commit 7111951b8d4973bda27ff663f2cf18b663d15b48 Author: Linus Torvalds Date: Sun Mar 29 15:25:41 2020 -0700 Linux 5.6 commit 570203ec830dd451b8804cdef8036f7fca9f0311 Merge: ab93e984dbb4 b943f045a9af Author: Linus Torvalds Date: Sun Mar 29 10:40:31 2020 -0700 Merge branch 'akpm' (patches from Andrew) Merge vm fixes from Andrew Morton: "5 fixes" * emailed patches from Andrew Morton : mm/sparse: fix kernel crash with pfn_section_valid check mm: fork: fix kernel_stack memcg stats for various stack implementations hugetlb_cgroup: fix illegal access to memory drivers/base/memory.c: indicate all memory blocks as removable mm/swapfile.c: move inode_lock out of claim_swapfile commit ab93e984dbb41578b41208cee52ce4e709951eb2 Merge: 01af08bd24ed 749da8ca978f Author: Linus Torvalds Date: Sun Mar 29 10:36:29 2020 -0700 Merge tag 'timers-urgent-2020-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single fix for the Hyper-V clocksource driver to make sched clock actually return nanoseconds and not the virtual clock value which increments at 10e7 HZ (100ns)" * tag 'timers-urgent-2020-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/hyper-v: Make sched clock return nanoseconds correctly commit 01af08bd24edf50b2d9e06f18df13cb8d0d645b7 Merge: e595dd94515e df81dfcfd699 Author: Linus Torvalds Date: Sun Mar 29 10:07:00 2020 -0700 Merge tag 'irq-urgent-2020-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A single bugfix to prevent reference leaks in irq affinity notifiers" * tag 'irq-urgent-2020-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Fix reference leaks on irq affinity notifiers commit b943f045a9af9fd02f923e43fe8d7517e9961701 Author: Aneesh Kumar K.V Date: Sat Mar 28 19:17:29 2020 -0700 mm/sparse: fix kernel crash with pfn_section_valid check Fix the crash like this: BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000000c3447c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries CPU: 11 PID: 7519 Comm: lt-ndctl Not tainted 5.6.0-rc7-autotest #1 ... NIP [c000000000c3447c] vmemmap_populated+0x98/0xc0 LR [c000000000088354] vmemmap_free+0x144/0x320 Call Trace: section_deactivate+0x220/0x240 __remove_pages+0x118/0x170 arch_remove_memory+0x3c/0x150 memunmap_pages+0x1cc/0x2f0 devm_action_release+0x30/0x50 release_nodes+0x2f8/0x3e0 device_release_driver_internal+0x168/0x270 unbind_store+0x130/0x170 drv_attr_store+0x44/0x60 sysfs_kf_write+0x68/0x80 kernfs_fop_write+0x100/0x290 __vfs_write+0x3c/0x70 vfs_write+0xcc/0x240 ksys_write+0x7c/0x140 system_call+0x5c/0x68 The crash is due to NULL dereference at test_bit(idx, ms->usage->subsection_map); due to ms->usage = NULL in pfn_section_valid() With commit d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") section_mem_map is set to NULL after depopulate_section_mem(). This was done so that pfn_page() can work correctly with kernel config that disables SPARSEMEM_VMEMMAP. With that config pfn_to_page does __section_mem_map_addr(__sec) + __pfn; where static inline struct page *__section_mem_map_addr(struct mem_section *section) { unsigned long map = section->section_mem_map; map &= SECTION_MAP_MASK; return (struct page *)map; } Now with SPASEMEM_VMEMAP enabled, mem_section->usage->subsection_map is used to check the pfn validity (pfn_valid()). Since section_deactivate release mem_section->usage if a section is fully deactivated, pfn_valid() check after a subsection_deactivate cause a kernel crash. static inline int pfn_valid(unsigned long pfn) { ... return early_section(ms) || pfn_section_valid(ms, pfn); } where static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); return test_bit(idx, ms->usage->subsection_map); } Avoid this by clearing SECTION_HAS_MEM_MAP when mem_section->usage is freed. For architectures like ppc64 where large pages are used for vmmemap mapping (16MB), a specific vmemmap mapping can cover multiple sections. Hence before a vmemmap mapping page can be freed, the kernel needs to make sure there are no valid sections within that mapping. Clearing the section valid bit before depopulate_section_memap enables this. [aneesh.kumar@linux.ibm.com: add comment] Link: http://lkml.kernel.org/r/20200326133235.343616-1-aneesh.kumar@linux.ibm.comLink: http://lkml.kernel.org/r/20200325031914.107660-1-aneesh.kumar@linux.ibm.com Fixes: d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") Reported-by: Sachin Sant Signed-off-by: Aneesh Kumar K.V Signed-off-by: Andrew Morton Tested-by: Sachin Sant Reviewed-by: Baoquan He Reviewed-by: Wei Yang Acked-by: Michal Hocko Acked-by: Pankaj Gupta Cc: Michael Ellerman Cc: Dan Williams Cc: David Hildenbrand Cc: Oscar Salvador Cc: Mike Rapoport Cc: Signed-off-by: Linus Torvalds commit 8380ce479010f2f779587b462a9b4681934297c3 Author: Roman Gushchin Date: Sat Mar 28 19:17:25 2020 -0700 mm: fork: fix kernel_stack memcg stats for various stack implementations Depending on CONFIG_VMAP_STACK and the THREAD_SIZE / PAGE_SIZE ratio the space for task stacks can be allocated using __vmalloc_node_range(), alloc_pages_node() and kmem_cache_alloc_node(). In the first and the second cases page->mem_cgroup pointer is set, but in the third it's not: memcg membership of a slab page should be determined using the memcg_from_slab_page() function, which looks at page->slab_cache->memcg_params.memcg . In this case, using mod_memcg_page_state() (as in account_kernel_stack()) is incorrect: page->mem_cgroup pointer is NULL even for pages charged to a non-root memory cgroup. It can lead to kernel_stack per-memcg counters permanently showing 0 on some architectures (depending on the configuration). In order to fix it, let's introduce a mod_memcg_obj_state() helper, which takes a pointer to a kernel object as a first argument, uses mem_cgroup_from_obj() to get a RCU-protected memcg pointer and calls mod_memcg_state(). It allows to handle all possible configurations (CONFIG_VMAP_STACK and various THREAD_SIZE/PAGE_SIZE values) without spilling any memcg/kmem specifics into fork.c . Note: This is a special version of the patch created for stable backports. It contains code from the following two patches: - mm: memcg/slab: introduce mem_cgroup_from_obj() - mm: fork: fix kernel_stack memcg stats for various stack implementations [guro@fb.com: introduce mem_cgroup_from_obj()] Link: http://lkml.kernel.org/r/20200324004221.GA36662@carbon.dhcp.thefacebook.com Fixes: 4d96ba353075 ("mm: memcg/slab: stop setting page->mem_cgroup pointer for slab pages") Signed-off-by: Roman Gushchin Signed-off-by: Andrew Morton Reviewed-by: Shakeel Butt Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Bharata B Rao Cc: Shakeel Butt Cc: Link: http://lkml.kernel.org/r/20200303233550.251375-1-guro@fb.com Signed-off-by: Linus Torvalds commit 726b7bbeafd4e0219c37b74673d368b21ff3d039 Author: Mina Almasry Date: Sat Mar 28 19:17:22 2020 -0700 hugetlb_cgroup: fix illegal access to memory This appears to be a mistake in commit faced7e0806cf ("mm: hugetlb controller for cgroups v2"). Essentially that commit does a hugetlb_cgroup_from_counter assuming that page_counter_try_charge has initialized counter. But if that has failed then it seems will not initialize counter, so hugetlb_cgroup_from_counter(counter) ends up pointing to random memory, causing kasan to complain. The solution is to simply use 'h_cg', instead of hugetlb_cgroup_from_counter(counter), since that is a reference to the hugetlb_cgroup anyway. After this change kasan ceases to complain. Fixes: faced7e0806cf ("mm: hugetlb controller for cgroups v2") Reported-by: syzbot+cac0c4e204952cf449b1@syzkaller.appspotmail.com Signed-off-by: Mina Almasry Signed-off-by: Andrew Morton Acked-by: Giuseppe Scrivano Acked-by: Tejun Heo Cc: Mike Kravetz Cc: David Rientjes Link: http://lkml.kernel.org/r/20200313223920.124230-1-almasrymina@google.com Signed-off-by: Linus Torvalds commit 53cdc1cb29e87ce5a61de5bb393eb08925d14ede Author: David Hildenbrand Date: Sat Mar 28 19:17:19 2020 -0700 drivers/base/memory.c: indicate all memory blocks as removable We see multiple issues with the implementation/interface to compute whether a memory block can be offlined (exposed via /sys/devices/system/memory/memoryX/removable) and would like to simplify it (remove the implementation). 1. It runs basically lockless. While this might be good for performance, we see possible races with memory offlining that will require at least some sort of locking to fix. 2. Nowadays, more false positives are possible. No arch-specific checks are performed that validate if memory offlining will not be denied right away (and such check will require locking). For example, arm64 won't allow to offline any memory block that was added during boot - which will imply a very high error rate. Other archs have other constraints. 3. The interface is inherently racy. E.g., if a memory block is detected to be removable (and was not a false positive at that time), there is still no guarantee that offlining will actually succeed. So any caller already has to deal with false positives. 4. It is unclear which performance benefit this interface actually provides. The introducing commit 5c755e9fd813 ("memory-hotplug: add sysfs removable attribute for hotplug memory remove") mentioned "A user-level agent must be able to identify which sections of memory are likely to be removable before attempting the potentially expensive operation." However, no actual performance comparison was included. Known users: - lsmem: Will group memory blocks based on the "removable" property. [1] - chmem: Indirect user. It has a RANGE mode where one can specify removable ranges identified via lsmem to be offlined. However, it also has a "SIZE" mode, which allows a sysadmin to skip the manual "identify removable blocks" step. [2] - powerpc-utils: Uses the "removable" attribute to skip some memory blocks right away when trying to find some to offline+remove. However, with ballooning enabled, it already skips this information completely (because it once resulted in many false negatives). Therefore, the implementation can deal with false positives properly already. [3] According to Nathan Fontenot, DLPAR on powerpc is nowadays no longer driven from userspace via the drmgr command (powerpc-utils). Nowadays it's managed in the kernel - including onlining/offlining of memory blocks - triggered by drmgr writing to /sys/kernel/dlpar. So the affected legacy userspace handling is only active on old kernels. Only very old versions of drmgr on a new kernel (unlikely) might execute slower - totally acceptable. With CONFIG_MEMORY_HOTREMOVE, always indicating "removable" should not break any user space tool. We implement a very bad heuristic now. Without CONFIG_MEMORY_HOTREMOVE we cannot offline anything, so report "not removable" as before. Original discussion can be found in [4] ("[PATCH RFC v1] mm: is_mem_section_removable() overhaul"). Other users of is_mem_section_removable() will be removed next, so that we can remove is_mem_section_removable() completely. [1] http://man7.org/linux/man-pages/man1/lsmem.1.html [2] http://man7.org/linux/man-pages/man8/chmem.8.html [3] https://github.com/ibm-power-utilities/powerpc-utils [4] https://lkml.kernel.org/r/20200117105759.27905-1-david@redhat.com Also, this patch probably fixes a crash reported by Steve. http://lkml.kernel.org/r/CAPcyv4jpdaNvJ67SkjyUJLBnBnXXQv686BiVW042g03FUmWLXw@mail.gmail.com Reported-by: "Scargall, Steve" Suggested-by: Michal Hocko Signed-off-by: David Hildenbrand Signed-off-by: Andrew Morton Reviewed-by: Nathan Fontenot Acked-by: Michal Hocko Cc: Dan Williams Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Badari Pulavarty Cc: Robert Jennings Cc: Heiko Carstens Cc: Karel Zak Cc: Link: http://lkml.kernel.org/r/20200128093542.6908-1-david@redhat.com Signed-off-by: Linus Torvalds commit d795a90e2ba024dbf2f22107ae89c210b98b08b8 Author: Naohiro Aota Date: Sat Mar 28 19:17:15 2020 -0700 mm/swapfile.c: move inode_lock out of claim_swapfile claim_swapfile() currently keeps the inode locked when it is successful, or the file is already swapfile (with -EBUSY). And, on the other error cases, it does not lock the inode. This inconsistency of the lock state and return value is quite confusing and actually causing a bad unlock balance as below in the "bad_swap" section of __do_sys_swapon(). This commit fixes this issue by moving the inode_lock() and IS_SWAPFILE check out of claim_swapfile(). The inode is unlocked in "bad_swap_unlock_inode" section, so that the inode is ensured to be unlocked at "bad_swap". Thus, error handling codes after the locking now jumps to "bad_swap_unlock_inode" instead of "bad_swap". ===================================== WARNING: bad unlock balance detected! 5.5.0-rc7+ #176 Not tainted ------------------------------------- swapon/4294 is trying to release lock (&sb->s_type->i_mutex_key) at: __do_sys_swapon+0x94b/0x3550 but there are no more locks to release! other info that might help us debug this: no locks held by swapon/4294. stack backtrace: CPU: 5 PID: 4294 Comm: swapon Not tainted 5.5.0-rc7-BTRFS-ZNS+ #176 Hardware name: ASUS All Series/H87-PRO, BIOS 2102 07/29/2014 Call Trace: dump_stack+0xa1/0xea print_unlock_imbalance_bug.cold+0x114/0x123 lock_release+0x562/0xed0 up_write+0x2d/0x490 __do_sys_swapon+0x94b/0x3550 __x64_sys_swapon+0x54/0x80 do_syscall_64+0xa4/0x4b0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f15da0a0dc7 Fixes: 1638045c3677 ("mm: set S_SWAPFILE on blockdev swap devices") Signed-off-by: Naohiro Aota Signed-off-by: Andrew Morton Tested-by: Qais Youef Reviewed-by: Andrew Morton Reviewed-by: Darrick J. Wong Cc: Christoph Hellwig Cc: Link: http://lkml.kernel.org/r/20200206090132.154869-1-naohiro.aota@wdc.com Signed-off-by: Linus Torvalds commit e595dd94515ed6bc5ba38fce0f9598db8c0ee9a9 Merge: 906c40438bb6 a0ba26f37ea0 Author: Linus Torvalds Date: Sat Mar 28 18:55:15 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix memory leak in vti6, from Torsten Hilbrich. 2) Fix double free in xfrm_policy_timer, from YueHaibing. 3) NL80211_ATTR_CHANNEL_WIDTH attribute is put with wrong type, from Johannes Berg. 4) Wrong allocation failure check in qlcnic driver, from Xu Wang. 5) Get ks8851-ml IO operations right, for real this time, from Marek Vasut. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (22 commits) r8169: fix PHY driver check on platforms w/o module softdeps net: ks8851-ml: Fix IO operations, again mlxsw: spectrum_mr: Fix list iteration in error path qlcnic: Fix bad kzalloc null test mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX mac80211: mark station unauthorized before key removal mac80211: Check port authorization in the ieee80211_tx_dequeue() case cfg80211: Do not warn on same channel at the end of CSA mac80211: drop data frames without key on encrypted links ieee80211: fix HE SPR size calculation nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type xfrm: policy: Fix doulbe free in xfrm_policy_timer bpf: Explicitly memset some bpf info structures declared on the stack bpf: Explicitly memset the bpf_attr structure bpf: Sanitize the bpf_struct_ops tcp-cc name vti6: Fix memory leak of skb if input policy check fails esp: remove the skb from the chain when it's enqueued in cryptd_wq ipv6: xfrm6_tunnel.c: Use built-in RCU list checking xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire xfrm: fix uctx len check in verify_sec_ctx_len ... commit 906c40438bb669b253d0daeaf5f37a9f78a81b41 Merge: 83fd69c93340 14c1fe699cad Author: Linus Torvalds Date: Sat Mar 28 13:11:26 2020 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Three more driver bugfixes, and two doc improvements fixing build warnings while we are here" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: pca-platform: Use platform_irq_get_optional i2c: st: fix missing struct parameter description i2c: nvidia-gpu: Handle timeout correctly in gpu_i2c_check_status() i2c: fix a doc warning i2c: hix5hd2: add missed clk_disable_unprepare in remove commit 83fd69c93340177dcd66fd26ce6441fb581c1dbf Merge: 69c5eea3128e ea697a8bf5a4 Author: Linus Torvalds Date: Sat Mar 28 09:14:16 2020 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two small fixes: one in drivers (qla2xxx), and one in the core (sd) to try to cope with USB enclosures that silently change reported parameters" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Fix optimal I/O size for devices that change reported values scsi: qla2xxx: Fix I/Os being passed down when FC device is being deleted commit 14c1fe699cad9cb0acda4559c584f136d18fea50 Author: Chris Packham Date: Fri Mar 27 11:44:22 2020 +1300 i2c: pca-platform: Use platform_irq_get_optional The interrupt is not required so use platform_irq_get_optional() to avoid error messages like i2c-pca-platform 22080000.i2c: IRQ index 0 not found Signed-off-by: Chris Packham Signed-off-by: Wolfram Sang commit f491c6687332920e296d0209e366fe2ca7eab1c6 Author: Alain Volmat Date: Thu Mar 26 22:22:43 2020 +0100 i2c: st: fix missing struct parameter description Fix a missing struct parameter description to allow warning free W=1 compilation. Signed-off-by: Alain Volmat Reviewed-by: Patrice Chotard Signed-off-by: Wolfram Sang commit a0ba26f37ea04e025a793ef5e5ac809221728ecb Merge: 2e8c339b4946 5c6f25887963 Author: David S. Miller Date: Fri Mar 27 16:18:51 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2020-03-27 The following pull-request contains BPF updates for your *net* tree. We've added 3 non-merge commits during the last 4 day(s) which contain a total of 4 files changed, 25 insertions(+), 20 deletions(-). The main changes are: 1) Explicitly memset the bpf_attr structure on bpf() syscall to avoid having to rely on compiler to do so. Issues have been noticed on some compilers with padding and other oddities where the request was then unexpectedly rejected, from Greg Kroah-Hartman. 2) Sanitize the bpf_struct_ops TCP congestion control name in order to avoid problematic characters such as whitespaces, from Martin KaFai Lau. ==================== Signed-off-by: David S. Miller commit 2e8c339b4946490a922a21aa8cd869c6cfad2023 Author: Heiner Kallweit Date: Fri Mar 27 17:33:32 2020 +0100 r8169: fix PHY driver check on platforms w/o module softdeps On Android/x86 the module loading infrastructure can't deal with softdeps. Therefore the check for presence of the Realtek PHY driver module fails. mdiobus_register() will try to load the PHY driver module, therefore move the check to after this call and explicitly check that a dedicated PHY driver is bound to the PHY device. Fixes: f32593773549 ("r8169: check that Realtek PHY driver module is loaded") Reported-by: Chih-Wei Huang Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit e00dd941ff9fa6ed920da5ead95d2598170fe4ea Merge: 8262e6f9b103 4c59406ed003 Author: David S. Miller Date: Fri Mar 27 14:56:55 2020 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2020-03-27 1) Handle NETDEV_UNREGISTER for xfrm device to handle asynchronous unregister events cleanly. From Raed Salem. 2) Fix vti6 tunnel inter address family TX through bpf_redirect(). From Nicolas Dichtel. 3) Fix lenght check in verify_sec_ctx_len() to avoid a slab-out-of-bounds. From Xin Long. 4) Add a missing verify_sec_ctx_len check in xfrm_add_acquire to avoid a possible out-of-bounds to access. From Xin Long. 5) Use built-in RCU list checking of hlist_for_each_entry_rcu to silence false lockdep warning in __xfrm6_tunnel_spi_lookup when CONFIG_PROVE_RCU_LIST is enabled. From Madhuparna Bhowmik. 6) Fix a panic on esp offload when crypto is done asynchronously. From Xin Long. 7) Fix a skb memory leak in an error path of vti6_rcv. From Torsten Hilbrich. 8) Fix a race that can lead to a doulbe free in xfrm_policy_timer. From Xin Long. ==================== Signed-off-by: David S. Miller commit 69c5eea3128e775fd3c70ecf0098105d96dee330 Merge: 32db9f10d52c ededa081ed20 Author: Linus Torvalds Date: Fri Mar 27 14:34:03 2020 -0700 Merge branch 'parisc-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parsic fix from Helge Deller: "Fix a recursive loop when running 'make ARCH=parisc defconfig'" * 'parisc-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix defconfig selection commit 32db9f10d52c97ffc407c7dad81c6fafcad730b2 Merge: 823846c31071 c8042d1e5cb3 Author: Linus Torvalds Date: Fri Mar 27 13:52:32 2020 -0700 Merge tag 'arm-soc-fixes-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM DT and driver fixes from Arnd Bergmann: "For the devicetree files, there are a total of 20 patches, almost entirely for 32-bit machines: - The Allwinner/sun9i r40 SoC dtsi file contains a number of issues, both for correctness and for style that are addressed in separate patches. This causes most of the changed lines of the DT updates this time. - More Allwinner updates fixing the identification of the security system on sun8i/A33, a recent regression of the A83t ethernet, and a few board specific issues on the TBS-A711 macine. - Several bug fixes for OMAP dts files, most notably fixing the timings for the NAND flash on the Nokia N900 that regressed a while ago after the move to configuring them from DT. Some other OMAPs now set the correct dma limits on the L3 bus, and a regression fix addresses lost Ethernet on dm814x - One incorrect setting in the newly added Raspberry Pi Zero W that may cause issues with the SD card controller. - A missing property on the bcm2835 firmware node caused incorrect DMA settings. - An old bug on the oxnas platform causing spurious interrupts is finally addressed. - A regression on the Exynos Midas board broke the OLED panel power supply. - The i.MX6 phycore SoM specified the wrong voltage for the SoC, this is now set to the values from the datasheet. - Some 64-bit machines use a deprecated string to identify the PSCI firmware. There are also several small code fixes addressing mostly serious issues: - Fix the sunxi rsb bus access to no longer return incorrect data when mixing 8 and 16 bit I/O. - Fix a suspend/resume regression on the OMAP2+ lcdc from a missing quirk in the ti-sysc driver - Fix a NULL pointer access from a race in the fsl dpio driver - Fix a v5.5 regression in the exynos-chipid driver that caused an invalid error code probing the device on non-exynos platforms - Fix an out-of-bounds access in the AMD TEE driver" * tag 'arm-soc-fixes-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) soc: samsung: chipid: Fix return value on non-Exynos platforms arm64: dts: Fix leftover entry-methods for PSCI ARM: dts: exynos: Fix regulator node aliasing on Midas-based boards ARM: dts: oxnas: Fix clear-mask property ARM: dts: bcm283x: Fix vc4's firmware bus DMA limitations ARM: dts: omap5: Add bus_dma_limit for L3 bus ARM: dts: omap4-droid4: Fix lost touchscreen interrupts ARM: dts: dra7: Add bus_dma_limit for L3 bus ARM: bcm2835-rpi-zero-w: Add missing pinctrl name ARM: dts: sun8i: a33: add the new SS compatible dt-bindings: crypto: add new compatible for A33 SS ARM: dts: sun8i: r40: Move SPI device nodes based on address order ARM: dts: sun8i: r40: Fix register base address for SPI2 and SPI3 ARM: dts: sun8i: r40: Move AHCI device node based on address order ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage soc: fsl: dpio: register dpio irq handlers after dpio create tee: amdtee: out of bounds read in find_session() ARM: dts: N900: fix onenand timings bus: ti-sysc: Fix quirk flags for lcdc on am335x ARM: dts: Fix dm814x Ethernet by changing to use rgmii-id mode ... commit 823846c3107197b6eae9fb656a23e986926d6c07 Merge: bb36d37e29d4 2191b4f298fa Author: Linus Torvalds Date: Fri Mar 27 11:06:10 2020 -0700 Merge tag 'riscv-for-linus-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: "Sorry for the last minute patches, but a few things fell through the cracks recently. I was on the fence about sending a late pull request just for the M-mode fixes, as we don't really have any users, but the last patch fixes the build for Fedora which I consider pretty important. Given that the M-mode fixes should be very low risk, I figured it's worth sending them along as well. Thhis passes my standard 'boot in QEMU' test" * tag 'riscv-for-linus-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: Move all address space definition macros to one place RISC-V: Only select essential drivers for SOC_VIRT config riscv: fix the IPI missing issue in nommu mode riscv: uaccess should be used in nommu mode commit bb36d37e29d4e355fdffb4cd932cbb60e25e7e02 Merge: 1fa8cb0b7b11 e33a814e772c Author: Linus Torvalds Date: Fri Mar 27 11:02:52 2020 -0700 Merge tag 'devicetree-fixes-for-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fix from Rob Herring: "A single fix for building dtc with GCC 10" * tag 'devicetree-fixes-for-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: scripts/dtc: Remove redundant YYLOC global declaration commit 1fa8cb0b7b11f3bbfe799d73f351e44a441903ca Merge: 527630fbf4f1 6f5459da2b87 Author: Linus Torvalds Date: Fri Mar 27 10:50:31 2020 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Will Deacon: "Fix defconfig build when using Clang's integrated assembler" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: alternative: fix build with clang integrated assembler commit 527630fbf4f194c5d71e75b2d3cb3d2f406bc5d0 Merge: 7bf8df68cba0 8400ab889632 Author: Linus Torvalds Date: Fri Mar 27 09:33:48 2020 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A handful of clk driver fixes. Mostly they're around the i.MX drivers fixing the parents of a few clks and making KASAN happy with how the message passing code works. Besides that we have a TI driver fix for the RTC parent and a fix for the basic gate type registration functions introduced this release where they didn't actually pass the arguments in the right places to the multiplexer function down below" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: imx: Align imx sc clock parent msg structs to 4 clk: imx: Align imx sc clock msg structs to 4 clk: Pass correct arguments to __clk_hw_register_gate() clk: ti: am43xx: Fix clock parent for RTC clock clk: imx8mp: Correct the enet_qos parent clock clk: imx8mp: Correct IMX8MP_CLK_HDMI_AXI clock parent commit 7bf8df68cba0536479aead32297e47908922582c Merge: f3e69428b5e2 c4b979ebcafe Author: Linus Torvalds Date: Fri Mar 27 09:21:52 2020 -0700 Merge tag 'drm-fixes-2020-03-27' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Pretty quiet: some minor sg mapping fixes for 3 drivers, and a single oops fix for the scheduler. I'm hoping nobody tries to send me a fixes pull today but I'll keep an eye out of the weekend. radeon/amdgpu/dma-buf: - sg list fixes scheduler: - oops fix" * tag 'drm-fixes-2020-03-27' of git://anongit.freedesktop.org/drm/drm: drm/scheduler: fix rare NULL ptr race drm/radeon: fix scatter-gather mapping with user pages drm/amdgpu: fix scatter-gather mapping with user pages drm/prime: use dma length macro when mapping sg commit ededa081ed203165cea441fca706bdf358026bab Author: Helge Deller Date: Thu Mar 26 23:31:43 2020 +0100 parisc: Fix defconfig selection Fix the recursive loop when running "make ARCH=parisc defconfig". Fixes: 84669923e1ed ("parisc: Regenerate parisc defconfigs") Noticed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Helge Deller commit e33a814e772cdc36436c8c188d8c42d019fda639 Author: Dirk Mueller Date: Tue Jan 14 18:53:41 2020 +0100 scripts/dtc: Remove redundant YYLOC global declaration gcc 10 will default to -fno-common, which causes this error at link time: (.text+0x0): multiple definition of `yylloc'; dtc-lexer.lex.o (symbol from plugin):(.text+0x0): first defined here This is because both dtc-lexer as well as dtc-parser define the same global symbol yyloc. Before with -fcommon those were merged into one defintion. The proper solution would be to to mark this as "extern", however that leads to: dtc-lexer.l:26:16: error: redundant redeclaration of 'yylloc' [-Werror=redundant-decls] 26 | extern YYLTYPE yylloc; | ^~~~~~ In file included from dtc-lexer.l:24: dtc-parser.tab.h:127:16: note: previous declaration of 'yylloc' was here 127 | extern YYLTYPE yylloc; | ^~~~~~ cc1: all warnings being treated as errors which means the declaration is completely redundant and can just be dropped. Signed-off-by: Dirk Mueller Signed-off-by: David Gibson [robh: cherry-pick from upstream] Cc: stable@vger.kernel.org Signed-off-by: Rob Herring commit 749da8ca978f19710aba496208c480ad42d37f79 Author: Yubo Xie Date: Thu Mar 26 19:11:59 2020 -0700 clocksource/drivers/hyper-v: Make sched clock return nanoseconds correctly The sched clock read functions return the HV clock (100ns granularity) without converting it to nanoseconds. Add the missing conversion. Fixes: bd00cd52d5be ("clocksource/drivers/hyperv: Add Hyper-V specific sched clock function") Signed-off-by: Yubo Xie Signed-off-by: Tianyu Lan Signed-off-by: Thomas Gleixner Reviewed-by: Vitaly Kuznetsov Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200327021159.31429-1-Tianyu.Lan@microsoft.com commit f3e69428b5e26b0851d7ef4c15859cffebf2b9de Merge: 9efcc4a12936 4134252ab7e2 Author: Linus Torvalds Date: Thu Mar 26 20:49:44 2020 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a fix to generate proper timestamps on key autorepeat events that were broken recently - a fix for Synaptics driver to only activate reduced reporting mode when explicitly requested - a new keycode for "selective screenshot" function - other assorted fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: fix stale timestamp on key autorepeat events Input: move the new KEY_SELECTIVE_SCREENSHOT keycode Input: avoid BIT() macro usage in the serio.h UAPI header Input: synaptics-rmi4 - set reduced reporting mode only when requested Input: synaptics - enable RMI on HP Envy 13-ad105ng Input: allocate keycode for "Selective Screenshot" key Input: tm2-touchkey - add support for Coreriver TC360 variant dt-bindings: input: add Coreriver TC360 binding dt-bindings: vendor-prefixes: Add Coreriver vendor prefix Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger() commit 8262e6f9b1034ede34548a04dec4c302d92c9497 Author: Marek Vasut Date: Wed Mar 25 15:25:47 2020 +0100 net: ks8851-ml: Fix IO operations, again This patch reverts 58292104832f ("net: ks8851-ml: Fix 16-bit IO operation") and edacb098ea9c ("net: ks8851-ml: Fix 16-bit data access"), because it turns out these were only necessary due to buggy hardware. This patch adds a check for such a buggy hardware to prevent any such mistakes again. While working further on the KS8851 driver, it came to light that the KS8851-16MLL is capable of switching bus endianness by a hardware strap, EESK pin. If this strap is incorrect, the IO accesses require such endian swapping as is being reverted by this patch. Such swapping also impacts the performance significantly. Hence, in addition to removing it, detect that the hardware is broken, report to user, and fail to bind with such hardware. Fixes: 58292104832f ("net: ks8851-ml: Fix 16-bit IO operation") Fixes: edacb098ea9c ("net: ks8851-ml: Fix 16-bit data access") Signed-off-by: Marek Vasut Cc: David S. Miller Cc: Lukas Wunner Cc: Petr Stetiar Cc: YueHaibing Signed-off-by: David S. Miller commit c4b979ebcafe978338cad1df4c77cdc8f84bd51c Merge: 5117c363eb21 3c0fdf3302cb Author: Dave Airlie Date: Fri Mar 27 13:03:17 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-03-26' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-03-26: Scheduler: - Fix a race condition that could result in a segfault Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200326144538.3937-1-alexander.deucher@amd.com commit 5117c363eb213d5503f5b7e39c9bfafd46388184 Merge: 16fbf79b0f83 47f7826c520e Author: Dave Airlie Date: Fri Mar 27 12:33:13 2020 +1000 Merge tag 'drm-misc-fixes-2020-03-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.6: - SG fixes for prime, radeon and amdgpu. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/ef10e822-76dd-125d-ec1f-9a78c5f76bc3@linux.intel.com commit 2191b4f298fa360f2d1d967c2c7db565bea2c32e Author: Atish Patra Date: Thu Mar 26 15:55:46 2020 -0700 RISC-V: Move all address space definition macros to one place We get the following compilation error if CONFIG_SPARSEMEM_VMEMMAP is set. --------------------------------------------------------------- ./arch/riscv/include/asm/pgtable-64.h: In function ‘pud_page’: ./include/asm-generic/memory_model.h:54:29: error: ‘vmemmap’ undeclared (first use in this function); did you mean ‘mem_map’? #define __pfn_to_page(pfn) (vmemmap + (pfn)) ^~~~~~~ ./include/asm-generic/memory_model.h:82:21: note: in expansion of macro ‘__pfn_to_page’ #define pfn_to_page __pfn_to_page ^~~~~~~~~~~~~ ./arch/riscv/include/asm/pgtable-64.h:70:9: note: in expansion of macro ‘pfn_to_page’ return pfn_to_page(pud_val(pud) >> _PAGE_PFN_SHIFT); --------------------------------------------------------------- Fix the compliation errors by moving all the address space definition macros before including pgtable-64.h. Fixes: 8ad8b72721d0 (riscv: Add KASAN support) Signed-off-by: Atish Patra Reviewed-by: Anup Patel Signed-off-by: Palmer Dabbelt commit 4134252ab7e2c339a54302b88496cb5a89cdbaec Author: Dmitry Torokhov Date: Wed Mar 25 10:57:54 2020 -0700 Input: fix stale timestamp on key autorepeat events We need to refresh timestamp when emitting key autorepeat events, otherwise they will carry timestamp of the original key press event. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206929 Fixes: 3b51c44bd693 ("Input: allow drivers specify timestamp for input events") Cc: stable@vger.kernel.org Reported-by: teika kazura Tested-by: teika kazura Signed-off-by: Dmitry Torokhov commit 9efcc4a129363187c9bf15338692f107c5c9b6f0 Author: David Howells Date: Thu Mar 26 15:24:07 2020 +0000 afs: Fix unpinned address list during probing When it's probing all of a fileserver's interfaces to find which one is best to use, afs_do_probe_fileserver() takes a lock on the server record and notes the pointer to the address list. It doesn't, however, pin the address list, so as soon as it drops the lock, there's nothing to stop the address list from being freed under us. Fix this by taking a ref on the address list inside the locked section and dropping it at the end of the function. Fixes: 3bf0fb6f33dd ("afs: Probe multiple fileservers simultaneously") Signed-off-by: David Howells Reviewed-by: Marc Dionne Signed-off-by: Linus Torvalds commit 60268940cd15491be6db4503d6f74f27fb38ae42 Merge: a53071bd3401 c8d6ee01449c Author: Linus Torvalds Date: Thu Mar 26 15:44:41 2020 -0700 Merge tag 'ceph-for-5.6-rc8' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A patch for a rather old regression in fullness handling and two memory leak fixes, marked for stable" * tag 'ceph-for-5.6-rc8' of git://github.com/ceph/ceph-client: ceph: fix memory leak in ceph_cleanup_snapid_map() libceph: fix alloc_msg_with_page_vector() memory leaks ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL commit a53071bd340171d258ddaf3f3c951708044ff455 Merge: 23cb8490c0d3 e1be9ac8e601 Author: Linus Torvalds Date: Thu Mar 26 15:30:49 2020 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "x86 bug fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: X86: Narrow down the IPI fastpath to single target IPI KVM: LAPIC: Also cancel preemption timer when disarm LAPIC timer KVM: VMX: don't allow memory operands for inline asm that modifies SP KVM: LAPIC: Mark hrtimer for period or oneshot mode to expire in hard interrupt context KVM: SVM: Issue WBINVD after deactivating an SEV guest KVM: SVM: document KVM_MEM_ENCRYPT_OP, let userspace detect if SEV is available KVM: x86: remove bogus user-triggerable WARN_ON commit 23cb8490c0d34b74b7548b60541758efe9754948 Author: Linus Torvalds Date: Thu Mar 26 15:12:19 2020 -0700 MAINTAINERS: fix bad file pattern Testing 'parse-maintainers' due to the previous commit shows a bad file pattern for the "TI VPE/CAL DRIVERS" entry in the MAINTAINERS file. There's also a lot of mis-ordered entries, but I'm still a bit nervous about the inevitable and annoying merge problems it would probably cause to fix them up. The MAINTAINERS file is one of my least favorite files due to being huge and centralized, but fixing it is also horribly painful for that reason. Signed-off-by: Linus Torvalds commit 5cdbec108fd21a605e0c6e96e7faddd01e78047d Author: Joe Perches Date: Sat Mar 7 18:59:05 2020 -0800 parse-maintainers: Do not sort section content by default Add an --order switch to control section reordering. Default for --order is off. Change the default ordering to a slightly more sensible: M: Person acting as a maintainer R: Person acting as a patch reviewer L: Mailing list where patches should be sent S: Maintenance status W: URI for general information Q: URI for patchwork tracking B: URI for bug tracking/submission C: URI for chat P: URI or file for subsystem specific coding styles T: SCM tree type and location F: File and directory pattern X: File and directory exclusion pattern N: File glob K: Keyword - patch content regex Signed-off-by: Joe Perches Signed-off-by: Linus Torvalds commit fbf66796a0aedbaea248c7ade1459ccd0dd4cb44 Author: Dmitry Torokhov Date: Thu Mar 26 12:54:02 2020 -0700 Input: move the new KEY_SELECTIVE_SCREENSHOT keycode We should try to keep keycodes sequential unless there is a reason to leave a gap in numbering, so let's move it from 0x280 to 0x27a while we still can. Fixes: 3b059da9835c ("Input: allocate keycode for Selective Screenshot key") Acked-by: Rajat Jain Link: https://lore.kernel.org/r/20200326182711.GA259753@dtor-ws Signed-off-by: Dmitry Torokhov commit bd6f20333c6794e8b06f5ee963bfa5943e65cc86 Author: Anup Patel Date: Tue Mar 10 17:29:25 2020 +0530 RISC-V: Only select essential drivers for SOC_VIRT config The kconfig select causes build failues for SOC_VIRT config becaus we are selecting lot of VIRTIO drivers without selecting all required dependencies. Better approach is to only select essential drivers from SOC_VIRT config option and enable required VIRTIO drivers using defconfigs. Fixes: 759bdc168181 ("RISC-V: Add kconfig option for QEMU virt machine") Signed-off-by: Anup Patel Acked-by: Michael S. Tsirkin Signed-off-by: Palmer Dabbelt commit 328f5bb9939dc32152ae025cf5c476b4380b6215 Merge: f6bf1bafdc21 b95d2ccd2ccb Author: David S. Miller Date: Thu Mar 26 12:03:02 2020 -0700 Merge tag 'mac80211-for-net-2020-03-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== We have the following fixes: * drop data packets if there's no key for them anymore, after there had been one, to avoid sending them in clear when hostapd removes the key before it removes the station and the packets are still queued * check port authorization again after dequeue, to avoid sending packets if the station is no longer authorized * actually remove the authorization flag before the key so packets are also dropped properly because of this * fix nl80211 control port packet tagging to handle them as packets allowed to go out without encryption * fix NL80211_ATTR_CHANNEL_WIDTH outgoing netlink attribute width (should be 32 bits, not 8) * don't WARN in a CSA scenario that happens on some APs * fix HE spatial reuse element size calculation ==================== Signed-off-by: David S. Miller commit f6bf1bafdc2152bb22aff3a4e947f2441a1d49e2 Author: Ido Schimmel Date: Thu Mar 26 16:17:33 2020 +0200 mlxsw: spectrum_mr: Fix list iteration in error path list_for_each_entry_from_reverse() iterates backwards over the list from the current position, but in the error path we should start from the previous position. Fix this by using list_for_each_entry_continue_reverse() instead. This suppresses the following error from coccinelle: drivers/net/ethernet/mellanox/mlxsw//spectrum_mr.c:655:34-38: ERROR: invalid reference to the index variable of the iterator on line 636 Fixes: c011ec1bbfd6 ("mlxsw: spectrum: Add the multicast routing offloading logic") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit bcaeb886ade124331a6f3a5cef34a3f1484c0a03 Author: Xu Wang Date: Thu Mar 26 18:14:29 2020 +0800 qlcnic: Fix bad kzalloc null test In qlcnic_83xx_get_reset_instruction_template, the variable of null test is bad, so correct it. Signed-off-by: Xu Wang Signed-off-by: David S. Miller commit 9420e8ade4353a6710908ffafa23ecaf1caa0123 Merge: 1b649e0bcae7 ba80013fba65 Author: Linus Torvalds Date: Thu Mar 26 10:39:36 2020 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "A small set of late-rc patches, mostly fixes for various crashers, some syzkaller fixes and a mlx5 HW limitation: - Several MAINTAINERS updates - Memory leak regression in ODP - Several fixes for syzkaller related crashes. Google recently taught syzkaller to create the software RDMA devices - Crash fixes for HFI1 - Several fixes for mlx5 crashes - Prevent unprivileged access to an unsafe mlx5 HW resource" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/mlx5: Block delay drop to unprivileged users RDMA/mlx5: Fix access to wrong pointer while performing flush due to error RDMA/core: Ensure security pkey modify is not lost MAINTAINERS: Clean RXE section and add Zhu as RXE maintainer IB/hfi1: Ensure pq is not left on waitlist IB/rdmavt: Free kernel completion queue when done RDMA/mad: Do not crash if the rdma device does not have a umad interface RDMA/core: Fix missing error check on dev_set_name() RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET RDMA/mlx5: Fix the number of hwcounters of a dynamic counter MAINTAINERS: Update maintainers for HISILICON ROCE DRIVER RDMA/odp: Fix leaking the tgid for implicit ODP commit b95d2ccd2ccb834394d50347d0e40dc38a954e4a Author: Johannes Berg Date: Thu Mar 26 15:53:34 2020 +0100 mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX When a frame is transmitted via the nl80211 TX rather than as a normal frame, IEEE80211_TX_CTRL_PORT_CTRL_PROTO wasn't set and this will lead to wrong decisions (rate control etc.) being made about the frame; fix this. Fixes: 911806491425 ("mac80211: Add support for tx_control_port") Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200326155333.f183f52b02f0.I4054e2a8c11c2ddcb795a0103c87be3538690243@changeid Signed-off-by: Johannes Berg commit b16798f5b907733966fd1a558fca823b3c67e4a1 Author: Johannes Berg Date: Thu Mar 26 15:51:35 2020 +0100 mac80211: mark station unauthorized before key removal If a station is still marked as authorized, mark it as no longer so before removing its keys. This allows frames transmitted to it to be rejected, providing additional protection against leaking plain text data during the disconnection flow. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200326155133.ccb4fb0bb356.If48f0f0504efdcf16b8921f48c6d3bb2cb763c99@changeid Signed-off-by: Johannes Berg commit ce2e1ca703071723ca2dd94d492a5ab6d15050da Author: Jouni Malinen Date: Thu Mar 26 15:51:34 2020 +0100 mac80211: Check port authorization in the ieee80211_tx_dequeue() case mac80211 used to check port authorization in the Data frame enqueue case when going through start_xmit(). However, that authorization status may change while the frame is waiting in a queue. Add a similar check in the dequeue case to avoid sending previously accepted frames after authorization change. This provides additional protection against potential leaking of frames after a station has been disconnected and the keys for it are being removed. Cc: stable@vger.kernel.org Signed-off-by: Jouni Malinen Link: https://lore.kernel.org/r/20200326155133.ced84317ea29.I34d4c47cd8cc8a4042b38a76f16a601fbcbfd9b3@changeid Signed-off-by: Johannes Berg commit 05dcb8bb258575a8dd3499d0d78bd2db633c2b23 Author: Ilan Peer Date: Thu Mar 26 15:09:43 2020 +0200 cfg80211: Do not warn on same channel at the end of CSA When cfg80211_update_assoc_bss_entry() is called, there is a verification that the BSS channel actually changed. As some APs use CSA also for bandwidth changes, this would result with a kernel warning. Fix this by removing the WARN_ON(). Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200326150855.96316ada0e8d.I6710376b1b4257e5f4712fc7ab16e2b638d512aa@changeid Signed-off-by: Johannes Berg commit a0761a301746ec2d92d7fcb82af69c0a6a4339aa Author: Johannes Berg Date: Thu Mar 26 15:09:42 2020 +0200 mac80211: drop data frames without key on encrypted links If we know that we have an encrypted link (based on having had a key configured for TX in the past) then drop all data frames in the key selection handler if there's no key anymore. This fixes an issue with mac80211 internal TXQs - there we can buffer frames for an encrypted link, but then if the key is no longer there when they're dequeued, the frames are sent without encryption. This happens if a station is disconnected while the frames are still on the TXQ. Detecting that a link should be encrypted based on a first key having been configured for TX is fine as there are no use cases for a connection going from with encryption to no encryption. With extended key IDs, however, there is a case of having a key configured for only decryption, so we can't just trigger this behaviour on a key being configured. Cc: stable@vger.kernel.org Reported-by: Jouni Malinen Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200326150855.6865c7f28a14.I9fb1d911b064262d33e33dfba730cdeef83926ca@changeid Signed-off-by: Johannes Berg commit 3c0fdf3302cb4f186c871684eac5c407a107e480 Author: Yintian Tao Date: Mon Mar 23 19:19:37 2020 +0800 drm/scheduler: fix rare NULL ptr race There is one one corner case at dma_fence_signal_locked which will raise the NULL pointer problem just like below. ->dma_fence_signal ->dma_fence_signal_locked ->test_and_set_bit here trigger dma_fence_release happen due to the zero of fence refcount. ->dma_fence_put ->dma_fence_release ->drm_sched_fence_release_scheduled ->call_rcu here make the union fled “cb_list” at finished fence to NULL because struct rcu_head contains two pointer which is same as struct list_head cb_list Therefore, to hold the reference of finished fence at drm_sched_process_job to prevent the null pointer during finished fence dma_fence_signal [ 732.912867] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 732.914815] #PF: supervisor write access in kernel mode [ 732.915731] #PF: error_code(0x0002) - not-present page [ 732.916621] PGD 0 P4D 0 [ 732.917072] Oops: 0002 [#1] SMP PTI [ 732.917682] CPU: 7 PID: 0 Comm: swapper/7 Tainted: G OE 5.4.0-rc7 #1 [ 732.918980] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 [ 732.920906] RIP: 0010:dma_fence_signal_locked+0x3e/0x100 [ 732.938569] Call Trace: [ 732.939003] [ 732.939364] dma_fence_signal+0x29/0x50 [ 732.940036] drm_sched_fence_finished+0x12/0x20 [gpu_sched] [ 732.940996] drm_sched_process_job+0x34/0xa0 [gpu_sched] [ 732.941910] dma_fence_signal_locked+0x85/0x100 [ 732.942692] dma_fence_signal+0x29/0x50 [ 732.943457] amdgpu_fence_process+0x99/0x120 [amdgpu] [ 732.944393] sdma_v4_0_process_trap_irq+0x81/0xa0 [amdgpu] v2: hold the finished fence at drm_sched_process_job instead of amdgpu_fence_process v3: resume the blank line Signed-off-by: Yintian Tao Reviewed-by: Christian König Signed-off-by: Alex Deucher commit e1be9ac8e6014a9b0a216aebae7250f9863e9fc3 Author: Wanpeng Li Date: Thu Mar 26 10:20:01 2020 +0800 KVM: X86: Narrow down the IPI fastpath to single target IPI The original single target IPI fastpath patch forgot to filter the ICR destination shorthand field. Multicast IPI is not suitable for this feature since wakeup the multiple sleeping vCPUs will extend the interrupt disabled time, it especially worse in the over-subscribe and VM has a little bit more vCPUs scenario. Let's narrow it down to single target IPI. Two VMs, each is 76 vCPUs, one running 'ebizzy -M', the other running cyclictest on all vCPUs, w/ this patch, the avg score of cyclictest can improve more than 5%. (pv tlb, pv ipi, pv sched yield are disabled during testing to avoid the disturb). Signed-off-by: Wanpeng Li Message-Id: <1585189202-1708-3-git-send-email-wanpengli@tencent.com> Signed-off-by: Paolo Bonzini commit 8400ab8896324641243b57fc49b448023c07409a Author: Leonard Crestez Date: Thu Feb 20 18:29:33 2020 +0200 clk: imx: Align imx sc clock parent msg structs to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y. Fix by marking with __aligned(4). Fixes: 666aed2d13ee ("clk: imx: scu: add set parent support") Signed-off-by: Leonard Crestez Link: https://lkml.kernel.org/r/aad021e432b3062c142973d09b766656eec18fde.1582216144.git.leonard.crestez@nxp.com Signed-off-by: Stephen Boyd commit a0ae04a25650fd51b7106e742d27333e502173c6 Author: Leonard Crestez Date: Thu Feb 20 18:29:32 2020 +0200 clk: imx: Align imx sc clock msg structs to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y. Fix by marking with __aligned(4). Fixes: fe37b4820417 ("clk: imx: add scu clock common part") Signed-off-by: Leonard Crestez Link: https://lkml.kernel.org/r/10e97a04980d933b2cfecb6b124bf9046b6e4f16.1582216144.git.leonard.crestez@nxp.com Signed-off-by: Stephen Boyd commit 4e934301203648b1705360c1c52d4ce2e2acec5e Author: Stephen Boyd Date: Tue Mar 24 19:22:57 2020 -0700 clk: Pass correct arguments to __clk_hw_register_gate() I copy/pasted these macros and forgot to update the argument names and where they're passed to. Fix it so that these macros make sense. Reported-by: Maxime Ripard Fixes: 194efb6e2667 ("clk: gate: Add support for specifying parents via DT/pointers") Signed-off-by: Stephen Boyd Link: https://lkml.kernel.org/r/20200325022257.148244-1-sboyd@kernel.org Tested-by: Maxime Ripard commit 1b649e0bcae71c118c1333e02249a7510ba7f70a Merge: 1dfb642b1015 2910594fd38d Author: Linus Torvalds Date: Wed Mar 25 13:58:05 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix deadlock in bpf_send_signal() from Yonghong Song. 2) Fix off by one in kTLS offload of mlx5, from Tariq Toukan. 3) Add missing locking in iwlwifi mvm code, from Avraham Stern. 4) Fix MSG_WAITALL handling in rxrpc, from David Howells. 5) Need to hold RTNL mutex in tcindex_partial_destroy_work(), from Cong Wang. 6) Fix producer race condition in AF_PACKET, from Willem de Bruijn. 7) cls_route removes the wrong filter during change operations, from Cong Wang. 8) Reject unrecognized request flags in ethtool netlink code, from Michal Kubecek. 9) Need to keep MAC in reset until PHY is up in bcmgenet driver, from Doug Berger. 10) Don't leak ct zone template in act_ct during replace, from Paul Blakey. 11) Fix flushing of offloaded netfilter flowtable flows, also from Paul Blakey. 12) Fix throughput drop during tx backpressure in cxgb4, from Rahul Lakkireddy. 13) Don't let a non-NULL skb->dev leave the TCP stack, from Eric Dumazet. 14) TCP_QUEUE_SEQ socket option has to update tp->copied_seq as well, also from Eric Dumazet. 15) Restrict macsec to ethernet devices, from Willem de Bruijn. 16) Fix reference leak in some ethtool *_SET handlers, from Michal Kubecek. 17) Fix accidental disabling of MSI for some r8169 chips, from Heiner Kallweit. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (138 commits) net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build net: ena: Add PCI shutdown handler to allow safe kexec selftests/net/forwarding: define libs as TEST_PROGS_EXTENDED selftests/net: add missing tests to Makefile r8169: re-enable MSI on RTL8168c net: phy: mdio-bcm-unimac: Fix clock handling cxgb4/ptp: pass the sign of offset delta in FW CMD net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop net: cbs: Fix software cbs to consider packet sending time net/mlx5e: Do not recover from a non-fatal syndrome net/mlx5e: Fix ICOSQ recovery flow with Striding RQ net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset net/mlx5e: Enhance ICOSQ WQE info fields net/mlx5_core: Set IB capability mask1 to fix ib_srpt connection failure selftests: netfilter: add nfqueue test case netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress netfilter: nft_fwd_netdev: validate family and chain type netfilter: nft_set_rbtree: Detect partial overlaps on insertion netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion ... commit 1dfb642b10158b45068102402decc3bcf853cb76 Merge: e2cf67f6689a 0c625ccfe6f7 Author: Linus Torvalds Date: Wed Mar 25 13:52:36 2020 -0700 Merge tag 'gpio-v5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: - One core quirk by myself to fix the .irq_disable() semantics when the gpiolib core takes over this callback. - The rest is an elaborate series of four patches fixing Intel laptop ACPI wakeup quirks. * tag 'gpio-v5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk gpiolib: Fix irq_disable() semantics commit 2910594fd38d1cb3c32fbf235e6c6228c780ab87 Merge: 2c64605b590e 0433ae556ec8 Author: David S. Miller Date: Wed Mar 25 13:12:26 2020 -0700 Merge tag 'wireless-drivers-2020-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.6 Fourth, and last, set of fixes for v5.6. Just two important fixes to iwlwifi regressions. iwlwifi * fix GEO_TX_POWER_LIMIT command on certain devices which caused firmware to crash during initialisation * add back device ids for three devices which were accidentally removed ==================== Signed-off-by: David S. Miller commit 2c64605b590edadb3fb46d1ec6badb49e940b479 Author: Pablo Neira Ayuso Date: Wed Mar 25 13:47:18 2020 +0100 net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build net/netfilter/nft_fwd_netdev.c: In function ‘nft_fwd_netdev_eval’: net/netfilter/nft_fwd_netdev.c:32:10: error: ‘struct sk_buff’ has no member named ‘tc_redirected’ pkt->skb->tc_redirected = 1; ^~ net/netfilter/nft_fwd_netdev.c:33:10: error: ‘struct sk_buff’ has no member named ‘tc_from_ingress’ pkt->skb->tc_from_ingress = 1; ^~ To avoid a direct dependency with tc actions from netfilter, wrap the redirect bits around CONFIG_NET_REDIRECT and move helpers to include/linux/skbuff.h. Turn on this toggle from the ifb driver, the only existing client of these bits in the tree. This patch adds skb_set_redirected() that sets on the redirected bit on the skbuff, it specifies if the packet was redirect from ingress and resets the timestamp (timestamp reset was originally missing in the netfilter bugfix). Fixes: bcfabee1afd99484 ("netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress") Reported-by: noreply@ellerman.id.au Reported-by: Geert Uytterhoeven Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 428c491332bca498c8eb2127669af51506c346c7 Author: Guilherme G. Piccoli Date: Fri Mar 20 09:55:34 2020 -0300 net: ena: Add PCI shutdown handler to allow safe kexec Currently ENA only provides the PCI remove() handler, used during rmmod for example. This is not called on shutdown/kexec path; we are potentially creating a failure scenario on kexec: (a) Kexec is triggered, no shutdown() / remove() handler is called for ENA; instead pci_device_shutdown() clears the master bit of the PCI device, stopping all DMA transactions; (b) Kexec reboot happens and the device gets enabled again, likely having its FW with that DMA transaction buffered; then it may trigger the (now invalid) memory operation in the new kernel, corrupting kernel memory area. This patch aims to prevent this, by implementing a shutdown() handler quite similar to the remove() one - the difference being the handling of the netdev, which is unregistered on remove(), but following the convention observed in other drivers, it's only detached on shutdown(). This prevents an odd issue in AWS Nitro instances, in which after the 2nd kexec the next one will fail with an initrd corruption, caused by a wild DMA write to invalid kernel memory. The lspci output for the adapter present in my instance is: 00:05.0 Ethernet controller [0200]: Amazon.com, Inc. Elastic Network Adapter (ENA) [1d0f:ec20] Suggested-by: Gavin Shan Signed-off-by: Guilherme G. Piccoli Acked-by: Sameeh Jubran Signed-off-by: David S. Miller commit c085dbfb1cfcf74e2ef2ef435291e7e63f046d6a Author: Hangbin Liu Date: Wed Mar 25 16:41:01 2020 +0800 selftests/net/forwarding: define libs as TEST_PROGS_EXTENDED The lib files should not be defined as TEST_PROGS, or we will run them in run_kselftest.sh. Also remove ethtool_lib.sh exec permission. Fixes: 81573b18f26d ("selftests/net/forwarding: add Makefile to install tests") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 919a23e9d6ccf8b30e6b4c7aa36f8904c99d2dd7 Author: Hangbin Liu Date: Wed Mar 25 16:07:01 2020 +0800 selftests/net: add missing tests to Makefile Find some tests are missed in Makefile by running: for file in $(ls *.sh); do grep -q $file Makefile || echo $file; done Signed-off-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: David S. Miller commit e2cf67f6689a218b4d8e606e90a12491a9cfa366 Merge: 76ccd234269b ccf4ad7da0d9 Author: Linus Torvalds Date: Wed Mar 25 10:34:02 2020 -0700 Merge tag 'zonefs-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: "A single fix from me to correctly handle the size of read-only zone files" * tag 'zonefs-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonfs: Fix handling of read-only zones commit 47f7826c520ecd92ffbffe59ecaa2fe61e42ec70 Author: Shane Francis Date: Wed Mar 25 09:07:41 2020 +0000 drm/radeon: fix scatter-gather mapping with user pages Calls to dma_map_sg may return less segments / entries than requested if they fall on page bounderies. The old implementation did not support this use case. Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206461 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206895 Bug: https://gitlab.freedesktop.org/drm/amd/issues/1056 Signed-off-by: Shane Francis Reviewed-by: Michael J. Ruhl Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200325090741.21957-4-bigbeeshane@gmail.com Cc: stable@vger.kernel.org commit 0199172f933342d8b1011aae2054a695c25726f4 Author: Shane Francis Date: Wed Mar 25 09:07:40 2020 +0000 drm/amdgpu: fix scatter-gather mapping with user pages Calls to dma_map_sg may return less segments / entries than requested if they fall on page bounderies. The old implementation did not support this use case. Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206461 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206895 Bug: https://gitlab.freedesktop.org/drm/amd/issues/1056 Signed-off-by: Shane Francis Reviewed-by: Michael J. Ruhl Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200325090741.21957-3-bigbeeshane@gmail.com Cc: stable@vger.kernel.org commit 42e67b479eab6d26459b80b4867298232b0435e7 Author: Shane Francis Date: Wed Mar 25 09:07:39 2020 +0000 drm/prime: use dma length macro when mapping sg As dma_map_sg can reorganize scatter-gather lists in a way that can cause some later segments to be empty we should always use the sg_dma_len macro to fetch the actual length. This could now be 0 and not need to be mapped to a page or address array Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206461 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206895 Bug: https://gitlab.freedesktop.org/drm/amd/issues/1056 Signed-off-by: Shane Francis Reviewed-by: Michael J. Ruhl Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200325090741.21957-2-bigbeeshane@gmail.com Cc: stable@vger.kernel.org commit c8042d1e5cb3e654b47447229ace3cd092a8fc27 Author: Marek Szyprowski Date: Mon Mar 16 18:56:52 2020 +0100 soc: samsung: chipid: Fix return value on non-Exynos platforms Correct the probe return value to -ENODEV on non-Exynos platforms. Link: https://lore.kernel.org/r/20200316175652.5604-4-krzk@kernel.org Fixes: 02fb29882d5c ("soc: samsung: chipid: Drop "syscon" compatible requirement") Cc: Signed-off-by: Marek Szyprowski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Arnd Bergmann commit 47039b55f8e2002baa7c00f35a7fd11361a8726c Merge: a88fead83e0d 36fa3e50085e Author: Arnd Bergmann Date: Wed Mar 25 13:52:50 2020 +0100 Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes tee: amdtee: out of bounds read in find_session() * tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: out of bounds read in find_session() Link: https://lore.kernel.org/r/20200320063446.GA9892@jade Signed-off-by: Arnd Bergmann commit a88fead83e0db632180a717930aff5fa2e401024 Merge: 94bb9d185854 deeabb4c1341 Author: Arnd Bergmann Date: Wed Mar 25 13:51:02 2020 +0100 Merge tag 'oxnas-arm-soc-dt-fixes-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/narmstrong/linux-oxnas into arm/fixes - interrupt controller mask init fix to avoid spurious irq after soft reset * tag 'oxnas-arm-soc-dt-fixes-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/narmstrong/linux-oxnas: ARM: dts: oxnas: Fix clear-mask property Link: https://lore.kernel.org/r/1cc83d6b-78de-9160-59bf-77cfe726a365@baylibre.com Signed-off-by: Arnd Bergmann commit 94bb9d185854d0accf89f0679f92ff4918f6c767 Merge: 9b631649c436 55c7c0621078 Author: Arnd Bergmann Date: Wed Mar 25 13:49:47 2020 +0100 Merge tag 'arm-soc/for-5.6/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 5.6, please pull the following: - Nick fixes the missing pinctrl-names property for the Raspberry Pi Zero Wireless DTS - Nicolas fixes the VC4 firmware node dma-range property which does not have the limitations of the soc's bus node * tag 'arm-soc/for-5.6/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux: ARM: dts: bcm283x: Fix vc4's firmware bus DMA limitations ARM: bcm2835-rpi-zero-w: Add missing pinctrl name Link: https://lore.kernel.org/r/20200323025246.22713-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 9b631649c43672cb7093103b5e8efa4553b952a5 Author: Linus Walleij Date: Sun Mar 22 12:58:46 2020 +0100 arm64: dts: Fix leftover entry-methods for PSCI These two device trees were either missed or added after the commit correcting the "entry-method" from "arm,psci" to just "psci" as per the binding. Link: https://lore.kernel.org/r/20200322115846.16265-1-linus.walleij@linaro.org Cc: Sudeep Holla Cc: Fabio Estevam Cc: Shawn Guo Cc: Chunyan Zhang Reviewed-by: Amit Kucheria Signed-off-by: Linus Walleij Reviewed-by: Sudeep Holla Signed-off-by: Arnd Bergmann commit ae6e45986a67a5d296eb6ef52619ca06e590bfaf Merge: 05ff1e3fb850 dfa7ea303f56 Author: Arnd Bergmann Date: Wed Mar 25 13:46:38 2020 +0100 Merge tag 'omap-for-v5.6/fixes-rc6-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Few more fixes for omaps Just few dts fixes: - A fix droid4 touchscreen stopping working with lost gpio interrupts - Also limit omap5 dma range similar to what we've recently done for dra7 * tag 'omap-for-v5.6/fixes-rc6-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: omap5: Add bus_dma_limit for L3 bus ARM: dts: omap4-droid4: Fix lost touchscreen interrupts ARM: dts: dra7: Add bus_dma_limit for L3 bus ARM: dts: N900: fix onenand timings ARM: dts: Fix dm814x Ethernet by changing to use rgmii-id mode Link: https://lore.kernel.org/r/pull-1584575254-461940@atomide.com Signed-off-by: Arnd Bergmann commit 05ff1e3fb850c667b9b0fd3e44c6f439baa77a64 Author: Marek Szyprowski Date: Mon Mar 16 18:37:10 2020 +0100 ARM: dts: exynos: Fix regulator node aliasing on Midas-based boards Commit d4ec0cb05064 ("ARM: dts: exynos: Add support for the touch-sensitive buttons on Midas family") added a new fixed regulator ("voltage-regulator-6") to base "midas" .dtsi, but it didn't update the clients of that .dtsi, which define their own fixed regulators starting from the "voltage-regulator-6". This results in aliasing of the regulator dt nodes and breaks operation of OLED panel due to lack of power supply. Fix this by increasing the numbers in the fixed regulator names for those boards. Link: https://lore.kernel.org/r/20200316173710.3144-1-krzk@kernel.org Fixes: d4ec0cb05064 ("ARM: dts: exynos: Add support for the touch-sensitive buttons on Midas family") Signed-off-by: Marek Szyprowski Reviewed-by: Denis 'GNUtoo' Carikli Signed-off-by: Krzysztof Kozlowski Signed-off-by: Arnd Bergmann commit ad5d7a551345c5b3dc9fab8db038d4c6518c7c82 Merge: d2687b896dab 636b45b8efa9 Author: Arnd Bergmann Date: Wed Mar 25 13:45:31 2020 +0100 Merge tag 'imx-fixes-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.6, round 2: - Fix minimum voltage setting of vdd_arm and vdd_soc on i.MX6 phycore-som board. * tag 'imx-fixes-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage Link: https://lore.kernel.org/r/20200316032555.GD17221@dragon Signed-off-by: Arnd Bergmann commit ba80013fba656b9830ef45cd40a6a1e44707f47a Author: Maor Gottlieb Date: Sun Mar 22 14:49:06 2020 +0200 RDMA/mlx5: Block delay drop to unprivileged users It has been discovered that this feature can globally block the RX port, so it should be allowed for highly privileged users only. Fixes: 03404e8ae652("IB/mlx5: Add support to dropless RQ") Link: https://lore.kernel.org/r/20200322124906.1173790-1-leon@kernel.org Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit d2687b896dabe32ff4630dd4359e4d8ecf31b8cf Merge: aafd017347ea 00cef5e404a6 Author: Arnd Bergmann Date: Wed Mar 25 13:42:10 2020 +0100 Merge tag 'sunxi-fixes-for-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner Fixes for 5.6 - part 2 This follows up on the previous 5.6 fixes tag with a fix for the A33 Security System (crypto offloading hardware). The hardware was found to not be compatible with existing hardware and a new compatible was needed. The driver change was picked up right before the previous -rc6 and the DT bindings and DT changes were not picked up. The goal is to have all the changes in the same release, that is v5.6. * tag 'sunxi-fixes-for-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sun8i: a33: add the new SS compatible dt-bindings: crypto: add new compatible for A33 SS Link: https://lore.kernel.org/r/20200313060727.GA23962@wens.csie.org Signed-off-by: Arnd Bergmann commit aafd017347eaedd953002dfba7f39ae486228222 Merge: 8b45e9d9c05d d9b553b02e69 Author: Arnd Bergmann Date: Wed Mar 25 13:41:01 2020 +0100 Merge tag 'sunxi-fixes-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner Fixes for v5.6 A pretty normal set of fixes for v5.6: - Fix reversed macros used for A83T EMAC clock and reset - Fix camera regulator voltage and USB OTG for TBS-A711 - 16-bit / 8-bit mixed read fix for our RSB driver - Fix SPI controller base address for R40 - Reorder device nodes based on base address for R40 * tag 'sunxi-fixes-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sun8i: r40: Move SPI device nodes based on address order ARM: dts: sun8i: r40: Fix register base address for SPI2 and SPI3 ARM: dts: sun8i: r40: Move AHCI device node based on address order bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads ARM: dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage ARM: dts: sun8i: a83t: Fix incorrect clk and reset macros for EMAC device Link: https://lore.kernel.org/r/20200313055233.GA19649@wens.csie.org Signed-off-by: Arnd Bergmann commit 8b45e9d9c05df5d7eb4ed460534fc554751505df Merge: 2c523b344dfa fe8fe7723a3a Author: Arnd Bergmann Date: Wed Mar 25 13:40:21 2020 +0100 Merge tag 'soc-fsl-fix-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux into arm/fixes NXP/FSL soc driver fixes for v5.6 DPAA2 DPIO - Fix a kernel hang caused by irq requested before creating dpio * tag 'soc-fsl-fix-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux: soc: fsl: dpio: register dpio irq handlers after dpio create Link: https://lore.kernel.org/r/20200312202525.16708-1-leoyang.li@nxp.com Signed-off-by: Arnd Bergmann commit 575a97acc3b7446094b0dcaf6285c7c6934c2477 Author: Johannes Berg Date: Wed Mar 25 09:09:19 2020 +0100 ieee80211: fix HE SPR size calculation The he_sr_control field is just a u8, so le32_to_cpu() shouldn't be applied to it; this was evidently copied from ieee80211_he_oper_size(). Fix it, and also adjust the type of the local variable. Fixes: ef11a931bd1c ("mac80211: HE: add Spatial Reuse element parsing support") Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200325090918.dfe483b49e06.Ia53622f23b2610a2ae6ea39a199866196fe946c1@changeid Signed-off-by: Johannes Berg commit 0016d3201753b59f3ae84b868fe66c86ad256f19 Author: Johannes Berg Date: Wed Mar 25 09:05:32 2020 +0100 nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type The new opmode notification used this attribute with a u8, when it's documented as a u32 and indeed used in userspace as such, it just happens to work on little-endian systems since userspace isn't doing any strict size validation, and the u8 goes into the lower byte. Fix this. Cc: stable@vger.kernel.org Fixes: 466b9936bf93 ("cfg80211: Add support to notify station's opmode change to userspace") Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200325090531.be124f0a11c7.Iedbf4e197a85471ebd729b186d5365c0343bf7a8@changeid Signed-off-by: Johannes Berg commit ea697a8bf5a4161e59806fab14f6e4a46dc7dcb0 Author: Martin K. Petersen Date: Tue Mar 24 11:16:15 2020 -0400 scsi: sd: Fix optimal I/O size for devices that change reported values Some USB bridge devices will return a default set of characteristics during initialization. And then, once an attached drive has spun up, substitute the actual parameters reported by the drive. According to the SCSI spec, the device should return a UNIT ATTENTION in case any reported parameters change. But in this case the change is made silently after a small window where default values are reported. Commit a83da8a4509d ("scsi: sd: Optimal I/O size should be a multiple of physical block size") validated the reported optimal I/O size against the physical block size to overcome problems with devices reporting nonsensical transfer sizes. However, this validation did not account for the fact that aforementioned devices will return default values during a brief window during spin-up. The subsequent change in reported characteristics would invalidate the checking that had previously been performed. Unset a previously configured optimal I/O size should the sanity checking fail on subsequent revalidate attempts. Link: https://lore.kernel.org/r/33fb522e-4f61-1b76-914f-c9e6a3553c9b@gmail.com Cc: Bryan Gurney Cc: Reported-by: Bernhard Sulzer Tested-by: Bernhard Sulzer Signed-off-by: Martin K. Petersen commit ccf4ad7da0d9c30a962a116cb55bcd7d8c44b0fe Author: Damien Le Moal Date: Fri Mar 20 21:36:54 2020 +0900 zonfs: Fix handling of read-only zones The write pointer of zones in the read-only consition is defined as invalid by the SCSI ZBC and ATA ZAC specifications. It is thus not possible to determine the correct size of a read-only zone file on mount. Fix this by handling read-only zones in the same manner as offline zones by disabling all accesses to the zone (read and write) and initializing the inode size of the read-only zone to 0). For zones found to be in the read-only condition at runtime, only disable write access to the zone and keep the size of the zone file to its last updated value to allow the user to recover previously written data. Also fix zonefs documentation file to reflect this change. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn commit 6f000f987832655e88ff885a1e695c2b8adcb5c5 Merge: 7e566df65278 a64d558d8cf9 Author: David S. Miller Date: Tue Mar 24 17:30:40 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) A new selftest for nf_queue, from Florian Westphal. This test covers two recent fixes: 07f8e4d0fddb ("tcp: also NULL skb->dev when copy was needed") and b738a185beaa ("tcp: ensure skb->dev is NULL before leaving TCP stack"). 2) The fwd action breaks with ifb. For safety in next extensions, make sure the fwd action only runs from ingress until it is extended to be used from a different hook. 3) The pipapo set type now reports EEXIST in case of subrange overlaps. Update the rbtree set to validate range overlaps, so far this validation is only done only from userspace. From Stefano Brivio. ==================== Signed-off-by: David S. Miller commit 7e566df6527883de0d660f0facec883d702a65cc Merge: f13bc68131b0 187a9830c921 Author: David S. Miller Date: Tue Mar 24 17:25:54 2020 -0700 Merge tag 'mlx5-fixes-2020-03-24' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2020-03-24 This series introduces some fixes to mlx5 driver. From Aya, Fixes to the RX error recovery flows From Leon, Fix IB capability mask Please pull and let me know if there is any problem. For -stable v5.5 ('net/mlx5_core: Set IB capability mask1 to fix ib_srpt connection failure') For -stable v5.4 ('net/mlx5e: Fix ICOSQ recovery flow with Striding RQ') ('net/mlx5e: Do not recover from a non-fatal syndrome') ('net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset') ('net/mlx5e: Enhance ICOSQ WQE info fields') The above patch ('net/mlx5e: Enhance ICOSQ WQE info fields') will fail to apply cleanly on v5.4 due to a trivial contextual conflict, but it is an important fix, do I need to do something about it or just assume Greg will know how to handle this ? ==================== Signed-off-by: David S. Miller commit f13bc68131b0c0d67a77fb43444e109828a983bf Author: Heiner Kallweit Date: Tue Mar 24 20:58:29 2020 +0100 r8169: re-enable MSI on RTL8168c The original change fixed an issue on RTL8168b by mimicking the vendor driver behavior to disable MSI on chip versions before RTL8168d. This however now caused an issue on a system with RTL8168c, see [0]. Therefore leave MSI disabled on RTL8168b, but re-enable it on RTL8168c. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1792839 Fixes: 003bd5b4a7b4 ("r8169: don't use MSI before RTL8168d") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit c312c7818b86b663d32ec5d4b512abf06b23899a Author: Andre Przywara Date: Tue Mar 24 16:10:10 2020 +0000 net: phy: mdio-bcm-unimac: Fix clock handling The DT binding for this PHY describes an *optional* clock property. Due to a bug in the error handling logic, we are actually ignoring this clock *all* of the time so far. Fix this by using devm_clk_get_optional() to handle this clock properly. Fixes: b78ac6ecd1b6b ("net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider") Signed-off-by: Andre Przywara Reviewed-by: Andrew Lunn Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 50e0d28d3808146cc19b0d5564ef4ba9e5bf3846 Author: Raju Rangoju Date: Tue Mar 24 17:10:00 2020 +0530 cxgb4/ptp: pass the sign of offset delta in FW CMD cxgb4_ptp_fineadjtime() doesn't pass the signedness of offset delta in FW_PTP_CMD. Fix it by passing correct sign. Signed-off-by: Raju Rangoju Signed-off-by: David S. Miller commit e80f40cbe4dd51371818e967d40da8fe305db5e4 Author: Vladimir Oltean Date: Tue Mar 24 11:45:34 2020 +0200 net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop Not only did this wheel did not need reinventing, but there is also an issue with it: It doesn't remove the VLAN header in a way that preserves the L2 payload checksum when that is being provided by the DSA master hw. It should recalculate checksum both for the push, before removing the header, and for the pull afterwards. But the current implementation is quite dizzying, with pulls followed immediately afterwards by pushes, the memmove is done before the push, etc. This makes a DSA master with RX checksumming offload to print stack traces with the infamous 'hw csum failure' message. So remove the dsa_8021q_remove_header function and replace it with something that actually works with inet checksumming. Fixes: d461933638ae ("net: dsa: tag_8021q: Create helper function for removing VLAN header") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 961d0e5b32946703125964f9f5b6321d60f4d706 Author: Zh-yuan Ye Date: Tue Mar 24 17:28:25 2020 +0900 net: cbs: Fix software cbs to consider packet sending time Currently the software CBS does not consider the packet sending time when depleting the credits. It caused the throughput to be Idleslope[kbps] * (Port transmit rate[kbps] / |Sendslope[kbps]|) where Idleslope * (Port transmit rate / (Idleslope + |Sendslope|)) = Idleslope is expected. In order to fix the issue above, this patch takes the time when the packet sending completes into account by moving the anchor time variable "last" ahead to the send completion time upon transmission and adding wait when the next dequeue request comes before the send completion time of the previous packet. changelog: V2->V3: - remove unnecessary whitespace cleanup - add the checks if port_rate is 0 before division V1->V2: - combine variable "send_completed" into "last" - add the comment for estimate of the packet sending Fixes: 585d763af09c ("net/sched: Introduce Credit Based Shaper (CBS) qdisc") Signed-off-by: Zh-yuan Ye Reviewed-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 52afa505a03d914081f40cb869a3248567a57573 Author: Eugene Syromiatnikov Date: Tue Mar 24 15:53:50 2020 -0700 Input: avoid BIT() macro usage in the serio.h UAPI header The commit 19ba1eb15a2a ("Input: psmouse - add a custom serio protocol to send extra information") introduced usage of the BIT() macro for SERIO_* flags; this macro is not provided in UAPI headers. Replace if with similarly defined _BITUL() macro defined in . Fixes: 19ba1eb15a2a ("Input: psmouse - add a custom serio protocol to send extra information") Signed-off-by: Eugene Syromiatnikov Cc: # v5.0+ Link: https://lore.kernel.org/r/20200324041341.GA32335@asgard.redhat.com Signed-off-by: Dmitry Torokhov commit 950bf4f17725556bbc773a5b71e88a6c14c9ff25 Author: Leon Romanovsky Date: Wed Mar 18 11:16:40 2020 +0200 RDMA/mlx5: Fix access to wrong pointer while performing flush due to error The main difference between send and receive SW completions is related to separate treatment of WQ queue. For receive completions, the initial index to be flushed is stored in "tail", while for send completions, it is in deleted "last_poll". CPU: 54 PID: 53405 Comm: kworker/u161:0 Kdump: loaded Tainted: G OE --------- -t - 4.18.0-147.el8.ppc64le #1 Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] NIP: c000003c7c00a000 LR: c00800000e586af4 CTR: c000003c7c00a000 REGS: c0000036cc9db940 TRAP: 0400 Tainted: G OE --------- -t - (4.18.0-147.el8.ppc64le) MSR: 9000000010009033 CR: 24004488 XER: 20040000 CFAR: c00800000e586af0 IRQMASK: 0 GPR00: c00800000e586ab4 c0000036cc9dbbc0 c00800000e5f1a00 c0000037d8433800 GPR04: c000003895a26800 c0000037293f2000 0000000000000201 0000000000000011 GPR08: c000003895a26c80 c000003c7c00a000 0000000000000000 c00800000ed30438 GPR12: c000003c7c00a000 c000003fff684b80 c00000000017c388 c00000396ec4be40 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: c00000000151e498 0000000000000010 c000003895a26848 0000000000000010 GPR24: 0000000000000010 0000000000010000 c000003895a26800 0000000000000000 GPR28: 0000000000000010 c0000037d8433800 c000003895a26c80 c000003895a26800 NIP [c000003c7c00a000] 0xc000003c7c00a000 LR [c00800000e586af4] __ib_process_cq+0xec/0x1b0 [ib_core] Call Trace: [c0000036cc9dbbc0] [c00800000e586ab4] __ib_process_cq+0xac/0x1b0 [ib_core] (unreliable) [c0000036cc9dbc40] [c00800000e586c88] ib_cq_poll_work+0x40/0xb0 [ib_core] [c0000036cc9dbc70] [c000000000171f44] process_one_work+0x2f4/0x5c0 [c0000036cc9dbd10] [c000000000172a0c] worker_thread+0xcc/0x760 [c0000036cc9dbdc0] [c00000000017c52c] kthread+0x1ac/0x1c0 [c0000036cc9dbe30] [c00000000000b75c] ret_from_kernel_thread+0x5c/0x80 Fixes: 8e3b68830186 ("RDMA/mlx5: Delete unreachable handle_atomic code by simplifying SW completion") Link: https://lore.kernel.org/r/20200318091640.44069-1-leon@kernel.org Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 2d47fbacf2725a67869f4d3634c2415e7dfab2f4 Author: Mike Marciniszyn Date: Fri Mar 13 08:47:05 2020 -0400 RDMA/core: Ensure security pkey modify is not lost The following modify sequence (loosely based on ipoib) will lose a pkey modifcation: - Modify (pkey index, port) - Modify (new pkey index, NO port) After the first modify, the qp_pps list will have saved the pkey and the unit on the main list. During the second modify, get_new_pps() will fetch the port from qp_pps and read the new pkey index from qp_attr->pkey_index. The state will still be zero, or IB_PORT_PKEY_NOT_VALID. Because of the invalid state, the new values will never replace the one in the qp pps list, losing the new pkey. This happens because the following if statements will never correct the state because the first term will be false. If the code had been executed, it would incorrectly overwrite valid values. if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) new_pps->main.state = IB_PORT_PKEY_VALID; if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { new_pps->main.port_num = qp_pps->main.port_num; new_pps->main.pkey_index = qp_pps->main.pkey_index; if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) new_pps->main.state = IB_PORT_PKEY_VALID; } Fix by joining the two if statements with an or test to see if qp_pps is non-NULL and in the correct state. Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") Link: https://lore.kernel.org/r/20200313124704.14982.55907.stgit@awfm-01.aw.intel.com Reviewed-by: Kaike Wan Signed-off-by: Mike Marciniszyn Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 1fa70778742d148ceaebae39c97683ef1607b482 Author: Leon Romanovsky Date: Thu Mar 12 10:36:58 2020 +0200 MAINTAINERS: Clean RXE section and add Zhu as RXE maintainer Zhu Yanjun contributed many patches to RXE and expressed genuine interest in improve RXE even more. Let's add him as a maintainer. Link: https://lore.kernel.org/r/20200312083658.29603-1-leon@kernel.org Signed-off-by: Leon Romanovsky Acked-by: Moni Shoua Signed-off-by: Jason Gunthorpe commit e4ad153ac8274291d21f13e98422821db4d590b9 Author: Andrew Duggan Date: Tue Mar 24 15:38:51 2020 -0700 Input: synaptics-rmi4 - set reduced reporting mode only when requested The previous patch "c5ccf2ad3d33 (Input: synaptics-rmi4 - switch to reduced reporting mode)" enabled reduced reporting mode unintentionally on some devices, if the firmware was configured with default Delta X/Y threshold values. The result unintentionally degrade the performance of some touchpads. This patch checks to see that the driver is modifying the delta X/Y thresholds before modifying the reporting mode. Signed-off-by: Andrew Duggan Fixes: c5ccf2ad3d33 ("Input: synaptics-rmi4 - switch to reduced reporting mode") Link: https://lore.kernel.org/r/20200312005549.29922-1-aduggan@synaptics.com Signed-off-by: Dmitry Torokhov commit 1369d0abe469fb4cdea8a5bce219d38cb857a658 Author: Yussuf Khalil Date: Sat Mar 7 14:16:31 2020 -0800 Input: synaptics - enable RMI on HP Envy 13-ad105ng This laptop (and perhaps other variants of the same model) reports an SMBus-capable Synaptics touchpad. Everything (including suspend and resume) works fine when RMI is enabled via the kernel command line, so let's add it to the whitelist. Signed-off-by: Yussuf Khalil Link: https://lore.kernel.org/r/20200307213508.267187-1-dev@pp3345.net Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 187a9830c921d92c4a9a8e2921ecc4b35a97532c Author: Aya Levin Date: Thu Mar 19 13:25:17 2020 +0200 net/mlx5e: Do not recover from a non-fatal syndrome For non-fatal syndromes like LOCAL_LENGTH_ERR, recovery shouldn't be triggered. In these scenarios, the RQ is not actually in ERR state. This misleads the recovery flow which assumes that the RQ is really in error state and no more completions arrive, causing crashes on bad page state. Fixes: 8276ea1353a4 ("net/mlx5e: Report and recover from CQE with error on RQ") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit e239c6d686e1c37fb2ab143162dfb57471a8643f Author: Aya Levin Date: Mon Mar 16 16:53:10 2020 +0200 net/mlx5e: Fix ICOSQ recovery flow with Striding RQ In striding RQ mode, the buffers of an RX WQE are first prepared and posted to the HW using a UMR WQEs via the ICOSQ. We maintain the state of these in-progress WQEs in the RQ SW struct. In the flow of ICOSQ recovery, the corresponding RQ is not in error state, hence: - The buffers of the in-progress WQEs must be released and the RQ metadata should reflect it. - Existing RX WQEs in the RQ should not be affected. For this, wrap the dealloc of the in-progress WQEs in a function, and use it in the ICOSQ recovery flow instead of mlx5e_free_rx_descs(). Fixes: be5323c8379f ("net/mlx5e: Report and recover from CQE error on ICOSQ") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 39369fd536d485a99a59d8e357c0d4d3ce19a3b8 Author: Aya Levin Date: Thu Mar 12 12:35:32 2020 +0200 net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset When resetting the RQ (moving RQ state from RST to RDY), the driver resets the WQ's SW metadata. In striding RQ mode, we maintain a field that reflects the actual expected WQ head (including in progress WQEs posted to the ICOSQ). It was mistakenly not reset together with the WQ. Fix this here. Fixes: 8276ea1353a4 ("net/mlx5e: Report and recover from CQE with error on RQ") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 1de0306c3a05d305e45b1f1fabe2f4e94222eb6b Author: Aya Levin Date: Mon Mar 9 09:44:18 2020 +0200 net/mlx5e: Enhance ICOSQ WQE info fields Add number of WQEBBs (WQE's Basic Block) to WQE info struct. Set the number of WQEBBs on WQE post, and increment the consumer counter (cc) on completion. In case of error completions, the cc was mistakenly not incremented, keeping a gap between cc and pc (producer counter). This failed the recovery flow on the ICOSQ from a CQE error which timed-out waiting for the cc and pc to meet. Fixes: be5323c8379f ("net/mlx5e: Report and recover from CQE error on ICOSQ") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 306f354c67397b3138300cde875c5cab45b857f7 Author: Leon Romanovsky Date: Mon Mar 16 09:31:03 2020 +0200 net/mlx5_core: Set IB capability mask1 to fix ib_srpt connection failure The cap_mask1 isn't protected by field_select and not listed among RW fields, but it is required to be written to properly initialize ports in IB virtualization mode. Link: https://lore.kernel.org/linux-rdma/88bab94d2fd72f3145835b4518bc63dda587add6.camel@redhat.com Fixes: ab118da4c10a ("net/mlx5: Don't write read-only fields in MODIFY_HCA_VPORT_CONTEXT command") Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit d944b27df121e2ee854a6c2fad13d6c6300792d4 Author: Kai-Heng Feng Date: Tue Mar 24 23:28:11 2020 +0800 i2c: nvidia-gpu: Handle timeout correctly in gpu_i2c_check_status() Nvidia card may come with a "phantom" UCSI device, and its driver gets stuck in probe routine, prevents any system PM operations like suspend. There's an unaccounted case that the target time can equal to jiffies in gpu_i2c_check_status(), let's solve that by using readl_poll_timeout() instead of jiffies comparison functions. Fixes: c71bcdcb42a7 ("i2c: add i2c bus driver for NVIDIA GPU") Suggested-by: Andy Shevchenko Signed-off-by: Kai-Heng Feng Reviewed-by: Andy Shevchenko Reviewed-by: Ajay Gupta Tested-by: Ajay Gupta Signed-off-by: Wolfram Sang commit a64d558d8cf98424cc5eb9ae6631782cd8bf789c Author: Florian Westphal Date: Mon Mar 23 17:34:30 2020 +0100 selftests: netfilter: add nfqueue test case Add a test case to check nf queue infrastructure. Could be extended in the future to also cover serialization of conntrack, uid and secctx attributes in nfqueue. For now, this checks that 'queue bypass' works, that a queue rule with no bypass option blocks traffic and that userspace receives the expected number of packets. For this we add two queues and hook all of prerouting/input/forward/output/postrouting. Packets get queued twice with a dummy base chain in between: This passes with current nf tree, but reverting commit 946c0d8e6ed4 ("netfilter: nf_queue: fix reinject verdict handling") makes this trip (it processes 30 instead of expected 20 packets). v2: update config file with queue and other options missing/needed for other tests. v3: also test with tcp, this reveals problem with commit 28f8bfd1ac94 ("netfilter: Support iif matches in POSTROUTING"), due to skb->dev pointing at another skb in the retransmit rbtree (skb->dev aliases to rbnode child). Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bcfabee1afd99484b6ba067361b8678e28bbc065 Author: Pablo Neira Ayuso Date: Mon Mar 23 19:53:10 2020 +0100 netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress Set skb->tc_redirected to 1, otherwise the ifb driver drops the packet. Set skb->tc_from_ingress to 1 to reinject the packet back to the ingress path after leaving the ifb egress path. This patch inconditionally sets on these two skb fields that are meaningful to the ifb driver. The existing forward action is guaranteed to run from ingress path. Fixes: 39e6dea28adc ("netfilter: nf_tables: add forward expression to the netdev family") Signed-off-by: Pablo Neira Ayuso commit 76a109fac206e158eb3c967af98c178cff738e6a Author: Pablo Neira Ayuso Date: Mon Mar 23 14:27:16 2020 +0100 netfilter: nft_fwd_netdev: validate family and chain type Make sure the forward action is only used from ingress. Fixes: 39e6dea28adc ("netfilter: nf_tables: add forward expression to the netdev family") Signed-off-by: Pablo Neira Ayuso commit 7c84d41416d836ef7e533bd4d64ccbdf40c5ac70 Author: Stefano Brivio Date: Sun Mar 22 03:22:01 2020 +0100 netfilter: nft_set_rbtree: Detect partial overlaps on insertion ...and return -ENOTEMPTY to the front-end in this case, instead of proceeding. Currently, nft takes care of checking for these cases and not sending them to the kernel, but if we drop the set_overlap() call in nft we can end up in situations like: # nft add table t # nft add set t s '{ type inet_service ; flags interval ; }' # nft add element t s '{ 1 - 5 }' # nft add element t s '{ 6 - 10 }' # nft add element t s '{ 4 - 7 }' # nft list set t s table ip t { set s { type inet_service flags interval elements = { 1-3, 4-5, 6-7 } } } This change has the primary purpose of making the behaviour consistent with nft_set_pipapo, but is also functional to avoid inconsistent behaviour if userspace sends overlapping elements for any reason. v2: When we meet the same key data in the tree, as start element while inserting an end element, or as end element while inserting a start element, actually check that the existing element is active, before resetting the overlap flag (Pablo Neira Ayuso) Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 6f7c9caf017be8ab0fe3b99509580d0793bf0833 Author: Stefano Brivio Date: Sun Mar 22 03:22:00 2020 +0100 netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() Replace negations of nft_rbtree_interval_end() with a new helper, nft_rbtree_interval_start(), wherever this helps to visualise the problem at hand, that is, for all the occurrences except for the comparison against given flags in __nft_rbtree_get(). This gets especially useful in the next patch. Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 0eb4b5ee33f2461d149408a247af8ae24756a6ca Author: Stefano Brivio Date: Sun Mar 22 03:21:59 2020 +0100 netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion ...and return -ENOTEMPTY to the front-end on collision, -EEXIST if an identical element already exists. Together with the previous patch, element collision will now be returned to the user as -EEXIST. Reported-by: Phil Sutter Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 8c2d45b2b65ca1f215244be1c600236e83f9815f Author: Pablo Neira Ayuso Date: Sun Mar 22 03:21:58 2020 +0100 netfilter: nf_tables: Allow set back-ends to report partial overlaps on insertion Currently, the -EEXIST return code of ->insert() callbacks is ambiguous: it might indicate that a given element (including intervals) already exists as such, or that the new element would clash with existing ones. If identical elements already exist, the front-end is ignoring this without returning error, in case NLM_F_EXCL is not set. However, if the new element can't be inserted due an overlap, we should report this to the user. To this purpose, allow set back-ends to return -ENOTEMPTY on collision with existing elements, translate that to -EEXIST, and return that to userspace, no matter if NLM_F_EXCL was set. Reported-by: Phil Sutter Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 76ccd234269bd05debdbc12c96eafe62dd9a6180 Merge: 3f3ee43a4623 564200ed8e71 Author: Linus Torvalds Date: Tue Mar 24 10:03:32 2020 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling fixes from Ingo Molnar: "A handful of tooling fixes all across the map, no kernel changes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tools headers uapi: Update linux/in.h copy perf probe: Do not depend on dwfl_module_addrsym() perf probe: Fix to delete multiple probe event perf parse-events: Fix reading of invalid memory in event parsing perf python: Fix clang detection when using CC=clang-version perf map: Fix off by one in strncpy() size argument tools: Let O= makes handle a relative path with -C option commit 3f3ee43a462344f6509bd15c988e39d330af91b3 Merge: c6ac7188c114 870b4333a62e Author: Linus Torvalds Date: Tue Mar 24 09:57:46 2020 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "A build fix with certain Kconfig combinations" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/ioremap: Fix CONFIG_EFI=n build commit c6ac7188c1142c450eb601563ad69204bf1e9286 Merge: 979e52ca0469 018af9be3dd5 Author: Linus Torvalds Date: Tue Mar 24 09:53:12 2020 -0700 Merge tag 'dmaengine-fix-5.6' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Late fixes in dmaengine for v5.6: - move .device_release missing log warning to debug - couple of maintainer entries for HiSilicon and IADX drivers - off-by-one fix for idxd driver - documentation warning fixes - TI k3 dma error handling fix" * tag 'dmaengine-fix-5.6' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: ti: k3-udma-glue: Fix an error handling path in 'k3_udma_glue_cfg_rx_flow()' MAINTAINERS: Add maintainer for HiSilicon DMA engine driver dmaengine: idxd: fix off by one on cdev dwq refcount MAINTAINERS: rectify the INTEL IADX DRIVER entry dmaengine: move .device_release missing log warning to debug level docs: dmaengine: provider.rst: get rid of some warnings commit 94be4b85d89520329f766c7d69a4d74bcc87f5b5 Author: Wanpeng Li Date: Tue Mar 24 14:32:10 2020 +0800 KVM: LAPIC: Also cancel preemption timer when disarm LAPIC timer The timer is disarmed when switching between TSC deadline and other modes, we should set everything to disarmed state, however, LAPIC timer can be emulated by preemption timer, it still works if vmx->hv_deadline_timer is not -1. This patch also cancels preemption timer when disarm LAPIC timer. Signed-off-by: Wanpeng Li Message-Id: <1585031530-19823-1-git-send-email-wanpengli@tencent.com> Signed-off-by: Paolo Bonzini commit 0c625ccfe6f754d0896b8881f5c85bcb81699f1f Author: Hans de Goede Date: Mon Mar 2 12:12:25 2020 +0100 gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model There are at least 3 models of the HP x2 10 models: Bay Trail SoC + AXP288 PMIC Cherry Trail SoC + AXP288 PMIC Cherry Trail SoC + TI PMIC Like on the other HP x2 10 models we need to ignore wakeup for ACPI GPIO events on the external embedded-controller pin to avoid spurious wakeups on the HP x2 10 CHT + AXP288 model too. This commit adds an extra DMI based quirk for the HP x2 10 CHT + AXP288 model, ignoring wakeups for ACPI GPIO events on the EC interrupt pin on this model. This fixes spurious wakeups from suspend on this model. Fixes: aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") Reported-and-tested-by: Marc Lehmann Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200302111225.6641-4-hdegoede@redhat.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 4c59406ed00379c8663f8663d82b2537467ce9d7 Author: YueHaibing Date: Mon Mar 23 15:32:39 2020 +0800 xfrm: policy: Fix doulbe free in xfrm_policy_timer After xfrm_add_policy add a policy, its ref is 2, then xfrm_policy_timer read_lock xp->walk.dead is 0 .... mod_timer() xfrm_policy_kill policy->walk.dead = 1 .... del_timer(&policy->timer) xfrm_pol_put //ref is 1 xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_pol_hold //ref is 1 read_unlock xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_policy_destroy is called twice, which may leads to double free. Call Trace: RIP: 0010:refcount_warn_saturate+0x161/0x210 ... xfrm_policy_timer+0x522/0x600 call_timer_fn+0x1b3/0x5e0 ? __xfrm_decode_session+0x2990/0x2990 ? msleep+0xb0/0xb0 ? _raw_spin_unlock_irq+0x24/0x40 ? __xfrm_decode_session+0x2990/0x2990 ? __xfrm_decode_session+0x2990/0x2990 run_timer_softirq+0x5c5/0x10e0 Fix this by use write_lock_bh in xfrm_policy_kill. Fixes: ea2dea9dacc2 ("xfrm: remove policy lock when accessing policy->walk.dead") Signed-off-by: YueHaibing Acked-by: Timo Teräs Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit 81573b18f26defe672a7d960f9af9ac2c97f324d Author: Vadym Kochan Date: Mon Mar 23 16:24:04 2020 +0200 selftests/net/forwarding: add Makefile to install tests Add missing Makefile for net/forwarding tests and include it to the targets list, otherwise forwarding tests are not installed in case of cross-compilation. Signed-off-by: Vadym Kochan Signed-off-by: David S. Miller commit 2f599ec422ad6634fb5ad43748b9969ca9d742bd Author: Michal Kubecek Date: Sun Mar 22 22:24:21 2020 +0100 ethtool: fix reference leak in some *_SET handlers Andrew noticed that some handlers for *_SET commands leak a netdev reference if required ethtool_ops callbacks do not exist. A simple reproducer would be e.g. ip link add veth1 type veth peer name veth2 ethtool -s veth1 wol g ip link del veth1 Make sure dev_put() is called when ethtool_ops check fails. v2: add Fixes tags Fixes: a53f3d41e4d3 ("ethtool: set link settings with LINKINFO_SET request") Fixes: bfbcfe2032e7 ("ethtool: set link modes related data with LINKMODES_SET request") Fixes: e54d04e3afea ("ethtool: set message mask with DEBUG_SET request") Fixes: 8d425b19b305 ("ethtool: set wake-on-lan settings with WOL_SET request") Reported-by: Andrew Lunn Signed-off-by: Michal Kubecek Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 0e62f543bed03a64495bd2651d4fe1aa4bcb7fe5 Author: Florian Fainelli Date: Sun Mar 22 13:58:50 2020 -0700 net: dsa: Fix duplicate frames flooded by learning When both the switch and the bridge are learning about new addresses, switch ports attached to the bridge would see duplicate ARP frames because both entities would attempt to send them. Fixes: 5037d532b83d ("net: dsa: add Broadcom tag RX/TX handler") Reported-by: Maxime Bizon Signed-off-by: Florian Fainelli Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller commit 39a8f2a88b0c04ff0f5db57ce5d44d36bcce1424 Merge: b06d072ccc4b 5d765a5e4bd7 Author: David S. Miller Date: Mon Mar 23 21:42:48 2020 -0700 Merge branch 'bnxt_en-Bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. 5 bug fix patches covering an indexing bug for priority counters, memory leak when retrieving DCB ETS settings, error path return code, proper disabling of PCI before freeing context memory, and proper ring accounting in error path. Please also apply these to -stable. Thanks. ==================== Signed-off-by: David S. Miller commit 5d765a5e4bd7c368e564e11402bba74cf7f03ac1 Author: Vasundhara Volam Date: Sun Mar 22 16:40:05 2020 -0400 bnxt_en: Reset rings if ring reservation fails during open() If ring counts are not reset when ring reservation fails, bnxt_init_dflt_ring_mode() will not be called again to reinitialise IRQs when open() is called and results in system crash as napi will also be not initialised. This patch fixes it by resetting the ring counts. Fixes: 47558acd56a7 ("bnxt_en: Reserve rings at driver open if none was reserved at probe time.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 62bfb932a51f6d08eb409248e69f8d6428c2cabd Author: Michael Chan Date: Sun Mar 22 16:40:04 2020 -0400 bnxt_en: Free context memory after disabling PCI in probe error path. Other shutdown code paths will always disable PCI first to shutdown DMA before freeing context memory. Do the same sequence in the error path of probe to be safe and consistent. Fixes: c20dc142dd7b ("bnxt_en: Disable bus master during PCI shutdown and driver unload.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0b5b561cea32d5bb1e0a82d65b755a3cb5212141 Author: Michael Chan Date: Sun Mar 22 16:40:03 2020 -0400 bnxt_en: Return error if bnxt_alloc_ctx_mem() fails. The current code ignores the return value from bnxt_hwrm_func_backing_store_cfg(), causing the driver to proceed in the init path even when this vital firmware call has failed. Fix it by propagating the error code to the caller. Fixes: 1b9394e5a2ad ("bnxt_en: Configure context memory on new devices.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 62d4073e86e62e316bea2c53e77db10418fd5dd7 Author: Edwin Peer Date: Sun Mar 22 16:40:02 2020 -0400 bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets() The allocated ieee_ets structure goes out of scope without being freed, leaking memory. Appropriate result codes should be returned so that callers do not rely on invalid data passed by reference. Also cache the ETS config retrieved from the device so that it doesn't need to be freed. The balance of the code was clearly written with the intent of having the results of querying the hardware cached in the device structure. The commensurate store was evidently missed though. Fixes: 7df4ae9fe855 ("bnxt_en: Implement DCBNL to support host-based DCBX.") Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit a24ec3220f369aa0b94c863b6b310685a727151c Author: Michael Chan Date: Sun Mar 22 16:40:01 2020 -0400 bnxt_en: Fix Priority Bytes and Packets counters in ethtool -S. There is an indexing bug in determining these ethtool priority counters. Instead of using the queue ID to index, we need to normalize by modulo 10 to get the index. This index is then used to obtain the proper CoS queue counter. Rename bp->pri2cos to bp->pri2cos_idx to make this more clear. Fixes: e37fed790335 ("bnxt_en: Add ethtool -S priority counters.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit b06d072ccc4b1acd0147b17914b7ad1caa1818bb Author: Willem de Bruijn Date: Sun Mar 22 13:51:13 2020 -0400 macsec: restrict to ethernet devices Only attach macsec to ethernet devices. Syzbot was able to trigger a KMSAN warning in macsec_handle_frame by attaching to a phonet device. Macvlan has a similar check in macvlan_port_create. v1->v2 - fix commit message typo Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit 55b474c41e586a5c21c7ab81ff474eb6bacb4322 Author: Michal Kubecek Date: Sat Mar 21 00:46:50 2020 +0100 netlink: check for null extack in cookie helpers Unlike NL_SET_ERR_* macros, nl_set_extack_cookie_u64() and nl_set_extack_cookie_u32() helpers do not check extack argument for null and neither do their callers, as syzbot recently discovered for ethnl_parse_header(). Instead of fixing the callers and leaving the trap in place, add check of null extack to both helpers to make them consistent with NL_SET_ERR_* macros. v2: drop incorrect second Fixes tag Fixes: 2363d73a2f3e ("ethtool: reject unrecognized request flags") Reported-by: syzbot+258a9089477493cea67b@syzkaller.appspotmail.com Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit 12a5ba5a1994568d4ceaff9e78c6b0329d953386 Author: Pawel Dembicki Date: Fri Mar 20 21:46:14 2020 +0100 net: qmi_wwan: add support for ASKEY WWHC050 ASKEY WWHC050 is a mcie LTE modem. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution. Signed-off-by: Cezary Jackiewicz Signed-off-by: Pawel Dembicki Acked-by: Bjørn Mork Signed-off-by: David S. Miller commit 0dcdf9f64028ec3b75db6b691560f8286f3898bf Author: Dan Carpenter Date: Fri Mar 20 16:21:17 2020 +0300 NFC: fdp: Fix a signedness bug in fdp_nci_send_patch() The nci_conn_max_data_pkt_payload_size() function sometimes returns -EPROTO so "max_size" needs to be signed for the error handling to work. We can make "payload_size" an int as well. Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit dddeb30bfc43926620f954266fd12c65a7206f07 Author: Qian Cai Date: Thu Mar 19 22:54:21 2020 -0400 ipv4: fix a RCU-list lock in inet_dump_fib() There is a place, inet_dump_fib() fib_table_dump fn_trie_dump_leaf() hlist_for_each_entry_rcu() without rcu_read_lock() will trigger a warning, WARNING: suspicious RCU usage ----------------------------- net/ipv4/fib_trie.c:2216 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/1923: #0: ffffffff8ce76e40 (rtnl_mutex){+.+.}, at: netlink_dump+0xd6/0x840 Call Trace: dump_stack+0xa1/0xea lockdep_rcu_suspicious+0x103/0x10d fn_trie_dump_leaf+0x581/0x590 fib_table_dump+0x15f/0x220 inet_dump_fib+0x4ad/0x5d0 netlink_dump+0x350/0x840 __netlink_dump_start+0x315/0x3e0 rtnetlink_rcv_msg+0x4d1/0x720 netlink_rcv_skb+0xf0/0x220 rtnetlink_rcv+0x15/0x20 netlink_unicast+0x306/0x460 netlink_sendmsg+0x44b/0x770 __sys_sendto+0x259/0x270 __x64_sys_sendto+0x80/0xa0 do_syscall_64+0x69/0xf4 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Fixes: 18a8021a7be3 ("net/ipv4: Plumb support for filtering route dumps") Signed-off-by: Qian Cai Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 684ac83e3699a6e1cc0abcff99e78c091491a516 Merge: 6cd6cbf593bf 0b136454741b Author: David S. Miller Date: Mon Mar 23 18:38:58 2020 -0700 Merge tag 'mlx5-fixes-2020-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2020-03-05 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v5.4 ('net/mlx5: DR, Fix postsend actions write length') For -stable v5.5 ('net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow') ('net/mlx5e: Fix endianness handling in pedit mask') ==================== Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 9a293d1e21a6461a11b4217b155bf445e57f4131 Author: Mike Marciniszyn Date: Fri Mar 20 16:02:10 2020 -0400 IB/hfi1: Ensure pq is not left on waitlist The following warning can occur when a pq is left on the dmawait list and the pq is then freed: WARNING: CPU: 47 PID: 3546 at lib/list_debug.c:29 __list_add+0x65/0xc0 list_add corruption. next->prev should be prev (ffff939228da1880), but was ffff939cabb52230. (next=ffff939cabb52230). Modules linked in: mmfs26(OE) mmfslinux(OE) tracedev(OE) 8021q garp mrp ib_isert iscsi_target_mod target_core_mod crc_t10dif crct10dif_generic opa_vnic rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_ipoib(OE) bridge stp llc iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crct10dif_pclmul crct10dif_common crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd ast ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm pcspkr joydev drm_panel_orientation_quirks i2c_i801 mei_me lpc_ich mei wmi ipmi_si ipmi_devintf ipmi_msghandler nfit libnvdimm acpi_power_meter acpi_pad hfi1(OE) rdmavt(OE) rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core binfmt_misc numatools(OE) xpmem(OE) ip_tables nfsv3 nfs_acl nfs lockd grace sunrpc fscache igb ahci libahci i2c_algo_bit dca libata ptp pps_core crc32c_intel [last unloaded: i2c_algo_bit] CPU: 47 PID: 3546 Comm: wrf.exe Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.41.1.el7.x86_64 #1 Hardware name: HPE.COM HPE SGI 8600-XA730i Gen10/X11DPT-SB-SG007, BIOS SBED1229 01/22/2019 Call Trace: [] dump_stack+0x19/0x1b [] __warn+0xd8/0x100 [] warn_slowpath_fmt+0x5f/0x80 [] ? ___slab_alloc+0x24e/0x4f0 [] __list_add+0x65/0xc0 [] defer_packet_queue+0x145/0x1a0 [hfi1] [] sdma_check_progress+0x67/0xa0 [hfi1] [] sdma_send_txlist+0x432/0x550 [hfi1] [] ? kmem_cache_alloc+0x179/0x1f0 [] ? user_sdma_send_pkts+0xc3/0x1990 [hfi1] [] user_sdma_send_pkts+0x158a/0x1990 [hfi1] [] ? try_to_del_timer_sync+0x5e/0x90 [] ? __check_object_size+0x1ca/0x250 [] hfi1_user_sdma_process_request+0xd66/0x1280 [hfi1] [] hfi1_aio_write+0xca/0x120 [hfi1] [] do_sync_readv_writev+0x7b/0xd0 [] do_readv_writev+0xce/0x260 [] ? pick_next_task_fair+0x5f/0x1b0 [] ? sched_clock_cpu+0x85/0xc0 [] ? __schedule+0x13a/0x860 [] vfs_writev+0x35/0x60 [] SyS_writev+0x7f/0x110 [] system_call_fastpath+0x22/0x27 The issue happens when wait_event_interruptible_timeout() returns a value <= 0. In that case, the pq is left on the list. The code continues sending packets and potentially can complete the current request with the pq still on the dmawait list provided no descriptor shortage is seen. If the pq is torn down in that state, the sdma interrupt handler could find the now freed pq on the list with list corruption or memory corruption resulting. Fix by adding a flush routine to ensure that the pq is never on a list after processing a request. A follow-up patch series will address issues with seqlock surfaced in: https://lore.kernel.org/r/20200320003129.GP20941@ziepe.ca The seqlock use for sdma will then be converted to a spin lock since the list_empty() doesn't need the protection afforded by the sequence lock currently in use. Fixes: a0d406934a46 ("staging/rdma/hfi1: Add page lock limit check for SDMA requests") Link: https://lore.kernel.org/r/20200320200200.23203.37777.stgit@awfm-01.aw.intel.com Reviewed-by: Kaike Wan Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 979e52ca0469fb38646bc51d26a0263a740c9f03 Merge: 16fbf79b0f83 c8cfcb78c658 Author: Linus Torvalds Date: Mon Mar 23 15:55:21 2020 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a correctness bug in the ARM64 version of ChaCha for lib/crypto used by WireGuard" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: arm64/chacha - correctly walk through blocks commit 6cd6cbf593bfa3ae6fc3ed34ac21da4d35045425 Author: Eric Dumazet Date: Wed Mar 18 19:21:02 2020 -0700 tcp: repair: fix TCP_QUEUE_SEQ implementation When application uses TCP_QUEUE_SEQ socket option to change tp->rcv_next, we must also update tp->copied_seq. Otherwise, stuff relying on tcp_inq() being precise can eventually be confused. For example, tcp_zerocopy_receive() might crash because it does not expect tcp_recv_skb() to return NULL. We could add tests in various places to fix the issue, or simply make sure tcp_inq() wont return a random value, and leave fast path as it is. Note that this fixes ioctl(fd, SIOCINQ, &val) at the same time. Fixes: ee9952831cfd ("tcp: Initial repair mode") Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 428b8f1d9f92f838b73997adc10046d3c6e05790 Author: Nick Desaulniers Date: Mon Mar 23 12:12:43 2020 -0700 KVM: VMX: don't allow memory operands for inline asm that modifies SP THUNK_TARGET defines [thunk_target] as having "rm" input constraints when CONFIG_RETPOLINE is not set, which isn't constrained enough for this specific case. For inline assembly that modifies the stack pointer before using this input, the underspecification of constraints is dangerous, and results in an indirect call to a previously pushed flags register. In this case `entry`'s stack slot is good enough to satisfy the "m" constraint in "rm", but the inline assembly in handle_external_interrupt_irqoff() modifies the stack pointer via push+pushf before using this input, which in this case results in calling what was the previous state of the flags register, rather than `entry`. Be more specific in the constraints by requiring `entry` be in a register, and not a memory operand. Reported-by: Dmitry Vyukov Reported-by: syzbot+3f29ca2efb056a761e38@syzkaller.appspotmail.com Debugged-by: Alexander Potapenko Debugged-by: Paolo Bonzini Debugged-by: Sean Christopherson Signed-off-by: Nick Desaulniers Message-Id: <20200323191243.30002-1-ndesaulniers@google.com> Signed-off-by: Paolo Bonzini commit 0433ae556ec8fb588a0735ddb09d3eb9806df479 Author: Golan Ben Ami Date: Wed Mar 18 08:12:54 2020 +0200 iwlwifi: don't send GEO_TX_POWER_LIMIT if no wgds table The GEO_TX_POWER_LIMIT command was sent although there is no wgds table, so the fw got wrong SAR values from the driver. Fix this by avoiding sending the command if no wgds tables are available. Signed-off-by: Golan Ben Ami Fixes: 39c1a9728f93 ("iwlwifi: refactor the SAR tables from mvm to acpi") Signed-off-by: Luca Coelho Tested-By: Jonathan McDowell Tested-by: Len Brown Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20200318081237.46db40617cc6.Id5cf852ec8c5dbf20ba86bad7b165a0c828f8b2e@changeid commit cf52c8a776d1b31493a987a0fb3c4dbaa0f7f2cc Author: Luca Coelho Date: Tue Mar 17 12:33:41 2020 +0200 iwlwifi: pcie: add 0x2526/0x401* devices back to cfg detection Three devices, with PCI device ID 0x2526 and subdevice IDs 0x4010, 0x4018 and 0x401C were removed accidentally. Add them back. Reported-by: Brett Hassal Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206661 Fixes: 0b295a1eb81f ("iwlwifi: add device name to device_info") Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20200317123331.16762b29f26c.I928bcaa799e7b3d33838c0667714eeb9fa665290@changeid commit edec6e015a02003c2af0ce82c54ea016b5a9e3f0 Author: He Zhe Date: Fri Mar 20 15:06:07 2020 +0800 KVM: LAPIC: Mark hrtimer for period or oneshot mode to expire in hard interrupt context apic->lapic_timer.timer was initialized with HRTIMER_MODE_ABS_HARD but started later with HRTIMER_MODE_ABS, which may cause the following warning in PREEMPT_RT kernel. WARNING: CPU: 1 PID: 2957 at kernel/time/hrtimer.c:1129 hrtimer_start_range_ns+0x348/0x3f0 CPU: 1 PID: 2957 Comm: qemu-system-x86 Not tainted 5.4.23-rt11 #1 Hardware name: Supermicro SYS-E300-9A-8C/A2SDi-8C-HLN4F, BIOS 1.1a 09/18/2018 RIP: 0010:hrtimer_start_range_ns+0x348/0x3f0 Code: 4d b8 0f 94 c1 0f b6 c9 e8 35 f1 ff ff 4c 8b 45 b0 e9 3b fd ff ff e8 d7 3f fa ff 48 98 4c 03 34 c5 a0 26 bf 93 e9 a1 fd ff ff <0f> 0b e9 fd fc ff ff 65 8b 05 fa b7 90 6d 89 c0 48 0f a3 05 60 91 RSP: 0018:ffffbc60026ffaf8 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff9d81657d4110 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000006cc7987bcf RDI: ffff9d81657d4110 RBP: ffffbc60026ffb58 R08: 0000000000000001 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000000 R12: 0000006cc7987bcf R13: 0000000000000000 R14: 0000006cc7987bcf R15: ffffbc60026d6a00 FS: 00007f401daed700(0000) GS:ffff9d81ffa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000ffffffff CR3: 0000000fa7574000 CR4: 00000000003426e0 Call Trace: ? kvm_release_pfn_clean+0x22/0x60 [kvm] start_sw_timer+0x85/0x230 [kvm] ? vmx_vmexit+0x1b/0x30 [kvm_intel] kvm_lapic_switch_to_sw_timer+0x72/0x80 [kvm] vmx_pre_block+0x1cb/0x260 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_vmexit+0x1b/0x30 [kvm_intel] ? vmx_vmexit+0xf/0x30 [kvm_intel] ? vmx_sync_pir_to_irr+0x9e/0x100 [kvm_intel] ? kvm_apic_has_interrupt+0x46/0x80 [kvm] kvm_arch_vcpu_ioctl_run+0x85b/0x1fa0 [kvm] ? _raw_spin_unlock_irqrestore+0x18/0x50 ? _copy_to_user+0x2c/0x30 kvm_vcpu_ioctl+0x235/0x660 [kvm] ? rt_spin_unlock+0x2c/0x50 do_vfs_ioctl+0x3e4/0x650 ? __fget+0x7a/0xa0 ksys_ioctl+0x67/0x90 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f4027cc54a7 Code: 00 00 90 48 8b 05 e9 59 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b9 59 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007f401dae9858 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00005558bd029690 RCX: 00007f4027cc54a7 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000d RBP: 00007f4028b72000 R08: 00005558bc829ad0 R09: 00000000ffffffff R10: 00005558bcf90ca0 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 00005558bce1c840 --[ end trace 0000000000000002 ]-- Signed-off-by: He Zhe Message-Id: <1584687967-332859-1-git-send-email-zhe.he@windriver.com> Reviewed-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 2e2409afe5f0c284c7dfe5504058e8d115806a7d Author: Tom Lendacky Date: Fri Mar 20 11:07:07 2020 -0500 KVM: SVM: Issue WBINVD after deactivating an SEV guest Currently, CLFLUSH is used to flush SEV guest memory before the guest is terminated (or a memory hotplug region is removed). However, CLFLUSH is not enough to ensure that SEV guest tagged data is flushed from the cache. With 33af3a7ef9e6 ("KVM: SVM: Reduce WBINVD/DF_FLUSH invocations"), the original WBINVD was removed. This then exposed crashes at random times because of a cache flush race with a page that had both a hypervisor and a guest tag in the cache. Restore the WBINVD when destroying an SEV guest and add a WBINVD to the svm_unregister_enc_region() function to ensure hotplug memory is flushed when removed. The DF_FLUSH can still be avoided at this point. Fixes: 33af3a7ef9e6 ("KVM: SVM: Reduce WBINVD/DF_FLUSH invocations") Signed-off-by: Tom Lendacky Message-Id: Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit c8d6ee01449cd0d2f30410681cccb616a88f50b1 Author: Luis Henriques Date: Thu Mar 19 11:43:48 2020 +0000 ceph: fix memory leak in ceph_cleanup_snapid_map() kmemleak reports the following memory leak: unreferenced object 0xffff88821feac8a0 (size 96): comm "kworker/1:0", pid 17, jiffies 4294896362 (age 20.512s) hex dump (first 32 bytes): a0 c8 ea 1f 82 88 ff ff 00 c9 ea 1f 82 88 ff ff ................ 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ad de ................ backtrace: [<00000000b3ea77fb>] ceph_get_snapid_map+0x75/0x2a0 [<00000000d4060942>] fill_inode+0xb26/0x1010 [<0000000049da6206>] ceph_readdir_prepopulate+0x389/0xc40 [<00000000e2fe2549>] dispatch+0x11ab/0x1521 [<000000007700b894>] ceph_con_workfn+0xf3d/0x3240 [<0000000039138a41>] process_one_work+0x24d/0x590 [<00000000eb751f34>] worker_thread+0x4a/0x3d0 [<000000007e8f0d42>] kthread+0xfb/0x130 [<00000000d49bd1fa>] ret_from_fork+0x3a/0x50 A kfree is missing while looping the 'to_free' list of ceph_snapid_map objects. Cc: stable@vger.kernel.org Fixes: 75c9627efb72 ("ceph: map snapid to anonymous bdev ID") Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit e886274031200bb60965c1b9c49b7acda56a93bd Author: Ilya Dryomov Date: Tue Mar 10 16:19:01 2020 +0100 libceph: fix alloc_msg_with_page_vector() memory leaks Make it so that CEPH_MSG_DATA_PAGES data item can own pages, fixing a bunch of memory leaks for a page vector allocated in alloc_msg_with_page_vector(). Currently, only watch-notify messages trigger this allocation, and normally the page vector is freed either in handle_watch_notify() or by the caller of ceph_osdc_notify(). But if the message is freed before that (e.g. if the session faults while reading in the message or if the notify is stale), we leak the page vector. This was supposed to be fixed by switching to a message-owned pagelist, but that never happened. Fixes: 1907920324f1 ("libceph: support for sending notifies") Reported-by: Roman Penyaev Signed-off-by: Ilya Dryomov Reviewed-by: Roman Penyaev commit 7614209736fbc4927584d4387faade4f31444fce Author: Ilya Dryomov Date: Mon Mar 9 12:03:14 2020 +0100 ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL CEPH_OSDMAP_FULL/NEARFULL aren't set since mimic, so we need to consult per-pool flags as well. Unfortunately the backwards compatibility here is lacking: - the change that deprecated OSDMAP_FULL/NEARFULL went into mimic, but was guarded by require_osd_release >= RELEASE_LUMINOUS - it was subsequently backported to luminous in v12.2.2, but that makes no difference to clients that only check OSDMAP_FULL/NEARFULL because require_osd_release is not client-facing -- it is for OSDs Since all kernels are affected, the best we can do here is just start checking both map flags and pool flags and send that to stable. These checks are best effort, so take osdc->lock and look up pool flags just once. Remove the FIXME, since filesystem quotas are checked above and RADOS quotas are reflected in POOL_FLAG_FULL: when the pool reaches its quota, both POOL_FLAG_FULL and POOL_FLAG_FULL_QUOTA are set. Cc: stable@vger.kernel.org Reported-by: Yanhu Cao Signed-off-by: Ilya Dryomov Reviewed-by: Jeff Layton Acked-by: Sage Weil commit 692b65c84f0bb0ca70c11e62c865cbaf7e8e3afd Author: Mauro Carvalho Chehab Date: Tue Mar 17 15:54:22 2020 +0100 i2c: fix a doc warning Don't let non-letters inside a literal block without escaping it, as the toolchain would mis-interpret it: ./include/linux/i2c.h:518: WARNING: Inline strong start-string without end-string. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Wolfram Sang commit deeabb4c1341a12bf8b599e6a2f4cfa4fd74738c Author: Sungbo Eo Date: Sat Mar 21 23:36:53 2020 +0900 ARM: dts: oxnas: Fix clear-mask property Disable all rps-irq interrupts during driver initialization to prevent an accidental interrupt on GIC. Fixes: 84316f4ef141 ("ARM: boot: dts: Add Oxford Semiconductor OX810SE dtsi") Fixes: 38d4a53733f5 ("ARM: dts: Add support for OX820 and Pogoplug V3") Signed-off-by: Sungbo Eo Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong commit 018af9be3dd54e6f24f828966bdd873f4d63ad9b Author: Christophe JAILLET Date: Wed Mar 18 20:12:09 2020 +0100 dmaengine: ti: k3-udma-glue: Fix an error handling path in 'k3_udma_glue_cfg_rx_flow()' All but one error handling paths in the 'k3_udma_glue_cfg_rx_flow()' function 'goto err' and call 'k3_udma_glue_release_rx_flow()'. This not correct because this function has a 'channel->flows_ready--;' at the end, but 'flows_ready' has not been incremented here, when we branch to the error handling path. In order to keep a correct value in 'flows_ready', un-roll 'k3_udma_glue_release_rx_flow()', simplify it, add some labels and branch at the correct places when an error is detected. Doing so, we also NULLify 'flow->udma_rflow' in a path that was lacking it. Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine user") Signed-off-by: Christophe JAILLET Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200318191209.1267-1-christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul commit 01c4df39a2bb732e0593ba3cdacc1552fd07f7b9 Author: Zhou Wang Date: Fri Mar 13 09:23:44 2020 +0800 MAINTAINERS: Add maintainer for HiSilicon DMA engine driver Add myself as the maintainer of HiSilicon DMA engine driver. Signed-off-by: Zhou Wang Link: https://lore.kernel.org/r/1584062624-196854-1-git-send-email-wangzhou1@hisilicon.com Signed-off-by: Vinod Koul commit 988aad2f111c768c66efc87d073c73ecb32b682c Author: Dave Jiang Date: Thu Mar 12 09:23:53 2020 -0700 dmaengine: idxd: fix off by one on cdev dwq refcount The refcount check for dedicated workqueue (dwq) is off by one and allows more than 1 user to open the char device. Fix check so only a single user can open the device. Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland") Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/158403020187.10208.14117394394540710774.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 16fbf79b0f83bc752cee8589279f1ebfe57b3b6e Author: Linus Torvalds Date: Sun Mar 22 18:31:56 2020 -0700 Linux 5.6-rc7 commit 55c7c0621078bd73e9d4d2a11eb36e61bc6fe998 Author: Nicolas Saenz Julienne Date: Thu Mar 19 20:00:13 2020 +0100 ARM: dts: bcm283x: Fix vc4's firmware bus DMA limitations The bus is virtual and devices have to inherit their DMA constraints from the underlying interconnect. So add an empty dma-ranges property to the bus node, implying the firmware bus' DMA constraints are identical to its parent's. Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") Signed-off-by: Nicolas Saenz Julienne Signed-off-by: Florian Fainelli commit 67d584e33e54c3f33c8541928aa7115388c97433 Merge: b3c03db67e84 d8e6fd5c7991 Author: Linus Torvalds Date: Sun Mar 22 11:35:33 2020 -0700 Merge tag 'for-5.6-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two fixes. The first is a regression: when dropping some incompat bits the conditions were reversed. The other is a fix for rename whiteout potentially leaving stack memory linked to a list" * tag 'for-5.6-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix removal of raid[56|1c34} incompat flags after removing block group btrfs: fix log context list corruption after rename whiteout error commit b3c03db67e844bb418e50c3e4de12eb11763e425 Merge: b74b991fb8b9 763802b53a42 Author: Linus Torvalds Date: Sun Mar 22 10:46:50 2020 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "10 fixes" * emailed patches from Andrew Morton : x86/mm: split vmalloc_sync_all() mm, slub: prevent kmalloc_node crashes and memory leaks mm/mmu_notifier: silence PROVE_RCU_LIST warnings epoll: fix possible lost wakeup on epoll_ctl() path mm: do not allow MADV_PAGEOUT for CoW pages mm, memcg: throttle allocators based on ancestral memory.high mm, memcg: fix corruption on 64-bit divisor in memory.high throttling page-flags: fix a crash at SetPageError(THP_SWAP) mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event commit e1b9f99ff8c40bba6e59de9ad4a659447b1e4112 Author: Chuhong Yuan Date: Mon Nov 4 23:00:48 2019 +0800 i2c: hix5hd2: add missed clk_disable_unprepare in remove The driver forgets to disable and unprepare clk when remove. Add a call to clk_disable_unprepare to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: Wolfram Sang Cc: stable@kernel.org commit 83a9b6f639e9f6b632337f9776de17d51d969c77 Author: Alan Maguire Date: Wed Mar 18 18:53:21 2020 +0000 selftests/net: add definition for SOL_DCCP to fix compilation errors for old libc Many systems build/test up-to-date kernels with older libcs, and an older glibc (2.17) lacks the definition of SOL_DCCP in /usr/include/bits/socket.h (it was added in the 4.6 timeframe). Adding the definition to the test program avoids a compilation failure that gets in the way of building tools/testing/selftests/net. The test itself will work once the definition is added; either skipping due to DCCP not being configured in the kernel under test or passing, so there are no other more up-to-date glibc dependencies here it seems beyond that missing definition. Fixes: 11fb60d1089f ("selftests: net: reuseport_addr_any: add DCCP") Signed-off-by: Alan Maguire Signed-off-by: David S. Miller commit 9a9ba2a4aaaa4e75a5f118b8ab642a55c34f95cb Author: Doug Berger Date: Tue Mar 17 17:05:36 2020 -0700 net: bcmgenet: always enable status blocks The hardware offloading of the NETIF_F_HW_CSUM and NETIF_F_RXCSUM features requires the use of Transmit Status Blocks before transmit frame data and Receive Status Blocks before receive frame data to carry the checksum information. Unfortunately, these status blocks are currently only enabled when the NETIF_F_HW_CSUM feature is enabled. As a result NETIF_F_RXCSUM will not actually be offloaded to the hardware unless both it and NETIF_F_HW_CSUM are enabled. Fortunately, that is the default configuration. This commit addresses this issue by always enabling the use of status blocks on both transmit and receive frames. Further, it replaces the use of a dedicated flag within the driver private data structure with direct use of the netdev features flags. Fixes: 810155397890 ("net: bcmgenet: use CHECKSUM_COMPLETE for NETIF_F_RXCSUM") Signed-off-by: Doug Berger Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 749f6f6843115b424680f1aada3c0dd613ad807c Author: Grygorii Strashko Date: Tue Mar 17 20:04:54 2020 +0200 net: phy: dp83867: w/a for fld detect threshold bootstrapping issue When the DP83867 PHY is strapped to enable Fast Link Drop (FLD) feature STRAP_STS2.STRAP_ FLD (reg 0x006F bit 10), the Energy Lost Threshold for FLD Energy Lost Mode FLD_THR_CFG.ENERGY_LOST_FLD_THR (reg 0x002e bits 2:0) will be defaulted to 0x2. This may cause the phy link to be unstable. The new DP83867 DM recommends to always restore ENERGY_LOST_FLD_THR to 0x1. Hence, restore default value of FLD_THR_CFG.ENERGY_LOST_FLD_THR to 0x1 when FLD is enabled by bootstrapping as recommended by DM. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 9de9aa487daff7a5c73434c24269b44ed6a428e6 Author: Emil Renner Berthing Date: Sat Mar 21 15:36:19 2020 +0100 net: stmmac: dwmac-rk: fix error path in rk_gmac_probe Make sure we clean up devicetree related configuration also when clock init fails. Fixes: fecd4d7eef8b ("net: stmmac: dwmac-rk: Add integrated PHY support") Signed-off-by: Emil Renner Berthing Signed-off-by: David S. Miller commit 2091a3d42b4f339eaeed11228e0cbe9d4f92f558 Author: Oliver Hartkopp Date: Sat Mar 21 14:08:29 2020 +0100 slcan: not call free_netdev before rtnl_unlock in slcan_open As the description before netdev_run_todo, we cannot call free_netdev before rtnl_unlock, fix it by reorder the code. This patch is a 1:1 copy of upstream slip.c commit f596c87005f7 ("slip: not call free_netdev before rtnl_unlock in slip_open"). Reported-by: yangerkun Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller commit 06e9bfc1e57daeead541c9f02968412cd284b189 Author: Lukas Bulwahn Date: Sat Mar 21 13:05:14 2020 +0100 ionic: make spdxcheck.py happy Headers ionic_if.h and ionic_regs.h are licensed under three alternative licenses and the used SPDX-License-Identifier expression makes ./scripts/spdxcheck.py complain: drivers/net/ethernet/pensando/ionic/ionic_if.h: 1:52 Syntax error: OR drivers/net/ethernet/pensando/ionic/ionic_regs.h: 1:52 Syntax error: OR As OR is associative, it is irrelevant if the parentheses are put around the first or the second OR-expression. Simply add parentheses to make spdxcheck.py happy. Signed-off-by: Lukas Bulwahn Acked-by: Shannon Nelson Signed-off-by: David S. Miller commit 3a303cfdd28d5f930a307c82e8a9d996394d5ebd Author: Taehee Yoo Date: Sat Mar 21 06:46:50 2020 +0000 hsr: fix general protection fault in hsr_addr_is_self() The port->hsr is used in the hsr_handle_frame(), which is a callback of rx_handler. hsr master and slaves are initialized in hsr_add_port(). This function initializes several pointers, which includes port->hsr after registering rx_handler. So, in the rx_handler routine, un-initialized pointer would be used. In order to fix this, pointers should be initialized before registering rx_handler. Test commands: ip netns del left ip netns del right modprobe -rv veth modprobe -rv hsr killall ping modprobe hsr ip netns add left ip netns add right ip link add veth0 type veth peer name veth1 ip link add veth2 type veth peer name veth3 ip link add veth4 type veth peer name veth5 ip link set veth1 netns left ip link set veth3 netns right ip link set veth4 netns left ip link set veth5 netns right ip link set veth0 up ip link set veth2 up ip link set veth0 address fc:00:00:00:00:01 ip link set veth2 address fc:00:00:00:00:02 ip netns exec left ip link set veth1 up ip netns exec left ip link set veth4 up ip netns exec right ip link set veth3 up ip netns exec right ip link set veth5 up ip link add hsr0 type hsr slave1 veth0 slave2 veth2 ip a a 192.168.100.1/24 dev hsr0 ip link set hsr0 up ip netns exec left ip link add hsr1 type hsr slave1 veth1 slave2 veth4 ip netns exec left ip a a 192.168.100.2/24 dev hsr1 ip netns exec left ip link set hsr1 up ip netns exec left ip n a 192.168.100.1 dev hsr1 lladdr \ fc:00:00:00:00:01 nud permanent ip netns exec left ip n r 192.168.100.1 dev hsr1 lladdr \ fc:00:00:00:00:01 nud permanent for i in {1..100} do ip netns exec left ping 192.168.100.1 & done ip netns exec left hping3 192.168.100.1 -2 --flood & ip netns exec right ip link add hsr2 type hsr slave1 veth3 slave2 veth5 ip netns exec right ip a a 192.168.100.3/24 dev hsr2 ip netns exec right ip link set hsr2 up ip netns exec right ip n a 192.168.100.1 dev hsr2 lladdr \ fc:00:00:00:00:02 nud permanent ip netns exec right ip n r 192.168.100.1 dev hsr2 lladdr \ fc:00:00:00:00:02 nud permanent for i in {1..100} do ip netns exec right ping 192.168.100.1 & done ip netns exec right hping3 192.168.100.1 -2 --flood & while : do ip link add hsr0 type hsr slave1 veth0 slave2 veth2 ip a a 192.168.100.1/24 dev hsr0 ip link set hsr0 up ip link del hsr0 done Splat looks like: [ 120.954938][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1]I [ 120.957761][ C0] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 120.959064][ C0] CPU: 0 PID: 1511 Comm: hping3 Not tainted 5.6.0-rc5+ #460 [ 120.960054][ C0] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 120.962261][ C0] RIP: 0010:hsr_addr_is_self+0x65/0x2a0 [hsr] [ 120.963149][ C0] Code: 44 24 18 70 73 2f c0 48 c1 eb 03 48 8d 04 13 c7 00 f1 f1 f1 f1 c7 40 04 00 f2 f2 f2 4 [ 120.966277][ C0] RSP: 0018:ffff8880d9c09af0 EFLAGS: 00010206 [ 120.967293][ C0] RAX: 0000000000000006 RBX: 1ffff1101b38135f RCX: 0000000000000000 [ 120.968516][ C0] RDX: dffffc0000000000 RSI: ffff8880d17cb208 RDI: 0000000000000000 [ 120.969718][ C0] RBP: 0000000000000030 R08: ffffed101b3c0e3c R09: 0000000000000001 [ 120.972203][ C0] R10: 0000000000000001 R11: ffffed101b3c0e3b R12: 0000000000000000 [ 120.973379][ C0] R13: ffff8880aaf80100 R14: ffff8880aaf800f2 R15: ffff8880aaf80040 [ 120.974410][ C0] FS: 00007f58e693f740(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000 [ 120.979794][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 120.980773][ C0] CR2: 00007ffcb8b38f29 CR3: 00000000afe8e001 CR4: 00000000000606f0 [ 120.981945][ C0] Call Trace: [ 120.982411][ C0] [ 120.982848][ C0] ? hsr_add_node+0x8c0/0x8c0 [hsr] [ 120.983522][ C0] ? rcu_read_lock_held+0x90/0xa0 [ 120.984159][ C0] ? rcu_read_lock_sched_held+0xc0/0xc0 [ 120.984944][ C0] hsr_handle_frame+0x1db/0x4e0 [hsr] [ 120.985597][ C0] ? hsr_nl_nodedown+0x2b0/0x2b0 [hsr] [ 120.986289][ C0] __netif_receive_skb_core+0x6bf/0x3170 [ 120.992513][ C0] ? check_chain_key+0x236/0x5d0 [ 120.993223][ C0] ? do_xdp_generic+0x1460/0x1460 [ 120.993875][ C0] ? register_lock_class+0x14d0/0x14d0 [ 120.994609][ C0] ? __netif_receive_skb_one_core+0x8d/0x160 [ 120.995377][ C0] __netif_receive_skb_one_core+0x8d/0x160 [ 120.996204][ C0] ? __netif_receive_skb_core+0x3170/0x3170 [ ... ] Reported-by: syzbot+fcf5dd39282ceb27108d@syzkaller.appspotmail.com Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 4abe5a1b9661b1c393082c11924e55c680c6ca8b Merge: 07f8e4d0fddb 7296695fc16d Author: David S. Miller Date: Sat Mar 21 19:44:23 2020 -0700 Merge branch 'hinic-BugFixes' Luo bin says: ==================== hinic: BugFixes Fix a number of bugs which have been present since the first commit. The bugs fixed in these patchs are hardly exposed unless given very specific conditions. ==================== Signed-off-by: David S. Miller commit 7296695fc16dd1761dbba8b68a9181c71cef0633 Author: Luo bin Date: Fri Mar 20 23:13:20 2020 +0000 hinic: fix wrong value of MIN_SKB_LEN the minimum value of skb len that hw supports is 32 rather than 17 Signed-off-by: Luo bin Signed-off-by: David S. Miller commit 0da7c322f116210ebfdda59c7da663a6fc5e9cc8 Author: Luo bin Date: Fri Mar 20 23:13:19 2020 +0000 hinic: fix wrong para of wait_for_completion_timeout the second input parameter of wait_for_completion_timeout should be jiffies instead of millisecond Signed-off-by: Luo bin Signed-off-by: David S. Miller commit 33f15da216a1f4566b4ec880942556ace30615df Author: Luo bin Date: Fri Mar 20 23:13:18 2020 +0000 hinic: fix out-of-order excution in arm cpu add read barrier in driver code to keep from reading other fileds in dma memory which is writable for hw until we have verified the memory is valid for driver Signed-off-by: Luo bin Signed-off-by: David S. Miller commit 614eaa943e9fc3fcdbd4aa0692ae84973d363333 Author: Luo bin Date: Fri Mar 20 23:13:17 2020 +0000 hinic: fix the bug of clearing event queue should disable eq irq before freeing it, must clear event queue depth in hw before freeing relevant memory to avoid illegal memory access and update consumer idx to avoid invalid interrupt Signed-off-by: Luo bin Signed-off-by: David S. Miller commit 96758117dc528e6d84bd23d205e8cf7f31eda029 Author: Luo bin Date: Fri Mar 20 23:13:16 2020 +0000 hinic: fix a bug of waitting for IO stopped it's unreliable for fw to check whether IO is stopped, so driver wait for enough time to ensure IO process is done in hw before freeing resources Signed-off-by: Luo bin Signed-off-by: David S. Miller commit 763802b53a427ed3cbd419dbba255c414fdd9e7c Author: Joerg Roedel Date: Sat Mar 21 18:22:41 2020 -0700 x86/mm: split vmalloc_sync_all() Commit 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()") introduced a call to vmalloc_sync_all() in the vunmap() code-path. While this change was necessary to maintain correctness on x86-32-pae kernels, it also adds additional cycles for architectures that don't need it. Specifically on x86-64 with CONFIG_VMAP_STACK=y some people reported severe performance regressions in micro-benchmarks because it now also calls the x86-64 implementation of vmalloc_sync_all() on vunmap(). But the vmalloc_sync_all() implementation on x86-64 is only needed for newly created mappings. To avoid the unnecessary work on x86-64 and to gain the performance back, split up vmalloc_sync_all() into two functions: * vmalloc_sync_mappings(), and * vmalloc_sync_unmappings() Most call-sites to vmalloc_sync_all() only care about new mappings being synchronized. The only exception is the new call-site added in the above mentioned commit. Shile Zhang directed us to a report of an 80% regression in reaim throughput. Fixes: 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()") Reported-by: kernel test robot Reported-by: Shile Zhang Signed-off-by: Joerg Roedel Signed-off-by: Andrew Morton Tested-by: Borislav Petkov Acked-by: Rafael J. Wysocki [GHES] Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Link: http://lkml.kernel.org/r/20191009124418.8286-1-joro@8bytes.org Link: https://lists.01.org/hyperkitty/list/lkp@lists.01.org/thread/4D3JPPHBNOSPFK2KEPC6KGKS6J25AIDB/ Link: http://lkml.kernel.org/r/20191113095530.228959-1-shile.zhang@linux.alibaba.com Signed-off-by: Linus Torvalds commit 0715e6c516f106ed553828a671d30ad9a3431536 Author: Vlastimil Babka Date: Sat Mar 21 18:22:37 2020 -0700 mm, slub: prevent kmalloc_node crashes and memory leaks Sachin reports [1] a crash in SLUB __slab_alloc(): BUG: Kernel NULL pointer dereference on read at 0x000073b0 Faulting instruction address: 0xc0000000003d55f4 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1 NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000 REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest) MSR: 8000000000009033 CR: 24004844 XER: 00000000 CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1 GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500 GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620 GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000 GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000 GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002 GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122 GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8 GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180 NIP ___slab_alloc+0x1f4/0x760 LR __slab_alloc+0x34/0x60 Call Trace: ___slab_alloc+0x334/0x760 (unreliable) __slab_alloc+0x34/0x60 __kmalloc_node+0x110/0x490 kvmalloc_node+0x58/0x110 mem_cgroup_css_online+0x108/0x270 online_css+0x48/0xd0 cgroup_apply_control_enable+0x2ec/0x4d0 cgroup_mkdir+0x228/0x5f0 kernfs_iop_mkdir+0x90/0xf0 vfs_mkdir+0x110/0x230 do_mkdirat+0xb0/0x1a0 system_call+0x5c/0x68 This is a PowerPC platform with following NUMA topology: available: 2 nodes (0-1) node 0 cpus: node 0 size: 0 MB node 0 free: 0 MB node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 node 1 size: 35247 MB node 1 free: 30907 MB node distances: node 0 1 0: 10 40 1: 40 10 possible numa nodes: 0-31 This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on appropriate NUMA node" [2] which effectively calls kmalloc_node for each possible node. SLUB however only allocates kmem_cache_node on online N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node for other nodes since commit a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node"). This is however not true in this configuration where the _node_numa_mem_ array is not initialized for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up accessing non-allocated kmem_cache_node. A related issue was reported by Bharata (originally by Ramachandran) [3] where a similar PowerPC configuration, but with mainline kernel without patch [2] ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems to have the same underlying issue with node_to_mem_node() not behaving as expected, and might probably also lead to an infinite loop with CONFIG_SLUB_CPU_PARTIAL [4]. This patch should fix both issues by not relying on node_to_mem_node() anymore and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is attempted for a node that's not online, or has no usable memory. The "usable memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY node state, as that is exactly the condition that SLUB uses to allocate kmem_cache_node structures. The check in get_partial() is removed completely, as the checks in ___slab_alloc() are now sufficient to prevent get_partial() being reached with an invalid node. [1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@linux.vnet.ibm.com/ [2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtuozzo.com/ [3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/ [4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.cz/ Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node") Reported-by: Sachin Sant Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN Signed-off-by: Vlastimil Babka Signed-off-by: Andrew Morton Tested-by: Sachin Sant Tested-by: Bharata B Rao Reviewed-by: Srikar Dronamraju Cc: Mel Gorman Cc: Michael Ellerman Cc: Michal Hocko Cc: Christopher Lameter Cc: linuxppc-dev@lists.ozlabs.org Cc: Joonsoo Kim Cc: Pekka Enberg Cc: David Rientjes Cc: Kirill Tkhai Cc: Vlastimil Babka Cc: Nathan Lynch Cc: Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.cz Debugged-by: Srikar Dronamraju Signed-off-by: Linus Torvalds commit 63886bad904b73f7470fd582fbc41c5ae04d6785 Author: Qian Cai Date: Sat Mar 21 18:22:34 2020 -0700 mm/mmu_notifier: silence PROVE_RCU_LIST warnings It is safe to traverse mm->notifier_subscriptions->list either under SRCU read lock or mm->notifier_subscriptions->lock using hlist_for_each_entry_rcu(). Silence the PROVE_RCU_LIST false positives, for example, WARNING: suspicious RCU usage ----------------------------- mm/mmu_notifier.c:484 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by libvirtd/802: #0: ffff9321e3f58148 (&mm->mmap_sem#2){++++}, at: do_mprotect_pkey+0xe1/0x3e0 #1: ffffffff91ae6160 (mmu_notifier_invalidate_range_start){+.+.}, at: change_p4d_range+0x5fa/0x800 #2: ffffffff91ae6e08 (srcu){....}, at: __mmu_notifier_invalidate_range_start+0x178/0x460 stack backtrace: CPU: 7 PID: 802 Comm: libvirtd Tainted: G I 5.6.0-rc6-next-20200317+ #2 Hardware name: HP ProLiant BL460c Gen8, BIOS I31 11/02/2014 Call Trace: dump_stack+0xa4/0xfe lockdep_rcu_suspicious+0xeb/0xf5 __mmu_notifier_invalidate_range_start+0x3ff/0x460 change_p4d_range+0x746/0x800 change_protection+0x1df/0x300 mprotect_fixup+0x245/0x3e0 do_mprotect_pkey+0x23b/0x3e0 __x64_sys_mprotect+0x51/0x70 do_syscall_64+0x91/0xae8 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Signed-off-by: Qian Cai Signed-off-by: Andrew Morton Reviewed-by: Paul E. McKenney Reviewed-by: Jason Gunthorpe Link: http://lkml.kernel.org/r/20200317175640.2047-1-cai@lca.pw Signed-off-by: Linus Torvalds commit 1b53734bd0b2feed8e7761771b2e76fc9126ea0c Author: Roman Penyaev Date: Sat Mar 21 18:22:30 2020 -0700 epoll: fix possible lost wakeup on epoll_ctl() path This fixes possible lost wakeup introduced by commit a218cc491420. Originally modifications to ep->wq were serialized by ep->wq.lock, but in commit a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention") a new rw lock was introduced in order to relax fd event path, i.e. callers of ep_poll_callback() function. After the change ep_modify and ep_insert (both are called on epoll_ctl() path) were switched to ep->lock, but ep_poll (epoll_wait) was using ep->wq.lock on wqueue list modification. The bug doesn't lead to any wqueue list corruptions, because wake up path and list modifications were serialized by ep->wq.lock internally, but actual waitqueue_active() check prior wake_up() call can be reordered with modifications of ep ready list, thus wake up can be lost. And yes, can be healed by explicit smp_mb(): list_add_tail(&epi->rdlink, &ep->rdllist); smp_mb(); if (waitqueue_active(&ep->wq)) wake_up(&ep->wp); But let's make it simple, thus current patch replaces ep->wq.lock with the ep->lock for wqueue modifications, thus wake up path always observes activeness of the wqueue correcty. Fixes: a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention") Reported-by: Max Neunhoeffer Signed-off-by: Roman Penyaev Signed-off-by: Andrew Morton Tested-by: Max Neunhoeffer Cc: Jakub Kicinski Cc: Christopher Kohlhoff Cc: Davidlohr Bueso Cc: Jason Baron Cc: Jes Sorensen Cc: [5.1+] Link: http://lkml.kernel.org/r/20200214170211.561524-1-rpenyaev@suse.de References: https://bugzilla.kernel.org/show_bug.cgi?id=205933 Bisected-by: Max Neunhoeffer Signed-off-by: Linus Torvalds commit 12e967fd8e4e6c3d275b4c69c890adc838891300 Author: Michal Hocko Date: Sat Mar 21 18:22:26 2020 -0700 mm: do not allow MADV_PAGEOUT for CoW pages Jann has brought up a very interesting point [1]. While shared pages are excluded from MADV_PAGEOUT normally, CoW pages can be easily reclaimed that way. This can lead to all sorts of hard to debug problems. E.g. performance problems outlined by Daniel [2]. There are runtime environments where there is a substantial memory shared among security domains via CoW memory and a easy to reclaim way of that memory, which MADV_{COLD,PAGEOUT} offers, can lead to either performance degradation in for the parent process which might be more privileged or even open side channel attacks. The feasibility of the latter is not really clear to me TBH but there is no real reason for exposure at this stage. It seems there is no real use case to depend on reclaiming CoW memory via madvise at this stage so it is much easier to simply disallow it and this is what this patch does. Put it simply MADV_{PAGEOUT,COLD} can operate only on the exclusively owned memory which is a straightforward semantic. [1] http://lkml.kernel.org/r/CAG48ez0G3JkMq61gUmyQAaCq=_TwHbi1XKzWRooxZkv08PQKuw@mail.gmail.com [2] http://lkml.kernel.org/r/CAKOZueua_v8jHCpmEtTB6f3i9e2YnmX4mqdYVWhV4E=Z-n+zRQ@mail.gmail.com Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD") Reported-by: Jann Horn Signed-off-by: Michal Hocko Signed-off-by: Andrew Morton Acked-by: Vlastimil Babka Cc: Minchan Kim Cc: Daniel Colascione Cc: Dave Hansen Cc: "Joel Fernandes (Google)" Cc: Link: http://lkml.kernel.org/r/20200312082248.GS23944@dhcp22.suse.cz Signed-off-by: Linus Torvalds commit e26733e0d0ec6798eca93daa300bc3f43616127f Author: Chris Down Date: Sat Mar 21 18:22:23 2020 -0700 mm, memcg: throttle allocators based on ancestral memory.high Prior to this commit, we only directly check the affected cgroup's memory.high against its usage. However, it's possible that we are being reclaimed as a result of hitting an ancestor memory.high and should be penalised based on that, instead. This patch changes memory.high overage throttling to use the largest overage in its ancestors when considering how many penalty jiffies to charge. This makes sure that we penalise poorly behaving cgroups in the same way regardless of at what level of the hierarchy memory.high was breached. Fixes: 0e4b01df8659 ("mm, memcg: throttle allocators when failing reclaim over memory.high") Reported-by: Johannes Weiner Signed-off-by: Chris Down Signed-off-by: Andrew Morton Acked-by: Johannes Weiner Cc: Tejun Heo Cc: Michal Hocko Cc: Nathan Chancellor Cc: Roman Gushchin Cc: [5.4.x+] Link: http://lkml.kernel.org/r/8cd132f84bd7e16cdb8fde3378cdbf05ba00d387.1584036142.git.chris@chrisdown.name Signed-off-by: Linus Torvalds commit d397a45fc741c80c32a14e2de008441e9976f50c Author: Chris Down Date: Sat Mar 21 18:22:20 2020 -0700 mm, memcg: fix corruption on 64-bit divisor in memory.high throttling Commit 0e4b01df8659 had a bunch of fixups to use the right division method. However, it seems that after all that it still wasn't right -- div_u64 takes a 32-bit divisor. The headroom is still large (2^32 pages), so on mundane systems you won't hit this, but this should definitely be fixed. Fixes: 0e4b01df8659 ("mm, memcg: throttle allocators when failing reclaim over memory.high") Reported-by: Johannes Weiner Signed-off-by: Chris Down Signed-off-by: Andrew Morton Acked-by: Johannes Weiner Cc: Tejun Heo Cc: Roman Gushchin Cc: Michal Hocko Cc: Nathan Chancellor Cc: [5.4.x+] Link: http://lkml.kernel.org/r/80780887060514967d414b3cd91f9a316a16ab98.1584036142.git.chris@chrisdown.name Signed-off-by: Linus Torvalds commit d72520ad004a8ce18a6ba6cde317f0081b27365a Author: Qian Cai Date: Sat Mar 21 18:22:17 2020 -0700 page-flags: fix a crash at SetPageError(THP_SWAP) Commit bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out") supported writing THP to a swap device but forgot to upgrade an older commit df8c94d13c7e ("page-flags: define behavior of FS/IO-related flags on compound pages") which could trigger a crash during THP swapping out with DEBUG_VM_PGFLAGS=y, kernel BUG at include/linux/page-flags.h:317! page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page)) page:fffff3b2ec3a8000 refcount:512 mapcount:0 mapping:000000009eb0338c index:0x7f6e58200 head:fffff3b2ec3a8000 order:9 compound_mapcount:0 compound_pincount:0 anon flags: 0x45fffe0000d8454(uptodate|lru|workingset|owner_priv_1|writeback|head|reclaim|swapbacked) end_swap_bio_write() SetPageError(page) VM_BUG_ON_PAGE(1 && PageCompound(page)) bio_endio+0x297/0x560 dec_pending+0x218/0x430 [dm_mod] clone_endio+0xe4/0x2c0 [dm_mod] bio_endio+0x297/0x560 blk_update_request+0x201/0x920 scsi_end_request+0x6b/0x4b0 scsi_io_completion+0x509/0x7e0 scsi_finish_command+0x1ed/0x2a0 scsi_softirq_done+0x1c9/0x1d0 __blk_mqnterrupt+0xf/0x20 Fix by checking PF_NO_TAIL in those places instead. Fixes: bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out") Signed-off-by: Qian Cai Signed-off-by: Andrew Morton Reviewed-by: David Hildenbrand Acked-by: "Huang, Ying" Acked-by: Rafael Aquini Cc: Link: http://lkml.kernel.org/r/20200310235846.1319-1-cai@lca.pw Signed-off-by: Linus Torvalds commit d41e2f3bd54699f85b3d6f45abd09fa24a222cb9 Author: Baoquan He Date: Sat Mar 21 18:22:13 2020 -0700 mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case In section_deactivate(), pfn_to_page() doesn't work any more after ms->section_mem_map is resetting to NULL in SPARSEMEM|!VMEMMAP case. It causes a hot remove failure: kernel BUG at mm/page_alloc.c:4806! invalid opcode: 0000 [#1] SMP PTI CPU: 3 PID: 8 Comm: kworker/u16:0 Tainted: G W 5.5.0-next-20200205+ #340 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: kacpi_hotplug acpi_hotplug_work_fn RIP: 0010:free_pages+0x85/0xa0 Call Trace: __remove_pages+0x99/0xc0 arch_remove_memory+0x23/0x4d try_remove_memory+0xc8/0x130 __remove_memory+0xa/0x11 acpi_memory_device_remove+0x72/0x100 acpi_bus_trim+0x55/0x90 acpi_device_hotplug+0x2eb/0x3d0 acpi_hotplug_work_fn+0x1a/0x30 process_one_work+0x1a7/0x370 worker_thread+0x30/0x380 kthread+0x112/0x130 ret_from_fork+0x35/0x40 Let's move the ->section_mem_map resetting after depopulate_section_memmap() to fix it. [akpm@linux-foundation.org: remove unneeded initialization, per David] Fixes: ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug") Signed-off-by: Baoquan He Signed-off-by: Andrew Morton Reviewed-by: Pankaj Gupta Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Wei Yang Cc: Oscar Salvador Cc: Mike Rapoport Cc: Link: http://lkml.kernel.org/r/20200307084229.28251-2-bhe@redhat.com Signed-off-by: Linus Torvalds commit 7d36665a5886c27ca4c4d0afd3ecc50b400f3587 Author: Chunguang Xu Date: Sat Mar 21 18:22:10 2020 -0700 memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event An eventfd monitors multiple memory thresholds of the cgroup, closes them, the kernel deletes all events related to this eventfd. Before all events are deleted, another eventfd monitors the memory threshold of this cgroup, leading to a crash: BUG: kernel NULL pointer dereference, address: 0000000000000004 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 800000033058e067 P4D 800000033058e067 PUD 3355ce067 PMD 0 Oops: 0002 [#1] SMP PTI CPU: 2 PID: 14012 Comm: kworker/2:6 Kdump: loaded Not tainted 5.6.0-rc4 #3 Hardware name: LENOVO 20AWS01K00/20AWS01K00, BIOS GLET70WW (2.24 ) 05/21/2014 Workqueue: events memcg_event_remove RIP: 0010:__mem_cgroup_usage_unregister_event+0xb3/0x190 RSP: 0018:ffffb47e01c4fe18 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff8bb223a8a000 RCX: 0000000000000001 RDX: 0000000000000001 RSI: ffff8bb22fb83540 RDI: 0000000000000001 RBP: ffffb47e01c4fe48 R08: 0000000000000000 R09: 0000000000000010 R10: 000000000000000c R11: 071c71c71c71c71c R12: ffff8bb226aba880 R13: ffff8bb223a8a480 R14: 0000000000000000 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff8bb242680000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000004 CR3: 000000032c29c003 CR4: 00000000001606e0 Call Trace: memcg_event_remove+0x32/0x90 process_one_work+0x172/0x380 worker_thread+0x49/0x3f0 kthread+0xf8/0x130 ret_from_fork+0x35/0x40 CR2: 0000000000000004 We can reproduce this problem in the following ways: 1. We create a new cgroup subdirectory and a new eventfd, and then we monitor multiple memory thresholds of the cgroup through this eventfd. 2. closing this eventfd, and __mem_cgroup_usage_unregister_event () will be called multiple times to delete all events related to this eventfd. The first time __mem_cgroup_usage_unregister_event() is called, the kernel will clear all items related to this eventfd in thresholds-> primary. Since there is currently only one eventfd, thresholds-> primary becomes empty, so the kernel will set thresholds-> primary and hresholds-> spare to NULL. If at this time, the user creates a new eventfd and monitor the memory threshold of this cgroup, kernel will re-initialize thresholds-> primary. Then when __mem_cgroup_usage_unregister_event () is called for the second time, because thresholds-> primary is not empty, the system will access thresholds-> spare, but thresholds-> spare is NULL, which will trigger a crash. In general, the longer it takes to delete all events related to this eventfd, the easier it is to trigger this problem. The solution is to check whether the thresholds associated with the eventfd has been cleared when deleting the event. If so, we do nothing. [akpm@linux-foundation.org: fix comment, per Kirill] Fixes: 907860ed381a ("cgroups: make cftype.unregister_event() void-returning") Signed-off-by: Chunguang Xu Signed-off-by: Andrew Morton Acked-by: Michal Hocko Acked-by: Kirill A. Shutemov Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Link: http://lkml.kernel.org/r/077a6f67-aefa-4591-efec-f2f3af2b0b02@gmail.com Signed-off-by: Linus Torvalds commit b74b991fb8b9d642b8fea20d6245c6e19125a305 Merge: 1ab7ea1f83d1 83166ac82b53 Author: Linus Torvalds Date: Sat Mar 21 12:08:26 2020 -0700 Merge tag 'block-5.6-20200320' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Just two NVMe fabrics fixes that should go into 5.6" * tag 'block-5.6-20200320' of git://git.kernel.dk/linux-block: nvmet-tcp: set MSG_MORE only if we actually have more to send nvme-rdma: Avoid double freeing of async event data commit 1ab7ea1f83d16489142bcfa1b7670ac7ca86cd81 Merge: 6c1bae744d5a 09952e3e7826 Author: Linus Torvalds Date: Sat Mar 21 11:54:47 2020 -0700 Merge tag 'io_uring-5.6-20200320' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Two different fixes in here: - Fix for a potential NULL pointer deref for links with async or drain marked (Pavel) - Fix for not properly checking RLIMIT_NOFILE for async punted operations. This affects openat/openat2, which were added this cycle, and accept4. I did a full audit of other cases where we might check current->signal->rlim[] and found only RLIMIT_FSIZE for buffered writes and fallocate. That one is fixed and queued for 5.7 and marked stable" * tag 'io_uring-5.6-20200320' of git://git.kernel.dk/linux-block: io_uring: make sure accept honor rlimit nofile io_uring: make sure openat/openat2 honor rlimit nofile io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN} commit 6c1bae744d5a15108c412336d95f3c4e5db6aff4 Merge: c63c50fc2ec9 b95fffb9b4af Author: Linus Torvalds Date: Sat Mar 21 11:50:36 2020 -0700 Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: "Update to turbostat v20.03.20. These patches unlock the full turbostat features for some new machines, plus a couple other minor tweaks" * 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: update version tools/power turbostat: Print cpuidle information tools/power turbostat: Fix 32-bit capabilities warning tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks tools/power turbostat: Support Elkhart Lake tools/power turbostat: Support Jasper Lake tools/power turbostat: Support Ice Lake server tools/power turbostat: Support Tiger Lake tools/power turbostat: Fix gcc build warnings tools/power turbostat: Support Cometlake commit df81dfcfd6991d547653d46c051bac195cd182c1 Author: Edward Cree Date: Fri Mar 13 20:33:07 2020 +0000 genirq: Fix reference leaks on irq affinity notifiers The handling of notify->work did not properly maintain notify->kref in two cases: 1) where the work was already scheduled, another irq_set_affinity_locked() would get the ref and (no-op-ly) schedule the work. Thus when irq_affinity_notify() ran, it would drop the original ref but not the additional one. 2) when cancelling the (old) work in irq_set_affinity_notifier(), if there was outstanding work a ref had been got for it but was never put. Fix both by checking the return values of the work handling functions (schedule_work() for (1) and cancel_work_sync() for (2)) and put the extra ref if the return value indicates preexisting work. Fixes: cd7eab44e994 ("genirq: Add IRQ affinity notifiers") Fixes: 59c39840f5ab ("genirq: Prevent use-after-free and work list corruption") Signed-off-by: Edward Cree Signed-off-by: Thomas Gleixner Acked-by: Ben Hutchings Link: https://lkml.kernel.org/r/24f5983f-2ab5-e83a-44ee-a45b5f9300f5@solarflare.com commit c63c50fc2ec9afc4de21ef9ead2eac64b178cce1 Merge: 5ad0ec0b8652 1d0c32ec3b86 Author: Linus Torvalds Date: Sat Mar 21 08:51:45 2020 -0700 Merge tag 'powerpc-5.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Two fixes for bugs introduced this cycle: - fix a crash when shutting down a KVM PR guest (our original style of KVM which doesn't use hypervisor mode) - fix for the recently added 32-bit KASAN_VMALLOC support Thanks to: Christophe Leroy, Greg Kurz, Sean Christopherson" * tag 'powerpc-5.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: KVM: PPC: Fix kernel crash with PR KVM powerpc/kasan: Fix shadow memory protection with CONFIG_KASAN_VMALLOC commit b95fffb9b4afa8b9aa4a389ec7a0c578811eaf42 Author: Len Brown Date: Sun Nov 17 21:18:31 2019 -0500 tools/power turbostat: update version A stitch in time saves nine. Signed-off-by: Len Brown commit abdcbdb265264f736df316622a695ad30019c05f Author: Len Brown Date: Sat Mar 21 00:47:47 2020 -0400 tools/power turbostat: Print cpuidle information Print cpuidle driver and governor. Originally-by: Antti Laakso Signed-off-by: Len Brown commit 07f8e4d0fddbf2f87e4cefb551278abc38db8cdd Author: Florian Westphal Date: Fri Mar 20 16:52:02 2020 +0100 tcp: also NULL skb->dev when copy was needed In rare cases retransmit logic will make a full skb copy, which will not trigger the zeroing added in recent change b738a185beaa ("tcp: ensure skb->dev is NULL before leaving TCP stack"). Cc: Eric Dumazet Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue") Fixes: 28f8bfd1ac94 ("netfilter: Support iif matches in POSTROUTING") Signed-off-by: Florian Westphal Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 702151da6df2364342acd08898263acd51e47a6a Merge: b738a185beaa 15ff197237e7 Author: David S. Miller Date: Fri Mar 20 19:34:18 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Refetch IP header pointer after pskb_may_pull() in flowtable, from Haishuang Yan. 2) Fix memleak in flowtable offload in nf_flow_table_free(), from Paul Blakey. 3) Set control.addr_type mask in flowtable offload, from Edward Cree. ==================== Signed-off-by: David S. Miller commit 83166ac82b53655b63d3a59f6fe44f20511e96f2 Merge: b53df2e7442c 98fd5c723730 Author: Jens Axboe Date: Fri Mar 20 19:14:16 2020 -0600 Merge branch 'nvme-5.6-rc6' of git://git.infradead.org/nvme into block-5.6 Pull NVMe fixes from Keith: "Two late nvme fabrics fixes for 5.6: a double free with the rdma transport, and a regression fix for tcp; please pull." * 'nvme-5.6-rc6' of git://git.infradead.org/nvme: nvmet-tcp: set MSG_MORE only if we actually have more to send nvme-rdma: Avoid double freeing of async event data commit d8e6fd5c7991033037842b32c9774370a038e902 Author: Filipe Manana Date: Fri Mar 20 18:43:48 2020 +0000 btrfs: fix removal of raid[56|1c34} incompat flags after removing block group We are incorrectly dropping the raid56 and raid1c34 incompat flags when there are still raid56 and raid1c34 block groups, not when we do not any of those anymore. The logic just got unintentionally broken after adding the support for the raid1c34 modes. Fix this by clear the flags only if we do not have block groups with the respective profiles. Fixes: 9c907446dce3 ("btrfs: drop incompat bit for raid1c34 after last block group is gone") Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5c6f25887963f15492b604dd25cb149c501bbabf Author: Greg Kroah-Hartman Date: Fri Mar 20 17:22:58 2020 +0100 bpf: Explicitly memset some bpf info structures declared on the stack Trying to initialize a structure with "= {};" will not always clean out all padding locations in a structure. So be explicit and call memset to initialize everything for a number of bpf information structures that are then copied from userspace, sometimes from smaller memory locations than the size of the structure. Reported-by: Daniel Borkmann Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200320162258.GA794295@kroah.com commit 8096f229421f7b22433775e928d506f0342e5907 Author: Greg Kroah-Hartman Date: Fri Mar 20 10:48:13 2020 +0100 bpf: Explicitly memset the bpf_attr structure For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Reported-by: Maciej Żenczykowski Reported-by: John Stultz Reported-by: Alexander Potapenko Reported-by: Alistair Delva Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com commit 98fd5c723730f560e5bea919a64ac5b83d45eb72 Author: Sagi Grimberg Date: Thu Mar 12 16:06:38 2020 -0700 nvmet-tcp: set MSG_MORE only if we actually have more to send When we send PDU data, we want to optimize the tcp stack operation if we have more data to send. So when we set MSG_MORE when: - We have more fragments coming in the batch, or - We have a more data to send in this PDU - We don't have a data digest trailer - We optimize with the SUCCESS flag and omit the NVMe completion (used if sq_head pointer update is disabled) This addresses a regression in QD=1 with SUCCESS flag optimization as we unconditionally set MSG_MORE when we didn't actually have more data to send. Fixes: 70583295388a ("nvmet-tcp: implement C2HData SUCCESS optimization") Reported-by: Mark Wunderlich Tested-by: Mark Wunderlich Signed-off-by: Sagi Grimberg Signed-off-by: Keith Busch commit 2da1ed62d55c6cbebbdee924f6af4e87bb6666e5 Author: Paolo Bonzini Date: Fri Mar 20 13:34:50 2020 -0400 KVM: SVM: document KVM_MEM_ENCRYPT_OP, let userspace detect if SEV is available Userspace has no way to query if SEV has been disabled with the sev module parameter of kvm-amd.ko. Actually it has one, but it is a hack: do ioctl(KVM_MEM_ENCRYPT_OP, NULL) and check if it returns EFAULT. Make it a little nicer by returning zero for SEV enabled and NULL argument, and while at it document the ioctl arguments. Cc: Brijesh Singh Signed-off-by: Paolo Bonzini commit d33294541889b023068522270cd4153ddd8e4635 Author: Paolo Bonzini Date: Thu Mar 19 13:41:06 2020 -0400 KVM: x86: remove bogus user-triggerable WARN_ON The WARN_ON is essentially comparing a user-provided value with 0. It is trivial to trigger it just by passing garbage to KVM_SET_CLOCK. Guests can break if you do so, but the same applies to every KVM_SET_* ioctl. So, if it hurts when you do like this, just do not do it. Reported-by: syzbot+00be5da1d75f1cc95f6b@syzkaller.appspotmail.com Fixes: 9446e6fce0ab ("KVM: x86: fix WARN_ON check of an unsigned less than zero") Cc: Sean Christopherson Signed-off-by: Paolo Bonzini commit 5ad0ec0b86525d0c5d3d250d3cfad7f183b00cfa Merge: f014d2b8584d 3568b88944fe Author: Linus Torvalds Date: Fri Mar 20 09:28:25 2020 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Fix panic() when it occurs during secondary CPU startup - Fix "kpti=off" when KASLR is enabled - Fix howler in compat syscall table for vDSO clock_getres() fallback * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: compat: Fix syscall number of compat_clock_getres arm64: kpti: Fix "kpti=off" when KASLR is enabled arm64: smp: fix crash_smp_send_stop() behaviour arm64: smp: fix smp_send_stop() behaviour commit f014d2b8584d0bf938e8d6761c79596e94b06f98 Merge: 3bd14829d327 add492d2e944 Author: Linus Torvalds Date: Fri Mar 20 09:24:22 2020 -0700 Merge tag 'char-misc-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small different driver fixes for 5.6-rc7: - binderfs fix, yet again - slimbus new device id added - hwtracing bugfixes for reported issues and a new device id All of these have been in linux-next with no reported issues" * tag 'char-misc-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: intel_th: pci: Add Elkhart Lake CPU support intel_th: Fix user-visible error codes intel_th: msu: Fix the unexpected state warning stm class: sys-t: Fix the use of time_after() slimbus: ngd: add v2.1.0 compatible binderfs: use refcount for binder control devices too commit 3bd14829d3275d96ff723a6c57429e9238117779 Merge: b07c2e76c419 14800df6a020 Author: Linus Torvalds Date: Fri Mar 20 09:20:38 2020 -0700 Merge tag 'staging-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO fixes from Greg KH: "Here are a number of small staging and IIO driver fixes for 5.6-rc7 Nothing major here, just resolutions for some reported problems: - iio bugfixes for a number of different drivers - greybus loopback_test fixes - wfx driver fixes All of these have been in linux-next with no reported issues" * tag 'staging-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 staging: greybus: loopback_test: fix potential path truncations staging: greybus: loopback_test: fix potential path truncation staging: greybus: loopback_test: fix poll-mask build breakage staging: wfx: fix RCU usage between hif_join() and ieee80211_bss_get_ie() staging: wfx: fix RCU usage in wfx_join_finalize() staging: wfx: make warning about pending frame less scary staging: wfx: fix lines ending with a comma instead of a semicolon staging: wfx: fix warning about freeing in-use mutex during device unregister staging/speakup: fix get_word non-space look-ahead iio: ping: set pa_laser_ping_cfg in of_ping_match iio: chemical: sps30: fix missing triggered buffer dependency iio: st_sensors: remap SMO8840 to LIS2DH12 iio: light: vcnl4000: update sampling periods for vcnl4040 iio: light: vcnl4000: update sampling periods for vcnl4200 iio: accel: adxl372: Set iio_chan BE iio: magnetometer: ak8974: Fix negative raw values in sysfs iio: trigger: stm32-timer: disable master mode when stopping iio: adc: stm32-dfsdm: fix sleep in atomic context iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode commit b07c2e76c419fe7ac8949e5ffea4a29414291b7d Merge: fa91418b72cb 2866ce869616 Author: Linus Torvalds Date: Fri Mar 20 09:16:35 2020 -0700 Merge tag 'usb-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 5.6-rc7. And there's a thunderbolt driver fix thrown in for good measure as well. These fixes are: - new device ids for usb-serial drivers - thunderbolt error code fix - xhci driver fixes - typec fixes - cdc-acm driver fixes - chipidea driver fix - more USB quirks added for devices that need them. All of these have been in linux-next with no reported issues" * tag 'usb-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: cdc-acm: fix rounding error in TIOCSSERIAL USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters usb: chipidea: udc: fix sleeping function called from invalid context USB: serial: pl2303: add device-id for HP LD381 USB: serial: option: add ME910G1 ECM composition 0x110b usb: host: xhci-plat: add a shutdown usb: typec: ucsi: displayport: Fix a potential race during registration usb: typec: ucsi: displayport: Fix NULL pointer dereference USB: Disable LPM on WD19's Realtek Hub usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c xhci: Do not open code __print_symbolic() in xhci trace events thunderbolt: Fix error code in tb_port_is_width_supported() commit fa91418b72cbf14742f2439439369fcad942b24c Merge: 12bf19c92682 6e622cd8bd88 Author: Linus Torvalds Date: Fri Mar 20 09:13:35 2020 -0700 Merge tag 'tty-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fixes from Greg KH: "Here are three small tty_io bugfixes for reported issues that Eric has resolved for 5.6-rc7 All of these have been in linux-next with no reported issues" * tag 'tty-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: fix compat TIOCGSERIAL checking wrong function ptr tty: fix compat TIOCGSERIAL leaking uninitialized memory tty: drop outdated comments about release_tty() locking commit 12bf19c9268263cf8fc6653966813ff9d5ceef17 Merge: 69d3e5a5a66b a124458a127c Author: Linus Torvalds Date: Fri Mar 20 09:10:29 2020 -0700 Merge tag 'sound-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few fixes covering the issues reported by syzkaller, a couple of fixes for the MIDI decoding bug, and a few usual HD-audio quirks. Some of them are about ALSA core stuff, but they are small fixes just for corner cases, and nothing thrilling" * tag 'sound-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 ALSA: seq: oss: Fix running status after receiving sysex ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks ALSA: hda/realtek: Fix pop noise on ALC225 ALSA: line6: Fix endless MIDI read loop ALSA: pcm: oss: Avoid plugin buffer overflow commit 69d3e5a5a66bb59c39f36dcb9cf4e9a4239aa8cd Merge: 6c90b86a745a 5366b96b1997 Author: Linus Torvalds Date: Fri Mar 20 09:03:54 2020 -0700 Merge tag 'drm-fixes-2020-03-20' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Hope you are well hiding out above the garage. A few amdgpu changes but nothing too major. I've had a wisdom tooth out this week so haven't been to on top of things, but all seems good. core: - fix lease warning i915: - Track active elements during dequeue - Fix failure to handle all MCR ranges - Revert unnecessary workaround amdgpu: - Pageflip fix - VCN clockgating fixes - GPR debugfs fix for umr - GPU reset fix - eDP fix for MBP - DCN2.x fix dw-hdmi: - fix AVI frame colorimetry komeda: - fix compiler warning bochs: - downgrade a binding failure to a warning" * tag 'drm-fixes-2020-03-20' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Fix pageflip event race condition for DCN. drm/amdgpu: fix typo for vcn2.5/jpeg2.5 idle check drm/amdgpu: fix typo for vcn2/jpeg2 idle check drm/amdgpu: fix typo for vcn1 idle check drm/lease: fix WARNING in idr_destroy drm/i915: Handle all MCR ranges Revert "drm/i915/tgl: Add extra hdc flush workaround" drm/i915/execlists: Track active elements during dequeue drm/bochs: downgrade pci_request_region failure from error to warning drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017 drm/amdgpu: add fbdev suspend/resume on gpu reset drm/amd/amdgpu: Fix GPR read from debugfs (v2) drm/amd/display: fix typos for dcn20_funcs and dcn21_funcs struct drm/komeda: mark PM functions as __maybe_unused drm/bridge: dw-hdmi: fix AVI frame colorimetry commit 09952e3e7826119ddd4357c453d54bcc7ef25156 Author: Jens Axboe Date: Thu Mar 19 20:16:56 2020 -0600 io_uring: make sure accept honor rlimit nofile Just like commit 4022e7af86be, this fixes the fact that IORING_OP_ACCEPT ends up using get_unused_fd_flags(), which checks current->signal->rlim[] for limits. Add an extra argument to __sys_accept4_file() that allows us to pass in the proper nofile limit, and grab it at request prep time. Acked-by: David S. Miller Signed-off-by: Jens Axboe commit 4022e7af86be2dd62975dedb6b7ea551d108695e Author: Jens Axboe Date: Thu Mar 19 19:23:18 2020 -0600 io_uring: make sure openat/openat2 honor rlimit nofile Dmitry reports that a test case shows that io_uring isn't honoring a modified rlimit nofile setting. get_unused_fd_flags() checks the task signal->rlimi[] for the limits. As this isn't easily inheritable, provide a __get_unused_fd_flags() that takes the value instead. Then we can grab it when the request is prepared (from the original task), and pass that in when we do the async part part of the open. Reported-by: Dmitry Kadashev Tested-by: Dmitry Kadashev Acked-by: David S. Miller Signed-off-by: Jens Axboe commit 6f5459da2b8736720afdbd67c4bd2d1edba7d0e3 Author: Ilie Halip Date: Thu Mar 19 23:45:28 2020 +0200 arm64: alternative: fix build with clang integrated assembler Building an arm64 defconfig with clang's integrated assembler, this error occurs: :2:2: error: unrecognized instruction mnemonic _ASM_EXTABLE 9999b, 9f ^ arch/arm64/mm/cache.S:50:1: note: while in macro instantiation user_alt 9f, "dc cvau, x4", "dc civac, x4", 0 ^ While GNU as seems fine with case-sensitive macro instantiations, clang doesn't, so use the actual macro name (_asm_extable) as in the rest of the file. Also checked that the generated assembly matches the GCC output. Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Fixes: 290622efc76e ("arm64: fix "dc cvau" cache operation on errata-affected core") Link: https://github.com/ClangBuiltLinux/linux/issues/924 Signed-off-by: Ilie Halip Signed-off-by: Will Deacon commit b738a185beaab8728943acdb3e67371b8a88185e Author: Eric Dumazet Date: Thu Mar 19 12:49:55 2020 -0700 tcp: ensure skb->dev is NULL before leaving TCP stack skb->rbnode is sharing three skb fields : next, prev, dev When a packet is sent, TCP keeps the original skb (master) in a rtx queue, which was converted to rbtree a while back. __tcp_transmit_skb() is responsible to clone the master skb, and add the TCP header to the clone before sending it to network layer. skb_clone() already clears skb->next and skb->prev, but copies the master oskb->dev into the clone. We need to clear skb->dev, otherwise lower layers could interpret the value as a pointer to a netdev. This old bug surfaced recently when commit 28f8bfd1ac94 ("netfilter: Support iif matches in POSTROUTING") was merged. Before this netfilter commit, skb->dev value was ignored and changed before reaching dev_queue_xmit() Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue") Fixes: 28f8bfd1ac94 ("netfilter: Support iif matches in POSTROUTING") Signed-off-by: Eric Dumazet Reported-by: Martin Zaharinov Cc: Florian Westphal Cc: Pablo Neira Ayuso Signed-off-by: David S. Miller commit fcaa681c03ea82193e60d7f2cdfd94fbbcd4cae9 Author: Len Brown Date: Thu Mar 19 23:24:17 2020 -0400 tools/power turbostat: Fix 32-bit capabilities warning warning: `turbostat' uses 32-bit capabilities (legacy support in use) Signed-off-by: Len Brown commit 1f81c5efc020314b2db30d77efe228b7e117750d Author: Len Brown Date: Thu Mar 19 18:26:05 2020 -0400 tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks Some Chromebook BIOS' do not export an ACPI LPIT, which is how Linux finds the residency counter for CPU and SYSTEM low power states, that is exports in /sys/devices/system/cpu/cpuidle/*residency_us When these sysfs attributes are missing, check the debugfs attrubte from the pmc_core driver, which accesses the same counter value. Signed-off-by: Len Brown commit f6708400707fec5cb56600710a9be59266df09ad Author: Chen Yu Date: Wed Mar 18 18:55:48 2020 +0800 tools/power turbostat: Support Elkhart Lake From a turbostat point of view the Tremont-based Elkhart Lake is very similar to Goldmont, reuse the code of Goldmont. Elkhart Lake does not support 'group turbo limit counter' nor C3, adjust the code accordingly. Signed-off-by: Chen Yu Signed-off-by: Len Brown commit d7814c3098ddb2780bb66e787aa3949110dd4a41 Author: Chen Yu Date: Tue Jan 14 12:09:45 2020 +0800 tools/power turbostat: Support Jasper Lake Jasper Lake, like Elkhart Lake, uses a Tremont CPU. So reuse the code. Signed-off-by: Chen Yu Signed-off-by: Len Brown commit 23274faf96500700da83c4f0ff12d78ae03d5604 Author: Chen Yu Date: Tue Jan 14 12:06:49 2020 +0800 tools/power turbostat: Support Ice Lake server From a turbostat point of view, Ice Lake server looks like Sky Lake server. Signed-off-by: Chen Yu Signed-off-by: Len Brown commit 4bf7132a0ace8888398af8cec6485ee4c6db5ea8 Author: Chen Yu Date: Tue Jan 14 12:04:55 2020 +0800 tools/power turbostat: Support Tiger Lake From a turbostat point of view, Tiger Lake looks like Ice Lake. Signed-off-by: Chen Yu Signed-off-by: Len Brown commit d8d005ba6afa502ca37ced5782f672c4d2fc1515 Author: Len Brown Date: Thu Mar 19 18:33:12 2020 -0400 tools/power turbostat: Fix gcc build warnings Warning: ‘__builtin_strncpy’ specified bound 20 equals destination size [-Wstringop-truncation] reduce param to strncpy, to guarantee that a null byte is always copied into destination buffer. Signed-off-by: Len Brown commit 081c54323b27d8d4b40df6b2375b9e1f6846d827 Author: Chen Yu Date: Thu Oct 31 21:14:22 2019 +0800 tools/power turbostat: Support Cometlake From a turbostat point of view, Cometlake is like Kabylake. Suggested-by: Rui Zhang Signed-off-by: Chen Yu Signed-off-by: Len Brown commit f1f20a8666c55cb534b8f3fc1130eebf01a06155 Author: Rahul Lakkireddy Date: Thu Mar 19 23:08:10 2020 +0530 cxgb4: fix Txq restart check during backpressure Driver reclaims descriptors in much smaller batches, even if hardware indicates more to reclaim, during backpressure. So, fix the check to restart the Txq during backpressure, by looking at how many descriptors hardware had indicated to reclaim, and not on how many descriptors that driver had actually reclaimed. Once the Txq is restarted, driver will reclaim even more descriptors when Tx path is entered again. Fixes: d429005fdf2c ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer") Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 7affd80802afb6ca92dba47d768632fbde365241 Author: Rahul Lakkireddy Date: Thu Mar 19 23:08:09 2020 +0530 cxgb4: fix throughput drop during Tx backpressure commit 7c3bebc3d868 ("cxgb4: request the TX CIDX updates to status page") reverted back to getting Tx CIDX updates via DMA, instead of interrupts, introduced by commit d429005fdf2c ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer") However, it missed reverting back several code changes where Tx CIDX updates are not explicitly requested during backpressure when using interrupt mode. These missed changes cause slow recovery during backpressure because the corresponding interrupt no longer comes and hence results in Tx throughput drop. So, revert back these missed code changes, as well, which will allow explicitly requesting Tx CIDX updates when backpressure happens. This enables the corresponding interrupt with Tx CIDX update message to get generated and hence speed up recovery and restore back throughput. Fixes: 7c3bebc3d868 ("cxgb4: request the TX CIDX updates to status page") Fixes: d429005fdf2c ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer") Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 22259471b51925353bd7b16f864c79fdd76e425e Author: René van Dorst Date: Thu Mar 19 14:47:56 2020 +0100 net: dsa: mt7530: Change the LINK bit to reflect the link status Andrew reported: After a number of network port link up/down changes, sometimes the switch port gets stuck in a state where it thinks it is still transmitting packets but the cpu port is not actually transmitting anymore. In this state you will see a message on the console "mtk_soc_eth 1e100000.ethernet eth0: transmit timed out" and the Tx counter in ifconfig will be incrementing on virtual port, but not incrementing on cpu port. The issue is that MAC TX/RX status has no impact on the link status or queue manager of the switch. So the queue manager just queues up packets of a disabled port and sends out pause frames when the queue is full. Change the LINK bit to reflect the link status. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Reported-by: Andrew Smith Signed-off-by: René van Dorst Reviewed-by: Vivien Didelot Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit c8cfcb78c65877313cda7bcbace624d3dbd1f3b3 Author: Jason A. Donenfeld Date: Wed Mar 18 20:27:32 2020 -0600 crypto: arm64/chacha - correctly walk through blocks Prior, passing in chunks of 2, 3, or 4, followed by any additional chunks would result in the chacha state counter getting out of sync, resulting in incorrect encryption/decryption, which is a pretty nasty crypto vuln: "why do images look weird on webpages?" WireGuard users never experienced this prior, because we have always, out of tree, used a different crypto library, until the recent Frankenzinc addition. This commit fixes the issue by advancing the pointers and state counter by the actual size processed. It also fixes up a bug in the (optional, costly) stride test that prevented it from running on arm64. Fixes: b3aad5bad26a ("crypto: arm64/chacha - expose arm64 ChaCha routine as library function") Reported-and-tested-by: Emil Renner Berthing Cc: Ard Biesheuvel Cc: stable@vger.kernel.org # v5.5+ Signed-off-by: Jason A. Donenfeld Reviewed-by: Eric Biggers Signed-off-by: Herbert Xu commit 3ac9eb4210a95cf9b374f1d48ce99d87d79d2510 Merge: 6002059d7882 7d7587db0d7f Author: David S. Miller Date: Thu Mar 19 20:28:34 2020 -0700 Merge tag 'rxrpc-fixes-20200319' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc, afs: Interruptibility fixes Here are a number of fixes for AF_RXRPC and AFS that make AFS system calls less interruptible and so less likely to leave the filesystem in an uncertain state. There's also a miscellaneous patch to make tracing consistent. (1) Firstly, abstract out the Tx space calculation in sendmsg. Much the same code is replicated in a number of places that subsequent patches are going to alter, including adding another copy. (2) Fix Tx interruptibility by allowing a kernel service, such as AFS, to request that a call be interruptible only when waiting for a call slot to become available (ie. the call has not taken place yet) or that a call be not interruptible at all (e.g. when we want to do writeback and don't want a signal interrupting a VM-induced writeback). (3) Increase the minimum delay on MSG_WAITALL for userspace sendmsg() when waiting for Tx buffer space as a 2*RTT delay is really small over 10G ethernet and a 1 jiffy timeout might be essentially 0 if at the end of the jiffy period. (4) Fix some tracing output in AFS to make it consistent with rxrpc. (5) Make sure aborted asynchronous AFS operations are tidied up properly so we don't end up with stuck rxrpc calls. (6) Make AFS client calls uninterruptible in the Rx phase. If we don't wait for the reply to be fully gathered, we can't update the local VFS state and we end up in an indeterminate state with respect to the server. ==================== Signed-off-by: David S. Miller commit 6002059d7882c3512e6ac52fa82424272ddfcd5c Author: Ido Schimmel Date: Thu Mar 19 13:25:39 2020 +0200 mlxsw: pci: Only issue reset when system is ready During initialization the driver issues a software reset command and then waits for the system status to change back to "ready" state. However, before issuing the reset command the driver does not check that the system is actually in "ready" state. On Spectrum-{1,2} systems this was always the case as the hardware initialization time is very short. On Spectrum-3 systems this is no longer the case. This results in the software reset command timing-out and the driver failing to load: [ 6.347591] mlxsw_spectrum3 0000:06:00.0: Cmd exec timed-out (opcode=40(ACCESS_REG),opcode_mod=0,in_mod=0) [ 6.358382] mlxsw_spectrum3 0000:06:00.0: Reg cmd access failed (reg_id=9023(mrsr),type=write) [ 6.368028] mlxsw_spectrum3 0000:06:00.0: cannot register bus device [ 6.375274] mlxsw_spectrum3: probe of 0000:06:00.0 failed with error -110 Fix this by waiting for the system to become ready both before issuing the reset command and afterwards. In case of failure, print the last system status to aid in debugging. Fixes: da382875c616 ("mlxsw: spectrum: Extend to support Spectrum-3 ASIC") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 5366b96b1997745d903c697a32e0ed27b66fd158 Merge: 362b86a3d337 fe8b7085cac3 Author: Dave Airlie Date: Fri Mar 20 12:51:34 2020 +1000 Merge tag 'drm-intel-fixes-2020-03-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.6-rc7: - Track active elements during dequeue - Fix failure to handle all MCR ranges - Revert unnecessary workaround Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/877dzgepvu.fsf@intel.com commit 362b86a3d337f6056e8c0692b15bc3c9d49306f5 Merge: 0f08b3156d28 eb916a5a93a6 Author: Dave Airlie Date: Fri Mar 20 12:48:10 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-03-19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-03-19: amdgpu: - Pageflip fix - VCN clockgating fixes - GPR debugfs fix for umr - GPU reset fix - eDP fix for MBP - DCN2.x fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200319204054.1036478-1-alexander.deucher@amd.com commit 1d0c32ec3b860a32df593a22bad0d1dbc5546a59 Author: Greg Kurz Date: Wed Mar 18 18:43:30 2020 +0100 KVM: PPC: Fix kernel crash with PR KVM With PR KVM, shutting down a VM causes the host kernel to crash: [ 314.219284] BUG: Unable to handle kernel data access on read at 0xc00800000176c638 [ 314.219299] Faulting instruction address: 0xc008000000d4ddb0 cpu 0x0: Vector: 300 (Data Access) at [c00000036da077a0] pc: c008000000d4ddb0: kvmppc_mmu_pte_flush_all+0x68/0xd0 [kvm_pr] lr: c008000000d4dd94: kvmppc_mmu_pte_flush_all+0x4c/0xd0 [kvm_pr] sp: c00000036da07a30 msr: 900000010280b033 dar: c00800000176c638 dsisr: 40000000 current = 0xc00000036d4c0000 paca = 0xc000000001a00000 irqmask: 0x03 irq_happened: 0x01 pid = 1992, comm = qemu-system-ppc Linux version 5.6.0-master-gku+ (greg@palmb) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #17 SMP Wed Mar 18 13:49:29 CET 2020 enter ? for help [c00000036da07ab0] c008000000d4fbe0 kvmppc_mmu_destroy_pr+0x28/0x60 [kvm_pr] [c00000036da07ae0] c0080000009eab8c kvmppc_mmu_destroy+0x34/0x50 [kvm] [c00000036da07b00] c0080000009e50c0 kvm_arch_vcpu_destroy+0x108/0x140 [kvm] [c00000036da07b30] c0080000009d1b50 kvm_vcpu_destroy+0x28/0x80 [kvm] [c00000036da07b60] c0080000009e4434 kvm_arch_destroy_vm+0xbc/0x190 [kvm] [c00000036da07ba0] c0080000009d9c2c kvm_put_kvm+0x1d4/0x3f0 [kvm] [c00000036da07c00] c0080000009da760 kvm_vm_release+0x38/0x60 [kvm] [c00000036da07c30] c000000000420be0 __fput+0xe0/0x310 [c00000036da07c90] c0000000001747a0 task_work_run+0x150/0x1c0 [c00000036da07cf0] c00000000014896c do_exit+0x44c/0xd00 [c00000036da07dc0] c0000000001492f4 do_group_exit+0x64/0xd0 [c00000036da07e00] c000000000149384 sys_exit_group+0x24/0x30 [c00000036da07e20] c00000000000b9d0 system_call+0x5c/0x68 This is caused by a use-after-free in kvmppc_mmu_pte_flush_all() which dereferences vcpu->arch.book3s which was previously freed by kvmppc_core_vcpu_free_pr(). This happens because kvmppc_mmu_destroy() is called after kvmppc_core_vcpu_free() since commit ff030fdf5573 ("KVM: PPC: Move kvm_vcpu_init() invocation to common code"). The kvmppc_mmu_destroy() helper calls one of the following depending on the KVM backend: - kvmppc_mmu_destroy_hv() which does nothing (Book3s HV) - kvmppc_mmu_destroy_pr() which undoes the effects of kvmppc_mmu_init() (Book3s PR 32-bit) - kvmppc_mmu_destroy_pr() which undoes the effects of kvmppc_mmu_init() (Book3s PR 64-bit) - kvmppc_mmu_destroy_e500() which does nothing (BookE e500/e500mc) It turns out that this is only relevant to PR KVM actually. And both 32 and 64 backends need vcpu->arch.book3s to be valid when calling kvmppc_mmu_destroy_pr(). So instead of calling kvmppc_mmu_destroy() from kvm_arch_vcpu_destroy(), call kvmppc_mmu_destroy_pr() at the beginning of kvmppc_core_vcpu_free_pr(). This is consistent with kvmppc_mmu_init() being the last call in kvmppc_core_vcpu_create_pr(). For the same reason, if kvmppc_core_vcpu_create_pr() returns an error then this means that kvmppc_mmu_init() was either not called or failed, in which case kvmppc_mmu_destroy() should not be called. Drop the line in the error path of kvm_arch_vcpu_create(). Fixes: ff030fdf5573 ("KVM: PPC: Move kvm_vcpu_init() invocation to common code") Signed-off-by: Greg Kurz Reviewed-by: Sean Christopherson Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/158455341029.178873.15248663726399374882.stgit@bahia.lan commit 15ff197237e76c4dab06b7b518afaa4ebb1c43e0 Author: Edward Cree Date: Thu Mar 19 19:37:21 2020 +0000 netfilter: flowtable: populate addr_type mask nf_flow_rule_match() sets control.addr_type in key, so needs to also set the corresponding mask. An exact match is wanted, so mask is all ones. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Edward Cree Signed-off-by: Pablo Neira Ayuso commit eb916a5a93a64c182b0a8f43886aa6bb4c3e52b0 Author: Mario Kleiner Date: Mon Mar 2 07:17:32 2020 +0100 drm/amd/display: Fix pageflip event race condition for DCN. Commit '16f17eda8bad ("drm/amd/display: Send vblank and user events at vsartup for DCN")' introduces a new way of pageflip completion handling for DCN, and some trouble. The current implementation introduces a race condition, which can cause pageflip completion events to be sent out one vblank too early, thereby confusing userspace and causing flicker: prepare_flip_isr(): 1. Pageflip programming takes the ddev->event_lock. 2. Sets acrtc->pflip_status == AMDGPU_FLIP_SUBMITTED 3. Releases ddev->event_lock. --> Deadline for surface address regs double-buffering passes on target pipe. 4. dc_commit_updates_for_stream() MMIO programs the new pageflip into hw, but too late for current vblank. => pflip_status == AMDGPU_FLIP_SUBMITTED, but flip won't complete in current vblank due to missing the double-buffering deadline by a tiny bit. 5. VSTARTUP trigger point in vblank is reached, VSTARTUP irq fires, dm_dcn_crtc_high_irq() gets called. 6. Detects pflip_status == AMDGPU_FLIP_SUBMITTED and assumes the pageflip has been completed/will complete in this vblank and sends out pageflip completion event to userspace and resets pflip_status = AMDGPU_FLIP_NONE. => Flip completion event sent out one vblank too early. This behaviour has been observed during my testing with measurement hardware a couple of time. The commit message says that the extra flip event code was added to dm_dcn_crtc_high_irq() to prevent missing to send out pageflip events in case the pflip irq doesn't fire, because the "DCH HUBP" component is clock gated and doesn't fire pflip irqs in that state. Also that this clock gating may happen if no planes are active. This suggests that the problem addressed by that commit can't happen if planes are active. The proposed solution is therefore to only execute the extra pflip completion code iff the count of active planes is zero and otherwise leave pflip completion handling to the pflip irq handler, for a more race-free experience. Note that i don't know if this fixes the problem the original commit tried to address, as i don't know what the test scenario was. It does fix the observed too early pageflip events though and points out the problem introduced. Fixes: 16f17eda8bad ("drm/amd/display: Send vblank and user events at vsartup for DCN") Reviewed-by: Nicholas Kazlauskas Signed-off-by: Mario Kleiner Signed-off-by: Alex Deucher commit c921ffe853332584eae4f5905cb2a14a7b3c9932 Author: Paul Blakey Date: Thu Mar 19 11:52:25 2020 +0200 netfilter: flowtable: Fix flushing of offloaded flows on free Freeing a flowtable with offloaded flows, the flow are deleted from hardware but are not deleted from the flow table, leaking them, and leaving their offload bit on. Add a second pass of the disabled gc to delete the these flows from the flow table before freeing it. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Paul Blakey Signed-off-by: Pablo Neira Ayuso commit 41e9ec5a54f95eee1a57c8d26ab70e0492548c1b Author: Haishuang Yan Date: Tue Mar 17 10:02:53 2020 +0800 netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6} Since pskb_may_pull may change skb->data, so we need to reload ip{v6}h at the right place. Fixes: a908fdec3dda ("netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table") Fixes: 7d2086871762 ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table") Signed-off-by: Haishuang Yan Signed-off-by: Pablo Neira Ayuso commit 61abaf02d2ec3d4575c66fa1b4a863877736b932 Author: Haishuang Yan Date: Tue Mar 17 10:02:52 2020 +0800 netfilter: flowtable: reload ip{v6}h in nf_flow_nat_ip{v6} Since nf_flow_snat_port and nf_flow_snat_ip{v6} call pskb_may_pull() which may change skb->data, so we need to reload ip{v6}h at the right place. Fixes: a908fdec3dda ("netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table") Fixes: 7d2086871762 ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table") Signed-off-by: Haishuang Yan Signed-off-by: Pablo Neira Ayuso commit 6c90b86a745a446717fdf408c4a8a4631a5e8ee3 Merge: cd607737f3b8 4686392c3236 Author: Linus Torvalds Date: Thu Mar 19 12:45:14 2020 -0700 Merge tag 'mmc-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - rtsx_pci: Fix support for some various speed modes - sdhci-of-at91: Fix support for GPIO card detect on SAMA5D2 - sdhci-cadence: Fix support for DDR52 speed mode for eMMC on UniPhier - sdhci-acpi: Fix broken WP support on Acer Aspire Switch 10 - sdhci-acpi: Workaround FW bug for suspend on Lenovo Miix 320 * tag 'mmc-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: rtsx_pci: Fix support for speed-modes that relies on tuning mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012) mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320 commit 3568b88944fef28db3ee989b957da49ffc627ede Author: Vincenzo Frascino Date: Thu Mar 19 14:11:38 2020 +0000 arm64: compat: Fix syscall number of compat_clock_getres The syscall number of compat_clock_getres was erroneously set to 247 (__NR_io_cancel!) instead of 264. This causes the vDSO fallback of clock_getres() to land on the wrong syscall for compat tasks. Fix the numbering. Cc: Fixes: 53c489e1dfeb6 ("arm64: compat: Add missing syscall numbers") Acked-by: Catalin Marinas Reviewed-by: Nick Desaulniers Signed-off-by: Vincenzo Frascino Signed-off-by: Will Deacon commit cd607737f3b84432b8a00cd31ac753dab1c38678 Merge: 207f75c4543f 979a2665eb6c Author: Linus Torvalds Date: Thu Mar 19 10:19:11 2020 -0700 Merge tag '5.6-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Three small smb3 fixes, two for stable" * tag '5.6-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: CIFS: fiemap: do not return EINVAL if get nothing CIFS: Increment num_remote_opens stats counter even in case of smb2_query_dir_first cifs: potential unintitliazed error code in cifs_getattr() commit 207f75c4543fcd34ed7ec84ede43479f1c08e7ca Merge: 5d892919fdd0 7883a1433929 Author: Linus Torvalds Date: Thu Mar 19 09:57:48 2020 -0700 Merge tag 'kbuild-fixes-v5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - fix __uint128_t capability test in Kconfig when GCC that defaults to 32-bit is used to build the 64-bit kernel - suppress new noisy Clang warnings -Wpointer-to-enum-cast - move the namespace field in Module.symvers for the backward compatibility reason for the depmod tool - use available compression for initramdisk when INTRAMFS_SOURCE is defined, which was the original behavior - fix modpost to handle correct large section numbers when it refers to modversion CRCs and module namespaces - fix comments and documents * tag 'kbuild-fixes-v5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: scripts/kallsyms: fix wrong kallsyms_relative_base modpost: Get proper section index by get_secindex() instead of st_shndx initramfs: restore default compression behavior modpost: move the namespace field in Module.symvers last kbuild: Disable -Wpointer-to-enum-cast kbuild: doc: fix references to other documents int128: fix __uint128_t compiler test in Kconfig kconfig: introduce m32-flag and m64-flag kbuild: Fix inconsistent comment commit 5d892919fdd0cefd361697472d4e1b174a594991 Author: Corentin Labbe Date: Wed Mar 18 15:26:49 2020 +0000 rtc: max8907: add missing select REGMAP_IRQ I have hit the following build error: armv7a-hardfloat-linux-gnueabi-ld: drivers/rtc/rtc-max8907.o: in function `max8907_rtc_probe': rtc-max8907.c:(.text+0x400): undefined reference to `regmap_irq_get_virq' max8907 should select REGMAP_IRQ Fixes: 94c01ab6d7544 ("rtc: add MAX8907 RTC driver") Cc: stable Signed-off-by: Corentin Labbe Signed-off-by: Linus Torvalds commit 564200ed8e71d91327d337e46bc778cee02da866 Author: Arnaldo Carvalho de Melo Date: Thu Mar 19 11:42:56 2020 -0300 tools headers uapi: Update linux/in.h copy To get the changes in: 267762538705 ("seg6: fix SRv6 L2 tunnels to use IANA-assigned protocol number") That ends up automatically adding the new IPPROTO_ETHERNET to the socket args beautifiers: $ tools/perf/trace/beauty/socket_ipproto.sh > before Apply this patch: $ tools/perf/trace/beauty/socket_ipproto.sh > after $ diff -u before after --- before 2020-03-19 11:48:36.876673819 -0300 +++ after 2020-03-19 11:49:00.148541377 -0300 @@ -6,6 +6,7 @@ [132] = "SCTP", [136] = "UDPLITE", [137] = "MPLS", + [143] = "ETHERNET", [17] = "UDP", [1] = "ICMP", [22] = "IDP", $ Addresses this tools/perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/in.h' differs from latest version at 'include/uapi/linux/in.h' diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h Cc: David S. Miller Cc: Paolo Lungaroni Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 7883a14339299773b2ce08dcfd97c63c199a9289 Author: Mikhail Petrov Date: Wed Mar 11 23:37:09 2020 +0300 scripts/kallsyms: fix wrong kallsyms_relative_base There is the code in the read_symbol function in 'scripts/kallsyms.c': if (is_ignored_symbol(name, type)) return NULL; /* Ignore most absolute/undefined (?) symbols. */ if (strcmp(name, "_text") == 0) _text = addr; But the is_ignored_symbol function returns true for name="_text" and type='A'. So the next condition is not executed and the _text variable is always zero. It makes the wrong kallsyms_relative_base symbol as a result of the code (CONFIG_KALLSYMS_BASE_RELATIVE is defined): if (base_relative) { output_label("kallsyms_relative_base"); output_address(relative_base); printf("\n"); } Because the output_address function uses the _text variable. So the kallsyms_lookup function and all related functions in the kernel do not work properly. For example, the stack trace in oops: Call Trace: [aa095e58] [809feab8] kobj_ns_ops_tbl+0x7ff09ac8/0x7ff1c1c4 (unreliable) [aa095e98] [80002b64] kobj_ns_ops_tbl+0x7f50db74/0x80000010 [aa095ef8] [809c3d24] kobj_ns_ops_tbl+0x7feced34/0x7ff1c1c4 [aa095f28] [80002ed0] kobj_ns_ops_tbl+0x7f50dee0/0x80000010 [aa095f38] [8000f238] kobj_ns_ops_tbl+0x7f51a248/0x80000010 The right stack trace: Call Trace: [aa095e58] [809feab8] module_vdu_video_init+0x2fc/0x3bc (unreliable) [aa095e98] [80002b64] do_one_initcall+0x40/0x1f0 [aa095ef8] [809c3d24] kernel_init_freeable+0x164/0x1d8 [aa095f28] [80002ed0] kernel_init+0x14/0x124 [aa095f38] [8000f238] ret_from_kernel_thread+0x14/0x1c [masahiroy@kernel.org: This issue happens on binutils <= 2.22 The following commit fixed it: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=d2667025dd30611514810c28bee9709e4623012a The symbol type of _text is 'T' on binutils >= 2.23 The minimal supported binutils version for the kernel build is 2.21 ] Signed-off-by: Mikhail Petrov Signed-off-by: Masahiro Yamada commit db5d85ce82487331b06ec0e076b85b5a3968bf53 Merge: ac309e7744be 1efde2754275 Author: Ingo Molnar Date: Thu Mar 19 14:59:10 2020 +0100 Merge tag 'perf-urgent-for-mingo-5.6-20200309' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf probe: Masami Hiramatsu: - Fix deletion of multiple probe events. - Fix userspace libraries handling by not depending on dwfl_module_addrsym(). Event parsing: Ian Rogers: - Fix reading of invalid memory in event parsing. python binding: Ilie Halip: - Fix clang detection when using CC=clang-version. build: Masami Hiramatsu: - Fix O= use with relative paths. Android: Dominik b. Czarnota: - Fix off by one in strncpy() size argument when handling Android libraries. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 870b4333a62e45b0b2000d14b301b7b8b8cad9da Author: Borislav Petkov Date: Wed Mar 18 19:27:48 2020 +0100 x86/ioremap: Fix CONFIG_EFI=n build In order to use efi_mem_type(), one needs CONFIG_EFI enabled. Otherwise that function is undefined. Use IS_ENABLED() to check and avoid the ifdeffery as the compiler optimizes away the following unreachable code then. Fixes: 985e537a4082 ("x86/ioremap: Map EFI runtime services data as encrypted for SEV") Reported-by: Randy Dunlap Signed-off-by: Borislav Petkov Tested-by: Randy Dunlap Cc: Tom Lendacky Cc: Link: https://lkml.kernel.org/r/7561e981-0d9b-d62c-0ef2-ce6007aff1ab@infradead.org commit c83557859eaa1286330a4d3d2e1ea0c0988c4604 Author: Will Deacon Date: Wed Mar 18 20:38:29 2020 +0000 arm64: kpti: Fix "kpti=off" when KASLR is enabled Enabling KASLR forces the use of non-global page-table entries for kernel mappings, as this is a decision that we have to make very early on before mapping the kernel proper. When used in conjunction with the "kpti=off" command-line option, it is possible to use non-global kernel mappings but with the kpti trampoline disabled. Since commit 09e3c22a86f6 ("arm64: Use a variable to store non-global mappings decision"), arm64_kernel_unmapped_at_el0() reflects only the use of non-global mappings and does not take into account whether the kpti trampoline is enabled. This breaks context switching of the TPIDRRO_EL0 register for 64-bit tasks, where the clearing of the register is deferred to the ret-to-user code, but it also breaks the ARM SPE PMU driver which helpfully recommends passing "kpti=off" on the command line! Report whether or not KPTI is actually enabled in arm64_kernel_unmapped_at_el0() and check the 'arm64_use_ng_mappings' global variable directly when determining the protection flags for kernel mappings. Cc: Mark Brown Reported-by: Hongbo Yao Tested-by: Hongbo Yao Fixes: 09e3c22a86f6 ("arm64: Use a variable to store non-global mappings decision") Signed-off-by: Will Deacon commit 3c025b6317272ee8493ee20fa5035c087626af48 Merge: 384d91c267e6 11a7686aa99c Author: David S. Miller Date: Wed Mar 18 18:51:43 2020 -0700 Merge branch 'wireguard-fixes' Jason A. Donenfeld says: ==================== wireguard fixes for 5.6-rc7 I originally intended to spend this cycle working on fun optimizations and architecture for WireGuard for 5.7, but I've been a bit neurotic about having 5.6 ship without any show stopper bugs. WireGuard has been stable for a long time now, but that doesn't make me any less nervous about the real deal in 5.6. To that end, I've been doing code reviews and having discussions, and we also had a security firm audit the code. That audit didn't turn up any vulnerabilities, but they did make a good defense-in-depth suggestion. This series contains: 1) Removal of a duplicated header, from YueHaibing. 2) Testing with 64-bit time in our test suite. 3) Account for skb->protocol==0 due to AF_PACKET sockets, suggested by Florian Fainelli. 4) Clean up some code in an unreachable switch/case branch, suggested by Florian Fainelli. 5) Better handling of low-order points, discussed with Mathias Hall-Andersen. ==================== Signed-off-by: David S. Miller commit 11a7686aa99c7fe4b3f80f6dcccd54129817984d Author: Jason A. Donenfeld Date: Wed Mar 18 18:30:47 2020 -0600 wireguard: noise: error out precomputed DH during handshake rather than config We precompute the static-static ECDH during configuration time, in order to save an expensive computation later when receiving network packets. However, not all ECDH computations yield a contributory result. Prior, we were just not letting those peers be added to the interface. However, this creates a strange inconsistency, since it was still possible to add other weird points, like a valid public key plus a low-order point, and, like points that result in zeros, a handshake would not complete. In order to make the behavior more uniform and less surprising, simply allow all peers to be added. Then, we'll error out later when doing the crypto if there's an issue. This also adds more separation between the crypto layer and the configuration layer. Discussed-with: Mathias Hall-Andersen Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 2b8765c52db24c0fbcc81bac9b5e8390f2c7d3c8 Author: Jason A. Donenfeld Date: Wed Mar 18 18:30:46 2020 -0600 wireguard: receive: remove dead code from default packet type case The situation in which we wind up hitting the default case here indicates a major bug in earlier parsing code. It is not a usual thing that should ever happen, which means a "friendly" message for it doesn't make sense. Rather, replace this with a WARN_ON, just like we do earlier in the file for a similar situation, so that somebody sends us a bug report and we can fix it. Reported-by: Fabian Freyer Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit a5588604af448664e796daf3c1d5a4523c60667b Author: Jason A. Donenfeld Date: Wed Mar 18 18:30:45 2020 -0600 wireguard: queueing: account for skb->protocol==0 We carry out checks to the effect of: if (skb->protocol != wg_examine_packet_protocol(skb)) goto err; By having wg_skb_examine_untrusted_ip_hdr return 0 on failure, this means that the check above still passes in the case where skb->protocol is zero, which is possible to hit with AF_PACKET: struct sockaddr_pkt saddr = { .spkt_device = "wg0" }; unsigned char buffer[5] = { 0 }; sendto(socket(AF_PACKET, SOCK_PACKET, /* skb->protocol = */ 0), buffer, sizeof(buffer), 0, (const struct sockaddr *)&saddr, sizeof(saddr)); Additional checks mean that this isn't actually a problem in the code base, but I could imagine it becoming a problem later if the function is used more liberally. I would prefer to fix this by having wg_examine_packet_protocol return a 32-bit ~0 value on failure, which will never match any value of skb->protocol, which would simply change the generated code from a mov to a movzx. However, sparse complains, and adding __force casts doesn't seem like a good idea, so instead we just add a simple helper function to check for the zero return value. Since wg_examine_packet_protocol itself gets inlined, this winds up not adding an additional branch to the generated code, since the 0 return value already happens in a mergable branch. Reported-by: Fabian Freyer Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 551599edbfff2431cef943a772fbde1c3e26eaf8 Author: Jason A. Donenfeld Date: Wed Mar 18 18:30:44 2020 -0600 wireguard: selftests: test using new 64-bit time_t In case this helps expose bugs with the newer 64-bit time_t types, we do our testing with the newer musl that supports this as well as CONFIG_COMPAT_32BIT_TIME=n. This matters to us, since wireguard does in fact deal with timestamps. Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 166391159c5deb84795d2ff46e95f276177fa5fb Author: YueHaibing Date: Wed Mar 18 18:30:43 2020 -0600 wireguard: selftests: remove duplicated include This commit removes a duplicated include. Signed-off-by: YueHaibing Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 0f08b3156d28e95333556ef8d6183982a68501f7 Merge: fb33c6510d55 b216a8e7908c Author: Dave Airlie Date: Thu Mar 19 11:47:41 2020 +1000 Merge tag 'drm-misc-fixes-2020-03-18-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - drm/lease: fix WARNING in idr_destroy - Fix AVI frame colorimetry in the dw-hdmi bridge. - Fix compiler warning in komeda by annotating functions as __maybe_unused. - Downgrade bochs pci_request_region failure from error to warning to workaround firmware fb. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/7654ac39-deb8-c9ca-9fd5-ef77b2636380@linux.intel.com commit 3384b043ea1564560ff19591cb9554867c7c6f77 Author: Greentime Hu Date: Tue Mar 3 17:34:18 2020 +0800 riscv: fix the IPI missing issue in nommu mode This patch fixes the IPI(inner processor interrupt) missing issue. It failed because it used hartid_mask to iterate for_each_cpu(), however the cpu_mask and hartid_mask may not be always the same. It will never send the IPI to hartid 4 because it will be skipped in for_each_cpu loop in my case. We can reproduce this case in Qemu sifive_u machine by this command. qemu-system-riscv64 -nographic -smp 5 -m 1G -M sifive_u -kernel \ arch/riscv/boot/loader It will hang in csd_lock_wait(csd) because the csd_unlock(csd) is not called. It is not called because hartid 4 doesn't receive the IPI to release this lock. The caller hart doesn't send the IPI to hartid 4 is because of hartid 4 is skipped in for_each_cpu(). It will be skipped is because "(cpu) < nr_cpu_ids" is not true. The hartid is 4 and nr_cpu_ids is 4. Therefore it should use cpumask in for_each_cpu() instead of hartid_mask. /* Send a message to all CPUs in the map */ arch_send_call_function_ipi_mask(cfd->cpumask_ipi); if (wait) { for_each_cpu(cpu, cfd->cpumask) { call_single_data_t *csd; csd = per_cpu_ptr(cfd->csd, cpu); csd_lock_wait(csd); } } for ((cpu) = -1; \ (cpu) = cpumask_next((cpu), (mask)), \ (cpu) < nr_cpu_ids;) It could boot to login console after this patch applied. Fixes: b2d36b5668f6 ("riscv: provide native clint access for M-mode") Signed-off-by: Greentime Hu Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt commit adccfb1a805ea84d2db38eb53032533279bdaa97 Author: Greentime Hu Date: Tue Mar 3 17:34:17 2020 +0800 riscv: uaccess should be used in nommu mode It might have the unaligned access exception when trying to exchange data with user space program. In this case, it failed in tty_ioctl(). Therefore we should enable uaccess.S for NOMMU mode since the generic code doesn't handle the unaligned access cases. 0x8013a212 : ld a5,460(s1) [ 0.115279] Oops - load address misaligned [#1] [ 0.115284] CPU: 0 PID: 29 Comm: sh Not tainted 5.4.0-rc5-00020-gb4c27160d562-dirty #36 [ 0.115294] epc: 000000008013a212 ra : 000000008013a212 sp : 000000008f48dd50 [ 0.115303] gp : 00000000801cac28 tp : 000000008fb80000 t0 : 00000000000000e8 [ 0.115312] t1 : 000000008f58f108 t2 : 0000000000000009 s0 : 000000008f48ddf0 [ 0.115321] s1 : 000000008f8c6220 a0 : 0000000000000001 a1 : 000000008f48dd28 [ 0.115330] a2 : 000000008fb80000 a3 : 00000000801a7398 a4 : 0000000000000000 [ 0.115339] a5 : 0000000000000000 a6 : 000000008f58f0c6 a7 : 000000000000001d [ 0.115348] s2 : 000000008f8c6308 s3 : 000000008f78b7c8 s4 : 000000008fb834c0 [ 0.115357] s5 : 0000000000005413 s6 : 0000000000000000 s7 : 000000008f58f2b0 [ 0.115366] s8 : 000000008f858008 s9 : 000000008f776818 s10: 000000008f776830 [ 0.115375] s11: 000000008fb840a8 t3 : 1999999999999999 t4 : 000000008f78704c [ 0.115384] t5 : 0000000000000005 t6 : 0000000000000002 [ 0.115391] status: 0000000200001880 badaddr: 000000008f8c63ec cause: 0000000000000004 [ 0.115401] ---[ end trace 00d490c6a8b6c9ac ]--- This failure could be fixed after this patch applied. [ 0.002282] Run /init as init process Initializing random number generator... [ 0.005573] random: dd: uninitialized urandom read (512 bytes read) done. Welcome to Buildroot buildroot login: root Password: Jan 1 00:00:00 login[62]: root login on 'ttySIF0' ~ # Signed-off-by: Greentime Hu Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt commit 384d91c267e621e0926062cfb3f20cb72dc16928 Author: Taehee Yoo Date: Wed Mar 18 13:28:09 2020 +0000 vxlan: check return value of gro_cells_init() gro_cells_init() returns error if memory allocation is failed. But the vxlan module doesn't check the return value of gro_cells_init(). Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")` Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit dd2af10402684cb5840a127caec9e7cdcff6d167 Author: Paul Blakey Date: Wed Mar 18 12:50:33 2020 +0200 net/sched: act_ct: Fix leak of ct zone template on replace Currently, on replace, the previous action instance params is swapped with a newly allocated params. The old params is only freed (via kfree_rcu), without releasing the allocated ct zone template related to it. Call tcf_ct_params_free (via call_rcu) for the old params, so it will release it. Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: Paul Blakey Signed-off-by: David S. Miller commit a3c33e7a4a116f8715c0ef0e668e6aeff009c762 Author: James Zhu Date: Wed Mar 18 17:12:12 2020 -0400 drm/amdgpu: fix typo for vcn2.5/jpeg2.5 idle check fix typo for vcn2.5/jpeg2.5 idle check Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit b5689d22aa6d815f29d34f8cbd708f9d34eed70a Author: James Zhu Date: Wed Mar 18 17:10:56 2020 -0400 drm/amdgpu: fix typo for vcn2/jpeg2 idle check fix typo for vcn2/jpeg2 idle check Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit acfc62dc68770aa665cc606891f6df7d6d1e52c0 Author: James Zhu Date: Wed Mar 18 17:09:05 2020 -0400 drm/amdgpu: fix typo for vcn1 idle check fix typo for vcn1 idle check Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit dcf23ac3e846ca0cf626c155a0e3fcbbcf4fae8a Author: Linus Torvalds Date: Wed Mar 18 07:52:21 2020 -0400 locks: reinstate locks_delete_block optimization There is measurable performance impact in some synthetic tests due to commit 6d390e4b5d48 (locks: fix a potential use-after-free problem when wakeup a waiter). Fix the race condition instead by clearing the fl_blocker pointer after the wake_up, using explicit acquire/release semantics. This does mean that we can no longer use the clearing of fl_blocker as the wait condition, so switch the waiters over to checking whether the fl_blocked_member list_head is empty. Reviewed-by: yangerkun Reviewed-by: NeilBrown Fixes: 6d390e4b5d48 (locks: fix a potential use-after-free problem when wakeup a waiter) Signed-off-by: Jeff Layton Signed-off-by: Linus Torvalds commit 4b8a5cfb5fd375cf4c7502a18f0096ed2881be27 Author: Xiao Yang Date: Wed Mar 18 18:34:16 2020 +0800 modpost: Get proper section index by get_secindex() instead of st_shndx (uint16_t) st_shndx is limited to 65535(i.e. SHN_XINDEX) so sym_get_data() gets wrong section index by st_shndx if requested symbol contains extended section index that is more than 65535. In this case, we need to get proper section index by .symtab_shndx section. Module.symvers generated by building kernel with "-ffunction-sections -fdata-sections" shows the issue. Fixes: 56067812d5b0 ("kbuild: modversions: add infrastructure for emitting relative CRCs") Fixes: e84f9fbbece1 ("modpost: refactor namespace_from_kstrtabns() to not hard-code section name") Signed-off-by: Xiao Yang Signed-off-by: Masahiro Yamada commit 5076190daded2197f62fe92cf69674488be44175 Author: Linus Torvalds Date: Tue Mar 17 11:04:09 2020 -0700 mm: slub: be more careful about the double cmpxchg of freelist This is just a cleanup addition to Jann's fix to properly update the transaction ID for the slub slowpath in commit fd4d9c7d0c71 ("mm: slub: add missing TID bump.."). The transaction ID is what protects us against any concurrent accesses, but we should really also make sure to make the 'freelist' comparison itself always use the same freelist value that we then used as the new next free pointer. Jann points out that if we do all of this carefully, we could skip the transaction ID update for all the paths that only remove entries from the lists, and only update the TID when adding entries (to avoid the ABA issue with cmpxchg and list handling re-adding a previously seen value). But this patch just does the "make sure to cmpxchg the same value we used" rather than then try to be clever. Acked-by: Jann Horn Signed-off-by: Linus Torvalds commit fd4d9c7d0c71866ec0c2825189ebd2ce35bd95b8 Author: Jann Horn Date: Tue Mar 17 01:28:45 2020 +0100 mm: slub: add missing TID bump in kmem_cache_alloc_bulk() When kmem_cache_alloc_bulk() attempts to allocate N objects from a percpu freelist of length M, and N > M > 0, it will first remove the M elements from the percpu freelist, then call ___slab_alloc() to allocate the next element and repopulate the percpu freelist. ___slab_alloc() can re-enable IRQs via allocate_slab(), so the TID must be bumped before ___slab_alloc() to properly commit the freelist head change. Fix it by unconditionally bumping c->tid when entering the slowpath. Cc: stable@vger.kernel.org Fixes: ebe909e0fdb3 ("slub: improve bulk alloc strategy") Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds commit b216a8e7908cd750550c0480cf7d2b3a37f06954 Author: Qiujun Huang Date: Wed Mar 18 15:53:50 2020 +0800 drm/lease: fix WARNING in idr_destroy drm_lease_create takes ownership of leases. And leases will be released by drm_master_put. drm_master_put ->drm_master_destroy ->idr_destroy So we needn't call idr_destroy again. Reported-and-tested-by: syzbot+05835159fe322770fe3d@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1584518030-4173-1-git-send-email-hqjagain@gmail.com commit 6e622cd8bd888c7fa3ee2b7dfb3514ab53b21570 Author: Eric Biggers Date: Mon Feb 24 10:20:44 2020 -0800 tty: fix compat TIOCGSERIAL checking wrong function ptr Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start checking for the presence of the ->set_serial function pointer rather than ->get_serial. This appears to be a copy-and-paste error, since ->get_serial is the function pointer that is called as well as the pointer that is checked by the non-compat version of TIOCGSERIAL. Fix this by checking the correct function pointer. Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") Cc: # v4.20+ Signed-off-by: Eric Biggers Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20200224182044.234553-3-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman commit 17329563a97df3ba474eca5037c1336e46e14ff8 Author: Eric Biggers Date: Mon Feb 24 10:20:43 2020 -0800 tty: fix compat TIOCGSERIAL leaking uninitialized memory Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start copying a whole 'serial_struct32' to userspace rather than individual fields, but failed to initialize all padding and fields -- namely the hole after the 'iomem_reg_shift' field, and the 'reserved' field. Fix this by initializing the struct to zero. [v2: use sizeof, and convert the adjacent line for consistency.] Reported-by: syzbot+8da9175e28eadcb203ce@syzkaller.appspotmail.com Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") Cc: # v4.20+ Signed-off-by: Eric Biggers Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20200224182044.234553-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman commit ed069827ca70af057caf21c395f76c2c0b82d429 Author: Eric Biggers Date: Sun Feb 23 23:33:59 2020 -0800 tty: drop outdated comments about release_tty() locking The current version of the TTY code unlocks the tty_struct(s) before release_tty() rather than after. Moreover, tty_unlock_pair() no longer exists. Thus, remove the outdated comments regarding tty_unlock_pair(). Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20200224073359.292795-1-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4686392c32361c97e8434adf9cc77ad7991bfa81 Author: Ricky Wu Date: Mon Mar 16 10:52:32 2020 +0800 mmc: rtsx_pci: Fix support for speed-modes that relies on tuning The TX/RX register should not be treated the same way to allow for better support of tuning. Fix this by using a default initial value for TX. Signed-off-by: Ricky Wu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200316025232.1167-1-ricky_wu@realtek.com [Ulf: Updated changelog] Signed-off-by: Ulf Hansson Acked-by: Greg Kroah-Hartman commit add492d2e9446a77ede9bb43699ec85ca8fc1aba Author: Alexander Shishkin Date: Tue Mar 17 08:22:15 2020 +0200 intel_th: pci: Add Elkhart Lake CPU support This adds support for the Trace Hub in Elkhart Lake CPU. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200317062215.15598-7-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ce666be89a8a09c5924ff08fc32e119f974bdab6 Author: Alexander Shishkin Date: Tue Mar 17 08:22:14 2020 +0200 intel_th: Fix user-visible error codes There are a few places in the driver that end up returning ENOTSUPP to the user, replace those with EINVAL. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver") Cc: stable@vger.kernel.org # v4.4+ Link: https://lore.kernel.org/r/20200317062215.15598-6-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 885f123554bbdc1807ca25a374be6e9b3bddf4de Author: Alexander Shishkin Date: Tue Mar 17 08:22:13 2020 +0200 intel_th: msu: Fix the unexpected state warning The unexpected state warning should only warn on illegal state transitions. Fix that. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Fixes: 615c164da0eb4 ("intel_th: msu: Introduce buffer interface") Cc: stable@vger.kernel.org # v5.4+ Link: https://lore.kernel.org/r/20200317062215.15598-5-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 283f87c0d5d32b4a5c22636adc559bca82196ed3 Author: Alexander Shishkin Date: Tue Mar 17 08:22:11 2020 +0200 stm class: sys-t: Fix the use of time_after() The operands of time_after() are in a wrong order in both instances in the sys-t driver. Fix that. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Fixes: 39f10239df75 ("stm class: p_sys-t: Add support for CLOCKSYNC packets") Fixes: d69d5e83110f ("stm class: Add MIPI SyS-T protocol support") Cc: stable@vger.kernel.org # v4.20+ Link: https://lore.kernel.org/r/20200317062215.15598-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 14800df6a020d38847fec77ac5a43dc221e5edfc Merge: bb5786b9286c 10856d88f765 Author: Greg Kroah-Hartman Date: Wed Mar 18 11:20:42 2020 +0100 Merge tag 'iio-fixes-for-5.6a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes in the 5.6 cycle. * adxl372 - Fix marking of buffered values as big endian. * ak8974 - Fix wrong handling of negative values when read from sysfs. * at91-sama5d2 - Fix differential mode by ensuring configuration set correctly. * ping - Use the write sensor type for of_ping_match table. * sps30 - Kconfig build dependency fix. * st-sensors - Fix a wrong identification of which part the SMO8840 ACPI ID indicates. * stm32-dsfdm - Fix a sleep in atomic issue by not using a trigger when it makes no sense. * stm32-timer - Make sure master mode is disabled when stopping. * vcnl400 - Update some sampling periods based on new docs. * tag 'iio-fixes-for-5.6a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: ping: set pa_laser_ping_cfg in of_ping_match iio: chemical: sps30: fix missing triggered buffer dependency iio: st_sensors: remap SMO8840 to LIS2DH12 iio: light: vcnl4000: update sampling periods for vcnl4040 iio: light: vcnl4000: update sampling periods for vcnl4200 iio: accel: adxl372: Set iio_chan BE iio: magnetometer: ak8974: Fix negative raw values in sysfs iio: trigger: stm32-timer: disable master mode when stopping iio: adc: stm32-dfsdm: fix sleep in atomic context iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode commit 2866ce8696167de300e27d50d521b5f671bab5d4 Merge: b401f8c4f492 cecc113c1af0 Author: Greg Kroah-Hartman Date: Wed Mar 18 10:42:57 2020 +0100 Merge tag 'usb-serial-5.6-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.6-rc7 Here are a couple of new device ids for 5.6-rc. All have been in linux-next with no reported issues. * tag 'usb-serial-5.6-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: pl2303: add device-id for HP LD381 USB: serial: option: add ME910G1 ECM composition 0x110b commit 2de9780f75076c1a1f122cbd39df0fa545284724 Author: Mauro Carvalho Chehab Date: Tue Mar 17 15:54:20 2020 +0100 net: core: dev.c: fix a documentation warning There's a markup for link with is "foo_". On this kernel-doc comment, we don't want this, but instead, place a literal reference. So, escape the literal with ``foo``, in order to avoid this warning: ./net/core/dev.c:5195: WARNING: Unknown target name: "page_is". Signed-off-by: Mauro Carvalho Chehab Signed-off-by: David S. Miller commit 6497ca07f5e91131c6c05e4564d7f98a780aa02b Author: Mauro Carvalho Chehab Date: Tue Mar 17 15:54:19 2020 +0100 net: phy: sfp-bus.c: get rid of docs warnings The indentation for the returned values are weird, causing those warnings: ./drivers/net/phy/sfp-bus.c:579: WARNING: Unexpected indentation. ./drivers/net/phy/sfp-bus.c:619: WARNING: Unexpected indentation. Use a list and change the identation for it to be properly parsed by the documentation toolchain. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: David S. Miller commit 155385754a9cb8489074372b766e402f527eba7b Merge: 872307abbd0d dfdde1345bc1 Author: David S. Miller Date: Tue Mar 17 21:24:23 2020 -0700 Merge branch 'ENA-driver-bug-fixes' Arthur Kiyanovski says: ==================== ENA driver bug fixes ==================== Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit dfdde1345bc124816f0fd42fa91b8748051e758e Author: Arthur Kiyanovski Date: Tue Mar 17 09:06:42 2020 +0200 net: ena: fix continuous keep-alive resets last_keep_alive_jiffies is updated in probe and when a keep-alive event is received. In case the driver times-out on a keep-alive event, it has high chances of continuously timing-out on keep-alive events. This is because when the driver recovers from the keep-alive-timeout reset the value of last_keep_alive_jiffies is very old, and if a keep-alive event is not received before the next timer expires, the value of last_keep_alive_jiffies will cause another keep-alive-timeout reset and so forth in a loop. Solution: Update last_keep_alive_jiffies whenever the device is restored after reset. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Noam Dagan Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 30623e1ed116bcd1785217d0a98eec643687e091 Author: Arthur Kiyanovski Date: Tue Mar 17 09:06:41 2020 +0200 net: ena: avoid memory access violation by validating req_id properly Rx req_id is an index in struct ena_eth_io_rx_cdesc_base. The driver should validate that the Rx req_id it received from the device is in range [0, ring_size -1]. Failure to do so could yield to potential memory access violoation. The validation was mistakenly done when refilling the Rx submission queue and not in Rx completion queue. Fixes: ad974baef2a1 ("net: ena: add support for out of order rx buffers refill") Signed-off-by: Noam Dagan Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit e02ae6ed51be3d28923bfd318ae57000f5643da5 Author: Arthur Kiyanovski Date: Tue Mar 17 09:06:40 2020 +0200 net: ena: fix request of incorrect number of IRQ vectors Bug: In short the main issue is caused by the fact that the number of queues is changed using ethtool after ena_probe() has been called and before ena_up() was executed. Here is the full scenario in detail: * ena_probe() is called when the driver is loaded, the driver is not up yet at the end of ena_probe(). * The number of queues is changed -> io_queue_count is changed as well - ena_up() is not called since the "dev_was_up" boolean in ena_update_queue_count() is false. * ena_up() is called by the kernel (it's called asynchronously some time after ena_probe()). ena_setup_io_intr() is called by ena_up() and it uses io_queue_count to get the suitable irq lines for each msix vector. The function ena_request_io_irq() is called right after that and it uses msix_vecs - This value only changes during ena_probe() and ena_restore() - to request the irq vectors. This results in "Failed to request I/O IRQ" error for i > io_queue_count. Numeric example: * After ena_probe() io_queue_count = 8, msix_vecs = 9. * The number of queues changes to 4 -> io_queue_count = 4, msix_vecs = 9. * ena_up() is executed for the first time: ** ena_setup_io_intr() inits the vectors only up to io_queue_count. ** ena_request_io_irq() calls request_irq() and fails for i = 5. How to reproduce: simply run the following commands: sudo rmmod ena && sudo insmod ena.ko; sudo ethtool -L eth1 combined 3; Fix: Use ENA_MAX_MSIX_VEC(adapter->num_io_queues + adapter->xdp_num_queues) instead of adapter->msix_vecs. We need to take XDP queues into consideration as they need to have msix vectors assigned to them as well. Note that the XDP cannot be attached before the driver is up and running but in XDP mode the issue might occur when the number of queues changes right after a reset trigger. The ENA_MAX_MSIX_VEC simply adds one to the argument since the first msix vector is reserved for management queue. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit ce1f352162828ba07470328828a32f47aa759020 Author: Arthur Kiyanovski Date: Tue Mar 17 09:06:39 2020 +0200 net: ena: fix incorrect setting of the number of msix vectors Overview: We don't frequently change the msix vectors throughout the life cycle of the driver. We do so in two functions: ena_probe() and ena_restore(). ena_probe() is only called when the driver is loaded. ena_restore() on the other hand is called during device reset / resume operations. We use num_io_queues for calculating and allocating the number of msix vectors. At ena_probe() this value is equal to max_num_io_queues and thus this is not an issue, however ena_restore() might be called after the number of io queues has changed. A possible bug scenario is as follows: * Change number of queues from 8 to 4. (num_io_queues = 4, max_num_io_queues = 8, msix_vecs = 9,) * Trigger reset occurs -> ena_restore is called. (num_io_queues = 4, max_num_io_queues =8 , msix_vecs = 5) * Change number of queues from 4 to 6. (num_io_queues = 6, max_num_io_queues = 8, msix_vecs = 5) * The driver will reset due to failure of check_for_rx_interrupt_queue() Fix: This can be easily fixed by always using max_num_io_queues to init the msix_vecs, since this number won't change as opposed to num_io_queues. Fixes: 4d19266022ec ("net: ena: multiple queue creation related cleanups") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 872307abbd0d9afd72171929806c2fa33dc34179 Author: Rayagonda Kokatanur Date: Tue Mar 17 10:24:35 2020 +0530 net: phy: mdio-mux-bcm-iproc: check clk_prepare_enable() return value Check clk_prepare_enable() return value. Fixes: 2c7230446bc9 ("net: phy: Add pm support to Broadcom iProc mdio mux driver") Signed-off-by: Rayagonda Kokatanur Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit af4e6671b21ff20ad189360d3a5a1d584c183091 Merge: d36963b861c1 88f6c8bf1aae Author: David S. Miller Date: Tue Mar 17 21:00:15 2020 -0700 Merge branch 'net-bcmgenet-revisit-MAC-reset' Doug Berger says: ==================== net: bcmgenet: revisit MAC reset Commit 3a55402c9387 ("net: bcmgenet: use RGMII loopback for MAC reset") was intended to resolve issues with reseting the UniMAC core within the GENET block by providing better control over the clocks used by the UniMAC core. Unfortunately, it is not compatible with all of the supported system configurations so an alternative method must be applied. This commit set provides such an alternative. The first commit reverts the previous change and the second commit provides the alternative reset sequence that addresses the concerns observed with the previous implementation. This replacement implementation should be applied to the stable branches wherever commit 3a55402c9387 ("net: bcmgenet: use RGMII loopback for MAC reset") has been applied. Unfortunately, reverting that commit may conflict with some restructuring changes introduced by commit 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config"). The first commit in this set has been manually edited to resolve the conflict on net/master. I would be happy to help stable maintainers with resolving any such conflicts if they occur. However, I do not expect that commit to have been backported to stable branch so hopefully the revert can be applied cleanly. ==================== Signed-off-by: David S. Miller commit 88f6c8bf1aaed5039923fb4c701cab4d42176275 Author: Doug Berger Date: Mon Mar 16 14:44:56 2020 -0700 net: bcmgenet: keep MAC in reset until PHY is up As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback during UniMAC sw_reset") the UniMAC must be clocked at least 5 cycles while the sw_reset is asserted to ensure a clean reset. That commit enabled local loopback to provide an Rx clock from the GENET sourced Tx clk. However, when connected in MII mode the Tx clk is sourced by the PHY so if an EPHY is not supplying clocks (e.g. when the link is down) the UniMAC does not receive the necessary clocks. This commit extends the sw_reset window until the PHY reports that the link is up thereby ensuring that the clocks are being provided to the MAC to produce a clean reset. One consequence is that if the system attempts to enter a Wake on LAN suspend state when the PHY link has not been active the MAC may not have had a chance to initialize cleanly. In this case, we remove the sw_reset and enable the WoL reception path as normal with the hope that the PHY will provide the necessary clocks to drive the WoL blocks if the link becomes active after the system has entered suspend. Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") Signed-off-by: Doug Berger Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 612eb1c3b9e504de24136c947ed7c07bc342f3aa Author: Doug Berger Date: Mon Mar 16 14:44:55 2020 -0700 Revert "net: bcmgenet: use RGMII loopback for MAC reset" This reverts commit 3a55402c93877d291b0a612d25edb03d1b4b93ac. This is not a good solution when connecting to an external switch that may not support the isolation of the TXC signal resulting in output driver contention on the pin. A different solution is necessary. Signed-off-by: Doug Berger Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit d36963b861c1ca352810cec2497e3dabf2333e11 Merge: 32ca98feab8c fa2632f74e57 Author: David S. Miller Date: Tue Mar 17 20:54:37 2020 -0700 Merge branch 'net-mvmdio-avoid-error-message-for-optional-IRQ' Chris Packham says: ==================== net: mvmdio: avoid error message for optional IRQ I've gone ahead an sent a revert. This is the same as the original v1 except I've added Andrew's review to the commit message. ==================== Signed-off-by: David S. Miller commit fa2632f74e57bbc869c8ad37751a11b6147a3acc Author: Chris Packham Date: Mon Mar 16 20:49:07 2020 +1300 net: mvmdio: avoid error message for optional IRQ Per the dt-binding the interrupt is optional so use platform_get_irq_optional() instead of platform_get_irq(). Since commit 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()") platform_get_irq() produces an error message orion-mdio f1072004.mdio: IRQ index 0 not found which is perfectly normal if one hasn't specified the optional property in the device tree. Signed-off-by: Chris Packham Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 028fd76b9b1cc9e195ce60790791fd3f37b9b5d7 Author: Chris Packham Date: Mon Mar 16 20:49:06 2020 +1300 Revert "net: mvmdio: avoid error message for optional IRQ" This reverts commit e1f550dc44a4d535da4e25ada1b0eaf8f3417929. platform_get_irq_optional() will still return -ENXIO when no interrupt is provided so the additional error handling caused the driver prone to fail when no interrupt was specified. Revert the change so we can apply the correct minimal fix. Signed-off-by: Chris Packham Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 3b059da9835c200d9533361f8b404fdcab007632 Author: Rajat Jain Date: Tue Mar 17 20:03:33 2020 -0700 Input: allocate keycode for "Selective Screenshot" key New Chrome OS keyboards have a "snip" key that is basically a selective screenshot (allows a user to select an area of screen to be copied). Allocate a keycode for it. Signed-off-by: Rajat Jain Reviewed-by: Harry Cutts Link: https://lore.kernel.org/r/20200313180333.75011-1-rajatja@google.com Signed-off-by: Dmitry Torokhov commit f50b7dacccbab2b9e3ef18f52a6dcc18ed2050b9 Author: Cristian Marussi Date: Wed Mar 11 17:12:45 2020 +0000 arm64: smp: fix crash_smp_send_stop() behaviour On a system configured to trigger a crash_kexec() reboot, when only one CPU is online and another CPU panics while starting-up, crash_smp_send_stop() will fail to send any STOP message to the other already online core, resulting in fail to freeze and registers not properly saved. Moreover even if the proper messages are sent (case CPUs > 2) it will similarly fail to account for the booting CPU when executing the final stop wait-loop, so potentially resulting in some CPU not been waited for shutdown before rebooting. A tangible effect of this behaviour can be observed when, after a panic with kexec enabled and loaded, on the following reboot triggered by kexec, the cpu that could not be successfully stopped fails to come back online: [ 362.291022] ------------[ cut here ]------------ [ 362.291525] kernel BUG at arch/arm64/kernel/cpufeature.c:886! [ 362.292023] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 362.292400] Modules linked in: [ 362.292970] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.6.0-rc4-00003-gc780b890948a #105 [ 362.293136] Hardware name: Foundation-v8A (DT) [ 362.293382] pstate: 200001c5 (nzCv dAIF -PAN -UAO) [ 362.294063] pc : has_cpuid_feature+0xf0/0x348 [ 362.294177] lr : verify_local_elf_hwcaps+0x84/0xe8 [ 362.294280] sp : ffff800011b1bf60 [ 362.294362] x29: ffff800011b1bf60 x28: 0000000000000000 [ 362.294534] x27: 0000000000000000 x26: 0000000000000000 [ 362.294631] x25: 0000000000000000 x24: ffff80001189a25c [ 362.294718] x23: 0000000000000000 x22: 0000000000000000 [ 362.294803] x21: ffff8000114aa018 x20: ffff800011156a00 [ 362.294897] x19: ffff800010c944a0 x18: 0000000000000004 [ 362.294987] x17: 0000000000000000 x16: 0000000000000000 [ 362.295073] x15: 00004e53b831ae3c x14: 00004e53b831ae3c [ 362.295165] x13: 0000000000000384 x12: 0000000000000000 [ 362.295251] x11: 0000000000000000 x10: 00400032b5503510 [ 362.295334] x9 : 0000000000000000 x8 : ffff800010c7e204 [ 362.295426] x7 : 00000000410fd0f0 x6 : 0000000000000001 [ 362.295508] x5 : 00000000410fd0f0 x4 : 0000000000000000 [ 362.295592] x3 : 0000000000000000 x2 : ffff8000100939d8 [ 362.295683] x1 : 0000000000180420 x0 : 0000000000180480 [ 362.296011] Call trace: [ 362.296257] has_cpuid_feature+0xf0/0x348 [ 362.296350] verify_local_elf_hwcaps+0x84/0xe8 [ 362.296424] check_local_cpu_capabilities+0x44/0x128 [ 362.296497] secondary_start_kernel+0xf4/0x188 [ 362.296998] Code: 52805001 72a00301 6b01001f 54000ec0 (d4210000) [ 362.298652] SMP: stopping secondary CPUs [ 362.300615] Starting crashdump kernel... [ 362.301168] Bye! [ 0.000000] Booting Linux on physical CPU 0x0000000003 [0x410fd0f0] [ 0.000000] Linux version 5.6.0-rc4-00003-gc780b890948a (crimar01@e120937-lin) (gcc version 8.3.0 (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36))) #105 SMP PREEMPT Fri Mar 6 17:00:42 GMT 2020 [ 0.000000] Machine model: Foundation-v8A [ 0.000000] earlycon: pl11 at MMIO 0x000000001c090000 (options '') [ 0.000000] printk: bootconsole [pl11] enabled ..... [ 0.138024] rcu: Hierarchical SRCU implementation. [ 0.153472] its@2f020000: unable to locate ITS domain [ 0.154078] its@2f020000: Unable to locate ITS domain [ 0.157541] EFI services will not be available. [ 0.175395] smp: Bringing up secondary CPUs ... [ 0.209182] psci: failed to boot CPU1 (-22) [ 0.209377] CPU1: failed to boot: -22 [ 0.274598] Detected PIPT I-cache on CPU2 [ 0.278707] GICv3: CPU2: found redistributor 1 region 0:0x000000002f120000 [ 0.285212] CPU2: Booted secondary processor 0x0000000001 [0x410fd0f0] [ 0.369053] Detected PIPT I-cache on CPU3 [ 0.372947] GICv3: CPU3: found redistributor 2 region 0:0x000000002f140000 [ 0.378664] CPU3: Booted secondary processor 0x0000000002 [0x410fd0f0] [ 0.401707] smp: Brought up 1 node, 3 CPUs [ 0.404057] SMP: Total of 3 processors activated. Make crash_smp_send_stop() account also for the online status of the calling CPU while evaluating how many CPUs are effectively online: this way the right number of STOPs is sent and all other stopped-cores's registers are properly saved. Fixes: 78fd584cdec05 ("arm64: kdump: implement machine_crash_shutdown()") Acked-by: Mark Rutland Signed-off-by: Cristian Marussi Signed-off-by: Will Deacon commit d0bab0c39e32d39a8c5cddca72e5b4a3059fe050 Author: Cristian Marussi Date: Wed Mar 11 17:12:44 2020 +0000 arm64: smp: fix smp_send_stop() behaviour On a system with only one CPU online, when another one CPU panics while starting-up, smp_send_stop() will fail to send any STOP message to the other already online core, resulting in a system still responsive and alive at the end of the panic procedure. [ 186.700083] CPU3: shutdown [ 187.075462] CPU2: shutdown [ 187.162869] CPU1: shutdown [ 188.689998] ------------[ cut here ]------------ [ 188.691645] kernel BUG at arch/arm64/kernel/cpufeature.c:886! [ 188.692079] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 188.692444] Modules linked in: [ 188.693031] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.6.0-rc4-00001-g338d25c35a98 #104 [ 188.693175] Hardware name: Foundation-v8A (DT) [ 188.693492] pstate: 200001c5 (nzCv dAIF -PAN -UAO) [ 188.694183] pc : has_cpuid_feature+0xf0/0x348 [ 188.694311] lr : verify_local_elf_hwcaps+0x84/0xe8 [ 188.694410] sp : ffff800011b1bf60 [ 188.694536] x29: ffff800011b1bf60 x28: 0000000000000000 [ 188.694707] x27: 0000000000000000 x26: 0000000000000000 [ 188.694801] x25: 0000000000000000 x24: ffff80001189a25c [ 188.694905] x23: 0000000000000000 x22: 0000000000000000 [ 188.694996] x21: ffff8000114aa018 x20: ffff800011156a38 [ 188.695089] x19: ffff800010c944a0 x18: 0000000000000004 [ 188.695187] x17: 0000000000000000 x16: 0000000000000000 [ 188.695280] x15: 0000249dbde5431e x14: 0262cbe497efa1fa [ 188.695371] x13: 0000000000000002 x12: 0000000000002592 [ 188.695472] x11: 0000000000000080 x10: 00400032b5503510 [ 188.695572] x9 : 0000000000000000 x8 : ffff800010c80204 [ 188.695659] x7 : 00000000410fd0f0 x6 : 0000000000000001 [ 188.695750] x5 : 00000000410fd0f0 x4 : 0000000000000000 [ 188.695836] x3 : 0000000000000000 x2 : ffff8000100939d8 [ 188.695919] x1 : 0000000000180420 x0 : 0000000000180480 [ 188.696253] Call trace: [ 188.696410] has_cpuid_feature+0xf0/0x348 [ 188.696504] verify_local_elf_hwcaps+0x84/0xe8 [ 188.696591] check_local_cpu_capabilities+0x44/0x128 [ 188.696666] secondary_start_kernel+0xf4/0x188 [ 188.697150] Code: 52805001 72a00301 6b01001f 54000ec0 (d4210000) [ 188.698639] ---[ end trace 3f12ca47652f7b72 ]--- [ 188.699160] Kernel panic - not syncing: Attempted to kill the idle task! [ 188.699546] Kernel Offset: disabled [ 188.699828] CPU features: 0x00004,20c02008 [ 188.700012] Memory Limit: none [ 188.700538] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- [root@arch ~]# echo Helo Helo [root@arch ~]# cat /proc/cpuinfo | grep proce processor : 0 Make smp_send_stop() account also for the online status of the calling CPU while evaluating how many CPUs are effectively online: this way, the right number of STOPs is sent, so enforcing a proper freeze of the system at the end of panic even under the above conditions. Fixes: 08e875c16a16c ("arm64: SMP support") Reported-by: Dave Martin Acked-by: Mark Rutland Signed-off-by: Cristian Marussi Signed-off-by: Will Deacon commit 8e7ae2518f5265f0ef09d561748098fde5a87ccd Author: Martin KaFai Lau Date: Fri Mar 13 18:02:09 2020 -0700 bpf: Sanitize the bpf_struct_ops tcp-cc name The bpf_struct_ops tcp-cc name should be sanitized in order to avoid problematic chars (e.g. whitespaces). This patch reuses the bpf_obj_name_cpy() for accepting the same set of characters in order to keep a consistent bpf programming experience. A "size" param is added. Also, the strlen is returned on success so that the caller (like the bpf_tcp_ca here) can error out on empty name. The existing callers of the bpf_obj_name_cpy() only need to change the testing statement to "if (err < 0)". For all these existing callers, the err will be overwritten later, so no extra change is needed for the new strlen return value. v3: - reverse xmas tree style v2: - Save the orig_src to avoid "end - size" (Andrii) Fixes: 0baf26b0fcd7 ("bpf: tcp: Support tcp_congestion_ops in bpf") Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20200314010209.1131542-1-kafai@fb.com commit b401f8c4f492cbf74f3f59c9141e5be3071071bb Author: Anthony Mallet Date: Thu Mar 12 14:31:01 2020 +0100 USB: cdc-acm: fix rounding error in TIOCSSERIAL By default, tty_port_init() initializes those parameters to a multiple of HZ. For instance in line 69 of tty_port.c: port->close_delay = (50 * HZ) / 100; https://github.com/torvalds/linux/blob/master/drivers/tty/tty_port.c#L69 With e.g. CONFIG_HZ = 250 (as this is the case for Ubuntu 18.04 linux-image-4.15.0-37-generic), the default setting for close_delay is thus 125. When ioctl(fd, TIOCGSERIAL, &s) is executed, the setting returned in user space is '12' (125/10). When ioctl(fd, TIOCSSERIAL, &s) is then executed with the same setting '12', the value is interpreted as '120' which is different from the current setting and a EPERM error may be raised by set_serial_info() if !CAP_SYS_ADMIN. https://github.com/torvalds/linux/blob/master/drivers/usb/class/cdc-acm.c#L919 Fixes: ba2d8ce9db0a6 ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)") Signed-off-by: Anthony Mallet Cc: stable Link: https://lore.kernel.org/r/20200312133101.7096-2-anthony.mallet@laas.fr Signed-off-by: Greg Kroah-Hartman commit 633e2b2ded739a34bd0fb1d8b5b871f7e489ea29 Author: Anthony Mallet Date: Thu Mar 12 14:31:00 2020 +0100 USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL close_delay and closing_wait are specified in hundredth of a second but stored internally in jiffies. Use the jiffies_to_msecs() and msecs_to_jiffies() functions to convert from each other. Signed-off-by: Anthony Mallet Cc: stable Link: https://lore.kernel.org/r/20200312133101.7096-1-anthony.mallet@laas.fr Signed-off-by: Greg Kroah-Hartman commit 75d7676ead19b1fbb5e0ee934c9ccddcb666b68c Author: Hans de Goede Date: Fri Mar 13 13:07:08 2020 +0100 usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters We have been receiving bug reports that ethernet connections over RTL8153 based ethernet adapters stops working after a while with errors like these showing up in dmesg when the ethernet stops working: [12696.189484] r8152 6-1:1.0 enp10s0u1: Tx timeout [12702.333456] r8152 6-1:1.0 enp10s0u1: Tx timeout [12707.965422] r8152 6-1:1.0 enp10s0u1: Tx timeout This has been reported on Dell WD15 docks, Belkin USB-C Express Dock 3.1 docks and with generic USB to ethernet dongles using the RTL8153 chipsets. Some users have tried adding usbcore.quirks=0bda:8153:k to the kernel commandline and all users who have tried this report that this fixes this. Also note that we already have an existing NO_LPM quirk for the RTL8153 used in the Microsoft Surface Dock (where it uses a different usb-id). This commit adds a NO_LPM quirk for the generic Realtek RTL8153 0bda:8153 usb-id, fixing the Tx timeout errors on these devices. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=198931 Cc: stable@vger.kernel.org Cc: russianneuromancer@ya.ru Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200313120708.100339-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit 7368760d1bcdabf515c41a502568b489de3da683 Author: Peter Chen Date: Mon Mar 16 11:10:34 2020 +0800 usb: chipidea: udc: fix sleeping function called from invalid context The code calls pm_runtime_get_sync with irq disabled, it causes below warning: BUG: sleeping function called from invalid context at wer/runtime.c:1075 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: er/u8:1 CPU: 1 PID: 37 Comm: kworker/u8:1 Not tainted 20200304-00181-gbebfd2a5be98 #1588 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: ci_otg ci_otg_work [] (unwind_backtrace) from [] 1/0x14) [] (show_stack) from [] 5/0x94) [] (dump_stack) from [] +0xeb/0x118) [] (___might_sleep) from [] esume+0x75/0x78) [] (__pm_runtime_resume) from [] 0x23/0x74) [] (ci_udc_pullup) from [] nect+0x2b/0xcc) [] (usb_gadget_connect) from [] _connect+0x59/0x104) [] (ci_hdrc_gadget_connect) from [] ssion+0x43/0x48) [] (ci_udc_vbus_session) from [] s_connect+0x17/0x9c) [] (usb_gadget_vbus_connect) from [] bd/0x128) [] (ci_otg_work) from [] rk+0x149/0x404) [] (process_one_work) from [] 0xf7/0x3bc) [] (worker_thread) from [] x118) [] (kthread) from [] (ret_from_fork+0x11/0x34) Tested-by: Dmitry Osipenko Cc: #v5.5 Fixes: 72dc8df7920f ("usb: chipidea: udc: protect usb interrupt enable") Reported-by: Dmitry Osipenko Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/20200316031034.17847-2-peter.chen@kernel.org Signed-off-by: Greg Kroah-Hartman commit 979a2665eb6c603ddce0ab374041ab101827b2e7 Author: Murphy Zhou Date: Sat Mar 14 11:38:31 2020 +0800 CIFS: fiemap: do not return EINVAL if get nothing If we call fiemap on a truncated file with none blocks allocated, it makes sense we get nothing from this call. No output means no blocks have been counted, but the call succeeded. It's a valid response. Simple example reproducer: xfs_io -f 'truncate 2M' -c 'fiemap -v' /cifssch/testfile xfs_io: ioctl(FS_IOC_FIEMAP) ["/cifssch/testfile"]: Invalid argument Signed-off-by: Murphy Zhou Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky CC: Stable commit 1be1fa42ebb73ad8fd67d2c846931361b4e3dd0a Author: Shyam Prasad N Date: Mon Mar 9 01:35:09 2020 -0700 CIFS: Increment num_remote_opens stats counter even in case of smb2_query_dir_first The num_remote_opens counter keeps track of the number of open files which must be maintained by the server at any point. This is a per-tree-connect counter, and the value of this counter gets displayed in the /proc/fs/cifs/Stats output as a following... Open files: 0 total (local), 1 open on server ^^^^^^^^^^^^^^^^ As a thumb-rule, we want to increment this counter for each open/create that we successfully execute on the server. Similarly, we should decrement the counter when we successfully execute a close. In this case, an increment was being missed in case of smb2_query_dir_first, in case of successful open. As a result, we would underflow the counter and we could even see the counter go to negative after sufficient smb2_query_dir_first calls. I tested the stats counter for a bunch of filesystem operations with the fix. And it looks like the counter looks correct to me. I also check if we missed the increments and decrements elsewhere. It does not seem so. Few other cases where an open is done and we don't increment the counter are the compound calls where the corresponding close is also sent in the request. Signed-off-by: Shyam Prasad N CC: Stable Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Reviewed-by: Pavel Shilovsky commit 39946886fc865a4c26f1b3ea0805936db2d8986d Author: Dan Carpenter Date: Fri Feb 28 12:22:59 2020 +0300 cifs: potential unintitliazed error code in cifs_getattr() Smatch complains that "rc" could be uninitialized. fs/cifs/inode.c:2206 cifs_getattr() error: uninitialized symbol 'rc'. Changing it to "return 0;" improves readability as well. Fixes: cc1baf98c8f6 ("cifs: do not ignore the SYNC flags in getattr") Signed-off-by: Dan Carpenter Signed-off-by: Steve French Acked-by: Ronnie Sahlberg commit a124458a127ccd7629e20cd7bae3e1f758ed32aa Author: Jian-Hong Pan Date: Tue Mar 17 16:28:09 2020 +0800 ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 A headset on the desktop like Acer N50-600 does not work, until quirk ALC662_FIXUP_ACER_NITRO_HEADSET_MODE is applied. Signed-off-by: Jian-Hong Pan Cc: Link: https://lore.kernel.org/r/20200317082806.73194-3-jian-hong@endlessm.com Signed-off-by: Takashi Iwai commit d858c706bdca97698752bd26b60c21ec07ef04f2 Author: Jian-Hong Pan Date: Tue Mar 17 16:28:07 2020 +0800 ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 The Acer desktop X2660G with ALC662 can't detect the headset microphone until ALC662_FIXUP_ACER_X2660G_HEADSET_MODE quirk applied. Signed-off-by: Jian-Hong Pan Cc: Link: https://lore.kernel.org/r/20200317082806.73194-2-jian-hong@endlessm.com Signed-off-by: Takashi Iwai commit dfa7ea303f56a3a8b1ed3b91ef35af2da67ca4ee Author: Roger Quadros Date: Mon Mar 16 12:27:31 2020 +0200 ARM: dts: omap5: Add bus_dma_limit for L3 bus The L3 interconnect's memory map is from 0x0 to 0xffffffff. Out of this, System memory (SDRAM) can be accessed from 0x80000000 to 0xffffffff (2GB) OMAP5 does support 4GB of SDRAM but upper 2GB can only be accessed by the MPU subsystem. Add the dma-ranges property to reflect the physical address limit of the L3 bus. Cc: stable@kernel.org Signed-off-by: Roger Quadros Signed-off-by: Tony Lindgren commit 4abd9930d189dedaa59097144c6d8f623342fa72 Author: Tony Lindgren Date: Sat Mar 14 13:55:05 2020 -0700 ARM: dts: omap4-droid4: Fix lost touchscreen interrupts Looks like we can have the maxtouch touchscreen stop producing interrupts if an edge interrupt is lost. This can happen easily when the SoC idles as the gpio controller may not see any state for an edge interrupt if it is briefly triggered when the system is idle. Also it looks like maxtouch stops sending any further interrupts if the interrupt is not handled. And we do have several cases of maxtouch already configured with a level interrupt, so let's do that. With level interrupt the gpio controller has the interrupt state visible after idle. Note that eventually we will probably also be using the Linux generic wakeirq configured for the controller, but that cannot be done until the maxtouch driver supports runtime PM. Cc: maemo-leste@lists.dyne.org Cc: Arthur Demchenkov Cc: Ivaylo Dimitrov Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren commit ac309e7744bee222df6de0122facaf2d9706fa70 Merge: 3d135f522476 819d578d51d0 Author: Linus Torvalds Date: Tue Mar 17 09:38:03 2020 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - string buffer formatting fixes in picolcd and sensor drivers, from Takashi Iwai - two new device IDs from Chen-Tsung Hsieh and Tony Fischetti * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: add ALWAYS_POLL quirk to lenovo pixart mouse HID: google: add moonball USB id HID: hid-sensor-custom: Use scnprintf() for avoiding potential buffer overflow HID: hid-picolcd_fb: Use scnprintf() for avoiding potential buffer overflow commit 78c3e5e6cde8193467427ed9e5f90a0d585625a1 Author: Arun Easi Date: Fri Mar 13 01:50:01 2020 -0700 scsi: qla2xxx: Fix I/Os being passed down when FC device is being deleted I/Os could be passed down while the device FC SCSI device is being deleted. This would result in unnecessary delay of I/O and driver messages (when extended logging is set). [mkp: fixed commit hash and added SoB for Nilesh] Link: https://lore.kernel.org/r/20200313085001.3781-1-njavali@marvell.com Fixes: 3c75ad1d87c7 ("scsi: qla2xxx: Remove defer flag to indicate immeadiate port loss") # v5.6-rc1+ Tested-by: Laurence Oberman Reviewed-by: Laurence Oberman Reviewed-by: Ewan D. Milne Reviewed-by: Roman Bolshakov Reviewed-by: Himanshu Madhani Signed-off-by: Arun Easi Signed-off-by: Nilesh Javali Signed-off-by: Martin K. Petersen commit bb5786b9286c253557a0115bc8d21879e61b7b94 Author: Michael Straube Date: Thu Mar 12 10:36:52 2020 +0100 staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 This device was added to the stand-alone driver on github. Add it to the staging driver as well. Link: https://github.com/lwfinger/rtl8188eu/commit/2141f244c3e7 Signed-off-by: Michael Straube Cc: stable Link: https://lore.kernel.org/r/20200312093652.13918-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit ae62cf5eb2792d9a818c2d93728ed92119357017 Author: Johan Hovold Date: Thu Mar 12 12:01:51 2020 +0100 staging: greybus: loopback_test: fix potential path truncations Newer GCC warns about possible truncations of two generated path names as we're concatenating the configurable sysfs and debugfs path prefixes with a filename and placing the results in buffers of the same size as the maximum length of the prefixes. snprintf(d->name, MAX_STR_LEN, "gb_loopback%u", dev_id); snprintf(d->sysfs_entry, MAX_SYSFS_PATH, "%s%s/", t->sysfs_prefix, d->name); snprintf(d->debugfs_entry, MAX_SYSFS_PATH, "%sraw_latency_%s", t->debugfs_prefix, d->name); Fix this by separating the maximum path length from the maximum prefix length and reducing the latter enough to fit the generated strings. Note that we also need to reduce the device-name buffer size as GCC isn't smart enough to figure out that we ever only used MAX_STR_LEN bytes of it. Fixes: 6b0658f68786 ("greybus: tools: Add tools directory to greybus repo and add loopback") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200312110151.22028-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit f16023834863932f95dfad13fac3fc47f77d2f29 Author: Johan Hovold Date: Thu Mar 12 12:01:50 2020 +0100 staging: greybus: loopback_test: fix potential path truncation Newer GCC warns about a possible truncation of a generated sysfs path name as we're concatenating a directory path with a file name and placing the result in a buffer that is half the size of the maximum length of the directory path (which is user controlled). loopback_test.c: In function 'open_poll_files': loopback_test.c:651:31: warning: '%s' directive output may be truncated writing up to 511 bytes into a region of size 255 [-Wformat-truncation=] 651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count"); | ^~ loopback_test.c:651:3: note: 'snprintf' output between 16 and 527 bytes into a destination of size 255 651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count"); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by making sure the buffer is large enough the concatenated strings. Fixes: 6b0658f68786 ("greybus: tools: Add tools directory to greybus repo and add loopback") Fixes: 9250c0ee2626 ("greybus: Loopback_test: use poll instead of inotify") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200312110151.22028-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8f3675be4bda33adbdc1dd2ab3b6c76a7599a79e Author: Johan Hovold Date: Thu Mar 12 12:01:49 2020 +0100 staging: greybus: loopback_test: fix poll-mask build breakage A scripted conversion from userland POLL* to kernel EPOLL* constants mistakingly replaced the poll flags in the loopback_test tool, which therefore no longer builds. Fixes: a9a08845e9ac ("vfs: do bulk POLL* -> EPOLL* replacement") Cc: stable # 4.16 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200312110151.22028-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 53dd0a7cd65edc83b0c243d1c08377c8b876b2ee Author: Michał Mirosław Date: Sun Mar 15 17:44:25 2020 +0100 mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 SAMA5D2x doesn't drive CMD line if GPIO is used as CD line (at least SAMA5D27 doesn't). Fix this by forcing card-detect in the module if module-controlled CD is not used. Fixed commit addresses the problem only for non-removable cards. This amends it to also cover gpio-cd case. Cc: stable@vger.kernel.org Fixes: 7a1e3f143176 ("mmc: sdhci-of-at91: force card detect value for non removable devices") Signed-off-by: Michał Mirosław Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/8d10950d9940468577daef4772b82a071b204716.1584290561.git.mirq-linux@rere.qmqm.pl Signed-off-by: Ulf Hansson commit 18b587b45c13bb6a07ed0edac15f06892593d07a Author: Masahiro Yamada Date: Thu Mar 12 19:42:57 2020 +0900 mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier The SDHCI_PRESET_FOR_* registers are not set for the UniPhier platform integration. (They are all read as zeros). Set the SDHCI_QUIRK2_PRESET_VALUE_BROKEN quirk flag. Otherwise, the High Speed DDR mode on the eMMC controller (MMC_TIMING_MMC_DDR52) would not work. I split the platform data to give no impact to other platforms, although the UniPhier platform is currently only the upstream user of this IP. The SDHCI_QUIRK2_PRESET_VALUE_BROKEN flag is set if the compatible string matches to "socionext,uniphier-sd4hc". Signed-off-by: Masahiro Yamada Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200312104257.21017-1-yamada.masahiro@socionext.com Signed-off-by: Ulf Hansson commit 3397b251ea02003f47f0b1667f3fe30bb4f9ce90 Author: Hans de Goede Date: Mon Mar 16 19:47:53 2020 +0100 mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012) On the Acer Aspire Switch 10 (SW5-012) microSD slot always reports the card being write-protected even though microSD cards do not have a write-protect switch at all. Add a new DMI_QUIRK_SD_NO_WRITE_PROTECT quirk which when set sets the MMC_CAP2_NO_WRITE_PROTECT flag on the controller for the external SD slot; and add a DMI quirk table entry which selects this quirk for the Acer SW5-012. Signed-off-by: Hans de Goede Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200316184753.393458-2-hdegoede@redhat.com Signed-off-by: Ulf Hansson commit 84d49b3d08a1d33690cc159036f381c31c27c17b Author: Hans de Goede Date: Mon Mar 16 19:47:52 2020 +0100 mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320 Based on a sample of 7 DSDTs from Cherry Trail devices using an AXP288 PMIC depending on the design one of 2 possible LDOs on the PMIC is used for the MMC signalling voltage, either DLDO3 or GPIO1LDO (GPIO1 pin in low noise LDO mode). The Lenovo Miix 320-10ICR uses GPIO1LDO in the SHC1 ACPI device's DSM methods to set 3.3 or 1.8 signalling voltage and this appears to work as advertised, so presumably the device is actually using GPIO1LDO for the external microSD signalling voltage. But this device has a bug in the _PS0 method of the SHC1 ACPI device, the DSM remembers the last set signalling voltage and the _PS0 restores this after a (runtime) suspend-resume cycle, but it "restores" the voltage on DLDO3 instead of setting it on GPIO1LDO as the DSM method does. DLDO3 is used for the LCD and setting it to 1.8V causes the LCD to go black. This commit works around this issue by calling the Intel DSM to reset the signal voltage to 3.3V after the host has been runtime suspended. This will make the _PS0 method reprogram the DLDO3 voltage to 3.3V, which leaves it at its original setting fixing the LCD going black. This commit adds and uses a DMI quirk mechanism to only trigger this workaround on the Lenovo Miix 320 while leaving the behavior of the driver unchanged on other devices. BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=111294 BugLink: https://gitlab.freedesktop.org/drm/intel/issues/355 Reported-by: russianneuromancer Signed-off-by: Hans de Goede Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200316184753.393458-1-hdegoede@redhat.com Signed-off-by: Ulf Hansson commit 785d74ec3bbf26ac7f6e92e6e96a259aec0f107a Author: Eugeniy Paltsev Date: Mon Mar 16 14:25:19 2020 +0300 initramfs: restore default compression behavior Even though INITRAMFS_SOURCE kconfig option isn't set in most of defconfigs it is used (set) extensively by various build systems. Commit f26661e12765 ("initramfs: make initramfs compression choice non-optional") has changed default compression mode. Previously we compress initramfs using available compression algorithm. Now we don't use any compression at all by default. It significantly increases the image size in case of build system chooses embedded initramfs. Initially I faced with this issue while using buildroot. As of today it's not possible to set preferred compression mode in target defconfig as this option depends on INITRAMFS_SOURCE being set. Modification of all build systems either doesn't look like good option. Let's instead rewrite initramfs compression mode choices list the way that "INITRAMFS_COMPRESSION_NONE" will be the last option in the list. In that case it will be chosen only if all other options (which implements any compression) are not available. Signed-off-by: Eugeniy Paltsev Signed-off-by: Masahiro Yamada commit 32ca98feab8c9076c89c0697c5a85e46fece809d Author: Petr Machata Date: Mon Mar 16 19:53:00 2020 +0200 net: ip_gre: Accept IFLA_INFO_DATA-less configuration The fix referenced below causes a crash when an ERSPAN tunnel is created without passing IFLA_INFO_DATA. Fix by validating passed-in data in the same way as ipgre does. Fixes: e1f8f78ffe98 ("net: ip_gre: Separate ERSPAN newlink / changelink callbacks") Reported-by: syzbot+1b4ebf4dae4e510dd219@syzkaller.appspotmail.com Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit 5190044c2965514a973184ca68ef5fad57a24670 Author: Jessica Yu Date: Wed Mar 11 18:01:20 2020 +0100 modpost: move the namespace field in Module.symvers last In order to preserve backwards compatability with kmod tools, we have to move the namespace field in Module.symvers last, as the depmod -e -E option looks at the first three fields in Module.symvers to check symbol versions (and it's expected they stay in the original order of crc, symbol, module). In addition, update an ancient comment above read_dump() in modpost that suggested that the export type field in Module.symvers was optional. I suspect that there were historical reasons behind that comment that are no longer accurate. We have been unconditionally printing the export type since 2.6.18 (commit bd5cbcedf44), which is over a decade ago now. Fix up read_dump() to treat each field as non-optional. I suspect the original read_dump() code treated the export field as optional in order to support pre <= 2.6.18 Module.symvers (which did not have the export type field). Note that although symbol namespaces are optional, the field will not be omitted from Module.symvers if a symbol does not have a namespace. In this case, the field will simply be empty and the next delimiter or end of line will follow. Cc: stable@vger.kernel.org Fixes: cb9b55d21fe0 ("modpost: add support for symbol namespaces") Tested-by: Matthias Maennich Reviewed-by: Matthias Maennich Reviewed-by: Lucas De Marchi Signed-off-by: Jessica Yu Signed-off-by: Masahiro Yamada commit 3d135f522476a815699dfbefb685de50bc5c12d6 Merge: fb33c6510d55 89604523a76e Author: Linus Torvalds Date: Mon Mar 16 15:39:52 2020 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - allow use of ARMv8 arch timer in 32-bit VDSO - rename missed .fixup section - fix kbuild issue with stack protector GCC plugin * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8961/2: Fix Kbuild issue caused by per-task stack protector GCC plugin ARM: 8958/1: rename missed uaccess .fixup section ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional() commit 065fd83e1be2e1ba0d446a257fd86a3cc7bddb51 Author: Jisheng Zhang Date: Mon Mar 16 22:56:36 2020 +0800 net: mvneta: Fix the case where the last poll did not process all rx For the case where the last mvneta_poll did not process all RX packets, we need to xor the pp->cause_rx_tx or port->cause_rx_tx before claculating the rx_queue. Fixes: 2dcf75e2793c ("net: mvneta: Associate RX queues with each CPU") Signed-off-by: Jisheng Zhang Signed-off-by: David S. Miller commit b317538c47943f9903860d83cc0060409e12d2ff Author: Zheng Wei Date: Mon Mar 16 22:23:47 2020 +0800 net: vxge: fix wrong __VA_ARGS__ usage printk in macro vxge_debug_ll uses __VA_ARGS__ without "##" prefix, it causes a build error when there is no variable arguments(e.g. only fmt is specified.). Signed-off-by: Zheng Wei Signed-off-by: David S. Miller commit 83d001068d33d4f93c52dcd35aaa143b6ef17120 Merge: 23c394819deb d79e9d7c1e4b Author: David S. Miller Date: Mon Mar 16 14:58:33 2020 -0700 Merge branch 'QorIQ-DPAA-ARM-RDBs-need-internal-delay-on-RGMII' Madalin Bucur says: ==================== QorIQ DPAA ARM RDBs need internal delay on RGMII v2: used phy_interface_mode_is_rgmii() to identify RGMII The QorIQ DPAA 1 based RDB boards require internal delay on both Tx and Rx to be set. The patch set ensures all RGMII modes are treated correctly by the FMan driver and sets the phy-connection-type to "rgmii-id" to restore functionality. Previously Rx internal delay was set by board pull-ups and was left untouched by the PHY driver. Since commit 1b3047b5208a80 ("net: phy: realtek: add support for configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver has control over the RGMII RX delay and it is disabling it for other modes than RGMII_RXID and RGMII_ID. Please note that u-boot in particular performs a fix-up of the PHY connection type and will overwrite the values from the Linux device tree. Another patch set was sent for u-boot and one needs to apply that [1] to the boot loader, to ensure this fix is complete, unless a different bootloader is used. ==================== Signed-off-by: David S. Miller commit d79e9d7c1e4ba5f95f2ff3541880c40ea9722212 Author: Madalin Bucur Date: Mon Mar 16 14:05:58 2020 +0200 arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode The correct setting for the RGMII ports on LS1046ARDB is to enable delay on both Rx and Tx so the interface mode used must be PHY_INTERFACE_MODE_RGMII_ID. Since commit 1b3047b5208a80 ("net: phy: realtek: add support for configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver has control over the RGMII RX delay and it is disabling it for RGMII_TXID. The LS1046ARDB uses two such PHYs in RGMII_ID mode but in the device tree the mode was described as "rgmii". Changing the phy-connection-type to "rgmii-id" to address the issue. Fixes: 3fa395d2c48a ("arm64: dts: add LS1046A DPAA FMan nodes") Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 4022d808c45277693ea86478fab1f081ebf997e8 Author: Madalin Bucur Date: Mon Mar 16 14:05:57 2020 +0200 arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id The correct setting for the RGMII ports on LS1043ARDB is to enable delay on both Rx and Tx so the interface mode used must be PHY_INTERFACE_MODE_RGMII_ID. Since commit 1b3047b5208a80 ("net: phy: realtek: add support for configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver has control over the RGMII RX delay and it is disabling it for RGMII_TXID. The LS1043ARDB uses two such PHYs in RGMII_ID mode but in the device tree the mode was described as "rgmii_txid". This issue was not apparent at the time as the PHY driver took the same action for RGMII_TXID and RGMII_ID back then but it became visible (RX no longer working) after the above patch. Changing the phy-connection-type to "rgmii-id" to address the issue. Fixes: bf02f2ffe59c ("arm64: dts: add LS1043A DPAA FMan support") Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 0fe1568061be372a908b408b93c2f64d1d95b6f6 Author: Madalin Bucur Date: Mon Mar 16 14:05:56 2020 +0200 net: fsl/fman: treat all RGMII modes in memac_adjust_link() Treat all internal delay variants the same as RGMII. Signed-off-by: Madalin Bucur Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 819d578d51d0ce73f06e35d69395ef55cd683a74 Author: Tony Fischetti Date: Thu Mar 12 12:16:06 2020 -0400 HID: add ALWAYS_POLL quirk to lenovo pixart mouse A lenovo pixart mouse (17ef:608d) is afflicted common the the malfunction where it disconnects and reconnects every minute--each time incrementing the device number. This patch adds the device id of the device and specifies that it needs the HID_QUIRK_ALWAYS_POLL quirk in order to work properly. Signed-off-by: Tony Fischetti Signed-off-by: Jiri Kosina commit 5f3d9b07b9bb4679922f0b2e2baa770e74a6bbd3 Author: Tony Lindgren Date: Fri Feb 21 09:10:30 2020 -0800 clk: ti: am43xx: Fix clock parent for RTC clock Currently enabling clkctrl clock on am4 can fail for RTC as the clock parent is wrong for RTC. Fixes: 76a1049b84dd ("clk: ti: am43xx: add new clkctrl data for am43xx") Signed-off-by: Tony Lindgren Link: https://lkml.kernel.org/r/20200221171030.39326-1-tony@atomide.com Acked-by: Tero Kristo Signed-off-by: Stephen Boyd commit 7aaec82fefd21b4de8b1ee3ec4f31af95ccc9ab1 Merge: 20055448dc1b 857c9d31f59f Author: Stephen Boyd Date: Mon Mar 16 11:26:05 2020 -0700 Merge tag 'imx-clk-fixes-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-fixes Pull a few more i.MX clk fixes for 5.6: - A couple of fixes on i.MX8MP clock driver to correct HDMI_AXI and ENET_QOS_ROOT parent clock * tag 'imx-clk-fixes-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: clk: imx8mp: Correct the enet_qos parent clock clk: imx8mp: Correct IMX8MP_CLK_HDMI_AXI clock parent commit 58322a1590fc189a8e1e349d309637d4a4942840 Author: Chen-Tsung Hsieh Date: Mon Mar 16 15:24:19 2020 +0800 HID: google: add moonball USB id Add 1 additional hammer-like device. Signed-off-by: Chen-Tsung Hsieh Reviewed-by: Nicolas Boichat Signed-off-by: Jiri Kosina commit fe8b7085cac3b0db03cdbb26d9309bc27325df0a Author: Matt Roper Date: Wed Mar 11 09:22:55 2020 -0700 drm/i915: Handle all MCR ranges The bspec documents multiple MCR ranges; make sure they're all captured by the driver. Bspec: 13991, 52079 Fixes: 592a7c5e082e ("drm/i915: Extend non readable mcr range") Cc: Mika Kuoppala Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20200311162300.1838847-2-matthew.d.roper@intel.com Reviewed-by: Mika Kuoppala (cherry picked from commit 415d1269975d3fc21c13a6ae8de7b5fe0e6febb1) Signed-off-by: Jani Nikula commit c09f6b4d0883dfb859c1ddcfb04c3260ef310ce0 Author: Caz Yokoyama Date: Wed Mar 4 14:13:59 2020 -0800 Revert "drm/i915/tgl: Add extra hdc flush workaround" This reverts commit 36a6b5d964d995b536b1925ec42052ee40ba92c4. The commit takes care Wa_1604544889 which was fixed on a0 stepping based on a0 replan. So no SW workaround is required on any stepping now. Reviewed-by: Matt Roper Signed-off-by: Caz Yokoyama Signed-off-by: José Roberto de Souza Fixes: 36a6b5d964d9 ("drm/i915/tgl: Add extra hdc flush workaround") Link: https://patchwork.freedesktop.org/patch/msgid/1c751032ce79c80c5485cae315f1a9904ce07cac.1583359940.git.caz.yokoyama@intel.com (cherry picked from commit 175c4d9b3b9a60b4ea0b8cd034011808c6a03b05) Signed-off-by: Jani Nikula commit 9777d8b2d2a148bc5d46694ec4f2559282fec8cf Author: Chris Wilson Date: Wed Mar 11 09:26:23 2020 +0000 drm/i915/execlists: Track active elements during dequeue Record the initial active element we use when building the next ELSP submission, so that we can compare against it latter to see if there's no change. Fixes: 44d0a9c05bc0 ("drm/i915/execlists: Skip redundant resubmission") Signed-off-by: Chris Wilson Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200311092624.10012-2-chris@chris-wilson.co.uk (cherry picked from commit 60ef5b7ac6a131f09d287a5f156c878c2c926a30) Signed-off-by: Jani Nikula commit 2a9de3af21aa8c31cd68b0b39330d69f8c1e59df Author: Torsten Hilbrich Date: Wed Mar 11 11:19:06 2020 +0100 vti6: Fix memory leak of skb if input policy check fails The vti6_rcv function performs some tests on the retrieved tunnel including checking the IP protocol, the XFRM input policy, the source and destination address. In all but one places the skb is released in the error case. When the input policy check fails the network packet is leaked. Using the same goto-label discard in this case to fix this problem. Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces") Signed-off-by: Torsten Hilbrich Reviewed-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit 6c3171ef76a0bad892050f6959a7eac02fb16df7 Author: Takashi Iwai Date: Mon Mar 16 10:05:06 2020 +0100 ALSA: seq: oss: Fix running status after receiving sysex This is a similar bug like the previous case for virmidi: the invalid running status is kept after receiving a sysex message. Again the fix is to clear the running status after handling the sysex. Cc: Link: https://lore.kernel.org/r/3b4a4e0f232b7afbaf0a843f63d0e538e3029bfd.camel@domdv.de Link: https://lore.kernel.org/r/20200316090506.23966-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4384f167ce5fa7241b61bb0984d651bc528ddebe Author: Takashi Iwai Date: Mon Mar 16 10:05:05 2020 +0100 ALSA: seq: virmidi: Fix running status after receiving sysex The virmidi driver handles sysex event exceptionally in a short-cut snd_seq_dump_var_event() call, but this missed the reset of the running status. As a result, it may lead to an incomplete command right after the sysex when an event with the same running status was queued. Fix it by clearing the running status properly via alling snd_midi_event_reset_decode() for that code path. Reported-by: Andreas Steinmetz Cc: Link: https://lore.kernel.org/r/3b4a4e0f232b7afbaf0a843f63d0e538e3029bfd.camel@domdv.de Link: https://lore.kernel.org/r/20200316090506.23966-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 23c394819deb4eb642b60bbd5b3eef181e65cd8f Merge: ef299cc3fa1a 2363d73a2f3e Author: David S. Miller Date: Mon Mar 16 02:04:24 2020 -0700 Merge branch 'ethtool-fail-with-error-if-request-has-unknown-flags' Michal Kubecek says: ==================== ethtool: fail with error if request has unknown flags Jakub Kicinski pointed out that if unrecognized flags are set in netlink header request, kernel shoud fail with an error rather than silently ignore them so that we have more freedom in future flags semantics. To help userspace with handling such errors, inform the client which flags are supported by kernel. For that purpose, we need to allow passing cookies as part of extack also in case of error (they can be only passed on success now). ==================== Signed-off-by: David S. Miller commit 2363d73a2f3e92787f336721c40918ba2eb0c74c Author: Michal Kubecek Date: Sun Mar 15 18:17:53 2020 +0100 ethtool: reject unrecognized request flags As pointed out by Jakub Kicinski, we ethtool netlink code should respond with an error if request head has flags set which are not recognized by kernel, either as a mistake or because it expects functionality introduced in later kernel versions. To avoid unnecessary roundtrips, use extack cookie to provide the information about supported request flags. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit f1388ec4a144f40348321a0915c5535d623e165c Author: Michal Kubecek Date: Sun Mar 15 18:17:48 2020 +0100 netlink: add nl_set_extack_cookie_u32() Similar to existing nl_set_extack_cookie_u64(), add new helper nl_set_extack_cookie_u32() which sets extack cookie to a u32 value. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit fe2a31d790f81bd14a76de3d3b87f4f1362f60cd Author: Michal Kubecek Date: Sun Mar 15 18:17:43 2020 +0100 netlink: allow extack cookie also for error messages Commit ba0dc5f6e0ba ("netlink: allow sending extended ACK with cookie on success") introduced a cookie which can be sent to userspace as part of extended ack message in the form of NLMSGERR_ATTR_COOKIE attribute. Currently the cookie is ignored if error code is non-zero but there is no technical reason for such limitation and it can be useful to provide machine parseable information as part of an error message. Include NLMSGERR_ATTR_COOKIE whenever the cookie has been set, regardless of error code. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit ef299cc3fa1a9e1288665a9fdc8bff55629fd359 Author: Cong Wang Date: Fri Mar 13 22:29:54 2020 -0700 net_sched: cls_route: remove the right filter from hashtable route4_change() allocates a new filter and copies values from the old one. After the new filter is inserted into the hash table, the old filter should be removed and freed, as the final step of the update. However, the current code mistakenly removes the new one. This looks apparently wrong to me, and it causes double "free" and use-after-free too, as reported by syzbot. Reported-and-tested-by: syzbot+f9b32aaacd60305d9687@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+2f8c233f131943d6056d@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+9c2df9fd5e9445b74e01@syzkaller.appspotmail.com Fixes: 1109c00547fc ("net: sched: RCU cls_route") Cc: Jamal Hadi Salim Cc: Jiri Pirko Cc: John Fastabend Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 4ae649e8879d5a96b0ce104c8eae6563c6f368a1 Merge: dcadaec22456 09e91dbea0aa Author: David S. Miller Date: Mon Mar 16 01:46:10 2020 -0700 Merge branch 'hsr-fix-several-bugs-in-generic-netlink-callback' Taehee Yoo says: ==================== hsr: fix several bugs in generic netlink callback This patchset is to fix several bugs they are related in generic netlink callback in hsr module. 1. The first patch is to add missing rcu_read_lock() in hsr_get_node_{list/status}(). The hsr_get_node_{list/status}() are not protected by RTNL because they are callback functions of generic netlink. But it calls __dev_get_by_index() without acquiring RTNL. So, it would use unsafe data. 2. The second patch is to avoid failure of hsr_get_node_list(). hsr_get_node_list() is a callback of generic netlink and it is used to get node information in userspace. But, if there are so many nodes, it fails because of buffer size. So, in this patch, restart routine is added. 3. The third patch is to set .netnsok flag to true. If .netnsok flag is false, non-init_net namespace is not allowed to operate generic netlink operations. So, currently, non-init_net namespace has no way to get node information because .netnsok is false in the current hsr code. Change log: v1->v2: - Preserve reverse christmas tree variable ordering in the second patch. ==================== Signed-off-by: David S. Miller commit 09e91dbea0aa32be02d8877bd50490813de56b9a Author: Taehee Yoo Date: Fri Mar 13 06:50:33 2020 +0000 hsr: set .netnsok flag The hsr module has been supporting the list and status command. (HSR_C_GET_NODE_LIST and HSR_C_GET_NODE_STATUS) These commands send node information to the user-space via generic netlink. But, in the non-init_net namespace, these commands are not allowed because .netnsok flag is false. So, there is no way to get node information in the non-init_net namespace. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit ca19c70f5225771c05bcdcb832b4eb84d7271c5e Author: Taehee Yoo Date: Fri Mar 13 06:50:24 2020 +0000 hsr: add restart routine into hsr_get_node_list() The hsr_get_node_list() is to send node addresses to the userspace. If there are so many nodes, it could fail because of buffer size. In order to avoid this failure, the restart routine is added. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 173756b86803655d70af7732079b3aa935e6ab68 Author: Taehee Yoo Date: Fri Mar 13 06:50:14 2020 +0000 hsr: use rcu_read_lock() in hsr_get_node_{list/status}() hsr_get_node_{list/status}() are not under rtnl_lock() because they are callback functions of generic netlink. But they use __dev_get_by_index() without rtnl_lock(). So, it would use unsafe data. In order to fix it, rcu_read_lock() and dev_get_by_index_rcu() are used instead of __dev_get_by_index(). Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 857c9d31f59f0c0e6117518452ca54883e47d859 Author: Fugang Duan Date: Wed Feb 19 14:04:11 2020 +0800 clk: imx8mp: Correct the enet_qos parent clock enet_qos is for eqos tsn AXI bus clock whose clock source is from ccm_enet_axi_clk_root, and controlled by CCM_CCGR59(offset 0x43b0) and CCM_CCGR64(offset 0x4400), so correct enet_qos root clock's parent clock to sim_enet. Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver") Signed-off-by: Fugang Duan Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit 78ef3c9ecf20b9d6291eb6e081dabae1a5d387d3 Author: Anson Huang Date: Wed Feb 19 14:04:10 2020 +0800 clk: imx8mp: Correct IMX8MP_CLK_HDMI_AXI clock parent IMX8MP_CLK_HDMI_AXI should be from imx8mp_media_axi_sels instead of imx8mp_media_apb_sels, fix it. Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit dcadaec2245616aedd94ff0129db2b13f2d8deb8 Merge: cb851c01b51b 2da222f612b5 Author: David S. Miller Date: Sun Mar 15 17:06:22 2020 -0700 Merge branch 'net-Use-scnprintf-for-avoiding-potential-buffer-overflow' Takashi Iwai says: ==================== net: Use scnprintf() for avoiding potential buffer overflow here is a respin of trivial patch series just to convert suspicious snprintf() usages with the more safer one, scnprintf(). v1->v2: Align the remaining lines to the open parenthesis Excluded i40e patch that was already queued ==================== Signed-off-by: David S. Miller commit 2da222f612b58b6e6b41972f46005b58aac1699e Author: Takashi Iwai Date: Sun Mar 15 10:35:03 2020 +0100 net: netdevsim: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Cc: "David S . Miller" Cc: Jakub Kicinski Cc: netdev@vger.kernel.org Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 5e892880e14fbc1944f49aa42a67496516fe5dac Author: Takashi Iwai Date: Sun Mar 15 10:35:02 2020 +0100 net: sfc: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Cc: "David S . Miller" Cc: Edward Cree Cc: Martin Habets Cc: Solarflare linux maintainers Cc: netdev@vger.kernel.org Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 38e0f746c456b2f7d64b37aef3b6bd9ad73508c0 Author: Takashi Iwai Date: Sun Mar 15 10:35:01 2020 +0100 net: ionic: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Reviewed-by: Simon Horman Acked-by: Shannon Nelson Cc: "David S . Miller" Cc: Jakub Kicinski Cc: oss-drivers@netronome.com Cc: netdev@vger.kernel.org Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 413ae546f8726ac0652e59fcf97561fc21f52653 Author: Takashi Iwai Date: Sun Mar 15 10:35:00 2020 +0100 net: nfp: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Reviewed-by: Simon Horman Cc: "David S . Miller" Cc: Jakub Kicinski Cc: oss-drivers@netronome.com To: netdev@vger.kernel.org Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 4a348601eb9131893c22b6ed2d3b6ba2bafc2391 Author: Takashi Iwai Date: Sun Mar 15 10:34:59 2020 +0100 net: mlx4: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Cc: "David S . Miller" Cc: Tariq Toukan To: netdev@vger.kernel.org Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 13bde56c5b7cc6489eb50c40449d461c7ca4da2d Author: Takashi Iwai Date: Sun Mar 15 10:34:58 2020 +0100 net: caif: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Cc: "David S . Miller" Cc: netdev@vger.kernel.org Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit cb851c01b51bb610a9093d01624565ce1d4e38fa Author: Ido Schimmel Date: Sun Mar 15 10:07:35 2020 +0200 mlxsw: reg: Increase register field length to 31 bits The cited commit set a value of 2^31-1 in order to "disable" the shaper on a given a port. However, the length of the maximum shaper rate field was not updated from 28 bits to 31 bits, which means ports are still limited to ~268Gbps despite supporting speeds of 400Gbps. Fix this by increasing the field's length. Fixes: 92afbfedb77d ("mlxsw: reg: Increase MLXSW_REG_QEEC_MAS_DIS") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit fb33c6510d5595144d585aa194d377cf74d31911 Author: Linus Torvalds Date: Sun Mar 15 15:01:23 2020 -0700 Linux 5.6-rc6 commit a42a7bb6f5362c77f38cdc5e2d05e9fe0c2ade2c Merge: 34d5a4b336e7 92c227554c8e Author: Linus Torvalds Date: Sun Mar 15 13:15:16 2020 -0700 Merge tag 'irq-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A single commit to handle an erratum in Cavium ThunderX to prevent access to GIC registers which are broken in the implementation" * tag 'irq-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3: Workaround Cavium erratum 38539 when reading GICD_TYPER2 commit 34d5a4b336e7e4c247d532a841d05367357197f8 Merge: ec181b7f30bd 8d67743653dc Author: Linus Torvalds Date: Sun Mar 15 12:55:52 2020 -0700 Merge tag 'locking-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fix from Thomas Gleixner: "Fix for yet another subtle futex issue. The futex code used ihold() to prevent inodes from vanishing, but ihold() does not guarantee inode persistence. Replace the inode pointer with a per boot, machine wide, unique inode identifier. The second commit fixes the breakage of the hash mechanism which causes a 100% performance regression" * tag 'locking-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Unbreak futex hashing futex: Fix inode life-time issue commit ec181b7f30bdae2fbbba1c0dd76aeaad89c7963e Merge: e99bc917fe02 469ff207b4c4 Author: Linus Torvalds Date: Sun Mar 15 12:52:56 2020 -0700 Merge tag 'x86-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "Two fixes for x86: - Map EFI runtime service data as encrypted when SEV is enabled. Otherwise e.g. SMBIOS data cannot be properly decoded by dmidecode. - Remove the warning in the vector management code which triggered when a managed interrupt affinity changed outside of a CPU hotplug operation. The warning was correct until the recent core code change that introduced a CPU isolation feature which needs to migrate managed interrupts away from online CPUs under certain conditions to achieve the isolation" * tag 'x86-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vector: Remove warning on managed interrupt migration x86/ioremap: Map EFI runtime services data as encrypted for SEV commit e99bc917fe0233ea64799a5bc376b7d7a7cb0aea Merge: ffe6da91b00e f967140dfb74 Author: Linus Torvalds Date: Sun Mar 15 12:50:15 2020 -0700 Merge tag 'perf-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A pile of perf fixes: Kernel side: - AMD uncore driver: Replace the open coded sanity check with the core variant, which provides the correct error code and also leaves a hint in dmesg Tooling: - Fix the stdio input handling with glibc versions >= 2.28 - Unbreak the futex-wake benchmark which was reduced to 0 test threads due to the conversion to cpumaps - Initialize sigaction structs before invoking sys_sigactio() - Plug the mapfile memory leak in perf jevents - Fix off by one relative directory includes - Fix an undefined string comparison in perf diff" * tag 'perf-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag tools: Fix off-by 1 relative directory includes perf jevents: Fix leak of mapfile memory perf bench: Clear struct sigaction before sigaction() syscall perf bench futex-wake: Restore thread count default to online CPU count perf top: Fix stdio interface input handling with glibc 2.28+ perf diff: Fix undefined string comparision spotted by clang's -Wstring-compare perf symbols: Don't try to find a vmlinux file when looking for kernel modules perf bench: Share some global variables to fix build with gcc 10 perf parse-events: Use asprintf() instead of strncpy() to read tracepoint files perf env: Do not return pointers to local variables perf tests bp_account: Make global variable static commit ffe6da91b00eb3f4b8227441ad67e2a8d8667e22 Merge: 52ac3777fc45 ecc421e05bab Author: Linus Torvalds Date: Sun Mar 15 12:48:21 2020 -0700 Merge tag 'timers-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single fix adding the missing time namespace adjustment in sys/sysinfo which caused sys/sysinfo to be inconsistent with /proc/uptime when read from a task inside a time namespace" * tag 'timers-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sys/sysinfo: Respect boottime inside time namespace commit 52ac3777fc4514b17c0c4c548f941207a0fc06a7 Merge: b67775e12457 59b5809655bd Author: Linus Torvalds Date: Sun Mar 15 12:44:23 2020 -0700 Merge tag 'ras-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fixes from Thomas Gleixner: "Two RAS related fixes: - Shut down the per CPU thermal throttling poll work properly when a CPU goes offline. The missing shutdown caused the poll work to be migrated to a unbound worker which triggered warnings about the usage of smp_processor_id() in preemptible context - Fix the PPIN feature initialization which missed to enable the functionality when PPIN_CTL was enabled but the MSR locked against updates" * tag 'ras-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Fix logic and comments around MSR_PPIN_CTL x86/mce/therm_throt: Undo thermal polling properly on CPU offline commit b67775e124572a7028e930c306ed68cc2f90b29b Merge: de28a65cd0e3 d6c066fda90d Author: Linus Torvalds Date: Sun Mar 15 12:42:03 2020 -0700 Merge tag 'efi-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Thomas Gleixner: "Two EFI fixes: - Prevent a race and buffer overflow in the sysfs efivars interface which causes kernel memory corruption. - Add the missing NULL pointer checks in efivar_store_raw()" * tag 'efi-urgent-2020-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Add a sanity check to efivar_store_raw() efi: Fix a race and a buffer overflow while reading efivars via sysfs commit de28a65cd0e39d031dfcdc61fbe06268cb4a5f94 Merge: d3dca69085e9 1da8347d8505 Author: Linus Torvalds Date: Sun Mar 15 12:37:10 2020 -0700 Merge tag 'iommu-fixes-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: - Intel VT-d fixes: - RCU list handling fixes - Replace WARN_TAINT with pr_warn + add_taint for reporting firmware issues - DebugFS fixes - Fix for hugepage handling in iova_to_phys implementation - Fix for handling VMD devices, which have a domain number which doesn't fit into 16 bits - Warning message fix - MSI allocation fix for iommu-dma code - Sign-extension fix for io page-table code - Fix for AMD-Vi to properly update the is-running bit when AVIC is used * tag 'iommu-fixes-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Populate debugfs if IOMMUs are detected iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE iommu/vt-d: Ignore devices with out-of-spec domain number iommu/vt-d: Fix the wrong printing in RHSA parsing iommu/vt-d: Fix debugfs register reads iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint iommu/vt-d: dmar_parse_one_rmrr: replace WARN_TAINT with pr_warn + add_taint iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint iommu/vt-d: Silence RCU-list debugging warnings iommu/vt-d: Fix RCU-list bugs in intel_iommu_init() iommu/dma: Fix MSI reservation allocation iommu/io-pgtable-arm: Fix IOVA validation for 32-bit iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page iommu/vt-d: Fix RCU list debugging warnings commit 92c227554c8e735a494cd4ddca2d5bebcd705b2c Merge: 2546287c5fb3 d01fd161e859 Author: Thomas Gleixner Date: Sun Mar 15 10:53:11 2020 +0100 Merge tag 'irqchip-fixes-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - Add workaround for Cavium/Marvell ThunderX unimplemented GIC registers commit 0fda7600c2e174fe27e9cf02e78e345226e441fa Author: Florian Westphal Date: Sat Mar 14 08:18:42 2020 +0100 geneve: move debug check after netdev unregister The debug check must be done after unregister_netdevice_many() call -- the list_del() for this is done inside .ndo_stop. Fixes: 2843a25348f8 ("geneve: speedup geneve tunnels dismantle") Reported-and-tested-by: Cc: Haishuang Yan Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Author: Willem de Bruijn Date: Fri Mar 13 12:18:09 2020 -0400 net/packet: tpacket_rcv: avoid a producer race condition PACKET_RX_RING can cause multiple writers to access the same slot if a fast writer wraps the ring while a slow writer is still copying. This is particularly likely with few, large, slots (e.g., GSO packets). Synchronize kernel thread ownership of rx ring slots with a bitmap. Writers acquire a slot race-free by testing tp_status TP_STATUS_KERNEL while holding the sk receive queue lock. They release this lock before copying and set tp_status to TP_STATUS_USER to release to userspace when done. During copying, another writer may take the lock, also see TP_STATUS_KERNEL, and start writing to the same slot. Introduce a new rx_owner_map bitmap with a bit per slot. To acquire a slot, test and set with the lock held. To release race-free, update tp_status and owner bit as a transaction, so take the lock again. This is the one of a variety of discussed options (see Link below): * instead of a shadow ring, embed the data in the slot itself, such as in tp_padding. But any test for this field may match a value left by userspace, causing deadlock. * avoid the lock on release. This leaves a small race if releasing the shadow slot before setting TP_STATUS_USER. The below reproducer showed that this race is not academic. If releasing the slot after tp_status, the race is more subtle. See the first link for details. * add a new tp_status TP_KERNEL_OWNED to avoid the transactional store of two fields. But, legacy applications may interpret all non-zero tp_status as owned by the user. As libpcap does. So this is possible only opt-in by newer processes. It can be added as an optional mode. * embed the struct at the tail of pg_vec to avoid extra allocation. The implementation proved no less complex than a separate field. The additional locking cost on release adds contention, no different than scaling on multicore or multiqueue h/w. In practice, below reproducer nor small packet tcpdump showed a noticeable change in perf report in cycles spent in spinlock. Where contention is problematic, packet sockets support mitigation through PACKET_FANOUT. And we can consider adding opt-in state TP_KERNEL_OWNED. Easy to reproduce by running multiple netperf or similar TCP_STREAM flows concurrently with `tcpdump -B 129 -n greater 60000`. Based on an earlier patchset by Jon Rosen. See links below. I believe this issue goes back to the introduction of tpacket_rcv, which predates git history. Link: https://www.mail-archive.com/netdev@vger.kernel.org/msg237222.html Suggested-by: Jon Rosen Signed-off-by: Willem de Bruijn Signed-off-by: Jon Rosen Signed-off-by: David S. Miller commit e1f8f78ffe9854308b9e12a73ebe4e909074fc33 Author: Petr Machata Date: Fri Mar 13 13:39:36 2020 +0200 net: ip_gre: Separate ERSPAN newlink / changelink callbacks ERSPAN shares most of the code path with GRE and gretap code. While that helps keep the code compact, it is also error prone. Currently a broken userspace can turn a gretap tunnel into a de facto ERSPAN one by passing IFLA_GRE_ERSPAN_VER. There has been a similar issue in ip6gretap in the past. To prevent these problems in future, split the newlink and changelink code paths. Split the ERSPAN code out of ipgre_netlink_parms() into a new function erspan_netlink_parms(). Extract a piece of common logic from ipgre_newlink() and ipgre_changelink() into ipgre_newlink_encap_setup(). Add erspan_newlink() and erspan_changelink(). Fixes: 84e54fe0a5ea ("gre: introduce native tunnel support for ERSPAN") Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit 46ea929b2b3f66e6a9bc91adbb9ca2157065f9b2 Author: Shahjada Abul Husain Date: Fri Mar 13 14:32:57 2020 +0530 cxgb4: fix delete filter entry fail in unload path Currently, the hardware TID index is assumed to start from index 0. However, with the following changeset, commit c21939998802 ("cxgb4: add support for high priority filters") hardware TID index can start after the high priority region, which has introduced a regression resulting in remove filters entry failure for cxgb4 unload path. This patch fix that. Fixes: c21939998802 ("cxgb4: add support for high priority filters") Signed-off-by: Shahjada Abul Husain Signed-off-by: David S. Miller commit fc191af1bb0d069dc7e981076e8b80af21f1e61d Author: Markus Fuchs Date: Fri Mar 6 17:38:48 2020 +0100 net: stmmac: platform: Fix misleading interrupt error msg Not every stmmac based platform makes use of the eth_wake_irq or eth_lpi interrupts. Use the platform_get_irq_byname_optional variant for these interrupts, so no error message is displayed, if they can't be found. Rather print an information to hint something might be wrong to assist debugging on platforms which use these interrupts. Signed-off-by: Markus Fuchs Signed-off-by: David S. Miller commit 13d0f7b814d9b4c67e60d8c2820c86ea181e7d99 Author: Bruno Meneguele Date: Thu Mar 12 20:08:20 2020 -0300 net/bpfilter: fix dprintf usage for /dev/kmsg The bpfilter UMH code was recently changed to log its informative messages to /dev/kmsg, however this interface doesn't support SEEK_CUR yet, used by dprintf(). As result dprintf() returns -EINVAL and doesn't log anything. However there already had some discussions about supporting SEEK_CUR into /dev/kmsg interface in the past it wasn't concluded. Since the only user of that from userspace perspective inside the kernel is the bpfilter UMH (userspace) module it's better to correct it here instead waiting a conclusion on the interface. Fixes: 36c4357c63f3 ("net: bpfilter: print umh messages to /dev/kmsg") Signed-off-by: Bruno Meneguele Signed-off-by: David S. Miller commit 0d1c3530e1bd38382edef72591b78e877e0edcd3 Author: Cong Wang Date: Wed Mar 11 22:42:28 2020 -0700 net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash(). Reported-and-tested-by: syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+c72da7b9ed57cde6fca2@syzkaller.appspotmail.com Fixes: 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit b1be2e8cd290f620777bfdb8aa00890cd2fa02b5 Author: Cong Wang Date: Wed Mar 11 22:42:27 2020 -0700 net_sched: hold rtnl lock in tcindex_partial_destroy_work() syzbot reported a use-after-free in tcindex_dump(). This is due to the lack of RTNL in the deferred rcu work. We queue this work with RTNL in tcindex_change(), later, tcindex_dump() is called: fh = tp->ops->get(tp, t->tcm_handle); ... err = tp->ops->change(..., &fh, ...); tfilter_notify(..., fh, ...); but there is nothing to serialize the pending tcindex_partial_destroy_work() with tcindex_dump(). Fix this by simply holding RTNL in tcindex_partial_destroy_work(), so that it won't be called until RTNL is released after tc_new_tfilter() is completed. Reported-and-tested-by: syzbot+653090db2562495901dc@syzkaller.appspotmail.com Fixes: 3d210534cc93 ("net_sched: fix a race condition in tcindex_destroy()") Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2 Author: Pavel Begunkov Date: Fri Mar 13 22:29:14 2020 +0300 io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN} Processing links, io_submit_sqe() prepares requests, drops sqes, and passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or IOSQE_ASYNC requests will go through the same prep, which doesn't expect sqe=NULL and fail with NULL pointer deference. Always do full prepare including io_alloc_async_ctx() for linked requests, and then it can skip the second preparation. Cc: stable@vger.kernel.org # 5.5 Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d3dca69085e94e52a1d61a34b8e5f73a9f3d7eed Merge: 3086ae071686 92bd1f2e1eed Author: Linus Torvalds Date: Sat Mar 14 15:53:48 2020 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has quite some regression fixes this time. One is also related to watchdogs, we have proper acks from Guenter for them" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: acpi: put device when verifying client fails misc: eeprom: at24: fix regulator underflow i2c: gpio: suppress error on probe defer macintosh: windfarm: fix MODINFO regression i2c: designware-pci: Fix BUG_ON during device removal i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional watchdog: iTCO_wdt: Export vendorsupport commit 3086ae071686e0fff1c0006a635f101edc5f3540 Merge: 6693075e0f46 8d92e992a785 Author: Linus Torvalds Date: Sat Mar 14 15:49:09 2020 -0700 Merge tag 'arc-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - Fix __ALIGN_STR and __ALIGN to not use default junk padding - Misc Kconfig cleanups, header updates * tag 'arc-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: define __ALIGN_STR and __ALIGN symbols for ARC ARC: show_regs: reduce lines of output ARC: Replace by ARC: fpu: fix randconfig build error reported by 0-day test service ARC: fix some Kconfig typos ARC: Cleanup old Kconfig IO scheduler options commit 6693075e0f46979f956fefdd51997f533b392615 Merge: 69a4d0baeeb1 018cabb694e3 Author: Linus Torvalds Date: Sat Mar 14 15:45:26 2020 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Bugfixes for x86 and s390" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: nVMX: avoid NULL pointer dereference with incorrect EVMCS GPAs KVM: x86: Initializing all kvm_lapic_irq fields in ioapic_write_indirect KVM: VMX: Condition ENCLS-exiting enabling on CPU support for SGX1 KVM: s390: Also reset registers in sync regs for initial cpu reset KVM: fix Kconfig menu text for -Werror KVM: x86: remove stale comment from struct x86_emulate_ctxt KVM: x86: clear stale x86_emulate_ctxt->intercept value KVM: SVM: Fix the svm vmexit code for WRMSR KVM: X86: Fix dereference null cpufreq policy commit 1da8347d8505c137fb07ff06bbcd3f2bf37409bc Author: Megha Dey Date: Sat Mar 14 11:39:59 2020 +0800 iommu/vt-d: Populate debugfs if IOMMUs are detected Currently, the intel iommu debugfs directory(/sys/kernel/debug/iommu/intel) gets populated only when DMA remapping is enabled (dmar_disabled = 0) irrespective of whether interrupt remapping is enabled or not. Instead, populate the intel iommu debugfs directory if any IOMMUs are detected. Cc: Dan Carpenter Fixes: ee2636b8670b1 ("iommu/vt-d: Enable base Intel IOMMU debugfs support") Signed-off-by: Megha Dey Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 69a4d0baeeb14b6a3c47570a0ac2e0fc4474f0e0 Merge: fffb08b37df9 20055448dc1b Author: Linus Torvalds Date: Sat Mar 14 08:59:35 2020 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A small collection of fixes. I'll make another sweep soon to look for more fixes for this -rc series. - Mark device node const in of_clk_get_parent APIs to ease landing changes in users later - Fix flag for Qualcomm SC7180 video clocks where we thought it would never turn off but actually hardware takes care of it - Remove disp_cc_mdss_rscc_ahb_clk on Qualcomm SC7180 SoCs because this clk is always on anyway - Correct some bad dt-binding numbers for i.MX8MN SoCs" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: imx8mn: Fix incorrect clock defines clk: qcom: dispcc: Remove support of disp_cc_mdss_rscc_ahb_clk clk: qcom: videocc: Update the clock flag for video_cc_vcodec0_core_clk of: clk: Make of_clk_get_parent_{count,name}() parameter const commit 018cabb694e3923998fdc2908af5268f1d89f48f Merge: 997224fe6673 95fa10103dab Author: Paolo Bonzini Date: Sat Mar 14 12:49:37 2020 +0100 Merge branch 'kvm-null-pointer-fix' into kvm-master commit 95fa10103dabc38be5de8efdfced5e67576ed896 Author: Vitaly Kuznetsov Date: Mon Mar 9 16:52:11 2020 +0100 KVM: nVMX: avoid NULL pointer dereference with incorrect EVMCS GPAs When an EVMCS enabled L1 guest on KVM will tries doing enlightened VMEnter with EVMCS GPA = 0 the host crashes because the evmcs_gpa != vmx->nested.hv_evmcs_vmptr condition in nested_vmx_handle_enlightened_vmptrld() will evaluate to false (as nested.hv_evmcs_vmptr is zeroed after init). The crash will happen on vmx->nested.hv_evmcs pointer dereference. Another problematic EVMCS ptr value is '-1' but it only causes host crash after nested_release_evmcs() invocation. The problem is exactly the same as with '0', we mistakenly think that the EVMCS pointer hasn't changed and thus nested.hv_evmcs_vmptr is valid. Resolve the issue by adding an additional !vmx->nested.hv_evmcs check to nested_vmx_handle_enlightened_vmptrld(), this way we will always be trying kvm_vcpu_map() when nested.hv_evmcs is NULL and this is supposed to catch all invalid EVMCS GPAs. Also, initialize hv_evmcs_vmptr to '0' in nested_release_evmcs() to be consistent with initialization where we don't currently set hv_evmcs_vmptr to '-1'. Cc: stable@vger.kernel.org Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 997224fe6673dfe2aaf4ba114cbbcc53bb18780e Merge: 0c22056f8c43 e93fc7b4544a Author: Paolo Bonzini Date: Sat Mar 14 11:59:08 2020 +0100 Merge tag 'kvm-s390-master-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master KVM: s390: Fully do the CPU resets as intended With 7de3f1423ff9 ("KVM: s390: Add new reset vcpu API") we clarified the meaning of the reset ioctl to fully reset the CPU and not only the parts that can not be handled by userspace. Turns out that we missed some parts. commit d01fd161e85904064290435f67f4ed59af5daf74 Author: Marc Zyngier Date: Wed Mar 11 11:56:49 2020 +0000 irqchip/gic-v3: Workaround Cavium erratum 38539 when reading GICD_TYPER2 Despite the architecture spec requiring that reserved registers in the GIC distributor memory map are RES0 (and thus are not allowed to generate an exception), the Cavium ThunderX (aka TX1) SoC explodes as such: [ 0.000000] GICv3: GIC: Using split EOI/Deactivate mode [ 0.000000] GICv3: 128 SPIs implemented [ 0.000000] GICv3: 0 Extended SPIs implemented [ 0.000000] Internal error: synchronous external abort: 96000210 [#1] SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc4-00035-g3cf6a3d5725f #7956 [ 0.000000] Hardware name: cavium,thunder-88xx (DT) [ 0.000000] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 0.000000] pc : __raw_readl+0x0/0x8 [ 0.000000] lr : gic_init_bases+0x110/0x560 [ 0.000000] sp : ffff800011243d90 [ 0.000000] x29: ffff800011243d90 x28: 0000000000000000 [ 0.000000] x27: 0000000000000018 x26: 0000000000000002 [ 0.000000] x25: ffff8000116f0000 x24: ffff000fbe6a2c80 [ 0.000000] x23: 0000000000000000 x22: ffff010fdc322b68 [ 0.000000] x21: ffff800010a7a208 x20: 00000000009b0404 [ 0.000000] x19: ffff80001124dad0 x18: 0000000000000010 [ 0.000000] x17: 000000004d8d492b x16: 00000000f67eb9af [ 0.000000] x15: ffffffffffffffff x14: ffff800011249908 [ 0.000000] x13: ffff800091243ae7 x12: ffff800011243af4 [ 0.000000] x11: ffff80001126e000 x10: ffff800011243a70 [ 0.000000] x9 : 00000000ffffffd0 x8 : ffff80001069c828 [ 0.000000] x7 : 0000000000000059 x6 : ffff8000113fb4d1 [ 0.000000] x5 : 0000000000000001 x4 : 0000000000000000 [ 0.000000] x3 : 0000000000000000 x2 : 0000000000000000 [ 0.000000] x1 : 0000000000000000 x0 : ffff8000116f000c [ 0.000000] Call trace: [ 0.000000] __raw_readl+0x0/0x8 [ 0.000000] gic_of_init+0x188/0x224 [ 0.000000] of_irq_init+0x200/0x3cc [ 0.000000] irqchip_init+0x1c/0x40 [ 0.000000] init_IRQ+0x160/0x1d0 [ 0.000000] start_kernel+0x2ec/0x4b8 [ 0.000000] Code: a8c47bfd d65f03c0 d538d080 d65f03c0 (b9400000) when reading the GICv4.1 GICD_TYPER2 register, which is unexpected... Work around it by adding a new quirk for the following variants: ThunderX: CN88xx OCTEON TX: CN83xx, CN81xx OCTEON TX2: CN93xx, CN96xx, CN98xx, CNF95xx* and use this flag to avoid accessing GICD_TYPER2. Note that all reserved registers (including redistributors and ITS) are impacted by this erratum, but that only GICD_TYPER2 has to be worked around so far. Signed-off-by: Marc Zyngier Tested-by: Robert Richter Tested-by: Mark Salter Tested-by: Tim Harvey Acked-by: Catalin Marinas Acked-by: Robert Richter Link: https://lore.kernel.org/r/20191027144234.8395-11-maz@kernel.org Link: https://lore.kernel.org/r/20200311115649.26060-1-maz@kernel.org commit 0c22056f8c43265da21a3dfe7b7e1379e5ff7c72 Author: Nitesh Narayan Lal Date: Fri Mar 13 09:16:24 2020 -0400 KVM: x86: Initializing all kvm_lapic_irq fields in ioapic_write_indirect Previously all fields of structure kvm_lapic_irq were not initialized before it was passed to kvm_bitmap_or_dest_vcpus(). Which will cause an issue when any of those fields are used for processing a request. For example not initializing the msi_redir_hint field before passing to the kvm_bitmap_or_dest_vcpus(), may lead to a misbehavior of kvm_apic_map_get_dest_lapic(). This will specifically happen when the kvm_lowest_prio_delivery() returns TRUE due to a non-zero garbage value of msi_redir_hint, which should not happen as the request belongs to APIC fixed delivery mode and we do not want to deliver the interrupt only to the lowest priority candidate. This patch initializes all the fields of kvm_lapic_irq based on the values of ioapic redirect_entry object before passing it on to kvm_bitmap_or_dest_vcpus(). Fixes: 7ee30bc132c6 ("KVM: x86: deliver KVM IOAPIC scan request to target vCPUs") Signed-off-by: Nitesh Narayan Lal Reviewed-by: Vitaly Kuznetsov [Set level to false since the value doesn't really matter. Suggested by Vitaly Kuznetsov. - Paolo] Signed-off-by: Paolo Bonzini commit 7a57c09bb1cb89239f38f690b87cdf2c7db76c34 Author: Sean Christopherson Date: Thu Mar 12 11:04:16 2020 -0700 KVM: VMX: Condition ENCLS-exiting enabling on CPU support for SGX1 Enable ENCLS-exiting (and thus set vmcs.ENCLS_EXITING_BITMAP) only if the CPU supports SGX1. Per Intel's SDM, all ENCLS leafs #UD if SGX1 is not supported[*], i.e. intercepting ENCLS to inject a #UD is unnecessary. Avoiding ENCLS-exiting even when it is reported as supported by the CPU works around a reported issue where SGX is "hard" disabled after an S3 suspend/resume cycle, i.e. CPUID.0x7.SGX=0 and the VMCS field/control are enumerated as unsupported. While the root cause of the S3 issue is unknown, it's definitely _not_ a KVM (or kernel) bug, i.e. this is a workaround for what is most likely a hardware or firmware issue. As a bonus side effect, KVM saves a VMWRITE when first preparing vmcs01 and vmcs02. Note, SGX must be disabled in BIOS to take advantage of this workaround [*] The additional ENCLS CPUID check on SGX1 exists so that SGX can be globally "soft" disabled post-reset, e.g. if #MC bits in MCi_CTL are cleared. Soft disabled meaning disabling SGX without clearing the primary CPUID bit (in leaf 0x7) and without poking into non-SGX CPU paths, e.g. for the VMCS controls. Fixes: 0b665d304028 ("KVM: vmx: Inject #UD for SGX ENCLS instruction in guest") Reported-by: Toni Spets Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 730ad0ede130015a773229573559e97ba0943065 Author: Suravee Suthikulpanit Date: Thu Mar 12 05:18:39 2020 -0500 iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE Commit b9c6ff94e43a ("iommu/amd: Re-factor guest virtual APIC (de-)activation code") accidentally left out the ir_data pointer when calling modity_irte_ga(), which causes the function amd_iommu_update_ga() to return prematurely due to struct amd_ir_data.ref is NULL and the "is_run" bit of IRTE does not get updated properly. This results in bad I/O performance since IOMMU AVIC always generate GA Log entry and notify IOMMU driver and KVM when it receives interrupt from the PCI pass-through device instead of directly inject interrupt to the vCPU. Fixes by passing ir_data when calling modify_irte_ga() as done previously. Fixes: b9c6ff94e43a ("iommu/amd: Re-factor guest virtual APIC (de-)activation code") Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit da72a379b2ec0bad3eb265787f7008bead0b040c Author: Daniel Drake Date: Thu Mar 12 14:09:55 2020 +0800 iommu/vt-d: Ignore devices with out-of-spec domain number VMD subdevices are created with a PCI domain ID of 0x10000 or higher. These subdevices are also handled like all other PCI devices by dmar_pci_bus_notifier(). However, when dmar_alloc_pci_notify_info() take records of such devices, it will truncate the domain ID to a u16 value (in info->seg). The device at (e.g.) 10000:00:02.0 is then treated by the DMAR code as if it is 0000:00:02.0. In the unlucky event that a real device also exists at 0000:00:02.0 and also has a device-specific entry in the DMAR table, dmar_insert_dev_scope() will crash on:   BUG_ON(i >= devices_cnt); That's basically a sanity check that only one PCI device matches a single DMAR entry; in this case we seem to have two matching devices. Fix this by ignoring devices that have a domain number higher than what can be looked up in the DMAR table. This problem was carefully diagnosed by Jian-Hong Pan. Signed-off-by: Lu Baolu Signed-off-by: Daniel Drake Fixes: 59ce0515cdaf3 ("iommu/vt-d: Update DRHD/RMRR/ATSR device scope caches when PCI hotplug happens") Signed-off-by: Joerg Roedel commit b0bb0c22c4db623f2e7b1a471596fbf1c22c6dc5 Author: Zhenzhong Duan Date: Thu Mar 12 14:09:54 2020 +0800 iommu/vt-d: Fix the wrong printing in RHSA parsing When base address in RHSA structure doesn't match base address in each DRHD structure, the base address in last DRHD is printed out. This doesn't make sense when there are multiple DRHD units, fix it by printing the buggy RHSA's base address. Signed-off-by: Lu Baolu Signed-off-by: Zhenzhong Duan Fixes: fd0c8894893cb ("intel-iommu: Set a more specific taint flag for invalid BIOS DMAR tables") Signed-off-by: Joerg Roedel commit 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f Author: Nathan Chancellor Date: Wed Mar 11 12:41:21 2020 -0700 kbuild: Disable -Wpointer-to-enum-cast Clang's -Wpointer-to-int-cast deviates from GCC in that it warns when casting to enums. The kernel does this in certain places, such as device tree matches to set the version of the device being used, which allows the kernel to avoid using a gigantic union. https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L428 https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L402 https://elixir.bootlin.com/linux/v5.5.8/source/include/linux/mod_devicetable.h#L264 To avoid a ton of false positive warnings, disable this particular part of the warning, which has been split off into a separate diagnostic so that the entire warning does not need to be turned off for clang. It will be visible under W=1 in case people want to go about fixing these easily and enabling the warning treewide. Cc: stable@vger.kernel.org Link: https://github.com/ClangBuiltLinux/linux/issues/887 Link: https://github.com/llvm/llvm-project/commit/2a41b31fcdfcb67ab7038fc2ffb606fd50b83a84 Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit fffb08b37df928475fef9c7f2aafddc2f6ebfaf4 Merge: b0ea262a2347 394b61711f3c Author: Linus Torvalds Date: Fri Mar 13 16:39:19 2020 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two small fixes, both in drivers: ipr and ufs" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ipr: Fix softlockup when rescanning devices in petitboot scsi: ufs: Fix possible unclocked access to auto hibern8 timer register commit 7d7587db0d7fd1138f2afcffdc46a8e15630b944 Author: David Howells Date: Thu Mar 12 21:40:06 2020 +0000 afs: Fix client call Rx-phase signal handling Fix the handling of signals in client rxrpc calls made by the afs filesystem. Ignore signals completely, leaving call abandonment or connection loss to be detected by timeouts inside AF_RXRPC. Allowing a filesystem call to be interrupted after the entire request has been transmitted and an abort sent means that the server may or may not have done the action - and we don't know. It may even be worse than that for older servers. Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals") Signed-off-by: David Howells commit dde9f095583b3f375ba23979045ee10dfcebec2f Author: David Howells Date: Fri Mar 13 13:46:08 2020 +0000 afs: Fix handling of an abort from a service handler When an AFS service handler function aborts a call, AF_RXRPC marks the call as complete - which means that it's not going to get any more packets from the receiver. This is a problem because reception of the final ACK is what triggers afs_deliver_to_call() to drop the final ref on the afs_call object. Instead, aborted AFS service calls may then just sit around waiting for ever or until they're displaced by a new call on the same connection channel or a connection-level abort. Fix this by calling afs_set_call_complete() to finalise the afs_call struct representing the call. However, we then need to drop the ref that stops the call from being deallocated. We can do this in afs_set_call_complete(), as the work queue is holding a separate ref of its own, but then we shouldn't do it in afs_process_async_call() and afs_delete_async_call(). call->drop_ref is set to indicate that a ref needs dropping for a call and this is dealt with when we transition a call to AFS_CALL_COMPLETE. But then we also need to get rid of the ref that pins an asynchronous client call. We can do this by the same mechanism, setting call->drop_ref for an async client call too. We can also get rid of call->incoming since nothing ever sets it and only one thing ever checks it (futilely). A trace of the rxrpc_call and afs_call struct ref counting looks like: -0 [001] ..s5 164.764892: rxrpc_call: c=00000002 SEE u=3 sp=rxrpc_new_incoming_call+0x473/0xb34 a=00000000442095b5 -0 [001] .Ns5 164.766001: rxrpc_call: c=00000002 QUE u=4 sp=rxrpc_propose_ACK+0xbe/0x551 a=00000000442095b5 -0 [001] .Ns4 164.766005: rxrpc_call: c=00000002 PUT u=3 sp=rxrpc_new_incoming_call+0xa3f/0xb34 a=00000000442095b5 -0 [001] .Ns7 164.766433: afs_call: c=00000002 WAKE u=2 o=11 sp=rxrpc_notify_socket+0x196/0x33c kworker/1:2-1810 [001] ...1 164.768409: rxrpc_call: c=00000002 SEE u=3 sp=rxrpc_process_call+0x25/0x7ae a=00000000442095b5 kworker/1:2-1810 [001] ...1 164.769439: rxrpc_tx_packet: c=00000002 e9f1a7a8:95786a88:00000008:09c5 00000001 00000000 02 22 ACK CallAck kworker/1:2-1810 [001] ...1 164.769459: rxrpc_call: c=00000002 PUT u=2 sp=rxrpc_process_call+0x74f/0x7ae a=00000000442095b5 kworker/1:2-1810 [001] ...1 164.770794: afs_call: c=00000002 QUEUE u=3 o=12 sp=afs_deliver_to_call+0x449/0x72c kworker/1:2-1810 [001] ...1 164.770829: afs_call: c=00000002 PUT u=2 o=12 sp=afs_process_async_call+0xdb/0x11e kworker/1:2-1810 [001] ...2 164.771084: rxrpc_abort: c=00000002 95786a88:00000008 s=0 a=1 e=1 K-1 kworker/1:2-1810 [001] ...1 164.771461: rxrpc_tx_packet: c=00000002 e9f1a7a8:95786a88:00000008:09c5 00000002 00000000 04 00 ABORT CallAbort kworker/1:2-1810 [001] ...1 164.771466: afs_call: c=00000002 PUT u=1 o=12 sp=SRXAFSCB_ProbeUuid+0xc1/0x106 The abort generated in SRXAFSCB_ProbeUuid(), labelled "K-1", indicates that the local filesystem/cache manager didn't recognise the UUID as its own. Fixes: 2067b2b3f484 ("afs: Fix the CB.ProbeUuid service handler to reply correctly") Signed-off-by: David Howells commit 4636cf184d6d9a92a56c2554681ea520dd4fe49a Author: David Howells Date: Fri Mar 13 13:36:01 2020 +0000 afs: Fix some tracing details Fix a couple of tracelines to indicate the usage count after the atomic op, not the usage count before it to be consistent with other afs and rxrpc trace lines. Change the wording of the afs_call_trace_work trace ID label from "WORK" to "QUEUE" to reflect the fact that it's queueing work, not doing work. Fixes: 341f741f04be ("afs: Refcount the afs_call struct") Signed-off-by: David Howells commit 498b577660f08cef5d9e78e0ed6dcd4c0939e98c Author: David Howells Date: Fri Mar 13 17:30:27 2020 +0000 rxrpc: Fix sendmsg(MSG_WAITALL) handling Fix the handling of sendmsg() with MSG_WAITALL for userspace to round the timeout for when a signal occurs up to at least two jiffies as a 1 jiffy timeout may end up being effectively 0 if jiffies wraps at the wrong time. Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals") Signed-off-by: David Howells commit e138aa7d3271ac1b0690ae2c9b04d51468dce1d6 Author: David Howells Date: Fri Mar 13 09:22:09 2020 +0000 rxrpc: Fix call interruptibility handling Fix the interruptibility of kernel-initiated client calls so that they're either only interruptible when they're waiting for a call slot to come available or they're not interruptible at all. Either way, they're not interruptible during transmission. This should help prevent StoreData calls from being interrupted when writeback is in progress. It doesn't, however, handle interruption during the receive phase. Userspace-initiated calls are still interruptable. After the signal has been handled, sendmsg() will return the amount of data copied out of the buffer and userspace can perform another sendmsg() call to continue transmission. Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals") Signed-off-by: David Howells commit 158fe6665389964a1de212818b4a5c52b7f7aff4 Author: David Howells Date: Fri Mar 13 09:05:38 2020 +0000 rxrpc: Abstract out the calculation of whether there's Tx space Abstract out the calculation of there being sufficient Tx buffer space. This is reproduced several times in the rxrpc sendmsg code. Signed-off-by: David Howells commit b0ea262a2347eac8522de5eef24ccd7a90dad7d4 Merge: 7e6d869f5f02 55dee1bc0d72 Author: Linus Torvalds Date: Fri Mar 13 15:21:32 2020 -0700 Merge tag 'nfs-for-5.6-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client bugfixes from Anna Schumaker: "These are mostly fscontext fixes, but there is also one that fixes collisions seen in fscache: - Ensure the fs_context has the correct fs_type when mounting and submounting - Fix leaking of ctx->nfs_server.hostname - Add minor version to fscache key to prevent collisions" * tag 'nfs-for-5.6-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: nfs: add minor version to nfs_server_key for fscache NFS: Fix leak of ctx->nfs_server.hostname NFS: Don't hard-code the fs_type when submounting NFS: Ensure the fs_context has the correct fs_type before mounting commit 7e6d869f5f024adc1fb0049f085c7a433fd09b14 Merge: 2af82177af47 3e8cb8b2eaeb Author: Linus Torvalds Date: Fri Mar 13 15:19:38 2020 -0700 Merge tag 'fuse-fixes-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fix from Miklos Szeredi: "Fix an Oops introduced in v5.4" * tag 'fuse-fixes-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: fix stack use after return commit 2af82177af47a3bff0cd0113dfde14d6e44a6243 Merge: 78511edc2dd4 c853680453ac Author: Linus Torvalds Date: Fri Mar 13 15:17:21 2020 -0700 Merge tag 'ovl-fixes-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Fix three bugs introduced in this cycle" * tag 'ovl-fixes-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: fix lockdep warning for async write ovl: fix some xino configurations ovl: fix lock in ovl_llseek() commit 236ebc20d9afc5e9ff52f3cf3f365a91583aac10 Author: Filipe Manana Date: Tue Mar 10 12:13:53 2020 +0000 btrfs: fix log context list corruption after rename whiteout error During a rename whiteout, if btrfs_whiteout_for_rename() returns an error we can end up returning from btrfs_rename() with the log context object still in the root's log context list - this happens if 'sync_log' was set to true before we called btrfs_whiteout_for_rename() and it is dangerous because we end up with a corrupt linked list (root->log_ctxs) as the log context object was allocated on the stack. After btrfs_rename() returns, any task that is running btrfs_sync_log() concurrently can end up crashing because that linked list is traversed by btrfs_sync_log() (through btrfs_remove_all_log_ctxs()). That results in the same issue that commit e6c617102c7e4 ("Btrfs: fix log context list corruption after rename exchange operation") fixed. Fixes: d4682ba03ef618 ("Btrfs: sync log after logging new name") CC: stable@vger.kernel.org # 4.19+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 78511edc2dd4c7b9f74f3b544093c854b7bd7744 Merge: 5007928eaeb7 bce74b1feb01 Author: Linus Torvalds Date: Fri Mar 13 13:21:51 2020 -0700 Merge tag 'pm-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix cpupower utility build failures with -fno-common enabled (Mike Gilbert)" * tag 'pm-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpupower: avoid multiple definition with gcc -fno-common commit 5007928eaeb7681501e94ac7516f6c6200f993fa Merge: 17829c5a42f7 805b13adde39 Author: Linus Torvalds Date: Fri Mar 13 13:00:08 2020 -0700 Merge tag 'io_uring-5.6-2020-03-13' of git://git.kernel.dk/linux-block Pull io_uring fix from Jens Axboe: "Just a single fix here, improving the RCU callback ordering from last week. After a bit more perusing by Paul, he poked a hole in the original" * tag 'io_uring-5.6-2020-03-13' of git://git.kernel.dk/linux-block: io_uring: ensure RCU callback ordering with rcu_barrier() commit 17829c5a42f776463b305f8a9ccac55a3f473e1d Merge: d36561296bb5 b53df2e7442c Author: Linus Torvalds Date: Fri Mar 13 12:45:23 2020 -0700 Merge tag 'block-5.6-2020-03-13' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A few fixes that should go into this release. This contains: - Fix for a corruption issue with the s390 dasd driver (Stefan) - Fixup/improvement for the flush insertion change that we had in this series (Ming) - Fix for the partition suppor for host aware zoned devices (Shin'ichiro) - Fix incorrect blk-iocost comparison (Tejun) The diffstat looks large, but that's a) mostly dasd, and b) the flush fix from Ming adds a big comment" * tag 'block-5.6-2020-03-13' of git://git.kernel.dk/linux-block: block: Fix partition support for host aware zoned block devices blk-mq: insert flush request to the front of dispatch queue s390/dasd: fix data corruption for thin provisioned devices blk-iocost: fix incorrect vtime comparison in iocg_is_idle() commit d36561296bb510bf339750ea22efaa660277642e Merge: ddd2b85ff73b 18d200460cd7 Author: Linus Torvalds Date: Fri Mar 13 12:21:10 2020 -0700 Merge tag 'mmc-v5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix HW busy detection support for host controllers requiring the MMC_RSP_BUSY response flag (R1B) to be set for the command. In particular for CMD6 (eMMC), erase/trim/discard (SD/eMMC) and CMD5 (eMMC sleep). MMC host: - sdhci-omap|tegra: Fix support for HW busy detection" * tag 'mmc-v5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard mmc: core: Allow host controllers to require R1B for CMD6 commit 94b18a87efdd1626a1e6aef87271af4a7c616d36 Merge: 242a6df688dc e2e57291097b Author: David S. Miller Date: Fri Mar 13 11:21:25 2020 -0700 Merge tag 'wireless-drivers-2020-03-13' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.6 Third, and hopefully last, set of fixes for v5.6. iwlwifi * fix a locking issue in time events handling * a fix in rate-scaling * fix for a potential NULL pointer deref * enable antenna diversity in some devices that were erroneously not doing it * allow FW dumps to continue when the FW is stuck * a fix in the HE capabilities handling * another fix for FW dumps where we were reading wrong addresses * fix link in MAINTAINERS file rtlwifi * fix regression causing connect issues in v5.4 wlcore * remove merge damage which luckily didn't have any impact on functionality ==================== Signed-off-by: David S. Miller commit 242a6df688dcad7c55105280a79aaff83addf7ce Merge: 0d81a3f29c0a 90db6d772f74 Author: David S. Miller Date: Fri Mar 13 11:13:45 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2020-03-12 The following pull-request contains BPF updates for your *net* tree. We've added 12 non-merge commits during the last 8 day(s) which contain a total of 12 files changed, 161 insertions(+), 15 deletions(-). The main changes are: 1) Andrii fixed two bugs in cgroup-bpf. 2) John fixed sockmap. 3) Luke fixed x32 jit. 4) Martin fixed two issues in struct_ops. 5) Yonghong fixed bpf_send_signal. 6) Yoshiki fixed BTF enum. ==================== Signed-off-by: David S. Miller commit ddd2b85ff73bb60061a9fb08ac1f5a03a2d4bce0 Author: Jann Horn Date: Thu Mar 12 21:36:53 2020 +0000 afs: Use kfree_rcu() instead of casting kfree() to rcu_callback_t afs_put_addrlist() casts kfree() to rcu_callback_t. Apart from being wrong in theory, this might also blow up when people start enforcing function types via compiler instrumentation, and it means the rcu_head has to be first in struct afs_addr_list. Use kfree_rcu() instead, it's simpler and more correct. Signed-off-by: Jann Horn Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 92bd1f2e1eed493a73a19012a3a7f1feed0883ff Merge: 8daee952b438 58d6fee50e67 Author: Wolfram Sang Date: Fri Mar 13 16:32:28 2020 +0100 Merge tag 'at24-fixes-for-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-current at24 fixes for v5.6-rc6 - fix regulator underflow bug introduced during the v5.6 merge window commit c853680453ac235e9010987a8bdaaba0e116d3c8 Author: Miklos Szeredi Date: Fri Mar 13 15:42:20 2020 +0100 ovl: fix lockdep warning for async write Lockdep reports "WARNING: lock held when returning to user space!" due to async write holding freeze lock over the write. Apparently aio.c already deals with this by lying to lockdep about the state of the lock. Do the same here. No need to check for S_IFREG() here since these file ops are regular-only. Reported-by: syzbot+9331a354f4f624a52a55@syzkaller.appspotmail.com Fixes: 2406a307ac7d ("ovl: implement async IO routines") Signed-off-by: Miklos Szeredi commit 53afcd310e867d25e394718558783c476301205c Author: Amir Goldstein Date: Fri Feb 21 16:34:42 2020 +0200 ovl: fix some xino configurations Fix up two bugs in the coversion to xino_mode: 1. xino=off does not always end up in disabled mode 2. xino=auto on 32bit arch should end up in disabled mode Take a proactive approach to disabling xino on 32bit kernel: 1. Disable XINO_AUTO config during build time 2. Disable xino with a warning on mount time As a by product, xino=on on 32bit arch also ends up in disabled mode. We never intended to enable xino on 32bit arch and this will make the rest of the logic simpler. Fixes: 0f831ec85eda ("ovl: simplify ovl_same_sb() helper") Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit cfb5d65f25959f724081bae8445a0241db606af6 Author: Roger Quadros Date: Fri Mar 13 11:47:17 2020 +0200 ARM: dts: dra7: Add bus_dma_limit for L3 bus The L3 interconnect's memory map is from 0x0 to 0xffffffff. Out of this, System memory (SDRAM) can be accessed from 0x80000000 to 0xffffffff (2GB) DRA7 does support 4GB of SDRAM but upper 2GB can only be accessed by the MPU subsystem. Add the dma-ranges property to reflect the physical address limit of the L3 bus. Issues ere observed only with SATA on DRA7-EVM with 4GB RAM and CONFIG_ARM_LPAE enabled. This is because the controller supports 64-bit DMA and its driver sets the dma_mask to 64-bit thus resulting in DMA accesses beyond L3 limit of 2G. Setting the correct bus_dma_limit fixes the issue. Signed-off-by: Roger Quadros Cc: stable@kernel.org Signed-off-by: Tony Lindgren commit 8c34cd1a7f089dc03933289c5d4a4d1489549828 Author: Gerd Hoffmann Date: Fri Mar 13 09:41:52 2020 +0100 drm/bochs: downgrade pci_request_region failure from error to warning Shutdown of firmware framebuffer has a bunch of problems. Because of this the framebuffer region might still be reserved even after drm_fb_helper_remove_conflicting_pci_framebuffers() returned. Don't consider pci_request_region() failure for the framebuffer region as fatal error to workaround this issue. Reported-by: Marek Marczykowski-Górecki Signed-off-by: Gerd Hoffmann Acked-by: Sam Ravnborg Link: http://patchwork.freedesktop.org/patch/msgid/20200313084152.2734-1-kraxel@redhat.com commit 941224e09483ea3428ffc6402de56a4a2e2cb6da Author: Kaike Wan Date: Fri Mar 13 08:39:57 2020 -0400 IB/rdmavt: Free kernel completion queue when done When a kernel ULP requests the rdmavt to create a completion queue, it allocated the queue and set cq->kqueue to point to it. However, when the completion queue is destroyed, cq->queue is freed instead, leading to a memory leak: https://lore.kernel.org/r/215235485.15264050.1583334487658.JavaMail.zimbra@redhat.com unreferenced object 0xffffc90006639000 (size 12288): comm "kworker/u128:0", pid 8, jiffies 4295777598 (age 589.085s) hex dump (first 32 bytes): 4d 00 00 00 4d 00 00 00 00 c0 08 ac 8b 88 ff ff M...M........... 00 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 ................ backtrace: [<0000000035a3d625>] __vmalloc_node_range+0x361/0x720 [<000000002942ce4f>] __vmalloc_node.constprop.30+0x63/0xb0 [<00000000f228f784>] rvt_create_cq+0x98a/0xd80 [rdmavt] [<00000000b84aec66>] __ib_alloc_cq_user+0x281/0x1260 [ib_core] [<00000000ef3764be>] nvme_rdma_cm_handler+0xdb7/0x1b80 [nvme_rdma] [<00000000936b401c>] cma_cm_event_handler+0xb7/0x550 [rdma_cm] [<00000000d9c40b7b>] addr_handler+0x195/0x310 [rdma_cm] [<00000000c7398a03>] process_one_req+0xdd/0x600 [ib_core] [<000000004d29675b>] process_one_work+0x920/0x1740 [<00000000efedcdb5>] worker_thread+0x87/0xb40 [<000000005688b340>] kthread+0x327/0x3f0 [<0000000043a168d6>] ret_from_fork+0x3a/0x50 This patch fixes the issue by freeing cq->kqueue instead. Fixes: 239b0e52d8aa ("IB/hfi1: Move rvt_cq_wc struct into uapi directory") Link: https://lore.kernel.org/r/20200313123957.14343.43879.stgit@awfm-01.aw.intel.com Cc: # 5.4.x Reported-by: Yi Zhang Reviewed-by: Mike Marciniszyn Reviewed-by: Dennis Dalessandro Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 469ff207b4c4033540b50bc59587dc915faa1367 Author: Peter Xu Date: Thu Mar 12 16:58:30 2020 -0400 x86/vector: Remove warning on managed interrupt migration The vector management code assumes that managed interrupts cannot be migrated away from an online CPU. free_moved_vector() has a WARN_ON_ONCE() which triggers when a managed interrupt vector association on a online CPU is cleared. The CPU offline code uses a different mechanism which cannot trigger this. This assumption is not longer correct because the new CPU isolation feature which affects the placement of managed interrupts must be able to move a managed interrupt away from an online CPU. There are two reasons why this can happen: 1) When the interrupt is activated the affinity mask which was established in irq_create_affinity_masks() is handed in to the vector allocation code. This mask contains all CPUs to which the interrupt can be made affine to, but this does not take the CPU isolation 'managed_irq' mask into account. When the interrupt is finally requested by the device driver then the affinity is checked again and the CPU isolation 'managed_irq' mask is taken into account, which moves the interrupt to a non-isolated CPU if possible. 2) The interrupt can be affine to an isolated CPU because the non-isolated CPUs in the calculated affinity mask are not online. Once a non-isolated CPU which is in the mask comes online the interrupt is migrated to this non-isolated CPU In both cases the regular online migration mechanism is used which triggers the WARN_ON_ONCE() in free_moved_vector(). Case #1 could have been addressed by taking the isolation mask into account, but that would require a massive code change in the activation logic and the eventual migration event was accepted as a reasonable tradeoff when the isolation feature was developed. But even if #1 would be addressed, #2 would still trigger it. Of course the warning in free_moved_vector() was overlooked at that time and the above two cases which have been discussed during patch review have obviously never been tested before the final submission. So keep it simple and remove the warning. [ tglx: Rewrote changelog and added a comment to free_moved_vector() ] Fixes: 11ea68f553e2 ("genirq, sched/isolation: Isolate from handling managed interrupts") Signed-off-by: Peter Xu Signed-off-by: Thomas Gleixner Reviewed-by: Ming Lei Link: https://lkml.kernel.org/r/20200312205830.81796-1-peterx@redhat.com commit 8daee952b4389729358665fb91949460641659d4 Author: Wolfram Sang Date: Thu Mar 12 14:32:44 2020 +0100 i2c: acpi: put device when verifying client fails i2c_verify_client() can fail, so we need to put the device when that happens. Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Reported-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Wolfram Sang commit 5bdfa854013ce4193de0d097931fd841382c76a7 Author: Jason Gunthorpe Date: Tue Mar 10 09:53:39 2020 +0200 RDMA/mad: Do not crash if the rdma device does not have a umad interface Non-IB devices do not have a umad interface and the client_data will be left set to NULL. In this case calling get_nl_info() will try to kref a NULL cdev causing a crash: general protection fault, probably for non-canonical address 0xdffffc00000000ba: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000005d0-0x00000000000005d7] CPU: 0 PID: 20851 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kobject_get+0x35/0x150 lib/kobject.c:640 Code: 53 e8 3f b0 8b f9 4d 85 e4 0f 84 a2 00 00 00 e8 31 b0 8b f9 49 8d 7c 24 3c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f b6 04 02 48 89 fa +83 e2 07 38 d0 7f 08 84 c0 0f 85 eb 00 00 00 RSP: 0018:ffffc9000946f1a0 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: ffffffff85bdbbb0 RCX: ffffc9000bf22000 RDX: 00000000000000ba RSI: ffffffff87e9d78f RDI: 00000000000005d4 RBP: ffffc9000946f1b8 R08: ffff8880581a6440 R09: ffff8880581a6cd0 R10: fffffbfff154b838 R11: ffffffff8aa5c1c7 R12: 0000000000000598 R13: 0000000000000000 R14: ffffc9000946f278 R15: ffff88805cb0c4d0 FS: 00007faa9e8af700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30121000 CR3: 000000004515d000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: get_device+0x25/0x40 drivers/base/core.c:2574 __ib_get_client_nl_info+0x205/0x2e0 drivers/infiniband/core/device.c:1861 ib_get_client_nl_info+0x35/0x180 drivers/infiniband/core/device.c:1881 nldev_get_chardev+0x575/0xac0 drivers/infiniband/core/nldev.c:1621 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Cc: stable@kernel.org Fixes: 8f71bb0030b8 ("RDMA: Report available cdevs through RDMA_NLDEV_CMD_GET_CHARDEV") Link: https://lore.kernel.org/r/20200310075339.238090-1-leon@kernel.org Reported-by: syzbot+46fe08363dbba223dec5@syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit f2f2b3bbf0d9f8d090b9a019679223b2bd1c66c4 Author: Jason Gunthorpe Date: Mon Mar 9 16:32:00 2020 -0300 RDMA/core: Fix missing error check on dev_set_name() If name memory allocation fails the name will be left empty and device_add_one() will crash: kobject: (0000000004952746): attempted to be registered with empty name! WARNING: CPU: 0 PID: 329 at lib/kobject.c:234 kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 329 Comm: syz-executor.5 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Code: 1a 98 ca f9 e9 f0 f8 ff ff 4c 89 f7 e8 6d 98 ca f9 e9 95 f9 ff ff e8 c3 f0 8b f9 4c 89 e6 48 c7 c7 a0 0e 1a 89 e8 e3 41 5c f9 <0f> 0b 41 bd ea ff ff ff e9 52 ff ff ff e8 a2 f0 8b f9 0f 0b e8 9b RSP: 0018:ffffc90005b27908 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815eae46 RDI: fffff52000b64f13 RBP: ffffc90005b27960 R08: ffff88805aeba480 R09: ffffed1015d06659 R10: ffffed1015d06658 R11: ffff8880ae8332c7 R12: ffff8880a37fd000 R13: 0000000000000000 R14: ffff888096691780 R15: 0000000000000001 kobject_add_varg lib/kobject.c:390 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:442 device_add+0x3be/0x1d00 drivers/base/core.c:2412 add_one_compat_dev drivers/infiniband/core/device.c:901 [inline] add_one_compat_dev+0x46a/0x7e0 drivers/infiniband/core/device.c:857 rdma_dev_init_net+0x2eb/0x490 drivers/infiniband/core/device.c:1120 ops_init+0xb3/0x420 net/core/net_namespace.c:137 setup_net+0x2d5/0x8b0 net/core/net_namespace.c:327 copy_net_ns+0x29e/0x5a0 net/core/net_namespace.c:468 create_new_namespaces+0x403/0xb50 kernel/nsproxy.c:108 unshare_nsproxy_namespaces+0xc2/0x200 kernel/nsproxy.c:229 ksys_unshare+0x444/0x980 kernel/fork.c:2955 __do_sys_unshare kernel/fork.c:3023 [inline] __se_sys_unshare kernel/fork.c:3021 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3021 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Link: https://lore.kernel.org/r/20200309193200.GA10633@ziepe.ca Cc: stable@kernel.org Fixes: 4e0f7b907072 ("RDMA/core: Implement compat device/sysfs tree in net namespace") Reported-by: syzbot+ab4dae63f7d310641ded@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe commit ba3b01d7a6f4ab9f8a0557044c9a7678f64ae070 Author: Megha Dey Date: Mon Mar 9 13:09:46 2020 -0700 iommu/vt-d: Fix debugfs register reads Commit 6825d3ea6cde ("iommu/vt-d: Add debugfs support to show register contents") dumps the register contents for all IOMMU devices. Currently, a 64 bit read(dmar_readq) is done for all the IOMMU registers, even though some of the registers are 32 bits, which is incorrect. Use the correct read function variant (dmar_readl/dmar_readq) while reading the contents of 32/64 bit registers respectively. Signed-off-by: Megha Dey Link: https://lore.kernel.org/r/1583784587-26126-2-git-send-email-megha.dey@linux.intel.com Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 81ee85d0462410de8eeeec1b9761941fd6ed8c7b Author: Hans de Goede Date: Mon Mar 9 19:25:10 2020 +0100 iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint Quoting from the comment describing the WARN functions in include/asm-generic/bug.h: * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report * significant kernel issues that need prompt attention if they should ever * appear at runtime. * * Do not use these macros when checking for invalid external inputs The (buggy) firmware tables which the dmar code was calling WARN_TAINT for really are invalid external inputs. They are not under the kernel's control and the issues in them cannot be fixed by a kernel update. So logging a backtrace, which invites bug reports to be filed about this, is not helpful. Fixes: 556ab45f9a77 ("ioat2: catch and recover from broken vtd configurations v6") Signed-off-by: Hans de Goede Acked-by: Lu Baolu Link: https://lore.kernel.org/r/20200309182510.373875-1-hdegoede@redhat.com BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=701847 Signed-off-by: Joerg Roedel commit 96788c7a7f1e7206519d4d736f89a2072dcfe0fc Author: Hans de Goede Date: Mon Mar 9 15:01:38 2020 +0100 iommu/vt-d: dmar_parse_one_rmrr: replace WARN_TAINT with pr_warn + add_taint Quoting from the comment describing the WARN functions in include/asm-generic/bug.h: * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report * significant kernel issues that need prompt attention if they should ever * appear at runtime. * * Do not use these macros when checking for invalid external inputs The (buggy) firmware tables which the dmar code was calling WARN_TAINT for really are invalid external inputs. They are not under the kernel's control and the issues in them cannot be fixed by a kernel update. So logging a backtrace, which invites bug reports to be filed about this, is not helpful. Some distros, e.g. Fedora, have tools watching for the kernel backtraces logged by the WARN macros and offer the user an option to file a bug for this when these are encountered. The WARN_TAINT in dmar_parse_one_rmrr + another iommu WARN_TAINT, addressed in another patch, have lead to over a 100 bugs being filed this way. This commit replaces the WARN_TAINT("...") call, with a pr_warn(FW_BUG "...") + add_taint(TAINT_FIRMWARE_WORKAROUND, ...) call avoiding the backtrace and thus also avoiding bug-reports being filed about this against the kernel. Fixes: f5a68bb0752e ("iommu/vt-d: Mark firmware tainted if RMRR fails sanity check") Signed-off-by: Hans de Goede Signed-off-by: Joerg Roedel Acked-by: Lu Baolu Cc: stable@vger.kernel.org Cc: Barret Rhoden Link: https://lore.kernel.org/r/20200309140138.3753-3-hdegoede@redhat.com BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1808874 commit 59833696442c674acbbd297772ba89e7ad8c753d Author: Hans de Goede Date: Mon Mar 9 15:01:37 2020 +0100 iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint Quoting from the comment describing the WARN functions in include/asm-generic/bug.h: * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report * significant kernel issues that need prompt attention if they should ever * appear at runtime. * * Do not use these macros when checking for invalid external inputs The (buggy) firmware tables which the dmar code was calling WARN_TAINT for really are invalid external inputs. They are not under the kernel's control and the issues in them cannot be fixed by a kernel update. So logging a backtrace, which invites bug reports to be filed about this, is not helpful. Some distros, e.g. Fedora, have tools watching for the kernel backtraces logged by the WARN macros and offer the user an option to file a bug for this when these are encountered. The WARN_TAINT in warn_invalid_dmar() + another iommu WARN_TAINT, addressed in another patch, have lead to over a 100 bugs being filed this way. This commit replaces the WARN_TAINT("...") calls, with pr_warn(FW_BUG "...") + add_taint(TAINT_FIRMWARE_WORKAROUND, ...) calls avoiding the backtrace and thus also avoiding bug-reports being filed about this against the kernel. Fixes: fd0c8894893c ("intel-iommu: Set a more specific taint flag for invalid BIOS DMAR tables") Fixes: e625b4a95d50 ("iommu/vt-d: Parse ANDD records") Signed-off-by: Hans de Goede Signed-off-by: Joerg Roedel Acked-by: Lu Baolu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200309140138.3753-2-hdegoede@redhat.com BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1564895 commit 7aefa6237cfe4a6fcf06a8656eee988b36f8fefc Author: Jason Gunthorpe Date: Mon Mar 9 16:05:15 2020 -0300 RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET Empty device names cannot be added to sysfs and crash with: kobject: (00000000f9de3792): attempted to be registered with empty name! WARNING: CPU: 1 PID: 10856 at lib/kobject.c:234 kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 10856 Comm: syz-executor459 Not tainted 5.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Code: 7a ca ca f9 e9 f0 f8 ff ff 4c 89 f7 e8 cd ca ca f9 e9 95 f9 ff ff e8 13 25 8c f9 4c 89 e6 48 c7 c7 a0 08 1a 89 e8 a3 76 5c f9 <0f> 0b 41 bd ea ff ff ff e9 52 ff ff ff e8 f2 24 8c f9 0f 0b e8 eb RSP: 0018:ffffc90002006eb0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815eae46 RDI: fffff52000400dc8 RBP: ffffc90002006f08 R08: ffff8880972ac500 R09: ffffed1015d26659 R10: ffffed1015d26658 R11: ffff8880ae9332c7 R12: ffff888093034668 R13: 0000000000000000 R14: ffff8880a69d7600 R15: 0000000000000001 kobject_add_varg lib/kobject.c:390 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:442 device_add+0x3be/0x1d00 drivers/base/core.c:2412 ib_register_device drivers/infiniband/core/device.c:1371 [inline] ib_register_device+0x93e/0xe40 drivers/infiniband/core/device.c:1343 rxe_register_device+0x52e/0x655 drivers/infiniband/sw/rxe/rxe_verbs.c:1231 rxe_add+0x122b/0x1661 drivers/infiniband/sw/rxe/rxe.c:302 rxe_net_add+0x91/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:539 rxe_newlink+0x39/0x90 drivers/infiniband/sw/rxe/rxe.c:318 nldev_newlink+0x28a/0x430 drivers/infiniband/core/nldev.c:1538 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Prevent empty names when checking the name provided from userspace during newlink and rename. Fixes: 3856ec4b93c9 ("RDMA/core: Add RDMA_NLDEV_CMD_NEWLINK/DELLINK support") Fixes: 05d940d3a3ec ("RDMA/nldev: Allow IB device rename through RDMA netlink") Cc: stable@kernel.org Link: https://lore.kernel.org/r/20200309191648.GA30852@ziepe.ca Reported-and-tested-by: syzbot+da615ac67d4dbea32cbc@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe commit dec9de2ada523b344eb2428abfedf9d6cd0a0029 Author: Mario Kleiner Date: Fri Feb 28 22:36:07 2020 +0100 drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017 This fixes a problem found on the MacBookPro 2017 Retina panel: The panel reports 10 bpc color depth in its EDID, and the firmware chooses link settings at boot which support enough bandwidth for 10 bpc (324000 kbit/sec aka LINK_RATE_RBR2 aka 0xc), but the DP_MAX_LINK_RATE dpcd register only reports 2.7 Gbps (multiplier value 0xa) as possible, in direct contradiction of what the firmware successfully set up. This restricts the panel to 8 bpc, not providing the full color depth of the panel on Linux <= 5.5. Additionally, commit '4a8ca46bae8a ("drm/amd/display: Default max bpc to 16 for eDP")' introduced into Linux 5.6-rc1 will unclamp panel depth to its full 10 bpc, thereby requiring a eDP bandwidth for all modes that exceeds the bandwidth available and causes all modes to fail validation -> No modes for the laptop panel -> failure to set any mode -> Panel goes dark. This patch adds a quirk specific to the MBP 2017 15" Retina panel to override reported max link rate to the correct maximum of 0xc = LINK_RATE_RBR2 to fix the darkness and reduced display precision. Please apply for Linux 5.6+ to avoid regressing Apple MBP panel support. Signed-off-by: Mario Kleiner Signed-off-by: Alex Deucher commit 063e768ebd27d3ec0d6908b7f8ea9b0a732b9949 Author: Evan Quan Date: Wed Mar 11 14:15:27 2020 +0800 drm/amdgpu: add fbdev suspend/resume on gpu reset This can fix the baco reset failure seen on Navi10. And this should be a low risk fix as the same sequence is already used for system suspend/resume. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 5bbc6604a62814511c32f2e39bc9ffb2c1b92cbe Author: Tom St Denis Date: Tue Mar 10 08:40:41 2020 -0400 drm/amd/amdgpu: Fix GPR read from debugfs (v2) The offset into the array was specified in bytes but should be in terms of 32-bit words. Also prevent large reads that would also cause a buffer overread. v2: Read from correct offset from internal storage buffer. Signed-off-by: Tom St Denis Acked-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b55dbe596942e15b3d18d36a41af4fde022c9d48 Author: Stanley.Yang Date: Wed Mar 11 16:39:47 2020 +0800 drm/amd/display: fix typos for dcn20_funcs and dcn21_funcs struct In dcn20_funcs and dcn21_funcs struct, the member ".dsc_pg_control = NULL" should be removed due to .dsc_pg_control be assigned to dcn20_dsc_pg_control. Signed-off-by: Stanley.Yang Reviewed-by: Anthony Koo Signed-off-by: Alex Deucher commit af3d0a68698c7e5df8b72267086b23422a3954bb Author: Christophe Leroy Date: Fri Mar 6 16:49:49 2020 +0000 powerpc/kasan: Fix shadow memory protection with CONFIG_KASAN_VMALLOC With CONFIG_KASAN_VMALLOC, new page tables are created at the time shadow memory for vmalloc area is unmapped. If some parts of the page table still have entries to the zero page shadow memory, the entries are wrongly marked RW. With CONFIG_KASAN_VMALLOC, almost the entire kernel address space is managed by KASAN. To make it simple, just create KASAN page tables for the entire kernel space at kasan_init(). That doesn't use much more space, and that's anyway already done for hash platforms. Fixes: 3d4247fcc938 ("powerpc/32: Add support of KASAN_VMALLOC") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/ef5248fc1f496c6b0dfdb59380f24968f25f75c5.1583513368.git.christophe.leroy@c-s.fr commit 0d81a3f29c0afb18ba2b1275dcccf21e0dd4da38 Merge: 1b51f69461e6 16b78f052d01 Author: Linus Torvalds Date: Thu Mar 12 18:05:19 2020 -0700 Merge tag 'drm-fixes-2020-03-13' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "It's a bit quieter, probably not as much as it could be. There is on large regression fix in here from Lyude for displayport bandwidth calculations, there've been reports of multi-monitor in docks not working since -rc1 and this has been tested to fix those. Otherwise it's a bunch of i915 (with some GVT fixes), a set of amdgpu watermark + bios fixes, and an exynos iommu cleanup fix. core: - DP MST bandwidth regression fix. i915: - hard lockup fix - GVT fixes - 32-bit alignment issue fix - timeline wait fixes - cacheline_retire and free amdgpu: - Update the display watermark bounding box for navi14 - Fix fetching vbios directly from rom on vega20/arcturus - Navi and renoir watermark fixes exynos: - iommu object cleanup fix" ` * tag 'drm-fixes-2020-03-13' of git://anongit.freedesktop.org/drm/drm: drm/dp_mst: Rewrite and fix bandwidth limit checks drm/dp_mst: Reprobe path resources in CSN handler drm/dp_mst: Use full_pbn instead of available_pbn for bandwidth checks drm/dp_mst: Rename drm_dp_mst_is_dp_mst_end_device() to be less redundant drm/i915: Defer semaphore priority bumping to a workqueue drm/i915/gt: Close race between cacheline_retire and free drm/i915/execlists: Enable timeslice on partial virtual engine dequeue drm/i915: be more solid in checking the alignment drm/i915/gvt: Fix dma-buf display blur issue on CFL drm/i915: Return early for await_start on same timeline drm/i915: Actually emit the await_start drm/amdgpu/powerplay: nv1x, renior copy dcn clock settings of watermark to smu during boot up drm/exynos: Fix cleanup of IOMMU related objects drm/amdgpu: correct ROM_INDEX/DATA offset for VEGA20 drm/amd/display: update soc bb for nv14 drm/i915/gvt: Fix emulated vbt size issue drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits commit 2eebb7abefb9f95b412c51add3d8216980bf6066 Author: Masahiro Yamada Date: Thu Mar 12 07:50:44 2020 +0900 kbuild: doc: fix references to other documents All the files in Documentation/kbuild/ were converted to reST. Signed-off-by: Masahiro Yamada commit 16b78f052d0129cd2998305480da6c4e3ac220a8 Merge: f31d83f047e1 047d4cd2067b Author: Dave Airlie Date: Fri Mar 13 10:38:24 2020 +1000 Merge tag 'topic/mst-bw-check-fixes-for-airlied-2020-03-12-2' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes UAPI Changes: None Cross-subsystem Changes: None Core Changes: Fixed regressions introduced by commit cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check"), which would cause us to: * Calculate the available bandwidth on an MST topology incorrectly, and as a result reject most display configurations that would try to enable more then one sink on a topology * Occasionally expose MST connectors to userspace before finishing probing their PBN capabilities, resulting in us rejecting display configurations because we assumed briefly that no bandwidth was available Driver Changes: None Signed-off-by: Dave Airlie From: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/bf16ee577567beed91c86b7d9cda3ec2e8c50a71.camel@redhat.com commit f31d83f047e190bc636505e9b9c31a34e25bfebe Merge: d94432653519 14a0d527a479 Author: Dave Airlie Date: Fri Mar 13 09:41:15 2020 +1000 Merge tag 'drm-intel-fixes-2020-03-12' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.6-rc6: - hard lockup fix - GVT fixes - 32-bit alignment issue fix - timeline wait fixes - cacheline_retire and free Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87lfo6ksvw.fsf@intel.com commit d94432653519031f89d2a30cc917e29a02f0200d Merge: e3c3b6e66da1 1d2686d417c5 Author: Dave Airlie Date: Fri Mar 13 09:22:25 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-03-11' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-03-11: amdgpu: - Update the display watermark bounding box for navi14 - Fix fetching vbios directly from rom on vega20/arcturus - Navi and renoir watermark fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200312020924.4161-1-alexander.deucher@amd.com commit 1b51f69461e6a3485bab5a7601e16b79d7eeac59 Merge: 807f030b44cc c0368595c163 Author: Linus Torvalds Date: Thu Mar 12 16:19:19 2020 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: "It looks like a decent sized set of fixes, but a lot of these are one liner off-by-one and similar type changes: 1) Fix netlink header pointer to calcular bad attribute offset reported to user. From Pablo Neira Ayuso. 2) Don't double clear PHY interrupts when ->did_interrupt is set, from Heiner Kallweit. 3) Add missing validation of various (devlink, nl802154, fib, etc.) attributes, from Jakub Kicinski. 4) Missing *pos increments in various netfilter seq_next ops, from Vasily Averin. 5) Missing break in of_mdiobus_register() loop, from Dajun Jin. 6) Don't double bump tx_dropped in veth driver, from Jiang Lidong. 7) Work around FMAN erratum A050385, from Madalin Bucur. 8) Make sure ARP header is pulled early enough in bonding driver, from Eric Dumazet. 9) Do a cond_resched() during multicast processing of ipvlan and macvlan, from Mahesh Bandewar. 10) Don't attach cgroups to unrelated sockets when in interrupt context, from Shakeel Butt. 11) Fix tpacket ring state management when encountering unknown GSO types. From Willem de Bruijn. 12) Fix MDIO bus PHY resume by checking mdio_bus_phy_may_suspend() only in the suspend context. From Heiner Kallweit" * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (112 commits) net: systemport: fix index check to avoid an array out of bounds access tc-testing: add ETS scheduler to tdc build configuration net: phy: fix MDIO bus PM PHY resuming net: hns3: clear port base VLAN when unload PF net: hns3: fix RMW issue for VLAN filter switch net: hns3: fix VF VLAN table entries inconsistent issue net: hns3: fix "tc qdisc del" failed issue taprio: Fix sending packets without dequeueing them net: mvmdio: avoid error message for optional IRQ net: dsa: mv88e6xxx: Add missing mask of ATU occupancy register net: memcg: fix lockdep splat in inet_csk_accept() s390/qeth: implement smarter resizing of the RX buffer pool s390/qeth: refactor buffer pool code s390/qeth: use page pointers to manage RX buffer pool seg6: fix SRv6 L2 tunnels to use IANA-assigned protocol number net: dsa: Don't instantiate phylink for CPU/DSA ports unless needed net/packet: tpacket_rcv: do not increment ring index on drop sxgbe: Fix off by one in samsung driver strncpy size arg net: caif: Add lockdep expression to RCU traversal primitive MAINTAINERS: remove Sathya Perla as Emulex NIC maintainer ... commit 047d4cd2067b028e7bca906c5ce20f4c89b65386 Author: Lyude Paul Date: Mon Mar 9 17:01:31 2020 -0400 drm/dp_mst: Rewrite and fix bandwidth limit checks Sigh, this is mostly my fault for not giving commit cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check") enough scrutiny during review. The way we're checking bandwidth limitations here is mostly wrong: For starters, drm_dp_mst_atomic_check_bw_limit() determines the pbn_limit of a branch by simply scanning each port on the current branch device, then uses the last non-zero full_pbn value that it finds. It then counts the sum of the PBN used on each branch device for that level, and compares against the full_pbn value it found before. This is wrong because ports can and will have different PBN limitations on many hubs, especially since a number of DisplayPort hubs out there will be clever and only use the smallest link rate required for each downstream sink - potentially giving every port a different full_pbn value depending on what link rate it's trained at. This means with our current code, which max PBN value we end up with is not well defined. Additionally, we also need to remember when checking bandwidth limitations that the top-most device in any MST topology is a branch device, not a port. This means that the first level of a topology doesn't technically have a full_pbn value that needs to be checked. Instead, we should assume that so long as our VCPI allocations fit we're within the bandwidth limitations of the primary MSTB. We do however, want to check full_pbn on every port including those of the primary MSTB. However, it's important to keep in mind that this value represents the minimum link rate /between a port's sink or mstb, and the mstb itself/. A quick diagram to explain: MSTB #1 / \ / \ Port #1 Port #2 full_pbn for Port #1 → | | ← full_pbn for Port #2 Sink #1 MSTB #2 | etc... Note that in the above diagram, the combined PBN from all VCPI allocations on said hub should not exceed the full_pbn value of port #2, and the display configuration on sink #1 should not exceed the full_pbn value of port #1. However, port #1 and port #2 can otherwise consume as much bandwidth as they want so long as their VCPI allocations still fit. And finally - our current bandwidth checking code also makes the mistake of not checking whether something is an end device or not before trying to traverse down it. So, let's fix it by rewriting our bandwidth checking helpers. We split the function into one part for handling branches which simply adds up the total PBN on each branch and returns it, and one for checking each port to ensure we're not going over its PBN limit. Phew. This should fix regressions seen, where we erroneously reject display configurations due to thinking they're going over our bandwidth limits when they're not. Changes since v1: * Took an even closer look at how PBN limitations are supposed to be handled, and did some experimenting with Sean Paul. Ended up rewriting these helpers again, but this time they should actually be correct! Changes since v2: * Small indenting fix * Fix pbn_used check in drm_dp_mst_atomic_check_port_bw_limit() Signed-off-by: Lyude Paul Fixes: cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check") Cc: Sean Paul Acked-by: Alex Deucher Reviewed-by: Mikita Lipski Tested-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20200309210131.1497545-1-lyude@redhat.com commit 87212b51bff02a6722d5e84f7842a6b0717eb7d4 Author: Lyude Paul Date: Fri Mar 6 18:46:21 2020 -0500 drm/dp_mst: Reprobe path resources in CSN handler We used to punt off reprobing path resources to the link address probe work, but now that we handle CSNs asynchronously from the driver's HPD handling we can do whatever the heck we want from the CSN! So, reprobe the path resources from drm_dp_mst_handle_conn_stat(). Also, get rid of the path resource reprobing code in drm_dp_check_and_send_link_address() since it's needlessly complicated when we already reprobe path resources from drm_dp_handle_link_address_port(). And finally, teach drm_dp_send_enum_path_resources() to return 1 on PBN changes so we know if we need to send another hotplug or not. This fixes issues where we've indicated to userspace that a port has just been connected, before we actually probed it's available PBN - something that results in unexpected atomic check failures. Signed-off-by: Lyude Paul Fixes: cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check") Cc: Mikita Lipski Cc: Hans de Goede Cc: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200306234623.547525-4-lyude@redhat.com Reviewed-by: Alex Deucher Tested-by: Hans de Goede commit fcf4638075964268bf8a0e212407096c6aab6fd3 Author: Lyude Paul Date: Fri Mar 6 18:46:20 2020 -0500 drm/dp_mst: Use full_pbn instead of available_pbn for bandwidth checks DisplayPort specifications are fun. For a while, it's been really unclear to us what available_pbn actually does. There's a somewhat vague explanation in the DisplayPort spec (starting from 1.2) that partially explains it: The minimum payload bandwidth number supported by the path. Each node updates this number with its available payload bandwidth number if its payload bandwidth number is less than that in the Message Transaction reply. So, it sounds like available_pbn represents the smallest link rate in use between the source and the branch device. Cool, so full_pbn is just the highest possible PBN that the branch device supports right? Well, we assumed that for quite a while until Sean Paul noticed that on some MST hubs, available_pbn will actually get set to 0 whenever there's any active payloads on the respective branch device. This caused quite a bit of confusion since clearing the payload ID table would end up fixing the available_pbn value. So, we just went with that until commit cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check") started breaking people's setups due to us getting erroneous available_pbn values. So, we did some more digging and got confused until we finally looked at the definition for full_pbn: The bandwidth of the link at the trained link rate and lane count between the DP Source device and the DP Sink device with no time slots allocated to VC Payloads, represented as a Payload Bandwidth Number. As with the Available_Payload_Bandwidth_Number, this number is determined by the link with the lowest lane count and link rate. That's what we get for not reading specs closely enough, hehe. So, since full_pbn is definitely what we want for doing bandwidth restriction checks - let's start using that instead and ignore available_pbn entirely. Signed-off-by: Lyude Paul Fixes: cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check") Cc: Mikita Lipski Cc: Hans de Goede Cc: Sean Paul Reviewed-by: Mikita Lipski Link: https://patchwork.freedesktop.org/patch/msgid/20200306234623.547525-3-lyude@redhat.com Reviewed-by: Alex Deucher Tested-by: Hans de Goede commit b2feb1d6d34844c5c56eb34008c3e516664c5410 Author: Lyude Paul Date: Fri Mar 6 18:46:19 2020 -0500 drm/dp_mst: Rename drm_dp_mst_is_dp_mst_end_device() to be less redundant It's already prefixed by dp_mst, so we don't really need to repeat ourselves here. One of the changes I should have picked up originally when reviewing MST DSC support. There should be no functional changes here Cc: Mikita Lipski Cc: Sean Paul Cc: Hans de Goede Signed-off-by: Lyude Paul Reviewed-by: Alex Deucher Tested-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20200306234623.547525-2-lyude@redhat.com commit 807f030b44ccbb26a346df6f6438628315d9ad98 Merge: 3cc6e2c599cd d9a9f4849fe0 Author: Linus Torvalds Date: Thu Mar 12 15:51:26 2020 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "A couple of fixes for old crap in ->atomic_open() instances" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: cifs_atomic_open(): fix double-put on late allocation failure gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache commit c0368595c1639947839c0db8294ee96aca0b3b86 Author: Colin Ian King Date: Thu Mar 12 15:04:30 2020 +0000 net: systemport: fix index check to avoid an array out of bounds access Currently the bounds check on index is off by one and can lead to an out of bounds access on array priv->filters_loc when index is RXCHK_BRCM_TAG_MAX. Fixes: bb9051a2b230 ("net: systemport: Add support for WAKE_FILTER") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 9d0e0cd9a529ba68b2acda68b5075d4a5ea7118a Author: Davide Caratti Date: Thu Mar 12 17:51:45 2020 +0100 tc-testing: add ETS scheduler to tdc build configuration add CONFIG_NET_SCH_ETS to 'config', otherwise test suites using this file to perform a full tdc run will encounter the following warning: ok 645 e90e - Add ETS qdisc using bands # skipped - "-----> teardown stage" did not complete successfully Fixes: 82c664b69c8b ("selftests: qdiscs: Add test coverage for ETS Qdisc") Reported-by: Jamal Hadi Salim Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit 611d779af7cad2b87487ff58e4931a90c20b113c Author: Heiner Kallweit Date: Thu Mar 12 22:25:20 2020 +0100 net: phy: fix MDIO bus PM PHY resuming So far we have the unfortunate situation that mdio_bus_phy_may_suspend() is called in suspend AND resume path, assuming that function result is the same. After the original change this is no longer the case, resulting in broken resume as reported by Geert. To fix this call mdio_bus_phy_may_suspend() in the suspend path only, and let the phy_device store the info whether it was suspended by MDIO bus PM. Fixes: 503ba7c69610 ("net: phy: Avoid multiple suspends") Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit d9a9f4849fe0c9d560851ab22a85a666cddfdd24 Author: Al Viro Date: Thu Mar 12 18:25:20 2020 -0400 cifs_atomic_open(): fix double-put on late allocation failure several iterations of ->atomic_open() calling conventions ago, we used to need fput() if ->atomic_open() failed at some point after successful finish_open(). Now (since 2016) it's not needed - struct file carries enough state to make fput() work regardless of the point in struct file lifecycle and discarding it on failure exits in open() got unified. Unfortunately, I'd missed the fact that we had an instance of ->atomic_open() (cifs one) that used to need that fput(), as well as the stale comment in finish_open() demanding such late failure handling. Trivially fixed... Fixes: fe9ec8291fca "do_last(): take fput() on error after opening to out:" Cc: stable@kernel.org # v4.7+ Signed-off-by: Al Viro commit 21039132650281de06a169cbe8a0f7e5c578fd8b Author: Al Viro Date: Tue Mar 10 09:31:41 2020 -0400 gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache with the way fs/namei.c:do_last() had been done, ->atomic_open() instances needed to recognize the case when existing file got found with O_EXCL|O_CREAT, either by falling back to finish_no_open() or failing themselves. gfs2 one didn't. Fixes: 6d4ade986f9c (GFS2: Add atomic_open support) Cc: stable@kernel.org # v3.11 Signed-off-by: Al Viro commit 6687c201fdc3139315c2ea7ef96c157672805cdc Author: Nick Hudson Date: Thu Mar 12 09:03:45 2020 +0000 ARM: bcm2835-rpi-zero-w: Add missing pinctrl name Define the sdhci pinctrl state as "default" so it gets applied correctly and to match all other RPis. Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W") Signed-off-by: Nick Hudson Signed-off-by: Florian Fainelli commit e4792ffe971dde60582028ccba08b5a2ad9d3359 Merge: b09fe70ef520 59359fc8a2f7 Author: David S. Miller Date: Thu Mar 12 11:38:27 2020 -0700 Merge branch 'hns3-fixes' Huazhong Tan says: ==================== net: hns3: fixes for -net This series includes several bugfixes for the HNS3 ethernet driver. [patch 1] fixes an "tc qdisc del" failure. [patch 2] fixes SW & HW VLAN table not consistent issue. [patch 3] fixes a RMW issue related to VLAN filter switch. [patch 4] clears port based VLAN when uploading PF. ==================== Signed-off-by: David S. Miller commit 59359fc8a2f7af062777692e6a7aae73483729ec Author: Jian Shen Date: Thu Mar 12 15:11:06 2020 +0800 net: hns3: clear port base VLAN when unload PF Currently, PF missed to clear the port base VLAN for VF when unload. In this case, the VLAN id will remain in the VLAN table. This patch fixes it. Fixes: 92f11ea177cd ("net: hns3: fix set port based VLAN issue for VF") Signed-off-by: Jian Shen Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 903b85d3adce99a5301d5959c4d3c9d14a7974d4 Author: Jian Shen Date: Thu Mar 12 15:11:05 2020 +0800 net: hns3: fix RMW issue for VLAN filter switch According to the user manual, the ingress and egress VLAN filter are configured at the same time. Currently, hclge_init_vlan_config() and hclge_set_vlan_spoofchk() will both change the VLAN filter switch. So it's necessary to read the old configuration before modifying it. Fixes: 22044f95faa0 ("net: hns3: add support for spoof check setting") Signed-off-by: Jian Shen Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 23b4201dead410c4a5108a8e723240419ab75257 Author: Jian Shen Date: Thu Mar 12 15:11:04 2020 +0800 net: hns3: fix VF VLAN table entries inconsistent issue Currently, if VF is loaded on the host side, the host doesn't clear the VF's VLAN table entries when VF removing. In this case, when doing reset and disabling sriov at the same time the VLAN device over VF will be removed, but the VLAN table entries in hardware are remained. This patch fixes it by asking PF to clear the VLAN table entries for VF when VF is removing. It also clears the VLAN table full bit after VF VLAN table entries being cleared. Fixes: c6075b193462 ("net: hns3: Record VF vlan tables") Signed-off-by: Jian Shen Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 5eb01ddfcfb25e6ebc404a41deae946bde776731 Author: Yonglong Liu Date: Thu Mar 12 15:11:03 2020 +0800 net: hns3: fix "tc qdisc del" failed issue The HNS3 driver supports to configure TC numbers and TC to priority map via "tc" tool. But when delete the rule, will fail, because the HNS3 driver needs at least one TC, but the "tc" tool sets TC number to zero when delete. This patch makes sure that the TC number is at least one. Fixes: 30d240dfa2e8 ("net: hns3: Add mqprio hardware offload support in hns3 driver") Signed-off-by: Yonglong Liu Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit b09fe70ef520e011ba4a64f4b93f948a8f14717b Author: Vinicius Costa Gomes Date: Mon Mar 9 10:39:53 2020 -0700 taprio: Fix sending packets without dequeueing them There was a bug that was causing packets to be sent to the driver without first calling dequeue() on the "child" qdisc. And the KASAN report below shows that sending a packet without calling dequeue() leads to bad results. The problem is that when checking the last qdisc "child" we do not set the returned skb to NULL, which can cause it to be sent to the driver, and so after the skb is sent, it may be freed, and in some situations a reference to it may still be in the child qdisc, because it was never dequeued. The crash log looks like this: [ 19.937538] ================================================================== [ 19.938300] BUG: KASAN: use-after-free in taprio_dequeue_soft+0x620/0x780 [ 19.938968] Read of size 4 at addr ffff8881128628cc by task swapper/1/0 [ 19.939612] [ 19.939772] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc3+ #97 [ 19.940397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qe4 [ 19.941523] Call Trace: [ 19.941774] [ 19.941985] dump_stack+0x97/0xe0 [ 19.942323] print_address_description.constprop.0+0x3b/0x60 [ 19.942884] ? taprio_dequeue_soft+0x620/0x780 [ 19.943325] ? taprio_dequeue_soft+0x620/0x780 [ 19.943767] __kasan_report.cold+0x1a/0x32 [ 19.944173] ? taprio_dequeue_soft+0x620/0x780 [ 19.944612] kasan_report+0xe/0x20 [ 19.944954] taprio_dequeue_soft+0x620/0x780 [ 19.945380] __qdisc_run+0x164/0x18d0 [ 19.945749] net_tx_action+0x2c4/0x730 [ 19.946124] __do_softirq+0x268/0x7bc [ 19.946491] irq_exit+0x17d/0x1b0 [ 19.946824] smp_apic_timer_interrupt+0xeb/0x380 [ 19.947280] apic_timer_interrupt+0xf/0x20 [ 19.947687] [ 19.947912] RIP: 0010:default_idle+0x2d/0x2d0 [ 19.948345] Code: 00 00 41 56 41 55 65 44 8b 2d 3f 8d 7c 7c 41 54 55 53 0f 1f 44 00 00 e8 b1 b2 c5 fd e9 07 00 3 [ 19.950166] RSP: 0018:ffff88811a3efda0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 19.950909] RAX: 0000000080000000 RBX: ffff88811a3a9600 RCX: ffffffff8385327e [ 19.951608] RDX: 1ffff110234752c0 RSI: 0000000000000000 RDI: ffffffff8385262f [ 19.952309] RBP: ffffed10234752c0 R08: 0000000000000001 R09: ffffed10234752c1 [ 19.953009] R10: ffffed10234752c0 R11: ffff88811a3a9607 R12: 0000000000000001 [ 19.953709] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 19.954408] ? default_idle_call+0x2e/0x70 [ 19.954816] ? default_idle+0x1f/0x2d0 [ 19.955192] default_idle_call+0x5e/0x70 [ 19.955584] do_idle+0x3d4/0x500 [ 19.955909] ? arch_cpu_idle_exit+0x40/0x40 [ 19.956325] ? _raw_spin_unlock_irqrestore+0x23/0x30 [ 19.956829] ? trace_hardirqs_on+0x30/0x160 [ 19.957242] cpu_startup_entry+0x19/0x20 [ 19.957633] start_secondary+0x2a6/0x380 [ 19.958026] ? set_cpu_sibling_map+0x18b0/0x18b0 [ 19.958486] secondary_startup_64+0xa4/0xb0 [ 19.958921] [ 19.959078] Allocated by task 33: [ 19.959412] save_stack+0x1b/0x80 [ 19.959747] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 19.960222] kmem_cache_alloc+0xe4/0x230 [ 19.960617] __alloc_skb+0x91/0x510 [ 19.960967] ndisc_alloc_skb+0x133/0x330 [ 19.961358] ndisc_send_ns+0x134/0x810 [ 19.961735] addrconf_dad_work+0xad5/0xf80 [ 19.962144] process_one_work+0x78e/0x13a0 [ 19.962551] worker_thread+0x8f/0xfa0 [ 19.962919] kthread+0x2ba/0x3b0 [ 19.963242] ret_from_fork+0x3a/0x50 [ 19.963596] [ 19.963753] Freed by task 33: [ 19.964055] save_stack+0x1b/0x80 [ 19.964386] __kasan_slab_free+0x12f/0x180 [ 19.964830] kmem_cache_free+0x80/0x290 [ 19.965231] ip6_mc_input+0x38a/0x4d0 [ 19.965617] ipv6_rcv+0x1a4/0x1d0 [ 19.965948] __netif_receive_skb_one_core+0xf2/0x180 [ 19.966437] netif_receive_skb+0x8c/0x3c0 [ 19.966846] br_handle_frame_finish+0x779/0x1310 [ 19.967302] br_handle_frame+0x42a/0x830 [ 19.967694] __netif_receive_skb_core+0xf0e/0x2a90 [ 19.968167] __netif_receive_skb_one_core+0x96/0x180 [ 19.968658] process_backlog+0x198/0x650 [ 19.969047] net_rx_action+0x2fa/0xaa0 [ 19.969420] __do_softirq+0x268/0x7bc [ 19.969785] [ 19.969940] The buggy address belongs to the object at ffff888112862840 [ 19.969940] which belongs to the cache skbuff_head_cache of size 224 [ 19.971202] The buggy address is located 140 bytes inside of [ 19.971202] 224-byte region [ffff888112862840, ffff888112862920) [ 19.972344] The buggy address belongs to the page: [ 19.972820] page:ffffea00044a1800 refcount:1 mapcount:0 mapping:ffff88811a2bd1c0 index:0xffff8881128625c0 compo0 [ 19.973930] flags: 0x8000000000010200(slab|head) [ 19.974388] raw: 8000000000010200 ffff88811a2ed650 ffff88811a2ed650 ffff88811a2bd1c0 [ 19.975151] raw: ffff8881128625c0 0000000000190013 00000001ffffffff 0000000000000000 [ 19.975915] page dumped because: kasan: bad access detected [ 19.976461] page_owner tracks the page as allocated [ 19.976946] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NO) [ 19.978332] prep_new_page+0x24b/0x330 [ 19.978707] get_page_from_freelist+0x2057/0x2c90 [ 19.979170] __alloc_pages_nodemask+0x218/0x590 [ 19.979619] new_slab+0x9d/0x300 [ 19.979948] ___slab_alloc.constprop.0+0x2f9/0x6f0 [ 19.980421] __slab_alloc.constprop.0+0x30/0x60 [ 19.980870] kmem_cache_alloc+0x201/0x230 [ 19.981269] __alloc_skb+0x91/0x510 [ 19.981620] alloc_skb_with_frags+0x78/0x4a0 [ 19.982043] sock_alloc_send_pskb+0x5eb/0x750 [ 19.982476] unix_stream_sendmsg+0x399/0x7f0 [ 19.982904] sock_sendmsg+0xe2/0x110 [ 19.983262] ____sys_sendmsg+0x4de/0x6d0 [ 19.983660] ___sys_sendmsg+0xe4/0x160 [ 19.984032] __sys_sendmsg+0xab/0x130 [ 19.984396] do_syscall_64+0xe7/0xae0 [ 19.984761] page last free stack trace: [ 19.985142] __free_pages_ok+0x432/0xbc0 [ 19.985533] qlist_free_all+0x56/0xc0 [ 19.985907] quarantine_reduce+0x149/0x170 [ 19.986315] __kasan_kmalloc.constprop.0+0x9e/0xd0 [ 19.986791] kmem_cache_alloc+0xe4/0x230 [ 19.987182] prepare_creds+0x24/0x440 [ 19.987548] do_faccessat+0x80/0x590 [ 19.987906] do_syscall_64+0xe7/0xae0 [ 19.988276] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 19.988775] [ 19.988930] Memory state around the buggy address: [ 19.989402] ffff888112862780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.990111] ffff888112862800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 19.990822] >ffff888112862880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.991529] ^ [ 19.992081] ffff888112862900: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 19.992796] ffff888112862980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") Reported-by: Michael Schmidt Signed-off-by: Vinicius Costa Gomes Acked-by: Andre Guedes Signed-off-by: David S. Miller commit 3cc6e2c599cdca573a8f347aea5da4c855ff5a78 Merge: 2644bc8569ba 443d372d6a96 Author: Linus Torvalds Date: Thu Mar 12 09:59:36 2020 -0700 Merge tag 'for-linus-5.6-2' of git://github.com/cminyard/linux-ipmi Pull IPMI fix from Corey Minyard: "Fix a message spew on some system The call to platform_get_irq() was changed to print a log if the interrupt was not available, and that was causing bogus messages to spew out for the IPMI driver. People have requested that this get in to 5.6 so I'm sending it along" * tag 'for-linus-5.6-2' of git://github.com/cminyard/linux-ipmi: ipmi_si: Avoid spurious errors for optional IRQs commit e2e57291097b289f84e05fa58ab5e6c6f30cc6e2 Author: Johannes Berg Date: Thu Mar 12 09:04:08 2020 +0100 wlcore: remove stray plus sign The commit mentioned below added a stray plus sign, likely due to some conflict resolution (i.e. as a leftover from a unified diff), which was harmless since it was just used as an integer constant modifier. Remove it anyway, now that I stumbled across it. Fixes: cf33a7728bf2 ("wlcore: mesh: Add support for RX Broadcast Key") Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo commit 2644bc8569baa735ae9c0a92432d6a30c20c1694 Merge: e6e6ec48dd0f 1579f1bc3b75 Author: Linus Torvalds Date: Thu Mar 12 09:25:55 2020 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a build problem with x86/curve25519" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: x86/curve25519 - support assemblers with no adx support commit 5461e0530c222129dfc941058be114b5cbc00837 Author: Takashi Iwai Date: Thu Mar 12 16:57:30 2020 +0100 ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks The return value checks in snd_pcm_plug_alloc() are covered with snd_BUG_ON() macro that may trigger a kernel WARNING depending on the kconfig. But since the error condition can be triggered by a weird user space parameter passed to OSS layer, we shouldn't give the kernel stack trace just for that. As it's a normal error condition, let's remove snd_BUG_ON() macro usage there. Reported-by: syzbot+2a59ee7a9831b264f45e@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20200312155730.7520-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f17f06a0c7794d3a7c2425663738823354447472 Author: Srinivas Kandagatla Date: Thu Mar 12 15:25:10 2020 +0000 slimbus: ngd: add v2.1.0 compatible This patch adds compatible for SlimBus Controller on SDM845. Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20200312152510.12224-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 531d3040bc5cf37dea01b118608347cca9325f9d Author: Amir Goldstein Date: Mon Mar 2 15:03:35 2020 +0200 ovl: fix lock in ovl_llseek() ovl_inode_lock() is interruptible. When inode_lock() in ovl_llseek() was replaced with ovl_inode_lock(), we did not add a check for error. Fix this by making ovl_inode_lock() uninterruptible and change the existing call sites to use an _interruptible variant. Reported-by: syzbot+66a9752fa927f745385e@syzkaller.appspotmail.com Fixes: b1f9d3858f72 ("ovl: use ovl_inode_lock in ovl_llseek()") Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit b53df2e7442c73a932fb74228147fb946e531585 Author: Shin'ichiro Kawasaki Date: Fri Feb 21 10:37:08 2020 +0900 block: Fix partition support for host aware zoned block devices Commit b72053072c0b ("block: allow partitions on host aware zone devices") introduced the helper function disk_has_partitions() to check if a given disk has valid partitions. However, since this function result directly depends on the disk partition table length rather than the actual existence of valid partitions in the table, it returns true even after all partitions are removed from the disk. For host aware zoned block devices, this results in zone management support to be kept disabled even after removing all partitions. Fix this by changing disk_has_partitions() to walk through the partition table entries and return true if and only if a valid non-zero size partition is found. Fixes: b72053072c0b ("block: allow partitions on host aware zone devices") Cc: stable@vger.kernel.org # 5.5 Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Shin'ichiro Kawasaki Signed-off-by: Jens Axboe commit c80b18cbb04b7b101af9bd14550f13d9866c646a Author: Larry Finger Date: Wed Feb 19 14:00:41 2020 -0600 rtlwifi: rtl8188ee: Fix regression due to commit d1d1a96bdb44 For some unexplained reason, commit d1d1a96bdb44 ("rtlwifi: rtl8188ee: Remove local configuration variable") broke at least one system. As the only net effect of the change was to remove 2 bytes from the start of struct phy_status_rpt, this patch adds 2 bytes of padding at the beginning of the struct. Fixes: d1d1a96bdb44 ("rtlwifi: rtl8188ee: Remove local configuration variable") Cc: Stable # V5.4+ Reported-by: Ashish Tested-by: Ashish Signed-off-by: Larry Finger Signed-off-by: Kalle Valo commit cc3200eac4c5eb11c3f34848a014d1f286316310 Author: Ming Lei Date: Thu Mar 12 17:15:48 2020 +0800 blk-mq: insert flush request to the front of dispatch queue commit 01e99aeca397 ("blk-mq: insert passthrough request into hctx->dispatch directly") may change to add flush request to the tail of dispatch by applying the 'add_head' parameter of blk_mq_sched_insert_request. Turns out this way causes performance regression on NCQ controller because flush is non-NCQ command, which can't be queued when there is any in-flight NCQ command. When adding flush rq to the front of hctx->dispatch, it is easier to introduce extra time to flush rq's latency compared with adding to the tail of dispatch queue because of S_SCHED_RESTART, then chance of flush merge is increased, and less flush requests may be issued to controller. So always insert flush request to the front of dispatch queue just like before applying commit 01e99aeca397 ("blk-mq: insert passthrough request into hctx->dispatch directly"). Cc: Damien Le Moal Cc: Shinichiro Kawasaki Reported-by: Shinichiro Kawasaki Fixes: 01e99aeca397 ("blk-mq: insert passthrough request into hctx->dispatch directly") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 5e6bdd37c5526ef01326df5dabb93011ee89237e Author: Stefan Haberland Date: Thu Mar 12 14:17:15 2020 +0100 s390/dasd: fix data corruption for thin provisioned devices Devices are formatted in multiple of tracks. For an Extent Space Efficient (ESE) volume we get errors when accessing unformatted tracks. In this case the driver either formats the track on the flight for write requests or returns zero data for read requests. In case a request spans multiple tracks, the indication of an unformatted track presented for the first track is incorrectly applied to all tracks covered by the request. As a result, tracks containing data will be handled as empty, resulting in zero data being returned on read, or overwriting existing data with zero on write. Fix by determining the track that gets the NRF error. For write requests only format the track that is surely not formatted. For Read requests all tracks before have returned valid data and should not be touched. All tracks after the unformatted track might be formatted or not. Those are returned to the blocklayer to build a new request. When using alias devices there is a chance that multiple write requests trigger a format of the same track which might lead to data loss. Ensure that a track is formatted only once by maintaining a list of currently processed tracks. Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") Cc: stable@vger.kernel.org # 5.3+ Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Reviewed-by: Peter Oberparleiter Signed-off-by: Jens Axboe commit f967140dfb7442e2db0868b03b961f9c59418a1b Author: Kim Phillips Date: Wed Mar 11 14:13:21 2020 -0500 perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag Enable the sampling check in kernel/events/core.c::perf_event_open(), which returns the more appropriate -EOPNOTSUPP. BEFORE: $ sudo perf record -a -e instructions,l3_request_g1.caching_l3_cache_accesses true Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (l3_request_g1.caching_l3_cache_accesses). /bin/dmesg | grep -i perf may provide additional information. With nothing relevant in dmesg. AFTER: $ sudo perf record -a -e instructions,l3_request_g1.caching_l3_cache_accesses true Error: l3_request_g1.caching_l3_cache_accesses: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat' Fixes: c43ca5091a37 ("perf/x86/amd: Add support for AMD NB and L2I "uncore" counters") Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov Acked-by: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200311191323.13124-1-kim.phillips@amd.com commit 18d200460cd73636d4f20674085c39e32b4e0097 Author: Ulf Hansson Date: Wed Mar 11 10:20:36 2020 +0100 mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command The busy timeout for the CMD5 to put the eMMC into sleep state, is specific to the card. Potentially the timeout may exceed the host->max_busy_timeout. If that becomes the case, mmc_sleep() converts from using an R1B response to an R1 response, as to prevent the host from doing HW busy detection. However, it has turned out that some hosts requires an R1B response no matter what, so let's respect that via checking MMC_CAP_NEED_RSP_BUSY. Note that, if the R1B gets enforced, the host becomes fully responsible of managing the needed busy timeout, in one way or the other. Suggested-by: Sowjanya Komatineni Cc: Link: https://lore.kernel.org/r/20200311092036.16084-1-ulf.hansson@linaro.org Signed-off-by: Ulf Hansson commit cecc113c1af0dd41ccf265c1fdb84dbd05e63423 Author: Scott Chen Date: Wed Mar 11 14:14:23 2020 +0800 USB: serial: pl2303: add device-id for HP LD381 Add a device id for HP LD381 Display LD381: 03f0:0f7f Signed-off-by: Scott Chen Cc: stable Signed-off-by: Johan Hovold commit 8e852a7953be2a6ee371449f7257fe15ace6a1fc Author: Daniele Palmas Date: Wed Mar 4 11:43:10 2020 +0100 USB: serial: option: add ME910G1 ECM composition 0x110b Add ME910G1 ECM composition 0x110b: tty, tty, tty, ecm Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20200304104310.2938-1-dnlplm@gmail.com Cc: stable Signed-off-by: Johan Hovold commit b433e340e7565110b0ce9ca4b3e26f4b97a1decf Author: Ran Wang Date: Fri Mar 6 17:23:28 2020 +0800 usb: host: xhci-plat: add a shutdown When loading new kernel via kexec, we need to shutdown host controller to avoid any un-expected memory accessing during new kernel boot. Signed-off-by: Ran Wang Cc: stable Tested-by: Stephen Boyd Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/20200306092328.41253-1-ran.wang_1@nxp.com Signed-off-by: Greg Kroah-Hartman commit 081da1325d351ea8804cf74e65263ea120834f33 Author: Heikki Krogerus Date: Wed Mar 11 16:00:06 2020 +0300 usb: typec: ucsi: displayport: Fix a potential race during registration Locking the connector in ucsi_register_displayport() to make sure that nothing can access the displayport alternate mode before the function has finished and the alternate mode is actually ready. Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") Cc: stable@vger.kernel.org Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20200311130006.41288-3-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d16e7b62c5adcd13832c6b0ba364c3468d21b856 Author: Heikki Krogerus Date: Wed Mar 11 16:00:05 2020 +0300 usb: typec: ucsi: displayport: Fix NULL pointer dereference If the registration of the DisplayPort was not successful, or if the port does not support DisplayPort alt mode in the first place, the function ucsi_displayport_remove_partner() will fail with NULL pointer dereference when it attempts to access the driver data. Adding a check to the function to make sure there really is driver data for the device before modifying it. Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") Reported-by: Andrea Gagliardi La Gala BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206365 Cc: stable@vger.kernel.org Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20200311130006.41288-2-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b63e48fb50e1ca71db301ca9082befa6f16c55c4 Author: Kai-Heng Feng Date: Wed Feb 5 19:26:33 2020 +0800 USB: Disable LPM on WD19's Realtek Hub Realtek Hub (0bda:0x0487) used in Dell Dock WD19 sometimes drops off the bus when bringing underlying ports from U3 to U0. Disabling LPM on the hub during setting link state is not enough, so let's disable LPM completely for this hub. Acked-by: Alan Stern Signed-off-by: Kai-Heng Feng Cc: stable Link: https://lore.kernel.org/r/20200205112633.25995-3-kai.heng.feng@canonical.com Signed-off-by: Greg Kroah-Hartman commit 58d6fee50e67bb1c69977f1a534ccb17bf58b0f1 Author: Michael Auchter Date: Tue Mar 10 15:58:40 2020 -0500 misc: eeprom: at24: fix regulator underflow The at24 driver attempts to read a byte from the device to validate that it's actually present, and if not, disables the vcc regulator and returns -ENODEV. However, between the read and the error handling path, pm_runtime_idle() is called and invokes the driver's suspend callback, which also disables the vcc regulator. This leads to an underflow of the regulator enable count if the EEPROM is not present. Move the pm_runtime_suspend() call to be after the error handling path to resolve this. Fixes: cd5676db0574 ("misc: eeprom: at24: support pm_runtime control") Signed-off-by: Michael Auchter Signed-off-by: Bartosz Golaszewski commit e1f550dc44a4d535da4e25ada1b0eaf8f3417929 Author: Chris Packham Date: Thu Mar 12 09:05:46 2020 +1300 net: mvmdio: avoid error message for optional IRQ Per the dt-binding the interrupt is optional so use platform_get_irq_optional() instead of platform_get_irq(). Since commit 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()") platform_get_irq() produces an error message orion-mdio f1072004.mdio: IRQ index 0 not found which is perfectly normal if one hasn't specified the optional property in the device tree. Signed-off-by: Chris Packham Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 012fc74517b25177dfede2ed45cd108258564e4a Author: Andrew Lunn Date: Wed Mar 11 21:02:31 2020 +0100 net: dsa: mv88e6xxx: Add missing mask of ATU occupancy register Only the bottom 12 bits contain the ATU bin occupancy statistics. The upper bits need masking off. Fixes: e0c69ca7dfbb ("net: dsa: mv88e6xxx: Add ATU occupancy via devlink resources") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 06669ea346e476a5339033d77ef175566a40efbb Author: Eric Dumazet Date: Wed Mar 11 11:44:26 2020 -0700 net: memcg: fix lockdep splat in inet_csk_accept() Locking newsk while still holding the listener lock triggered a lockdep splat [1] We can simply move the memcg code after we release the listener lock, as this can also help if multiple threads are sharing a common listener. Also fix a typo while reading socket sk_rmem_alloc. [1] WARNING: possible recursive locking detected 5.6.0-rc3-syzkaller #0 Not tainted -------------------------------------------- syz-executor598/9524 is trying to acquire lock: ffff88808b5b8b90 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1541 [inline] ffff88808b5b8b90 (sk_lock-AF_INET6){+.+.}, at: inet_csk_accept+0x69f/0xd30 net/ipv4/inet_connection_sock.c:492 but task is already holding lock: ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1541 [inline] ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: inet_csk_accept+0x8d/0xd30 net/ipv4/inet_connection_sock.c:445 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_INET6); lock(sk_lock-AF_INET6); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by syz-executor598/9524: #0: ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1541 [inline] #0: ffff88808b5b9590 (sk_lock-AF_INET6){+.+.}, at: inet_csk_accept+0x8d/0xd30 net/ipv4/inet_connection_sock.c:445 stack backtrace: CPU: 0 PID: 9524 Comm: syz-executor598 Not tainted 5.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:2370 [inline] check_deadlock kernel/locking/lockdep.c:2411 [inline] validate_chain kernel/locking/lockdep.c:2954 [inline] __lock_acquire.cold+0x114/0x288 kernel/locking/lockdep.c:3954 lock_acquire+0x197/0x420 kernel/locking/lockdep.c:4484 lock_sock_nested+0xc5/0x110 net/core/sock.c:2947 lock_sock include/net/sock.h:1541 [inline] inet_csk_accept+0x69f/0xd30 net/ipv4/inet_connection_sock.c:492 inet_accept+0xe9/0x7c0 net/ipv4/af_inet.c:734 __sys_accept4_file+0x3ac/0x5b0 net/socket.c:1758 __sys_accept4+0x53/0x90 net/socket.c:1809 __do_sys_accept4 net/socket.c:1821 [inline] __se_sys_accept4 net/socket.c:1818 [inline] __x64_sys_accept4+0x93/0xf0 net/socket.c:1818 do_syscall_64+0xf6/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4445c9 Code: e8 0c 0d 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc35b37608 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004445c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000306777 R09: 0000000000306777 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004053d0 R14: 0000000000000000 R15: 0000000000000000 Fixes: d752a4986532 ("net: memcg: late association of sock to memcg") Signed-off-by: Eric Dumazet Cc: Shakeel Butt Reported-by: syzbot Signed-off-by: David S. Miller commit 5e72b23774c2f7182a95fb81fdd688d5d837d0b7 Merge: 267762538705 5d4f78564c9c Author: David S. Miller Date: Wed Mar 11 23:52:32 2020 -0700 Merge branch 's390-qeth-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2020-03-11 please apply the following patch series for qeth to netdev's net tree. Just one fix to get the RX buffer pool resizing right, with two preparatory cleanups. This is on the larger side given where we are in the -rc cycle, but a big chunk of the delta is just refactoring to make the fix look nice. I intentionally split these off from yesterday's series. No objections if you'd rather punt them to net-next, the series should apply cleanly. ==================== Signed-off-by: David S. Miller commit 5d4f78564c9ca38146102c4f8998edcad5afbc22 Author: Julian Wiedmann Date: Wed Mar 11 18:07:11 2020 +0100 s390/qeth: implement smarter resizing of the RX buffer pool The RX buffer pool is allocated in qeth_alloc_qdio_queues(). A subsequent pool resizing is then handled in a very simple way: first free the current pool, then allocate a new pool of the requested size. There's two ways where this can go wrong: 1. if the resize action happens _before_ the initial pool was allocated, then a subsequent initialization will call qeth_alloc_qdio_queues() and fill the pool with a second(!) set of pages. We consume twice the planned amount of memory. This is easy to fix - just skip the resizing if the queues haven't been allocated yet. 2. if the initial pool was created by qeth_alloc_qdio_queues() but a subsequent resizing fails, then the device has no(!) RX buffer pool. The next initialization will _not_ call qeth_alloc_qdio_queues(), and attempting to back the RX buffers with pages in qeth_init_qdio_queues() will fail. Not very difficult to fix either - instead of re-allocating the whole pool, just allocate/free as many entries to match the desired size. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 0f75e149298bedc48db03259a38a303611d247b1 Author: Julian Wiedmann Date: Wed Mar 11 18:07:10 2020 +0100 s390/qeth: refactor buffer pool code In preparation for a subsequent fix, split out helpers to allocate/free individual pool entries. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit f81649dfa5343eef7e579eb6f8dd8bd6d300ec31 Author: Julian Wiedmann Date: Wed Mar 11 18:07:09 2020 +0100 s390/qeth: use page pointers to manage RX buffer pool The RX buffer elements are always backed with full pages, reflect this in the pointer type. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 2677625387056136e256c743e3285b4fe3da87bb Author: Paolo Lungaroni Date: Wed Mar 11 17:54:06 2020 +0100 seg6: fix SRv6 L2 tunnels to use IANA-assigned protocol number The Internet Assigned Numbers Authority (IANA) has recently assigned a protocol number value of 143 for Ethernet [1]. Before this assignment, encapsulation mechanisms such as Segment Routing used the IPv6-NoNxt protocol number (59) to indicate that the encapsulated payload is an Ethernet frame. In this patch, we add the definition of the Ethernet protocol number to the kernel headers and update the SRv6 L2 tunnels to use it. [1] https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml Signed-off-by: Paolo Lungaroni Reviewed-by: Andrea Mayer Acked-by: Ahmed Abdelsalam Signed-off-by: David S. Miller commit a20f997010c4ec76eaa55b8cc047d76dcac69f70 Author: Andrew Lunn Date: Wed Mar 11 16:24:24 2020 +0100 net: dsa: Don't instantiate phylink for CPU/DSA ports unless needed By default, DSA drivers should configure CPU and DSA ports to their maximum speed. In many configurations this is sufficient to make the link work. In some cases it is necessary to configure the link to run slower, e.g. because of limitations of the SoC it is connected to. Or back to back PHYs are used and the PHY needs to be driven in order to establish link. In this case, phylink is used. Only instantiate phylink if it is required. If there is no PHY, or no fixed link properties, phylink can upset a link which works in the default configuration. Fixes: 0e27921816ad ("net: dsa: Use PHYLINK for the CPU/DSA ports") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 46e4c421a053c36bf7a33dda2272481bcaf3eed3 Author: Willem de Bruijn Date: Mon Mar 9 11:34:35 2020 -0400 net/packet: tpacket_rcv: do not increment ring index on drop In one error case, tpacket_rcv drops packets after incrementing the ring producer index. If this happens, it does not update tp_status to TP_STATUS_USER and thus the reader is stalled for an iteration of the ring, causing out of order arrival. The only such error path is when virtio_net_hdr_from_skb fails due to encountering an unknown GSO type. Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit f3cc008bf6d59b8d93b4190e01d3e557b0040e15 Author: Dominik Czarnota Date: Mon Mar 9 16:22:50 2020 +0100 sxgbe: Fix off by one in samsung driver strncpy size arg This patch fixes an off-by-one error in strncpy size argument in drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c. The issue is that in: strncmp(opt, "eee_timer:", 6) the passed string literal: "eee_timer:" has 10 bytes (without the NULL byte) and the passed size argument is 6. As a result, the logic will also accept other, malformed strings, e.g. "eee_tiXXX:". This bug doesn't seem to have any security impact since its present in module's cmdline parsing code. Signed-off-by: Dominik Czarnota Signed-off-by: David S. Miller commit f9fc28a8de2fb367f1ab76f0cf176ca545db3d6f Author: Amol Grover Date: Thu Mar 12 11:04:20 2020 +0530 net: caif: Add lockdep expression to RCU traversal primitive caifdevs->list is traversed using list_for_each_entry_rcu() outside an RCU read-side critical section but under the protection of rtnl_mutex. Hence, add the corresponding lockdep expression to silence the following false-positive warning: [ 10.868467] ============================= [ 10.869082] WARNING: suspicious RCU usage [ 10.869817] 5.6.0-rc1-00177-g06ec0a154aae4 #1 Not tainted [ 10.870804] ----------------------------- [ 10.871557] net/caif/caif_dev.c:115 RCU-list traversed in non-reader section!! Reported-by: kernel test robot Signed-off-by: Amol Grover Signed-off-by: David S. Miller commit eecba79e694eda24ba698fe1bdf0466d2f797b42 Author: Jakub Kicinski Date: Wed Mar 11 16:37:02 2020 -0700 MAINTAINERS: remove Sathya Perla as Emulex NIC maintainer Remove Sathya Perla, sathya.perla@broadcom.com is bouncing. The driver has 3 more maintainers. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit ab14961d10d02d20767612c78ce148f6eb85bd58 Author: Jakub Kicinski Date: Tue Mar 10 20:36:16 2020 -0700 net: fec: validate the new settings in fec_enet_set_coalesce() fec_enet_set_coalesce() validates the previously set params and if they are within range proceeds to apply the new ones. The new ones, however, are not validated. This seems backwards, probably a copy-paste error? Compile tested only. Fixes: d851b47b22fc ("net: fec: add interrupt coalescence feature support") Signed-off-by: Jakub Kicinski Acked-by: Fugang Duan Signed-off-by: David S. Miller commit 443d372d6a96cd94ad119e5c14bb4d63a536a7f6 Author: Takashi Iwai Date: Wed Feb 5 10:31:46 2020 +0100 ipmi_si: Avoid spurious errors for optional IRQs Although the IRQ assignment in ipmi_si driver is optional, platform_get_irq() spews error messages unnecessarily: ipmi_si dmi-ipmi-si.0: IRQ index 0 not found Fix this by switching to platform_get_irq_optional(). Cc: stable@vger.kernel.org # 5.4.x Cc: John Donnelly Fixes: 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()") Reported-and-tested-by: Patrick Vo Signed-off-by: Takashi Iwai Message-Id: <20200205093146.1352-1-tiwai@suse.de> Signed-off-by: Corey Minyard commit e3c3b6e66da1caeb39a504b03ddcdd3693e45254 Merge: 2c523b344dfa 07dc3678bacc Author: Dave Airlie Date: Thu Mar 12 11:02:46 2020 +1000 Merge tag 'exynos-drm-fixes-for-v5.6-rc5-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Fix IOMMU initialization failure when Exynos DRM driver is rebound, and also fix memory leak to iommu mapping object, which was detected by kmemleak detector. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/1583887109-4148-1-git-send-email-inki.dae@samsung.com commit 3a7c733165a4799fa1beb262fe244bfbcdd1c163 Author: Masahiro Yamada Date: Tue Mar 10 19:12:50 2020 +0900 int128: fix __uint128_t compiler test in Kconfig The support for __uint128_t is dependent on the target bit size. GCC that defaults to the 32-bit can still build the 64-bit kernel with -m64 flag passed. However, $(cc-option,-D__SIZEOF_INT128__=0) is evaluated against the default machine bit, which may not match to the kernel it is building. Theoretically, this could be evaluated separately for 64BIT/32BIT. config CC_HAS_INT128 bool default !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0) if 64BIT default !$(cc-option,$(m32-flag) -D__SIZEOF_INT128__=0) I simplified it more because the 32-bit compiler is unlikely to support __uint128_t. Fixes: c12d3362a74b ("int128: move __uint128_t compiler test to Kconfig") Reported-by: George Spelvin Signed-off-by: Masahiro Yamada Tested-by: George Spelvin commit 8cc4fd73501d9f1370c3eebb70cfe8cc9e24062b Author: Masahiro Yamada Date: Tue Mar 10 19:12:49 2020 +0900 kconfig: introduce m32-flag and m64-flag When a compiler supports multiple architectures, some compiler features can be dependent on the target architecture. This is typical for Clang, which supports multiple LLVM backends. Even for GCC, we need to take care of biarch compiler cases. It is not a problem when we evaluate cc-option in Makefiles because cc-option is tested against the flag in question + $(KBUILD_CFLAGS). The cc-option in Kconfig, on the other hand, does not accumulate tested flags. Due to this simplification, it could potentially test cc-option against a different target. At first, Kconfig always evaluated cc-option against the host architecture. Since commit e8de12fb7cde ("kbuild: Check for unknown options with cc-option usage in Kconfig and clang"), in case of cross-compiling with Clang, the target triple is correctly passed to Kconfig. The case with biarch GCC (and native build with Clang) is still not handled properly. We need to pass some flags to specify the target machine bit. Due to the design, all the macros in Kconfig are expanded in the parse stage, where we do not know the target bit size yet. For example, arch/x86/Kconfig allows a user to toggle CONFIG_64BIT. If a compiler flag -foo depends on the machine bit, it must be tested twice, one with -m32 and the other with -m64. However, -m32/-m64 are not always recognized. So, this commits adds m64-flag and m32-flag macros. They expand to -m32, -m64, respectively if supported. Or, they expand to an empty string if unsupported. The typical usage is like this: config FOO bool default $(cc-option,$(m64-flag) -foo) if 64BIT default $(cc-option,$(m32-flag) -foo) This is clumsy, but there is no elegant way to handle this in the current static macro expansion. There was discussion for static functions vs dynamic functions. The consensus was to go as far as possible with the static functions. (https://lkml.org/lkml/2018/3/2/22) Signed-off-by: Masahiro Yamada Tested-by: George Spelvin Reviewed-by: Nathan Chancellor commit 46b7c49254f89d54f11c58fa629f66e224a16034 Author: SZ Lin (林上智) Date: Sun Mar 1 00:09:58 2020 +0800 kbuild: Fix inconsistent comment The commit 2042b5486bd3 ("kbuild: unset variables in top Makefile instead of setting 0") renamed the variable from "config-targets" to "config-build", the comment should be consistent accordingly. Signed-off-by: Kaiden PK Yu (余泊鎧) Signed-off-by: SZ Lin (林上智) Signed-off-by: Masahiro Yamada commit 14a0d527a479eb2cb6067f9e5e163e1bf35db2a9 Author: Chris Wilson Date: Tue Mar 10 10:17:20 2020 +0000 drm/i915: Defer semaphore priority bumping to a workqueue Since the semaphore fence may be signaled from inside an interrupt handler from inside a request holding its request->lock, we cannot then enter into the engine->active.lock for processing the semaphore priority bump as we may traverse our call tree and end up on another held request. CPU 0: [ 2243.218864] _raw_spin_lock_irqsave+0x9a/0xb0 [ 2243.218867] i915_schedule_bump_priority+0x49/0x80 [i915] [ 2243.218869] semaphore_notify+0x6d/0x98 [i915] [ 2243.218871] __i915_sw_fence_complete+0x61/0x420 [i915] [ 2243.218874] ? kmem_cache_free+0x211/0x290 [ 2243.218876] i915_sw_fence_complete+0x58/0x80 [i915] [ 2243.218879] dma_i915_sw_fence_wake+0x3e/0x80 [i915] [ 2243.218881] signal_irq_work+0x571/0x690 [i915] [ 2243.218883] irq_work_run_list+0xd7/0x120 [ 2243.218885] irq_work_run+0x1d/0x50 [ 2243.218887] smp_irq_work_interrupt+0x21/0x30 [ 2243.218889] irq_work_interrupt+0xf/0x20 CPU 1: [ 2242.173107] _raw_spin_lock+0x8f/0xa0 [ 2242.173110] __i915_request_submit+0x64/0x4a0 [i915] [ 2242.173112] __execlists_submission_tasklet+0x8ee/0x2120 [i915] [ 2242.173114] ? i915_sched_lookup_priolist+0x1e3/0x2b0 [i915] [ 2242.173117] execlists_submit_request+0x2e8/0x2f0 [i915] [ 2242.173119] submit_notify+0x8f/0xc0 [i915] [ 2242.173121] __i915_sw_fence_complete+0x61/0x420 [i915] [ 2242.173124] ? _raw_spin_unlock_irqrestore+0x39/0x40 [ 2242.173137] i915_sw_fence_complete+0x58/0x80 [i915] [ 2242.173140] i915_sw_fence_commit+0x16/0x20 [i915] Closes: https://gitlab.freedesktop.org/drm/intel/issues/1318 Fixes: b7404c7ecb38 ("drm/i915: Bump ready tasks ahead of busywaits") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: # v5.2+ Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200310101720.9944-1-chris@chris-wilson.co.uk (cherry picked from commit 209df10bb4536c81c2540df96c02cd079435357f) Signed-off-by: Jani Nikula commit 8ea6bb8e4d47e07518e5dba4f5cb77e210f0df82 Author: Chris Wilson Date: Fri Mar 6 15:46:47 2020 +0000 drm/i915/gt: Close race between cacheline_retire and free If the cacheline may still be busy, atomically mark it for future release, and only if we can determine that it will never be used again, immediately free it. Closes: https://gitlab.freedesktop.org/drm/intel/issues/1392 Fixes: ebece7539242 ("drm/i915: Keep timeline HWSP allocated until idle across the system") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Mika Kuoppala Cc: Matthew Auld Reviewed-by: Mika Kuoppala Cc: # v5.2+ Link: https://patchwork.freedesktop.org/patch/msgid/20200306154647.3528345-1-chris@chris-wilson.co.uk (cherry picked from commit 2d4bd971f5baa51418625f379a69f5d58b5a0450) Signed-off-by: Jani Nikula commit eafc2aa20fba319b6e791a1b0c45a91511eccb6b Author: Chris Wilson Date: Fri Mar 6 11:30:10 2020 +0000 drm/i915/execlists: Enable timeslice on partial virtual engine dequeue If we stop filling the ELSP due to an incompatible virtual engine request, check if we should enable the timeslice on behalf of the queue. This fixes the case where we are inspecting the last->next element when we know that the last element is the last request in the execution queue, and so decided we did not need to enable timeslicing despite the intent to do so! Fixes: 8ee36e048c98 ("drm/i915/execlists: Minimalistic timeslicing") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Cc: # v5.4+ Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200306113012.3184606-1-chris@chris-wilson.co.uk (cherry picked from commit 3df2deed411e0f1b7312baf0139aab8bba4c0410) Signed-off-by: Jani Nikula commit 1d61c5d711a2dc0b978ae905535edee9601f9449 Author: Matthew Auld Date: Thu Mar 5 20:35:34 2020 +0000 drm/i915: be more solid in checking the alignment The alignment is u64, and yet is_power_of_2() assumes unsigned long, which might give different results between 32b and 64b kernel. Signed-off-by: Matthew Auld Cc: Chris Wilson Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200305203534.210466-1-matthew.auld@intel.com Cc: stable@vger.kernel.org (cherry picked from commit 2920516b2f719546f55079bc39a7fe409d9e80ab) Signed-off-by: Jani Nikula commit 259170cb4c84f4165a36c0b05811eb74c495412c Author: Tina Zhang Date: Thu Feb 27 09:00:41 2020 +0800 drm/i915/gvt: Fix dma-buf display blur issue on CFL Commit c3b5a8430daad ("drm/i915/gvt: Enable gfx virtualiztion for CFL") added the support on CFL. The vgpu emulation hotplug support on CFL was supposed to be included in that patch. Without the vgpu emulation hotplug support, the dma-buf based display gives us a blur face. So fix this issue by adding the vgpu emulation hotplug support on CFL. Fixes: c3b5a8430daad ("drm/i915/gvt: Enable gfx virtualiztion for CFL") Signed-off-by: Tina Zhang Acked-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20200227010041.32248-1-tina.zhang@intel.com (cherry picked from commit 135dde8853c7e00f6002e710f7e4787ed8585c0e) Signed-off-by: Jani Nikula commit c951b0af2dddbb1f34be103029eb9030392d5554 Author: Chris Wilson Date: Thu Mar 5 13:48:22 2020 +0000 drm/i915: Return early for await_start on same timeline Requests within a timeline are ordered by that timeline, so awaiting for the start of a request within the timeline is a no-op. This used to work by falling out of the mutex_trylock() as the signaler and waiter had the same timeline and not returning an error. Fixes: 6a79d848403d ("drm/i915: Lock signaler timeline while navigating") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: # v5.5+ Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200305134822.2750496-1-chris@chris-wilson.co.uk (cherry picked from commit ab7a69020fb5d5c7ba19fba60f62fd6f9ca9f779) Signed-off-by: Jani Nikula commit c67b35d970ed3391069c21f3071a26f687399ab2 Author: Chris Wilson Date: Thu Mar 5 10:42:10 2020 +0000 drm/i915: Actually emit the await_start Fix the inverted test to emit the wait on the end of the previous request if we /haven't/ already. Fixes: 6a79d848403d ("drm/i915: Lock signaler timeline while navigating") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: # v5.5+ Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200305104210.2619967-1-chris@chris-wilson.co.uk (cherry picked from commit 07e9c59d63df6a1c44c1975c01827ba18b69270a) Signed-off-by: Jani Nikula commit 7395f62d95aafacdb9bd4996ec2f95b4a655d7e6 Author: Nathan Chancellor Date: Tue Mar 10 15:06:54 2020 -0700 dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom Clang warns: drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:2860:9: warning: converting the result of '?:' with integer constants to a boolean always evaluates to 'true' [-Wtautological-constant-compare] return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom, ^ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:131:34: note: expanded from macro 'DPAA_FD_DATA_ALIGNMENT' \#define DPAA_FD_DATA_ALIGNMENT (fman_has_errata_a050385() ? 64 : 16) ^ 1 warning generated. This was exposed by commit 3c68b8fffb48 ("dpaa_eth: FMan erratum A050385 workaround") even though it appears to have been an issue since the introductory commit 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") since DPAA_FD_DATA_ALIGNMENT has never been able to be zero. Just replace the whole boolean expression with the true branch, as it is always been true. Link: https://github.com/ClangBuiltLinux/linux/issues/928 Signed-off-by: Nathan Chancellor Reviewed-by: Madalin Bucur Signed-off-by: David S. Miller commit e6e6ec48dd0fa12e8a2d1ff6b55cd907401bd7fe Merge: addcb1d0ee31 2b4eae95c736 Author: Linus Torvalds Date: Wed Mar 11 13:35:34 2020 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt fix from Eric Biggers: "Fix a bug where if userspace is writing to encrypted files while the FS_IOC_REMOVE_ENCRYPTION_KEY ioctl (introduced in v5.4) is running, dirty inodes could be evicted, causing writes could be lost or the filesystem to hang due to a use-after-free. This was encountered during real-world use, not just theoretical. Tested with the existing fscrypt xfstests, and with a new xfstest I wrote to reproduce this bug. This fix does expose an existing bug with '-o lazytime' that Ted is working on fixing, but this fix is more critical and needed anyway regardless of the lazytime fix" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fscrypt: don't evict dirty inodes after removing key commit f2df8ce148fc6af6944978a3876593ef6c40994c Merge: 2165fdf4bc2d ba32679cac50 Author: David S. Miller Date: Wed Mar 11 12:29:03 2020 -0700 Merge tag 'mac80211-for-net-2020-03-11' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A couple of fixes: * three netlink validation fixes * a mesh path selection fix ==================== Signed-off-by: David S. Miller commit 211b64e4b5b6bd5fdc19cd525c2cc9a90e6b0ec9 Author: Christian Brauner Date: Wed Mar 11 11:53:09 2020 +0100 binderfs: use refcount for binder control devices too Binderfs binder-control devices are cleaned up via binderfs_evict_inode too() which will use refcount_dec_and_test(). However, we missed to set the refcount for binderfs binder-control devices and so we underflowed when the binderfs instance got unmounted. Pretty obvious oversight and should have been part of the more general UAF fix. The good news is that having test cases (suprisingly) helps. Technically, we could detect that we're about to cleanup the binder-control dentry in binderfs_evict_inode() and then simply clean it up. But that makes the assumption that the binder driver itself will never make use of a binderfs binder-control device after the binderfs instance it belongs to has been unmounted and the superblock for it been destroyed. While it is unlikely to ever come to this let's be on the safe side. Performance-wise this also really doesn't matter since the binder-control device is only every really when creating the binderfs filesystem or creating additional binder devices. Both operations are pretty rare. Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II") Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com Reported-by: Naresh Kamboju Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner Acked-by: Todd Kjos Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com Signed-off-by: Greg Kroah-Hartman commit 8d92e992a785f35d23f845206cf8c6cafbc264e0 Author: Eugeniy Paltsev Date: Wed Mar 11 19:26:43 2020 +0300 ARC: define __ALIGN_STR and __ALIGN symbols for ARC The default defintions use fill pattern 0x90 for padding which for ARC generates unintended "ldh_s r12,[r0,0x20]" corresponding to opcode 0x9090 So use ".align 4" which insert a "nop_s" instruction instead. Cc: stable@vger.kernel.org Acked-by: Vineet Gupta Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 204c7eceb76f348b89ccbf20fa3ba9a703ffada5 Author: Vineet Gupta Date: Tue Mar 3 22:10:01 2020 -0800 ARC: show_regs: reduce lines of output Before ------ | CPU: 1 PID: 29061 Comm: tst-dynarray-at Not tainted 5.6.0-rc1-00002-g941fcc018ca6-dirty #12 | | [ECR ]: 0x00090000 => | [EFA ]: 0x00000000 | [ERET ]: 0x2004aa6c | @off 0x2aa6c in [/lib/libc-2.31.9000.so] VMA: 0x20020000 to 0x20122000 | [STAT32]: 0x80080a82 [IE U ] | BTA: 0x2004aa18 SP: 0x5ffff8a8 FP: 0x5ffff8fc | LPS: 0x2008788e LPE: 0x20087896 LPC: 0x00000000 | r00: 0x00000000 r01: 0x5ffff8a8 r02: 0x00000000 | r03: 0x00000008 r04: 0xffffffff r05: 0x00000000 | r06: 0x00000000 r07: 0x00000000 r08: 0x00000087 | r09: 0x00000000 r10: 0x2010691c r11: 0x00000020 | r12: 0x2003b214 r13: 0x5ffff8a8 r14: 0x20126e68 | r15: 0x2001f26c r16: 0x2012a000 r17: 0x00000001 | r18: 0x5ffff8fc r19: 0x00000000 r20: 0x5ffff948 | r21: 0x00000001 r22: 0xffffffff r23: 0x5fffff8c | r24: 0x4008c2a8 r25: 0x2001f6e0 After ----- | CPU: 1 PID: 29061 Comm: tst-dynarray-at Not tainted 5.6.0-rc1-00002-g941fcc018ca6-dirty #12 | @off 0x2aa6c in [/lib/libc-2.31.9000.so] VMA: 0x20020000 to 0x20122000 | ECR: 0x00090000 EFA: 0x00000000 ERET: 0x2004aa6c | STAT32: 0x80080a82 [IE U ] BTA: 0x2004aa18 | BLK: 0x2003b214 SP: 0x5ffff8a8 FP: 0x5ffff8fc | LPS: 0x2008788e LPE: 0x20087896 LPC: 0x00000000 | r00: 0x00000000 r01: 0x5ffff8a8 r02: 0x00000000 | r03: 0x00000008 r04: 0xffffffff r05: 0x00000000 | r06: 0x00000000 r07: 0x00000000 r08: 0x00000087 | r09: 0x00000000 r10: 0x2010691c r11: 0x00000020 | r12: 0x2003b214 r13: 0x5ffff8a8 r14: 0x20126e68 | r15: 0x2001f26c r16: 0x2012a000 r17: 0x00000001 | r18: 0x5ffff8fc r19: 0x00000000 r20: 0x5ffff948 | r21: 0x00000001 r22: 0xffffffff r23: 0x5fffff8c | r24: 0x4008c2a8 r25: 0x2001f6e0 BTA: 0x2004aa18 Signed-off-by: Vineet Gupta commit addcb1d0ee31aa1472a7afd31a63162423af9c93 Merge: 36feb996308e 10dab84caf40 Author: Linus Torvalds Date: Wed Mar 11 10:00:41 2020 -0700 Merge tag 'for-linus-2020-03-10' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull thread fix from Christian Brauner: "This contains a single fix for a regression which was introduced when we introduced the ability to select a specific pid at process creation time. When this feature is requested, the error value will be set to -EPERM after exiting the pid allocation loop. This caused EPERM to be returned when e.g. the init process/child subreaper of the pid namespace has already died where we used to return ENOMEM before. The first patch here simply fixes the regression by unconditionally setting the return value back to ENOMEM again once we've successfully allocated the requested pid number. This should be easy to backport to v5.5. The second patch adds a comment explaining that we must keep returning ENOMEM since we've been doing it for a long time and have explicitly documented this behavior for userspace. This seemed worthwhile because we now have at least two separate example where people tried to change the return value to something other than ENOMEM (The first version of the regression fix did that too and the commit message links to an earlier patch that tried to do the same.). I have a simple regression test to make sure we catch this regression in the future but since that introduces a whole new selftest subdir and test files I'll keep this for v5.7" * tag 'for-linus-2020-03-10' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: pid: make ENOMEM return value more obvious pid: Fix error return value in some cases commit 36feb996308ec3392495e3341bab2570b11cb1bd Merge: c7f26a0ce61e d9815bff6b37 Author: Linus Torvalds Date: Wed Mar 11 09:54:59 2020 -0700 Merge tag 'trace-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull ftrace fix from Steven Rostedt: "Have ftrace lookup_rec() return a consistent record otherwise it can break live patching" * tag 'trace-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: ftrace: Return the first found result in lookup_rec() commit c7f26a0ce61eb51a4849bdf3268bedd251b6dbc6 Merge: a6ff4631a619 f7d5f5655ef7 Author: Linus Torvalds Date: Wed Mar 11 09:49:47 2020 -0700 Merge tag 'mips_fixes_5.6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: "A few MIPS fixes: - DT fixes for CI20 - Fix command line handling - Correct patchwork URL" * tag 'mips_fixes_5.6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MAINTAINERS: Correct MIPS patchwork URL MIPS: DTS: CI20: fix interrupt for pcf8563 RTC MIPS: DTS: CI20: fix PMU definitions for ACT8600 MIPS: Fix CONFIG_MIPS_CMDLINE_DTB_EXTEND handling commit a6ff4631a61928061c166d3919b9f6e397851125 Merge: e3a36eb6dfae 1cada2f30766 Author: Linus Torvalds Date: Wed Mar 11 09:45:38 2020 -0700 Merge tag 'pinctrl-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some pin control fixes for the v5.6 series. It comes down to memory leaks in the core and driver fixes. Some should have been sent earlier but they kept piling up and the world is just so full of distractions these days. - Fix some inverted pins in the Meson GLX driver. - Align the i.MX SC message structs causing warnings from KASan. - Balance the kref in pinctrl hogs so they are actually free:d when removing a pin control module. We haven't seen it before as people don't use modules for pin control that much, I think. - Add a missing call to pinctrl_unregister_mappings() another memory leak when using modules. - Fix the fwspec parsing in the Qualcomm driver. - Fix a syntax error in the Falcon driver. - Assign .irq_eoi conditionally in the Qualcomm driver, fixing a bug affecting elder Qualcomm platforms" * tag 'pinctrl-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: Assign irq_eoi conditionally pinctrl: falcon: fix syntax error pinctrl: qcom: ssbi-gpio: Fix fwspec parsing bug pinctrl: madera: Add missing call to pinctrl_unregister_mappings pinctrl: core: Remove extra kref_get which blocks hogs being freed pinctrl: imx: scu: Align imx sc msg structs to 4 pinctrl: meson-gxl: fix GPIOX sdio pins commit e3a36eb6dfaeea8175c05d5915dcf0b939be6dab Author: Christoph Hellwig Date: Wed Mar 11 17:07:10 2020 +0100 driver code: clarify and fix platform device DMA mask allocation This does three inter-related things to clarify the usage of the platform device dma_mask field. In the process, fix the bug introduced by cdfee5623290 ("driver core: initialize a default DMA mask for platform device") that caused Artem Tashkinov's laptop to not boot with newer Fedora kernels. This does: - First off, rename the field to "platform_dma_mask" to make it greppable. We have way too many different random fields called "dma_mask" in various data structures, where some of them are actual masks, and some of them are just pointers to the mask. And the structures all have pointers to each other, or embed each other inside themselves, and "pdev" sometimes means "platform device" and sometimes it means "PCI device". So to make it clear in the code when you actually use this new field, give it a unique name (it really should be something even more unique like "platform_device_dma_mask", since it's per platform device, not per platform, but that gets old really fast, and this is unique enough in context). To further clarify when the field gets used, initialize it when we actually start using it with the default value. - Then, use this field instead of the random one-off allocation in platform_device_register_full() that is now unnecessary since we now already have a perfectly fine allocation for it in the platform device structure. - The above then allows us to fix the actual bug, where the error path of platform_device_register_full() would unconditionally free the platform device DMA allocation with 'kfree()'. That kfree() was dont regardless of whether the allocation had been done earlier with the (now removed) kmalloc, or whether setup_pdev_dma_masks() had already been used and the dma_mask pointer pointed to the mask that was part of the platform device. It seems most people never triggered the error path, or only triggered it from a call chain that set an explicit pdevinfo->dma_mask value (and thus caused the unnecessary allocation that was "cleaned up" in the error path) before calling platform_device_register_full(). Robin Murphy points out that in Artem's case the wdat_wdt driver failed in platform_device_add(), and that was the one that had called platform_device_register_full() with pdevinfo.dma_mask = 0, and would have caused that kfree() of pdev.dma_mask corrupting the heap. A later unrelated kmalloc() then oopsed due to the heap corruption. Fixes: cdfee5623290 ("driver core: initialize a default DMA mask for platform device") Reported-bisected-and-tested-by: Artem S. Tashkinov Reviewed-by: Robin Murphy Cc: Greg Kroah-Hartman Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit 00cef5e404a6c6e72cbec1fd7a41b01890b8d340 Author: Corentin Labbe Date: Wed Nov 20 16:28:32 2019 +0100 ARM: dts: sun8i: a33: add the new SS compatible Add the new A33 SS compatible to the crypto node. Signed-off-by: Corentin Labbe Signed-off-by: Chen-Yu Tsai commit d2f8bfa4bff5028bc40ed56b4497c32e05b0178f Author: Ulf Hansson Date: Tue Mar 10 15:50:11 2020 +0100 mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY It has turned out that the sdhci-tegra controller requires the R1B response, for commands that has this response associated with them. So, converting from an R1B to an R1 response for a CMD6 for example, leads to problems with the HW busy detection support. Fix this by informing the mmc core about the requirement, via setting the host cap, MMC_CAP_NEED_RSP_BUSY. Reported-by: Bitan Biswas Reported-by: Peter Geis Suggested-by: Sowjanya Komatineni Cc: Tested-by: Sowjanya Komatineni Tested-By: Peter Geis Signed-off-by: Ulf Hansson commit f81547ba7a98d24fe566d102b4edefe30e0c4f2d Author: Corentin Labbe Date: Wed Nov 20 16:28:31 2019 +0100 dt-bindings: crypto: add new compatible for A33 SS The A33 SS has a difference with all other SS, it give SHA1 digest directly in BE. This difference need to be handlded by the driver and so need a new compatible. Signed-off-by: Corentin Labbe Acked-by: Rob Herring Signed-off-by: Chen-Yu Tsai commit 055e04830d4544c57f2a5192a26c9e25915c29c0 Author: Ulf Hansson Date: Tue Mar 10 15:05:02 2020 +0100 mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY It has turned out that the sdhci-omap controller requires the R1B response, for commands that has this response associated with them. So, converting from an R1B to an R1 response for a CMD6 for example, leads to problems with the HW busy detection support. Fix this by informing the mmc core about the requirement, via setting the host cap, MMC_CAP_NEED_RSP_BUSY. Reported-by: Naresh Kamboju Reported-by: Anders Roxell Reported-by: Faiz Abbas Cc: Tested-by: Anders Roxell Tested-by: Faiz Abbas Signed-off-by: Ulf Hansson commit 43cc64e5221cc6741252b64bc4531dd1eefb733d Author: Ulf Hansson Date: Tue Mar 10 14:43:00 2020 +0100 mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard The busy timeout that is computed for each erase/trim/discard operation, can become quite long and may thus exceed the host->max_busy_timeout. If that becomes the case, mmc_do_erase() converts from using an R1B response to an R1 response, as to prevent the host from doing HW busy detection. However, it has turned out that some hosts requires an R1B response no matter what, so let's respect that via checking MMC_CAP_NEED_RSP_BUSY. Note that, if the R1B gets enforced, the host becomes fully responsible of managing the needed busy timeout, in one way or the other. Suggested-by: Sowjanya Komatineni Cc: Tested-by: Anders Roxell Tested-by: Sowjanya Komatineni Tested-by: Faiz Abbas Tested-By: Peter Geis Signed-off-by: Ulf Hansson commit 1292e3efb149ee21d8d33d725eeed4e6b1ade963 Author: Ulf Hansson Date: Tue Mar 10 12:49:43 2020 +0100 mmc: core: Allow host controllers to require R1B for CMD6 It has turned out that some host controllers can't use R1B for CMD6 and other commands that have R1B associated with them. Therefore invent a new host cap, MMC_CAP_NEED_RSP_BUSY to let them specify this. In __mmc_switch(), let's check the flag and use it to prevent R1B responses from being converted into R1. Note that, this also means that the host are on its own, when it comes to manage the busy timeout. Suggested-by: Sowjanya Komatineni Cc: Tested-by: Anders Roxell Tested-by: Sowjanya Komatineni Tested-by: Faiz Abbas Tested-By: Peter Geis Signed-off-by: Ulf Hansson commit 0e91506ba00730f088961a8d39f8693b0f8e3fea Author: Hans de Goede Date: Mon Mar 2 12:12:24 2020 +0100 gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model Commit aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") was added to deal with spurious wakeups on one specific model of the HP x2 10 series. In the mean time I have learned that there are at least 3 different HP x2 10 models: Bay Trail SoC + AXP288 PMIC Cherry Trail SoC + AXP288 PMIC Cherry Trail SoC + TI PMIC And the original quirk is only correct for (and only matches the) Cherry Trail SoC + TI PMIC model. The Bay Trail SoC + AXP288 PMIC model has different DMI strings, has the external EC interrupt on a different GPIO pin and only needs to ignore wakeups on the EC interrupt, the INT0002 device works fine on this model. This commit adds an extra DMI based quirk for the HP x2 10 BYT + AXP288 model, ignoring wakeups for ACPI GPIO events on the EC interrupt pin on this model. This fixes spurious wakeups from suspend on this model. Fixes: aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200302111225.6641-3-hdegoede@redhat.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 2ccb21f5516afef5e251184eeefbf36db90206d7 Author: Hans de Goede Date: Mon Mar 2 12:12:23 2020 +0100 gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option Commit aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") was added to deal with spurious wakeups on one specific model of the HP x2 10 series. The approach taken there was to add a bool controlling wakeup support for all ACPI GPIO events. This was sufficient for the specific HP x2 10 model the commit was trying to fix, but in the mean time other models have turned up which need a similar workaround to avoid spurious wakeups from suspend, but only for one of the pins on which the ACPI tables request ACPI GPIO events. Since the honor_wakeup option was added to be able to ignore wake events, the name was perhaps not the best, this commit renames it to ignore_wake and changes it to a string with the following format: gpiolib_acpi.ignore_wake=controller@pin[,controller@pin[,...]] This allows working around spurious wakeup issues on a per pin basis. This commit also reworks the existing quirk for the HP x2 10 so that it functions as before. Note: -This removes the honor_wakeup parameter. This has only been upstream for a short time and to the best of my knowledge there are no users using this module parameter. -The controller@pin[,controller@pin[,...]] syntax is based on an existing kernel module parameter using the same controller@pin format. That version uses ';' as separator, but in practice that is problematic because grub2 cannot handle this without taking special care to escape the ';', so here we are using a ',' as separator instead which does not have this issue. Fixes: aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200302111225.6641-2-hdegoede@redhat.com Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit efaa87fa0947d525cf7c075316adde4e3ac7720b Author: Hans de Goede Date: Mon Mar 2 12:12:22 2020 +0100 gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk Commit aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") added a quirk for some models of the HP x2 10 series. There are 2 issues with the comment describing the quirk: 1) The comment claims the DMI quirk applies to all Cherry Trail based HP x2 10 models. In the mean time I have learned that there are at least 3 models of the HP x2 10 models: Bay Trail SoC + AXP288 PMIC Cherry Trail SoC + AXP288 PMIC Cherry Trail SoC + TI PMIC And this quirk's DMI matches only match the Cherry Trail SoC + TI PMIC SoC, which is good because we want a slightly different quirk for the others. This commit updates the comment to make it clear that the quirk is only for the Cherry Trail SoC + TI PMIC models. 2) The comment says that it is ok to disable wakeup on all ACPI GPIO event handlers, because there is only the one for the embedded-controller events. This is not true, there also is a handler for the special INT0002 device which is related to USB wakeups. We need to also disable wakeups on that one because the device turns of the USB-keyboard built into the dock when closing the lid. The XHCI controller takes a while to notice this, so it only notices it when already suspended, causing a spurious wakeup because of this. So disabling wakeup on all handlers is the right thing to do, but not because there only is the one handler for the EC events. This commit updates the comment to correctly reflect this. Fixes: aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200302111225.6641-1-hdegoede@redhat.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 8959b304c7062889b1276092cc8590dc1ba98f65 Author: Linus Walleij Date: Fri Mar 6 14:23:26 2020 +0100 gpiolib: Fix irq_disable() semantics The implementation if .irq_disable() which kicks in between the gpiolib and the driver is not properly mimicking the expected semantics of the irqchip core: the irqchip will call .irq_disable() if that exists, else it will call mask_irq() which first checks if .irq_mask() is defined before calling it. Since we are calling it unconditionally, we get this bug from drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c, as it only defines .irq_mask_ack and not .irq_mask: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = (ptrval) (...) PC is at 0x0 LR is at gpiochip_irq_disable+0x20/0x30 Fix this by only calling .irq_mask() if it exists. Cc: Brian Masney Cc: Hans Verkuil Cc: stable@vger.kernel.org Reviewed-by: Bartosz Golaszewski Fixes: 461c1a7d4733 ("gpiolib: override irq_enable/disable") Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20200306132326.1329640-1-linus.walleij@linaro.org commit 985e537a4082b4635754a57f4f95430790afee6a Author: Tom Lendacky Date: Tue Mar 10 18:35:57 2020 +0100 x86/ioremap: Map EFI runtime services data as encrypted for SEV The dmidecode program fails to properly decode the SMBIOS data supplied by OVMF/UEFI when running in an SEV guest. The SMBIOS area, under SEV, is encrypted and resides in reserved memory that is marked as EFI runtime services data. As a result, when memremap() is attempted for the SMBIOS data, it can't be mapped as regular RAM (through try_ram_remap()) and, since the address isn't part of the iomem resources list, it isn't mapped encrypted through the fallback ioremap(). Add a new __ioremap_check_other() to deal with memory types like EFI_RUNTIME_SERVICES_DATA which are not covered by the resource ranges. This allows any runtime services data which has been created encrypted, to be mapped encrypted too. [ bp: Move functionality to a separate function. ] Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Reviewed-by: Joerg Roedel Tested-by: Joerg Roedel Cc: # 5.3 Link: https://lkml.kernel.org/r/2d9e16eb5b53dc82665c95c6764b7407719df7a0.1582645327.git.thomas.lendacky@amd.com commit d9b553b02e691185f8145637c46f9564395936e2 Author: Chen-Yu Tsai Date: Wed Mar 11 01:47:09 2020 +0800 ARM: dts: sun8i: r40: Move SPI device nodes based on address order When the SPI device nodes were added, they were added in the wrong location in the device tree file. The device nodes should be sorted by register address. Move the devices node to their correct positions within the file. Fixes: 554581b79139 ("ARM: dts: sun8i: R40: Add SPI controllers nodes and pinmuxes") Acked-by: Maxime Ripard Reviewed-by: Andre Przywara Signed-off-by: Chen-Yu Tsai commit abe076fb0dfd34e4b8b397946d5e1dab2d7fe953 Author: Chen-Yu Tsai Date: Wed Mar 11 01:47:08 2020 +0800 ARM: dts: sun8i: r40: Fix register base address for SPI2 and SPI3 When the SPI device nodes were added, SPI2 and SPI3 had incorrect register base addresses. Fix the base address for both of them. Fixes: 554581b79139 ("ARM: dts: sun8i: R40: Add SPI controllers nodes and pinmuxes") Reported-by: JuanEsf Acked-by: Maxime Ripard Reviewed-by: Andre Przywara Signed-off-by: Chen-Yu Tsai commit fe3a04824f75786e39ed74e82fb6cb2534c95fe4 Author: Chen-Yu Tsai Date: Wed Mar 11 01:47:07 2020 +0800 ARM: dts: sun8i: r40: Move AHCI device node based on address order When the AHCI device node was added, it was added in the wrong location in the device tree file. The device nodes should be sorted by register address. Move the device node to before EHCI1, where it belongs. Fixes: 41c64d3318aa ("ARM: dts: sun8i: r40: add sata node") Acked-by: Maxime Ripard Reviewed-by: Andre Przywara Signed-off-by: Chen-Yu Tsai commit d9815bff6b379ff46981bea9dfeb146081eab314 Author: Artem Savkov Date: Fri Mar 6 18:43:17 2020 +0100 ftrace: Return the first found result in lookup_rec() It appears that ip ranges can overlap so. In that case lookup_rec() returns whatever results it got last even if it found nothing in last searched page. This breaks an obscure livepatch late module patching usecase: - load livepatch - load the patched module - unload livepatch - try to load livepatch again To fix this return from lookup_rec() as soon as it found the record containing searched-for ip. This used to be this way prior lookup_rec() introduction. Link: http://lkml.kernel.org/r/20200306174317.21699-1-asavkov@redhat.com Cc: stable@vger.kernel.org Fixes: 7e16f581a817 ("ftrace: Separate out functionality from ftrace_location_range()") Signed-off-by: Artem Savkov Signed-off-by: Steven Rostedt (VMware) commit 90db6d772f749e38171d04619a5e3cd8804a6d02 Author: John Fastabend Date: Tue Mar 10 09:41:48 2020 -0700 bpf, sockmap: Remove bucket->lock from sock_{hash|map}_free The bucket->lock is not needed in the sock_hash_free and sock_map_free calls, in fact it is causing a splat due to being inside rcu block. | BUG: sleeping function called from invalid context at net/core/sock.c:2935 | in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 62, name: kworker/0:1 | 3 locks held by kworker/0:1/62: | #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0 | #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0 | #2: ffff8881381f6df8 (&stab->lock){+...}, at: sock_map_free+0x26/0x180 | CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04008-g7b083332376e #454 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 | Workqueue: events bpf_map_free_deferred | Call Trace: | dump_stack+0x71/0xa0 | ___might_sleep.cold+0xa6/0xb6 | lock_sock_nested+0x28/0x90 | sock_map_free+0x5f/0x180 | bpf_map_free_deferred+0x58/0x80 | process_one_work+0x260/0x5e0 | worker_thread+0x4d/0x3e0 | kthread+0x108/0x140 | ? process_one_work+0x5e0/0x5e0 | ? kthread_park+0x90/0x90 | ret_from_fork+0x3a/0x50 The reason we have stab->lock and bucket->locks in sockmap code is to handle checking EEXIST in update/delete cases. We need to be careful during an update operation that we check for EEXIST and we need to ensure that the psock object is not in some partial state of removal/insertion while we do this. So both map_update_common and sock_map_delete need to guard from being run together potentially deleting an entry we are checking, etc. But by the time we get to the tear-down code in sock_{ma[|hash}_free we have already disconnected the map and we just did synchronize_rcu() in the line above so no updates/deletes should be in flight. Because of this we can drop the bucket locks from the map free'ing code, noting no update/deletes can be in-flight. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: Jakub Sitnicki Suggested-by: Jakub Sitnicki Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/158385850787.30597.8346421465837046618.stgit@john-Precision-5820-Tower commit 62a1a58039595698f644f560f00105bb4d5f5c7f Author: Takashi Iwai Date: Wed Mar 11 08:38:24 2020 +0100 HID: hid-sensor-custom: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai Signed-off-by: Jiri Kosina commit 42f502dfe132edb8d7a47e6c0641ed82d718ad0b Author: Takashi Iwai Date: Wed Mar 11 08:37:19 2020 +0100 HID: hid-picolcd_fb: Use scnprintf() for avoiding potential buffer overflow Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai Signed-off-by: Jiri Kosina commit 195967c088aa856fc7a2698230cddef3b8d7cda9 Author: Lukas Bulwahn Date: Sat Mar 7 21:57:37 2020 +0100 MAINTAINERS: rectify the INTEL IADX DRIVER entry Commit bfe1d56091c1 ("dmaengine: idxd: Init and probe for Intel data accelerators") added the INTEL IADX DRIVER entry in MAINTAINERS, which mentions include/linux/idxd.h as file entry. However, this header file was not added in this commit, nor in any later one. Hence, since then, ./scripts/get_maintainer.pl --self-test complains: warning: no file matches F: include/linux/idxd.h Drop the file entry to the non-existing file in INTEL IADX DRIVER now. Signed-off-by: Lukas Bulwahn Acked-by: Dave Jiang Link: https://lore.kernel.org/r/20200307205737.5829-1-lukas.bulwahn@gmail.com Signed-off-by: Vinod Koul commit f91da3bd21721c05cc7054156fa993edbb16777a Author: Vinod Koul Date: Fri Mar 6 19:20:18 2020 +0530 dmaengine: move .device_release missing log warning to debug level Dmaengine core warns the drivers registering for missing .device_release implementation. The warning is accurate for dmaengine controllers which hotplug but not for rest. So reduce this to a debug log. Link: https://lore.kernel.org/r/20200306135018.2286959-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 636b45b8efa91db05553840b6c0120d6fa6b94fa Author: Marco Felsch Date: Thu Feb 27 12:02:46 2020 +0100 ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage The current set minimum voltage of 730000µV seems to be wrong. I don't know the document which specifies that but the imx6qdl datasheets says that the minimum voltage should be 0.925V for VDD_ARM (LDO bypassed, lowest opp) and 1.15V for VDD_SOC (LDO bypassed, lowest opp). Fixes: ddec5d1c0047 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM") Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit ba32679cac50c38fdf488296f96b1f3175532b8e Author: Nicolas Cavallari Date: Thu Mar 5 15:04:09 2020 +0100 mac80211: Do not send mesh HWMP PREQ if HWMP is disabled When trying to transmit to an unknown destination, the mesh code would unconditionally transmit a HWMP PREQ even if HWMP is not the current path selection algorithm. Signed-off-by: Nicolas Cavallari Link: https://lore.kernel.org/r/20200305140409.12204-1-cavallar@lri.fr Signed-off-by: Johannes Berg commit 5cde05c61cbe13cbb3fa66d52b9ae84f7975e5e6 Author: Jakub Kicinski Date: Mon Mar 2 21:10:58 2020 -0800 nl80211: add missing attribute validation for channel switch Add missing attribute validation for NL80211_ATTR_OPER_CLASS to the netlink policy. Fixes: 1057d35ede5d ("cfg80211: introduce TDLS channel switch commands") Signed-off-by: Jakub Kicinski Link: https://lore.kernel.org/r/20200303051058.4089398-4-kuba@kernel.org Signed-off-by: Johannes Berg commit 056e9375e1f3c4bf2fd49b70258c7daf788ecd9d Author: Jakub Kicinski Date: Mon Mar 2 21:10:57 2020 -0800 nl80211: add missing attribute validation for beacon report scanning Add missing attribute validation for beacon report scanning to the netlink policy. Fixes: 1d76250bd34a ("nl80211: support beacon report scanning") Signed-off-by: Jakub Kicinski Link: https://lore.kernel.org/r/20200303051058.4089398-3-kuba@kernel.org Signed-off-by: Johannes Berg commit 0e1a1d853ecedc99da9d27f9f5c376935547a0e2 Author: Jakub Kicinski Date: Mon Mar 2 21:10:56 2020 -0800 nl80211: add missing attribute validation for critical protocol indication Add missing attribute validation for critical protocol fields to the netlink policy. Fixes: 5de17984898c ("cfg80211: introduce critical protocol indication from user-space") Signed-off-by: Jakub Kicinski Link: https://lore.kernel.org/r/20200303051058.4089398-2-kuba@kernel.org Signed-off-by: Johannes Berg commit e93fc7b4544a5475cfdbc22f87e89f9829bf801c Author: Christian Borntraeger Date: Tue Mar 3 03:10:57 2020 -0500 KVM: s390: Also reset registers in sync regs for initial cpu reset When we do the initial CPU reset we must not only clear the registers in the internal data structures but also in kvm_run sync_regs. For modern userspace sync_regs is the only place that it looks at. Fixes: 7de3f1423ff9 ("KVM: s390: Add new reset vcpu API") Acked-by: David Hildenbrand Signed-off-by: Christian Borntraeger commit ac42c12dd752d315a7027dcb50421dbbd1af53bd Author: Jérôme Pouiller Date: Tue Mar 10 11:13:56 2020 +0100 staging: wfx: fix RCU usage between hif_join() and ieee80211_bss_get_ie() Access to result of ieee80211_bss_get_ie() is protected by RCU. In other hand, function hif_join() can sleep and cannot be called with RCU locked. Provide a copy of "ssidie" to hif_join() to solve this behavior. Fixes: 9ced9b593741 ("staging: wfx: simplify hif_join()") Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20200310101356.182818-6-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 046cc2effd1312a23b9e3d8363be7c68f6e91f3c Author: Jérôme Pouiller Date: Tue Mar 10 11:13:55 2020 +0100 staging: wfx: fix RCU usage in wfx_join_finalize() Access to sta->ht_cap is protected by RCU. However, hif_set_association_mode() may sleep, so it can't be called in RCU. This patch fix this behavior by handling sta and its RCU directly from function hif_set_association_mode(). Signed-off-by: Jérôme Pouiller Fixes: d00149011066 ("staging: wfx: fix RCU usage") Link: https://lore.kernel.org/r/20200310101356.182818-5-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 4bbc6a3e7ad0d0f31ae3ba9858dbca45eb7a848e Author: Jérôme Pouiller Date: Tue Mar 10 11:13:54 2020 +0100 staging: wfx: make warning about pending frame less scary Removing station while some traffic is in progress may happen. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20200310101356.182818-4-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit c918c27ac6f0252aaa2374cdaa0426df4d5df9df Author: Jérôme Pouiller Date: Tue Mar 10 11:13:53 2020 +0100 staging: wfx: fix lines ending with a comma instead of a semicolon Obviously introduced by mistake. Fixes: 09779276f1ba ("staging: wfx: simplify hif_start() usage") Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20200310101356.182818-3-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit bab0a0b03442a62fe3abefcb2169e0b9ff95990c Author: Jérôme Pouiller Date: Tue Mar 10 11:13:52 2020 +0100 staging: wfx: fix warning about freeing in-use mutex during device unregister After hif_shutdown(), communication with the chip is no more possible. It the only request that never reply. Therefore, hif_cmd.lock is never unlocked. hif_shutdown() unlock itself hif_cmd.lock to avoid a potential warning during disposal of device. hif_cmd.key_renew_lock should also been unlocked for the same reason. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20200310101356.182818-2-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 9d32c0cde4e2d1343dfb88a67b2ec6397705b32b Author: Samuel Thibault Date: Fri Mar 6 01:30:47 2020 +0100 staging/speakup: fix get_word non-space look-ahead get_char was erroneously given the address of the pointer to the text instead of the address of the text, thus leading to random crashes when the user requests speaking a word while the current position is on a space character and say_word_ctl is not enabled. Reported-on: https://github.com/bytefire/speakup/issues/1 Reported-by: Kirk Reiser Reported-by: Janina Sajka Reported-by: Alexandr Epaneshnikov Reported-by: Gregory Nowak Reported-by: deedra waters Signed-off-by: Samuel Thibault Tested-by: Alexandr Epaneshnikov Tested-by: Gregory Nowak Tested-by: Michael Taboada Cc: stable Link: https://lore.kernel.org/r/20200306003047.thijtmqrnayd3dmw@function Signed-off-by: Greg Kroah-Hartman commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757 Author: Kai-Heng Feng Date: Wed Mar 11 14:13:28 2020 +0800 ALSA: hda/realtek: Fix pop noise on ALC225 Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") makes the ALC225 have pop noise on S3 resume and cold boot. So partially revert this commit for ALC225 to fix the regression. Fixes: 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") BugLink: https://bugs.launchpad.net/bugs/1866357 Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20200311061328.17614-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai commit 394b61711f3ce33f75bf70a3e22938464a13b3ee Author: Wen Xiong Date: Fri Mar 6 09:57:28 2020 -0600 scsi: ipr: Fix softlockup when rescanning devices in petitboot When trying to rescan disks in petitboot shell, we hit the following softlockup stacktrace: Kernel panic - not syncing: System is deadlocked on memory [ 241.223394] CPU: 32 PID: 693 Comm: sh Not tainted 5.4.16-openpower1 #1 [ 241.223406] Call Trace: [ 241.223415] [c0000003f07c3180] [c000000000493fc4] dump_stack+0xa4/0xd8 (unreliable) [ 241.223432] [c0000003f07c31c0] [c00000000007d4ac] panic+0x148/0x3cc [ 241.223446] [c0000003f07c3260] [c000000000114b10] out_of_memory+0x468/0x4c4 [ 241.223461] [c0000003f07c3300] [c0000000001472b0] __alloc_pages_slowpath+0x594/0x6d8 [ 241.223476] [c0000003f07c3420] [c00000000014757c] __alloc_pages_nodemask+0x188/0x1a4 [ 241.223492] [c0000003f07c34a0] [c000000000153e10] alloc_pages_current+0xcc/0xd8 [ 241.223508] [c0000003f07c34e0] [c0000000001577ac] alloc_slab_page+0x30/0x98 [ 241.223524] [c0000003f07c3520] [c0000000001597fc] new_slab+0x138/0x40c [ 241.223538] [c0000003f07c35f0] [c00000000015b204] ___slab_alloc+0x1e4/0x404 [ 241.223552] [c0000003f07c36c0] [c00000000015b450] __slab_alloc+0x2c/0x48 [ 241.223566] [c0000003f07c36f0] [c00000000015b754] kmem_cache_alloc_node+0x9c/0x1b4 [ 241.223582] [c0000003f07c3760] [c000000000218c48] blk_alloc_queue_node+0x34/0x270 [ 241.223599] [c0000003f07c37b0] [c000000000226574] blk_mq_init_queue+0x2c/0x78 [ 241.223615] [c0000003f07c37e0] [c0000000002ff710] scsi_mq_alloc_queue+0x28/0x70 [ 241.223631] [c0000003f07c3810] [c0000000003005b8] scsi_alloc_sdev+0x184/0x264 [ 241.223647] [c0000003f07c38a0] [c000000000300ba0] scsi_probe_and_add_lun+0x288/0xa3c [ 241.223663] [c0000003f07c3a00] [c000000000301768] __scsi_scan_target+0xcc/0x478 [ 241.223679] [c0000003f07c3b20] [c000000000301c64] scsi_scan_channel.part.9+0x74/0x7c [ 241.223696] [c0000003f07c3b70] [c000000000301df4] scsi_scan_host_selected+0xe0/0x158 [ 241.223712] [c0000003f07c3bd0] [c000000000303f04] store_scan+0x104/0x114 [ 241.223727] [c0000003f07c3cb0] [c0000000002d5ac4] dev_attr_store+0x30/0x4c [ 241.223741] [c0000003f07c3cd0] [c0000000001dbc34] sysfs_kf_write+0x64/0x78 [ 241.223756] [c0000003f07c3cf0] [c0000000001da858] kernfs_fop_write+0x170/0x1b8 [ 241.223773] [c0000003f07c3d40] [c0000000001621fc] __vfs_write+0x34/0x60 [ 241.223787] [c0000003f07c3d60] [c000000000163c2c] vfs_write+0xa8/0xcc [ 241.223802] [c0000003f07c3db0] [c000000000163df4] ksys_write+0x70/0xbc [ 241.223816] [c0000003f07c3e20] [c00000000000b40c] system_call+0x5c/0x68 As a part of the scan process Linux will allocate and configure a scsi_device for each target to be scanned. If the device is not present, then the scsi_device is torn down. As a part of scsi_device teardown a workqueue item will be scheduled and the lockups we see are because there are 250k workqueue items to be processed. Accoding to the specification of SIS-64 sas controller, max_channel should be decreased on SIS-64 adapters to 4. The patch fixes softlockup issue. Thanks for Oliver Halloran's help with debugging and explanation! Link: https://lore.kernel.org/r/1583510248-23672-1-git-send-email-wenxiong@linux.vnet.ibm.com Signed-off-by: Wen Xiong Signed-off-by: Martin K. Petersen commit 2165fdf4bc2d323ec73e5995510f163163ce0fa4 Merge: a2d8bf77a27c 0e635c2a8713 Author: David S. Miller Date: Tue Mar 10 16:07:49 2020 -0700 Merge branch 's390-qeth-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2020-03-10 This fixes three minor issues: 1) a setup parameter gets cleared unnecessarily when the HW config changes, 2) insufficient error handling when initially filling the RX ring, and 3) a rarely used worker that needs to be cancelled during tear down. ==================== Signed-off-by: David S. Miller commit 0e635c2a8713e3e013b4adcb7cb7e28a048b7c42 Author: Julian Wiedmann Date: Tue Mar 10 18:38:03 2020 +0100 s390/qeth: cancel RX reclaim work earlier When qeth's napi poll code fails to refill an entirely empty RX ring, it kicks off buffer_reclaim_work to try again later. Make sure that this worker is cancelled when setting the qeth device offline. Otherwise a RX refill action can unexpectedly end up running concurrently to bigger re-configurations (eg. resizing the buffer pool), without any locking. Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 17413852804d7e86e6f0576cca32c1541817800e Author: Julian Wiedmann Date: Tue Mar 10 18:38:02 2020 +0100 s390/qeth: handle error when backing RX buffer qeth_init_qdio_queues() fills the RX ring with an initial set of RX buffers. If qeth_init_input_buffer() fails to back one of the RX buffers with memory, we need to bail out and report the error. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 240c1948491b81cfe40f84ea040a8f2a4966f101 Author: Julian Wiedmann Date: Tue Mar 10 18:38:01 2020 +0100 s390/qeth: don't reset default_out_queue When an OSA device in prio-queue setup is reduced to 1 TX queue due to HW restrictions, we reset its the default_out_queue to 0. In the old code this was needed so that qeth_get_priority_queue() gets the queue selection right. But with proper multiqueue support we already reduced dev->real_num_tx_queues to 1, and so the stack puts all traffic on txq 0 without even calling .ndo_select_queue. Thus we can preserve the user's configuration, and apply it if the OSA device later re-gains support for multiple TX queues. Fixes: 73dc2daf110f ("s390/qeth: add TX multiqueue support for OSA devices") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit be7594a424b4de7473b3d726635c3bf6aa19a86e Author: Can Guo Date: Thu Mar 5 00:53:07 2020 -0800 scsi: ufs: Fix possible unclocked access to auto hibern8 timer register Before access auto hibner8 timer register, make sure power and clock are properly configured to avoid unclocked register access. Link: https://lore.kernel.org/r/1583398391-14273-1-git-send-email-cang@codeaurora.org Fixes: ba7af5ec5126 ("scsi: ufs: export ufshcd_auto_hibern8_update for vendor usage") Reviewed-by: Stanley Chu Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit a2d8bf77a27c81924498fe9cf0bf2ea8ef2d1220 Merge: 7d7195a026ba 09f4136c5d6b Author: David S. Miller Date: Tue Mar 10 15:59:32 2020 -0700 Merge branch 'MACSec-bugfixes-related-to-MAC-address-change' Igor Russkikh says: ==================== MACSec bugfixes related to MAC address change We found out that there's an issue in MACSec code when the MAC address is changed. Both s/w and offloaded implementations don't update SCI when the MAC address changes at the moment, but they should do so, because SCI contains MAC in its first 6 octets. ==================== Signed-off-by: David S. Miller commit 09f4136c5d6b4c5144a965bd086009863d58ff08 Author: Dmitry Bogdanov Date: Tue Mar 10 18:22:25 2020 +0300 net: macsec: invoke mdo_upd_secy callback when mac address changed Notify the offload engine about MAC address change to reconfigure it accordingly. Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure") Signed-off-by: Dmitry Bogdanov Signed-off-by: Mark Starovoytov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 6fc498bc82929ee23aa2f35a828c6178dfd3f823 Author: Dmitry Bogdanov Date: Tue Mar 10 18:22:24 2020 +0300 net: macsec: update SCI upon MAC address change. SCI should be updated, because it contains MAC in its first 6 octets. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Dmitry Bogdanov Signed-off-by: Mark Starovoytov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 7d7195a026bac47ac9943f11f84b7546276209dd Author: Juliet Kim Date: Tue Mar 10 09:23:58 2020 -0500 ibmvnic: Do not process device remove during device reset The ibmvnic driver does not check the device state when the device is removed. If the device is removed while a device reset is being processed, the remove may free structures needed by the reset, causing an oops. Fix this by checking the device state before processing device remove. Signed-off-by: Juliet Kim Signed-off-by: David S. Miller commit ece0d7bd74615773268475b6b64d6f1ebbd4b4c6 Author: Karsten Graul Date: Tue Mar 10 09:33:30 2020 +0100 net/smc: cancel event worker during device removal During IB device removal, cancel the event worker before the device structure is freed. Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client") Reported-by: syzbot+b297c6825752e7a07272@syzkaller.appspotmail.com Signed-off-by: Karsten Graul Reviewed-by: Ursula Braun Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 60380488e4e0b95e9e82aa68aa9705baa86de84c Author: Hangbin Liu Date: Tue Mar 10 15:27:37 2020 +0800 ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface Rafał found an issue that for non-Ethernet interface, if we down and up frequently, the memory will be consumed slowly. The reason is we add allnodes/allrouters addressed in multicast list in ipv6_add_dev(). When link down, we call ipv6_mc_down(), store all multicast addresses via mld_add_delrec(). But when link up, we don't call ipv6_mc_up() for non-Ethernet interface to remove the addresses. This makes idev->mc_tomb getting bigger and bigger. The call stack looks like: addrconf_notify(NETDEV_REGISTER) ipv6_add_dev ipv6_dev_mc_inc(ff01::1) ipv6_dev_mc_inc(ff02::1) ipv6_dev_mc_inc(ff02::2) addrconf_notify(NETDEV_UP) addrconf_dev_config /* Alas, we support only Ethernet autoconfiguration. */ return; addrconf_notify(NETDEV_DOWN) addrconf_ifdown ipv6_mc_down igmp6_group_dropped(ff02::2) mld_add_delrec(ff02::2) igmp6_group_dropped(ff02::1) igmp6_group_dropped(ff01::1) After investigating, I can't found a rule to disable multicast on non-Ethernet interface. In RFC2460, the link could be Ethernet, PPP, ATM, tunnels, etc. In IPv4, it doesn't check the dev type when calls ip_mc_up() in inetdev_event(). Even for IPv6, we don't check the dev type and call ipv6_add_dev(), ipv6_dev_mc_inc() after register device. So I think it's OK to fix this memory consumer by calling ipv6_mc_up() for non-Ethernet interface. v2: Also check IFF_MULTICAST flag to make sure the interface supports multicast Reported-by: Rafał Miłecki Tested-by: Rafał Miłecki Fixes: 74235a25c673 ("[IPV6] addrconf: Fix IPv6 on tuntap tunnels") Fixes: 1666d49e1d41 ("mld: do not remove mld souce list info when set link down") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit f35111a946548e3b34a55abbad3e9bacce6cb10f Merge: 2a48b3793157 11a4a8f73b3c Author: Linus Torvalds Date: Tue Mar 10 15:36:27 2020 -0700 Merge tag 'clang-format-for-linus-v5.6-rc6' of git://github.com/ojeda/linux Pull clang-format update from Miguel Ojeda: "Another update for the .clang-format macro list It has been a while since the last time I sent one!" * tag 'clang-format-for-linus-v5.6-rc6' of git://github.com/ojeda/linux: clang-format: Update with the latest for_each macro list commit d752a4986532cb6305dfd5290a614cde8072769d Author: Shakeel Butt Date: Mon Mar 9 22:16:06 2020 -0700 net: memcg: late association of sock to memcg If a TCP socket is allocated in IRQ context or cloned from unassociated (i.e. not associated to a memcg) in IRQ context then it will remain unassociated for its whole life. Almost half of the TCPs created on the system are created in IRQ context, so, memory used by such sockets will not be accounted by the memcg. This issue is more widespread in cgroup v1 where network memory accounting is opt-in but it can happen in cgroup v2 if the source socket for the cloning was created in root memcg. To fix the issue, just do the association of the sockets at the accept() time in the process context and then force charge the memory buffer already used and reserved by the socket. Signed-off-by: Shakeel Butt Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit e876ecc67db80dfdb8e237f71e5b43bb88ae549c Author: Shakeel Butt Date: Mon Mar 9 22:16:05 2020 -0700 cgroup: memcg: net: do not associate sock with unrelated cgroup We are testing network memory accounting in our setup and noticed inconsistent network memory usage and often unrelated cgroups network usage correlates with testing workload. On further inspection, it seems like mem_cgroup_sk_alloc() and cgroup_sk_alloc() are broken in irq context specially for cgroup v1. mem_cgroup_sk_alloc() and cgroup_sk_alloc() can be called in irq context and kind of assumes that this can only happen from sk_clone_lock() and the source sock object has already associated cgroup. However in cgroup v1, where network memory accounting is opt-in, the source sock can be unassociated with any cgroup and the new cloned sock can get associated with unrelated interrupted cgroup. Cgroup v2 can also suffer if the source sock object was created by process in the root cgroup or if sk_alloc() is called in irq context. The fix is to just do nothing in interrupt. WARNING: Please note that about half of the TCP sockets are allocated from the IRQ context, so, memory used by such sockets will not be accouted by the memcg. The stack trace of mem_cgroup_sk_alloc() from IRQ-context: CPU: 70 PID: 12720 Comm: ssh Tainted: 5.6.0-smp-DEV #1 Hardware name: ... Call Trace: dump_stack+0x57/0x75 mem_cgroup_sk_alloc+0xe9/0xf0 sk_clone_lock+0x2a7/0x420 inet_csk_clone_lock+0x1b/0x110 tcp_create_openreq_child+0x23/0x3b0 tcp_v6_syn_recv_sock+0x88/0x730 tcp_check_req+0x429/0x560 tcp_v6_rcv+0x72d/0xa40 ip6_protocol_deliver_rcu+0xc9/0x400 ip6_input+0x44/0xd0 ? ip6_protocol_deliver_rcu+0x400/0x400 ip6_rcv_finish+0x71/0x80 ipv6_rcv+0x5b/0xe0 ? ip6_sublist_rcv+0x2e0/0x2e0 process_backlog+0x108/0x1e0 net_rx_action+0x26b/0x460 __do_softirq+0x104/0x2a6 do_softirq_own_stack+0x2a/0x40 do_softirq.part.19+0x40/0x50 __local_bh_enable_ip+0x51/0x60 ip6_finish_output2+0x23d/0x520 ? ip6table_mangle_hook+0x55/0x160 __ip6_finish_output+0xa1/0x100 ip6_finish_output+0x30/0xd0 ip6_output+0x73/0x120 ? __ip6_finish_output+0x100/0x100 ip6_xmit+0x2e3/0x600 ? ipv6_anycast_cleanup+0x50/0x50 ? inet6_csk_route_socket+0x136/0x1e0 ? skb_free_head+0x1e/0x30 inet6_csk_xmit+0x95/0xf0 __tcp_transmit_skb+0x5b4/0xb20 __tcp_send_ack.part.60+0xa3/0x110 tcp_send_ack+0x1d/0x20 tcp_rcv_state_process+0xe64/0xe80 ? tcp_v6_connect+0x5d1/0x5f0 tcp_v6_do_rcv+0x1b1/0x3f0 ? tcp_v6_do_rcv+0x1b1/0x3f0 __release_sock+0x7f/0xd0 release_sock+0x30/0xa0 __inet_stream_connect+0x1c3/0x3b0 ? prepare_to_wait+0xb0/0xb0 inet_stream_connect+0x3b/0x60 __sys_connect+0x101/0x120 ? __sys_getsockopt+0x11b/0x140 __x64_sys_connect+0x1a/0x20 do_syscall_64+0x51/0x200 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The stack trace of mem_cgroup_sk_alloc() from IRQ-context: Fixes: 2d7580738345 ("mm: memcontrol: consolidate cgroup socket tracking") Fixes: d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets") Signed-off-by: Shakeel Butt Reviewed-by: Roman Gushchin Signed-off-by: David S. Miller commit 2a48b37931572802e980dc059e03ec29a33d2963 Merge: e94148454103 2f920c0f0e29 Author: Linus Torvalds Date: Tue Mar 10 15:32:57 2020 -0700 Merge tag 'auxdisplay-for-linus-v5.6-rc6' of git://github.com/ojeda/linux Pull auxdisplay updates from Miguel Ojeda: "A few minor auxdisplay improvements: - charlcd: replace zero-length array with flexible-array member (kernel-wide cleanup by Gustavo A. R. Silva) - img-ascii-lcd: convert to devm_platform_ioremap_resource (Yangtao Li) - Fix Kconfig indentation (Krzysztof Kozlowski) * tag 'auxdisplay-for-linus-v5.6-rc6' of git://github.com/ojeda/linux: auxdisplay: charlcd: replace zero-length array with flexible-array member auxdisplay: img-ascii-lcd: convert to devm_platform_ioremap_resource auxdisplay: Fix Kconfig indentation commit 65dfcf08072b072b633ba9a693ed48a53919b45f Author: Jakub Kicinski Date: Mon Mar 9 20:11:42 2020 -0700 MAINTAINERS: update cxgb4vf maintainer to Vishal Casey Leedomn is bouncing, Vishal indicated he's happy to take the role. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit e941484541036ba3652b658ed5536c7bca5bdb89 Merge: 2c1aca4bd3fe 2e5383d7904e Author: Linus Torvalds Date: Tue Mar 10 15:05:45 2020 -0700 Merge branch 'for-5.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - cgroup.procs listing related fixes. It didn't interlock properly with exiting tasks leaving a short window where a cgroup has empty cgroup.procs but still can't be removed and misbehaved on short reads. - psi_show() crash fix on 32bit ino archs - Empty release_agent handling fix * 'for-5.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup1: don't call release_agent when it is "" cgroup: fix psi_show() crash on 32bit ino archs cgroup: Iterate tasks that did not finish do_exit() cgroup: cgroup_procs_next should increase position index cgroup-v1: cgroup_pidlist_next should update position index commit 2c1aca4bd3fefc57018773cc8771f71c9bfbdc1f Merge: 30bb5572ce7a aa202f1f5696 Author: Linus Torvalds Date: Tue Mar 10 14:48:22 2020 -0700 Merge branch 'for-5.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: "Workqueue has been incorrectly round-robining per-cpu work items. Hillf's patch fixes that. The other patch documents memory-ordering properties of workqueue operations" * 'for-5.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: don't use wq_select_unbound_cpu() for bound works workqueue: Document (some) memory-ordering properties of {queue,schedule}_work() commit 1d2686d417c5998af3817f93be01745b3db57ecd Author: Hersen Wu Date: Thu Feb 13 10:42:25 2020 -0500 drm/amdgpu/powerplay: nv1x, renior copy dcn clock settings of watermark to smu during boot up dc to pplib interface is changed for navi1x, renoir. display_config_changed is not called by dc anymore. smu_write_watermarks_table is not executed for navi1x, renoir during boot up. solution: call smu_write_watermarks_table just after dc pass watermark clock settings to pplib Signed-off-by: Hersen Wu Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 9134ae2a2546cb96abddcd4469a79c77ee3a4480 Author: Prabhath Sajeepa Date: Mon Mar 9 15:07:53 2020 -0600 nvme-rdma: Avoid double freeing of async event data The timeout of identify cmd, which is invoked as part of admin queue creation, can result in freeing of async event data both in nvme_rdma_timeout handler and error handling path of nvme_rdma_configure_admin queue thus causing NULL pointer reference. Call Trace: ? nvme_rdma_setup_ctrl+0x223/0x800 [nvme_rdma] nvme_rdma_create_ctrl+0x2ba/0x3f7 [nvme_rdma] nvmf_dev_write+0xa54/0xcc6 [nvme_fabrics] __vfs_write+0x1b/0x40 vfs_write+0xb2/0x1b0 ksys_write+0x61/0xd0 __x64_sys_write+0x1a/0x20 do_syscall_64+0x60/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reviewed-by: Roland Dreier Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Prabhath Sajeepa Signed-off-by: Keith Busch commit fe8fe7723a3a824790bda681b40efd767e2251a7 Author: Grigore Popescu Date: Tue Mar 10 14:07:19 2020 +0200 soc: fsl: dpio: register dpio irq handlers after dpio create The dpio irqs must be registered when you can actually receive interrupts, ie when the dpios are created. Kernel goes through NULL pointer dereference errors followed by kernel panic [1] because the dpio irqs are enabled before the dpio is created. [1] Unable to handle kernel NULL pointer dereference at virtual address 0040 fsl_mc_dpio dpio.14: probed fsl_mc_dpio dpio.13: Adding to iommu group 11 ISV = 0, ISS = 0x00000004 Unable to handle kernel NULL pointer dereference at virtual address 0040 Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [0000000000000040] user address but active_mm is swapper Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 151 Comm: kworker/2:1 Not tainted 5.6.0-rc4-next-20200304 #1 Hardware name: NXP Layerscape LX2160ARDB (DT) Workqueue: events deferred_probe_work_func pstate: 00000085 (nzcv daIf -PAN -UAO) pc : dpaa2_io_irq+0x18/0xe0 lr : dpio_irq_handler+0x1c/0x28 sp : ffff800010013e20 x29: ffff800010013e20 x28: ffff0026d9b4c140 x27: ffffa1d38a142018 x26: ffff0026d2953400 x25: ffffa1d38a142018 x24: ffffa1d38a7ba1d8 x23: ffff800010013f24 x22: 0000000000000000 x21: 0000000000000072 x20: ffff0026d2953400 x19: ffff0026d2a68b80 x18: 0000000000000001 x17: 000000002fb37f3d x16: 0000000035eafadd x15: ffff0026d9b4c5b8 x14: ffffffffffffffff x13: ff00000000000000 x12: 0000000000000038 x11: 0101010101010101 x10: 0000000000000040 x9 : ffffa1d388db11e4 x8 : ffffa1d38a7e40f0 x7 : ffff0026da414f38 x6 : 0000000000000000 x5 : ffff0026da414d80 x4 : ffff5e5353d0c000 x3 : ffff800010013f60 x2 : ffffa1d388db11c8 x1 : ffff0026d2a67c00 x0 : 0000000000000000 Call trace: dpaa2_io_irq+0x18/0xe0 dpio_irq_handler+0x1c/0x28 __handle_irq_event_percpu+0x78/0x2c0 handle_irq_event_percpu+0x38/0x90 handle_irq_event+0x4c/0xd0 handle_fasteoi_irq+0xbc/0x168 generic_handle_irq+0x2c/0x40 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x64/0x150 el1_irq+0xb8/0x180 _raw_spin_unlock_irqrestore+0x14/0x48 irq_set_affinity_hint+0x6c/0xa0 dpaa2_dpio_probe+0x2a4/0x518 fsl_mc_driver_probe+0x28/0x70 really_probe+0xdc/0x320 driver_probe_device+0x5c/0xf0 __device_attach_driver+0x88/0xc0 bus_for_each_drv+0x7c/0xc8 __device_attach+0xe4/0x140 device_initial_probe+0x18/0x20 bus_probe_device+0x98/0xa0 device_add+0x41c/0x758 fsl_mc_device_add+0x184/0x530 dprc_scan_objects+0x280/0x370 dprc_probe+0x124/0x3b0 fsl_mc_driver_probe+0x28/0x70 really_probe+0xdc/0x320 driver_probe_device+0x5c/0xf0 __device_attach_driver+0x88/0xc0 bus_for_each_drv+0x7c/0xc8 __device_attach+0xe4/0x140 device_initial_probe+0x18/0x20 bus_probe_device+0x98/0xa0 deferred_probe_work_func+0x74/0xa8 process_one_work+0x1c8/0x470 worker_thread+0x1f8/0x428 kthread+0x124/0x128 ret_from_fork+0x10/0x18 Code: a9bc7bfd 910003fd a9025bf5 a90363f7 (f9402015) ---[ end trace 38298e1a29e7a570 ]--- Kernel panic - not syncing: Fatal exception in interrupt SMP: stopping secondary CPUs Mem abort info: ESR = 0x96000004 CM = 0, WnR = 0 EC = 0x25: DABT (current EL), IL = 32 bits [0000000000000040] user address but active_mm is swapper SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [0000000000000040] user address but active_mm is swapper SMP: failed to stop secondary CPUs 0-2 Kernel Offset: 0x21d378600000 from 0xffff800010000000 PHYS_OFFSET: 0xffffe92180000000 CPU features: 0x10002,21806008 Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Signed-off-by: Laurentiu Tudor Signed-off-by: Grigore Popescu Signed-off-by: Li Yang commit dcd6589b11d3b1e71f516a87a7b9646ed356b4c0 Author: Tejun Heo Date: Tue Mar 10 13:07:46 2020 -0400 blk-iocost: fix incorrect vtime comparison in iocg_is_idle() vtimes may wrap and time_before/after64() should be used to determine whether a given vtime is before or after another. iocg_is_idle() was incorrectly using plain "<" comparison do determine whether done_vtime is before vtime. Here, the only thing we're interested in is whether done_vtime matches vtime which indicates that there's nothing in flight. Let's test for inequality instead. Signed-off-by: Tejun Heo Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Jens Axboe commit ec16b6bbdab1ce2b03f46271460efc7f450658cd Author: Mark Zhang Date: Thu Mar 5 14:40:52 2020 +0200 RDMA/mlx5: Fix the number of hwcounters of a dynamic counter When we read the global counter and there's any dynamic counter allocated, the value of a hwcounter is the sum of the default counter and all dynamic counters. So the number of hwcounters of a dynamically allocated counter must be same as of the default counter, otherwise there will be read violations. This fixes the KASAN slab-out-of-bounds bug: BUG: KASAN: slab-out-of-bounds in rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] Read of size 8 at addr ffff8884192a5778 by task rdma/10138 CPU: 7 PID: 10138 Comm: rdma Not tainted 5.5.0-for-upstream-dbg-2020-02-06_18-30-19-27 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0xb7/0x10b print_address_description.constprop.4+0x1e2/0x400 ? rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] __kasan_report+0x15c/0x1e0 ? mlx5_ib_query_q_counters+0x13f/0x270 [mlx5_ib] ? rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] kasan_report+0xe/0x20 rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] ? rdma_counter_query_stats+0xd0/0xd0 [ib_core] ? memcpy+0x34/0x50 ? nla_put+0xe2/0x170 nldev_stat_get_doit+0x9c7/0x14f0 [ib_core] ... do_syscall_64+0x95/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fcc457fe65a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa f1 2b 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 f3 c3 0f 1f 40 00 41 55 41 54 4d 89 c5 55 RSP: 002b:00007ffc0586f868 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcc457fe65a RDX: 0000000000000020 RSI: 00000000013db920 RDI: 0000000000000003 RBP: 00007ffc0586fa90 R08: 00007fcc45ac10e0 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004089c0 R13: 0000000000000000 R14: 00007ffc0586fab0 R15: 00000000013dc9a0 Allocated by task 9700: save_stack+0x19/0x80 __kasan_kmalloc.constprop.7+0xa0/0xd0 mlx5_ib_counter_alloc_stats+0xd1/0x1d0 [mlx5_ib] rdma_counter_alloc+0x16d/0x3f0 [ib_core] rdma_counter_bind_qpn_alloc+0x216/0x4e0 [ib_core] nldev_stat_set_doit+0x8c2/0xb10 [ib_core] rdma_nl_rcv_msg+0x3d2/0x730 [ib_core] rdma_nl_rcv+0x2a8/0x400 [ib_core] netlink_unicast+0x448/0x620 netlink_sendmsg+0x731/0xd10 sock_sendmsg+0xb1/0xf0 __sys_sendto+0x25d/0x2c0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x95/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 18d422ce8ccf ("IB/mlx5: Add counter_alloc_stats() and counter_update_stats() support") Link: https://lore.kernel.org/r/20200305124052.196688-1-leon@kernel.org Signed-off-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit d372abf37676dab366518088f8871fab312ccc30 Author: Weihang Li Date: Sat Mar 7 17:58:34 2020 +0800 MAINTAINERS: Update maintainers for HISILICON ROCE DRIVER Add myself as a maintainer for HNS RoCE drivers, and update Xavier's e-amil address. Link: https://lore.kernel.org/r/1583575114-32194-1-git-send-email-liweihang@huawei.com Signed-off-by: Weihang Li Acked-by: Wei Hu (Xavier) Signed-off-by: Jason Gunthorpe commit 0f9826f4753f74f935e18c2a640484ecbd941346 Author: Jason Gunthorpe Date: Wed Mar 4 14:16:07 2020 -0400 RDMA/odp: Fix leaking the tgid for implicit ODP The tgid used to be part of ib_umem_free_notifier(), when it was reworked it got moved to release, but it should have been unconditional as all umem alloc paths get the tgid. As is, creating an implicit ODP will leak the tgid reference. Link: https://lore.kernel.org/r/20200304181607.GA22412@ziepe.ca Cc: stable@kernel.org Fixes: f25a546e6529 ("RDMA/odp: Use mmu_interval_notifier_insert()") Signed-off-by: Jason Gunthorpe commit f7861a55b1ce35d0cacfd1f0435f46533dbc9b67 Merge: 1d8006abaab4 6ffe559a77d1 Author: Alexei Starovoitov Date: Tue Mar 10 10:00:42 2020 -0700 Merge branch 'fix-BTF-enum' Yoshiki Komachi says: ==================== btf_enum_check_member() checked if the size of "enum" as a struct member exceeded struct_size or not. Then, the function compared it with the size of "int". Although the size of "enum" is 4-byte by default (i.e., equivalent to "int"), the packing feature enables us to reduce it, as illustrated by the following example: struct A { char m; enum { E0, E1 } __attribute__((packed)) n; }; With such a setup above, the bpf loader gave an error attempting to load it: ------------------------------------------------------------------ ... [3] ENUM (anon) size=1 vlen=2 E0 val=0 E1 val=1 [4] STRUCT A size=2 vlen=2 m type_id=2 bits_offset=0 n type_id=3 bits_offset=8 [4] STRUCT A size=2 vlen=2 n type_id=3 bits_offset=8 Member exceeds struct_size libbpf: Error loading .BTF into kernel: -22. ------------------------------------------------------------------ The related issue was previously fixed by the commit 9eea98497951 ("bpf: fix BTF verification of enums"). On the other hand, this series fixes this issue as well, and adds a selftest program for it. Changes in v2: - change an example in commit message based on Andrii's review - add a selftest program for packed "enum" type members in struct/union ==================== Acked-by: Andrii Nakryiko Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov commit 6ffe559a77d1c963a3567f7a39a5419bdcdc4f1c Author: Yoshiki Komachi Date: Tue Mar 10 16:32:30 2020 +0900 selftests/bpf: Add test for the packed enum member in struct/union Add a simple test to the existing selftest program in order to make sure that a packed enum member in struct unexceeds the struct_size. Signed-off-by: Yoshiki Komachi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/1583825550-18606-3-git-send-email-komachi.yoshiki@gmail.com commit da6c7faeb103c493e505e87643272f70be586635 Author: Yoshiki Komachi Date: Tue Mar 10 16:32:29 2020 +0900 bpf/btf: Fix BTF verification of enum members in struct/union btf_enum_check_member() was currently sure to recognize the size of "enum" type members in struct/union as the size of "int" even if its size was packed. This patch fixes BTF enum verification to use the correct size of member in BPF programs. Fixes: 179cde8cef7e ("bpf: btf: Check members of struct/union") Signed-off-by: Yoshiki Komachi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/1583825550-18606-2-git-send-email-komachi.yoshiki@gmail.com commit 16263abc12d09871156a1c8650fb651f0e552f5e Author: Alberto Mattea Date: Fri Mar 6 17:08:58 2020 +0200 usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c This controller timeouts during suspend (S3) with [ 240.521724] xhci_hcd 0000:30:00.3: WARN: xHC save state timeout [ 240.521729] xhci_hcd 0000:30:00.3: ERROR mismatched command completion event thus preventing the system from entering S3. Moreover it remains in an undefined state where some connected devices stop working until a reboot. Apply the XHCI_SUSPEND_DELAY quirk to make it suspend properly. CC: stable@vger.kernel.org Signed-off-by: Alberto Mattea Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20200306150858.21904-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 045706bff837ee89c13f1ace173db71922c1c40b Author: Steven Rostedt (VMware) Date: Fri Mar 6 17:08:57 2020 +0200 xhci: Do not open code __print_symbolic() in xhci trace events libtraceevent (used by perf and trace-cmd) failed to parse the xhci_urb_dequeue trace event. This is because the user space trace event format parsing is not a full C compiler. It can handle some basic logic, but is not meant to be able to handle everything C can do. In cases where a trace event field needs to be converted from a number to a string, there's the __print_symbolic() macro that should be used: See samples/trace_events/trace-events-sample.h Some xhci trace events open coded the __print_symbolic() causing the user spaces tools to fail to parse it. This has to be replaced with __print_symbolic() instead. CC: stable@vger.kernel.org Reported-by: Tzvetomir Stoyanov Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206531 Fixes: 5abdc2e6e12ff ("usb: host: xhci: add urb_enqueue/dequeue/giveback tracers") Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20200306150858.21904-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c08ab390b68305ac415ecd7e5ea7f9c2a28105e0 Merge: 2c523b344dfa e9d0e7511fda Author: Greg Kroah-Hartman Date: Tue Mar 10 17:42:55 2020 +0100 Merge tag 'thunderbolt-fix-for-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fix for v5.6-rc6 This includes a single commit that fixes incorrect return value from tb_port_is_width_supported() if the read fails. * tag 'thunderbolt-fix-for-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix error code in tb_port_is_width_supported() commit 1756bfe89857898eb7f434b60d063f649c3395db Merge: 0c5220a3c124 cfaf6051eccc Author: Tony Lindgren Date: Tue Mar 10 08:54:01 2020 -0700 Merge branch 'fix-lcdc-quirk' into fixes commit aa202f1f56960c60e7befaa0f49c72b8fa11b0a8 Author: Hillf Danton Date: Fri Jan 24 20:14:45 2020 -0500 workqueue: don't use wq_select_unbound_cpu() for bound works wq_select_unbound_cpu() is designed for unbound workqueues only, but it's wrongly called when using a bound workqueue too. Fixing this ensures work queued to a bound workqueue with cpu=WORK_CPU_UNBOUND always runs on the local CPU. Before, that would happen only if wq_unbound_cpumask happened to include it (likely almost always the case), or was empty, or we got lucky with forced round-robin placement. So restricting /sys/devices/virtual/workqueue/cpumask to a small subset of a machine's CPUs would cause some bound work items to run unexpectedly there. Fixes: ef557180447f ("workqueue: schedule WORK_CPU_UNBOUND work on wq_unbound_cpumask CPUs") Cc: stable@vger.kernel.org # v4.5+ Signed-off-by: Hillf Danton [dj: massage changelog] Signed-off-by: Daniel Jordan Cc: Tejun Heo Cc: Lai Jiangshan Cc: linux-kernel@vger.kernel.org Signed-off-by: Tejun Heo commit da86cad0e011c0216bf2303bc924fa080e150bc8 Author: Luca Coelho Date: Thu Mar 5 14:26:22 2020 +0200 MAINTAINERS: update web URL for iwlwifi The current URL mentioned in iwlwifi's W entry is outdated and currently pointing to a dead link. Change it so that it points to the correct Wiki page directly. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 453bfc2d16fccb9917a331347ebc7432b0a8111e Merge: 236205942749 9352ed0165ff Author: Kalle Valo Date: Tue Mar 10 15:33:24 2020 +0200 Merge tag 'iwlwifi-for-kalle-2020-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes First batch of fixes intended for v5.6 * Fix a locking issue in time events handling; * A fix in rate-scaling; * Fix for a potential NULL pointer deref; * Enable antenna diversity in some devices that were erroneously not doing it; * Allow FW dumps to continue when the FW is stuck; * A fix in the HE capabilities handling; * Another fix for FW dumps where we were reading wrong addresses. commit 3747cd2efe7ecb9604972285ab3f60c96cb753a8 Author: Hamish Martin Date: Tue Mar 10 10:16:18 2020 +1300 i2c: gpio: suppress error on probe defer If a GPIO we are trying to use is not available and we are deferring the probe, don't output an error message. This seems to have been the intent of commit 05c74778858d ("i2c: gpio: Add support for named gpios in DT") but the error was still output due to not checking the updated 'retdesc'. Fixes: 05c74778858d ("i2c: gpio: Add support for named gpios in DT") Signed-off-by: Hamish Martin Acked-by: Linus Walleij Signed-off-by: Wolfram Sang commit bcf3588d8ed3517e6ffaf083f034812aee9dc8e2 Author: Wolfram Sang Date: Tue Mar 3 13:50:46 2020 +0100 macintosh: windfarm: fix MODINFO regression Commit af503716ac14 made sure OF devices get an OF style modalias with I2C events. It assumed all in-tree users were converted, yet it missed some Macintosh drivers. Add an OF module device table for all windfarm drivers to make them automatically load again. Fixes: af503716ac14 ("i2c: core: report OF style module alias for devices registered via OF") Link: https://bugzilla.kernel.org/show_bug.cgi?id=199471 Reported-by: Erhard Furtner Tested-by: Erhard Furtner Acked-by: Michael Ellerman (powerpc) Signed-off-by: Wolfram Sang Cc: stable@kernel.org # v4.17+ commit 9be8bc4dd6177cf992b93b0bd014c4f611283896 Author: Jarkko Nikula Date: Thu Feb 13 17:15:03 2020 +0200 i2c: designware-pci: Fix BUG_ON during device removal Function i2c_dw_pci_remove() -> pci_free_irq_vectors() -> pci_disable_msi() -> free_msi_irqs() will throw a BUG_ON() for MSI enabled device since the driver has not released the requested IRQ before calling the pci_free_irq_vectors(). Here driver requests an IRQ using devm_request_irq() but automatic release happens only after remove callback. Fix this by explicitly freeing the IRQ before calling pci_free_irq_vectors(). Fixes: 21aa3983d619 ("i2c: designware-pci: Switch over to MSI interrupts") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Jarkko Nikula Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang commit f5152416528c2295f35dd9c9bd4fb27c4032413d Author: Qian Cai Date: Thu Mar 5 15:15:02 2020 -0500 iommu/vt-d: Silence RCU-list debugging warnings Similar to the commit 02d715b4a818 ("iommu/vt-d: Fix RCU list debugging warnings"), there are several other places that call list_for_each_entry_rcu() outside of an RCU read side critical section but with dmar_global_lock held. Silence those false positives as well. drivers/iommu/intel-iommu.c:4288 RCU-list traversed in non-reader section!! 1 lock held by swapper/0/1: #0: ffffffff935892c8 (dmar_global_lock){+.+.}, at: intel_iommu_init+0x1ad/0xb97 drivers/iommu/dmar.c:366 RCU-list traversed in non-reader section!! 1 lock held by swapper/0/1: #0: ffffffff935892c8 (dmar_global_lock){+.+.}, at: intel_iommu_init+0x125/0xb97 drivers/iommu/intel-iommu.c:5057 RCU-list traversed in non-reader section!! 1 lock held by swapper/0/1: #0: ffffffffa71892c8 (dmar_global_lock){++++}, at: intel_iommu_init+0x61a/0xb13 Signed-off-by: Qian Cai Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 2d48ea0efb8887ebba3e3720bb5b738aced4e574 Author: Qian Cai Date: Thu Mar 5 15:00:46 2020 -0500 iommu/vt-d: Fix RCU-list bugs in intel_iommu_init() There are several places traverse RCU-list without holding any lock in intel_iommu_init(). Fix them by acquiring dmar_global_lock. WARNING: suspicious RCU usage ----------------------------- drivers/iommu/intel-iommu.c:5216 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by swapper/0/1. Call Trace: dump_stack+0xa0/0xea lockdep_rcu_suspicious+0x102/0x10b intel_iommu_init+0x947/0xb13 pci_iommu_init+0x26/0x62 do_one_initcall+0xfe/0x500 kernel_init_freeable+0x45a/0x4f8 kernel_init+0x11/0x139 ret_from_fork+0x3a/0x50 DMAR: Intel(R) Virtualization Technology for Directed I/O Fixes: d8190dc63886 ("iommu/vt-d: Enable DMA remapping after rmrr mapped") Signed-off-by: Qian Cai Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 04bbb97d1b732b2d197f103c5818f5c214a4cf81 Author: Mika Westerberg Date: Wed Feb 26 16:21:22 2020 +0300 i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device Martin noticed that nct6775 driver does not load properly on his system in v5.4+ kernels. The issue was bisected to commit b84398d6d7f9 ("i2c: i801: Use iTCO version 6 in Cannon Lake PCH and beyond") but it is likely not the culprit because the faulty code has been in the driver already since commit 9424693035a5 ("i2c: i801: Create iTCO device on newer Intel PCHs"). So more likely some commit that added PCI IDs of recent chipsets made the driver to create the iTCO_wdt device on Martins system. The issue was debugged to be PCI configuration access to the PMC device that is not present. This returns all 1's when read and this caused the iTCO_wdt driver to accidentally request resourses used by nct6775. It turns out that the SMI resource is only required for some ancient systems, not the ones supported by this driver. For this reason do not populate the SMI resource at all and drop all the related code. The driver now always populates the main I/O resource and only in case of SPT (Intel Sunrisepoint) compatible devices it adds another resource for the NO_REBOOT bit. These two resources are of different types so platform_get_resource() used by the iTCO_wdt driver continues to find the both resources at index 0. Link: https://lore.kernel.org/linux-hwmon/CAM1AHpQ4196tyD=HhBu-2donSsuogabkfP03v1YF26Q7_BgvgA@mail.gmail.com/ Fixes: 9424693035a5 ("i2c: i801: Create iTCO device on newer Intel PCHs") [wsa: complete fix needs all of http://patchwork.ozlabs.org/project/linux-i2c/list/?series=160959&state=*] Reported-by: Martin Volf Signed-off-by: Mika Westerberg Reviewed-by: Guenter Roeck Signed-off-by: Wolfram Sang commit e42b0c24389d5a1602e77db4f6def0d5a19e3e43 Author: Mika Westerberg Date: Wed Feb 26 16:21:21 2020 +0300 watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional The iTCO_wdt driver only needs ICH_RES_IO_SMI I/O resource when either turn_SMI_watchdog_clear_off module parameter is set to match ->iTCO_version (or higher), and when legacy iTCO_vendorsupport is set. Modify the driver so that ICH_RES_IO_SMI is optional if the two conditions are not met. Signed-off-by: Mika Westerberg Reviewed-by: Guenter Roeck Signed-off-by: Wolfram Sang commit 7ca6ee38909109751bfab79e9f6c570d2ed258c6 Author: Mika Westerberg Date: Wed Feb 26 16:21:20 2020 +0300 watchdog: iTCO_wdt: Export vendorsupport In preparation for making ->smi_res optional the iTCO_wdt driver needs to know whether vendorsupport is being set to non-zero. For this reason export the variable. Signed-off-by: Mika Westerberg Reviewed-by: Guenter Roeck Signed-off-by: Wolfram Sang commit b74f241d71c251fef074e58ff767b47d1aff901d Merge: 2c523b344dfa 2fa7e15c5f46 Author: Jani Nikula Date: Tue Mar 10 11:16:41 2020 +0200 Merge tag 'gvt-fixes-2020-03-10' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2020-03-10 - Fix vgpu idr destroy causing timer destroy failure (Zhenyu) - Fix VBT size (Tina) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20200310080933.GE28483@zhen-hp.sh.intel.com commit bce74b1feb01accc6654a1f3e37958478d3a4fbc Merge: 2c523b344dfa 2de7fb60a474 Author: Rafael J. Wysocki Date: Tue Mar 10 09:52:04 2020 +0100 Merge tag 'linux-cpupower-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility fix for v5.6 from Shuah Khan: "This cpupower update for Linux 5.6-rc6 consists of a fix from Mike Gilbert for build failures when -fno-common is enabled. -fno-common will be default in gcc v10." * tag 'linux-cpupower-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: avoid multiple definition with gcc -fno-common commit 36fa3e50085e3858dd506e4431b9abd1bcb1f542 Author: Dan Carpenter Date: Thu Feb 27 19:19:54 2020 +0300 tee: amdtee: out of bounds read in find_session() The "index" is a user provided value from 0-USHRT_MAX. If it's over TEE_NUM_SESSIONS (31) then it results in an out of bounds read when we call test_bit(index, sess->sess_mask). Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Acked-by: Rijo Thomas Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander commit 07dc3678bacc2a75b1900febea7d996a31f178a2 Author: Marek Szyprowski Date: Mon Mar 9 12:02:14 2020 +0100 drm/exynos: Fix cleanup of IOMMU related objects Store the IOMMU mapping created by the device core of each Exynos DRM sub-device and restore it when the Exynos DRM driver is unbound. This fixes IOMMU initialization failure for the second time when a deferred probe is triggered from the bind() callback of master's compound DRM driver. This also fixes the following issue found using kmemleak detector: unreferenced object 0xc2137640 (size 64): comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s) hex dump (first 32 bytes): 50 a3 14 c2 80 a2 14 c2 01 00 00 00 20 00 00 00 P........... ... 00 10 00 00 00 80 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<3acd268d>] arch_setup_dma_ops+0x4c/0x104 [<9f7d2cce>] of_dma_configure+0x19c/0x3a4 [] really_probe+0xb0/0x47c [<4f510e4f>] driver_probe_device+0x78/0x1c4 [<7481a0cf>] device_driver_attach+0x58/0x60 [<0ff8f5c1>] __driver_attach+0xb8/0x158 [<86006144>] bus_for_each_dev+0x74/0xb4 [<10159dca>] bus_add_driver+0x1c0/0x200 [<8a265265>] driver_register+0x74/0x108 [] exynos_drm_init+0xb0/0x134 [] do_one_initcall+0x90/0x458 [<6da35917>] kernel_init_freeable+0x188/0x200 [] kernel_init+0x8/0x110 [<1f3cddf9>] ret_from_fork+0x14/0x20 [<8cd12507>] 0x0 unreferenced object 0xc214a280 (size 128): comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s) hex dump (first 32 bytes): 00 a0 ec ed 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<3acd268d>] arch_setup_dma_ops+0x4c/0x104 [<9f7d2cce>] of_dma_configure+0x19c/0x3a4 [] really_probe+0xb0/0x47c [<4f510e4f>] driver_probe_device+0x78/0x1c4 [<7481a0cf>] device_driver_attach+0x58/0x60 [<0ff8f5c1>] __driver_attach+0xb8/0x158 [<86006144>] bus_for_each_dev+0x74/0xb4 [<10159dca>] bus_add_driver+0x1c0/0x200 [<8a265265>] driver_register+0x74/0x108 [] exynos_drm_init+0xb0/0x134 [] do_one_initcall+0x90/0x458 [<6da35917>] kernel_init_freeable+0x188/0x200 [] kernel_init+0x8/0x110 [<1f3cddf9>] ret_from_fork+0x14/0x20 [<8cd12507>] 0x0 unreferenced object 0xedeca000 (size 4096): comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<3acd268d>] arch_setup_dma_ops+0x4c/0x104 [<9f7d2cce>] of_dma_configure+0x19c/0x3a4 [] really_probe+0xb0/0x47c [<4f510e4f>] driver_probe_device+0x78/0x1c4 [<7481a0cf>] device_driver_attach+0x58/0x60 [<0ff8f5c1>] __driver_attach+0xb8/0x158 [<86006144>] bus_for_each_dev+0x74/0xb4 [<10159dca>] bus_add_driver+0x1c0/0x200 [<8a265265>] driver_register+0x74/0x108 [] exynos_drm_init+0xb0/0x134 [] do_one_initcall+0x90/0x458 [<6da35917>] kernel_init_freeable+0x188/0x200 [] kernel_init+0x8/0x110 [<1f3cddf9>] ret_from_fork+0x14/0x20 [<8cd12507>] 0x0 unreferenced object 0xc214a300 (size 128): comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s) hex dump (first 32 bytes): 00 a3 14 c2 00 a3 14 c2 00 40 18 c2 00 80 18 c2 .........@...... 02 00 02 00 ad 4e ad de ff ff ff ff ff ff ff ff .....N.......... backtrace: [<08cbd8bc>] iommu_domain_alloc+0x24/0x50 [] arm_iommu_create_mapping+0xe4/0x134 [<3acd268d>] arch_setup_dma_ops+0x4c/0x104 [<9f7d2cce>] of_dma_configure+0x19c/0x3a4 [] really_probe+0xb0/0x47c [<4f510e4f>] driver_probe_device+0x78/0x1c4 [<7481a0cf>] device_driver_attach+0x58/0x60 [<0ff8f5c1>] __driver_attach+0xb8/0x158 [<86006144>] bus_for_each_dev+0x74/0xb4 [<10159dca>] bus_add_driver+0x1c0/0x200 [<8a265265>] driver_register+0x74/0x108 [] exynos_drm_init+0xb0/0x134 [] do_one_initcall+0x90/0x458 [<6da35917>] kernel_init_freeable+0x188/0x200 [] kernel_init+0x8/0x110 [<1f3cddf9>] ret_from_fork+0x14/0x20 Signed-off-by: Marek Szyprowski Reviewed-by: Lukasz Luba Signed-off-by: Inki Dae commit 1d8006abaab4cb90f81add86e8d1bf9411add05a Author: Andrii Nakryiko Date: Mon Mar 9 15:40:17 2020 -0700 bpf: Fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory There is no compensating cgroup_bpf_put() for each ancestor cgroup in cgroup_bpf_inherit(). If compute_effective_progs returns error, those cgroups won't be freed ever. Fix it by putting them in cleanup code path. Fixes: e10360f815ca ("bpf: cgroup: prevent out-of-order release of cgroup bpf") Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Acked-by: Roman Gushchin Link: https://lore.kernel.org/bpf/20200309224017.1063297-1-andriin@fb.com commit 62039c30c19dcab96621e074aeeb90da7100def7 Author: Andrii Nakryiko Date: Mon Mar 9 15:27:55 2020 -0700 bpf: Initialize storage pointers to NULL to prevent freeing garbage pointer Local storage array isn't initialized, so if cgroup storage allocation fails for BPF_CGROUP_STORAGE_SHARED, error handling code will attempt to free uninitialized pointer for BPF_CGROUP_STORAGE_PERCPU storage type. Avoid this by always initializing storage pointers to NULLs. Fixes: 8bad74f9840f ("bpf: extend cgroup bpf core to allow multiple cgroup storage types") Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200309222756.1018737-1-andriin@fb.com commit 2362059427494b9e318161f0447a10dc5513b2c3 Merge: a8015ded89ad 8e8ce08198de Author: David S. Miller Date: Mon Mar 9 19:08:43 2020 -0700 Merge tag 'batadv-net-for-davem-20200306' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - Don't schedule OGM for disabled interface, by Sven Eckelmann ==================== Signed-off-by: David S. Miller commit a8015ded89ad740d21355470d41879c5bd82aab7 Author: Vladimir Oltean Date: Tue Mar 10 03:28:18 2020 +0200 net: mscc: ocelot: properly account for VLAN header length when setting MRU What the driver writes into MAC_MAXLEN_CFG does not actually represent VLAN_ETH_FRAME_LEN but instead ETH_FRAME_LEN + ETH_FCS_LEN. Yes they are numerically equal, but the difference is important, as the switch treats VLAN-tagged traffic specially and knows to increase the maximum accepted frame size automatically. So it is always wrong to account for VLAN in the MAC_MAXLEN_CFG register. Unconditionally increase the maximum allowed frame size for double-tagged traffic. Accounting for the additional length does not mean that the other VLAN membership checks aren't performed, so there's no harm done. Also, stop abusing the MTU name for configuring the MRU. There is no support for configuring the MRU on an interface at the moment. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Fixes: fa914e9c4d94 ("net: mscc: ocelot: create a helper for changing the port MTU") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit afe207d80a61e4d6e7cfa0611a4af46d0ba95628 Author: Eric Dumazet Date: Mon Mar 9 18:22:58 2020 -0700 ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() Commit e18b353f102e ("ipvlan: add cond_resched_rcu() while processing muticast backlog") added a cond_resched_rcu() in a loop using rcu protection to iterate over slaves. This is breaking rcu rules, so lets instead use cond_resched() at a point we can reschedule Fixes: e18b353f102e ("ipvlan: add cond_resched_rcu() while processing muticast backlog") Signed-off-by: Eric Dumazet Cc: Mahesh Bandewar Signed-off-by: David S. Miller commit 018d26fcd12a75fb9b5fe233762aa3f2f0854b88 Author: Dmitry Yakunin Date: Thu Mar 5 17:45:57 2020 +0300 cgroup, netclassid: periodically release file_lock on classid updating In our production environment we have faced with problem that updating classid in cgroup with heavy tasks cause long freeze of the file tables in this tasks. By heavy tasks we understand tasks with many threads and opened sockets (e.g. balancers). This freeze leads to an increase number of client timeouts. This patch implements following logic to fix this issue: аfter iterating 1000 file descriptors file table lock will be released thus providing a time gap for socket creation/deletion. Now update is non atomic and socket may be skipped using calls: dup2(oldfd, newfd); close(oldfd); But this case is not typical. Moreover before this patch skip is possible too by hiding socket fd in unix socket buffer. New sockets will be allocated with updated classid because cgroup state is updated before start of the file descriptors iteration. So in common cases this patch has no side effects. Signed-off-by: Dmitry Yakunin Reviewed-by: Konstantin Khlebnikov Signed-off-by: David S. Miller commit ce9a4186f9ac475c415ffd20348176a4ea366670 Author: Mahesh Bandewar Date: Mon Mar 9 15:57:07 2020 -0700 macvlan: add cond_resched() during multicast processing The Rx bound multicast packets are deferred to a workqueue and macvlan can also suffer from the same attack that was discovered by Syzbot for IPvlan. This solution is not as effective as in IPvlan. IPvlan defers all (Tx and Rx) multicast packet processing to a workqueue while macvlan does this way only for the Rx. This fix should address the Rx codition to certain extent. Tx is still suseptible. Tx multicast processing happens when .ndo_start_xmit is called, hence we cannot add cond_resched(). However, it's not that severe since the user which is generating / flooding will be affected the most. Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") Signed-off-by: Mahesh Bandewar Signed-off-by: David S. Miller commit e18b353f102e371580f3f01dd47567a25acc3c1d Author: Mahesh Bandewar Date: Mon Mar 9 15:57:02 2020 -0700 ipvlan: add cond_resched_rcu() while processing muticast backlog If there are substantial number of slaves created as simulated by Syzbot, the backlog processing could take much longer and result into the issue found in the Syzbot report. INFO: rcu_sched detected stalls on CPUs/tasks: (detected by 1, t=10502 jiffies, g=5049, c=5048, q=752) All QSes seen, last rcu_sched kthread activity 10502 (4294965563-4294955061), jiffies_till_next_fqs=1, root ->qsmask 0x0 syz-executor.1 R running task on cpu 1 10984 11210 3866 0x30020008 179034491270 Call Trace: [] _sched_show_task kernel/sched/core.c:8063 [inline] [] _sched_show_task.cold+0x2fd/0x392 kernel/sched/core.c:8030 [] sched_show_task+0xb/0x10 kernel/sched/core.c:8073 [] print_other_cpu_stall kernel/rcu/tree.c:1577 [inline] [] check_cpu_stall kernel/rcu/tree.c:1695 [inline] [] __rcu_pending kernel/rcu/tree.c:3478 [inline] [] rcu_pending kernel/rcu/tree.c:3540 [inline] [] rcu_check_callbacks.cold+0xbb4/0xc29 kernel/rcu/tree.c:2876 [] update_process_times+0x32/0x80 kernel/time/timer.c:1635 [] tick_sched_handle+0xa0/0x180 kernel/time/tick-sched.c:161 [] tick_sched_timer+0x44/0x130 kernel/time/tick-sched.c:1193 [] __run_hrtimer kernel/time/hrtimer.c:1393 [inline] [] __hrtimer_run_queues+0x307/0xd90 kernel/time/hrtimer.c:1455 [] hrtimer_interrupt+0x2ea/0x730 kernel/time/hrtimer.c:1513 [] local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1031 [inline] [] smp_apic_timer_interrupt+0x144/0x5e0 arch/x86/kernel/apic/apic.c:1056 [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:778 RIP: 0010:do_raw_read_lock+0x22/0x80 kernel/locking/spinlock_debug.c:153 RSP: 0018:ffff8801dad07ab8 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff12 RAX: 0000000000000000 RBX: ffff8801c4135680 RCX: 0000000000000000 RDX: 1ffff10038826afe RSI: ffff88019d816bb8 RDI: ffff8801c41357f0 RBP: ffff8801dad07ac0 R08: 0000000000004b15 R09: 0000000000310273 R10: ffff88019d816bb8 R11: 0000000000000001 R12: ffff8801c41357e8 R13: 0000000000000000 R14: ffff8801cfb19850 R15: ffff8801cfb198b0 [] __raw_read_lock_bh include/linux/rwlock_api_smp.h:177 [inline] [] _raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:240 [] ipv6_chk_mcast_addr+0x11a/0x6f0 net/ipv6/mcast.c:1006 [] ip6_mc_input+0x319/0x8e0 net/ipv6/ip6_input.c:482 [] dst_input include/net/dst.h:449 [inline] [] ip6_rcv_finish+0x408/0x610 net/ipv6/ip6_input.c:78 [] NF_HOOK include/linux/netfilter.h:292 [inline] [] NF_HOOK include/linux/netfilter.h:286 [inline] [] ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:278 [] __netif_receive_skb_one_core+0x12a/0x1f0 net/core/dev.c:5303 [] __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:5417 [] process_backlog+0x216/0x6c0 net/core/dev.c:6243 [] napi_poll net/core/dev.c:6680 [inline] [] net_rx_action+0x47b/0xfb0 net/core/dev.c:6748 [] __do_softirq+0x2c8/0x99a kernel/softirq.c:317 [] invoke_softirq kernel/softirq.c:399 [inline] [] irq_exit+0x16a/0x1a0 kernel/softirq.c:439 [] exiting_irq arch/x86/include/asm/apic.h:561 [inline] [] smp_apic_timer_interrupt+0x165/0x5e0 arch/x86/kernel/apic/apic.c:1058 [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:778 RIP: 0010:__sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:102 RSP: 0018:ffff880196033bd8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12 RAX: ffff88019d8161c0 RBX: 00000000ffffffff RCX: ffffc90003501000 RDX: 0000000000000002 RSI: ffffffff816236d1 RDI: 0000000000000005 RBP: ffff880196033bd8 R08: ffff88019d8161c0 R09: 0000000000000000 R10: 1ffff10032c067f0 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000080 R14: 0000000000000000 R15: 0000000000000000 [] do_futex+0x151/0x1d50 kernel/futex.c:3548 [] C_SYSC_futex kernel/futex_compat.c:201 [inline] [] compat_SyS_futex+0x270/0x3b0 kernel/futex_compat.c:175 [] do_syscall_32_irqs_on arch/x86/entry/common.c:353 [inline] [] do_fast_syscall_32+0x357/0xe1c arch/x86/entry/common.c:415 [] entry_SYSENTER_compat+0x8b/0x9d arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f23c69 RSP: 002b:00000000f5d1f12c EFLAGS: 00000282 ORIG_RAX: 00000000000000f0 RAX: ffffffffffffffda RBX: 000000000816af88 RCX: 0000000000000080 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000816af8c RBP: 00000000f5d1f228 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 rcu_sched kthread starved for 10502 jiffies! g5049 c5048 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=1 rcu_sched R running task on cpu 1 13048 8 2 0x90000000 179099587640 Call Trace: [] context_switch+0x60f/0xa60 kernel/sched/core.c:3209 [] __schedule+0x5aa/0x1da0 kernel/sched/core.c:3934 [] schedule+0x8f/0x1b0 kernel/sched/core.c:4011 [] schedule_timeout+0x50d/0xee0 kernel/time/timer.c:1803 [] rcu_gp_kthread+0xda1/0x3b50 kernel/rcu/tree.c:2327 [] kthread+0x348/0x420 kernel/kthread.c:246 [] ret_from_fork+0x56/0x70 arch/x86/entry/entry_64.S:393 Fixes: ba35f8588f47 (“ipvlan: Defer multicast / broadcast processing to a work-queue”) Signed-off-by: Mahesh Bandewar Reported-by: syzbot Signed-off-by: David S. Miller commit ad8192767c9f9cf97da57b9ffcea70fb100febef Author: Mahesh Bandewar Date: Mon Mar 9 15:56:56 2020 -0700 ipvlan: don't deref eth hdr before checking it's set IPvlan in L3 mode discards outbound multicast packets but performs the check before ensuring the ether-header is set or not. This is an error that Eric found through code browsing. Fixes: 2ad7bf363841 (“ipvlan: Initial check-in of the IPVLAN driver.”) Signed-off-by: Mahesh Bandewar Reported-by: Eric Dumazet Signed-off-by: David S. Miller commit 4b1bd9db078f7d5332c8601a2f5bd43cf0458fd4 Author: Edward Cree Date: Mon Mar 9 18:16:24 2020 +0000 sfc: detach from cb_page in efx_copy_channel() It's a resource, not a parameter, so we can't copy it into the new channel's TX queues, otherwise aliasing will lead to resource- management bugs if the channel is subsequently torn down without being initialised. Before the Fixes:-tagged commit there was a similar bug with tsoh_page, but I'm not sure it's worth doing another fix for such old kernels. Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2") Suggested-by: Derek Shute Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit 30bb5572ce7a8710fa9ea720b6ecb382791c9800 Merge: d397a82b7cca 1091c8fce8aa Author: Linus Torvalds Date: Mon Mar 9 16:16:42 2020 -0700 Merge tag 'ktest-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull Ktest fixes and clean ups from Steven Rostedt: - Make the default option oldconfig instead of randconfig (one too many times I lost my config because I left the build type out) - Add timeout to ssh sync to sync before reboot (prevents test hangs) - A couple of spelling fix patches * tag 'ktest-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest: Fix typos in ktest.pl ktest: Add timeout for ssh sync testing ktest: Make default build option oldconfig not randconfig ktest: Fix some typos in sample.conf commit d397a82b7ccaa4c4fe3e149ecb763dd6214abc93 Merge: 7de41b120bb7 31e43f31890c Author: Linus Torvalds Date: Mon Mar 9 16:12:20 2020 -0700 Merge tag 'mmc-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - sdhci-msm: Silence warning about turning function into static - sdhci-pci-gli: Fix support for GL975x by enabling MSI interrupt * tag 'mmc-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci-gli: Enable MSI interrupt for GL975x mmc: sdhci-msm: Mark sdhci_msm_cqe_disable static commit 7de41b120bb7fbe83bb46e7585c7346d21b93585 Merge: 2c523b344dfa 6ae4edab2fbf Author: Linus Torvalds Date: Mon Mar 9 16:02:32 2020 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Some bug fixes all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_balloon: Adjust label in virtballoon_probe virtio-blk: improve virtqueue error to BLK_STS virtio-blk: fix hw_queue stopped on arbitrary error virtio_ring: Fix mem leak with vring_new_virtqueue() commit 10dab84caf400f2f5f8b010ebb0c7c4272ec5093 Author: Christian Brauner Date: Sun Mar 8 14:29:17 2020 +0100 pid: make ENOMEM return value more obvious The alloc_pid() codepath used to be simpler. With the introducation of the ability to choose specific pids in 49cb2fc42ce4 ("fork: extend clone3() to support setting a PID") it got more complex. It hasn't been super obvious that ENOMEM is returned when the pid namespace init process/child subreaper of the pid namespace has died. As can be seen from multiple attempts to improve this see e.g. [1] and most recently [2]. We regressed returning ENOMEM in [3] and [2] restored it. Let's add a comment on top explaining that this is historic and documented behavior and cannot easily be changed. [1]: 35f71bc0a09a ("fork: report pid reservation failure properly") [2]: b26ebfe12f34 ("pid: Fix error return value in some cases") [3]: 49cb2fc42ce4 ("fork: extend clone3() to support setting a PID") Signed-off-by: Christian Brauner commit 8d67743653dce5a0e7aa500fcccb237cde7ad88e Author: Thomas Gleixner Date: Sun Mar 8 19:07:17 2020 +0100 futex: Unbreak futex hashing The recent futex inode life time fix changed the ordering of the futex key union struct members, but forgot to adjust the hash function accordingly, As a result the hashing omits the leading 64bit and even hashes beyond the futex key causing a bad hash distribution which led to a ~100% performance regression. Hand in the futex key pointer instead of a random struct member and make the size calculation based of the struct offset. Fixes: 8019ad13ef7f ("futex: Fix inode life-time issue") Reported-by: Rong Chen Decoded-by: Linus Torvalds Signed-off-by: Thomas Gleixner Tested-by: Rong Chen Link: https://lkml.kernel.org/r/87h7yy90ve.fsf@nanos.tec.linutronix.de commit f1c2cd3f8fb959123a9beba18c0e8112dcb2e137 Author: Hawking Zhang Date: Wed Mar 4 17:03:48 2020 +0800 drm/amdgpu: correct ROM_INDEX/DATA offset for VEGA20 The ROMC_INDEX/DATA offset was changed to e4/e5 since from smuio_v11 (vega20/arcturus). Signed-off-by: Hawking Zhang Tested-by: Candice Li Reviewed-by: Candice Li Signed-off-by: Alex Deucher commit 1091c8fce8aa9c5abe1a73acab4bcaf58a729005 Author: Masanari Iida Date: Mon Mar 9 20:54:30 2020 +0900 ktest: Fix typos in ktest.pl This patch fixes multipe spelling typo found in ktest.pl. Link: http://lkml.kernel.org/r/20200309115430.57540-1-standby24x7@gmail.com Acked-by: Randy Dunlap Signed-off-by: Masanari Iida Signed-off-by: Steven Rostedt (VMware) commit 4d00fc477a2ce8b6d2b09fb34ef9fe9918e7d434 Author: Steven Rostedt (VMware) Date: Mon Mar 9 16:00:11 2020 -0400 ktest: Add timeout for ssh sync testing Before rebooting the box, a "ssh sync" is called to the test machine to see if it is alive or not. But if the test machine is in a partial state, that ssh may never actually finish, and the ktest test hangs. Add a 10 second timeout to the sync test, which will fail after 10 seconds and then cause the test to reboot the test machine. Cc: stable@vger.kernel.org Fixes: 6474ace999edd ("ktest.pl: Powercycle the box on reboot if no connection can be made") Signed-off-by: Steven Rostedt (VMware) commit 791dc9d6b3ca4291be6cfce7b9be468d61d7ed95 Author: Steven Rostedt (VMware) Date: Wed Nov 13 13:36:24 2019 -0500 ktest: Make default build option oldconfig not randconfig For the last time, I screwed up my ktest config file, and the build went into the default "randconfig", blowing away the .config that I had set up. The reason for the default randconfig was because when this was first written, I wanted to do a bunch of randconfigs. But as time progressed, ktest isn't about randconfig anymore, and because randconfig destroys the config in the build directory, it's a dangerous default to have. Use oldconfig as the default. Signed-off-by: Steven Rostedt (VMware) commit afbac6c500da7235e9767b99e3fe2369cf3618a4 Author: Masanari Iida Date: Mon Sep 30 21:49:25 2019 +0900 ktest: Fix some typos in sample.conf This patch fixes some spelling typo in sample.conf Link: http://lkml.kernel.org/r/20190930124925.20250-1-standby24x7@gmail.com Acked-by: Randy Dunlap Signed-off-by: Masanari Iida Signed-off-by: Steven Rostedt (VMware) commit d5349775c1726ce997b8eb4982cd85a01f1c8b42 Author: Martin Leung Date: Mon Feb 24 14:07:23 2020 -0500 drm/amd/display: update soc bb for nv14 [why] nv14 previously inherited soc bb from generic dcn 2, did not match watermark values according to memory team [how] add nv14 specific soc bb: copy nv2 generic that it was using from before, but changed num channels to 8 Signed-off-by: Martin Leung Reviewed-by: Jun Lei Acked-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 661388f9b0004421b2ecdeac17248bd92a3bb818 Author: Masanari Iida Date: Mon Mar 9 19:43:56 2020 +0900 linux-next: DOC: RDS: Fix a typo in rds.txt This patch fix a spelling typo in rds.txt Signed-off-by: Masanari Iida Signed-off-by: David S. Miller commit 0c5220a3c1242c7a2451570ed5f5af69620aac75 Author: Arthur Demchenkov Date: Sun Mar 8 22:19:33 2020 +0300 ARM: dts: N900: fix onenand timings Commit a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") started using DT specified timings for GPMC, and as a result the OneNAND stopped working on N900 as we had wrong values in the DT. Fix by updating the values to bootloader timings that have been tested to be working on Nokia N900 with OneNAND manufacturers: Samsung, Numonyx. Fixes: a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") Signed-off-by: Arthur Demchenkov Tested-by: Merlijn Wajer Reviewed-by: Roger Quadros Signed-off-by: Tony Lindgren commit cfaf6051eccc7b8b2354f68c5125d2497b046052 Author: Tony Lindgren Date: Mon Mar 9 09:41:14 2020 -0700 bus: ti-sysc: Fix quirk flags for lcdc on am335x Commit adb72394e2ab ("ARM: OMAP2+: Drop legacy platform data for am3 lcdc") dropped legacy platform data but we never added the quirks for SWSUP_SIDLE and SWSUP_MSTANDBY for lcdc for ti-sysc driver. This breaks suspend/resume. Let's fix the issue by enabling the same quirks for ti-sysc driver as we had earlier with platform data. Fixes: adb72394e2ab ("ARM: OMAP2+: Drop legacy platform data for am3 lcdc") Fixes: 23731eac9848 ("bus: ti-sysc: Detect devices on am335x when DEBUG is enabled") Reported-by: Keerthy Cc: Jyri Sarha Cc: Keerthy Cc: Dave Gerlach Cc: Tero Kristo Tested-by: Dave Gerlach Signed-off-by: Tony Lindgren commit 1cada2f307665e208a486d7ac2294ed9a6f74a6f Author: Linus Walleij Date: Mon Mar 9 16:26:04 2020 +0100 pinctrl: qcom: Assign irq_eoi conditionally The hierarchical parts of MSM pinctrl/GPIO is only used when the device tree has a "wakeup-parent" as a phandle, but the .irq_eoi is anyway assigned leading to semantic problems on elder Qualcomm chipsets. When the drivers/mfd/qcom-pm8xxx.c driver calls chained_irq_exit() that call will in turn call chip->irq_eoi() which is set to irq_chip_eoi_parent() by default on a hierachical IRQ chip, and the parent is pinctrl-msm.c so that will in turn unconditionally call irq_chip_eoi_parent() again, but its parent is invalid so we get the following crash: Unnable to handle kernel NULL pointer dereference at virtual address 00000010 pgd = (ptrval) [00000010] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM (...) PC is at irq_chip_eoi_parent+0x4/0x10 LR is at pm8xxx_irq_handler+0x1b4/0x2d8 If we solve this crash by avoiding to call up to irq_chip_eoi_parent(), the machine will hang and get reset by the watchdog, because of semantic issues, probably inside irq_chip. As a solution, just assign the .irq_eoi conditionally if we are actually using a wakeup parent. Cc: David Heidelberg Cc: Bjorn Andersson Cc: Lina Iyer Cc: Stephen Boyd Cc: stable@vger.kernel.org Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy") Link: https://lore.kernel.org/r/20200306121221.1231296-1-linus.walleij@linaro.org Link: https://lore.kernel.org/r/20200309125207.571840-1-linus.walleij@linaro.org Link: https://lore.kernel.org/r/20200309152604.585112-1-linus.walleij@linaro.org Tested-by: David Heidelberg Acked-by: Marc Zyngier Signed-off-by: Linus Walleij commit 1efde2754275dbd9d11c6e0132a4f09facf297ab Author: Masami Hiramatsu Date: Fri Feb 28 00:42:01 2020 +0900 perf probe: Do not depend on dwfl_module_addrsym() Do not depend on dwfl_module_addrsym() because it can fail on user-space shared libraries. Actually, same bug was fixed by commit 664fee3dc379 ("perf probe: Do not use dwfl_module_addrsym if dwarf_diename finds symbol name"), but commit 07d369857808 ("perf probe: Fix wrong address verification) reverted to get actual symbol address from symtab. This fixes it again by getting symbol address from DIE, and only if the DIE has only address range, it uses dwfl_module_addrsym(). Fixes: 07d369857808 ("perf probe: Fix wrong address verification) Reported-by: Alexandre Ghiti Signed-off-by: Masami Hiramatsu Tested-by: Alexandre Ghiti Cc: Alexander Shishkin Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sasha Levin Link: http://lore.kernel.org/lkml/158281812176.476.14164573830975116234.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 6b8d68f1ce9266b05a55e93c62923ff51daae4c1 Author: Masami Hiramatsu Date: Fri Feb 28 16:57:42 2020 +0900 perf probe: Fix to delete multiple probe event When we put an event with multiple probes, perf-probe fails to delete with filters. This comes from a failure to list up the event name because of overwrapping its name. To fix this issue, skip to list up the event which has same name. Without this patch: # perf probe -l \* probe_perf:map__map_ip (on perf_sample__fprintf_brstackoff:21@ probe_perf:map__map_ip (on perf_sample__fprintf_brstackoff:25@ probe_perf:map__map_ip (on append_inlines:12@util/machine.c in probe_perf:map__map_ip (on unwind_entry:19@util/machine.c in / probe_perf:map__map_ip (on map__map_ip@util/map.h in /home/mhi probe_perf:map__map_ip (on map__map_ip@util/map.h in /home/mhi # perf probe -d \* "*" does not hit any event. Error: Failed to delete events. Reason: No such file or directory (Code: -2) With it: # perf probe -d \* Removed event: probe_perf:map__map_ip # Fixes: 72363540c009 ("perf probe: Support multiprobe event") Reported-by: Arnaldo Carvalho de Melo Reported-by: He Zhe Signed-off-by: Masami Hiramatsu Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: stable@vger.kernel.org Link: http://lore.kernel.org/lkml/158287666197.16697.7514373548551863562.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 05e54e2386733dfdb62b6784b3d6e1b0bd9bb559 Author: Ian Rogers Date: Fri Mar 6 23:31:21 2020 -0800 perf parse-events: Fix reading of invalid memory in event parsing ADD_CONFIG_TERM accesses term->weak, however, in get_config_chgs this value is accessed outside of the list_for_each_entry and references invalid memory. Add an argument for ADD_CONFIG_TERM for weak and set it to false in the get_config_chgs case. This bug was cause by clang's address sanitizer and libfuzzer. It can be reproduced with a command line of: perf stat -a -e i/bs,tsc,L2/o Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20200307073121.203816-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a7ffd416d80497f03d1f62c0b330cff76a86d5ad Author: Ilie Halip Date: Mon Mar 9 10:56:17 2020 +0200 perf python: Fix clang detection when using CC=clang-version Currently, the setup.py script detects the clang compiler only when invoked with CC=clang. But when using a specific version (e.g. CC=clang-11), this doesn't work correctly and wrong compiler flags are set, leading to build errors. To properly detect clang, invoke the compiler with -v and check the output. The first line should start with "clang version ...". Committer testing: $ make CC=clang-9 O=/tmp/build/perf -C tools/perf install-bin $ readelf -wi /tmp/build/perf/python/perf.cpython-37m-x86_64-linux-gnu.so | grep DW_AT_producer | head -1 DW_AT_producer : (indirect string, offset: 0x0): clang version 9.0.1 (Fedora 9.0.1-2.fc31) /usr/bin/clang-9 -Wno-unused-result -Wsign-compare -D DYNAMIC_ANNOTATIONS_ENABLED=1 -D NDEBUG -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-command-line -m64 -mtune=generic -fasynchronous-unwind-tables -fcf-protection=full -D _GNU_SOURCE -fPIC -fwrapv -Wbad-function-cast -Wdeclaration-after-statement -Wformat-security -Wformat-y2k -Winit-self -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wno-system-headers -Wold-style-definition -Wpacked -Wredundant-decls -Wstrict-prototypes -Wswitch-default -Wswitch-enum -Wundef -Wwrite-strings -Wformat -Wshadow -D HAVE_ARCH_X86_64_SUPPORT -I /tmp/build/perf/arch/x86/include/generated -D HAVE_SYSCALL_TABLE_SUPPORT -D HAVE_PERF_REGS_SUPPORT -D HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET -Werror -O3 -fno-omit-frame-pointer -ggdb3 -funwind-tables -Wall -Wextra -std=gnu99 -fstack-protector-all -D _FORTIFY_SOURCE=2 -D _LARGEFILE64_SOURCE -D _FILE_OFFSET_BITS=64 -D _GNU_SOURCE -I /home/acme/git/perf/tools/lib/perf/include -I /home/acme/git/perf/tools/perf/util/include -I /home/acme/git/perf/tools/perf/arch/x86/include -I /home/acme/git/perf/tools/include/ -I /home/acme/git/perf/tools/arch/x86/include/uapi -I /home/acme/git/perf/tools/include/uapi -I /home/acme/git/perf/tools/arch/x86/include/ -I /home/acme/git/perf/tools/arch/x86/ -I /tmp/build/perf//util -I /tmp/build/perf/ -I /home/acme/git/perf/tools/perf/util -I /home/acme/git/perf/tools/perf -I /home/acme/git/perf/tools/lib/ -D HAVE_PTHREAD_ATTR_SETAFFINITY_NP -D HAVE_PTHREAD_BARRIER -D HAVE_EVENTFD -D HAVE_GET_CURRENT_DIR_NAME -D HAVE_GETTID -D HAVE_DWARF_GETLOCATIONS_SUPPORT -D HAVE_GLIBC_SUPPORT -D HAVE_AIO_SUPPORT -D HAVE_SCHED_GETCPU_SUPPORT -D HAVE_SETNS_SUPPORT -D HAVE_LIBELF_SUPPORT -D HAVE_LIBELF_MMAP_SUPPORT -D HAVE_ELF_GETPHDRNUM_SUPPORT -D HAVE_GELF_GETNOTE_SUPPORT -D HAVE_ELF_GETSHDRSTRNDX_SUPPORT -D HAVE_DWARF_SUPPORT -D HAVE_LIBBPF_SUPPORT -D HAVE_BPF_PROLOGUE -D HAVE_SDT_EVENT -D HAVE_JITDUMP -D HAVE_DWARF_UNWIND_SUPPORT -D NO_LIBUNWIND_DEBUG_FRAME -D HAVE_LIBUNWIND_SUPPORT -D HAVE_LIBCRYPTO_SUPPORT -D HAVE_SLANG_SUPPORT -D HAVE_GTK2_SUPPORT -D NO_LIBPERL -D HAVE_TIMERFD_SUPPORT -D HAVE_LIBPYTHON_SUPPORT -D HAVE_CPLUS_DEMANGLE_SUPPORT -D HAVE_LIBBFD_SUPPORT -D HAVE_ZLIB_SUPPORT -D HAVE_LZMA_SUPPORT -D HAVE_ZSTD_SUPPORT -D HAVE_LIBCAP_SUPPORT -D HAVE_BACKTRACE_SUPPORT -D HAVE_LIBNUMA_SUPPORT -D HAVE_KVM_STAT_SUPPORT -D DISASM_FOUR_ARGS_SIGNATURE -D HAVE_LIBBABELTRACE_SUPPORT -D HAVE_AUXTRACE_SUPPORT -D HAVE_JVMTI_CMLR -I /tmp/build/perf/ -fPIC -I util/include -I /usr/include/python3.7m -c /home/acme/git/perf/tools/perf/util/python.c -o /tmp/build/perf/python_ext_build/tmp/home/acme/git/perf/tools/perf/util/python.o -Wbad-function-cast -Wdeclaration-after-statement -Wformat-security -Wformat-y2k -Winit-self -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wno-system-headers -Wold-style-definition -Wpacked -Wredundant-decls -Wstrict-prototypes -Wswitch-default -Wswitch-enum -Wundef -Wwrite-strings -Wformat -Wshadow -D HAVE_ARCH_X86_64_SUPPORT -I /tmp/build/perf/arch/x86/include/generated -D HAVE_SYSCALL_TABLE_SUPPORT -D HAVE_PERF_REGS_SUPPORT -D HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET -Werror -O3 -fno-omit-frame-pointer -ggdb3 -funwind-tables -Wall -Wextra -std=gnu99 -fstack-protector-all -D _FORTIFY_SOURCE=2 -D _LARGEFILE64_SOURCE -D _FILE_OFFSET_BITS=64 -D _GNU_SOURCE -I /home/acme/git/perf/tools/lib/perf/include -I /home/acme/git/perf/tools/perf/util/include -I /home/acme/git/perf/tools/perf/arch/x86/include -I /home/acme/git/perf/tools/include/ -I /home/acme/git/perf/tools/arch/x86/include/uapi -I /home/acme/git/perf/tools/include/uapi -I /home/acme/git/perf/tools/arch/x86/include/ -I /home/acme/git/perf/tools/arch/x86/ -I /tmp/build/perf//util -I /tmp/build/perf/ -I /home/acme/git/perf/tools/perf/util -I /home/acme/git/perf/tools/perf -I /home/acme/git/perf/tools/lib/ -D HAVE_PTHREAD_ATTR_SETAFFINITY_NP -D HAVE_PTHREAD_BARRIER -D HAVE_EVENTFD -D HAVE_GET_CURRENT_DIR_NAME -D HAVE_GETTID -D HAVE_DWARF_GETLOCATIONS_SUPPORT -D HAVE_GLIBC_SUPPORT -D HAVE_AIO_SUPPORT -D HAVE_SCHED_GETCPU_SUPPORT -D HAVE_SETNS_SUPPORT -D HAVE_LIBELF_SUPPORT -D HAVE_LIBELF_MMAP_SUPPORT -D HAVE_ELF_GETPHDRNUM_SUPPORT -D HAVE_GELF_GETNOTE_SUPPORT -D HAVE_ELF_GETSHDRSTRNDX_SUPPORT -D HAVE_DWARF_SUPPORT -D HAVE_LIBBPF_SUPPORT -D HAVE_BPF_PROLOGUE -D HAVE_SDT_EVENT -D HAVE_JITDUMP -D HAVE_DWARF_UNWIND_SUPPORT -D NO_LIBUNWIND_DEBUG_FRAME -D HAVE_LIBUNWIND_SUPPORT -D HAVE_LIBCRYPTO_SUPPORT -D HAVE_SLANG_SUPPORT -D HAVE_GTK2_SUPPORT -D NO_LIBPERL -D HAVE_TIMERFD_SUPPORT -D HAVE_LIBPYTHON_SUPPORT -D HAVE_CPLUS_DEMANGLE_SUPPORT -D HAVE_LIBBFD_SUPPORT -D HAVE_ZLIB_SUPPORT -D HAVE_LZMA_SUPPORT -D HAVE_ZSTD_SUPPORT -D HAVE_LIBCAP_SUPPORT -D HAVE_BACKTRACE_SUPPORT -D HAVE_LIBNUMA_SUPPORT -D HAVE_KVM_STAT_SUPPORT -D DISASM_FOUR_ARGS_SIGNATURE -D HAVE_LIBBABELTRACE_SUPPORT -D HAVE_AUXTRACE_SUPPORT -D HAVE_JVMTI_CMLR -I /tmp/build/perf/ -fno-strict-aliasing -Wno-write-strings -Wno-unused-parameter -Wno-redundant-decls $ And here is how tools/perf/util/setup.py checks if the used clang has options that the distro specific python extension building compiler defaults: if cc_is_clang: from distutils.sysconfig import get_config_vars vars = get_config_vars() for var in ('CFLAGS', 'OPT'): vars[var] = sub("-specs=[^ ]+", "", vars[var]) if not clang_has_option("-mcet"): vars[var] = sub("-mcet", "", vars[var]) if not clang_has_option("-fcf-protection"): vars[var] = sub("-fcf-protection", "", vars[var]) if not clang_has_option("-fstack-clash-protection"): vars[var] = sub("-fstack-clash-protection", "", vars[var]) if not clang_has_option("-fstack-protector-strong"): vars[var] = sub("-fstack-protector-strong", "", vars[var]) So "-fcf-protection=full" is used, clang-9 has this option and thus it was kept, the perf python extension was built with it and the build completed successfully. Link: https://github.com/ClangBuiltLinux/linux/issues/903 Signed-off-by: Ilie Halip Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Igor Lubashev Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20200309085618.14307-1-ilie.halip@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit d62e7fbea4951c124a24176da0c7bf3003ec53d4 Author: Mathias Kresin Date: Thu Mar 5 19:22:45 2020 +0100 pinctrl: falcon: fix syntax error Add the missing semicolon after of_node_put to get the file compiled. Fixes: f17d2f54d36d ("pinctrl: falcon: Add of_node_put() before return") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Mathias Kresin Link: https://lore.kernel.org/r/20200305182245.9636-1-dev@kresin.me Acked-by: Thomas Langer Signed-off-by: Linus Walleij commit f98371476f36359da2285d1807b43e5b17fd18de Author: Linus Walleij Date: Fri Mar 6 15:34:15 2020 +0100 pinctrl: qcom: ssbi-gpio: Fix fwspec parsing bug We are parsing SSBI gpios as fourcell fwspecs but they are twocell. Probably a simple copy-and-paste bug. Tested on the APQ8060 DragonBoard and after this ethernet and MMC card detection works again. Cc: Bjorn Andersson Cc: stable@vger.kernel.org Reviewed-by: Brian Masney Fixes: ae436fe81053 ("pinctrl: ssbi-gpio: convert to hierarchical IRQ helpers in gpio core") Link: https://lore.kernel.org/r/20200306143416.1476250-1-linus.walleij@linaro.org Signed-off-by: Linus Walleij commit db2c549407d4a76563c579e4768f7d6d32afefba Author: disconnect3d Date: Mon Mar 9 11:48:53 2020 +0100 perf map: Fix off by one in strncpy() size argument This patch fixes an off-by-one error in strncpy size argument in tools/perf/util/map.c. The issue is that in: strncmp(filename, "/system/lib/", 11) the passed string literal: "/system/lib/" has 12 bytes (without the NULL byte) and the passed size argument is 11. As a result, the logic won't match the ending "/" byte and will pass filepaths that are stored in other directories e.g. "/system/libmalicious/bin" or just "/system/libmalicious". This functionality seems to be present only on Android. I assume the /system/ directory is only writable by the root user, so I don't think this bug has much (or any) security impact. Fixes: eca818369996 ("perf tools: Add automatic remapping of Android libraries") Signed-off-by: disconnect3d Cc: Alexander Shishkin Cc: Changbin Du Cc: Jiri Olsa Cc: John Keeping Cc: Mark Rutland Cc: Michael Lentine Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20200309104855.3775-1-dominik.b.czarnota@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit f7d5f5655ef7e5d2a128f6696ac35256e83b119b Author: Thomas Bogendoerfer Date: Sat Mar 7 10:00:22 2020 +0100 MAINTAINERS: Correct MIPS patchwork URL MIPS patchwork lives on patchwork.kernel.org for quite some time. Signed-off-by: Thomas Bogendoerfer commit d683469b3c93d7e2afd39e6e1970f24700eb7a68 Author: Takashi Iwai Date: Mon Mar 9 10:59:22 2020 +0100 ALSA: line6: Fix endless MIDI read loop The MIDI input event parser of the LINE6 driver may enter into an endless loop when the unexpected data sequence is given, as it tries to continue the secondary bytes without termination. Also, when the input data is too short, the parser returns a negative error, while the caller doesn't handle it properly. This would lead to the unexpected behavior as well. This patch addresses those issues by checking the return value correctly and handling the one-byte event in the parser properly. The bug was reported by syzkaller. Reported-by: syzbot+cce32521ee0a824c21f7@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/000000000000033087059f8f8fa3@google.com Link: https://lore.kernel.org/r/20200309095922.30269-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f2ecf903ef06eb1bbbfa969db9889643d487e73a Author: Takashi Iwai Date: Mon Mar 9 09:21:48 2020 +0100 ALSA: pcm: oss: Avoid plugin buffer overflow Each OSS PCM plugins allocate its internal buffer per pre-calculation of the max buffer size through the chain of plugins (calling src_frames and dst_frames callbacks). This works for most plugins, but the rate plugin might behave incorrectly. The calculation in the rate plugin involves with the fractional position, i.e. it may vary depending on the input position. Since the buffer size pre-calculation is always done with the offset zero, it may return a shorter size than it might be; this may result in the out-of-bound access as spotted by fuzzer. This patch addresses those possible buffer overflow accesses by simply setting the upper limit per the given buffer size for each plugin before src_frames() and after dst_frames() calls. Reported-by: syzbot+e1fe9f44fb8ecf4fb5dd@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/000000000000b25ea005a02bcf21@google.com Link: https://lore.kernel.org/r/20200309082148.19855-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 83f73c5bb7b9a9135173f0ba2b1aa00c06664ff9 Author: Dmitry Yakunin Date: Thu Mar 5 15:33:12 2020 +0300 inet_diag: return classid for all socket types In commit 1ec17dbd90f8 ("inet_diag: fix reporting cgroup classid and fallback to priority") croup classid reporting was fixed. But this works only for TCP sockets because for other socket types icsk parameter can be NULL and classid code path is skipped. This change moves classid handling to inet_diag_msg_attrs_fill() function. Also inet_diag_msg_attrs_size() helper was added and addends in nlmsg_new() were reordered to save order from inet_sk_diag_fill(). Fixes: 1ec17dbd90f8 ("inet_diag: fix reporting cgroup classid and fallback to priority") Signed-off-by: Dmitry Yakunin Reviewed-by: Konstantin Khlebnikov Signed-off-by: David S. Miller commit b723bd933980f4956dabc8a8d84b3e83be8d094c Author: Remi Pommarel Date: Sun Mar 8 10:25:56 2020 +0100 net: stmmac: dwmac1000: Disable ACS if enhanced descs are not used ACS (auto PAD/FCS stripping) removes FCS off 802.3 packets (LLC) so that there is no need to manually strip it for such packets. The enhanced DMA descriptors allow to flag LLC packets so that the receiving callback can use that to strip FCS manually or not. On the other hand, normal descriptors do not support that. Thus in order to not truncate LLC packet ACS should be disabled when using normal DMA descriptors. Fixes: 47dd7a540b8a0 ("net: add support for STMicroelectronics Ethernet controllers.") Signed-off-by: Remi Pommarel Signed-off-by: David S. Miller commit 17c25cafd4d3e74c83dce56b158843b19c40b414 Author: Eric Dumazet Date: Sat Mar 7 22:05:14 2020 -0800 gre: fix uninit-value in __iptunnel_pull_header syzbot found an interesting case of the kernel reading an uninit-value [1] Problem is in the handling of ETH_P_WCCP in gre_parse_header() We look at the byte following GRE options to eventually decide if the options are four bytes longer. Use skb_header_pointer() to not pull bytes if we found that no more bytes were needed. All callers of gre_parse_header() are properly using pskb_may_pull() anyway before proceeding to next header. [1] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2303 [inline] BUG: KMSAN: uninit-value in __iptunnel_pull_header+0x30c/0xbd0 net/ipv4/ip_tunnel_core.c:94 CPU: 1 PID: 11784 Comm: syz-executor940 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 pskb_may_pull include/linux/skbuff.h:2303 [inline] __iptunnel_pull_header+0x30c/0xbd0 net/ipv4/ip_tunnel_core.c:94 iptunnel_pull_header include/net/ip_tunnels.h:411 [inline] gre_rcv+0x15e/0x19c0 net/ipv6/ip6_gre.c:606 ip6_protocol_deliver_rcu+0x181b/0x22c0 net/ipv6/ip6_input.c:432 ip6_input_finish net/ipv6/ip6_input.c:473 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ip6_input net/ipv6/ip6_input.c:482 [inline] ip6_mc_input+0xdf2/0x1460 net/ipv6/ip6_input.c:576 dst_input include/net/dst.h:442 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ipv6_rcv+0x683/0x710 net/ipv6/ip6_input.c:306 __netif_receive_skb_one_core net/core/dev.c:5198 [inline] __netif_receive_skb net/core/dev.c:5312 [inline] netif_receive_skb_internal net/core/dev.c:5402 [inline] netif_receive_skb+0x66b/0xf20 net/core/dev.c:5461 tun_rx_batched include/linux/skbuff.h:4321 [inline] tun_get_user+0x6aef/0x6f60 drivers/net/tun.c:1997 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa5a/0xca0 fs/read_write.c:496 vfs_write+0x44a/0x8f0 fs/read_write.c:558 ksys_write+0x267/0x450 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f62d99 Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000fffedb2c EFLAGS: 00000217 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002580 RDX: 0000000000000fca RSI: 0000000000000036 RDI: 0000000000000004 RBP: 0000000000008914 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242 tun_alloc_skb drivers/net/tun.c:1529 [inline] tun_get_user+0x10ae/0x6f60 drivers/net/tun.c:1843 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa5a/0xca0 fs/read_write.c:496 vfs_write+0x44a/0x8f0 fs/read_write.c:558 ksys_write+0x267/0x450 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 Fixes: 95f5c64c3c13 ("gre: Move utility functions to common headers") Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 63aae7b17344d4b08a7d05cb07044de4c0f9dcc6 Author: Jiri Wiesner Date: Sat Mar 7 13:31:57 2020 +0100 ipvlan: do not add hardware address of master to its unicast filter list There is a problem when ipvlan slaves are created on a master device that is a vmxnet3 device (ipvlan in VMware guests). The vmxnet3 driver does not support unicast address filtering. When an ipvlan device is brought up in ipvlan_open(), the ipvlan driver calls dev_uc_add() to add the hardware address of the vmxnet3 master device to the unicast address list of the master device, phy_dev->uc. This inevitably leads to the vmxnet3 master device being forced into promiscuous mode by __dev_set_rx_mode(). Promiscuous mode is switched on the master despite the fact that there is still only one hardware address that the master device should use for filtering in order for the ipvlan device to be able to receive packets. The comment above struct net_device describes the uc_promisc member as a "counter, that indicates, that promiscuous mode has been enabled due to the need to listen to additional unicast addresses in a device that does not implement ndo_set_rx_mode()". Moreover, the design of ipvlan guarantees that only the hardware address of a master device, phy_dev->dev_addr, will be used to transmit and receive all packets from its ipvlan slaves. Thus, the unicast address list of the master device should not be modified by ipvlan_open() and ipvlan_stop() in order to make ipvlan a workable option on masters that do not support unicast address filtering. Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver") Reported-by: Per Sundstrom Signed-off-by: Jiri Wiesner Reviewed-by: Eric Dumazet Acked-by: Mahesh Bandewar Signed-off-by: David S. Miller commit 805b13adde3964c78cba125a15527e88c19f87b3 Author: Jens Axboe Date: Sun Mar 8 20:07:28 2020 -0600 io_uring: ensure RCU callback ordering with rcu_barrier() After more careful studying, Paul informs me that we cannot rely on ordering of RCU callbacks in the way that the the tagged commit did. The current construct looks like this: void C(struct rcu_head *rhp) { do_something(rhp); call_rcu(&p->rh, B); } call_rcu(&p->rh, A); call_rcu(&p->rh, C); and we're relying on ordering between A and B, which isn't guaranteed. Make this explicit instead, and have a work item issue the rcu_barrier() to ensure that A has run before we manually execute B. While thorough testing never showed this issue, it's dependent on the per-cpu load in terms of RCU callbacks. The updated method simplifies the code as well, and eliminates the need to maintain an rcu_head in the fileset data. Fixes: c1e2148f8ecb ("io_uring: free fixed_file_data after RCU grace period") Reported-by: Paul E. McKenney Signed-off-by: Jens Axboe commit 2c523b344dfa65a3738e7039832044aa133c75fb Author: Linus Torvalds Date: Sun Mar 8 17:44:44 2020 -0700 Linux 5.6-rc5 commit 62790268e4eda1deaac93264af69ac95b4afdf96 Merge: efe582a137ed d4d89e25fc7b Author: Linus Torvalds Date: Sun Mar 8 17:36:22 2020 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "We've been accruing these for a couple of weeks, so the batch is a bit bigger than usual. Largest delta is due to a led-bl driver that is added -- there was a miscommunication before the merge window and the driver didn't make it in. Due to this, the platforms needing it regressed. At this point, it seemed easier to add the new driver than unwind the changes. Besides that, there are a handful of various fixes: - AMD tee memory leak fix - A handful of fixlets for i.MX SCU communication - A few maintainers woke up and realized DEBUG_FS had been missing for a while, so a few updates of that. ... and the usual collection of smaller fixes to various platforms" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (37 commits) ARM: socfpga_defconfig: Add back DEBUG_FS arm64: dts: socfpga: agilex: Fix gmac compatible ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS arm64: dts: meson: fix gxm-khadas-vim2 wifi arm64: dts: meson-sm1-sei610: add missing interrupt-names ARM: meson: Drop unneeded select of COMMON_CLK ARM: dts: bcm2711: Add pcie0 alias ARM: dts: bcm283x: Add missing properties to the PWR LED tee: amdtee: fix memory leak in amdtee_open_session() ARM: OMAP2+: Fix compile if CONFIG_HAVE_ARM_SMCCC is not set arm: dts: dra76x: Fix mmc3 max-frequency ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes bus: ti-sysc: Fix 1-wire reset quirk ARM: dts: r8a7779: Remove deprecated "renesas, rcar-sata" compatible value soc: imx-scu: Align imx sc msg structs to 4 firmware: imx: Align imx_sc_msg_req_cpu_start to 4 firmware: imx: scu-pd: Align imx sc msg structs to 4 firmware: imx: misc: Align imx sc msg structs to 4 firmware: imx: scu: Ensure sequential TX ARM: dts: imx7-colibri: Fix frequency for sd/mmc ... commit efe582a137eda93265d880494cb04370afd162f2 Merge: 378fee2e6b12 dfc6014e3b60 Author: Linus Torvalds Date: Sun Mar 8 17:33:52 2020 -0700 Merge tag 'edac_urgent-2020-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: "Error reporting fix for synopsys_edac: do not overwrite partial decoded error message (Sherry Sun)" * tag 'edac_urgent-2020-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/synopsys: Do not print an error with back-to-back snprintf() calls commit 10856d88f7653b42196ca5b2775bbc1f15122a58 Author: YueHaibing Date: Wed Mar 4 19:34:23 2020 +0800 iio: ping: set pa_laser_ping_cfg in of_ping_match pa_laser_ping_cfg should be set in of_ping_match instead of pa_ping_cfg. Fixes: 7bb501f49ddb ("iio: ping: add parallax ping sensors") Signed-off-by: YueHaibing Acked-by: Andreas Klinger Signed-off-by: Jonathan Cameron commit 016a8845f6da65b2203f102f192046fbb624e250 Author: Petr Štetiar Date: Thu Feb 27 17:27:34 2020 +0100 iio: chemical: sps30: fix missing triggered buffer dependency SPS30 uses triggered buffer, but the dependency is not specified in the Kconfig file. Fix this by selecting IIO_BUFFER and IIO_TRIGGERED_BUFFER config symbols. Cc: stable@vger.kernel.org Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor") Signed-off-by: Petr Štetiar Signed-off-by: Jonathan Cameron commit e43d110cdc206b6df4dd438cd10c81d1da910aad Author: Wen-chien Jesse Sung Date: Mon Feb 24 17:54:26 2020 +0800 iio: st_sensors: remap SMO8840 to LIS2DH12 According to ST, the HID is for LIS2DH12. Fixes: 3d56e19815b3 ("iio: accel: st_accel: Add support for the SMO8840 ACPI id") Signed-off-by: Wen-chien Jesse Sung Tested-by: Hans de Goede Reviewed-by: Hans de Goede Cc: Signed-off-by: Jonathan Cameron commit 2ca5a8792d617b4035aacd0a8be527f667fbf912 Author: Tomas Novotny Date: Tue Feb 18 16:44:51 2020 +0100 iio: light: vcnl4000: update sampling periods for vcnl4040 Vishay has published a new version of "Designing the VCNL4200 Into an Application" application note in October 2019. The new version specifies that there is +-20% of part to part tolerance. Although the application note is related to vcnl4200, according to support the vcnl4040's "ASIC is quite similar to that one for the VCNL4200". So update the sampling periods (and comment), including the correct sampling period for proximity. Both sampling periods are lower. Users relying on the blocking behaviour of reading will get proximity measurements much earlier. Fixes: 5a441aade5b3 ("iio: light: vcnl4000 add support for the VCNL4040 proximity and light sensor") Reviewed-by: Guido Günther Tested-by: Guido Günther Signed-off-by: Tomas Novotny Cc: Signed-off-by: Jonathan Cameron commit b42aa97ed5f1169cfd37175ef388ea62ff2dcf43 Author: Tomas Novotny Date: Tue Feb 18 16:44:50 2020 +0100 iio: light: vcnl4000: update sampling periods for vcnl4200 Vishay has published a new version of "Designing the VCNL4200 Into an Application" application note in October 2019. The new version specifies that there is +-20% of part to part tolerance. This explains the drift seen during experiments. The proximity pulse width is also changed from 32us to 30us. According to the support, the tolerance also applies to ambient light. So update the sampling periods. As the reading is blocking, current users may notice slightly longer response time. Fixes: be38866fbb97 ("iio: vcnl4000: add support for VCNL4200") Reviewed-by: Guido Günther Signed-off-by: Tomas Novotny Cc: Signed-off-by: Jonathan Cameron commit cb2116ff97859d34fda6cb561ac654415f4c6230 Author: Alexandru Tachici Date: Wed Feb 19 16:31:12 2020 +0200 iio: accel: adxl372: Set iio_chan BE Data stored in the iio-buffer is BE and this should be specified in the iio_chan_spec struct. Fixes: f4f55ce38e5f8 ("iio:adxl372: Add FIFO and interrupts support") Signed-off-by: Alexandru Tachici Cc: Signed-off-by: Jonathan Cameron commit 378fee2e6b12f31ab3749e0aa4ed0a63be23e822 Merge: b34e5c13327e f0fe2c0f050d Author: Linus Torvalds Date: Sun Mar 8 10:49:44 2020 -0500 Merge tag 'char-misc-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are four small char/misc driver fixes for reported issues for 5.6-rc5. These fixes are: - binder fix for a potential use-after-free problem found (took two tries to get it right) - interconnect core fix - altera-stapl driver fix All four of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binder: prevent UAF for binderfs devices II interconnect: Handle memory allocation errors altera-stapl: altera_get_note: prevent write beyond end of 'key' binder: prevent UAF for binderfs devices commit b34e5c13327ef723362c88c43da176a439badeea Merge: cc432aee7d5a 77036165d8bc Author: Linus Torvalds Date: Sun Mar 8 10:39:40 2020 -0500 Merge tag 'driver-core-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core and debugfs fixes from Greg KH: "Here are four small driver core / debugfs patches for 5.6-rc3: - debugfs api cleanup now that all debugfs_create_regset32() callers have been fixed up. This was waiting until after the -rc1 merge as these fixes came in through different trees - driver core sync state fixes based on reports of minor issues found in the feature All of these have been in linux-next with no reported issues" * tag 'driver-core-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: driver core: Skip unnecessary work when device doesn't have sync_state() driver core: Add dev_has_sync_state() driver core: Call sync_state() even if supplier has no consumers debugfs: remove return value of debugfs_create_regset32() commit cc432aee7d5a5cd6c8ae4dd9f5bae56428d1fca2 Merge: fd3f6cc9806c 2b2e71fe6575 Author: Linus Torvalds Date: Sun Mar 8 10:35:04 2020 -0500 Merge tag 'tty-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty/serial fixes for 5.6-rc5 Just some small serial driver fixes, and a vt core fixup, full details are: - vt fixes for issues found by syzbot - serdev fix for Apple boxes - fsl_lpuart serial driver fixes - MAINTAINER update for incorrect serial files - new device ids for 8250_exar driver - mvebu-uart fix All of these have been in linux-next with no reported issues" * tag 'tty-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: serial: fsl_lpuart: free IDs allocated by IDA Revert "tty: serial: fsl_lpuart: drop EARLYCON_DECLARE" serdev: Fix detection of UART devices on Apple machines. MAINTAINERS: Add missed files related to Synopsys DesignWare UART serial: 8250_exar: add support for ACCES cards tty:serial:mvebu-uart:fix a wrong return vt: selection, push sel_lock up vt: selection, push console lock down commit fd3f6cc9806c2f10b886f3ad78c9e192fb1bffd9 Merge: 61a09258f2e5 19f3c1e98bd1 Author: Linus Torvalds Date: Sun Mar 8 10:32:23 2020 -0500 Merge tag 'usb-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY fixes from Greg KH: "Here are some small USB and PHY driver fixes for reported issues for 5.6-rc5. Included in here are: - phy driver fixes - new USB quirks - USB cdns3 gadget driver fixes - USB hub core fixes All of these have been in linux-next with no reported issues" * tag 'usb-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: dwc3: gadget: Update chain bit correctly when using sg list usb: core: port: do error out if usb_autopm_get_interface() fails usb: core: hub: do error out if usb_autopm_get_interface() fails usb: core: hub: fix unhandled return by employing a void function usb: storage: Add quirk for Samsung Fit flash usb: quirks: add NO_LPM quirk for Logitech Screen Share usb: usb251xb: fix regulator probe and error handling phy: allwinner: Fix GENMASK misuse usb: cdns3: gadget: toggle cycle bit before reset endpoint usb: cdns3: gadget: link trb should point to next request phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling phy: brcm-sata: Correct MDIO operations for 40nm platforms phy: ti: gmii-sel: do not fail in case of gmii phy: ti: gmii-sel: fix set of copy-paste errors phy: core: Fix phy_get() to not return error on link creation failure phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval commit b26ebfe12f34f372cf041c6f801fa49c3fb382c5 Author: Corey Minyard Date: Fri Mar 6 11:23:14 2020 -0600 pid: Fix error return value in some cases Recent changes to alloc_pid() allow the pid number to be specified on the command line. If set_tid_size is set, then the code scanning the levels will hard-set retval to -EPERM, overriding it's previous -ENOMEM value. After the code scanning the levels, there are error returns that do not set retval, assuming it is still set to -ENOMEM. So set retval back to -ENOMEM after scanning the levels. Fixes: 49cb2fc42ce4 ("fork: extend clone3() to support setting a PID") Signed-off-by: Corey Minyard Acked-by: Christian Brauner Cc: Andrei Vagin Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Oleg Nesterov Cc: Adrian Reber Cc: # 5.5 Link: https://lore.kernel.org/r/20200306172314.12232-1-minyard@acm.org [christian.brauner@ubuntu.com: fixup commit message] Signed-off-by: Christian Brauner commit 6ae4edab2fbf86ec92fbf0a8f0c60b857d90d50f Author: Nathan Chancellor Date: Sat Feb 15 17:40:39 2020 -0700 virtio_balloon: Adjust label in virtballoon_probe Clang warns when CONFIG_BALLOON_COMPACTION is unset: ../drivers/virtio/virtio_balloon.c:963:1: warning: unused label 'out_del_vqs' [-Wunused-label] out_del_vqs: ^~~~~~~~~~~~ 1 warning generated. Move the label within the preprocessor block since it is only used when CONFIG_BALLOON_COMPACTION is set. Fixes: 1ad6f58ea936 ("virtio_balloon: Fix memory leaks on errors in virtballoon_probe()") Link: https://github.com/ClangBuiltLinux/linux/issues/886 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20200216004039.23464-1-natechancellor@gmail.com Signed-off-by: Michael S. Tsirkin Reviewed-by: David Hildenbrand commit 3d973b2e9a625996ee997c7303cd793b9d197c65 Author: Halil Pasic Date: Thu Feb 13 13:37:28 2020 +0100 virtio-blk: improve virtqueue error to BLK_STS Let's change the mapping between virtqueue_add errors to BLK_STS statuses, so that -ENOSPC, which indicates virtqueue full is still mapped to BLK_STS_DEV_RESOURCE, but -ENOMEM which indicates non-device specific resource outage is mapped to BLK_STS_RESOURCE. Signed-off-by: Halil Pasic Link: https://lore.kernel.org/r/20200213123728.61216-3-pasic@linux.ibm.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit f5f6b95c72f7f8bb46eace8c5306c752d0133daa Author: Halil Pasic Date: Thu Feb 13 13:37:27 2020 +0100 virtio-blk: fix hw_queue stopped on arbitrary error Since nobody else is going to restart our hw_queue for us, the blk_mq_start_stopped_hw_queues() is in virtblk_done() is not sufficient necessarily sufficient to ensure that the queue will get started again. In case of global resource outage (-ENOMEM because mapping failure, because of swiotlb full) our virtqueue may be empty and we can get stuck with a stopped hw_queue. Let us not stop the queue on arbitrary errors, but only on -EONSPC which indicates a full virtqueue, where the hw_queue is guaranteed to get started by virtblk_done() before when it makes sense to carry on submitting requests. Let us also remove a stale comment. Signed-off-by: Halil Pasic Cc: Jens Axboe Fixes: f7728002c1c7 ("virtio_ring: fix return code on DMA mapping fails") Link: https://lore.kernel.org/r/20200213123728.61216-2-pasic@linux.ibm.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit f13f09a12cbd0c7b776e083c5d008b6c6a9c4e0b Author: Suman Anna Date: Mon Feb 24 15:26:43 2020 -0600 virtio_ring: Fix mem leak with vring_new_virtqueue() The functions vring_new_virtqueue() and __vring_new_virtqueue() are used with split rings, and any allocations within these functions are managed outside of the .we_own_ring flag. The commit cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately") allocates the desc state within the __vring_new_virtqueue() but frees it only when the .we_own_ring flag is set. This leads to a memory leak when freeing such allocated virtqueues with the vring_del_virtqueue() function. Fix this by moving the desc_state free code outside the flag and only for split rings. Issue was discovered during testing with remoteproc and virtio_rpmsg. Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately") Signed-off-by: Suman Anna Link: https://lore.kernel.org/r/20200224212643.30672-1-s-anna@ti.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit d6c066fda90d578aacdf19771a027ed484a79825 Author: Vladis Dronov Date: Sun Mar 8 09:08:55 2020 +0100 efi: Add a sanity check to efivar_store_raw() Add a sanity check to efivar_store_raw() the same way efivar_{attr,size,data}_read() and efivar_show_raw() have it. Signed-off-by: Vladis Dronov Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: Link: https://lore.kernel.org/r/20200305084041.24053-3-vdronov@redhat.com Link: https://lore.kernel.org/r/20200308080859.21568-25-ardb@kernel.org commit 286d3250c9d6437340203fb64938bea344729a0e Author: Vladis Dronov Date: Sun Mar 8 09:08:54 2020 +0100 efi: Fix a race and a buffer overflow while reading efivars via sysfs There is a race and a buffer overflow corrupting a kernel memory while reading an EFI variable with a size more than 1024 bytes via the older sysfs method. This happens because accessing struct efi_variable in efivar_{attr,size,data}_read() and friends is not protected from a concurrent access leading to a kernel memory corruption and, at best, to a crash. The race scenario is the following: CPU0: CPU1: efivar_attr_read() var->DataSize = 1024; efivar_entry_get(... &var->DataSize) down_interruptible(&efivars_lock) efivar_attr_read() // same EFI var var->DataSize = 1024; efivar_entry_get(... &var->DataSize) down_interruptible(&efivars_lock) virt_efi_get_variable() // returns EFI_BUFFER_TOO_SMALL but // var->DataSize is set to a real // var size more than 1024 bytes up(&efivars_lock) virt_efi_get_variable() // called with var->DataSize set // to a real var size, returns // successfully and overwrites // a 1024-bytes kernel buffer up(&efivars_lock) This can be reproduced by concurrent reading of an EFI variable which size is more than 1024 bytes: ts# for cpu in $(seq 0 $(nproc --ignore=1)); do ( taskset -c $cpu \ cat /sys/firmware/efi/vars/KEKDefault*/size & ) ; done Fix this by using a local variable for a var's data buffer size so it does not get overwritten. Fixes: e14ab23dde12b80d ("efivars: efivar_entry API") Reported-by: Bob Sanders and the LTP testsuite Signed-off-by: Vladis Dronov Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: Link: https://lore.kernel.org/r/20200305084041.24053-2-vdronov@redhat.com Link: https://lore.kernel.org/r/20200308080859.21568-24-ardb@kernel.org commit 2b4eae95c7361e0a147b838715c8baa1380a428f Author: Eric Biggers Date: Thu Mar 5 00:41:38 2020 -0800 fscrypt: don't evict dirty inodes after removing key After FS_IOC_REMOVE_ENCRYPTION_KEY removes a key, it syncs the filesystem and tries to get and put all inodes that were unlocked by the key so that unused inodes get evicted via fscrypt_drop_inode(). Normally, the inodes are all clean due to the sync. However, after the filesystem is sync'ed, userspace can modify and close one of the files. (Userspace is *supposed* to close the files before removing the key. But it doesn't always happen, and the kernel can't assume it.) This causes the inode to be dirtied and have i_count == 0. Then, fscrypt_drop_inode() failed to consider this case and indicated that the inode can be dropped, causing the write to be lost. On f2fs, other problems such as a filesystem freeze could occur due to the inode being freed while still on f2fs's dirty inode list. Fix this bug by making fscrypt_drop_inode() only drop clean inodes. I've written an xfstest which detects this bug on ext4, f2fs, and ubifs. Fixes: b1c0ec3599f4 ("fscrypt: add FS_IOC_REMOVE_ENCRYPTION_KEY ioctl") Cc: # v5.4+ Link: https://lore.kernel.org/r/20200305084138.653498-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 61a09258f2e5b48ad0605131cae9a33ce4d01a9d Merge: c20037652700 810dbc69087b Author: Linus Torvalds Date: Sat Mar 7 19:52:55 2020 -0600 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Nothing particularly exciting, some small ODP regressions from the mmu notifier rework, another bunch of syzkaller fixes, and a bug fix for a botched syzkaller fix in the first rc pull request. - Fix busted syzkaller fix in 'get_new_pps' - this turned out to crash on certain HW configurations - Bug fixes for various missed things in error unwinds - Add a missing rcu_read_lock annotation in hfi/qib - Fix two ODP related regressions from the recent mmu notifier changes - Several more syzkaller bugs in siw, RDMA netlink, verbs and iwcm - Revert an old patch in CMA as it is now shown to not be allocating port numbers properly" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/iwcm: Fix iwcm work deallocation RDMA/siw: Fix failure handling during device creation RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing RDMA/odp: Ensure the mm is still alive before creating an implicit child RDMA/core: Fix protection fault in ib_mr_pool_destroy IB/mlx5: Fix implicit ODP race IB/hfi1, qib: Ensure RCU is locked when accessing list RDMA/core: Fix pkey and port assignment in get_new_pps RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() RDMA/rw: Fix error flow during RDMA context initialization RDMA/core: Fix use of logical OR in get_new_pps Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" commit c20037652700024cffeb6b0f74306ce9b391248f Merge: 5dfcc13902bf f0e20b894350 Author: Linus Torvalds Date: Sat Mar 7 14:20:29 2020 -0600 Merge tag 'io_uring-5.6-2020-03-07' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Here are a few io_uring fixes that should go into this release. This contains: - Removal of (now) unused io_wq_flush() and associated flag (Pavel) - Fix cancelation lockup with linked timeouts (Pavel) - Fix for potential use-after-free when freeing percpu ref for fixed file sets - io-wq cancelation fixups (Pavel)" * tag 'io_uring-5.6-2020-03-07' of git://git.kernel.dk/linux-block: io_uring: fix lockup with timeouts io_uring: free fixed_file_data after RCU grace period io-wq: remove io_wq_flush and IO_WQ_WORK_INTERNAL io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation commit 5dfcc13902bfb6d252b84e234bfc4cdba76c1069 Merge: 6f784a3179dc 14afc5936197 Author: Linus Torvalds Date: Sat Mar 7 14:14:38 2020 -0600 Merge tag 'block-5.6-2020-03-07' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Here are a few fixes that should go into this release. This contains: - Revert of a bad bcache patch from this merge window - Removed unused function (Daniel) - Fixup for the blktrace fix from Jan from this release (Cengiz) - Fix of deeper level bfqq overwrite in BFQ (Carlo)" * tag 'block-5.6-2020-03-07' of git://git.kernel.dk/linux-block: block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() blktrace: fix dereference after null check Revert "bcache: ignore pending signals when creating gc and allocator thread" block: Remove used kblockd_schedule_work_on() commit 6f784a3179dce0d3e9ab5413766e2fd9631d3521 Merge: 9d588f636027 d171c45da874 Author: Linus Torvalds Date: Sat Mar 7 12:00:13 2020 -0600 Merge tag 'media/v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - a fix for the media controller links in both hantro driver and in v4l2-mem2mem core - some fixes for the pulse8-cec driver - vicodec: handle alpha channel for RGB32 formats, as it may be used - mc-entity.c: fix handling of pad flags * tag 'media/v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: hantro: Fix broken media controller links media: mc-entity.c: use & to check pad flags, not == media: v4l2-mem2mem.c: fix broken links media: vicodec: process all 4 components for RGB32 formats media: pulse8-cec: close serio in disconnect, not adap_free media: pulse8-cec: INIT_DELAYED_WORK was called too late commit f0e20b8943509d81200cef5e30af2adfddba0f5c Author: Pavel Begunkov Date: Sat Mar 7 01:15:22 2020 +0300 io_uring: fix lockup with timeouts There is a recipe to deadlock the kernel: submit a timeout sqe with a linked_timeout (e.g. test_single_link_timeout_ception() from liburing), and SIGKILL the process. Then, io_kill_timeouts() takes @ctx->completion_lock, but the timeout isn't flagged with REQ_F_COMP_LOCKED, and will try to double grab it during io_put_free() to cancel the linked timeout. Probably, the same can happen with another io_kill_timeout() call site, that is io_commit_cqring(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 9d588f63602778716921bb638cda412cdeacabc8 Merge: 5236647adbae df057c914a9c Author: Linus Torvalds Date: Sat Mar 7 08:12:47 2020 -0600 Merge tag 's390-5.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix panic in gup_fast on large pud by providing an implementation of pud_write. This has been overlooked during migration to common gup code. - Fix unexpected write combining on PCI stores. * tag 's390-5.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pci: Fix unexpected write combine on resource s390/mm: fix panic in gup_fast on large pud commit 5236647adbae2d4cfc11eda20a38e0a300b97e73 Merge: cbee7c8b4485 59bee45b9712 Author: Linus Torvalds Date: Sat Mar 7 08:10:34 2020 -0600 Merge tag 'powerpc-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Some more powerpc fixes for 5.6: - One fix for a recent regression to our breakpoint/watchpoint code. - Another fix for our KUAP support, this time a missing annotation in a rarely used path in signal handling. - A fix for our handling of a CPU feature that effects the PMU, when booting guests in some configurations. - A minor fix to our linker script to explicitly include the .BTF section. Thanks to: Christophe Leroy, Desnes A. Nunes do Rosario, Leonardo Bras, Naveen N. Rao, Ravi Bangoria, Stefan Berger" * tag 'powerpc-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm: Fix missing KUAP disable in flush_coherent_icache() powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems powerpc: Include .BTF section powerpc/watchpoint: Don't call dar_within_range() for Book3S commit cbee7c8b4485fb876895b82ddba19ae4e2e2d102 Merge: fa883d6afb15 4ab50af63d2e Author: Linus Torvalds Date: Sat Mar 7 08:04:54 2020 -0600 Merge tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Four fixes and a small cleanup patch: - two fixes by Dongli Zhang fixing races in the xenbus driver - two fixes by me fixing issues introduced in 5.6 - a small cleanup by Gustavo Silva replacing a zero-length array with a flexible-array" * tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/blkfront: fix ring info addressing xen/xenbus: fix locking xenbus: req->err should be updated before req->state xenbus: req->body should be updated before req->state xen: Replace zero-length array with flexible-array member commit fa883d6afb158c3c9bf33262272da3b6f0489742 Merge: 676fc8de3193 186e28a18aeb Author: Linus Torvalds Date: Sat Mar 7 08:01:43 2020 -0600 Merge tag 'for-linus-2020-03-07' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux Pull thread fixes from Christian Brauner: "Here are a few hopefully uncontroversial fixes: - Use RCU_INIT_POINTER() when initializing rcu protected members in task_struct to fix sparse warnings. - Add pidfd_fdinfo_test binary to .gitignore file" * tag 'for-linus-2020-03-07' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux: selftests: pidfd: Add pidfd_fdinfo_test in .gitignore exit: Fix Sparse errors and warnings fork: Use RCU_INIT_POINTER() instead of rcu_access_pointer() commit 676fc8de319335b840934c57ec75bdbbf049b738 Merge: 63849c8f4107 5a56996b0f13 Author: Linus Torvalds Date: Sat Mar 7 07:59:30 2020 -0600 Merge tag 'sound-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The regular "bump-in-the-middle" updates, containing mostly ASoC- related fixes at this time. All changes are reasonably small. A few entries are for ASoC and ALSA core parts (DAPM, PCM, topology) for followups of the recent changes and potential buffer overflow by snprintf(), while the rest are (both new and old) device-specific fixes for Intel, meson, tas2562, rt1015, as well as the usual HD-audio quirks" * tag 'sound-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (25 commits) ALSA: sgio2audio: Remove usage of dropped hw_params/hw_free functions ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 ALSA: hda/realtek - Add Headset Mic supported ASoC: wm8741: Fix typo in Kconfig prompt ASoC: stm32: sai: manage rebind issue ASoC: SOF: Fix snd_sof_ipc_stream_posn() ASoC: rt1015: modify pre-divider for sysclk ASoC: rt1015: add operation callback function for rt1015_dai[] ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop() ASoC: dapm: Correct DAPM handling of active widgets during shutdown ASoC: tas2562: Fix sample rate error message ASoC: Intel: Skylake: Fix available clock counter incrementation ASoC: soc-pcm/soc-compress: don't use snd_soc_dapm_stream_stop() ASoC: meson: g12a: add tohdmitx reset ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path ASoC: soc-core: fix for_rtd_codec_dai_rollback() macro ASoC: topology: Fix memleak in soc_tplg_manifest_load() ASoC: topology: Fix memleak in soc_tplg_link_elems_load() ... commit 130ab8819d81bd96f1a71e8461a8f73edf1fbe82 Author: H. Nikolaus Schaller Date: Fri Mar 6 18:28:30 2020 +0100 MIPS: DTS: CI20: fix interrupt for pcf8563 RTC Interrupts should not be specified by interrupt line but by gpio parent and reference. Fixes: 73f2b940474d ("MIPS: CI20: DTS: Add I2C nodes") Cc: stable@vger.kernel.org Signed-off-by: H. Nikolaus Schaller Reviewed-by: Paul Cercueil Signed-off-by: Thomas Bogendoerfer commit e8d87a0b822d4b3d9a94a5da915f93aa1b674c93 Author: H. Nikolaus Schaller Date: Fri Mar 6 18:27:58 2020 +0100 MIPS: DTS: CI20: fix PMU definitions for ACT8600 There is a ACT8600 on the CI20 board and the bindings of the ACT8865 driver have changed without updating the CI20 device tree. Therefore the PMU can not be probed successfully and is running in power-on reset state. Fix DT to match the latest act8865-regulator bindings. Fixes: 73f2b940474d ("MIPS: CI20: DTS: Add I2C nodes") Cc: stable@vger.kernel.org Signed-off-by: H. Nikolaus Schaller Reviewed-by: Paul Cercueil Signed-off-by: Thomas Bogendoerfer commit 798048f85093901f475d25b2ac8d9ea1bc6d471a Merge: b95b4d5ef061 441b62acd9c8 Author: Ingo Molnar Date: Sat Mar 7 08:29:55 2020 +0100 Merge tag 'perf-urgent-for-mingo-5.6-20200306' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf top: Tommi Rantala: - Fix stdio interface input handling with glibc 2.28+. perf bench: Tommi Rantala: - Restore thread count default to online CPU count in futex-wake bench. perf jevents: John Garry: - Fix leak of mapfile memory. perf diff: Nick Desaulniers: - Fix undefined string comparision spotted by clang's -Wstring-compare. misc: Ian Rogers: - Fix off-by 1 relative directory includes. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit aeaa925bff844d225f259215a250d2811e436499 Author: Jonathan Neuschäfer Date: Thu Mar 5 17:05:16 2020 +0100 rhashtable: Document the right function parameters rhashtable_lookup_get_insert_key doesn't have a parameter `data`. It does have a parameter `key`, however. Signed-off-by: Jonathan Neuschäfer Acked-by: Herbert Xu Signed-off-by: David S. Miller commit 5a56996b0f13b9a5db0ca60528d13c661d37377a Merge: 95dbf14b236f 3fb83cbee1de Author: Takashi Iwai Date: Sat Mar 7 07:24:36 2020 +0100 Merge tag 'asoc-fix-v5.6-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.6 More fixes that have arrived since the merge window, spread out all over. There's a few things like the operation callback addition for rt1015 and the meson reset addition which add small new bits of functionality to fix non-working systems, they're all very small and for parts of newly added functionality. commit 03138e2bf78b2e219b5f15b9bbd84e2d457e3b73 Author: Jakub Kicinski Date: Wed Mar 4 10:17:53 2020 -0800 MAINTAINERS: remove bouncing pkaustub@cisco.com from enic pkaustub@cisco.com is bouncing, remove it. Signed-off-by: Jakub Kicinski Acked-by: Christian Benvenuti Signed-off-by: David S. Miller commit e396ce5f4229388db5143fec0ec36af504bff12e Author: Shannon Nelson Date: Wed Mar 4 09:42:10 2020 -0800 ionic: fix vf op lock usage These are a couple of read locks that should be write locks. Fixes: fbb39807e9ae ("ionic: support sr-iov operations") Signed-off-by: Shannon Nelson Reviewed-by: Parav Pandit Signed-off-by: David S. Miller commit b7469e83d2add567e4e0b063963db185f3167cea Author: Eric Dumazet Date: Wed Mar 4 09:32:16 2020 -0800 bonding/alb: make sure arp header is pulled before accessing it Similar to commit 38f88c454042 ("bonding/alb: properly access headers in bond_alb_xmit()"), we need to make sure arp header was pulled in skb->head before blindly accessing it in rlb_arp_xmit(). Remove arp_pkt() private helper, since it is more readable/obvious to have the following construct back to back : if (!pskb_network_may_pull(skb, sizeof(*arp))) return NULL; arp = (struct arp_pkt *)skb_network_header(skb); syzbot reported : BUG: KMSAN: uninit-value in bond_slave_has_mac_rx include/net/bonding.h:704 [inline] BUG: KMSAN: uninit-value in rlb_arp_xmit drivers/net/bonding/bond_alb.c:662 [inline] BUG: KMSAN: uninit-value in bond_alb_xmit+0x575/0x25e0 drivers/net/bonding/bond_alb.c:1477 CPU: 0 PID: 12743 Comm: syz-executor.4 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 bond_slave_has_mac_rx include/net/bonding.h:704 [inline] rlb_arp_xmit drivers/net/bonding/bond_alb.c:662 [inline] bond_alb_xmit+0x575/0x25e0 drivers/net/bonding/bond_alb.c:1477 __bond_start_xmit drivers/net/bonding/bond_main.c:4257 [inline] bond_start_xmit+0x85d/0x2f70 drivers/net/bonding/bond_main.c:4282 __netdev_start_xmit include/linux/netdevice.h:4524 [inline] netdev_start_xmit include/linux/netdevice.h:4538 [inline] xmit_one net/core/dev.c:3470 [inline] dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3486 __dev_queue_xmit+0x37de/0x4220 net/core/dev.c:4063 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4096 packet_snd net/packet/af_packet.c:2967 [inline] packet_sendmsg+0x8347/0x93b0 net/packet/af_packet.c:2992 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] __sys_sendto+0xc1b/0xc50 net/socket.c:1998 __do_sys_sendto net/socket.c:2010 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:2006 __x64_sys_sendto+0x6e/0x90 net/socket.c:2006 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c479 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc77ffbbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fc77ffbc6d4 RCX: 000000000045c479 RDX: 000000000000000e RSI: 00000000200004c0 RDI: 0000000000000003 RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000a04 R14: 00000000004cc7b0 R15: 000000000076bf2c Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242 packet_alloc_skb net/packet/af_packet.c:2815 [inline] packet_snd net/packet/af_packet.c:2910 [inline] packet_sendmsg+0x66a0/0x93b0 net/packet/af_packet.c:2992 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] __sys_sendto+0xc1b/0xc50 net/socket.c:1998 __do_sys_sendto net/socket.c:2010 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:2006 __x64_sys_sendto+0x6e/0x90 net/socket.c:2006 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Signed-off-by: David S. Miller commit 172fd3eb3873103e5096fd71088cf85fe346f094 Merge: 357ddbb9bf48 3c68b8fffb48 Author: David S. Miller Date: Fri Mar 6 21:55:32 2020 -0800 Merge branch 'QorIQ-DPAA-FMan-erratum-A050385-workaround' Madalin Bucur says: ==================== QorIQ DPAA FMan erratum A050385 workaround Changes in v2: - added CONFIG_DPAA_ERRATUM_A050385 - removed unnecessary parenthesis - changed alignment defines to use only decimal values The patch set implements the workaround for FMan erratum A050385: FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak; thus stopping further packet processing. To reproduce this issue when the workaround is not applied, one needs to ensure the FMan DMA transaction queue is already full when a transaction split occurs so the system must be under high traffic load (i.e. multiple ports at line rate). After the errata occurs, the traffic stops. The only SoC impacted by this is the LS1043A, the other ARM DPAA 1 SoC or the PPC DPAA 1 SoCs do not have this erratum. The FMAN internal queue can overflow when FMAN splits single read or write transactions into multiple smaller transactions such that more than 17 AXI transactions are in flight from FMAN to interconnect. When the FMAN internal queue overflows, it can stall further packet processing. The issue can occur with any one of the following three conditions: 1. FMAN AXI transaction crosses 4K address boundary (Errata A010022) 2. FMAN DMA address for an AXI transaction is not 16 byte aligned, i.e. the last 4 bits of an address are non-zero 3. Scatter Gather (SG) frames have more than one SG buffer in the SG list and any one of the buffers, except the last buffer in the SG list has data size that is not a multiple of 16 bytes, i.e., other than 16, 32, 48, 64, etc. With any one of the above three conditions present, there is likelihood of stalled FMAN packet processing, especially under stress with multiple ports injecting line-rate traffic. To avoid situations that stall FMAN packet processing, all of the above three conditions must be avoided; therefore, configure the system with the following rules: 1. Frame buffers must not span a 4KB address boundary, unless the frame start address is 256 byte aligned 2. All FMAN DMA start addresses (for example, BMAN buffer address, FD[address] + FD[offset]) are 16B aligned 3. SG table and buffer addresses are 16B aligned and the size of SG buffers are multiple of 16 bytes, except for the last SG buffer that can be of any size. Additional workaround notes: - Address alignment of 64 bytes is recommended for maximally efficient system bus transactions (although 16 byte alignment is sufficient to avoid the stall condition) - To support frame sizes that are larger than 4K bytes, there are two options: 1. Large single buffer frames that span a 4KB page boundary can be converted into SG frames to avoid transaction splits at the 4KB boundary, 2. Align the large single buffer to 256B address boundaries, ensure that the frame address plus offset is 256B aligned. - If software generated SG frames have buffers that are unaligned and with random non-multiple of 16 byte lengths, before transmitting such frames via FMAN, frames will need to be copied into a new single buffer or multiple buffer SG frame that is compliant with the three rules listed above. ==================== Signed-off-by: David S. Miller commit 3c68b8fffb48c0018c24e73c48f2bac768c6203e Author: Madalin Bucur Date: Wed Mar 4 18:04:28 2020 +0200 dpaa_eth: FMan erratum A050385 workaround Align buffers, data start, SG fragment length to avoid DMA splits. These changes prevent the A050385 erratum to manifest itself: FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak; thus stopping further packet processing. The FMAN internal queue can overflow when FMAN splits single read or write transactions into multiple smaller transactions such that more than 17 AXI transactions are in flight from FMAN to interconnect. When the FMAN internal queue overflows, it can stall further packet processing. The issue can occur with any one of the following three conditions: 1. FMAN AXI transaction crosses 4K address boundary (Errata A010022) 2. FMAN DMA address for an AXI transaction is not 16 byte aligned, i.e. the last 4 bits of an address are non-zero 3. Scatter Gather (SG) frames have more than one SG buffer in the SG list and any one of the buffers, except the last buffer in the SG list has data size that is not a multiple of 16 bytes, i.e., other than 16, 32, 48, 64, etc. With any one of the above three conditions present, there is likelihood of stalled FMAN packet processing, especially under stress with multiple ports injecting line-rate traffic. To avoid situations that stall FMAN packet processing, all of the above three conditions must be avoided; therefore, configure the system with the following rules: 1. Frame buffers must not span a 4KB address boundary, unless the frame start address is 256 byte aligned 2. All FMAN DMA start addresses (for example, BMAN buffer address, FD[address] + FD[offset]) are 16B aligned 3. SG table and buffer addresses are 16B aligned and the size of SG buffers are multiple of 16 bytes, except for the last SG buffer that can be of any size. Additional workaround notes: - Address alignment of 64 bytes is recommended for maximally efficient system bus transactions (although 16 byte alignment is sufficient to avoid the stall condition) - To support frame sizes that are larger than 4K bytes, there are two options: 1. Large single buffer frames that span a 4KB page boundary can be converted into SG frames to avoid transaction splits at the 4KB boundary, 2. Align the large single buffer to 256B address boundaries, ensure that the frame address plus offset is 256B aligned. - If software generated SG frames have buffers that are unaligned and with random non-multiple of 16 byte lengths, before transmitting such frames via FMAN, frames will need to be copied into a new single buffer or multiple buffer SG frame that is compliant with the three rules listed above. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit b281f7b93b258ce1419043bbd898a29254d5c9c7 Author: Madalin Bucur Date: Wed Mar 4 18:04:27 2020 +0200 fsl/fman: detect FMan erratum A050385 Detect the presence of the A050385 erratum. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit b54d3900862374e1bb2846e6b39d79c896c0b200 Author: Madalin Bucur Date: Wed Mar 4 18:04:26 2020 +0200 arm64: dts: ls1043a: FMan erratum A050385 The LS1043A SoC is affected by the A050385 erratum stating that FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak thus stopping further packet processing. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 26d5bb9e4c4b541c475751e015072eb2cbf70d15 Author: Madalin Bucur Date: Wed Mar 4 18:04:25 2020 +0200 dt-bindings: net: FMan erratum A050385 FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak; thus stopping further packet processing. The FMAN internal queue can overflow when FMAN splits single read or write transactions into multiple smaller transactions such that more than 17 AXI transactions are in flight from FMAN to interconnect. When the FMAN internal queue overflows, it can stall further packet processing. The issue can occur with any one of the following three conditions: 1. FMAN AXI transaction crosses 4K address boundary (Errata A010022) 2. FMAN DMA address for an AXI transaction is not 16 byte aligned, i.e. the last 4 bits of an address are non-zero 3. Scatter Gather (SG) frames have more than one SG buffer in the SG list and any one of the buffers, except the last buffer in the SG list has data size that is not a multiple of 16 bytes, i.e., other than 16, 32, 48, 64, etc. With any one of the above three conditions present, there is likelihood of stalled FMAN packet processing, especially under stress with multiple ports injecting line-rate traffic. To avoid situations that stall FMAN packet processing, all of the above three conditions must be avoided; therefore, configure the system with the following rules: 1. Frame buffers must not span a 4KB address boundary, unless the frame start address is 256 byte aligned 2. All FMAN DMA start addresses (for example, BMAN buffer address, FD[address] + FD[offset]) are 16B aligned 3. SG table and buffer addresses are 16B aligned and the size of SG buffers are multiple of 16 bytes, except for the last SG buffer that can be of any size. Additional workaround notes: - Address alignment of 64 bytes is recommended for maximally efficient system bus transactions (although 16 byte alignment is sufficient to avoid the stall condition) - To support frame sizes that are larger than 4K bytes, there are two options: 1. Large single buffer frames that span a 4KB page boundary can be converted into SG frames to avoid transaction splits at the 4KB boundary, 2. Align the large single buffer to 256B address boundaries, ensure that the frame address plus offset is 256B aligned. - If software generated SG frames have buffers that are unaligned and with random non-multiple of 16 byte lengths, before transmitting such frames via FMAN, frames will need to be copied into a new single buffer or multiple buffer SG frame that is compliant with the three rules listed above. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 357ddbb9bf4813e48f5aa7836b6606c05f6e5788 Merge: 2398e3991bda 6a42cefb25d8 Author: David S. Miller Date: Fri Mar 6 21:36:25 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Patches to bump position index from sysctl seq_next, from Vasilin Averin. 2) Release flowtable hook from error path, from Florian Westphal. 3) Patches to add missing netlink attribute validation, from Jakub Kicinski. 4) Missing NFTA_CHAIN_FLAGS in nf_tables_fill_chain_info(). 5) Infinite loop in module autoload if extension is not available, from Florian Westphal. 6) Missing module ownership in inet/nat chain type definition. ==================== Signed-off-by: David S. Miller commit 63849c8f410717eb2e6662f3953ff674727303e7 Merge: 7e6582ef32f6 f3a60268f5ce Author: Linus Torvalds Date: Fri Mar 6 17:03:37 2020 -0600 Merge tag 'linux-kselftest-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest update from Shuah Khan: "This consists of a cleanup patch to undo changes to global .gitignore that added selftests/lkdtm objects and add them to a local selftests/lkdtm/.gitignore. Summary of Linus's comments on local vs. global gitignore scope: - Keep local gitignore patterns in local files. - Put only global gitignore patterns in the top-level gitignore file. Local scope keeps things much better separated. It also incidentally means that if a directory gets renamed, the gitignore file continues to work unless in the case of renaming the actual files themselves that are named in the gitignore" * tag 'linux-kselftest-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftest/lkdtm: Use local .gitignore commit da3289044833769188c0da945d2cec90af35e87e Author: Nick Reitemeyer Date: Sat Feb 15 15:41:55 2020 -0800 Input: tm2-touchkey - add support for Coreriver TC360 variant The Coreriver TouchCore 360 is like the midas board touchkey, but it is using a fixed regulator. Signed-off-by: Nick Reitemeyer Link: https://lore.kernel.org/r/20200121141525.3404-3-nick.reitemeyer@web.de Signed-off-by: Dmitry Torokhov commit 3c2c07b0068a0e07712b1dec1a6f35d1f91a27fe Author: Nick Reitemeyer Date: Sat Feb 15 15:41:19 2020 -0800 dt-bindings: input: add Coreriver TC360 binding Signed-off-by: Nick Reitemeyer Acked-by: Rob Herring Link: https://lore.kernel.org/r/20200121141525.3404-2-nick.reitemeyer@web.de Signed-off-by: Dmitry Torokhov commit 574abf5676ac59c73d46556e3f04d4aa4b2bfa97 Author: Nick Reitemeyer Date: Sat Feb 15 15:40:36 2020 -0800 dt-bindings: vendor-prefixes: Add Coreriver vendor prefix Coreriver is a South Korean microcontroller manufacturer: http://coreriver.com Signed-off-by: Nick Reitemeyer Acked-by: Rob Herring Link: https://lore.kernel.org/r/20200121141525.3404-1-nick.reitemeyer@web.de Signed-off-by: Dmitry Torokhov commit 7e6582ef32f6cbd55b9c752727847b0ee6710e78 Merge: 611d61f9ac99 af33d2433b03 Author: Linus Torvalds Date: Fri Mar 6 16:38:33 2020 -0600 Merge tag 'riscv-for-linus-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: "This contains a handful of fixes that I would like to target for 5.6: - A pair of fixes to module loading, which we hope solve the last of the issues with module text being loaded too sparsely for our call relocations. - A Kconfig fix that disallows selecting memory models not supported by NOMMU. - A series of Kconfig updates to ease selecting the drivers necessary to run on QEMU's virt platform. - DTS updates for SiFive's HiFive Unleashed. - A fix to our seccomp support that avoids mangling restartable syscalls" * tag 'riscv-for-linus-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: fix seccomp reject syscall code path riscv: dts: Add GPIO reboot method to HiFive Unleashed DTS file RISC-V: Select Goldfish RTC driver for QEMU virt machine RISC-V: Select SYSCON Reboot and Poweroff for QEMU virt machine RISC-V: Enable QEMU virt machine support in defconfigs RISC-V: Add kconfig option for QEMU virt machine riscv: Fix range looking for kernel image memblock riscv: Force flat memory model with no-mmu riscv: Change code model of module to medany to improve data accessing riscv: avoid the PIC offset of static percpu data in module beyond 2G limits commit 32cf3a610c35cb21e3157f4bbf29d89960e30a36 Author: Dan Carpenter Date: Fri Mar 6 11:50:51 2020 -0800 Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger() These functions are supposed to return negative error codes but instead it returns true on failure and false on success. The error codes are eventually propagated back to user space. Fixes: 48a2b783483b ("Input: add Raydium I2C touchscreen driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20200303101306.4potflz7na2nn3od@kili.mountain Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 611d61f9ac99dc9e1494473fb90117a960a89dfa Author: Jonathan Neuschäfer Date: Fri Mar 6 23:13:11 2020 +0100 parse-maintainers: Mark as executable This makes the script more convenient to run. Signed-off-by: Jonathan Neuschäfer Signed-off-by: Linus Torvalds commit bdf1ea7ca8a9e6febdde32eec03e0a44f39a44ff Merge: 2f501bb1802d d2334a91a3b0 Author: Linus Torvalds Date: Fri Mar 6 16:11:34 2020 -0600 Merge tag 'devicetree-fixes-for-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: "Another batch of DT fixes. I think this should be the last of it, but sending pull requests seems to cause people to send more fixes. Summary: - Fixes for warnings introduced by hierarchical PSCI binding changes - Fixes for broken doc references due to DT schema conversions - Several grammar and typo fixes - Fix a bunch of dtc warnings in examples" * tag 'devicetree-fixes-for-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: arm: Fixup the DT bindings for hierarchical PSCI states dt-bindings: power: Extend nodename pattern for power-domain providers MAINTAINERS: update ALLWINNER CPUFREQ DRIVER entry dt-bindings: bus: Drop empty compatible string in example dt-bindings: power: Convert domain-idle-states bindings to json-schema dt-bindings: arm: Fix cpu compatibles in the hierarchical example for PSCI dt-bindings: arm: Correct links to idle states definitions dt-bindings: mfd: Fix typo in file name of twl-familly.txt dt-bindings: mfd: tps65910: Improve grammar dt-bindings: mfd: zii,rave-sp: Fix a typo ("onborad") dt-bindings: arm: fsl: fix APF6Dev compatible dt-bindings: Fix dtc warnings in examples docs: dt: fix several broken doc references docs: dt: fix several broken references due to renames MAINTAINERS: clean up PCIE DRIVER FOR CAVIUM THUNDERX commit 2f501bb1802dbbf1467e7999954588da31f635ad Merge: 30fe0d07fd7b 513dc792d606 Author: Linus Torvalds Date: Fri Mar 6 16:08:48 2020 -0600 Merge tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm Pull vgacon fix from Daniel Vetter: "One vgacon input check for stable" * tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm: vgacon: Fix a UAF in vgacon_invert_region commit 2f920c0f0e29268827c2894c6e8f237a78159718 Author: Gustavo A. R. Silva Date: Wed Feb 12 13:52:31 2020 -0600 auxdisplay: charlcd: replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Miguel Ojeda commit e8897e4fe8f27d407b1e00ee0410fd3ec396275c Author: Yangtao Li Date: Sun Dec 29 07:04:19 2019 +0000 auxdisplay: img-ascii-lcd: convert to devm_platform_ioremap_resource Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li Signed-off-by: Miguel Ojeda commit d568bbd2f872cdd1b605d8e6b9b9c719a0ebd306 Author: Krzysztof Kozlowski Date: Thu Nov 21 04:20:41 2019 +0100 auxdisplay: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miguel Ojeda commit 30fe0d07fd7b27d41d9b31a224052cc4e910947a Merge: 0b25d458035d e7a04894c766 Author: Linus Torvalds Date: Fri Mar 6 14:56:46 2020 -0600 Merge tag 'for-5.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One fixup for DIO when in use with the new checksums, a missed case where the checksum size was still assuming u32" * tag 'for-5.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix RAID direct I/O reads with alternate csums commit 0b25d458035d0ca6502e678874e2ccb2fa2ddc23 Merge: ae24a21bbd96 6d390e4b5d48 Author: Linus Torvalds Date: Fri Mar 6 14:55:27 2020 -0600 Merge tag 'filelock-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking fixes from Jeff Layton: "Just a couple of late-breaking patches for the file locking code. The second patch (from yangerkun) fixes a rather nasty looking potential use-after-free that should go to stable. The other patch could technically wait for 5.7, but it's fairly innocuous so I figured we might as well take it" * tag 'filelock-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: locks: fix a potential use-after-free problem when wakeup a waiter fcntl: Distribute switch variables for initialization commit ae24a21bbd96a7a4a3e82890285255d7e86540f0 Merge: 43c63729c96f f9981d4f50b4 Author: Linus Torvalds Date: Fri Mar 6 14:50:16 2020 -0600 Merge tag 'spi-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A selection of small fixes, mostly for drivers, that have arrived since the merge window. None of them are earth shattering in themselves but all useful for affected systems" * tag 'spi-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi_register_controller(): free bus id on error paths spi: bcm63xx-hsspi: Really keep pll clk enabled spi: atmel-quadspi: fix possible MMIO window size overrun spi/zynqmp: remove entry that causes a cs glitch spi: pxa2xx: Add CS control clock quirk spi: spidev: Fix CS polarity if GPIO descriptors are used spi: qup: call spi_qup_pm_resume_runtime before suspending spi: spi-omap2-mcspi: Support probe deferral for DMA channels spi: spi-omap2-mcspi: Handle DMA size restriction on AM65x commit 11a4a8f73b3ce71b32f36e9f1655f6ddf8f1732b Author: Miguel Ojeda Date: Fri Mar 6 21:50:00 2020 +0100 clang-format: Update with the latest for_each macro list Re-run the shell fragment that generated the original list. Signed-off-by: Miguel Ojeda commit 43c63729c96f06f97367edf680d42d634041fd6a Merge: 08e39fcb92b0 02fbabd5f4ed Author: Linus Torvalds Date: Fri Mar 6 14:48:30 2020 -0600 Merge tag 'regulator-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small fixes, one for a minor issue in the stm32-vrefbuf driver and a documentation fix in the Qualcomm code" * tag 'regulator-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling regulator: qcom_spmi: Fix docs for PM8004 commit 08e39fcb92b039189006566a97aa9565fe20fb83 Merge: c20c4a084a87 44f2f882909f Author: Linus Torvalds Date: Fri Mar 6 14:47:06 2020 -0600 Merge tag 'hwmon-for-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix an error return in the adt7462 driver, bad voltage limits reported by the xdpe12284 driver, and a broken documentation reference in the adm1177 driver documentation" * tag 'hwmon-for-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() hwmon: (pmbus/xdpe12284) Add callback for vout limits conversion docs: adm1177: fix a broken reference commit c20c4a084a878df35a7e394a7e646f303b505eaf Merge: aeb542a1b5c5 9abd515a6e4a Author: Linus Torvalds Date: Fri Mar 6 14:35:47 2020 -0600 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Here are another three arm64 fixes for 5.6, all pretty minor. Main thing is fixing a silly bug in the fsl_imx8_ddr PMU driver where we would zero the counters when disabling them. - Fix misreporting of ASID limit when KPTI is enabled - Fix busted NULL pointer checks for GICC structure in ACPI PMU code - Avoid nobbling the "fsl_imx8_ddr" PMU counters when disabling them" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: context: Fix ASID limit in boot messages drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition commit be40920fbf1003c38ccdc02b571e01a75d890c82 Author: Masami Hiramatsu Date: Sat Mar 7 03:32:58 2020 +0900 tools: Let O= makes handle a relative path with -C option When I tried to compile tools/perf from the top directory with the -C option, the O= option didn't work correctly if I passed a relative path: $ make O=BUILD -C tools/perf/ make: Entering directory '/home/mhiramat/ksrc/linux/tools/perf' BUILD: Doing 'make -j8' parallel build ../scripts/Makefile.include:4: *** O=/home/mhiramat/ksrc/linux/tools/perf/BUILD does not exist. Stop. make: *** [Makefile:70: all] Error 2 make: Leaving directory '/home/mhiramat/ksrc/linux/tools/perf' The O= directory existence check failed because the check script ran in the build target directory instead of the directory where I ran the make command. To fix that, once change directory to $(PWD) and check O= directory, since the PWD is set to where the make command runs. Fixes: c883122acc0d ("perf tools: Let O= makes handle relative paths") Reported-by: Randy Dunlap Signed-off-by: Masami Hiramatsu Cc: Andrew Morton Cc: Borislav Petkov Cc: Geert Uytterhoeven Cc: Jiri Olsa Cc: Masahiro Yamada Cc: Michal Marek Cc: Peter Zijlstra Cc: Sasha Levin Cc: Steven Rostedt (VMware) Cc: stable@vger.kernel.org Link: http://lore.kernel.org/lkml/158351957799.3363.15269768530697526765.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 513dc792d6060d5ef572e43852683097a8420f56 Author: Zhang Xiaoxu Date: Wed Mar 4 10:24:29 2020 +0800 vgacon: Fix a UAF in vgacon_invert_region When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 Call Trace: [] dump_stack+0x1e/0x20 [] kasan_report+0x577/0x950 [] __asan_load2+0x62/0x80 [] vgacon_invert_region+0x9d/0x110 [] invert_screen+0xe5/0x470 [] set_selection+0x44b/0x12f0 [] tioclinux+0xee/0x490 [] vt_ioctl+0xff4/0x2670 [] tty_ioctl+0x46a/0x1a10 [] do_vfs_ioctl+0x5bd/0xc40 [] SyS_ioctl+0x132/0x170 [] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include #include #include #include #include #include #include #include struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access. Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647. Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits: if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL; Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reference: CVE-2020-8647 and CVE-2020-8649 Reported-by: Hulk Robot Signed-off-by: Zhang Xiaoxu [danvet: augment commit message to point out overflow safety] Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangxiaoxu5@huawei.com commit d2334a91a3b01dce4f290b4536fcfa4b9e923a3d Author: Ulf Hansson Date: Tue Mar 3 16:07:47 2020 +0100 dt-bindings: arm: Fixup the DT bindings for hierarchical PSCI states The hierarchical topology with power-domain should be described through child nodes, rather than as currently described in the PSCI root node. Fix this by adding a patternProperties with a corresponding reference to the power-domain DT binding. Additionally, update the example to conform to the new pattern, but also to the adjusted domain-idle-state DT binding. Fixes: a3f048b5424e ("dt: psci: Update DT bindings to support hierarchical PSCI states") Signed-off-by: Ulf Hansson [robh: Add missing allOf, tweak power-domain node name] Signed-off-by: Rob Herring commit 14ee09a05ed5b8b9121ca80958a06fdfc8c85d93 Author: Ulf Hansson Date: Tue Mar 3 16:07:46 2020 +0100 dt-bindings: power: Extend nodename pattern for power-domain providers The existing binding requires the nodename to have a '@', which is a bit limiting for the wider use case. Therefore, let's extend the pattern to allow either '@' or '-'. Fixes: a3f048b5424e ("dt: psci: Update DT bindings to support hierarchical PSCI states") Signed-off-by: Ulf Hansson [robh: drop example change] Signed-off-by: Rob Herring commit c1e2148f8ecb26863b899d402a823dab8e26efd1 Author: Jens Axboe Date: Wed Mar 4 07:25:50 2020 -0700 io_uring: free fixed_file_data after RCU grace period The percpu refcount protects this structure, and we can have an atomic switch in progress when exiting. This makes it unsafe to just free the struct normally, and can trigger the following KASAN warning: BUG: KASAN: use-after-free in percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0 Read of size 1 at addr ffff888181a19a30 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc4+ #5747 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x3b/0x60 ? percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0 ? percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0 __kasan_report.cold+0x1a/0x3d ? percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0 percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0 rcu_core+0x370/0x830 ? percpu_ref_exit+0x50/0x50 ? rcu_note_context_switch+0x7b0/0x7b0 ? run_rebalance_domains+0x11d/0x140 __do_softirq+0x10a/0x3e9 irq_exit+0xd5/0xe0 smp_apic_timer_interrupt+0x86/0x200 apic_timer_interrupt+0xf/0x20 RIP: 0010:default_idle+0x26/0x1f0 Fix this by punting the final exit and free of the struct to RCU, then we know that it's safe to do so. Jann suggested the approach of using a double rcu callback to achieve this. It's important that we do a nested call_rcu() callback, as otherwise the free could be ordered before the atomic switch, even if the latter was already queued. Reported-by: syzbot+e017e49c39ab484ac87a@syzkaller.appspotmail.com Suggested-by: Jann Horn Reviewed-by: Paul E. McKenney Signed-off-by: Jens Axboe commit 6a42cefb25d8bdc1b391f4a53c78c32164eea2dd Author: Pablo Neira Ayuso Date: Fri Mar 6 17:37:28 2020 +0100 netfilter: nft_chain_nat: inet family is missing module ownership Set owner to THIS_MODULE, otherwise the nft_chain_nat module might be removed while there are still inet/nat chains in place. [ 117.942096] BUG: unable to handle page fault for address: ffffffffa0d5e040 [ 117.942101] #PF: supervisor read access in kernel mode [ 117.942103] #PF: error_code(0x0000) - not-present page [ 117.942106] PGD 200c067 P4D 200c067 PUD 200d063 PMD 3dc909067 PTE 0 [ 117.942113] Oops: 0000 [#1] PREEMPT SMP PTI [ 117.942118] CPU: 3 PID: 27 Comm: kworker/3:0 Not tainted 5.6.0-rc3+ #348 [ 117.942133] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 117.942145] RIP: 0010:nf_tables_chain_destroy.isra.0+0x94/0x15a [nf_tables] [ 117.942149] Code: f6 45 54 01 0f 84 d1 00 00 00 80 3b 05 74 44 48 8b 75 e8 48 c7 c7 72 be de a0 e8 56 e6 2d e0 48 8b 45 e8 48 c7 c7 7f be de a0 <48> 8b 30 e8 43 e6 2d e0 48 8b 45 e8 48 8b 40 10 48 85 c0 74 5b 8b [ 117.942152] RSP: 0018:ffffc9000015be10 EFLAGS: 00010292 [ 117.942155] RAX: ffffffffa0d5e040 RBX: ffff88840be87fc2 RCX: 0000000000000007 [ 117.942158] RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffffffffa0debe7f [ 117.942160] RBP: ffff888403b54b50 R08: 0000000000001482 R09: 0000000000000004 [ 117.942162] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8883eda7e540 [ 117.942164] R13: dead000000000122 R14: dead000000000100 R15: ffff888403b3db80 [ 117.942167] FS: 0000000000000000(0000) GS:ffff88840e4c0000(0000) knlGS:0000000000000000 [ 117.942169] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 117.942172] CR2: ffffffffa0d5e040 CR3: 00000003e4c52002 CR4: 00000000001606e0 [ 117.942174] Call Trace: [ 117.942188] nf_tables_trans_destroy_work.cold+0xd/0x12 [nf_tables] [ 117.942196] process_one_work+0x1d6/0x3b0 [ 117.942200] worker_thread+0x45/0x3c0 [ 117.942203] ? process_one_work+0x3b0/0x3b0 [ 117.942210] kthread+0x112/0x130 [ 117.942214] ? kthread_create_worker_on_cpu+0x40/0x40 [ 117.942221] ret_from_fork+0x35/0x40 nf_tables_chain_destroy() crashes on module_put() because the module is gone. Fixes: d164385ec572 ("netfilter: nat: add inet family nat support") Signed-off-by: Pablo Neira Ayuso commit 6d390e4b5d48ec03bb87e63cf0a2bff5f4e116da Author: yangerkun Date: Wed Mar 4 15:25:56 2020 +0800 locks: fix a potential use-after-free problem when wakeup a waiter '16306a61d3b7 ("fs/locks: always delete_block after waiting.")' add the logic to check waiter->fl_blocker without blocked_lock_lock. And it will trigger a UAF when we try to wakeup some waiter： Thread 1 has create a write flock a on file, and now thread 2 try to unlock and delete flock a, thread 3 try to add flock b on the same file. Thread2 Thread3 flock syscall(create flock b) ...flock_lock_inode_wait flock_lock_inode(will insert our fl_blocked_member list to flock a's fl_blocked_requests) sleep flock syscall(unlock) ...flock_lock_inode_wait locks_delete_lock_ctx ...__locks_wake_up_blocks __locks_delete_blocks( b->fl_blocker = NULL) ... break by a signal locks_delete_block b->fl_blocker == NULL && list_empty(&b->fl_blocked_requests) success, return directly locks_free_lock b wake_up(&b->fl_waiter) trigger UAF Fix it by remove this logic, and this patch may also fix CVE-2019-19769. Cc: stable@vger.kernel.org Fixes: 16306a61d3b7 ("fs/locks: always delete_block after waiting.") Signed-off-by: yangerkun Signed-off-by: Jeff Layton commit 14afc59361976c0ba39e3a9589c3eaa43ebc7e1d Author: Carlo Nonato Date: Fri Mar 6 13:27:31 2020 +0100 block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() The bfq_find_set_group() function takes as input a blkcg (which represents a cgroup) and retrieves the corresponding bfq_group, then it updates the bfq internal group hierarchy (see comments inside the function for why this is needed) and finally it returns the bfq_group. In the hierarchy update cycle, the pointer holding the correct bfq_group that has to be returned is mistakenly used to traverse the hierarchy bottom to top, meaning that in each iteration it gets overwritten with the parent of the current group. Since the update cycle stops at root's children (depth = 2), the overwrite becomes a problem only if the blkcg describes a cgroup at a hierarchy level deeper than that (depth > 2). In this case the root's child that happens to be also an ancestor of the correct bfq_group is returned. The main consequence is that processes contained in a cgroup at depth greater than 2 are wrongly placed in the group described above by BFQ. This commits fixes this problem by using a different bfq_group pointer in the update cycle in order to avoid the overwrite of the variable holding the original group reference. Reported-by: Kwon Je Oh Signed-off-by: Carlo Nonato Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit cf7da891b624983ffadd6b97ef63a0def3e985ad Author: Mauro Carvalho Chehab Date: Tue Mar 3 16:50:33 2020 +0100 docs: dmaengine: provider.rst: get rid of some warnings Get rid of those warnings by adding extra blank lines: Documentation/driver-api/dmaengine/provider.rst:270: WARNING: Unexpected indentation. Documentation/driver-api/dmaengine/provider.rst:273: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/driver-api/dmaengine/provider.rst:288: WARNING: Unexpected indentation. Documentation/driver-api/dmaengine/provider.rst:290: WARNING: Block quote ends without a blank line; unexpected unindent. While here, use parenthesis after get_metadata_ptr/set_metadata_len, as, if some day someone adds a kerneldoc markup for those, it should automatically generate a cross-reference to them. Signed-off-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/62cf2a87b379a92c9c0e5a40c2ae8a138b01fe0a.1583250595.git.mchehab+huawei@kernel.org Signed-off-by: Vinod Koul commit 9352ed0165ff4313ab340c979446c3d64c531f7a Author: Luca Coelho Date: Fri Mar 6 15:16:27 2020 +0200 iwlwifi: cfg: use antenna diversity with all AX101 devices We were erroneously only setting the tx_with_siso_diversity flag in the Qu B-step configurations for AX101 devices, though we should do it on all configurations. Add the flag to the other two configurations, namely Qu C-step and QuZ. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151129.1cd986ef467c.Idc0b111475ae3d38b68ae062613c080b574e33e1@changeid commit ce19801ba75a902ab515dda03b57738c708d0781 Author: Ilan Peer Date: Fri Mar 6 15:16:26 2020 +0200 iwlwifi: mvm: Fix rate scale NSS configuration The TLC configuration did not take into consideration the station's SMPS configuration, and thus configured rates for 2 NSS even if static SMPS was reported by the station. Fix this. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151129.b4f940d13eca.Ieebfa889d08205a3a961ae0138fb5832e8a0f9c1@changeid commit 699b760bd29edba736590fffef7654cb079c753e Author: Luca Coelho Date: Fri Mar 6 15:16:25 2020 +0200 iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails If the firmware is in a bad state or not initialized fully, sending the DBGC_SUSPEND_RESUME command fails but we can still collect logs. Instead of aborting the entire dump process, simply ignore the error. By removing the last callpoint that was checking the return value, we can also convert the function to return void. Signed-off-by: Luca Coelho Fixes: 576058330f2d ("iwlwifi: dbg: support debug recording suspend resume command") Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151129.dcec37b2efd4.I8dcd190431d110a6a0e88095ce93591ccfb3d78d@changeid commit a5688e600e78f9fc68102bf0fe5c797fc2826abe Author: Mordechay Goodstein Date: Fri Mar 6 15:16:24 2020 +0200 iwlwifi: yoyo: don't add TLV offset when reading FIFOs The TLV offset is only used to read registers, while the offset used for the FIFO addresses are hard coded in the driver and not given by the TLV. If we try to apply the TLV offset when reading the FIFOs, we'll read from invalid addresses, causing the driver to hang. Signed-off-by: Mordechay Goodstein Fixes: 8d7dea25ada7 ("iwlwifi: dbg_ini: implement Rx fifos dump") Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151129.fbab869c26fa.I4ddac20d02f9bce41855a816aa6855c89bc3874e@changeid commit 71bc0334a6371c7de0e0594439de7d237e4d2d03 Author: Luca Coelho Date: Fri Mar 6 15:16:23 2020 +0200 iwlwifi: check allocated pointer when allocating conf_tlvs We were erroneously checking the length of the tlv instead of checking the pointer returned by kmemdup() when allocating dbg_conf_tlv[]. This was probably a typo. Fix it by checking the returned pointer instead of the length. Reported-by: Markus Elfring Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151128.06e00e6e980f.I9a890ce83493b79892a5f690d12016525317fa7e@changeid commit cb377dfda1755b3bc01436755d866c8e5336a762 Author: Mordechay Goodstein Date: Fri Mar 6 15:16:22 2020 +0200 iwlwifi: consider HE capability when setting LDPC The AP may set the LDPC capability only in HE (IEEE80211_HE_PHY_CAP1), but we were checking it only in the HT capabilities. If we don't use this capability when required, the DSP gets the wrong configuration in HE and doesn't work properly. Signed-off-by: Mordechay Goodstein Fixes: befebbb30af0 ("iwlwifi: rs: consider LDPC capability in case of HE") Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151128.492d167c1a25.I1ad1353dbbf6c99ae57814be750f41a1c9f7f4ac@changeid commit 089e5016d7eb063712063670e6da7c1a4de1a5c1 Author: Avraham Stern Date: Fri Mar 6 15:16:21 2020 +0200 iwlwifi: mvm: take the required lock when clearing time event data When receiving a session protection end notification, the time event data is cleared without holding the required lock. Fix it. Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20200306151128.a49846a634e4.Id1ada7c5a964f5e25f4d0eacc2c4b050015b46a2@changeid commit aeb542a1b5c507ea117d21c3e3e012ba16f065ac Merge: b0b8a945ea29 140d7e88bb2a Author: Linus Torvalds Date: Fri Mar 6 07:18:36 2020 -0600 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "7 fixes" * emailed patches from Andrew Morton : arch/Kconfig: update HAVE_RELIABLE_STACKTRACE description mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled mm/z3fold.c: do not include rwlock.h directly fat: fix uninit-memory access for partial initialized inode mm: avoid data corruption on CoW fault into PFN-mapped VMA mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa commit 93e5fbb18cec70b3b5c614f67b65388829113bdd Author: Luke Nelson Date: Thu Mar 5 15:44:13 2020 -0800 selftests: bpf: Add test for JMP32 JSET BPF_X with upper bits set The existing tests attempt to check that JMP32 JSET ignores the upper bits in the operand registers. However, the tests missed one such bug in the x32 JIT that is only uncovered when a previous instruction pollutes the upper 32 bits of the registers. This patch adds a new test case that catches the bug by first executing a 64-bit JSET to pollute the upper 32-bits of the temporary registers, followed by a 32-bit JSET which should ignore the upper 32 bits. Co-developed-by: Xi Wang Signed-off-by: Xi Wang Signed-off-by: Luke Nelson Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200305234416.31597-2-luke.r.nels@gmail.com commit 80f1f85036355e5581ec0b99913410345ad3491b Author: Luke Nelson Date: Thu Mar 5 15:44:12 2020 -0800 bpf, x32: Fix bug with JMP32 JSET BPF_X checking upper bits The current x32 BPF JIT is incorrect for JMP32 JSET BPF_X when the upper 32 bits of operand registers are non-zero in certain situations. The problem is in the following code: case BPF_JMP | BPF_JSET | BPF_X: case BPF_JMP32 | BPF_JSET | BPF_X: ... /* and dreg_lo,sreg_lo */ EMIT2(0x23, add_2reg(0xC0, sreg_lo, dreg_lo)); /* and dreg_hi,sreg_hi */ EMIT2(0x23, add_2reg(0xC0, sreg_hi, dreg_hi)); /* or dreg_lo,dreg_hi */ EMIT2(0x09, add_2reg(0xC0, dreg_lo, dreg_hi)); This code checks the upper bits of the operand registers regardless if the BPF instruction is BPF_JMP32 or BPF_JMP64. Registers dreg_hi and dreg_lo are not loaded from the stack for BPF_JMP32, however, they can still be polluted with values from previous instructions. The following BPF program demonstrates the bug. The jset64 instruction loads the temporary registers and performs the jump, since ((u64)r7 & (u64)r8) is non-zero. The jset32 should _not_ be taken, as the lower 32 bits are all zero, however, the current JIT will take the branch due the pollution of temporary registers from the earlier jset64. mov64 r0, 0 ld64 r7, 0x8000000000000000 ld64 r8, 0x8000000000000000 jset64 r7, r8, 1 exit jset32 r7, r8, 1 mov64 r0, 2 exit The expected return value of this program is 2; under the buggy x32 JIT it returns 0. The fix is to skip using the upper 32 bits for jset32 and compare the upper 32 bits for jset64 only. All tests in test_bpf.ko and selftests/bpf/test_verifier continue to pass with this change. We found this bug using our automated verification tool, Serval. Fixes: 69f827eb6e14 ("x32: bpf: implement jitting of JMP32") Co-developed-by: Xi Wang Signed-off-by: Xi Wang Signed-off-by: Luke Nelson Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200305234416.31597-1-luke.r.nels@gmail.com commit 2b2e71fe657510a6f71aa16ef0309fa6bc20ab3d Author: Michael Walle Date: Tue Mar 3 18:42:59 2020 +0100 tty: serial: fsl_lpuart: free IDs allocated by IDA Since commit 3bc3206e1c0f ("serial: fsl_lpuart: Remove the alias node dependence") the port line number can also be allocated by IDA, but in case of an error the ID will no be removed again. More importantly, any ID will be freed in remove(), even if it wasn't allocated but instead fetched by of_alias_get_id(). If it was not allocated by IDA there will be a warning: WARN(1, "ida_free called for id=%d which is not allocated.\n", id); Move the ID allocation more to the end of the probe() so that we still can use plain return in the first error cases. Fixes: 3bc3206e1c0f ("serial: fsl_lpuart: Remove the alias node dependence") Signed-off-by: Michael Walle Cc: stable Link: https://lore.kernel.org/r/20200303174306.6015-3-michael@walle.cc Signed-off-by: Greg Kroah-Hartman commit 0e28ed6c9df986e937e488ec2a0c35bd4bb2a0af Author: Michael Walle Date: Tue Mar 3 18:42:58 2020 +0100 Revert "tty: serial: fsl_lpuart: drop EARLYCON_DECLARE" This reverts commit a659652f6169240a5818cb244b280c5a362ef5a4. This broke the earlycon on LS1021A processors because the order of the earlycon_setup() functions were changed. Before the commit the normal lpuart32_early_console_setup() was called. After the commit the lpuart32_imx_early_console_setup() is called instead. Fixes: a659652f6169 ("tty: serial: fsl_lpuart: drop EARLYCON_DECLARE") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20200303174306.6015-2-michael@walle.cc Signed-off-by: Greg Kroah-Hartman commit 35d4670aaec7206b5ef19c842ca33076bde562e4 Author: Ronald Tschalär Date: Tue Feb 11 11:47:23 2020 -0800 serdev: Fix detection of UART devices on Apple machines. On Apple devices the _CRS method returns an empty resource template, and the resource settings are instead provided by the _DSM method. But commit 33364d63c75d6182fa369cea80315cf1bb0ee38e (serdev: Add ACPI devices by ResourceSource field) changed the search for serdev devices to require valid, non-empty resource template, thereby breaking Apple devices and causing bluetooth devices to not be found. This expands the check so that if we don't find a valid template, and we're on an Apple machine, then just check for the device being an immediate child of the controller and having a "baud" property. Cc: # 5.5 Fixes: 33364d63c75d ("serdev: Add ACPI devices by ResourceSource field") Signed-off-by: Ronald Tschalär Link: https://lore.kernel.org/r/20200211194723.486217-1-ronald@innovation.ch Signed-off-by: Greg Kroah-Hartman commit 140d7e88bb2ac4af7b0db1fd6302179440f3c4be Author: Miroslav Benes Date: Thu Mar 5 22:28:45 2020 -0800 arch/Kconfig: update HAVE_RELIABLE_STACKTRACE description save_stack_trace_tsk_reliable() is not the only function providing the reliable stack traces anymore. Architecture might define ARCH_STACKWALK which provides a newer stack walking interface and has arch_stack_walk_reliable() function. Update the description accordingly. Signed-off-by: Andrew Morton Signed-off-by: Miroslav Benes Acked-by: Josh Poimboeuf Link: http://lkml.kernel.org/r/20200120154042.9934-1-mbenes@suse.cz Signed-off-by: Linus Torvalds commit c87cbc1f007c4b46165f05ceca04e1973cda0b9c Author: Vlastimil Babka Date: Thu Mar 5 22:28:42 2020 -0800 mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled Commit cd02cf1aceea ("mm/hotplug: fix an imbalance with DEBUG_PAGEALLOC") fixed memory hotplug with debug_pagealloc enabled, where onlining a page goes through page freeing, which removes the direct mapping. Some arches don't like when the page is not mapped in the first place, so generic_online_page() maps it first. This is somewhat wasteful, but better than special casing page freeing fast paths. The commit however missed that DEBUG_PAGEALLOC configured doesn't mean it's actually enabled. One has to test debug_pagealloc_enabled() since 031bc5743f15 ("mm/debug-pagealloc: make debug-pagealloc boottime configurable"), or alternatively debug_pagealloc_enabled_static() since 8e57f8acbbd1 ("mm, debug_pagealloc: don't rely on static keys too early"), but this is not done. As a result, a s390 kernel with DEBUG_PAGEALLOC configured but not enabled will crash: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 Fault in home space mode while using kernel ASCE. AS:0000001ece13400b R2:000003fff7fd000b R3:000003fff7fcc007 S:000003fff7fd7000 P:000000000000013d Oops: 0004 ilc:2 [#1] SMP CPU: 1 PID: 26015 Comm: chmem Kdump: loaded Tainted: GX 5.3.18-5-default #1 SLE15-SP2 (unreleased) Krnl PSW : 0704e00180000000 0000001ecd281b9e (__kernel_map_pages+0x166/0x188) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 0000000000000800 0000400b00000000 0000000000000100 0000000000000001 0000000000000000 0000000000000002 0000000000000100 0000001ece139230 0000001ecdd98d40 0000400b00000100 0000000000000000 000003ffa17e4000 001fffe0114f7d08 0000001ecd4d93ea 001fffe0114f7b20 Krnl Code: 0000001ecd281b8e: ec17ffff00d8 ahik %r1,%r7,-1 0000001ecd281b94: ec111dbc0355 risbg %r1,%r1,29,188,3 >0000001ecd281b9e: 94fb5006 ni 6(%r5),251 0000001ecd281ba2: 41505008 la %r5,8(%r5) 0000001ecd281ba6: ec51fffc6064 cgrj %r5,%r1,6,1ecd281b9e 0000001ecd281bac: 1a07 ar %r0,%r7 0000001ecd281bae: ec03ff584076 crj %r0,%r3,4,1ecd281a5e Call Trace: [<0000001ecd281b9e>] __kernel_map_pages+0x166/0x188 [<0000001ecd4d9516>] online_pages_range+0xf6/0x128 [<0000001ecd2a8186>] walk_system_ram_range+0x7e/0xd8 [<0000001ecda28aae>] online_pages+0x2fe/0x3f0 [<0000001ecd7d02a6>] memory_subsys_online+0x8e/0xc0 [<0000001ecd7add42>] device_online+0x5a/0xc8 [<0000001ecd7d0430>] state_store+0x88/0x118 [<0000001ecd5b9f62>] kernfs_fop_write+0xc2/0x200 [<0000001ecd5064b6>] vfs_write+0x176/0x1e0 [<0000001ecd50676a>] ksys_write+0xa2/0x100 [<0000001ecda315d4>] system_call+0xd8/0x2c8 Fix this by checking debug_pagealloc_enabled_static() before calling kernel_map_pages(). Backports for kernel before 5.5 should use debug_pagealloc_enabled() instead. Also add comments. Fixes: cd02cf1aceea ("mm/hotplug: fix an imbalance with DEBUG_PAGEALLOC") Reported-by: Gerald Schaefer Signed-off-by: Andrew Morton Signed-off-by: Vlastimil Babka Reviewed-by: David Hildenbrand Cc: Cc: Joonsoo Kim Cc: Qian Cai Link: http://lkml.kernel.org/r/20200224094651.18257-1-vbabka@suse.cz Signed-off-by: Linus Torvalds commit a8198fedd94590ba28c1537440cdb260718ac13b Author: Sebastian Andrzej Siewior Date: Thu Mar 5 22:28:39 2020 -0800 mm/z3fold.c: do not include rwlock.h directly rwlock.h should not be included directly. Instead linux/splinlock.h should be included. One thing it does is to break the RT build. Signed-off-by: Andrew Morton Signed-off-by: Sebastian Andrzej Siewior Cc: Peter Zijlstra Cc: Vitaly Wool Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20200224133631.1510569-1-bigeasy@linutronix.de Signed-off-by: Linus Torvalds commit bc87302a093f0eab45cd4e250c2021299f712ec6 Author: OGAWA Hirofumi Date: Thu Mar 5 22:28:36 2020 -0800 fat: fix uninit-memory access for partial initialized inode When get an error in the middle of reading an inode, some fields in the inode might be still not initialized. And then the evict_inode path may access those fields via iput(). To fix, this makes sure that inode fields are initialized. Reported-by: syzbot+9d82b8de2992579da5d0@syzkaller.appspotmail.com Signed-off-by: Andrew Morton Signed-off-by: OGAWA Hirofumi Cc: Link: http://lkml.kernel.org/r/871rqnreqx.fsf@mail.parknet.co.jp Signed-off-by: Linus Torvalds commit c3e5ea6ee574ae5e845a40ac8198de1fb63bb3ab Author: Kirill A. Shutemov Date: Thu Mar 5 22:28:32 2020 -0800 mm: avoid data corruption on CoW fault into PFN-mapped VMA Jeff Moyer has reported that one of xfstests triggers a warning when run on DAX-enabled filesystem: WARNING: CPU: 76 PID: 51024 at mm/memory.c:2317 wp_page_copy+0xc40/0xd50 ... wp_page_copy+0x98c/0xd50 (unreliable) do_wp_page+0xd8/0xad0 __handle_mm_fault+0x748/0x1b90 handle_mm_fault+0x120/0x1f0 __do_page_fault+0x240/0xd70 do_page_fault+0x38/0xd0 handle_page_fault+0x10/0x30 The warning happens on failed __copy_from_user_inatomic() which tries to copy data into a CoW page. This happens because of race between MADV_DONTNEED and CoW page fault: CPU0 CPU1 handle_mm_fault() do_wp_page() wp_page_copy() do_wp_page() madvise(MADV_DONTNEED) zap_page_range() zap_pte_range() ptep_get_and_clear_full() __copy_from_user_inatomic() sees empty PTE and fails WARN_ON_ONCE(1) clear_page() The solution is to re-try __copy_from_user_inatomic() under PTL after checking that PTE is matches the orig_pte. The second copy attempt can still fail, like due to non-readable PTE, but there's nothing reasonable we can do about, except clearing the CoW page. Reported-by: Jeff Moyer Signed-off-by: Andrew Morton Signed-off-by: Kirill A. Shutemov Tested-by: Jeff Moyer Cc: Cc: Justin He Cc: Dan Williams Link: http://lkml.kernel.org/r/20200218154151.13349-1-kirill.shutemov@linux.intel.com Signed-off-by: Linus Torvalds commit 8a8683ad9ba48b4b52a57f013513d1635c1ca5c4 Author: Huang Ying Date: Thu Mar 5 22:28:29 2020 -0800 mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() In set_pmd_migration_entry(), pmdp_invalidate() is used to change PMD atomically. But the PMD is read before that with an ordinary memory reading. If the THP (transparent huge page) is written between the PMD reading and pmdp_invalidate(), the PMD dirty bit may be lost, and cause data corruption. The race window is quite small, but still possible in theory, so need to be fixed. The race is fixed via using the return value of pmdp_invalidate() to get the original content of PMD, which is a read/modify/write atomic operation. So no THP writing can occur in between. The race has been introduced when the THP migration support is added in the commit 616b8371539a ("mm: thp: enable thp migration in generic path"). But this fix depends on the commit d52605d7cb30 ("mm: do not lose dirty and accessed bits in pmdp_invalidate()"). So it's easy to be backported after v4.16. But the race window is really small, so it may be fine not to backport the fix at all. Signed-off-by: Andrew Morton Signed-off-by: "Huang, Ying" Reviewed-by: Zi Yan Reviewed-by: William Kucharski Acked-by: Kirill A. Shutemov Cc: Cc: Vlastimil Babka Cc: Michal Hocko Cc: Andrea Arcangeli Link: http://lkml.kernel.org/r/20200220075220.2327056-1-ying.huang@intel.com Signed-off-by: Linus Torvalds commit 8b272b3cbbb50a6a8e62d8a15affd473a788e184 Author: Mel Gorman Date: Thu Mar 5 22:28:26 2020 -0800 mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa : A user reported a bug against a distribution kernel while running a : proprietary workload described as "memory intensive that is not swapping" : that is expected to apply to mainline kernels. The workload is : read/write/modifying ranges of memory and checking the contents. They : reported that within a few hours that a bad PMD would be reported followed : by a memory corruption where expected data was all zeros. A partial : report of the bad PMD looked like : : [ 5195.338482] ../mm/pgtable-generic.c:33: bad pmd ffff8888157ba008(000002e0396009e2) : [ 5195.341184] ------------[ cut here ]------------ : [ 5195.356880] kernel BUG at ../mm/pgtable-generic.c:35! : .... : [ 5195.410033] Call Trace: : [ 5195.410471] [] change_protection_range+0x7dd/0x930 : [ 5195.410716] [] change_prot_numa+0x18/0x30 : [ 5195.410918] [] task_numa_work+0x1fe/0x310 : [ 5195.411200] [] task_work_run+0x72/0x90 : [ 5195.411246] [] exit_to_usermode_loop+0x91/0xc2 : [ 5195.411494] [] prepare_exit_to_usermode+0x31/0x40 : [ 5195.411739] [] retint_user+0x8/0x10 : : Decoding revealed that the PMD was a valid prot_numa PMD and the bad PMD : was a false detection. The bug does not trigger if automatic NUMA : balancing or transparent huge pages is disabled. : : The bug is due a race in change_pmd_range between a pmd_trans_huge and : pmd_nond_or_clear_bad check without any locks held. During the : pmd_trans_huge check, a parallel protection update under lock can have : cleared the PMD and filled it with a prot_numa entry between the transhuge : check and the pmd_none_or_clear_bad check. : : While this could be fixed with heavy locking, it's only necessary to make : a copy of the PMD on the stack during change_pmd_range and avoid races. A : new helper is created for this as the check if quite subtle and the : existing similar helpful is not suitable. This passed 154 hours of : testing (usually triggers between 20 minutes and 24 hours) without : detecting bad PMDs or corruption. A basic test of an autonuma-intensive : workload showed no significant change in behaviour. Although Mel withdrew the patch on the face of LKML comment https://lkml.org/lkml/2017/4/10/922 the race window aforementioned is still open, and we have reports of Linpack test reporting bad residuals after the bad PMD warning is observed. In addition to that, bad rss-counter and non-zero pgtables assertions are triggered on mm teardown for the task hitting the bad PMD. host kernel: mm/pgtable-generic.c:40: bad pmd 00000000b3152f68(8000000d2d2008e7) .... host kernel: BUG: Bad rss-counter state mm:00000000b583043d idx:1 val:512 host kernel: BUG: non-zero pgtables_bytes on freeing mm: 4096 The issue is observed on a v4.18-based distribution kernel, but the race window is expected to be applicable to mainline kernels, as well. [akpm@linux-foundation.org: fix comment typo, per Rafael] Signed-off-by: Andrew Morton Signed-off-by: Rafael Aquini Signed-off-by: Mel Gorman Cc: Cc: Zi Yan Cc: "Kirill A. Shutemov" Cc: Vlastimil Babka Cc: Michal Hocko Link: http://lkml.kernel.org/r/20200216191800.22423-1-aquini@redhat.com Signed-off-by: Linus Torvalds commit b0b8a945ea29166706611820e609bce23e278f6b Merge: fe67d1821fa8 7589238a8cf3 Author: Linus Torvalds Date: Fri Mar 6 06:50:26 2020 -0600 Merge tag 'devprop-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework fix from Rafael Wysocki: "Revert a problematic commit from the 5.3 development cycle (Brendan Higgins)" * tag 'devprop-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "software node: Simplify software_node_release() function" commit fe67d1821fa8cd9856fc5e65d53ef73b450fa7d8 Merge: ba0ae9ac4607 86dfa5bec249 Author: Linus Torvalds Date: Fri Mar 6 06:49:09 2020 -0600 Merge tag 'acpi-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI documentation fix from Rafael Wysocki: "Fix Sphinx format warinings in an ACPI fan document added recently (Randy Dunlap)" * tag 'acpi-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Documentation/admin-guide/acpi: fix fan_performance_states.rst warnings commit ba0ae9ac46078c53adbb4485adbb3df779228287 Merge: 9f65ed5fe41c 2ac4853e295b Author: Linus Torvalds Date: Fri Mar 6 06:45:20 2020 -0600 Merge tag 'drm-fixes-2020-03-06' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Weekly fixes round, looks like a few people woke up, got a bunch of fixes across the drivers. Bit bigger than I'd like but they all seem fine and hopefully it quiets down now. sun4i, kirin, mediatek and exynos on the ARM side. virtio-gpu and core have some mmap fixes, and there is a dma-buf leak. one ttm fence leak is also fixed. Otherwise it's mostly amdgpu and i915. One of the i915 fixes is for a very long latency I was seeing (using latencytop) running gnome-shell locally when using firefox and eating nearly all my RAM, it really helps with desktop responsiveness esp when firefox is chewing a lot. dma-buf: - fix memory leak core: - shmem object mmap fix. ttm: - Fix fence leak in ttm_buffer_object_transfer(). amdgpu: - Gfx reset fix for gfx9, 10 - Fix for gfx10 - DP MST fix - DCC fix - Renoir power fixes - Navi power fix i915: - Break up long lists of object reclaim with cond_resched() - PSR probe fix - TGL workarounds - Selftest return value fix - Drop timeline mutex while waiting for retirement - Wait for OA configuration completion before writes to OA buffer virtio: - Fix resource id creation race in virtio. - mmap fixes sun4i: - Fixes for sun4i VI layer format support. kirin: - kirin: Revert "Fix for hikey620 display offset problem" exynos: - fix a kernel oops problem in case that driver is loaded as module. - fix a regulator warning issue when I2C DDC adapter cannot be gathered. - print out an error message only in error case excepting -EPROBE_DEFER. mediatek: - overlay, cursor and gce fixes" ` * tag 'drm-fixes-2020-03-06' of git://anongit.freedesktop.org/drm/drm: (38 commits) drm/amdgpu/display: navi1x copy dcn watermark clock settings to smu resume from s3 (v2) drm/amd/powerplay: map mclk to fclk for COMBINATIONAL_BYPASS case drm/amd/powerplay: fix pre-check condition for setting clock range drm/amd/display: fix dcc swath size calculations on dcn1 drm/amd/display: Clear link settings on MST disable connector drm/amdgpu: disable 3D pipe 1 on Navi1x drm/amdgpu: clean wptr on wb when gpu recovery drm: kirin: Revert "Fix for hikey620 display offset problem" drm/i915/gt: Drop the timeline->mutex as we wait for retirement drm/i915/perf: Reintroduce wait on OA configuration completion drm/sun4i: Fix DE2 VI layer format support drm/sun4i: Add separate DE3 VI layer formats drm/sun4i: de2/de3: Remove unsupported VI layer formats drm/i915/selftests: Fix return in assert_mmap_offset() drm/i915: Protect i915_request_await_start from early waits drm/i915/tgl: Add Wa_1608008084 drm/i915/tgl: Add Wa_22010178259:tgl drm/i915: Program MBUS with rmw during initialization drm/i915/psr: Force PSR probe only after full initialization drm/i915/gem: Break up long lists of object reclaim ... commit 441b62acd9c809e87bab45ad1d82b1b3b77cb4f0 Author: Ian Rogers Date: Thu Mar 5 23:11:08 2020 -0800 tools: Fix off-by 1 relative directory includes This is currently working due to extra include paths in the build. Committer testing: $ cd tools/include/uapi/asm/ Before this patch: $ ls -la ../../arch/x86/include/uapi/asm/errno.h ls: cannot access '../../arch/x86/include/uapi/asm/errno.h': No such file or directory $ After this patch; $ ls -la ../../../arch/x86/include/uapi/asm/errno.h -rw-rw-r--. 1 acme acme 31 Feb 20 12:42 ../../../arch/x86/include/uapi/asm/errno.h $ Check that that is still under tools/, i.e. hasn't escaped into the main kernel sources: $ cd ../../../arch/x86/include/uapi/asm/ $ pwd /home/acme/git/perf/tools/arch/x86/include/uapi/asm $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexios Zavras Cc: Andi Kleen Cc: Greg Kroah-Hartman Cc: Igor Lubashev Cc: Kan Liang Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Wei Li Link: http://lore.kernel.org/lkml/20200306071110.130202-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3f5777fbaf04c58d940526a22a2e0c813c837936 Author: John Garry Date: Thu Mar 5 19:08:01 2020 +0800 perf jevents: Fix leak of mapfile memory The memory for global pointer is never freed during normal program execution, so let's do that in the main function exit as a good programming practice. A stray blank line is also removed. Reported-by: Jiri Olsa Signed-off-by: John Garry Cc: Alexander Shishkin Cc: Andi Kleen Cc: James Clark Cc: Joakim Zhang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linuxarm@huawei.com Link: http://lore.kernel.org/lkml/1583406486-154841-2-git-send-email-john.garry@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 7b919a53102d81cd2e310b4941ac51c465d249ca Author: Tommi Rantala Date: Thu Mar 5 10:37:14 2020 +0200 perf bench: Clear struct sigaction before sigaction() syscall Avoid garbage in sigaction structs used in sigaction() syscalls. Valgrind is complaining about it. Signed-off-by: Tommi Rantala Cc: Alexander Shishkin Cc: Changbin Du Cc: Darren Hart Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lore.kernel.org/lkml/20200305083714.9381-4-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo commit f649bd9dd5d5004543bbc3c50b829577b49f5d75 Author: Tommi Rantala Date: Thu Mar 5 10:37:13 2020 +0200 perf bench futex-wake: Restore thread count default to online CPU count Since commit 3b2323c2c1c4 ("perf bench futex: Use cpumaps") the default number of threads the benchmark uses got changed from number of online CPUs to zero: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 15930]: blocking on 0 threads (at [private] futex 0x558b8ee4bfac), waking up 1 at a time. [Run 1]: Wokeup 0 of 0 threads in 0.0000 ms [...] [Run 10]: Wokeup 0 of 0 threads in 0.0000 ms Wokeup 0 of 0 threads in 0.0004 ms (+-40.82%) Restore the old behavior by grabbing the number of online CPUs via cpu->nr: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 18356]: blocking on 8 threads (at [private] futex 0xb3e62c), waking up 1 at a time. [Run 1]: Wokeup 8 of 8 threads in 0.0260 ms [...] [Run 10]: Wokeup 8 of 8 threads in 0.0270 ms Wokeup 8 of 8 threads in 0.0419 ms (+-24.35%) Fixes: 3b2323c2c1c4 ("perf bench futex: Use cpumaps") Signed-off-by: Tommi Rantala Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Darren Hart Cc: Davidlohr Bueso Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lore.kernel.org/lkml/20200305083714.9381-3-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo commit 29b4f5f188571c112713c35cc87eefb46efee612 Author: Tommi Rantala Date: Thu Mar 5 10:37:12 2020 +0200 perf top: Fix stdio interface input handling with glibc 2.28+ Since glibc 2.28 when running 'perf top --stdio', input handling no longer works, but hitting any key always just prints the "Mapped keys" help text. To fix it, call clearerr() in the display_thread() loop to clear any EOF sticky errors, as instructed in the glibc NEWS file (https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS): * All stdio functions now treat end-of-file as a sticky condition. If you read from a file until EOF, and then the file is enlarged by another process, you must call clearerr or another function with the same effect (e.g. fseek, rewind) before you can read the additional data. This corrects a longstanding C99 conformance bug. It is most likely to affect programs that use stdio to read interactive input from a terminal. (Bug #1190.) Signed-off-by: Tommi Rantala Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200305083714.9381-2-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo commit cfd3bc752a3f5529506d279deb42e3bc8055695b Author: Nick Desaulniers Date: Sun Feb 23 11:34:49 2020 -0800 perf diff: Fix undefined string comparision spotted by clang's -Wstring-compare clang warns: util/block-info.c:298:18: error: result of comparison against a string literal is unspecified (use an explicit string comparison function instead) [-Werror,-Wstring-compare] if ((start_line != SRCLINE_UNKNOWN) && (end_line != SRCLINE_UNKNOWN)) { ^ ~~~~~~~~~~~~~~~ util/block-info.c:298:51: error: result of comparison against a string literal is unspecified (use an explicit string comparison function instead) [-Werror,-Wstring-compare] if ((start_line != SRCLINE_UNKNOWN) && (end_line != SRCLINE_UNKNOWN)) { ^ ~~~~~~~~~~~~~~~ util/block-info.c:298:18: error: result of comparison against a string literal is unspecified (use an explicit string comparison function instead) [-Werror,-Wstring-compare] if ((start_line != SRCLINE_UNKNOWN) && (end_line != SRCLINE_UNKNOWN)) { ^ ~~~~~~~~~~~~~~~ util/block-info.c:298:51: error: result of comparison against a string literal is unspecified (use an explicit string comparison function instead) [-Werror,-Wstring-compare] if ((start_line != SRCLINE_UNKNOWN) && (end_line != SRCLINE_UNKNOWN)) { ^ ~~~~~~~~~~~~~~~ util/map.c:434:15: error: result of comparison against a string literal is unspecified (use an explicit string comparison function instead) [-Werror,-Wstring-compare] if (srcline != SRCLINE_UNKNOWN) ^ ~~~~~~~~~~~~~~~ Reviewer Notes: Looks good to me. Some more context: https://clang.llvm.org/docs/DiagnosticsReference.html#wstring-compare The spec says: J.1 Unspecified behavior The following are unspecified: .. Whether two string literals result in distinct arrays (6.4.5). Signed-off-by: Nick Desaulniers Reviewed-by: Ian Rogers Cc: Alexander Shishkin Cc: Changbin Du Cc: Jin Yao Cc: Jiri Olsa Cc: John Keeping Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: clang-built-linux@googlegroups.com Link: https://github.com/ClangBuiltLinux/linux/issues/900 Link: http://lore.kernel.org/lkml/20200223193456.25291-1-nick.desaulniers@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 95dbf14b236f3147f716cd159bd29461916c610e Author: Thomas Bogendoerfer Date: Fri Mar 6 11:58:37 2020 +0100 ALSA: sgio2audio: Remove usage of dropped hw_params/hw_free functions Commit ee88f4ebe575 ("ALSA: mips: Use managed buffer allocation") removed superfluous hw_params/hw_free callbacks, but forgot to remove them where they were used. Fixes: ee88f4ebe575 ("ALSA: mips: Use managed buffer allocation") Signed-off-by: Thomas Bogendoerfer Link: https://lore.kernel.org/r/20200306105837.31523-1-tsbogend@alpha.franken.de Signed-off-by: Takashi Iwai commit 8019ad13ef7f64be44d4f892af9c840179009254 Author: Peter Zijlstra Date: Wed Mar 4 11:28:31 2020 +0100 futex: Fix inode life-time issue As reported by Jann, ihold() does not in fact guarantee inode persistence. And instead of making it so, replace the usage of inode pointers with a per boot, machine wide, unique inode identifier. This sequence number is global, but shared (file backed) futexes are rare enough that this should not become a performance issue. Reported-by: Jann Horn Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) commit 86dfa5bec24952f99f2cfa778975d5a914c3a1d2 Merge: 98d54f81e36b ae99fb8baafc Author: Rafael J. Wysocki Date: Fri Mar 6 10:57:46 2020 +0100 Merge branch 'acpi-doc' * acpi-doc: Documentation/admin-guide/acpi: fix fan_performance_states.rst warnings commit 2398e3991bda7caa6b112a6f650fbab92f732b91 Author: Paolo Abeni Date: Wed Mar 4 16:51:07 2020 +0100 mptcp: always include dack if possible. Currently passive MPTCP socket can skip including the DACK option - if the peer sends data before accept() completes. The above happens because the msk 'can_ack' flag is set only after the accept() call. Such missing DACK option may cause - as per RFC spec - unwanted fallback to TCP. This change addresses the issue using the key material available in the current subflow, if any, to create a suitable dack option when msk ack seq is not yet available. v1 -> v2: - adavance the generated ack after the initial MPC packet Fixes: d22f4988ffec ("mptcp: process MP_CAPABLE data option") Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: David S. Miller commit a3aefbfe45751bf7b338c181b97608e276b5bb73 Author: Dan Carpenter Date: Wed Mar 4 17:24:31 2020 +0300 net: nfc: fix bounds checking bugs on "pipe" This is similar to commit 674d9de02aa7 ("NFC: Fix possible memory corruption when handling SHDLC I-Frame commands") and commit d7ee81ad09f0 ("NFC: nci: Add some bounds checking in nci_hci_cmd_received()") which added range checks on "pipe". The "pipe" variable comes skb->data[0] in nfc_hci_msg_rx_work(). It's in the 0-255 range. We're using it as the array index into the hdev->pipes[] array which has NFC_HCI_MAX_PIPES (128) members. Fixes: 118278f20aa8 ("NFC: hci: Add pipes table to reference them with a tuple {gate, host}") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 9803aac7b5508718989e4cde11b854fc01037b01 Author: Arnd Bergmann Date: Tue Jan 7 22:53:19 2020 +0100 drm/komeda: mark PM functions as __maybe_unused Without this, we get a couple of warnings when CONFIG_PM is disabled: drivers/gpu/drm/arm/display/komeda/komeda_drv.c:156:12: error: 'komeda_rt_pm_resume' defined but not used [-Werror=unused-function] static int komeda_rt_pm_resume(struct device *dev) ^~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/arm/display/komeda/komeda_drv.c:149:12: error: 'komeda_rt_pm_suspend' defined but not used [-Werror=unused-function] static int komeda_rt_pm_suspend(struct device *dev) ^~~~~~~~~~~~~~~~~~~~ Fixes: efb465088518 ("drm/komeda: Add runtime_pm support") Signed-off-by: Arnd Bergmann Reviewed-by: James Qian Wang (Arm Technology China) Signed-off-by: james qian wang (Arm Technology China) Link: https://patchwork.freedesktop.org/patch/msgid/20200107215327.1579195-1-arnd@arndb.de commit 2fa7e15c5f466fdd0c0b196b1dc4a65d191efd96 Author: Tina Zhang Date: Thu Mar 5 21:15:59 2020 +0800 drm/i915/gvt: Fix emulated vbt size issue The emulated vbt doesn't tell its size correctly. According to the intel_vbt_defs.h, vbt_header.vbt_size should the size of VBT (VBT Header, BDB Header and data blocks), and bdb_header.bdb_size should be the size of BDB (BDB Header and data blocks). This patch fixes the issue and lets vbt provided by GVT-g pass the guest i915's sanity test. v2: refine the commit message. (Zhenyu) Signed-off-by: Tina Zhang Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20200305131600.29640-1-tina.zhang@intel.com commit e25d5dbcffae62c9a7fa03517dfa4b8e67670e3d Author: Jiang Lidong Date: Wed Mar 4 09:49:29 2020 +0800 veth: ignore peer tx_dropped when counting local rx_dropped When local NET_RX backlog is full due to traffic overrun, peer veth tx_dropped counter increases. At that time, list local veth stats, rx_dropped has double value of peer tx_dropped, even bigger than transmit packets by peer. In NET_RX softirq process, if any packet drop case happens, it increases dev's rx_dropped counter and returns NET_RX_DROP. At veth tx side, it records any error returned from peer netif_rx into local dev tx_dropped counter. In veth get stats process, it puts local dev rx_dropped and peer dev tx_dropped into together as local rx_drpped value. So that it shows double value of real dropped packets number in this case. This patch ignores peer tx_dropped when counting local rx_dropped, since peer tx_dropped is duplicated to local rx_dropped at most cases. Signed-off-by: Jiang Lidong Signed-off-by: David S. Miller commit 2ac4853e295bba53209917e14af701c45c99ce04 Merge: 64c3fd53408d 09ed6ba43e65 Author: Dave Airlie Date: Fri Mar 6 11:06:33 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-03-05' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-03-05: amdgpu: - Gfx reset fix for gfx9, 10 - Fix for gfx10 - DP MST fix - DCC fix - Renoir power fixes - Navi power fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200305185957.4268-1-alexander.deucher@amd.com commit 64c3fd53408de5700b555ad612da2d79c58919ee Merge: 26398db1f49a 169c0aa4bc17 Author: Dave Airlie Date: Fri Mar 6 09:18:18 2020 +1000 Merge tag 'drm-intel-fixes-2020-03-05' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.6-rc5: - Break up long lists of object reclaim with cond_resched() - PSR probe fix - TGL workarounds - Selftest return value fix - Drop timeline mutex while waiting for retirement - Wait for OA configuration completion before writes to OA buffer Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87eeu7nl6z.fsf@intel.com commit 26398db1f49a63f93b789d43b3bc292242ff73d4 Merge: 70b8ea1ab1d3 1b79cfd99ff5 Author: Dave Airlie Date: Fri Mar 6 05:40:12 2020 +1000 Merge tag 'drm-misc-fixes-2020-03-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fixes for v5.6.rc5: - dma-buf fix memory leak - Fix resource id creation race in virtio. - Various mmap fixes. - Fix fence leak in ttm_buffer_object_transfer(). - Fixes for sun4i VI layer format support. - kirin: Revert "Fix for hikey620 display offset problem" Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/56de63c7-0cdf-5805-e268-44944af7fef2@linux.intel.com commit 0b136454741b2f6cb18d55e355d396db9248b2ab Author: Eli Cohen Date: Wed Feb 19 09:03:28 2020 +0200 net/mlx5: Clear LAG notifier pointer after unregister After returning from unregister_netdevice_notifier_dev_net(), set the notifier_call field to NULL so successive call to mlx5_lag_add() will function as expected. Fixes: 7907f23adc18 ("net/mlx5: Implement RoCE LAG feature") Signed-off-by: Eli Cohen Reviewed-by: Vlad Buslov Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed commit 404402abd5f90aa90a134eb9604b1750c1941529 Author: Sebastian Hense Date: Thu Feb 20 08:11:36 2020 +0100 net/mlx5e: Fix endianness handling in pedit mask The mask value is provided as 64 bit and has to be casted in either 32 or 16 bit. On big endian systems the wrong half was casted which resulted in an all zero mask. Fixes: 2b64beba0251 ("net/mlx5e: Support header re-write of partial fields in TC pedit offload") Signed-off-by: Sebastian Hense Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit f28ca65efa87b3fb8da3d69ca7cb1ebc0448de66 Author: Tariq Toukan Date: Mon Feb 24 13:56:53 2020 +0200 net/mlx5e: kTLS, Fix wrong value in record tracker enum Fix to match the HW spec: TRACKING state is 1, SEARCHING is 2. No real issue for now, as these values are not currently used. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Tariq Toukan Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit 56917766def72f5afdf4235adb91b6897ff26d9d Author: Tariq Toukan Date: Thu Feb 20 13:40:24 2020 +0200 net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow We have an off-by-1 issue in the TCP seq comparison. The last sequence number that belongs to the TCP packet's payload is not "start_seq + len", but one byte before it. Fix it so the 'ends_before' is evaluated properly. This fixes a bug that results in error completions in the kTLS HW offload flows. Fixes: ffbd9ca94e2e ("net/mlx5e: kTLS, Fix corner-case checks in TX resync flow") Signed-off-by: Tariq Toukan Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit 692b0399a22530b2de8490bea75a7d20d59391d0 Author: Hamdan Igbaria Date: Mon Feb 24 14:41:29 2020 +0200 net/mlx5: DR, Fix postsend actions write length Fix the send info write length to be (actions x action) size in bytes. Fixes: 297cccebdc5a ("net/mlx5: DR, Expose an internal API to issue RDMA operations") Signed-off-by: Hamdan Igbaria Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 2f63f2d5981499e5867aa061c9c8eb448494bb1e Merge: 3b4f06c715d0 b102f0c522cf Author: David S. Miller Date: Thu Mar 5 15:05:31 2020 -0800 Merge tag 'wireless-drivers-2020-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.6 Second set of fixes for v5.6. Only two small fixes this time. iwlwifi * fix another initialisation regression with 3168 devices mt76 * fix memory corruption with too many rx fragments ==================== Signed-off-by: David S. Miller commit 3b4f06c715d0d3ecd6497275e3c85fe91462d0ee Author: Tom Zhao Date: Thu Mar 5 11:38:45 2020 +0000 sfc: complete the next packet when we receive a timestamp We now ignore the "completion" event when using tx queue timestamping, and only pay attention to the two (high and low) timestamp events. The NIC will send a pair of timestamp events for every packet transmitted. The current firmware may merge the completion events, and it is possible that future versions may reorder the completion and timestamp events. As such the completion event is not useful. Without this patch in place a merged completion event on a queue with timestamping will cause a "spurious TX completion" error. This affects SFN8000-series adapters. Signed-off-by: Tom Zhao Acked-by: Martin Habets Signed-off-by: David S. Miller commit 849b4d94582a966ecb533448415462846da1f0fa Author: Martin KaFai Lau Date: Wed Mar 4 17:34:54 2020 -0800 bpf: Do not allow map_freeze in struct_ops map struct_ops map cannot support map_freeze. Otherwise, a struct_ops cannot be unregistered from the subsystem. Fixes: 85d33df357b6 ("bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS") Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200305013454.535397-1-kafai@fb.com commit 8e5290e710f4ffe8e9f8813e2ed0397a94d7b2f1 Author: Martin KaFai Lau Date: Wed Mar 4 17:34:47 2020 -0800 bpf: Return better error value in delete_elem for struct_ops map The current always succeed behavior in bpf_struct_ops_map_delete_elem() is not ideal for userspace tool. It can be improved to return proper error value. If it is in TOBEFREE, it means unregistration has been already done before but it is in progress and waiting for the subsystem to clear the refcnt to zero, so -EINPROGRESS. If it is INIT, it means the struct_ops has not been registered yet, so -ENOENT. Fixes: 85d33df357b6 ("bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS") Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200305013447.535326-1-kafai@fb.com commit a35a76faad53429b52a8937b69fdeee5b4e5f935 Merge: 52e7c083b417 c4ef2f3256e3 Author: Alexei Starovoitov Date: Thu Mar 5 13:59:13 2020 -0800 Merge branch 'fix_bpf_send_signal' Yonghong Song says: ==================== Commit 8b401f9ed244 ("bpf: implement bpf_send_signal() helper") introduced bpf_send_signal() helper and Commit 8482941f0906 ("bpf: Add bpf_send_signal_thread() helper") added bpf_send_signal_thread() helper. Both helpers try to send a signel to current process or thread. When bpf_prog is called with scheduler rq_lock held, a deadlock could happen since bpf_send_signal() and bpf_send_signal_thread() will call group_send_sig_info() which may ultimately want to acquire rq_lock() again. This happens in 5.2 and 4.16 based kernels in our production environment with perf_sw_event. In a different scenario, the following is also possible in the last kernel: cpu 1: do_task_stat <- holding sighand->siglock ... task_sched_runtime <- trying to grab rq_lock cpu 2: __schedule <- holding rq_lock ... do_send_sig_info <- trying to grab sighand->siglock Commit eac9153f2b58 ("bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()") has a similar issue with above rq_lock() deadlock. This patch set addressed the issue in a similar way. Patch #1 provided kernel solution and Patch #2 added a selftest. Changelogs: v2 -> v3: . simplify selftest send_signal_sched_switch(). The previous version has mmap/munmap inherited from Song's reproducer. They are not necessary in this context. v1 -> v2: . previous fix using task_work in nmi() is incorrect. there is no nmi() involvement here. Using task_work in all cases might be a solution. But decided to use a similar fix as in Commit eac9153f2b58. ==================== Signed-off-by: Alexei Starovoitov commit c4ef2f3256e3bc008f98121cad39ee5467db07a6 Author: Yonghong Song Date: Wed Mar 4 11:11:05 2020 -0800 selftests/bpf: Add send_signal_sched_switch test Added one test, send_signal_sched_switch, to test bpf_send_signal() helper triggered by sched/sched_switch tracepoint. This test can be used to verify kernel deadlocks fixed by the previous commit. The test itself is heavily borrowed from Commit eac9153f2b58 ("bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()"). Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Cc: Song Liu Link: https://lore.kernel.org/bpf/20200304191105.2796601-1-yhs@fb.com commit 1bc7896e9ef44fd77858b3ef0b8a6840be3a4494 Author: Yonghong Song Date: Wed Mar 4 11:11:04 2020 -0800 bpf: Fix deadlock with rq_lock in bpf_send_signal() When experimenting with bpf_send_signal() helper in our production environment (5.2 based), we experienced a deadlock in NMI mode: #5 [ffffc9002219f770] queued_spin_lock_slowpath at ffffffff8110be24 #6 [ffffc9002219f770] _raw_spin_lock_irqsave at ffffffff81a43012 #7 [ffffc9002219f780] try_to_wake_up at ffffffff810e7ecd #8 [ffffc9002219f7e0] signal_wake_up_state at ffffffff810c7b55 #9 [ffffc9002219f7f0] __send_signal at ffffffff810c8602 #10 [ffffc9002219f830] do_send_sig_info at ffffffff810ca31a #11 [ffffc9002219f868] bpf_send_signal at ffffffff8119d227 #12 [ffffc9002219f988] bpf_overflow_handler at ffffffff811d4140 #13 [ffffc9002219f9e0] __perf_event_overflow at ffffffff811d68cf #14 [ffffc9002219fa10] perf_swevent_overflow at ffffffff811d6a09 #15 [ffffc9002219fa38] ___perf_sw_event at ffffffff811e0f47 #16 [ffffc9002219fc30] __schedule at ffffffff81a3e04d #17 [ffffc9002219fc90] schedule at ffffffff81a3e219 #18 [ffffc9002219fca0] futex_wait_queue_me at ffffffff8113d1b9 #19 [ffffc9002219fcd8] futex_wait at ffffffff8113e529 #20 [ffffc9002219fdf0] do_futex at ffffffff8113ffbc #21 [ffffc9002219fec0] __x64_sys_futex at ffffffff81140d1c #22 [ffffc9002219ff38] do_syscall_64 at ffffffff81002602 #23 [ffffc9002219ff50] entry_SYSCALL_64_after_hwframe at ffffffff81c00068 The above call stack is actually very similar to an issue reported by Commit eac9153f2b58 ("bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()") by Song Liu. The only difference is bpf_send_signal() helper instead of bpf_get_stack() helper. The above deadlock is triggered with a perf_sw_event. Similar to Commit eac9153f2b58, the below almost identical reproducer used tracepoint point sched/sched_switch so the issue can be easily caught. /* stress_test.c */ #include #include #include #include #include #include #include #define THREAD_COUNT 1000 char *filename; void *worker(void *p) { void *ptr; int fd; char *pptr; fd = open(filename, O_RDONLY); if (fd < 0) return NULL; while (1) { struct timespec ts = {0, 1000 + rand() % 2000}; ptr = mmap(NULL, 4096 * 64, PROT_READ, MAP_PRIVATE, fd, 0); usleep(1); if (ptr == MAP_FAILED) { printf("failed to mmap\n"); break; } munmap(ptr, 4096 * 64); usleep(1); pptr = malloc(1); usleep(1); pptr[0] = 1; usleep(1); free(pptr); usleep(1); nanosleep(&ts, NULL); } close(fd); return NULL; } int main(int argc, char *argv[]) { void *ptr; int i; pthread_t threads[THREAD_COUNT]; if (argc < 2) return 0; filename = argv[1]; for (i = 0; i < THREAD_COUNT; i++) { if (pthread_create(threads + i, NULL, worker, NULL)) { fprintf(stderr, "Error creating thread\n"); return 0; } } for (i = 0; i < THREAD_COUNT; i++) pthread_join(threads[i], NULL); return 0; } and the following command: 1. run `stress_test /bin/ls` in one windown 2. hack bcc trace.py with the following change: --- a/tools/trace.py +++ b/tools/trace.py @@ -513,6 +513,7 @@ BPF_PERF_OUTPUT(%s); __data.tgid = __tgid; __data.pid = __pid; bpf_get_current_comm(&__data.comm, sizeof(__data.comm)); + bpf_send_signal(10); %s %s %s.perf_submit(%s, &__data, sizeof(__data)); 3. in a different window run ./trace.py -p $(pidof stress_test) t:sched:sched_switch The deadlock can be reproduced in our production system. Similar to Song's fix, the fix is to delay sending signal if irqs is disabled to avoid deadlocks involving with rq_lock. With this change, my above stress-test in our production system won't cause deadlock any more. I also implemented a scale-down version of reproducer in the selftest (a subsequent commit). With latest bpf-next, it complains for the following potential deadlock. [ 32.832450] -> #1 (&p->pi_lock){-.-.}: [ 32.833100] _raw_spin_lock_irqsave+0x44/0x80 [ 32.833696] task_rq_lock+0x2c/0xa0 [ 32.834182] task_sched_runtime+0x59/0xd0 [ 32.834721] thread_group_cputime+0x250/0x270 [ 32.835304] thread_group_cputime_adjusted+0x2e/0x70 [ 32.835959] do_task_stat+0x8a7/0xb80 [ 32.836461] proc_single_show+0x51/0xb0 ... [ 32.839512] -> #0 (&(&sighand->siglock)->rlock){....}: [ 32.840275] __lock_acquire+0x1358/0x1a20 [ 32.840826] lock_acquire+0xc7/0x1d0 [ 32.841309] _raw_spin_lock_irqsave+0x44/0x80 [ 32.841916] __lock_task_sighand+0x79/0x160 [ 32.842465] do_send_sig_info+0x35/0x90 [ 32.842977] bpf_send_signal+0xa/0x10 [ 32.843464] bpf_prog_bc13ed9e4d3163e3_send_signal_tp_sched+0x465/0x1000 [ 32.844301] trace_call_bpf+0x115/0x270 [ 32.844809] perf_trace_run_bpf_submit+0x4a/0xc0 [ 32.845411] perf_trace_sched_switch+0x10f/0x180 [ 32.846014] __schedule+0x45d/0x880 [ 32.846483] schedule+0x5f/0xd0 ... [ 32.853148] Chain exists of: [ 32.853148] &(&sighand->siglock)->rlock --> &p->pi_lock --> &rq->lock [ 32.853148] [ 32.854451] Possible unsafe locking scenario: [ 32.854451] [ 32.855173] CPU0 CPU1 [ 32.855745] ---- ---- [ 32.856278] lock(&rq->lock); [ 32.856671] lock(&p->pi_lock); [ 32.857332] lock(&rq->lock); [ 32.857999] lock(&(&sighand->siglock)->rlock); Deadlock happens on CPU0 when it tries to acquire &sighand->siglock but it has been held by CPU1 and CPU1 tries to grab &rq->lock and cannot get it. This is not exactly the callstack in our production environment, but sympotom is similar and both locks are using spin_lock_irqsave() to acquire the lock, and both involves rq_lock. The fix to delay sending signal when irq is disabled also fixed this issue. Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Cc: Song Liu Link: https://lore.kernel.org/bpf/20200304191104.2796501-1-yhs@fb.com commit af33d2433b03d63ed31fcfda842f46676a5e1afc Author: Tycho Andersen Date: Sat Feb 8 08:18:17 2020 -0700 riscv: fix seccomp reject syscall code path If secure_computing() rejected a system call, we were previously setting the system call number to -1, to indicate to later code that the syscall failed. However, if something (e.g. a user notification) was sleeping, and received a signal, we may set a0 to -ERESTARTSYS and re-try the system call again. In this case, seccomp "denies" the syscall (because of the signal), and we would set a7 to -1, thus losing the value of the system call we want to restart. Instead, let's return -1 from do_syscall_trace_enter() to indicate that the syscall was rejected, so we don't clobber the value in case of -ERESTARTSYS or whatever. This commit fixes the user_notification_signal seccomp selftest on riscv to no longer hang. That test expects the system call to be re-issued after the signal, and it wasn't due to the above bug. Now that it is, everything works normally. Note that in the ptrace (tracer) case, the tracer can set the register values to whatever they want, so we still need to keep the code that handles out-of-bounds syscalls. However, we can drop the comment. We can also drop syscall_set_nr(), since it is no longer used anywhere, and the code that re-loads the value in a7 because of it. Reported in: https://lore.kernel.org/bpf/CAEn-LTp=ss0Dfv6J00=rCAy+N78U2AmhqJNjfqjr2FDpPYjxEQ@mail.gmail.com/ Reported-by: David Abdurachmanov Signed-off-by: Tycho Andersen Reviewed-by: Kees Cook Signed-off-by: Palmer Dabbelt commit 153031a301bb07194e9c37466cfce8eacb977621 Author: Cengiz Can Date: Wed Mar 4 13:58:19 2020 +0300 blktrace: fix dereference after null check There was a recent change in blktrace.c that added a RCU protection to `q->blk_trace` in order to fix a use-after-free issue during access. However the change missed an edge case that can lead to dereferencing of `bt` pointer even when it's NULL: Coverity static analyzer marked this as a FORWARD_NULL issue with CID 1460458. ``` /kernel/trace/blktrace.c: 1904 in sysfs_blk_trace_attr_store() 1898 ret = 0; 1899 if (bt == NULL) 1900 ret = blk_trace_setup_queue(q, bdev); 1901 1902 if (ret == 0) { 1903 if (attr == &dev_attr_act_mask) >>> CID 1460458: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "bt". 1904 bt->act_mask = value; 1905 else if (attr == &dev_attr_pid) 1906 bt->pid = value; 1907 else if (attr == &dev_attr_start_lba) 1908 bt->start_lba = value; 1909 else if (attr == &dev_attr_end_lba) ``` Added a reassignment with RCU annotation to fix the issue. Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU") Cc: stable@vger.kernel.org Reviewed-by: Ming Lei Reviewed-by: Bob Liu Reviewed-by: Steven Rostedt (VMware) Signed-off-by: Cengiz Can Signed-off-by: Jens Axboe commit b85c821083359ef9fd524321af6f2a5d91730459 Author: Andy Shevchenko Date: Thu Mar 5 14:31:08 2020 +0200 MAINTAINERS: Add missed files related to Synopsys DesignWare UART 8250_dw has been split to library part and the driver, the library is being used by 8250_lpss, which represents Synosys DesignWare UART (with optional Synopsys Designware DMA) enumerated by PCI. Add missed above mentioned files to the database record for review. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20200305123108.41320-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 10c5ccc3c6d32f3d7d6c07de1d3f0f4b52f3e3ab Author: Jay Dolan Date: Thu Mar 5 06:05:04 2020 -0800 serial: 8250_exar: add support for ACCES cards Add ACCES VIDs and PIDs that use the Exar chips Signed-off-by: Jay Dolan Cc: stable Link: https://lore.kernel.org/r/20200305140504.22237-1-jay.dolan@accesio.com Signed-off-by: Greg Kroah-Hartman commit 0a91330b2af9f71ceeeed483f92774182b58f6d9 Author: Yash Shah Date: Wed Feb 19 09:19:07 2020 +0530 riscv: dts: Add GPIO reboot method to HiFive Unleashed DTS file Add the ability to reboot the HiFive Unleashed board via GPIO. Signed-off-by: Yash Shah Reviewed-by: Anup Patel Signed-off-by: Palmer Dabbelt commit 4a3e208474204e879d22a310b244cb2f39e5b1f8 Author: tangbin Date: Thu Mar 5 09:38:23 2020 +0800 tty:serial:mvebu-uart:fix a wrong return in this place, the function should return a negative value and the PTR_ERR already returns a negative,so return -PTR_ERR() is wrong. Signed-off-by: tangbin Cc: stable Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20200305013823.20976-1-tangbin@cmss.chinamobile.com Signed-off-by: Greg Kroah-Hartman commit 68e1006f618e509fc7869259fe83ceec4a95dac3 Author: Jian Shen Date: Thu Mar 5 09:47:53 2020 +0800 net: hns3: fix a not link up issue when fibre port supports autoneg When fibre port supports auto-negotiation, the IMP(Intelligent Management Process) processes the speed of auto-negotiation and the user's speed separately. For below case, the port will get a not link up problem. step 1: disables auto-negotiation and sets speed to A, then the driver's MAC speed will be updated to A. step 2: enables auto-negotiation and MAC gets negotiated speed B, then the driver's MAC speed will be updated to B through querying in periodical task. step 3: MAC gets new negotiated speed A. step 4: disables auto-negotiation and sets speed to B before periodical task query new MAC speed A, the driver will ignore the speed configuration. This patch fixes it by skipping speed and duplex checking when fibre port supports auto-negotiation. Fixes: 22f48e24a23d ("net: hns3: add autoneg and change speed support for fibre port") Signed-off-by: Jian Shen Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 110a40dfb708fe940a3f3704d470e431c368d256 Author: Eric Dumazet Date: Wed Mar 4 15:51:43 2020 -0800 slip: make slhc_compress() more robust against malicious packets Before accessing various fields in IPV4 network header and TCP header, make sure the packet : - Has IP version 4 (ip->version == 4) - Has not a silly network length (ip->ihl >= 5) - Is big enough to hold network and transport headers - Has not a silly TCP header size (th->doff >= sizeof(struct tcphdr) / 4) syzbot reported : BUG: KMSAN: uninit-value in slhc_compress+0x5b9/0x2e60 drivers/net/slip/slhc.c:270 CPU: 0 PID: 11728 Comm: syz-executor231 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 slhc_compress+0x5b9/0x2e60 drivers/net/slip/slhc.c:270 ppp_send_frame drivers/net/ppp/ppp_generic.c:1637 [inline] __ppp_xmit_process+0x1902/0x2970 drivers/net/ppp/ppp_generic.c:1495 ppp_xmit_process+0x147/0x2f0 drivers/net/ppp/ppp_generic.c:1516 ppp_write+0x6bb/0x790 drivers/net/ppp/ppp_generic.c:512 do_loop_readv_writev fs/read_write.c:717 [inline] do_iter_write+0x812/0xdc0 fs/read_write.c:1000 compat_writev+0x2df/0x5a0 fs/read_write.c:1351 do_compat_pwritev64 fs/read_write.c:1400 [inline] __do_compat_sys_pwritev fs/read_write.c:1420 [inline] __se_compat_sys_pwritev fs/read_write.c:1414 [inline] __ia32_compat_sys_pwritev+0x349/0x3f0 fs/read_write.c:1414 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f7cd99 Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000ffdb84ac EFLAGS: 00000217 ORIG_RAX: 000000000000014e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000040047459 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] ppp_write+0x115/0x790 drivers/net/ppp/ppp_generic.c:500 do_loop_readv_writev fs/read_write.c:717 [inline] do_iter_write+0x812/0xdc0 fs/read_write.c:1000 compat_writev+0x2df/0x5a0 fs/read_write.c:1351 do_compat_pwritev64 fs/read_write.c:1400 [inline] __do_compat_sys_pwritev fs/read_write.c:1420 [inline] __se_compat_sys_pwritev fs/read_write.c:1414 [inline] __ia32_compat_sys_pwritev+0x349/0x3f0 fs/read_write.c:1414 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 Fixes: b5451d783ade ("slip: Move the SLIP drivers") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 52e7c083b417417bb4352ebf3a6409988b6af238 Author: Quentin Monnet Date: Wed Feb 26 17:13:53 2020 +0000 mailmap: Update email address My Netronome address is no longer active. I am no maintainer, but get_maintainer.pl sometimes returns my name for a small number of files (BPF-related). Add an entry to .mailmap for good measure. Signed-off-by: Quentin Monnet Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200226171353.18982-1-quentin@isovalent.com Signed-off-by: Alexei Starovoitov commit d2047aba2e68f02119fa28904364070b98d92cd8 Author: Anup Patel Date: Tue Dec 3 03:49:39 2019 +0000 RISC-V: Select Goldfish RTC driver for QEMU virt machine We select Goldfish RTC driver using QEMU virt machine kconfig option to access RTC device on QEMU virt machine. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Palmer Dabbelt Reviewed-by: Alistair Francis Signed-off-by: Palmer Dabbelt commit 81e2d3c52c0ef819d2fe68ebe2e167045938929e Author: Anup Patel Date: Tue Dec 3 03:49:37 2019 +0000 RISC-V: Select SYSCON Reboot and Poweroff for QEMU virt machine The SYSCON Reboot and Poweroff drivers can be used on QEMU virt machine to reboot or poweroff the system hence we select these drivers using QEMU virt machine kconfig option. Signed-off-by: Anup Patel Reviewed-by: Palmer Dabbelt Reviewed-by: Alistair Francis Signed-off-by: Palmer Dabbelt commit a4485398b6b86334aa26dff5088b3e7e8a87682d Author: Anup Patel Date: Tue Dec 3 03:49:34 2019 +0000 RISC-V: Enable QEMU virt machine support in defconfigs We have kconfig option for QEMU virt machine so let's enable it in RV32 and RV64 defconfigs. Also, we remove various VIRTIO configs from RV32 and RV64 defconfigs because these are now selected by QEMU virt machine kconfig option. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Palmer Dabbelt Reviewed-by: Alistair Francis Signed-off-by: Palmer Dabbelt commit 759bdc168181abeff61399d0f7ecec2852cc3e61 Author: Anup Patel Date: Tue Dec 3 03:49:31 2019 +0000 RISC-V: Add kconfig option for QEMU virt machine We add kconfig option for QEMU virt machine and select all required VIRTIO drivers using this kconfig option. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Reviewed-by: Palmer Dabbelt Reviewed-by: Alistair Francis Signed-off-by: Palmer Dabbelt commit 9f65ed5fe41ce08ed1cb1f6a950f9ec694c142ad Merge: 6fd145da21af 5313b2a58ef0 Author: Linus Torvalds Date: Thu Mar 5 12:23:22 2020 -0600 Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V update from Wei Liu: - Update MAINTAINERS file for Hyper-V - One cleanup patch for Hyper-V HID driver * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: HID: hyperv: NULL check before some freeing functions is not needed. Hyper-V: add myself as a maintainer Hyper-V: Drop Sasha Levin from the Hyper-V maintainers commit 6fd145da21af43dd069463d83d89aefcc6675eba Merge: 776e49e8ddb5 25962e1a7f1d Author: Linus Torvalds Date: Thu Mar 5 12:19:34 2020 -0600 Merge tag 'dmaengine-fix-5.6-rc5' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "A bunch of driver fixes: - Doc updates to clean warnings for dmaengine - Fixes for newly added Intel idxd driver - More fixes for newly added TI k3-udma driver - Fixes for IMX and Tegra drivers" * tag 'dmaengine-fix-5.6-rc5' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: imx-sdma: Fix the event id check to include RX event for UART6 dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list dmaengine: tegra-apb: Fix use-after-free dmaengine: imx-sdma: fix context cache dmaengine: idxd: wq size configuration needs to check global max size dmaengine: idxd: sysfs input of wq incorrect wq type should return error dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() dmaengine: idxd: correct reserved token calculation dmaengine: ti: k3-udma: Fix terminated transfer handling dmaengine: ti: k3-udma: Use the channel direction in pause/resume functions dmaengine: ti: k3-udma: Use the TR counter helper for slave_sg and cyclic dmaengine: ti: k3-udma: Move the TR counter calculation to helper function dmaengine: ti: k3-udma: Workaround for RX teardown with stale data in peer dmaengine: ti: k3-udma: Use ktime/usleep_range based TX completion check dmaengine: idxd: Fix error handling in idxd_wq_cdev_dev_setup() dmaengine: doc: fix warnings/issues of client.rst dmaengine: idxd: fix runaway module ref count on device driver bind commit e8dca30f7118461d47e1c3510d0e31b277439151 Author: Jernej Skrabec Date: Thu Mar 5 00:25:09 2020 +0100 drm/bridge: dw-hdmi: fix AVI frame colorimetry CTA-861-F explicitly states that for RGB colorspace colorimetry should be set to "none". Fix that. Acked-by: Laurent Pinchart Fixes: def23aa7e982 ("drm: bridge: dw-hdmi: Switch to V4L bus format and encodings") Signed-off-by: Jernej Skrabec Link: https://patchwork.freedesktop.org/patch/msgid/20200304232512.51616-2-jernej.skrabec@siol.net commit 4ab50af63d2eb5da5c1571f8518948514f535782 Author: Juergen Gross Date: Thu Mar 5 16:51:29 2020 +0100 xen/blkfront: fix ring info addressing Commit 0265d6e8ddb890 ("xen/blkfront: limit allocated memory size to actual use case") made struct blkfront_ring_info size dynamic. This is fine when running with only one queue, but with multiple queues the addressing of the single queues has to be adapted as the structs are allocated in an array. Fixes: 0265d6e8ddb890 ("xen/blkfront: limit allocated memory size to actual use case") Reported-by: Sander Eikelenboom Tested-by: Sander Eikelenboom Signed-off-by: Juergen Gross Acked-by: Roger Pau Monné Link: https://lore.kernel.org/r/20200305155129.28326-1-jgross@suse.com Signed-off-by: Boris Ostrovsky commit 2f69a110e7bba3ec6bc089a2f736ca0941d887ed Author: Juergen Gross Date: Thu Mar 5 11:03:23 2020 +0100 xen/xenbus: fix locking Commit 060eabe8fbe726 ("xenbus/backend: Protect xenbus callback with lock") introduced a bug by holding a lock while calling a function which might schedule. Fix that by using a semaphore instead. Fixes: 060eabe8fbe726 ("xenbus/backend: Protect xenbus callback with lock") Signed-off-by: Juergen Gross Link: https://lore.kernel.org/r/20200305100323.16736-1-jgross@suse.com Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky commit 8130b9d5b5abf26f9927b487c15319a187775f34 Author: Dongli Zhang Date: Tue Mar 3 14:14:23 2020 -0800 xenbus: req->err should be updated before req->state This patch adds the barrier to guarantee that req->err is always updated before req->state. Otherwise, read_reply() would not return ERR_PTR(req->err) but req->body, when process_writes()->xb_write() is failed. Signed-off-by: Dongli Zhang Link: https://lore.kernel.org/r/20200303221423.21962-2-dongli.zhang@oracle.com Reviewed-by: Julien Grall Signed-off-by: Boris Ostrovsky commit 1b6a51e86cce38cf4d48ce9c242120283ae2f603 Author: Dongli Zhang Date: Tue Mar 3 14:14:22 2020 -0800 xenbus: req->body should be updated before req->state The req->body should be updated before req->state is updated and the order should be guaranteed by a barrier. Otherwise, read_reply() might return req->body = NULL. Below is sample callstack when the issue is reproduced on purpose by reordering the updates of req->body and req->state and adding delay in code between updates of req->state and req->body. [ 22.356105] general protection fault: 0000 [#1] SMP PTI [ 22.361185] CPU: 2 PID: 52 Comm: xenwatch Not tainted 5.5.0xen+ #6 [ 22.366727] Hardware name: Xen HVM domU, BIOS ... [ 22.372245] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60 ... ... [ 22.392163] RSP: 0018:ffffb2d64023fdf0 EFLAGS: 00010246 [ 22.395933] RAX: 0000000000000000 RBX: 75746e7562755f6d RCX: 0000000000000000 [ 22.400871] RDX: 0000000000000000 RSI: ffffb2d64023fdfc RDI: 75746e7562755f6d [ 22.405874] RBP: 0000000000000000 R08: 00000000000001e8 R09: 0000000000cdcdcd [ 22.410945] R10: ffffb2d6402ffe00 R11: ffff9d95395eaeb0 R12: ffff9d9535935000 [ 22.417613] R13: ffff9d9526d4a000 R14: ffff9d9526f4f340 R15: ffff9d9537654000 [ 22.423726] FS: 0000000000000000(0000) GS:ffff9d953bc80000(0000) knlGS:0000000000000000 [ 22.429898] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.434342] CR2: 000000c4206a9000 CR3: 00000001ea3fc002 CR4: 00000000001606e0 [ 22.439645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.444941] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.450342] Call Trace: [ 22.452509] simple_strtoull+0x27/0x70 [ 22.455572] xenbus_transaction_start+0x31/0x50 [ 22.459104] netback_changed+0x76c/0xcc1 [xen_netfront] [ 22.463279] ? find_watch+0x40/0x40 [ 22.466156] xenwatch_thread+0xb4/0x150 [ 22.469309] ? wait_woken+0x80/0x80 [ 22.472198] kthread+0x10e/0x130 [ 22.474925] ? kthread_park+0x80/0x80 [ 22.477946] ret_from_fork+0x35/0x40 [ 22.480968] Modules linked in: xen_kbdfront xen_fbfront(+) xen_netfront xen_blkfront [ 22.486783] ---[ end trace a9222030a747c3f7 ]--- [ 22.490424] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60 The virt_rmb() is added in the 'true' path of test_reply(). The "while" is changed to "do while" so that test_reply() is used as a read memory barrier. Signed-off-by: Dongli Zhang Link: https://lore.kernel.org/r/20200303221423.21962-1-dongli.zhang@oracle.com Reviewed-by: Julien Grall Signed-off-by: Boris Ostrovsky commit e8dc73c9f9ea554b36093dea23e4ca3b586105d7 Author: Gustavo A. R. Silva Date: Wed Feb 26 15:26:12 2020 -0600 xen: Replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200226212612.GA4663@embeddedor Reviewed-by: Juergen Gross Signed-off-by: Boris Ostrovsky commit 8b33a134a9cc2a501f8fc731d91caef39237d495 Author: Jian-Hong Pan Date: Tue Feb 25 15:29:21 2020 +0800 ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 A headset on the laptop like ASUS B9450FA does not work, until quirk ALC294_FIXUP_ASUS_HPE is applied. Signed-off-by: Jian-Hong Pan Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/20200225072920.109199-1-jian-hong@endlessm.com Signed-off-by: Takashi Iwai commit 09ed6ba43e659474878b22d40b141a01d09ec857 Author: Hersen Wu Date: Thu Feb 13 10:50:13 2020 -0500 drm/amdgpu/display: navi1x copy dcn watermark clock settings to smu resume from s3 (v2) This interface is for dGPU Navi1x. Linux dc-pplib interface depends on window driver dc implementation. For Navi1x, clock settings of dcn watermarks are fixed. the settings should be passed to smu during boot up and resume from s3. boot up: dc calculate dcn watermark clock settings within dc_create, dcn20_resource_construct, then call pplib functions below to pass the settings to smu: smu_set_watermarks_for_clock_ranges smu_set_watermarks_table navi10_set_watermarks_table smu_write_watermarks_table For Renoir, clock settings of dcn watermark are also fixed values. dc has implemented different flow for window driver: dc_hardware_init / dc_set_power_state dcn10_init_hw notify_wm_ranges set_wm_ranges For Linux smu_set_watermarks_for_clock_ranges renoir_set_watermarks_table smu_write_watermarks_table dc_hardware_init -> amdgpu_dm_init dc_set_power_state --> dm_resume therefore, linux dc-pplib interface of navi10/12/14 is different from that of Renoir. v2: add missing unlock in error case Signed-off-by: Hersen Wu Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit ab65a371dd5f5cba6bd9a58a1a6d4115a71cc5c9 Author: Prike Liang Date: Wed Mar 4 10:36:21 2020 +0800 drm/amd/powerplay: map mclk to fclk for COMBINATIONAL_BYPASS case When hit COMBINATIONAL_BYPASS the mclk will be bypass and can export fclk frequency to user usage. Signed-off-by: Prike Liang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 80381d40c9bf5218db06a7d7246c5478c95987ee Author: Prike Liang Date: Mon Mar 2 09:36:15 2020 +0800 drm/amd/powerplay: fix pre-check condition for setting clock range This fix will handle some MP1 FW issue like as mclk dpm table in renoir has a reverse dpm clock layout and a zero frequency dpm level as following case. cat pp_dpm_mclk 0: 1200Mhz 1: 1200Mhz 2: 800Mhz 3: 0Mhz Signed-off-by: Prike Liang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a0275dfc82c9034eefbeffd556cca6dd239d7925 Author: Josip Pavic Date: Fri Feb 21 12:26:19 2020 -0500 drm/amd/display: fix dcc swath size calculations on dcn1 [Why] Swath sizes are being calculated incorrectly. The horizontal swath size should be the product of block height, viewport width, and bytes per element, but the calculation uses viewport height instead of width. The vertical swath size is similarly incorrectly calculated. The effect of this is that we report the wrong DCC caps. [How] Use viewport width in the horizontal swath size calculation and viewport height in the vertical swath size calculation. Signed-off-by: Josip Pavic Reviewed-by: Aric Cyr Acked-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 5ac7fd2f597b88ee81f4748ee50cab06192a8dc3 Author: Bhawanpreet Lakha Date: Thu Feb 20 11:16:14 2020 -0500 drm/amd/display: Clear link settings on MST disable connector [Why] If we have a single MST display and we disconnect it, we dont disable that link. This causes the old link settings to still exist Now on a replug for MST we think its a link loss and will try to reallocate mst payload which will fail, throwing warning below. [ 129.374192] [drm] Failed to updateMST allocation table forpipe idx:0 [ 129.374206] ------------[ cut here ]------------ [ 129.374284] WARNING: CPU: 14 PID: 1710 at drivers/gpu/drm/amd/amdgpu/../dal-dev/dc/core/dc_link.c:3153 dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu] [ 129.374285] Modules linked in: amdgpu(OE) amd_iommu_v2 gpu_sched ttm drm_kms_helper drm fb_sys_fops syscopyarea sysfillrect sysimgblt binfmt_misc nls_iso8859_1 edac_mce_amd snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio kvm snd_hda_codec_hdmi snd_hda_intel snd_intel_nhlt snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi crct10dif_pclmul snd_seq crc32_pclmul ghash_clmulni_intel snd_seq_device snd_timer snd aesni_intel eeepc_wmi crypto_simd asus_wmi joydev cryptd sparse_keymap input_leds soundcore video glue_helper wmi_bmof mxm_wmi k10temp ccp mac_hid sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid igb i2c_algo_bit ahci dca i2c_piix4 libahci gpio_amdpt wmi gpio_generic [ 129.374318] CPU: 14 PID: 1710 Comm: kworker/14:2 Tainted: G W OE 5.4.0-rc7bhawan+ #480 [ 129.374318] Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 0515 03/30/2017 [ 129.374397] Workqueue: events dm_irq_work_func [amdgpu] [ 129.374468] RIP: 0010:dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu] [ 129.374470] Code: 52 20 e8 1c 63 ad f4 48 8b 5d d0 65 48 33 1c 25 28 00 00 00 b8 01 00 00 00 75 16 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b e9 fa fe ff ff e8 ed 5b d6 f3 41 0f b6 b6 c4 02 00 00 48 c7 [ 129.374471] RSP: 0018:ffff9f9141e7fcc0 EFLAGS: 00010246 [ 129.374472] RAX: 0000000000000000 RBX: ffff91ef0762f800 RCX: 0000000000000000 [ 129.374473] RDX: 0000000000000005 RSI: ffffffffc0c4a988 RDI: 0000000000000004 [ 129.374474] RBP: ffff9f9141e7fd10 R08: 0000000000000005 R09: 0000000000000000 [ 129.374475] R10: 0000000000000002 R11: 0000000000000001 R12: ffff91eebd510c00 [ 129.374475] R13: ffff91eebd510e58 R14: ffff91ef052c01b8 R15: 0000000000000006 [ 129.374476] FS: 0000000000000000(0000) GS:ffff91ef0ef80000(0000) knlGS:0000000000000000 [ 129.374477] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.374478] CR2: 000055623ea01d50 CR3: 0000000408a8c000 CR4: 00000000003406e0 [ 129.374479] Call Trace: [ 129.374550] dc_link_reallocate_mst_payload+0x12e/0x150 [amdgpu] [ 129.374617] dc_link_handle_hpd_rx_irq+0x6d4/0x6e0 [amdgpu] [ 129.374693] handle_hpd_rx_irq+0x77/0x310 [amdgpu] [ 129.374768] dm_irq_work_func+0x53/0x70 [amdgpu] [ 129.374774] process_one_work+0x1fd/0x3f0 [ 129.374776] worker_thread+0x255/0x410 [ 129.374778] kthread+0x121/0x140 [ 129.374780] ? process_one_work+0x3f0/0x3f0 [ 129.374781] ? kthread_park+0x90/0x90 [ 129.374785] ret_from_fork+0x22/0x40 [How] when we disable MST we should clear the cur link settings (lane_count=0 is good enough). This will cause us to not reallocate payloads earlier than expected and not throw the warning Signed-off-by: Bhawanpreet Lakha Reviewed-by: Hersen Wu Acked-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 194bcf35bce4a236059816bc41b3db9c9c92a1bb Author: Tianci.Yin Date: Fri Feb 28 17:10:21 2020 +0800 drm/amdgpu: disable 3D pipe 1 on Navi1x [why] CP firmware decide to skip setting the state for 3D pipe 1 for Navi1x as there is no use case. [how] Disable 3D pipe 1 on Navi1x. Reviewed-by: Feifei Xu Reviewed-by: Monk Liu Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 0d45e86d2267d5bdf7bbb631499788da1c27ceb2 Author: Christian Lachner Date: Sun Feb 23 10:24:16 2020 +0100 ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master The Gigabyte X570 Aorus Master motherboard with ALC1220 codec requires a similar workaround for Clevo laptops to enforce the DAC/mixer connection path. Set up a quirk entry for that. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205275 Signed-off-by: Christian Lachner Cc: Link: https://lore.kernel.org/r/20200223092416.15016-2-gladiac@gmail.com Signed-off-by: Takashi Iwai commit 76f7dec08fd64e9e3ad0810a1a8a60b0a846d348 Author: Kailang Yang Date: Mon Feb 10 16:30:26 2020 +0800 ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 ThinkPad want to support Headset Button control. This patch will enable it. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/7f0b7128f40f41f6b5582ff610adc33d@realtek.com Signed-off-by: Takashi Iwai commit 78def224f59c05d00e815be946ec229719ccf377 Author: Kailang Yang Date: Thu Feb 20 15:21:54 2020 +0800 ALSA: hda/realtek - Add Headset Mic supported Dell desktop platform supported headset Mic. Add pin verb to enable headset Mic. This platform only support fixed type headset for Iphone type. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/b9da28d772ef43088791b0f3675929e7@realtek.com Signed-off-by: Takashi Iwai commit a754acc3e4bcf0b70f4356fc450fec72875762da Author: Jason A. Donenfeld Date: Wed Mar 4 18:42:21 2020 +0800 KVM: fix Kconfig menu text for -Werror This was evidently copy and pasted from the i915 driver, but the text wasn't updated. Fixes: 4f337faf1c55 ("KVM: allow disabling -Werror") Signed-off-by: Jason A. Donenfeld Signed-off-by: Paolo Bonzini commit 5313b2a58ef02e2b077d7ae8088043609e3155b0 Author: Lucas Tanure Date: Sat Feb 29 17:30:07 2020 +0000 HID: hyperv: NULL check before some freeing functions is not needed. Fix below warnings reported by coccicheck: drivers/hid/hid-hyperv.c:197:2-7: WARNING: NULL check before some freeing functions is not needed. drivers/hid/hid-hyperv.c:211:2-7: WARNING: NULL check before some freeing functions is not needed. Signed-off-by: Lucas Tanure Reviewed-by: Michael Kelley Reviewed-by: Wei Liu Acked-by: Benjamin Tissoires Signed-off-by: Wei Liu commit 8c1b0767ae0c4b18cd967556aa6ddc7aab5bef0d Author: Wei Liu Date: Wed Mar 4 14:47:09 2020 +0000 Hyper-V: add myself as a maintainer Signed-off-by: Wei Liu Acked-by: K. Y. Srinivasan commit acb4d372a0311cb1c2b03e471007708b2a50c5da Author: Sasha Levin Date: Wed Feb 5 16:32:42 2020 -0500 Hyper-V: Drop Sasha Levin from the Hyper-V maintainers Signed-off-by: Sasha Levin Signed-off-by: Wei Liu commit 6198adeaf21536f426a79f3d490651e52fd76d60 Author: Lukas Bulwahn Date: Wed Mar 4 22:26:00 2020 +0100 MAINTAINERS: update ALLWINNER CPUFREQ DRIVER entry Commit b30d8cf5e171 ("dt-bindings: opp: Convert Allwinner H6 OPP to a schema") converted in Documentation/devicetree/bindings/opp/ the file sun50i-nvmem-cpufreq.txt to allwinner,sun50i-h6-operating-points.yaml. Since then, ./scripts/get_maintainer.pl --self-test complains: warning: no file matches \ F: Documentation/devicetree/bindings/opp/sun50i-nvmem-cpufreq.txt Adjust the file pattern in the ALLWINNER CPUFREQ DRIVER entry. Signed-off-by: Lukas Bulwahn Signed-off-by: Rob Herring commit 3fb83cbee1de58fcd5d22f1db89460bb7c08b6e8 Author: Axel Lin Date: Wed Mar 4 22:02:41 2020 +0800 ASoC: wm8741: Fix typo in Kconfig prompt Fix trivial copy-n-paste mistake. Signed-off-by: Axel Lin Link: https://lore.kernel.org/r/20200304140241.340-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit 1d305ba40eb8081ff21eeb8ca6ba5c70fd920934 Author: Florian Westphal Date: Thu Mar 5 11:15:36 2020 +0100 netfilter: nf_tables: fix infinite loop when expr is not available nft will loop forever if the kernel doesn't support an expression: 1. nft_expr_type_get() appends the family specific name to the module list. 2. -EAGAIN is returned to nfnetlink, nfnetlink calls abort path. 3. abort path sets ->done to true and calls request_module for the expression. 4. nfnetlink replays the batch, we end up in nft_expr_type_get() again. 5. nft_expr_type_get attempts to append family-specific name. This one already exists on the list, so we continue 6. nft_expr_type_get adds the generic expression name to the module list. -EAGAIN is returned, nfnetlink calls abort path. 7. abort path encounters the family-specific expression which has 'done' set, so it gets removed. 8. abort path requests the generic expression name, sets done to true. 9. batch is replayed. If the expression could not be loaded, then we will end up back at 1), because the family-specific name got removed and the cycle starts again. Note that userspace can SIGKILL the nft process to stop the cycle, but the desired behaviour is to return an error after the generic expr name fails to load the expression. Fixes: eb014de4fd418 ("netfilter: nf_tables: autoload modules from the abort path") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d78008de6103c708171baff9650a7862645d23b0 Author: Pablo Neira Ayuso Date: Tue Mar 3 15:02:45 2020 +0100 netfilter: nf_tables: dump NFTA_CHAIN_FLAGS attribute Missing NFTA_CHAIN_FLAGS netlink attribute when dumping basechain definitions. Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso commit 1579f1bc3b753d17a44de3457d5c6f4a5b14c752 Author: Jason A. Donenfeld Date: Sun Mar 1 22:52:35 2020 +0800 crypto: x86/curve25519 - support assemblers with no adx support Some older version of GAS do not support the ADX instructions, similarly to how they also don't support AVX and such. This commit adds the same build-time detection mechanisms we use for AVX and others for ADX, and then makes sure that the curve25519 library dispatcher calls the right functions. Reported-by: Willy Tarreau Signed-off-by: Jason A. Donenfeld Signed-off-by: Herbert Xu commit 59bee45b9712c759ea4d3dcc4eff1752f3a66558 Author: Michael Ellerman Date: Tue Mar 3 23:28:47 2020 +1100 powerpc/mm: Fix missing KUAP disable in flush_coherent_icache() Stefan reported a strange kernel fault which turned out to be due to a missing KUAP disable in flush_coherent_icache() called from flush_icache_range(). The fault looks like: Kernel attempted to access user page (7fffc30d9c00) - exploit attempt? (uid: 1009) BUG: Unable to handle kernel data access on read at 0x7fffc30d9c00 Faulting instruction address: 0xc00000000007232c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV CPU: 35 PID: 5886 Comm: sigtramp Not tainted 5.6.0-rc2-gcc-8.2.0-00003-gfc37a1632d40 #79 NIP: c00000000007232c LR: c00000000003b7fc CTR: 0000000000000000 REGS: c000001e11093940 TRAP: 0300 Not tainted (5.6.0-rc2-gcc-8.2.0-00003-gfc37a1632d40) MSR: 900000000280b033 CR: 28000884 XER: 00000000 CFAR: c0000000000722fc DAR: 00007fffc30d9c00 DSISR: 08000000 IRQMASK: 0 GPR00: c00000000003b7fc c000001e11093bd0 c0000000023ac200 00007fffc30d9c00 GPR04: 00007fffc30d9c18 0000000000000000 c000001e11093bd4 0000000000000000 GPR08: 0000000000000000 0000000000000001 0000000000000000 c000001e1104ed80 GPR12: 0000000000000000 c000001fff6ab380 c0000000016be2d0 4000000000000000 GPR16: c000000000000000 bfffffffffffffff 0000000000000000 0000000000000000 GPR20: 00007fffc30d9c00 00007fffc30d8f58 00007fffc30d9c18 00007fffc30d9c20 GPR24: 00007fffc30d9c18 0000000000000000 c000001e11093d90 c000001e1104ed80 GPR28: c000001e11093e90 0000000000000000 c0000000023d9d18 00007fffc30d9c00 NIP flush_icache_range+0x5c/0x80 LR handle_rt_signal64+0x95c/0xc2c Call Trace: 0xc000001e11093d90 (unreliable) handle_rt_signal64+0x93c/0xc2c do_notify_resume+0x310/0x430 ret_from_except_lite+0x70/0x74 Instruction dump: 409e002c 7c0802a6 3c62ff31 3863f6a0 f8010080 48195fed 60000000 48fe4c8d 60000000 e8010080 7c0803a6 7c0004ac <7c00ffac> 7c0004ac 4c00012c 38210070 This path through handle_rt_signal64() to setup_trampoline() and flush_icache_range() is only triggered by 64-bit processes that have unmapped their VDSO, which is rare. flush_icache_range() takes a range of addresses to flush. In flush_coherent_icache() we implement an optimisation for CPUs where we know we don't actually have to flush the whole range, we just need to do a single icbi. However we still execute the icbi on the user address of the start of the range we're flushing. On CPUs that also implement KUAP (Power9) that leads to the spurious fault above. We should be able to pass any address, including a kernel address, to the icbi on these CPUs, which would avoid any interaction with KUAP. But I don't want to make that change in a bug fix, just in case it surfaces some strange behaviour on some CPU. So for now just disable KUAP around the icbi. Note the icbi is treated as a load, so we allow read access, not write as you'd expect. Fixes: 890274c2dc4c ("powerpc/64s: Implement KUAP for Radix MMU") Cc: stable@vger.kernel.org # v5.2+ Reported-by: Stefan Berger Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200303235708.26004-1-mpe@ellerman.id.au commit 2ab7e274b86739f4ceed5d94b6879f2d07b2802f Author: Yintian Tao Date: Fri Feb 28 14:24:42 2020 +0800 drm/amdgpu: clean wptr on wb when gpu recovery The TDR will be randomly failed due to compute ring test failure. If the compute ring wptr & 0x7ff(ring_buf_mask) is 0x100 then after map mqd the compute ring rptr will be synced with 0x100. And the ring test packet size is also 0x100. Then after invocation of amdgpu_ring_commit, the cp will not really handle the packet on the ring buffer because rptr is equal to wptr. Signed-off-by: Yintian Tao Acked-by: Christian König Reviewed-by: Monk Liu Signed-off-by: Alex Deucher commit 70b8ea1ab1d3ff3ad5c7491bf8995c912506da6c Merge: 755d7a928a0c 3d2ed431b8f3 Author: Dave Airlie Date: Thu Mar 5 12:59:39 2020 +1000 Merge tag 'mediatek-drm-fixes-5.6' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes Mediatek DRM Fixes for Linux 5.6 Signed-off-by: Dave Airlie From: CK Hu Link: https://patchwork.freedesktop.org/patch/msgid/1583373069.364.4.camel@mtksdaap41 commit 755d7a928a0cdb1979be738408f2e4d4ecea1a32 Merge: 98d54f81e36b 3b6a9b19ab65 Author: Dave Airlie Date: Thu Mar 5 12:34:50 2020 +1000 Merge tag 'exynos-drm-fixes-for-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Three fixups - fix a kernel oops problem in case that driver is loaded as module. - fix a regulator warning issue when I2C DDC adapter cannot be gathered. - print out an error message only in error case excepting -EPROBE_DEFER. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/1583126752-30477-1-git-send-email-inki.dae@samsung.com commit a160eed4b783d7b250a32f7e5787c9867abc5686 Author: Alexandre Ghiti Date: Mon Feb 17 00:28:47 2020 -0500 riscv: Fix range looking for kernel image memblock When looking for the memblock where the kernel lives, we should check that the memory range associated to the memblock entirely comprises the kernel image and not only intersects with it. Signed-off-by: Alexandre Ghiti Reviewed-by: Anup Patel Signed-off-by: Palmer Dabbelt commit 7589238a8cf37331607c3222a64ac3140b29532d Author: Brendan Higgins Date: Thu Feb 27 16:00:01 2020 -0800 Revert "software node: Simplify software_node_release() function" This reverts commit 3df85a1ae51f6b256982fe9d17c2dc5bfb4cc402. The reverted commit says "It's possible to release the node ID immediately when fwnode_remove_software_node() is called, no need to wait for software_node_release() with that." However, releasing the node ID before waiting for software_node_release() to be called causes the node ID to be released before the kobject and the underlying sysfs entry; this means there is a period of time where a sysfs entry exists that is associated with an unallocated node ID. Once consequence of this is that there is a race condition where it is possible to call fwnode_create_software_node() with no parent node specified (NULL) and have it fail with -EEXIST because the node ID that was assigned is still associated with a stale sysfs entry that hasn't been cleaned up yet. Although it is difficult to reproduce this race condition under normal conditions, it can be deterministically reproduced with the following minconfig on UML: CONFIG_KUNIT_DRIVER_PE_TEST=y CONFIG_DEBUG_KERNEL=y CONFIG_DEBUG_OBJECTS=y CONFIG_DEBUG_OBJECTS_TIMERS=y CONFIG_DEBUG_KOBJECT_RELEASE=y CONFIG_KUNIT=y Running the tests with this configuration causes the following failure: kobject: 'node0' ((____ptrval____)): kobject_release, parent (____ptrval____) (delayed 400) ok 1 - pe_test_uints sysfs: cannot create duplicate filename '/kernel/software_nodes/node0' CPU: 0 PID: 28 Comm: kunit_try_catch Not tainted 5.6.0-rc3-next-20200227 #14 kobject_add_internal failed for node0 with -EEXIST, don't try to register things with the same name in the same directory. kobject: 'node0' ((____ptrval____)): kobject_release, parent (____ptrval____) (delayed 100) # pe_test_uint_arrays: ASSERTION FAILED at drivers/base/test/property-entry-test.c:123 Expected node is not error, but is: -17 not ok 2 - pe_test_uint_arrays Reported-by: Heidi Fahim Signed-off-by: Brendan Higgins Reviewed-by: Heikki Krogerus Cc: 5.3+ # 5.3+ Signed-off-by: Rafael J. Wysocki commit 07f5ae220b36214cd9be489cf36ffe92d9c08944 Author: Rob Herring Date: Mon Mar 2 11:36:20 2020 -0600 dt-bindings: bus: Drop empty compatible string in example In preparation to add generic checks of compatible strings, drop the compatible as '...' is not a valid compatible string. Cc: Maxime Ripard Cc: Chen-Yu Tsai Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Rob Herring commit 776e49e8ddb5169e6477fd33a396e9c7b2eb7400 Merge: 8b614cb8f1dc 636be4241bdd Author: Linus Torvalds Date: Wed Mar 4 13:02:45 2020 -0600 Merge tag 'for-5.6/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix request-based DM's congestion_fn and actually wire it up to the bdi. - Extend dm-bio-record to track additional struct bio members needed by DM integrity target. - Fix DM core to properly advertise that a device is suspended during unload (between the presuspend and postsuspend hooks). This change is a prereq for related DM integrity and DM writecache fixes. It elevates DM integrity's 'suspending' state tracking to DM core. - Four stable fixes for DM integrity target. - Fix crash in DM cache target due to incorrect work item cancelling. - Fix DM thin metadata lockdep warning that was introduced during 5.6 merge window. - Fix DM zoned target's chunk work refcounting that regressed during recent conversion to refcount_t. - Bump the minor version for DM core and all target versions that have seen interface changes or important fixes during the 5.6 cycle. * tag 'for-5.6/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: bump version of core and various targets dm: fix congested_fn for request-based device dm integrity: use dm_bio_record and dm_bio_restore dm bio record: save/restore bi_end_io and bi_integrity dm zoned: Fix reference counter initial value of chunk works dm writecache: verify watermark during resume dm: report suspended device during destroy dm thin metadata: fix lockdep complaint dm cache: fix a crash due to incorrect work item cancelling dm integrity: fix invalid table returned due to argument count mismatch dm integrity: fix a deadlock due to offloading to an incorrect workqueue dm integrity: fix recalculation when moving from journal mode to bitmap mode commit aa2734202acc506d09c8e641db4da161f902df27 Author: Damien Le Moal Date: Wed Feb 12 19:34:24 2020 +0900 riscv: Force flat memory model with no-mmu Compilation errors trigger if ARCH_SPARSEMEM_ENABLE is enabled for a nommu kernel. Since the sparsemem model does not make sense anyway for the nommu case, do not allow selecting this option to always use the flatmem model. Signed-off-by: Damien Le Moal Reviewed-by: Anup Patel Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt commit 810dbc69087b08fd53e1cdd6c709f385bc2921ad Author: Bernard Metzler Date: Mon Mar 2 19:16:14 2020 +0100 RDMA/iwcm: Fix iwcm work deallocation The dealloc_work_entries() function must update the work_free_list pointer while freeing its entries, since potentially called again on same list. A second iteration of the work list caused system crash. This happens, if work allocation fails during cma_iw_listen() and free_cm_id() tries to free the list again during cleanup. Fixes: 922a8e9fb2e0 ("RDMA: iWARP Connection Manager.") Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com Signed-off-by: Bernard Metzler Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 12e5eef0f4d8087ea7b559f6630be08ffea2d851 Author: Bernard Metzler Date: Mon Mar 2 16:58:14 2020 +0100 RDMA/siw: Fix failure handling during device creation A failing call to ib_device_set_netdev() during device creation caused system crash due to xa_destroy of uninitialized xarray hit by device deallocation. Fixed by moving xarray initialization before potential device deallocation. Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") Link: https://lore.kernel.org/r/20200302155814.9896-1-bmt@zurich.ibm.com Reported-by: syzbot+2e80962bedd9559fe0b3@syzkaller.appspotmail.com Signed-off-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit 78f34a16c28654cb47791257006f90d0948f2f0c Author: Mark Zhang Date: Thu Feb 27 14:51:11 2020 +0200 RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing This fixes the kernel crash when a RDMA_NLDEV_CMD_STAT_SET command is received, but the QP number parameter is not available. iwpm_register_pid: Unable to send a nlmsg (client = 2) infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 9754 Comm: syz-executor069 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:nla_get_u32 include/net/netlink.h:1474 [inline] RIP: 0010:nldev_stat_set_doit+0x63c/0xb70 drivers/infiniband/core/nldev.c:1760 Code: fc 01 0f 84 58 03 00 00 e8 41 83 bf fb 4c 8b a3 58 fd ff ff 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 6d RSP: 0018:ffffc900068bf350 EFLAGS: 00010247 RAX: dffffc0000000000 RBX: ffffc900068bf728 RCX: ffffffff85b60470 RDX: 0000000000000000 RSI: ffffffff85b6047f RDI: 0000000000000004 RBP: ffffc900068bf750 R08: ffff88808c3ee140 R09: ffff8880a25e6010 R10: ffffed10144bcddc R11: ffff8880a25e6ee3 R12: 0000000000000000 R13: ffff88809acb0000 R14: ffff888092a42c80 R15: 000000009ef2e29a FS: 0000000001ff0880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4733e34000 CR3: 00000000a9b27000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4403d9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc0efbc5c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403d9 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 00000000006ca018 R08: 0000000000000008 R09: 00000000004002c8 R10: 000000000000004a R11: 0000000000000246 R12: 0000000000401c60 R13: 0000000000401cf0 R14: 0000000000000000 R15: 0000000000000000 Fixes: b389327df905 ("RDMA/nldev: Allow counter manual mode configration through RDMA netlink") Link: https://lore.kernel.org/r/20200227125111.99142-1-leon@kernel.org Reported-by: syzbot+bd4af81bc51ee0283445@syzkaller.appspotmail.com Signed-off-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a4e63bce1414df7ab6eb82ca9feb8494ce13e554 Author: Jason Gunthorpe Date: Thu Feb 27 13:41:18 2020 +0200 RDMA/odp: Ensure the mm is still alive before creating an implicit child Registration of a mmu_notifier requires the caller to hold a mmget() on the mm as registration is not permitted to race with exit_mmap(). There is a BUG_ON inside the mmu_notifier to guard against this. Normally creating a umem is done against current which implicitly holds the mmget(), however an implicit ODP child is created from a pagefault work queue and is not guaranteed to have a mmget(). Call mmget() around this registration and abort faulting if the MM has gone to exit_mmap(). Before the patch below the notifier was registered when the implicit ODP parent was created, so there was no chance to register a notifier outside of current. Fixes: c571feca2dc9 ("RDMA/odp: use mmu_notifier_get/put for 'struct ib_ucontext_per_mm'") Link: https://lore.kernel.org/r/20200227114118.94736-1-leon@kernel.org Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit e38b55ea0443da35a50a3eb2079ad3612cf763b9 Author: Maor Gottlieb Date: Thu Feb 27 13:27:08 2020 +0200 RDMA/core: Fix protection fault in ib_mr_pool_destroy Fix NULL pointer dereference in the error flow of ib_create_qp_user when accessing to uninitialized list pointers - rdma_mrs and sig_mrs. The following crash from syzkaller revealed it. kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN PTI CPU: 1 PID: 23167 Comm: syz-executor.1 Not tainted 5.5.0-rc5 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 RIP: 0010:ib_mr_pool_destroy+0x81/0x1f0 Code: 00 00 fc ff df 49 c1 ec 03 4d 01 fc e8 a8 ea 72 fe 41 80 3c 24 00 0f 85 62 01 00 00 48 8b 13 48 89 d6 4c 8d 6a c8 48 c1 ee 03 <42> 80 3c 3e 00 0f 85 34 01 00 00 48 8d 7a 08 4c 8b 02 48 89 fe 48 RSP: 0018:ffffc9000951f8b0 EFLAGS: 00010046 RAX: 0000000000040000 RBX: ffff88810f268038 RCX: ffffffff82c41628 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000951f850 RBP: ffff88810f268020 R08: 0000000000000004 R09: fffff520012a3f0a R10: 0000000000000001 R11: fffff520012a3f0a R12: ffffed1021e4d007 R13: ffffffffffffffc8 R14: 0000000000000246 R15: dffffc0000000000 FS: 00007f54bc788700(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000116920002 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rdma_rw_cleanup_mrs+0x15/0x30 ib_destroy_qp_user+0x674/0x7d0 ib_create_qp_user+0xb01/0x11c0 create_qp+0x1517/0x2130 ib_uverbs_create_qp+0x13e/0x190 ib_uverbs_write+0xaa5/0xdf0 __vfs_write+0x7c/0x100 vfs_write+0x168/0x4a0 ksys_write+0xc8/0x200 do_syscall_64+0x9c/0x390 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x465b49 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f54bc787c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000465b49 RDX: 0000000000000040 RSI: 0000000020000540 RDI: 0000000000000003 RBP: 00007f54bc787c70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54bc7886bc R13: 00000000004ca2ec R14: 000000000070ded0 R15: 0000000000000005 Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API") Link: https://lore.kernel.org/r/20200227112708.93023-1-leon@kernel.org Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit de5ed007a03d71daaa505f5daa4d3666530c7090 Author: Artemy Kovalyov Date: Thu Feb 27 13:39:18 2020 +0200 IB/mlx5: Fix implicit ODP race Following race may occur because of the call_srcu and the placement of the synchronize_srcu vs the xa_erase. CPU0 CPU1 mlx5_ib_free_implicit_mr: destroy_unused_implicit_child_mr: xa_erase(odp_mkeys) synchronize_srcu() xa_lock(implicit_children) if (still in xarray) atomic_inc() call_srcu() xa_unlock(implicit_children) xa_erase(implicit_children): xa_lock(implicit_children) __xa_erase() xa_unlock(implicit_children) flush_workqueue() [..] free_implicit_child_mr_rcu: (via call_srcu) queue_work() WARN_ON(atomic_read()) [..] free_implicit_child_mr_work: (via wq) free_implicit_child_mr() mlx5_mr_cache_invalidate() mlx5_ib_update_xlt() <-- UMR QP fail atomic_dec() The wait_event() solves the race because it blocks until free_implicit_child_mr_work() completes. Fixes: 5256edcb98a1 ("RDMA/mlx5: Rework implicit ODP destroy") Link: https://lore.kernel.org/r/20200227113918.94432-1-leon@kernel.org Signed-off-by: Artemy Kovalyov Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 2e5383d7904e60529136727e49629a82058a5607 Author: Tycho Andersen Date: Wed Feb 19 12:01:29 2020 -0700 cgroup1: don't call release_agent when it is "" Older (and maybe current) versions of systemd set release_agent to "" when shutting down, but do not set notify_on_release to 0. Since 64e90a8acb85 ("Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()"), we filter out such calls when the user mode helper path is "". However, when used in conjunction with an actual (i.e. non "") STATIC_USERMODEHELPER, the path is never "", so the real usermode helper will be called with argv[0] == "". Let's avoid this by not invoking the release_agent when it is "". Signed-off-by: Tycho Andersen Signed-off-by: Tejun Heo commit d4d89e25fc7b4225211c217491e5525b00cf3961 Merge: 820d15632ec1 41bae0caf5dc Author: Olof Johansson Date: Wed Mar 4 08:51:54 2020 -0800 Merge tag 'socfpga_defconfig_fix_for_v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes ARM: socfpga_defconfig: add back DEBUGFS - Add back DEBUG_FS for socfpga_defconfig * tag 'socfpga_defconfig_fix_for_v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: socfpga_defconfig: Add back DEBUG_FS Link: https://lore.kernel.org/r/20200304101917.1243-1-dinguyen@kernel.org Signed-off-by: Olof Johansson commit 190ecb190a9cd8c0599d8499b901e3c32e87966a Author: Qian Cai Date: Sun Feb 23 22:00:07 2020 -0500 cgroup: fix psi_show() crash on 32bit ino archs Similar to the commit d7495343228f ("cgroup: fix incorrect WARN_ON_ONCE() in cgroup_setup_root()"), cgroup_id(root_cgrp) does not equal to 1 on 32bit ino archs which triggers all sorts of issues with psi_show() on s390x. For example, BUG: KASAN: slab-out-of-bounds in collect_percpu_times+0x2d0/ Read of size 4 at addr 000000001e0ce000 by task read_all/3667 collect_percpu_times+0x2d0/0x798 psi_show+0x7c/0x2a8 seq_read+0x2ac/0x830 vfs_read+0x92/0x150 ksys_read+0xe2/0x188 system_call+0xd8/0x2b4 Fix it by using cgroup_ino(). Fixes: 743210386c03 ("cgroup: use cgrp->kn->id as the cgroup ID") Signed-off-by: Qian Cai Acked-by: Johannes Weiner Signed-off-by: Tejun Heo Cc: stable@vger.kernel.org # v5.5 commit 65ac74f1de3334852fb7d9b1b430fa5a06524276 Author: Marc Zyngier Date: Wed Mar 4 11:11:17 2020 +0000 iommu/dma: Fix MSI reservation allocation The way cookie_init_hw_msi_region() allocates the iommu_dma_msi_page structures doesn't match the way iommu_put_dma_cookie() frees them. The former performs a single allocation of all the required structures, while the latter tries to free them one at a time. It doesn't quite work for the main use case (the GICv3 ITS where the range is 64kB) when the base granule size is 4kB. This leads to a nice slab corruption on teardown, which is easily observable by simply creating a VF on a SRIOV-capable device, and tearing it down immediately (no need to even make use of it). Fortunately, this only affects systems where the ITS isn't translated by the SMMU, which are both rare and non-standard. Fix it by allocating iommu_dma_msi_page structures one at a time. Fixes: 7c1b058c8b5a3 ("iommu/dma: Handle IOMMU API reserved regions") Signed-off-by: Marc Zyngier Reviewed-by: Eric Auger Cc: Robin Murphy Cc: Joerg Roedel Cc: Will Deacon Cc: stable@vger.kernel.org Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel commit 3261227d136d83bcb4df4e9292385fb9e007fae7 Author: Ulf Hansson Date: Tue Mar 3 16:07:45 2020 +0100 dt-bindings: power: Convert domain-idle-states bindings to json-schema While converting to the json-schema, let's also take the opportunity to further specify/clarify some more details about the DT binding. For example, let's define the label where to put the states nodes, set a pattern for nodename of the state nodes and finally add an example. Fixes: a3f048b5424e ("dt: psci: Update DT bindings to support hierarchical PSCI states") Signed-off-by: Ulf Hansson [robh: drop type refs from standard unit properties] Signed-off-by: Rob Herring commit ac9686a936a194fd3d4b8797944bdaaecf0adfda Author: Ulf Hansson Date: Tue Mar 3 16:07:44 2020 +0100 dt-bindings: arm: Fix cpu compatibles in the hierarchical example for PSCI Fixes: a3f048b5424e ("dt: psci: Update DT bindings to support hierarchical PSCI states") Signed-off-by: Ulf Hansson Signed-off-by: Rob Herring commit 8d62d9c4bc05b3d6731f3fa083eea6400871822c Author: Ulf Hansson Date: Tue Mar 3 16:07:43 2020 +0100 dt-bindings: arm: Correct links to idle states definitions The arm,idle-state DT bindings recently got converted to the json-schema, but some links are still pointing to the old, non-existing, txt file. Let's update the links to fix this. Fixes: baac82fe06db ("dt-bindings: arm: Convert arm,idle-state binding to DT schema") Signed-off-by: Ulf Hansson Signed-off-by: Rob Herring commit 31e43f31890ca6e909b27dcb539252b46aa465da Author: Ben Chuang Date: Wed Feb 19 17:29:00 2020 +0800 mmc: sdhci-pci-gli: Enable MSI interrupt for GL975x Enable MSI interrupt for GL9750/GL9755. Some platforms do not support PCI INTx and devices can not work without interrupt. Like messages below: [ 4.487132] sdhci-pci 0000:01:00.0: SDHCI controller found [17a0:9755] (rev 0) [ 4.487198] ACPI BIOS Error (bug): Could not resolve symbol [\_SB.PCI0.PBR2._PRT.APS2], AE_NOT_FOUND (20190816/psargs-330) [ 4.487397] ACPI Error: Aborting method \_SB.PCI0.PBR2._PRT due to previous error (AE_NOT_FOUND) (20190816/psparse-529) [ 4.487707] pcieport 0000:00:01.3: can't derive routing for PCI INT A [ 4.487709] sdhci-pci 0000:01:00.0: PCI INT A: no GSI Signed-off-by: Ben Chuang Tested-by: Raul E Rangel Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200219092900.9151-1-benchuanggli@gmail.com Signed-off-by: Ulf Hansson commit f9981d4f50b475d7dbb70f3022b87a3c8bba9fd6 Author: Aaro Koskinen Date: Wed Mar 4 13:17:40 2020 +0200 spi: spi_register_controller(): free bus id on error paths Some error paths leave the bus id allocated. As a result the IDR allocation will fail after a deferred probe. Fix by freeing the bus id always on error. Signed-off-by: Aaro Koskinen Message-Id: <20200304111740.27915-1-aaro.koskinen@nokia.com> Signed-off-by: Mark Brown commit 02fbabd5f4ed182d2c616e49309f5a3efd9ec671 Author: Fabrice Gasnier Date: Wed Mar 4 09:55:32 2020 +0100 regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling There maybe an overshoot, when disabling, then re-enabling vrefbuf too quickly. VREFBUF is used by ADC/DAC on some boards. When re-enabling too quickly, an overshoot on the reference voltage make the conversions inaccurate for a short period of time. - Don't put the VREFBUF in HiZ when disabling, to force an active discharge. - Enforce a 1ms OFF/ON delay Fixes: 0cdbf481e927 ("regulator: Add support for stm32-vrefbuf") Signed-off-by: Fabrice Gasnier Message-Id: <1583312132-20932-1-git-send-email-fabrice.gasnier@st.com> Signed-off-by: Mark Brown commit 1b79cfd99ff5127e6a143767b51694a527b3ea38 Author: John Stultz Date: Tue Mar 3 16:32:28 2020 +0000 drm: kirin: Revert "Fix for hikey620 display offset problem" This reverts commit ff57c6513820efe945b61863cf4a51b79f18b592. With the commit ff57c6513820 ("drm: kirin: Fix for hikey620 display offset problem") we added support for handling LDI overflows by resetting the hardware. However, its been observed that when we do hit the LDI overflow condition, the irq seems to be screaming, and we do nothing but stream: [drm:ade_irq_handler [kirin_drm]] *ERROR* LDI underflow! over and over to the screen I've tried a few appraoches to avoid this, but none has yet been successful and the cure here is worse then the original disease, so revert this for now. Cc: Xinliang Liu Cc: Rongrong Zou Cc: Xinwei Kong Cc: Chen Feng Cc: Sam Ravnborg Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel Fixes: ff57c6513820 ("drm: kirin: Fix for hikey620 display offset problem") Signed-off-by: John Stultz Acked-by: Xinliang Liu Signed-off-by: Xinliang Liu Link: https://patchwork.freedesktop.org/patch/msgid/20200303163228.52741-1-john.stultz@linaro.org commit 0d6defc7e0e437a9fd53622f7fd85740f38d5693 Author: Olivier Moysan Date: Wed Mar 4 11:24:06 2020 +0100 ASoC: stm32: sai: manage rebind issue The commit e894efef9ac7 ("ASoC: core: add support to card rebind") allows to rebind the sound card after a rebind of one of its component. With this commit, the sound card is actually rebound, but may be no more functional. The following problems have been seen with STM32 SAI driver. 1) DMA channel is not requested: With the sound card rebind the simplified call sequence is: stm32_sai_sub_probe snd_soc_register_component snd_soc_try_rebind_card snd_soc_instantiate_card devm_snd_dmaengine_pcm_register The problem occurs because the pcm must be registered, before snd_soc_instantiate_card() is called. Modify SAI driver, to change the call sequence as follows: stm32_sai_sub_probe devm_snd_dmaengine_pcm_register snd_soc_register_component snd_soc_try_rebind_card 2) DMA channel is not released: dma_release_channel() is not called when devm_dmaengine_pcm_release() is executed. This occurs because SND_DMAENGINE_PCM_DRV_NAME component, has already been released through devm_component_release(). devm_dmaengine_pcm_release() should be called before devm_component_release() to avoid this problem. Call snd_dmaengine_pcm_unregister() and snd_soc_unregister_component() explicitly from SAI driver, to have the right sequence. Signed-off-by: Olivier Moysan Message-Id: <20200304102406.8093-1-olivier.moysan@st.com> Signed-off-by: Mark Brown commit 77036165d8bcf7c7b2a2df28a601ec2c52bb172d Author: Saravana Kannan Date: Fri Feb 21 00:05:10 2020 -0800 driver core: Skip unnecessary work when device doesn't have sync_state() A bunch of busy work is done for devices that don't have sync_state() support. Stop doing the busy work. Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20200221080510.197337-4-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit ac338acf514e7b578fa9e3742ec2c292323b4c1a Author: Saravana Kannan Date: Fri Feb 21 00:05:09 2020 -0800 driver core: Add dev_has_sync_state() Add an API to check if a device has sync_state support in its driver or bus. Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20200221080510.197337-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 21eb93f432b1a785df193df1a56a59e9eb3a985f Author: Saravana Kannan Date: Fri Feb 21 00:05:08 2020 -0800 driver core: Call sync_state() even if supplier has no consumers The initial patch that added sync_state() support didn't handle the case where a supplier has no consumers. This was because when a device is successfully bound with a driver, only its suppliers were checked to see if they are eligible to get a sync_state(). This is not sufficient for devices that have no consumers but still need to do device state clean up. So fix this. Fixes: fc5a251d0fd7ca90 (driver core: Add sync_state driver/bus callback) Signed-off-by: Saravana Kannan Cc: stable Link: https://lore.kernel.org/r/20200221080510.197337-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 19f3c1e98bd1704fe22e5f8105c0677a1332cdef Merge: dad2aff3e827 be4e3c737eeb Author: Greg Kroah-Hartman Date: Wed Mar 4 13:28:52 2020 +0100 Merge tag 'phy-for-5.6-rc_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 5.6-rc *) Fix phy_get() from erroring out if device link creation failed *) Fix write timeouts in Motorola Mapphone mdm6600 PHY *) Fix Broadcom brcm-sata PHY driver to write to the correct MDIO register *) Add GMII PHY mode in supported modes of TI AM335x/437x/5xx SoCs Signed-off-by: Kishon Vijay Abraham I * tag 'phy-for-5.6-rc_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy: phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling phy: brcm-sata: Correct MDIO operations for 40nm platforms phy: ti: gmii-sel: do not fail in case of gmii phy: ti: gmii-sel: fix set of copy-paste errors phy: core: Fix phy_get() to not return error on link creation failure phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval commit 169c0aa4bc17d37370f55188d9327b99d60fd9d7 Author: Chris Wilson Date: Tue Mar 3 14:00:09 2020 +0000 drm/i915/gt: Drop the timeline->mutex as we wait for retirement As we have pinned the timeline (using tl->active_count), we can safely drop the tl->mutex as we wait for what we believe to be the final request on that timeline. This is useful for ensuring that we do not block the engine heartbeat by hogging the kernel_context's timeline on a dead GPU. References: https://gitlab.freedesktop.org/drm/intel/issues/1364 Fixes: 058179e72e09 ("drm/i915/gt: Replace hangcheck by heartbeats") Fixes: f33a8a51602c ("drm/i915: Merge wait_for_timelines with retire_request") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200303140009.1494819-1-chris@chris-wilson.co.uk (cherry picked from commit 82126e596d8519baac416aee83cad938f1d23cf8) Signed-off-by: Jani Nikula commit 08f56f8f3799b2ed1c5ac7eed6d86a4926289655 Author: Chris Wilson Date: Mon Mar 2 08:57:57 2020 +0000 drm/i915/perf: Reintroduce wait on OA configuration completion We still need to wait for the initial OA configuration to happen before we enable OA report writes to the OA buffer. Reported-by: Lionel Landwerlin Fixes: 15d0ace1f876 ("drm/i915/perf: execute OA configuration from command stream") Closes: https://gitlab.freedesktop.org/drm/intel/issues/1356 Testcase: igt/perf/stream-open-close Signed-off-by: Chris Wilson Cc: Lionel Landwerlin Reviewed-by: Lionel Landwerlin Link: https://patchwork.freedesktop.org/patch/msgid/20200302085812.4172450-7-chris@chris-wilson.co.uk (cherry picked from commit 4b4e973d5eb89244b67d3223b60f752d0479f253) Signed-off-by: Jani Nikula commit d1d17a359ce6901545c075d7401c10179d9cedfd Author: Xin Long Date: Wed Mar 4 16:51:42 2020 +0800 esp: remove the skb from the chain when it's enqueued in cryptd_wq Xiumei found a panic in esp offload: BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 RIP: 0010:esp_output_done+0x101/0x160 [esp4] Call Trace: ? esp_output+0x180/0x180 [esp4] cryptd_aead_crypt+0x4c/0x90 cryptd_queue_worker+0x6e/0xa0 process_one_work+0x1a7/0x3b0 worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x35/0x40 It was caused by that skb secpath is used in esp_output_done() after it's been released elsewhere. The tx path for esp offload is: __dev_queue_xmit()-> validate_xmit_skb_list()-> validate_xmit_xfrm()-> esp_xmit()-> esp_output_tail()-> aead_request_set_callback(esp_output_done) <--[1] crypto_aead_encrypt() <--[2] In [1], .callback is set, and in [2] it will trigger the worker schedule, later on a kernel thread will call .callback(esp_output_done), as the call trace shows. But in validate_xmit_xfrm(): skb_list_walk_safe(skb, skb2, nskb) { ... err = x->type_offload->xmit(x, skb2, esp_features); [esp_xmit] ... } When the err is -EINPROGRESS, which means this skb2 will be enqueued and later gets encrypted and sent out by .callback later in a kernel thread, skb2 should be removed fromt skb chain. Otherwise, it will get processed again outside validate_xmit_xfrm(), which could release skb secpath, and cause the panic above. This patch is to remove the skb from the chain when it's enqueued in cryptd_wq. While at it, remove the unnecessary 'if (!skb)' check. Fixes: 3dca3f38cfb8 ("xfrm: Separate ESP handling from segmentation for GRO packets.") Reported-by: Xiumei Mu Signed-off-by: Xin Long Signed-off-by: Steffen Klassert commit b95b4d5ef061806fde07a6a3255e6c07f4fed0d3 Merge: 8b614cb8f1dc b5c0951860ba Author: Ingo Molnar Date: Wed Mar 4 11:54:10 2020 +0100 Merge tag 'perf-urgent-for-mingo-5.6-20200303' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf symbols: Arnaldo Carvalho de Melo: - Don't try to find a vmlinux file when looking for kernel modules, fixing symbol resolution in systems with compressed kernel modules. perf env: Arnaldo Carvalho de Melo: - Do not return pointers to local variables, fixing valid warning from gcc 10 for corner case that stops the build due to -Werror. perf tests: Arnaldo Carvalho de Melo: - Make global variable static in the bp_account entry to fix build with gcc 10. perf parse-events: Arnaldo Carvalho de Melo: - Use asprintf() instead of strncpy() to read tracepoint files, addressing compiler warning that stops the build as we use -Werror. perf bench: Arnaldo Carvalho de Melo: - Share some global variables to fix build with gcc 10. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit df057c914a9c219ac8b8ed22caf7da2f80c1fe26 Author: Niklas Schnelle Date: Thu Feb 27 12:17:18 2020 +0100 s390/pci: Fix unexpected write combine on resource In the initial MIO support introduced in commit 71ba41c9b1d9 ("s390/pci: provide support for MIO instructions") zpci_map_resource() and zpci_setup_resources() default to using the mio_wb address as the resource's start address. This means users of the mapping, which includes most drivers, will get write combining on PCI Stores. This may lead to problems when drivers expect write through behavior when not using an explicit ioremap_wc(). Cc: stable@vger.kernel.org Fixes: 71ba41c9b1d9 ("s390/pci: provide support for MIO instructions") Signed-off-by: Niklas Schnelle Reviewed-by: Pierre Morel Signed-off-by: Vasily Gorbik commit 582b4e55403e053d8a48ff687a05174da9cc3fb0 Author: Gerald Schaefer Date: Thu Feb 27 12:56:42 2020 +0100 s390/mm: fix panic in gup_fast on large pud On s390 there currently is no implementation of pud_write(). That was ok as long as we had our own implementation of get_user_pages_fast() which checked for pud protection by testing the bit directly w/o using pud_write(). The other callers of pud_write() are not reachable on s390. After commit 1a42010cdc26 ("s390/mm: convert to the generic get_user_pages_fast code") we use the generic get_user_pages_fast(), which does call pud_write() in pud_access_permitted() for FOLL_WRITE access on a large pud. Without an s390 specific pud_write(), the generic version is called, which contains a BUG() statement to remind us that we don't have a proper implementation. This results in a kernel panic. Fix this by providing an implementation of pud_write(). Cc: # 5.2+ Fixes: 1a42010cdc26 ("s390/mm: convert to the generic get_user_pages_fast code") Signed-off-by: Gerald Schaefer Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 41bae0caf5dc216c7b43712b8c2b6a0d63b4d655 Author: Dinh Nguyen Date: Mon Feb 3 15:55:09 2020 -0600 ARM: socfpga_defconfig: Add back DEBUG_FS Commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") removed select for DEBUG_FS but we still need it for development purposes. Fixes: 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") Signed-off-by: Dinh Nguyen commit dad2aff3e827b112f27fa5e6f2bf87a110067c3f Author: Pratham Pratap Date: Mon Mar 2 21:44:43 2020 +0000 usb: dwc3: gadget: Update chain bit correctly when using sg list If scatter-gather operation is allowed, a large USB request is split into multiple TRBs. For preparing TRBs for sg list, driver iterates over the list and creates TRB for each sg and mark the chain bit to false for the last sg. The current IOMMU driver is clubbing the list of sgs which shares a page boundary into one and giving it to USB driver. With this the number of sgs mapped it not equal to the the number of sgs passed. Because of this USB driver is not marking the chain bit to false since it couldn't iterate to the last sg. This patch addresses this issue by marking the chain bit to false if it is the last mapped sg. At a practical level, this patch resolves USB transfer stalls seen with adb on dwc3 based db845c, pixel3 and other qcom hardware after functionfs gadget added scatter-gather support around v4.20. Credit also to Anurag Kumar Vulisha who implemented a very similar fix to this issue. Cc: Felipe Balbi Cc: Yang Fei Cc: Thinh Nguyen Cc: Tejas Joglekar Cc: Andrzej Pietrasiewicz Cc: Jack Pham Cc: Todd Kjos Cc: Greg KH Cc: Linux USB List Cc: stable #4.20+ Signed-off-by: Pratham Pratap [jstultz: Slight tweak to remove sg_is_last() usage, reworked commit message, minor comment tweak] Signed-off-by: John Stultz Link: https://lore.kernel.org/r/20200302214443.55783-1-john.stultz@linaro.org Signed-off-by: Greg Kroah-Hartman commit 1f8b39bc99a31759e97a0428a5c3f64802c1e61d Author: Eugeniu Rosca Date: Wed Feb 26 18:50:36 2020 +0100 usb: core: port: do error out if usb_autopm_get_interface() fails Reviewing a fresh portion of coverity defects in USB core (specifically CID 1458999), Alan Stern noted below in [1]: On Tue, Feb 25, 2020 at 02:39:23PM -0500, Alan Stern wrote: > A revised search finds line 997 in drivers/usb/core/hub.c and lines > 216, 269 in drivers/usb/core/port.c. (I didn't try looking in any > other directories.) AFAICT all three of these should check the > return value, although a error message in the kernel log probably > isn't needed. Factor out the usb_port_runtime_{resume,suspend}() changes into a standalone patch to allow conflict-free porting on top of stable v3.9+. [1] https://lore.kernel.org/lkml/Pine.LNX.4.44L0.2002251419120.1485-100000@iolanthe.rowland.org Fixes: 971fcd492cebf5 ("usb: add runtime pm support for usb port device") Cc: stable@vger.kernel.org # v3.9+ Suggested-by: Alan Stern Signed-off-by: Eugeniu Rosca Acked-by: Alan Stern Link: https://lore.kernel.org/r/20200226175036.14946-3-erosca@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman commit 60e3f6e4ac5b0fda43dad01c32e09409ec710045 Author: Eugeniu Rosca Date: Wed Feb 26 18:50:35 2020 +0100 usb: core: hub: do error out if usb_autopm_get_interface() fails Reviewing a fresh portion of coverity defects in USB core (specifically CID 1458999), Alan Stern noted below in [1]: On Tue, Feb 25, 2020 at 02:39:23PM -0500, Alan Stern wrote: > A revised search finds line 997 in drivers/usb/core/hub.c and lines > 216, 269 in drivers/usb/core/port.c. (I didn't try looking in any > other directories.) AFAICT all three of these should check the > return value, although a error message in the kernel log probably > isn't needed. Factor out the usb_remove_device() change into a standalone patch to allow conflict-free integration on top of the earliest stable branches. [1] https://lore.kernel.org/lkml/Pine.LNX.4.44L0.2002251419120.1485-100000@iolanthe.rowland.org Fixes: 253e05724f9230 ("USB: add a "remove hardware" sysfs attribute") Cc: stable@vger.kernel.org # v2.6.33+ Suggested-by: Alan Stern Signed-off-by: Eugeniu Rosca Acked-by: Alan Stern Link: https://lore.kernel.org/r/20200226175036.14946-2-erosca@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman commit 63d6d7ed475c53dc1cabdfedf63de1fd8dcd72ee Author: Eugeniu Rosca Date: Wed Feb 26 18:50:34 2020 +0100 usb: core: hub: fix unhandled return by employing a void function Address below Coverity complaint (Feb 25, 2020, 8:06 AM CET): *** CID 1458999: Error handling issues (CHECKED_RETURN) /drivers/usb/core/hub.c: 1869 in hub_probe() 1863 1864 if (id->driver_info & HUB_QUIRK_CHECK_PORT_AUTOSUSPEND) 1865 hub->quirk_check_port_auto_suspend = 1; 1866 1867 if (id->driver_info & HUB_QUIRK_DISABLE_AUTOSUSPEND) { 1868 hub->quirk_disable_autosuspend = 1; >>> CID 1458999: Error handling issues (CHECKED_RETURN) >>> Calling "usb_autopm_get_interface" without checking return value (as is done elsewhere 97 out of 111 times). 1869 usb_autopm_get_interface(intf); 1870 } 1871 1872 if (hub_configure(hub, &desc->endpoint[0].desc) >= 0) 1873 return 0; 1874 Rather than checking the return value of 'usb_autopm_get_interface()', switch to the usb_autopm_get_interface_no_resume() API, as per: On Tue, Feb 25, 2020 at 10:32:32AM -0500, Alan Stern wrote: ------ 8< ------ > This change (i.e. 'ret = usb_autopm_get_interface') is not necessary, > because the resume operation cannot fail at this point (interfaces > are always powered-up during probe). A better solution would be to > call usb_autopm_get_interface_no_resume() instead. ------ 8< ------ Fixes: 1208f9e1d758c9 ("USB: hub: Fix the broken detection of USB3 device in SMSC hub") Cc: Hardik Gajjar Cc: stable@vger.kernel.org # v4.14+ Reported-by: scan-admin@coverity.com Suggested-by: Alan Stern Signed-off-by: Eugeniu Rosca Acked-by: Alan Stern Link: https://lore.kernel.org/r/20200226175036.14946-1-erosca@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman commit 86d92f5465958752481269348d474414dccb1552 Author: Jim Lin Date: Mon Mar 2 22:21:35 2020 +0800 usb: storage: Add quirk for Samsung Fit flash Current driver has 240 (USB2.0) and 2048 (USB3.0) as max_sectors, e.g., /sys/bus/scsi/devices/0:0:0:0/max_sectors If data access times out, driver error handling will issue a port reset. Sometimes Samsung Fit (090C:1000) flash disk will not respond to later Set Address or Get Descriptor command. Adding this quirk to limit max_sectors to 64 sectors to avoid issue occurring. Signed-off-by: Jim Lin Acked-by: Alan Stern Cc: stable Link: https://lore.kernel.org/r/1583158895-31342-1-git-send-email-jilin@nvidia.com Signed-off-by: Greg Kroah-Hartman commit b96ed52d781a2026d0c0daa5787c6f3d45415862 Author: Dan Lazewatsky Date: Wed Feb 26 14:34:38 2020 +0000 usb: quirks: add NO_LPM quirk for Logitech Screen Share LPM on the device appears to cause xHCI host controllers to claim that there isn't enough bandwidth to support additional devices. Signed-off-by: Dan Lazewatsky Cc: stable Signed-off-by: Gustavo Padovan Link: https://lore.kernel.org/r/20200226143438.1445-1-gustavo.padovan@collabora.com Signed-off-by: Greg Kroah-Hartman commit f06947f275f1838586792c17b6ab70da82ed7b43 Author: Marco Felsch Date: Wed Feb 26 08:26:44 2020 +0100 usb: usb251xb: fix regulator probe and error handling Commit 4d7201cda226 ("usb: usb251xb: add vdd supply support") didn't covered the non-DT use-case and so the regualtor_enable() call during probe will fail on those platforms. Also the commit didn't handled the error case correctly. Move devm_regulator_get() out of usb251xb_get_ofdata() to address the 1st issue. This can be done without worries because devm_regulator_get() handles the non-DT use-case too. Add devm_add_action_or_reset() to address the 2nd bug. Fixes: 4d7201cda226 ("usb: usb251xb: add vdd supply support") Signed-off-by: Marco Felsch Cc: stable Acked-by: Richard Leitner Link: https://lore.kernel.org/r/20200226072644.18490-1-m.felsch@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit 96b4ea324ae92386db2b0c73ace597c80cde1ecb Author: Rikard Falkeborn Date: Sun Feb 23 00:41:25 2020 +0100 phy: allwinner: Fix GENMASK misuse Arguments are supposed to be ordered high then low. Fixes: a228890f9458 ("phy: allwinner: add phy driver for USB3 PHY on Allwinner H6 SoC") Signed-off-by: Rikard Falkeborn Tested-by: Ondrej Jirman Signed-off-by: Ondrej Jirman Acked-by: Maxime Ripard Acked-by: Chen-Yu Tsai Cc: stable Link: https://lore.kernel.org/r/20191110124355.1569-1-rikard.falkeborn@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4bf2dd65135a2d7fe202f7c10d65b51bcf645ac6 Author: Peter Chen Date: Wed Feb 19 22:14:55 2020 +0800 usb: cdns3: gadget: toggle cycle bit before reset endpoint If there are TRBs pending during reset endpoint operation, the DMA will advance after reset operation, but it isn't expected, since the data is not yet available (For OUT, the data is not yet available). After the data is ready, there won't be any interrupt since the EP_TRADDR already points to next TRB entry and doorbell is not set. To fix it, it toggles cycle bit before reset operation, and restores it after reset, it could avoid unexpected DMA advance due to cycle bit is for software during the endpoint reset operation. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Signed-off-by: Peter Chen Cc: stable Link: https://lore.kernel.org/r/20200219141455.23257-3-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit 8a7c47fb7285b23ca259c888016513d5566fa9e8 Author: Peter Chen Date: Wed Feb 19 22:14:54 2020 +0800 usb: cdns3: gadget: link trb should point to next request It has marked the dequeue trb as link trb, but its next segment pointer is still itself, it causes the transfer can't go on. Fix it by set its pointer as the trb address for the next request. Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") Signed-off-by: Peter Chen Cc: stable Link: https://lore.kernel.org/r/20200219141455.23257-2-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit e9d0e7511fda92a6511904996dd0aa57b6d7687a Author: Dan Carpenter Date: Tue Mar 3 13:17:16 2020 +0300 thunderbolt: Fix error code in tb_port_is_width_supported() This function is type bool, and it's supposed to return true on success. Unfortunately, this path takes negative error codes and casts them to bool (true) so it's treated as success instead of failure. Fixes: 91c0c12080d0 ("thunderbolt: Add support for lane bonding") Signed-off-by: Dan Carpenter Signed-off-by: Mika Westerberg commit 209c65b61d94344522c41a83cd6ce51aac5fd0a4 Author: Dajun Jin Date: Mon Mar 2 20:24:21 2020 -0800 drivers/of/of_mdio.c:fix of_mdiobus_register() When registers a phy_device successful, should terminate the loop or the phy_device would be registered in other addr. If there are multiple PHYs without reg properties, it will go wrong. Signed-off-by: Dajun Jin Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 116ca924aea664141afa86a1425edc3fcda0d06f Author: Vishal Kulkarni Date: Mon Mar 2 10:54:13 2020 +0530 cxgb4: fix checks for max queues to allocate Hardware can support more than 8 queues currently limited by netif_get_num_default_rss_queues(). So, rework and fix checks for max number of queues to allocate. The checks should be based on how many are actually supported by hardware, OR the number of online cpus; whichever is lower. Fixes: 5952dde72307 ("cxgb4: set maximal number of default RSS queues") Signed-off-by: Vishal Kulkarni " Signed-off-by: David S. Miller commit 20d8bb0d172d87dcc52727cb7174ae9994de8978 Author: Hauke Mehrtens Date: Mon Mar 2 00:55:02 2020 +0100 phylink: Improve error message when validate failed This should improve the error message when the PHY validate in the MAC driver failed. I ran into this problem multiple times that I put wrong interface values into the device tree and was searching why it is failing with -22 (-EINVAL). This should make it easier to spot the problem. Signed-off-by: Hauke Mehrtens Acked-by: Russell King Signed-off-by: David S. Miller commit 43de81b0601df7d7988d3f5617ee0987df65c883 Author: Jonas Gorski Date: Mon Mar 2 20:46:57 2020 +0100 net: phy: bcm63xx: fix OOPS due to missing driver name 719655a14971 ("net: phy: Replace phy driver features u32 with link_mode bitmap") was a bit over-eager and also removed the second phy driver's name, resulting in a nasty OOPS on registration: [ 1.319854] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804dd50c, ra == 804dd4f0 [ 1.330859] Oops[#1]: [ 1.333138] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.22 #0 [ 1.339217] $ 0 : 00000000 00000001 87ca7f00 805c1874 [ 1.344590] $ 4 : 00000000 00000047 00585000 8701f800 [ 1.349965] $ 8 : 8701f800 804f4a5c 00000003 64726976 [ 1.355341] $12 : 00000001 00000000 00000000 00000114 [ 1.360718] $16 : 87ca7f80 00000000 00000000 80639fe4 [ 1.366093] $20 : 00000002 00000000 806441d0 80b90000 [ 1.371470] $24 : 00000000 00000000 [ 1.376847] $28 : 87c1e000 87c1fda0 80b90000 804dd4f0 [ 1.382224] Hi : d1c8f8da [ 1.385180] Lo : 5518a480 [ 1.388182] epc : 804dd50c kset_find_obj+0x3c/0x114 [ 1.393345] ra : 804dd4f0 kset_find_obj+0x20/0x114 [ 1.398530] Status: 10008703 KERNEL EXL IE [ 1.402833] Cause : 00800008 (ExcCode 02) [ 1.406952] BadVA : 00000000 [ 1.409913] PrId : 0002a075 (Broadcom BMIPS4350) [ 1.414745] Modules linked in: [ 1.417895] Process swapper/0 (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000) [ 1.426214] Stack : 87cec000 80630000 80639370 80640658 80640000 80049af4 80639fe4 8063a0d8 [ 1.434816] 8063a0d8 802ef078 00000002 00000000 806441d0 80b90000 8063a0d8 802ef114 [ 1.443417] 87cea0de 87c1fde0 00000000 804de488 87cea000 8063a0d8 8063a0d8 80334e48 [ 1.452018] 80640000 8063984c 80639bf4 00000000 8065de48 00000001 8063a0d8 80334ed0 [ 1.460620] 806441d0 80b90000 80b90000 802ef164 8065dd70 80620000 80b90000 8065de58 [ 1.469222] ... [ 1.471734] Call Trace: [ 1.474255] [<804dd50c>] kset_find_obj+0x3c/0x114 [ 1.479141] [<802ef078>] driver_find+0x1c/0x44 [ 1.483665] [<802ef114>] driver_register+0x74/0x148 [ 1.488719] [<80334e48>] phy_driver_register+0x9c/0xd0 [ 1.493968] [<80334ed0>] phy_drivers_register+0x54/0xe8 [ 1.499345] [<8001061c>] do_one_initcall+0x7c/0x1f4 [ 1.504374] [<80644ed8>] kernel_init_freeable+0x1d4/0x2b4 [ 1.509940] [<804f4e24>] kernel_init+0x10/0xf8 [ 1.514502] [<80018e68>] ret_from_kernel_thread+0x14/0x1c [ 1.520040] Code: 1060000c 02202025 90650000 <90810000> 24630001 14250004 24840001 14a0fffb 90650000 [ 1.530061] [ 1.531698] ---[ end trace d52f1717cd29bdc8 ]--- Fix it by readding the name. Fixes: 719655a14971 ("net: phy: Replace phy driver features u32 with link_mode bitmap") Signed-off-by: Jonas Gorski Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 707518348ae7337db34bdeb544edf254f66e20f2 Author: Jacob Keller Date: Mon Mar 2 14:21:19 2020 -0800 devlink: remove trigger command from devlink-region.rst The devlink trigger command does not exist. While rewriting the documentation for devlink into the reStructuredText format, documentation for the trigger command was accidentally merged in. This occurred because the author was also working on a potential extension to devlink regions which included this trigger command, and accidentally squashed the documentation incorrectly. Further review eventually settled on using the previously unused "new" command instead of creating a new trigger command. Fix this by removing mention of the trigger command from the documentation. Fixes: 0b0f945f5458 ("devlink: add a file documenting devlink regions", 2020-01-10) Noticed-by: Jiri Pirko Signed-off-by: Jacob Keller Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 88a637719a1570705c02cacb3297af164b1714e7 Author: Jakub Kicinski Date: Mon Mar 2 21:08:33 2020 -0800 netfilter: nft_tunnel: add missing attribute validation for tunnels Add missing attribute validation for tunnel source and destination ports to the netlink policy. Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support") Signed-off-by: Jakub Kicinski Signed-off-by: Pablo Neira Ayuso commit 9d6effb2f1523eb84516e44213c00f2fd9e6afff Author: Jakub Kicinski Date: Mon Mar 2 21:08:32 2020 -0800 netfilter: nft_payload: add missing attribute validation for payload csum flags Add missing attribute validation for NFTA_PAYLOAD_CSUM_FLAGS to the netlink policy. Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") Signed-off-by: Jakub Kicinski Signed-off-by: Pablo Neira Ayuso commit c049b3450072b8e3998053490e025839fecfef31 Author: Jakub Kicinski Date: Mon Mar 2 21:08:31 2020 -0800 netfilter: cthelper: add missing attribute validation for cthelper Add missing attribute validation for cthelper to the netlink policy. Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Jakub Kicinski Signed-off-by: Pablo Neira Ayuso commit 2d285f26ecd072800a29c5b71e63437f21ef830a Author: Florian Westphal Date: Mon Mar 2 21:58:50 2020 +0100 netfilter: nf_tables: free flowtable hooks on hook register error If hook registration fails, the hooks allocated via nft_netdev_hook_alloc need to be freed. We can't change the goto label to 'goto 5' -- while it does fix the memleak it does cause a warning splat from the netfilter core (the hooks were not registered). Fixes: 3f0465a9ef02 ("netfilter: nf_tables: dynamically allocate hooks per net_device in flowtables") Reported-by: syzbot+a2ff6fa45162a5ed4dd3@syzkaller.appspotmail.com Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit ee84f19cbbe9cf7cba2958acb03163fed3ecbb0f Author: Vasily Averin Date: Tue Feb 25 10:07:12 2020 +0300 netfilter: x_tables: xt_mttg_seq_next should increase position index If .next function does not change position index, following .show function will repeat output related to current position index. Without patch: # dd if=/proc/net/ip_tables_matches # original file output conntrack conntrack conntrack recent recent icmp udplite udp tcp 0+1 records in 0+1 records out 65 bytes copied, 5.4074e-05 s, 1.2 MB/s # dd if=/proc/net/ip_tables_matches bs=62 skip=1 dd: /proc/net/ip_tables_matches: cannot skip to specified offset cp <<< end of last line tcp <<< and then unexpected whole last line once again 0+1 records in 0+1 records out 7 bytes copied, 0.000102447 s, 68.3 kB/s Cc: stable@vger.kernel.org Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Pablo Neira Ayuso commit db25517a550926f609c63054b12ea9ad515e1a10 Author: Vasily Averin Date: Tue Feb 25 10:06:29 2020 +0300 netfilter: xt_recent: recent_seq_next should increase position index If .next function does not change position index, following .show function will repeat output related to current position index. Without the patch: # dd if=/proc/net/xt_recent/SSH # original file outpt src=127.0.0.4 ttl: 0 last_seen: 6275444819 oldest_pkt: 1 6275444819 src=127.0.0.2 ttl: 0 last_seen: 6275438906 oldest_pkt: 1 6275438906 src=127.0.0.3 ttl: 0 last_seen: 6275441953 oldest_pkt: 1 6275441953 0+1 records in 0+1 records out 204 bytes copied, 6.1332e-05 s, 3.3 MB/s Read after lseek into middle of last line (offset 140 in example below) generates expected end of last line and then unexpected whole last line once again # dd if=/proc/net/xt_recent/SSH bs=140 skip=1 dd: /proc/net/xt_recent/SSH: cannot skip to specified offset 127.0.0.3 ttl: 0 last_seen: 6275441953 oldest_pkt: 1 6275441953 src=127.0.0.3 ttl: 0 last_seen: 6275441953 oldest_pkt: 1 6275441953 0+1 records in 0+1 records out 132 bytes copied, 6.2487e-05 s, 2.1 MB/s Cc: stable@vger.kernel.org Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Pablo Neira Ayuso commit bb71f846a0002239f7058c84f1496648ff4a5c20 Author: Vasily Averin Date: Tue Feb 25 10:05:59 2020 +0300 netfilter: synproxy: synproxy_cpu_seq_next should increase position index If .next function does not change position index, following .show function will repeat output related to current position index. Cc: stable@vger.kernel.org Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Pablo Neira Ayuso commit dc15af8e9dbd039ebb06336597d2c491ef46ab74 Author: Vasily Averin Date: Tue Feb 25 10:05:47 2020 +0300 netfilter: nf_conntrack: ct_cpu_seq_next should increase position index If .next function does not change position index, following .show function will repeat output related to current position index. Cc: stable@vger.kernel.org Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Pablo Neira Ayuso commit 820d15632ec10bc0cf79595c5a635b795d149520 Merge: 0b86b258e644 8c867387160e Author: Olof Johansson Date: Tue Mar 3 16:40:54 2020 -0800 Merge tag 'socfpga_dts_fix_for_v5.6_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes arm64: dts: agilex: fix gmac compatible - The compatible for Agilex GMAC should be "altr,socfpga-stmmac-a10-s10" * tag 'socfpga_dts_fix_for_v5.6_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: (578 commits) arm64: dts: socfpga: agilex: Fix gmac compatible Linux 5.6-rc4 KVM: VMX: check descriptor table exits on instruction emulation ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() macintosh: therm_windtunnel: fix regression when instantiating devices jbd2: fix data races at struct journal_head kvm: x86: Limit the number of "kvm: disabled by bios" messages KVM: x86: avoid useless copy of cpufreq policy KVM: allow disabling -Werror KVM: x86: allow compiling as non-module with W=1 KVM: Pre-allocate 1 cpumask variable per cpu for both pv tlb and pv ipis KVM: Introduce pv check helpers KVM: let declaration of kvm_get_running_vcpus match implementation KVM: SVM: allocate AVIC data structures based on kvm_amd module parameter MAINTAINERS: Correct Cadence PCI driver path io_uring: fix 32-bit compatability with sendmsg/recvmsg net: dsa: mv88e6xxx: Fix masking of egress port mlxsw: pci: Wait longer before accessing the device after reset sfc: fix timestamp reconstruction at 16-bit rollover points vsock: fix potential deadlock in transport->release() ... Link: https://lore.kernel.org/r/20200303153509.28248-1-dinguyen@kernel.org Signed-off-by: Olof Johansson commit f8a0fea9518c5ff7c37679504bd9eeabeae8ee36 Author: Jonathan Neuschäfer Date: Tue Mar 3 21:22:05 2020 +0100 docs: networking: net_failover: Fix a few typos Signed-off-by: Jonathan Neuschäfer Signed-off-by: David S. Miller commit 8640f8dc6d657ebfb4e67c202ad32c5457858a13 Author: Russell King Date: Tue Mar 3 15:01:46 2020 +0000 net: dsa: fix phylink_start()/phylink_stop() calls Place phylink_start()/phylink_stop() inside dsa_port_enable() and dsa_port_disable(), which ensures that we call phylink_stop() before tearing down phylink - which is a documented requirement. Failure to do so can cause use-after-free bugs. Fixes: 0e27921816ad ("net: dsa: Use PHYLINK for the CPU/DSA ports") Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 8b614cb8f1dcac8ca77cf4dd85f46ef3055f8238 Merge: 2873dc25477f fb4b5f13464c Author: Linus Torvalds Date: Tue Mar 3 17:31:19 2020 -0600 Merge tag '5.6-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Five small cifs/smb3 fixes, two for stable (one for a reconnect problem and the other fixes a use case when renaming an open file)" * tag '5.6-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Use #define in cifs_dbg cifs: fix rename() by ensuring source handle opened with DELETE bit cifs: add missing mount option to /proc/mounts cifs: fix potential mismatch of UNC paths cifs: don't leak -EAGAIN for stat() during reconnect commit f650bcd4ef5d6e2330593dbaaa814ffc945a9855 Merge: a6fbcddad6a4 0d29169a708b Author: David S. Miller Date: Tue Mar 3 14:43:17 2020 -0800 Merge branch 'Fix-IPv6-peer-route-update' Hangbin Liu says: ==================== Fix IPv6 peer route update Currently we have two issues for peer route update on IPv6. 1. When update peer route metric, we only updated the local one. 2. If peer address changed, we didn't remove the old one and add new one. The first two patches fixed these issues and the third patch add new tests to cover it. With the fixes and updated test: ]# ./fib_tests.sh IPv6 prefix route tests TEST: Default metric [ OK ] TEST: User specified metric on first device [ OK ] TEST: User specified metric on second device [ OK ] TEST: Delete of address on first device [ OK ] TEST: Modify metric of address [ OK ] TEST: Prefix route removed on link down [ OK ] TEST: Prefix route with metric on link up [ OK ] TEST: Set metric with peer route on local side [ OK ] TEST: User specified metric on local address [ OK ] TEST: Set metric with peer route on peer side [ OK ] TEST: Modify metric with peer route on local side [ OK ] TEST: Modify metric with peer route on peer side [ OK ] IPv4 prefix route tests TEST: Default metric [ OK ] TEST: User specified metric on first device [ OK ] TEST: User specified metric on second device [ OK ] TEST: Delete of address on first device [ OK ] TEST: Modify metric of address [ OK ] TEST: Prefix route removed on link down [ OK ] TEST: Prefix route with metric on link up [ OK ] TEST: Modify metric of .0/24 address [ OK ] TEST: Set metric of address with peer route [ OK ] TEST: Modify metric of address with peer route [ OK ] Tests passed: 22 Tests failed: 0 ==================== Signed-off-by: David S. Miller commit 0d29169a708bf730ede287248e429d579f432d1d Author: Hangbin Liu Date: Tue Mar 3 14:37:36 2020 +0800 selftests/net/fib_tests: update addr_metric_test for peer route testing This patch update {ipv4, ipv6}_addr_metric_test with 1. Set metric of address with peer route and see if the route added correctly. 2. Modify metric and peer address for peer route and see if the route changed correctly. Signed-off-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: David S. Miller commit d0098e4c6b83e502cc1cd96d67ca86bc79a6c559 Author: Hangbin Liu Date: Tue Mar 3 14:37:35 2020 +0800 net/ipv6: remove the old peer route if change it to a new one When we modify the peer route and changed it to a new one, we should remove the old route first. Before the fix: + ip addr add dev dummy1 2001:db8::1 peer 2001:db8::2 + ip -6 route show dev dummy1 2001:db8::1 proto kernel metric 256 pref medium 2001:db8::2 proto kernel metric 256 pref medium + ip addr change dev dummy1 2001:db8::1 peer 2001:db8::3 + ip -6 route show dev dummy1 2001:db8::1 proto kernel metric 256 pref medium 2001:db8::2 proto kernel metric 256 pref medium After the fix: + ip addr change dev dummy1 2001:db8::1 peer 2001:db8::3 + ip -6 route show dev dummy1 2001:db8::1 proto kernel metric 256 pref medium 2001:db8::3 proto kernel metric 256 pref medium This patch depend on the previous patch "net/ipv6: need update peer route when modify metric" to update new peer route after delete old one. Signed-off-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 617940123e0140521f3080d2befc2bf55bcda094 Author: Hangbin Liu Date: Tue Mar 3 14:37:34 2020 +0800 net/ipv6: need update peer route when modify metric When we modify the route metric, the peer address's route need also be updated. Before the fix: + ip addr add dev dummy1 2001:db8::1 peer 2001:db8::2 metric 60 + ip -6 route show dev dummy1 2001:db8::1 proto kernel metric 60 pref medium 2001:db8::2 proto kernel metric 60 pref medium + ip addr change dev dummy1 2001:db8::1 peer 2001:db8::2 metric 61 + ip -6 route show dev dummy1 2001:db8::1 proto kernel metric 61 pref medium 2001:db8::2 proto kernel metric 60 pref medium After the fix: + ip addr change dev dummy1 2001:db8::1 peer 2001:db8::2 metric 61 + ip -6 route show dev dummy1 2001:db8::1 proto kernel metric 61 pref medium 2001:db8::2 proto kernel metric 61 pref medium Fixes: 8308f3ff1753 ("net/ipv6: Add support for specifying metric of connected routes") Signed-off-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 50bbd62ce7a153051209049db708b8f5f3c395b8 Author: Jonathan Neuschäfer Date: Thu Feb 27 18:07:01 2020 +0100 dt-bindings: mfd: Fix typo in file name of twl-familly.txt Signed-off-by: Jonathan Neuschäfer Signed-off-by: Rob Herring commit 8c6687efcfd2f849a1a66bc6d54ead4f60d9b5e4 Author: Jonathan Neuschäfer Date: Thu Feb 27 17:05:21 2020 +0100 dt-bindings: mfd: tps65910: Improve grammar Signed-off-by: Jonathan Neuschäfer Signed-off-by: Rob Herring commit b94858a7eae1aeabf6d910ded3b6fe66d06e8a1e Author: Jonathan Neuschäfer Date: Thu Feb 27 16:55:00 2020 +0100 dt-bindings: mfd: zii,rave-sp: Fix a typo ("onborad") Signed-off-by: Jonathan Neuschäfer Signed-off-by: Rob Herring commit 20896ef137340e9426cf322606f764452f5eb960 Author: Jernej Skrabec Date: Mon Feb 24 18:38:57 2020 +0100 drm/sun4i: Fix DE2 VI layer format support DE2 VI layer doesn't support blending which means alpha channel is ignored. Replace all formats with alpha with "don't care" (X) channel. Fixes: 7480ba4d7571 ("drm/sun4i: Add support for DE2 VI planes") Acked-by: Maxime Ripard Signed-off-by: Jernej Skrabec Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-4-jernej.skrabec@siol.net commit 169ca4b38932112e8b2ee8baef9cea44678625b3 Author: Jernej Skrabec Date: Mon Feb 24 18:38:56 2020 +0100 drm/sun4i: Add separate DE3 VI layer formats DE3 VI layers support alpha blending, but DE2 VI layers do not. Additionally, DE3 VI layers support 10-bit RGB and YUV formats. Make a separate list for DE3. Fixes: c50519e6db4d ("drm/sun4i: Add basic support for DE3") Acked-by: Maxime Ripard Signed-off-by: Jernej Skrabec Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-3-jernej.skrabec@siol.net commit a4769905f0ae32cae4f096f646ab03b8b4794c74 Author: Jernej Skrabec Date: Mon Feb 24 18:38:55 2020 +0100 drm/sun4i: de2/de3: Remove unsupported VI layer formats YUV444 and YVU444 are planar formats, but HW format RGB888 is packed. This means that those two mappings were never correct. Remove them. Fixes: 60a3dcf96aa8 ("drm/sun4i: Add DE2 definitions for YUV formats") Acked-by: Maxime Ripard Signed-off-by: Jernej Skrabec Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-2-jernej.skrabec@siol.net commit a6fbcddad6a4141d119f18dca72f9ecc897eac51 Merge: ab124d580ad4 6ba3da446551 Author: David S. Miller Date: Tue Mar 3 13:28:49 2020 -0800 Merge branch 'net-add-missing-netlink-policies' Jakub Kicinski says: ==================== net: add missing netlink policies Recent one-off fixes motivated me to do some grepping for more missing netlink attribute policies. I didn't manage to even produce a KASAN splat with these, but it should be possible with sufficient luck. All the missing policies are pretty trivial (NLA_Uxx). I've only tested the devlink patches, the rest compiles. ==================== Signed-off-by: David S. Miller commit 6ba3da446551f2150fadbf8c7788edcb977683d3 Author: Jakub Kicinski Date: Mon Mar 2 21:05:26 2020 -0800 nfc: add missing attribute validation for vendor subcommand Add missing attribute validation for vendor subcommand attributes to the netlink policy. Fixes: 9e58095f9660 ("NFC: netlink: Implement vendor command support") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 88e706d5168b07df4792dbc3d1bc37b83e4bd74d Author: Jakub Kicinski Date: Mon Mar 2 21:05:25 2020 -0800 nfc: add missing attribute validation for deactivate target Add missing attribute validation for NFC_ATTR_TARGET_INDEX to the netlink policy. Fixes: 4d63adfe12dd ("NFC: Add NFC_CMD_DEACTIVATE_TARGET support") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 361d23e41ca6e504033f7e66a03b95788377caae Author: Jakub Kicinski Date: Mon Mar 2 21:05:24 2020 -0800 nfc: add missing attribute validation for SE API Add missing attribute validation for NFC_ATTR_SE_INDEX to the netlink policy. Fixes: 5ce3f32b5264 ("NFC: netlink: SE API implementation") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 213320a67962ff6e7b83b704d55cbebc341426db Author: Jakub Kicinski Date: Mon Mar 2 21:05:23 2020 -0800 tipc: add missing attribute validation for MTU property Add missing attribute validation for TIPC_NLA_PROP_MTU to the netlink policy. Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU") Signed-off-by: Jakub Kicinski Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 669fcd7795900cd1880237cbbb57a7db66cb9ac8 Author: Jakub Kicinski Date: Mon Mar 2 21:05:22 2020 -0800 team: add missing attribute validation for array index Add missing attribute validation for TEAM_ATTR_OPTION_ARRAY_INDEX to the netlink policy. Fixes: b13033262d24 ("team: introduce array options") Signed-off-by: Jakub Kicinski Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit dd25cb272ccce4db67dc8509278229099e4f5e99 Author: Jakub Kicinski Date: Mon Mar 2 21:05:21 2020 -0800 team: add missing attribute validation for port ifindex Add missing attribute validation for TEAM_ATTR_OPTION_PORT_IFINDEX to the netlink policy. Fixes: 80f7c6683fe0 ("team: add support for per-port options") Signed-off-by: Jakub Kicinski Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit e13aaa0643da10006ec35715954e7f92a62899a5 Author: Jakub Kicinski Date: Mon Mar 2 21:05:20 2020 -0800 net: taprio: add missing attribute validation for txtime delay Add missing attribute validation for TCA_TAPRIO_ATTR_TXTIME_DELAY to the netlink policy. Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Signed-off-by: Jakub Kicinski Reviewed-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 7e6dc03eeb023e18427a373522f1d247b916a641 Author: Jakub Kicinski Date: Mon Mar 2 21:05:19 2020 -0800 net: fq: add missing attribute validation for orphan mask Add missing attribute validation for TCA_FQ_ORPHAN_MASK to the netlink policy. Fixes: 06eb395fa985 ("pkt_sched: fq: better control of DDOS traffic") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit b5ab1f1be6180a2e975eede18731804b5164a05d Author: Jakub Kicinski Date: Mon Mar 2 21:05:18 2020 -0800 openvswitch: add missing attribute validation for hash Add missing attribute validation for OVS_PACKET_ATTR_HASH to the netlink policy. Fixes: bd1903b7c459 ("net: openvswitch: add hash info to upcall") Signed-off-by: Jakub Kicinski Reviewed-by: Greg Rose Signed-off-by: David S. Miller commit 31d9a1c524964bac77b7f9d0a1ac140dc6b57461 Author: Jakub Kicinski Date: Mon Mar 2 21:05:17 2020 -0800 macsec: add missing attribute validation for port Add missing attribute validation for IFLA_MACSEC_PORT to the netlink policy. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit ab02ad660586b94f5d08912a3952b939cf4c4430 Author: Jakub Kicinski Date: Mon Mar 2 21:05:16 2020 -0800 can: add missing attribute validation for termination Add missing attribute validation for IFLA_CAN_TERMINATION to the netlink policy. Fixes: 12a6075cabc0 ("can: dev: add CAN interface termination API") Signed-off-by: Jakub Kicinski Acked-by: Oliver Hartkopp Signed-off-by: David S. Miller commit b60673c4c418bef7550d02faf53c34fbfeb366bf Author: Jakub Kicinski Date: Mon Mar 2 21:05:15 2020 -0800 nl802154: add missing attribute validation for dev_type Add missing attribute type validation for IEEE802154_ATTR_DEV_TYPE to the netlink policy. Fixes: 90c049b2c6ae ("ieee802154: interface type to be added") Signed-off-by: Jakub Kicinski Acked-by: Stefan Schmidt Signed-off-by: David S. Miller commit 9322cd7c4af2ccc7fe7c5f01adb53f4f77949e92 Author: Jakub Kicinski Date: Mon Mar 2 21:05:14 2020 -0800 nl802154: add missing attribute validation Add missing attribute validation for several u8 types. Fixes: 2c21d11518b6 ("net: add NL802154 interface for configuration of 802.15.4 devices") Signed-off-by: Jakub Kicinski Acked-by: Stefan Schmidt Signed-off-by: David S. Miller commit 4c16d64ea04056f1b1b324ab6916019f6a064114 Author: Jakub Kicinski Date: Mon Mar 2 21:05:13 2020 -0800 fib: add missing attribute validation for tun_id Add missing netlink policy entry for FRA_TUN_ID. Fixes: e7030878fc84 ("fib: Add fib rule match on tunnel id") Signed-off-by: Jakub Kicinski Reviewed-by: David Ahern Signed-off-by: David S. Miller commit ff3b63b8c299b73ac599b120653b47e275407656 Author: Jakub Kicinski Date: Mon Mar 2 21:05:12 2020 -0800 devlink: validate length of region addr/len DEVLINK_ATTR_REGION_CHUNK_ADDR and DEVLINK_ATTR_REGION_CHUNK_LEN lack entries in the netlink policy. Corresponding nla_get_u64()s may read beyond the end of the message. Fixes: 4e54795a27f5 ("devlink: Add support for region snapshot read command") Signed-off-by: Jakub Kicinski Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 8750939b6ad86abc3f53ec8a9683a1cded4a5654 Author: Jakub Kicinski Date: Mon Mar 2 21:05:11 2020 -0800 devlink: validate length of param values DEVLINK_ATTR_PARAM_VALUE_DATA may have different types so it's not checked by the normal netlink policy. Make sure the attribute length is what we expect. Fixes: e3b7ca18ad7b ("devlink: Add param set command") Signed-off-by: Jakub Kicinski Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit b46b2b7ba6e104d265ab705914859ec0db7a98c5 Author: Tony Lindgren Date: Tue Mar 3 13:18:36 2020 -0800 ARM: dts: Fix dm814x Ethernet by changing to use rgmii-id mode Commit cd28d1d6e52e ("net: phy: at803x: Disable phy delay for RGMII mode") caused a regression for dm814x boards where NFSroot would no longer work. Let's fix the issue by configuring "rgmii-id" mode as internal delays are needed that is no longer the case with "rgmii" mode. Signed-off-by: Tony Lindgren commit 44f2f882909fedfc3a56e4b90026910456019743 Author: Dan Carpenter Date: Tue Mar 3 13:16:08 2020 +0300 hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() This is only called from adt7462_update_device(). The caller expects it to return zero on error. I fixed a similar issue earlier in commit a4bf06d58f21 ("hwmon: (adt7462) ADT7462_REG_VOLT_MAX() should return 0") but I missed this one. Fixes: c0b4e3ab0c76 ("adt7462: new hwmon driver") Signed-off-by: Dan Carpenter Reviewed-by: Darrick J. Wong Link: https://lore.kernel.org/r/20200303101608.kqjwfcazu2ylhi2a@kili.mountain Signed-off-by: Guenter Roeck commit b5c0951860ba98cfe1936b5c0739450875d51451 Author: Arnaldo Carvalho de Melo Date: Mon Mar 2 16:03:34 2020 -0300 perf symbols: Don't try to find a vmlinux file when looking for kernel modules The dso->kernel value is now set to everything that is in machine->kmaps, but that was being used to decide if vmlinux lookup is needed, which ended up making that lookup be made for kernel modules, that now have dso->kernel set, leading to these kinds of warnings when running on a machine with compressed kernel modules, like fedora:31: [root@five ~]# perf record -F 10000 -a sleep 2 [ perf record: Woken up 1 times to write data ] lzma: fopen failed on vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /usr/lib/debug/boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /lib/modules/5.5.5-200.fc31.x86_64/build/vmlinux: 'No such file or directory' lzma: fopen failed on vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /usr/lib/debug/boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /lib/modules/5.5.5-200.fc31.x86_64/build/vmlinux: 'No such file or directory' lzma: fopen failed on vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /usr/lib/debug/boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /lib/modules/5.5.5-200.fc31.x86_64/build/vmlinux: 'No such file or directory' lzma: fopen failed on vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /usr/lib/debug/boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /lib/modules/5.5.5-200.fc31.x86_64/build/vmlinux: 'No such file or directory' lzma: fopen failed on vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux: 'No such file or directory' lzma: fopen failed on /boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /usr/lib/debug/boot/vmlinux-5.5.5-200.fc31.x86_64: 'No such file or directory' lzma: fopen failed on /lib/modules/5.5.5-200.fc31.x86_64/build/vmlinux: 'No such file or directory' [ perf record: Captured and wrote 1.024 MB perf.data (1366 samples) ] [root@five ~]# This happens when collecting the buildid, when we find samples for kernel modules, fix it by checking if the looked up DSO is a kernel module by other means. Fixes: 02213cec64bb ("perf maps: Mark module DSOs with kernel type") Tested-by: Jiri Olsa Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Kim Phillips Cc: Michael Petlan Cc: Namhyung Kim Cc: Ravi Bangoria Link: http://lore.kernel.org/lkml/20200302191007.GD10335@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e4d9b04b973b2dbce7b42af95ea70d07da1c936d Author: Arnaldo Carvalho de Melo Date: Mon Mar 2 12:09:38 2020 -0300 perf bench: Share some global variables to fix build with gcc 10 Noticed with gcc 10 (fedora rawhide) that those variables were not being declared as static, so end up with: ld: /tmp/build/perf/bench/epoll-wait.o:/git/perf/tools/perf/bench/epoll-wait.c:93: multiple definition of `end'; /tmp/build/perf/bench/futex-hash.o:/git/perf/tools/perf/bench/futex-hash.c:40: first defined here ld: /tmp/build/perf/bench/epoll-wait.o:/git/perf/tools/perf/bench/epoll-wait.c:93: multiple definition of `start'; /tmp/build/perf/bench/futex-hash.o:/git/perf/tools/perf/bench/futex-hash.c:40: first defined here ld: /tmp/build/perf/bench/epoll-wait.o:/git/perf/tools/perf/bench/epoll-wait.c:93: multiple definition of `runtime'; /tmp/build/perf/bench/futex-hash.o:/git/perf/tools/perf/bench/futex-hash.c:40: first defined here ld: /tmp/build/perf/bench/epoll-ctl.o:/git/perf/tools/perf/bench/epoll-ctl.c:38: multiple definition of `end'; /tmp/build/perf/bench/futex-hash.o:/git/perf/tools/perf/bench/futex-hash.c:40: first defined here ld: /tmp/build/perf/bench/epoll-ctl.o:/git/perf/tools/perf/bench/epoll-ctl.c:38: multiple definition of `start'; /tmp/build/perf/bench/futex-hash.o:/git/perf/tools/perf/bench/futex-hash.c:40: first defined here ld: /tmp/build/perf/bench/epoll-ctl.o:/git/perf/tools/perf/bench/epoll-ctl.c:38: multiple definition of `runtime'; /tmp/build/perf/bench/futex-hash.o:/git/perf/tools/perf/bench/futex-hash.c:40: first defined here make[4]: *** [/git/perf/tools/build/Makefile.build:145: /tmp/build/perf/bench/perf-in.o] Error 1 Prefix those with bench__ and add them to bench/bench.h, so that we can share those on the tools needing to access those variables from signal handlers. Acked-by: Thomas Gleixner Cc: Adrian Hunter Cc: Davidlohr Bueso Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20200303155811.GD13702@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f0fe2c0f050d31babcad7d65f1d550d462a40064 Author: Christian Brauner Date: Tue Mar 3 17:43:40 2020 +0100 binder: prevent UAF for binderfs devices II This is a necessary follow up to the first fix I proposed and we merged in 2669b8b0c79 ("binder: prevent UAF for binderfs devices"). I have been overly optimistic that the simple fix I proposed would work. But alas, ihold() + iput() won't work since the inodes won't survive the destruction of the superblock. So all we get with my prior fix is a different race with a tinier race-window but it doesn't solve the issue. Fwiw, the problem lies with generic_shutdown_super(). It even has this cozy Al-style comment: if (!list_empty(&sb->s_inodes)) { printk("VFS: Busy inodes after unmount of %s. " "Self-destruct in 5 seconds. Have a nice day...\n", sb->s_id); } On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is called which punts the actual cleanup operation to a workqueue. At some point, binder_deferred_func() will be called which will end up calling binder_deferred_release() which will retrieve and cleanup the binder_context attach to this struct binder_proc. If we trace back where this binder_context is attached to binder_proc we see that it is set in binder_open() and is taken from the struct binder_device it is associated with. This obviously assumes that the struct binder_device that context is attached to is _never_ freed. While that might be true for devtmpfs binder devices it is most certainly wrong for binderfs binder devices. So, assume binder_open() is called on a binderfs binder devices. We now stash away the struct binder_context associated with that struct binder_devices: proc->context = &binder_dev->context; /* binderfs stashes devices in i_private */ if (is_binderfs_device(nodp)) { binder_dev = nodp->i_private; info = nodp->i_sb->s_fs_info; binder_binderfs_dir_entry_proc = info->proc_log_dir; } else { . . . proc->context = &binder_dev->context; Now let's assume that the binderfs instance for that binder devices is shutdown via umount() and/or the mount namespace associated with it goes away. As long as there is still an fd open for that binderfs binder device things are fine. But let's assume we now close the last fd for that binderfs binder device. Now binder_release() is called and punts to the workqueue. Assume that the workqueue has quite a bit of stuff to do and doesn't get to cleaning up the struct binder_proc and the associated struct binder_context with it for that binderfs binder device right away. In the meantime, the VFS is killing the super block and is ultimately calling sb->evict_inode() which means it will call binderfs_evict_inode() which does: static void binderfs_evict_inode(struct inode *inode) { struct binder_device *device = inode->i_private; struct binderfs_info *info = BINDERFS_I(inode); clear_inode(inode); if (!S_ISCHR(inode->i_mode) || !device) return; mutex_lock(&binderfs_minors_mutex); --info->device_count; ida_free(&binderfs_minors, device->miscdev.minor); mutex_unlock(&binderfs_minors_mutex); kfree(device->context.name); kfree(device); } thereby freeing the struct binder_device including struct binder_context. Now the workqueue finally has time to get around to cleaning up struct binder_proc and is now trying to access the associate struct binder_context. Since it's already freed it will OOPs. Fix this by introducing a refounct on binder devices. This is an alternative fix to 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()"). Fixes: 3ad20fe393b3 ("binder: implement binderfs") Fixes: 2669b8b0c798 ("binder: prevent UAF for binderfs devices") Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs") Related : 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner Acked-by: Todd Kjos Link: https://lore.kernel.org/r/20200303164340.670054-1-christian.brauner@ubuntu.com Signed-off-by: Greg Kroah-Hartman commit ecc421e05bab97cf3ff4fe456ade47ef84dba8c2 Author: Cyril Hrubis Date: Tue Mar 3 16:06:38 2020 +0100 sys/sysinfo: Respect boottime inside time namespace The sysinfo() syscall includes uptime in seconds but has no correction for time namespaces which makes it inconsistent with the /proc/uptime inside of a time namespace. Add the missing time namespace adjustment call. Signed-off-by: Cyril Hrubis Signed-off-by: Thomas Gleixner Reviewed-by: Dmitry Safonov Link: https://lkml.kernel.org/r/20200303150638.7329-1-chrubis@suse.cz commit aad15bc85c189261b0554a7dc8e053641dd4025c Author: Vincent Chen Date: Fri Feb 21 10:47:55 2020 +0800 riscv: Change code model of module to medany to improve data accessing All the loaded module locates in the region [＆_end-2G，VMALLOC_END] at runtime, so the distance from the module start to the end of the kernel image does not exceed 2GB. Hence, the code model of the kernel module can be changed to medany to improve the performance data access. Signed-off-by: Vincent Chen Signed-off-by: Palmer Dabbelt commit 0cff8bff7af886af0923d5c91776cd51603e531f Author: Vincent Chen Date: Fri Feb 21 10:47:54 2020 +0800 riscv: avoid the PIC offset of static percpu data in module beyond 2G limits The compiler uses the PIC-relative method to access static variables instead of GOT when the code model is PIC. Therefore, the limitation of the access range from the instruction to the symbol address is +-2GB. Under this circumstance, the kernel cannot load a kernel module if this module has static per-CPU symbols declared by DEFINE_PER_CPU(). The reason is that kernel relocates the .data..percpu section of the kernel module to the end of kernel's .data..percpu. Hence, the distance between the per-CPU symbols and the instruction will exceed the 2GB limits. To solve this problem, the kernel should place the loaded module in the memory area [&_end-2G, VMALLOC_END]. Signed-off-by: Vincent Chen Suggested-by: Alexandre Ghiti Suggested-by: Anup Patel Tested-by: Alexandre Ghiti Tested-by: Carlos de Paula Signed-off-by: Palmer Dabbelt commit d718fdc3e752ba51ddb2b5554d3db98a09355cc2 Author: Vitaly Kuznetsov Date: Tue Mar 3 15:33:16 2020 +0100 KVM: x86: remove stale comment from struct x86_emulate_ctxt Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") did some field shuffling and instead of [opcode_len, _regs) started clearing [has_seg_override, modrm). The comment about clearing fields altogether is not true anymore. Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 342993f96ab24d5864ab1216f46c0b199c2baf8e Author: Vitaly Kuznetsov Date: Tue Mar 3 15:33:15 2020 +0100 KVM: x86: clear stale x86_emulate_ctxt->intercept value After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Hyper-V guests on KVM stopped booting with: kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 info2 0 int_info 0 int_info_err 0 kvm_page_fault: address febd0000 error_code 181 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL kvm_inj_exception: #UD (0x0) "f3 a5" is a "rep movsw" instruction, which should not be intercepted at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") reduced the number of fields cleared by init_decode_cache() claiming that they are being cleared elsewhere, 'intercept', however, is left uncleared if the instruction does not have any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm, NearBranch, No16 and of course Intercept itself). Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Cc: stable@vger.kernel.org Suggested-by: Paolo Bonzini Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 636be4241bdd88fec273b38723e44bad4e1c4fae Author: Mike Snitzer Date: Thu Feb 27 14:25:31 2020 -0500 dm: bump version of core and various targets Changes made during the 5.6 cycle warrant bumping the version number for DM core and the targets modified by this commit. It should be noted that dm-thin, dm-crypt and dm-raid already had their target version bumped during the 5.6 merge window. Signed-off-by; Mike Snitzer commit 974f51e8633f0f3f33e8f86bbb5ae66758aa63c7 Author: Hou Tao Date: Tue Mar 3 16:45:01 2020 +0800 dm: fix congested_fn for request-based device We neither assign congested_fn for requested-based blk-mq device nor implement it correctly. So fix both. Also, remove incorrect comment from dm_init_normal_md_queue and rename it to dm_init_congested_fn. Fixes: 4aa9c692e052 ("bdi: separate out congested state into a separate struct") Cc: stable@vger.kernel.org Signed-off-by: Hou Tao Signed-off-by: Mike Snitzer commit 0a68ff5e2e7cf2263674b7f0418b31e10b2a497f Author: Kees Cook Date: Wed Feb 19 22:22:43 2020 -0800 fcntl: Distribute switch variables for initialization Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain. To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body. fs/fcntl.c: In function ‘send_sigio_to_task’: fs/fcntl.c:738:20: warning: statement will never be executed [-Wswitch-unreachable] 738 | kernel_siginfo_t si; | ^~ [1] https://bugs.llvm.org/show_bug.cgi?id=44916 Signed-off-by: Kees Cook Signed-off-by: Jeff Layton commit b102f0c522cf668c8382c56a4f771b37d011cda2 Author: Felix Fietkau Date: Thu Feb 20 12:41:39 2020 +0100 mt76: fix array overflow on receiving too many fragments for a packet If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo commit 8c867387160e89c9ffd12459f38e56844312a7a7 Author: Ley Foon Tan Date: Thu Feb 27 04:20:14 2020 +0800 arm64: dts: socfpga: agilex: Fix gmac compatible Fix gmac compatible string to "altr,socfpga-stmmac-a10-s10". Gmac for Agilex should use same compatible as Stratix 10. Fixes: 4b36daf9ada3 ("arm64: dts: agilex: Add initial support for Intel's Agilex SoCFPGA") Cc: stable@vger.kernel.org Signed-off-by: Ley Foon Tan Signed-off-by: Dinh Nguyen commit 248aa2645aa7fc9175d1107c2593cc90d4af5a4e Author: Mike Snitzer Date: Fri Feb 28 18:11:53 2020 -0500 dm integrity: use dm_bio_record and dm_bio_restore In cases where dec_in_flight() has to requeue the integrity_bio_wait work to transfer the rest of the data, the bio's __bi_remaining might already have been decremented to 0, e.g.: if bio passed to underlying data device was split via blk_queue_split(). Use dm_bio_{record,restore} rather than effectively open-coding them in dm-integrity -- these methods now manage __bi_remaining too. Depends-on: f7f0b057a9c1 ("dm bio record: save/restore bi_end_io and bi_integrity") Reported-by: Daniel Glöckner Suggested-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 1b17159e52bb31f982f82a6278acd7fab1d3f67b Author: Mike Snitzer Date: Fri Feb 28 18:00:53 2020 -0500 dm bio record: save/restore bi_end_io and bi_integrity Also, save/restore __bi_remaining in case the bio was used in a BIO_CHAIN (e.g. due to blk_queue_split). Suggested-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit e7a04894c766daa4248cb736efee93550f2d5872 Author: Omar Sandoval Date: Mon Mar 2 14:02:49 2020 -0800 btrfs: fix RAID direct I/O reads with alternate csums btrfs_lookup_and_bind_dio_csum() does pointer arithmetic which assumes 32-bit checksums. If using a larger checksum, this leads to spurious failures when a direct I/O read crosses a stripe. This is easy to reproduce: # mkfs.btrfs -f --checksum blake2 -d raid0 /dev/vdc /dev/vdd ... # mount /dev/vdc /mnt # cd /mnt # dd if=/dev/urandom of=foo bs=1M count=1 status=none # dd if=foo of=/dev/null bs=1M iflag=direct status=none dd: error reading 'foo': Input/output error # dmesg | tail -1 [ 135.821568] BTRFS warning (device vdc): csum failed root 5 ino 257 off 421888 ... Fix it by using the actual checksum size. Fixes: 1e25a2e3ca0d ("btrfs: don't assume ordered sums to be 4 bytes") CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Johannes Thumshirn Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit 613cea5935e83cb5a7d182ee3f98d54620e102e2 Author: Dan Carpenter Date: Tue Mar 3 13:18:58 2020 +0300 ASoC: SOF: Fix snd_sof_ipc_stream_posn() We're passing "&posn" instead of "posn" so it ends up corrupting memory instead of doing something useful. Fixes: 53e0c72d98ba ("ASoC: SOF: Add support for IPC IO between DSP and Host") Signed-off-by: Dan Carpenter Reviewed-by: Kai Vehmanen Link: https://lore.kernel.org/r/20200303101858.ytehbrivocyp3cnf@kili.mountain Signed-off-by: Mark Brown commit 4b01618b624736fc7d74f150f623d11b17b7b288 Author: Jack Yu Date: Tue Mar 3 10:59:13 2020 +0800 ASoC: rt1015: modify pre-divider for sysclk Modify pre-divider for system clock. Signed-off-by: Jack Yu Link: https://lore.kernel.org/r/20200303025913.24499-1-jack.yu@realtek.com Signed-off-by: Mark Brown commit 3791163602f7140011a8dc1691cfe6ec0cb1ef07 Author: Georgi Djakov Date: Wed Feb 26 13:04:20 2020 +0200 interconnect: Handle memory allocation errors When we allocate memory, kasprintf() can fail and we must check its return value. Fixes: 05309830e1f8 ("interconnect: Add a name to struct icc_path") Signed-off-by: Georgi Djakov Link: https://lore.kernel.org/r/20200226110420.5357-2-georgi.djakov@linaro.org Signed-off-by: Greg Kroah-Hartman commit 3745488e9d599916a0b40d45d3f30e3d4720288e Author: Daniel Axtens Date: Tue Feb 25 10:44:27 2020 -0800 altera-stapl: altera_get_note: prevent write beyond end of 'key' altera_get_note is called from altera_init, where key is kzalloc(33). When the allocation functions are annotated to allow the compiler to see the sizes of objects, and with FORTIFY_SOURCE, we see: In file included from drivers/misc/altera-stapl/altera.c:14:0: In function ‘strlcpy’, inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter __write_overflow(); ^~~~~~~~~~~~~~~~~~ That refers to this code in altera_get_note: if (key != NULL) strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], length); The error triggers because the length of 'key' is 33, but the copy uses length supplied as the 'length' parameter, which is always 256. Split the size parameter into key_len and val_len, and use the appropriate length depending on what is being copied. Detected by compiler error, only compile-tested. Cc: "Igor M. Liplianin" Signed-off-by: Daniel Axtens Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook Signed-off-by: Greg Kroah-Hartman commit 2669b8b0c798fbe1a31d49e07aa33233d469ad9b Author: Christian Brauner Date: Fri Feb 21 19:01:24 2020 +0100 binder: prevent UAF for binderfs devices On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is called which punts the actual cleanup operation to a workqueue. At some point, binder_deferred_func() will be called which will end up calling binder_deferred_release() which will retrieve and cleanup the binder_context attach to this struct binder_proc. If we trace back where this binder_context is attached to binder_proc we see that it is set in binder_open() and is taken from the struct binder_device it is associated with. This obviously assumes that the struct binder_device that context is attached to is _never_ freed. While that might be true for devtmpfs binder devices it is most certainly wrong for binderfs binder devices. So, assume binder_open() is called on a binderfs binder devices. We now stash away the struct binder_context associated with that struct binder_devices: proc->context = &binder_dev->context; /* binderfs stashes devices in i_private */ if (is_binderfs_device(nodp)) { binder_dev = nodp->i_private; info = nodp->i_sb->s_fs_info; binder_binderfs_dir_entry_proc = info->proc_log_dir; } else { . . . proc->context = &binder_dev->context; Now let's assume that the binderfs instance for that binder devices is shutdown via umount() and/or the mount namespace associated with it goes away. As long as there is still an fd open for that binderfs binder device things are fine. But let's assume we now close the last fd for that binderfs binder device. Now binder_release() is called and punts to the workqueue. Assume that the workqueue has quite a bit of stuff to do and doesn't get to cleaning up the struct binder_proc and the associated struct binder_context with it for that binderfs binder device right away. In the meantime, the VFS is killing the super block and is ultimately calling sb->evict_inode() which means it will call binderfs_evict_inode() which does: static void binderfs_evict_inode(struct inode *inode) { struct binder_device *device = inode->i_private; struct binderfs_info *info = BINDERFS_I(inode); clear_inode(inode); if (!S_ISCHR(inode->i_mode) || !device) return; mutex_lock(&binderfs_minors_mutex); --info->device_count; ida_free(&binderfs_minors, device->miscdev.minor); mutex_unlock(&binderfs_minors_mutex); kfree(device->context.name); kfree(device); } thereby freeing the struct binder_device including struct binder_context. Now the workqueue finally has time to get around to cleaning up struct binder_proc and is now trying to access the associate struct binder_context. Since it's already freed it will OOPs. Fix this by holding an additional reference to the inode that is only released once the workqueue is done cleaning up struct binder_proc. This is an easy alternative to introducing separate refcounting on struct binder_device which we can always do later if it becomes necessary. This is an alternative fix to 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()"). Fixes: 3ad20fe393b3 ("binder: implement binderfs") Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs") Related : 51d8a7eca677 ("binder: prevent UAF read in print_binder_transaction_log_entry()") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner Acked-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman commit 04d6067f1f19e70a418f92fa3170cf7fe53b7fdf Author: Zhenyu Wang Date: Tue Mar 3 13:54:12 2020 +0800 drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits From commit f25a49ab8ab9 ("drm/i915/gvt: Use vgpu_lock to protect per vgpu access") the vgpu idr destroy is moved later than vgpu resource destroy, then it would fail to stop timer for schedule policy clean which to check vgpu idr for any left vGPU. So this trys to destroy vgpu idr earlier. Cc: Colin Xu Fixes: f25a49ab8ab9 ("drm/i915/gvt: Use vgpu_lock to protect per vgpu access") Acked-by: Colin Xu Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20200229055445.31481-1-zhenyuw@linux.intel.com commit 764b53b26c9897b0693c934797e898d6cd883a26 Author: Jens Axboe Date: Mon Mar 2 20:01:32 2020 -0700 Revert "bcache: ignore pending signals when creating gc and allocator thread" This reverts commit 0b96da639a4874311e9b5156405f69ef9fc3bef8. We can't just go flushing random signals, under the assumption that the OOM killer will just do something else. It's not safe from the OOM perspective, and it could also cause other signals to get randomly lost. Signed-off-by: Jens Axboe commit ab4562f4dd92c455f6b313717af5e7d72a55d7b4 Author: Sébastien Szymanski Date: Tue Feb 25 13:39:04 2020 +0100 dt-bindings: arm: fsl: fix APF6Dev compatible APF6 Dev compatible is armadeus,imx6dl-apf6dev and not armadeus,imx6dl-apf6dldev. Fixes: 3d735471d066 ("dt-bindings: arm: Document Armadeus SoM and Dev boards devicetree binding") Signed-off-by: Sébastien Szymanski Signed-off-by: Rob Herring commit 80ad894382bf1d73eb688c29714fa10c0afcf2e7 Author: Pavel Begunkov Date: Mon Mar 2 23:46:10 2020 +0300 io-wq: remove io_wq_flush and IO_WQ_WORK_INTERNAL io_wq_flush() is buggy, during cancelation of a flush, the associated work may be passed to the caller's (i.e. io_uring) @match callback. That callback is expecting it to be embedded in struct io_kiocb. Cancelation of internal work probably doesn't make a lot of sense to begin with. As the flush helper is no longer used, just delete it and the associated work flag. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0b86b258e644c5f547005654cde0913d9e2ab5bc Merge: 14022b11d657 1bba60808404 Author: Olof Johansson Date: Mon Mar 2 11:54:24 2020 -0800 Merge tag 'arm-soc/for-5.6/defconfig-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs defconfig file(s) fixes for v5.6, please pull the following: - Stefan restores CONFIG_DEBUG_FS from the bcm2835_defconfig which was accidentally removed * tag 'arm-soc/for-5.6/defconfig-fixes' of https://github.com/Broadcom/stblinux: ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS Link: https://lore.kernel.org/r/20200302195043.14513-1-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit 14022b11d65700f35db9d85303dfb29149329e65 Merge: b6a79b417f54 146033562e7e Author: Olof Johansson Date: Mon Mar 2 10:15:11 2020 -0800 Merge tag 'amlogic-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into arm/fixes Amlogic fixes for v5.6-rc * tag 'amlogic-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic: arm64: dts: meson: fix gxm-khadas-vim2 wifi arm64: dts: meson-sm1-sei610: add missing interrupt-names ARM: meson: Drop unneeded select of COMMON_CLK Link: https://lore.kernel.org/r/7hr1yc9cc1.fsf@baylibre.com Signed-off-by: Olof Johansson commit 1bba60808404b873defa0f3560497eb2e8fe86b8 Author: Stefan Wahren Date: Sun Feb 23 14:02:56 2020 +0100 ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS The commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") accidentally dropped the DEBUG FS support in bcm2835_defconfig. So restore the config as before the commit. Reported-by: Marek Szyprowski Fixes: 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") Signed-off-by: Stefan Wahren Signed-off-by: Florian Fainelli commit 08090744f2dbba6b10d38fb17443c81f66798ca0 Author: Robin Murphy Date: Fri Feb 28 14:18:55 2020 +0000 iommu/io-pgtable-arm: Fix IOVA validation for 32-bit Since we ony support the TTB1 quirk for AArch64 contexts, and consequently only for 64-bit builds, the sign-extension aspect of the "are all bits above IAS consistent?" check should implicitly only apply to 64-bit IOVAs. Change the type of the cast to ensure that 32-bit longs don't inadvertently get sign-extended, and thus considered invalid, if they happen to be above 2GB in the TTB0 region. Reported-by: Stephan Gerhold Signed-off-by: Robin Murphy Acked-by: Acked-by: Will Deacon Fixes: db6903010aa5 ("iommu/io-pgtable-arm: Prepare for TTBR1 usage") Signed-off-by: Joerg Roedel commit 77a1bce84bba01f3f143d77127b72e872b573795 Author: Yonghyun Hwang Date: Wed Feb 26 12:30:06 2020 -0800 iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page intel_iommu_iova_to_phys() has a bug when it translates an IOVA for a huge page onto its corresponding physical address. This commit fixes the bug by accomodating the level of page entry for the IOVA and adds IOVA's lower address to the physical address. Cc: Acked-by: Lu Baolu Reviewed-by: Moritz Fischer Signed-off-by: Yonghyun Hwang Fixes: 3871794642579 ("VT-d: Changes to support KVM") Signed-off-by: Joerg Roedel commit aaca21007ba14005feca74a079888c49a9b6f6ac Author: Haiwei Li Date: Mon Mar 2 20:19:28 2020 +0800 KVM: SVM: Fix the svm vmexit code for WRMSR In svm, exit_code for MSR writes is not EXIT_REASON_MSR_WRITE which belongs to vmx. According to amd manual, SVM_EXIT_MSR(7ch) is the exit_code of VMEXIT_MSR due to RDMSR or WRMSR access to protected MSR. Additionally, the processor indicates in the VMCB's EXITINFO1 whether a RDMSR(EXITINFO1=0) or WRMSR(EXITINFO1=1) was intercepted. Signed-off-by: Haiwei Li Fixes: 1e9e2622a149 ("KVM: VMX: FIXED+PHYSICAL mode single target IPI fastpath", 2019-11-21) Signed-off-by: Paolo Bonzini commit 9a11997e757bcf716c1b199ea7bd1abbadc4b357 Author: Wanpeng Li Date: Mon Mar 2 15:15:36 2020 +0800 KVM: X86: Fix dereference null cpufreq policy Naresh Kamboju reported: Linux version 5.6.0-rc4 (oe-user@oe-host) (gcc version (GCC)) #1 SMP Sun Mar 1 22:59:08 UTC 2020 kvm: no hardware support BUG: kernel NULL pointer dereference, address: 000000000000028c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.6.0-rc4 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), 04/01/2014 RIP: 0010:kobject_put+0x12/0x1c0 Call Trace: cpufreq_cpu_put+0x15/0x20 kvm_arch_init+0x1f6/0x2b0 kvm_init+0x31/0x290 ? svm_check_processor_compat+0xd/0xd ? svm_check_processor_compat+0xd/0xd svm_init+0x21/0x23 do_one_initcall+0x61/0x2f0 ? rdinit_setup+0x30/0x30 ? rcu_read_lock_sched_held+0x4f/0x80 kernel_init_freeable+0x219/0x279 ? rest_init+0x250/0x250 kernel_init+0xe/0x110 ret_from_fork+0x27/0x50 Modules linked in: CR2: 000000000000028c ---[ end trace 239abf40c55c409b ]--- RIP: 0010:kobject_put+0x12/0x1c0 cpufreq policy which is get by cpufreq_cpu_get() can be NULL if it is failure, this patch takes care of it. Fixes: aaec7c03de (KVM: x86: avoid useless copy of cpufreq policy) Reported-by: Naresh Kamboju Cc: Naresh Kamboju Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 02d715b4a8182f4887d82df82a7b83aced647760 Author: Amol Grover Date: Sun Feb 23 22:25:39 2020 +0530 iommu/vt-d: Fix RCU list debugging warnings dmar_drhd_units is traversed using list_for_each_entry_rcu() outside of an RCU read side critical section but under the protection of dmar_global_lock. Hence add corresponding lockdep expression to silence the following false-positive warnings: [ 1.603975] ============================= [ 1.603976] WARNING: suspicious RCU usage [ 1.603977] 5.5.4-stable #17 Not tainted [ 1.603978] ----------------------------- [ 1.603980] drivers/iommu/intel-iommu.c:4769 RCU-list traversed in non-reader section!! [ 1.603869] ============================= [ 1.603870] WARNING: suspicious RCU usage [ 1.603872] 5.5.4-stable #17 Not tainted [ 1.603874] ----------------------------- [ 1.603875] drivers/iommu/dmar.c:293 RCU-list traversed in non-reader section!! Tested-by: Madhuparna Bhowmik Signed-off-by: Amol Grover Cc: stable@vger.kernel.org Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 2de7fb60a4740135e03cf55c1982e393ccb87b6b Author: Mike Gilbert Date: Wed Feb 26 14:33:59 2020 -0500 cpupower: avoid multiple definition with gcc -fno-common Building cpupower with -fno-common in CFLAGS results in errors due to multiple definitions of the 'cpu_count' and 'start_time' variables. ./utils/idle_monitor/snb_idle.o:./utils/idle_monitor/cpupower-monitor.h:28: multiple definition of `cpu_count'; ./utils/idle_monitor/nhm_idle.o:./utils/idle_monitor/cpupower-monitor.h:28: first defined here ... ./utils/idle_monitor/cpuidle_sysfs.o:./utils/idle_monitor/cpuidle_sysfs.c:22: multiple definition of `start_time'; ./utils/idle_monitor/amd_fam14h_idle.o:./utils/idle_monitor/amd_fam14h_idle.c:85: first defined here The -fno-common option will be enabled by default in GCC 10. Bug: https://bugs.gentoo.org/707462 Signed-off-by: Mike Gilbert Signed-off-by: Shuah Khan commit f3a60268f5cec7dae0e9713f5fc65aecc3734c09 Author: Christophe Leroy Date: Thu Feb 27 14:07:10 2020 +0000 selftest/lkdtm: Use local .gitignore Commit 68ca0fd272da ("selftest/lkdtm: Don't pollute 'git status'") introduced patterns for git to ignore files generated in tools/testing/selftests/lkdtm/ Use local .gitignore file instead of using the root one. Fixes: 68ca0fd272da ("selftest/lkdtm: Don't pollute 'git status'") Signed-off-by: Christophe Leroy Acked-by: Kees Cook Signed-off-by: Shuah Khan commit 817a68a6584aa08e323c64283fec5ded7be84759 Author: Dennis Dalessandro Date: Tue Feb 25 14:54:45 2020 -0500 IB/hfi1, qib: Ensure RCU is locked when accessing list The packet handling function, specifically the iteration of the qp list for mad packet processing misses locking RCU before running through the list. Not only is this incorrect, but the list_for_each_entry_rcu() call can not be called with a conditional check for lock dependency. Remedy this by invoking the rcu lock and unlock around the critical section. This brings MAD packet processing in line with what is done for non-MAD packets. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Link: https://lore.kernel.org/r/20200225195445.140896.41873.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 51bddd4501bc414b8b1e8f4d096b4a5304068169 Author: Christophe JAILLET Date: Fri Feb 28 22:38:38 2020 +0100 spi: bcm63xx-hsspi: Really keep pll clk enabled The purpose of commit 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled") was to keep the pll clk enabled through the lifetime of the device. In order to do that, some 'clk_prepare_enable()'/'clk_disable_unprepare()' calls have been added in the error handling path of the probe function, in the remove function and in the suspend and resume functions. However, a 'clk_disable_unprepare()' call has been unfortunately left in the probe function. So the commit seems to be more or less a no-op. Axe it now, so that the pll clk is left enabled through the lifetime of the device, as described in the commit. Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled") Signed-off-by: Christophe JAILLET Acked-by: Jonas Gorski Link: https://lore.kernel.org/r/20200228213838.7124-1-christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit 7125f204501ed55493593209c6c71ac7c38f6b6c Author: Arnaldo Carvalho de Melo Date: Mon Mar 2 11:55:47 2020 -0300 perf parse-events: Use asprintf() instead of strncpy() to read tracepoint files Make the code more compact by using asprintf() instead of malloc()+strncpy() which also uses less memory and avoids these warnings with gcc 10: CC /tmp/build/perf/util/cloexec.o In file included from /usr/include/string.h:495, from util/parse-events.h:12, from util/parse-events.c:18: In function ‘strncpy’, inlined from ‘tracepoint_id_to_path’ at util/parse-events.c:271:5: /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ offset [275, 511] from the object at ‘sys_dirent’ is out of the bounds of referenced subobject ‘d_name’ with type ‘char[256]’ at offset 19 [-Werror=array-bounds] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /usr/include/dirent.h:61, from util/parse-events.c:5: util/parse-events.c: In function ‘tracepoint_id_to_path’: /usr/include/bits/dirent.h:33:10: note: subobject ‘d_name’ declared here 33 | char d_name[256]; /* We must not include limits.h! */ | ^~~~~~ In file included from /usr/include/string.h:495, from util/parse-events.h:12, from util/parse-events.c:18: In function ‘strncpy’, inlined from ‘tracepoint_id_to_path’ at util/parse-events.c:273:5: /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ offset [275, 511] from the object at ‘evt_dirent’ is out of the bounds of referenced subobject ‘d_name’ with type ‘char[256]’ at offset 19 [-Werror=array-bounds] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /usr/include/dirent.h:61, from util/parse-events.c:5: util/parse-events.c: In function ‘tracepoint_id_to_path’: /usr/include/bits/dirent.h:33:10: note: subobject ‘d_name’ declared here 33 | char d_name[256]; /* We must not include limits.h! */ | ^~~~~~ CC /tmp/build/perf/util/call-path.o Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20200302145535.GA28183@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ebcb9464a2ae3a547e97de476575c82ece0e93e2 Author: Arnaldo Carvalho de Melo Date: Mon Mar 2 11:23:03 2020 -0300 perf env: Do not return pointers to local variables It is possible to return a pointer to a local variable when looking up the architecture name for the running system and no normalization is done on that value, i.e. we may end up returning the uts.machine local variable. While this doesn't happen on most arches, as normalization takes place, lets fix this by making that a static variable and optimize it a bit by not always running uname(), only the first time. Noticed in fedora rawhide running with: [perfbuilder@a5ff49d6e6e4 ~]$ gcc --version gcc (GCC) 10.0.1 20200216 (Red Hat 10.0.1-0.8) Reported-by: Jiri Olsa Cc: Adrian Hunter Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit fc04c39bae01a607454f7619665309870c60937a Author: Pavel Begunkov Date: Sun Mar 1 19:18:19 2020 +0300 io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation To cancel a work, io-wq sets IO_WQ_WORK_CANCEL and executes the callback. However, IO_WQ_WORK_NO_CANCEL works will just execute and may return next work, which will be ignored and lost. Cancel the whole link. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e959e5405f34aa92d71d0dd162b969c21742061d Author: Daniel Wagner Date: Mon Mar 2 14:24:08 2020 +0100 block: Remove used kblockd_schedule_work_on() Commit ee63cfa7fc19 ("block: add kblockd_schedule_work_on()") introduced the helper in 2016. Remove it because since then no caller was added. Cc: Jens Axboe Signed-off-by: Daniel Wagner Signed-off-by: Jens Axboe commit cff20b3151ccab690715cb6cf0f5da5cccb32adf Author: Arnaldo Carvalho de Melo Date: Mon Mar 2 11:13:19 2020 -0300 perf tests bp_account: Make global variable static To fix the build with newer gccs, that without this patch exit with: LD /tmp/build/perf/tests/perf-in.o ld: /tmp/build/perf/tests/bp_account.o:/git/perf/tools/perf/tests/bp_account.c:22: multiple definition of `the_var'; /tmp/build/perf/tests/bp_signal.o:/git/perf/tools/perf/tests/bp_signal.c:38: first defined here make[4]: *** [/git/perf/tools/build/Makefile.build:145: /tmp/build/perf/tests/perf-in.o] Error 1 First noticed in fedora:rawhide/32 with: [perfbuilder@a5ff49d6e6e4 ~]$ gcc --version gcc (GCC) 10.0.1 20200216 (Red Hat 10.0.1-0.8) Reported-by: Jiri Olsa Cc: Adrian Hunter Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit d237851d5d9dff5973160737197e825f05715ba3 Author: Jack Yu Date: Mon Mar 2 09:54:24 2020 +0800 ASoC: rt1015: add operation callback function for rt1015_dai[] Add operation callback function for rt1015_dai[]. Signed-off-by: Jack Yu Link: https://lore.kernel.org/r/20200302015424.9075-1-jack.yu@realtek.com Signed-off-by: Mark Brown commit 2873dc25477f483997c99981cf14b43a0d4f84d4 Merge: c105df5d865a bba42affa732 Author: Linus Torvalds Date: Mon Mar 2 06:54:54 2020 -0600 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: a pkeys fix for a bug that triggers with weird BIOS settings, and two Xen PV fixes: a paravirt interface fix, and pagetable dumping fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Fix dump_pagetables with Xen PV x86/ioperm: Add new paravirt function update_io_bitmap() x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes commit c105df5d865afbc10e9730b7b13abc831d5e9ac7 Merge: 852fb4a72822 289de3598481 Author: Linus Torvalds Date: Mon Mar 2 06:51:43 2020 -0600 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a scheduler statistics bug" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix statistics for find_idlest_group() commit 852fb4a72822b6c03bcf6cf1d51fb05b319d301e Merge: e130a920f693 7977fed974d6 Author: Linus Torvalds Date: Mon Mar 2 06:46:39 2020 -0600 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "No kernel side changes, all tooling fixes plus two tooling cleanups that were committed late in the merge window alongside the perf annotate fixes, delayed by Arnaldo's European trip" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) perf annotate: Fix segfault with source toggle perf annotate: Align struct annotate_args perf annotate: Simplify disasm_line allocation and freeing code perf annotate: Remove privsize from symbol__annotate() args perf probe: Check return value of strlist__add() for -ENOMEM perf config: Document missing config options perf annotate: Fix perf config option description perf annotate: Prefer cmdline option over default config perf annotate: Make perf config effective perf config: Introduce perf_config_u8() perf annotate: Fix --show-nr-samples for tui/stdio2 perf annotate: Fix --show-total-period for tui/stdio2 perf annotate/tui: Re-render title bar after switching back from script browser tools headers UAPI: Update tools's copy of kvm.h headers tools arch x86: Sync the msr-index.h copy with the kernel sources perf arch powerpc: Sync powerpc syscall.tbl with the kernel sources perf auxtrace: Add auxtrace_record__read_finish() perf arm-spe: Fix endless record after being terminated perf cs-etm: Fix endless record after being terminated perf intel-bts: Fix endless record after being terminated ... commit e130a920f69399777062f9fe7763abe895d386b0 Merge: 98d54f81e36b be36f9e7517e Author: Linus Torvalds Date: Mon Mar 2 06:41:41 2020 -0600 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Three fixes to EFI mixed boot mode, mostly related to x86-64 vmap stacks activated years ago, bug-fixed recently for EFI, which had knock-on effects of various 1:1 mapping assumptions in mixed mode. There's also a READ_ONCE() fix for reading an mmap-ed EFI firmware data field only once, out of caution" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: READ_ONCE rng seed size before munmap efi/x86: Handle by-ref arguments covering multiple pages in mixed mode efi/x86: Remove support for EFI time and counter services in mixed mode efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper commit 9abd515a6e4a5c58c6eb4d04110430325eb5f5ac Author: Jean-Philippe Brucker Date: Thu Feb 27 09:34:47 2020 +0100 arm64: context: Fix ASID limit in boot messages Since commit f88f42f853a8 ("arm64: context: Free up kernel ASIDs if KPTI is not in use"), the NUM_USER_ASIDS macro doesn't correspond to the effective number of ASIDs when KPTI is enabled. Get an accurate number of available ASIDs in an arch_initcall, once we've discovered all CPUs' capabilities and know if we still need to halve the ASID space for KPTI. Fixes: f88f42f853a8 ("arm64: context: Free up kernel ASIDs if KPTI is not in use") Reviewed-by: Vladimir Murzin Signed-off-by: Jean-Philippe Brucker Signed-off-by: Will Deacon commit 3ba52ad55b533760a1f65836aa0ec9d35e36bb4f Author: luanshi Date: Wed Feb 26 13:45:10 2020 +0800 drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer Fix bogus NULL checks on the return value of acpi_cpu_get_madt_gicc() by checking for a 0 'gicc->performance_interrupt' value instead. Signed-off-by: Liguang Zhang Signed-off-by: Will Deacon commit 049d919168458ac54e7fad27cd156a958b042d2f Author: Joakim Zhang Date: Tue Feb 25 20:56:43 2020 +0800 drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition When disabling a counter from ddr_perf_event_stop(), the counter value is reset to 0 at the same time. Preserve the counter value by performing a read-modify-write of the PMU register and clearing only the enable bit. Signed-off-by: Joakim Zhang Signed-off-by: Will Deacon commit f4aaa44e8b20f7e0d4ea68d3bca4968b6ae5aaff Author: Dan Carpenter Date: Fri Feb 28 17:14:13 2020 +0300 drm/i915/selftests: Fix return in assert_mmap_offset() The assert_mmap_offset() returns type bool so if we return an error pointer that is "return true;" or success. If we have an error, then we should return false. Fixes: 3d81d589d6e3 ("drm/i915: Test exhaustion of the mmap space") Signed-off-by: Dan Carpenter Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200228141413.qfjf4abr323drlo4@kili.mountain (cherry picked from commit efbf928824820f2738f41271934f6ec2c6ebd587) Signed-off-by: Jani Nikula commit 0b1570b7ffe68dfefa07cb092a0723f898bb8184 Author: Chris Wilson Date: Thu Feb 27 08:57:14 2020 +0000 drm/i915: Protect i915_request_await_start from early waits We need to be extremely careful inside i915_request_await_start() as it needs to walk the list of requests in the foreign timeline with very little protection. As we hold our own timeline mutex, we can not nest inside the signaler's timeline mutex, so all that remains is our RCU protection. However, to be safe we need to tell the compiler that we may be traversing the list only under RCU protection, and furthermore we need to start declaring requests as elements of the timeline from their construction. Fixes: 9ddc8ec027a3 ("drm/i915: Eliminate the trylock for awaiting an earlier request") Fixes: 6a79d848403d ("drm/i915: Lock signaler timeline while navigating") Signed-off-by: Chris Wilson Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200227085723.1961649-11-chris@chris-wilson.co.uk (cherry picked from commit d22d2d073ef859b346bc32cb25299262e3973769) Signed-off-by: Jani Nikula commit eddf309a8ed42eb3312b17a6934686b018189cd3 Author: Lucas De Marchi Date: Mon Feb 24 11:12:58 2020 -0800 drm/i915/tgl: Add Wa_1608008084 Wa_1608008084 is an additional WA that applies to writes on FF_MODE2 register. We can't read it back either from CPU or GPU. Since the other bits should be 0, recommendation to handle Wa_1604555607 is to actually just write the timer value. Do a write only and don't try to read it, neither before or after the WA is applied. Fixes: ff690b2111ba ("drm/i915/tgl: Implement Wa_1604555607") Signed-off-by: Lucas De Marchi Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20200224191258.15668-1-lucas.demarchi@intel.com (cherry picked from commit e94bda14325ccf1a519ffb516738d1201457f97f) Signed-off-by: Jani Nikula commit 4c116e1ae43955a0a38555dfd4d136a222a8996b Author: Matt Roper Date: Thu Feb 27 16:43:20 2020 -0800 drm/i915/tgl: Add Wa_22010178259:tgl We need to explicitly set the TLB Request Timer initial value in the BW_BUDDY registers to 0x8 rather than relying on the hardware default. v2: Apply missing REG_FIELD_PREP to ensure 0x8 is placed in the correct bits during the rmw. (Jose) Bspec: 52890 Bspec: 50044 Fixes: 3fa01d642fa7 ("drm/i915/tgl: Program BW_BUDDY registers during display init") Cc: Stanislav Lisovskiy Cc: José Roberto de Souza Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20200219215655.2923650-1-matthew.d.roper@intel.com Reviewed-by: José Roberto de Souza (cherry picked from commit 87e04f75928bb5d357ef7df4eedc1a7e2761a833) Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200228004320.127142-2-matthew.d.roper@intel.com commit c725161924f9a5872a3e53b73345a6026a5c170e Author: Matt Roper Date: Thu Feb 27 16:43:19 2020 -0800 drm/i915: Program MBUS with rmw during initialization It wasn't terribly clear from the bspec's wording, but after discussion with the hardware folks, it turns out that we need to preserve the pre-existing contents of the MBUS ABOX control register when initializing a few specific bits. Bspec: 49213 Bspec: 50096 Fixes: 4cb4585e5a7f ("drm/i915/icl: initialize MBus during display init") Cc: Stanislav Lisovskiy Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20200204011032.582737-1-matthew.d.roper@intel.com Reviewed-by: Matt Atwood (cherry picked from commit 837b63e6087838d0f1e612d448405419199d8033) Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200228004320.127142-1-matthew.d.roper@intel.com commit 33e059a2e4df454359f642f2235af39de9d3e914 Author: José Roberto de Souza Date: Thu Feb 27 12:55:40 2020 -0800 drm/i915/psr: Force PSR probe only after full initialization Commit 60c6a14b489b ("drm/i915/display: Force the state compute phase once to enable PSR") was forcing the state compute too earlier causing errors because not everything was initialized, so here moving to the end of i915_driver_modeset_probe() when the display is all initialized. Also fixing the place where it disarm the force probe as during the atomic check phase errors could happen like the ones due locking and it would cause PSR to never be enabled if that happens. Leaving the disarm to the atomic commit phase, intel_psr_enable() or intel_psr_update() will be called even if the current state do not allow PSR to be enabled. v2: Check if intel_dp is null in intel_psr_force_mode_changed_set() v3: Check intel_dp before get dev_priv v4: - renamed intel_psr_force_mode_changed_set() to intel_psr_set_force_mode_changed() - removed the set parameter from intel_psr_set_force_mode_changed() - not calling intel_psr_set_force_mode_changed() from intel_psr_enable/update(), directly setting it after the same checks that intel_psr_set_force_mode_changed() does - moved intel_psr_set_force_mode_changed() arm call to i915_driver_modeset_probe() as it is a better for a PSR call, all the functions calls happening between the old and the new function call will cause issue [backported to v5.6-rc3] Fixes: 60c6a14b489b ("drm/i915/display: Force the state compute phase once to enable PSR") Closes: https://gitlab.freedesktop.org/drm/intel/issues/1151 Tested-by: Ross Zwisler Reported-by: Ross Zwisler Cc: Gwan-gyeong Mun Cc: Jani Nikula Cc: Anshuman Gupta Reviewed-by: Gwan-gyeong Mun Signed-off-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20200221212635.11614-1-jose.souza@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20200227205540.126135-1-jose.souza@intel.com (cherry picked from commit df1a5bfc16f3275a74f77d73375e69bc62c45c4b) Signed-off-by: Jani Nikula commit bb699a793110fc29664e80c4ebb158a922151d52 Author: Chris Wilson Date: Fri Feb 21 10:09:53 2020 +0000 drm/i915/gem: Break up long lists of object reclaim Call cond_resched() between each freed object in case we have a really, really long list, and we don't want to block normal processes. Signed-off-by: Chris Wilson Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20200221100953.2587176-1-chris@chris-wilson.co.uk (cherry picked from commit deeee411a97559096523f97655ff16da34cf0573) Signed-off-by: Jani Nikula commit 852d7655ea4395a1deb7070abe37962a7d0662e4 Author: Gerd Hoffmann Date: Fri Feb 28 11:47:23 2020 +0100 drm/shmem: drop pgprot_decrypted() Was added by commit 95cf9264d5f3 ("x86, drm, fbdev: Do not specify encrypted memory for video mappings"), then it was kept through various changes. While vram actually needs decrypted mappings this is not correct for shmem gem objects which live in main memory not io memory, so remove the call. Signed-off-by: Gerd Hoffmann Reviewed-by: Thomas Hellstrom Link: http://patchwork.freedesktop.org/patch/msgid/20200228104723.18757-1-kraxel@redhat.com commit 3b6a9b19ab652efac7ad4c392add6f1235019568 Author: Marek Szyprowski Date: Thu Feb 20 13:57:26 2020 +0100 drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails Move enabling and disabling HDMI_EN optional regulator to probe() function to keep track on the regulator status. This fixes following warning if probe() fails (for example when I2C DDC adapter cannot be yet gathered due to the missing driver). This fixes following warning observed on Arndale5250 board with multi_v7_defconfig: [drm] Failed to get ddc i2c adapter by node ------------[ cut here ]------------ WARNING: CPU: 0 PID: 214 at drivers/regulator/core.c:2051 _regulator_put+0x16c/0x184 Modules linked in: ... CPU: 0 PID: 214 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219-00040-g38af1dfafdbb #7570 Hardware name: Samsung Exynos (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xcc/0xe0) [] (dump_stack) from [] (__warn+0xe0/0xf8) [] (__warn) from [] (warn_slowpath_fmt+0xb0/0xb8) [] (warn_slowpath_fmt) from [] (_regulator_put+0x16c/0x184) [] (_regulator_put) from [] (regulator_put+0x1c/0x2c) [] (regulator_put) from [] (release_nodes+0x17c/0x200) [] (release_nodes) from [] (really_probe+0x10c/0x350) [] (really_probe) from [] (driver_probe_device+0x60/0x1a0) [] (driver_probe_device) from [] (device_driver_attach+0x58/0x60) [] (device_driver_attach) from [] (__driver_attach+0x80/0xbc) [] (__driver_attach) from [] (bus_for_each_dev+0x68/0xb4) [] (bus_for_each_dev) from [] (bus_add_driver+0x130/0x1e8) [] (bus_add_driver) from [] (driver_register+0x78/0x110) [] (driver_register) from [] (exynos_drm_init+0xe8/0x11c [exynosdrm]) [] (exynos_drm_init [exynosdrm]) from [] (do_one_initcall+0x50/0x220) [] (do_one_initcall) from [] (do_init_module+0x60/0x210) [] (do_init_module) from [] (load_module+0x1c0c/0x2310) [] (load_module) from [] (sys_finit_module+0xac/0xbc) [] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x54) Exception stack(0xecca3fa8 to 0xecca3ff0) ... ---[ end trace 276c91214635905c ]--- Signed-off-by: Marek Szyprowski Reviewed-by: Andrzej Hajda Signed-off-by: Inki Dae commit c0fd99d659ba5582e09625c7a985d63fc2ca74b5 Author: Marek Szyprowski Date: Thu Feb 20 13:30:12 2020 +0100 drm/exynos: dsi: fix workaround for the legacy clock name Writing to the built-in strings arrays doesn't work if driver is loaded as kernel module. This is also considered as a bad pattern. Fix this by adding a call to clk_get() with legacy clock name. This fixes following kernel oops if driver is loaded as module: Unable to handle kernel paging request at virtual address bf047978 pgd = (ptrval) [bf047978] *pgd=59344811, *pte=5903c6df, *ppte=5903c65f Internal error: Oops: 80f [#1] SMP ARM Modules linked in: mc exynosdrm(+) analogix_dp rtc_s3c exynos_ppmu i2c_gpio CPU: 1 PID: 212 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219 #326 videodev: Linux video capture interface: v2.00 Hardware name: Samsung Exynos (Flattened Device Tree) PC is at exynos_dsi_probe+0x1f0/0x384 [exynosdrm] LR is at exynos_dsi_probe+0x1dc/0x384 [exynosdrm] ... Process systemd-udevd (pid: 212, stack limit = 0x(ptrval)) ... [] (exynos_dsi_probe [exynosdrm]) from [] (platform_drv_probe+0x6c/0xa4) [] (platform_drv_probe) from [] (really_probe+0x210/0x350) [] (really_probe) from [] (driver_probe_device+0x60/0x1a0) [] (driver_probe_device) from [] (device_driver_attach+0x58/0x60) [] (device_driver_attach) from [] (__driver_attach+0x80/0xbc) [] (__driver_attach) from [] (bus_for_each_dev+0x68/0xb4) [] (bus_for_each_dev) from [] (bus_add_driver+0x130/0x1e8) [] (bus_add_driver) from [] (driver_register+0x78/0x110) [] (driver_register) from [] (exynos_drm_init+0xe8/0x11c [exynosdrm]) [] (exynos_drm_init [exynosdrm]) from [] (do_one_initcall+0x50/0x220) [] (do_one_initcall) from [] (do_init_module+0x60/0x210) [] (do_init_module) from [] (load_module+0x1c0c/0x2310) [] (load_module) from [] (sys_finit_module+0xac/0xbc) [] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x54) Exception stack(0xd979bfa8 to 0xd979bff0) ... ---[ end trace db16efe05faab470 ]--- Signed-off-by: Marek Szyprowski Reviewed-by: Andrzej Hajda Signed-off-by: Inki Dae commit 0a9d1e3f3f038785ebc72d53f1c409d07f6b4ff5 Author: Marek Szyprowski Date: Thu Feb 27 08:06:37 2020 +0100 drm/exynos: dsi: propagate error value and silence meaningless warning Properly propagate error value from devm_regulator_bulk_get() and don't confuse user with meaningless warning about failure in getting regulators in case of deferred probe. Signed-off-by: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Inki Dae commit ab124d580ad40b0666d7892ceccd8c4ac1ce4c79 Merge: 249bc9744e16 22630e28f9c2 Author: David S. Miller Date: Sun Mar 1 19:15:27 2020 -0800 Merge branch 'bnxt_en-2-bug-fixes' Michael Chan says: ==================== bnxt_en: 2 bug fixes. This first patch fixes a rare but possible crash in pci_disable_msix() when the MTU is changed. The 2nd patch fixes a regression in error code handling when flashing a file to NVRAM. Please also queue these for -stable. Thanks. ==================== Signed-off-by: David S. Miller commit 22630e28f9c2b55abd217869cc0696def89f2284 Author: Edwin Peer Date: Sun Mar 1 22:07:18 2020 -0500 bnxt_en: fix error handling when flashing from file After bnxt_hwrm_do_send_message() was updated to return standard error codes in a recent commit, a regression in bnxt_flash_package_from_file() was introduced. The return value does not properly reflect all possible firmware errors when calling firmware to flash the package. Fix it by consolidating all errors in one local variable rc instead of having 2 variables for different errors. Fixes: d4f1420d3656 ("bnxt_en: Convert error code in firmware message response to standard code.") Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit a9b952d267e59a3b405e644930f46d252cea7122 Author: Vasundhara Volam Date: Sun Mar 1 22:07:17 2020 -0500 bnxt_en: reinitialize IRQs when MTU is modified MTU changes may affect the number of IRQs so we must call bnxt_close_nic()/bnxt_open_nic() with the irq_re_init parameter set to true. The reason is that a larger MTU may require aggregation rings not needed with smaller MTU. We may not be able to allocate the required number of aggregation rings and so we reduce the number of channels which will change the number of IRQs. Without this patch, it may crash eventually in pci_disable_msix() when the IRQs are not properly unwound. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 249bc9744e165abe74ae326f43e9d70bad54c3b7 Author: Heiner Kallweit Date: Sun Mar 1 21:36:09 2020 +0100 net: phy: avoid clearing PHY interrupts twice in irq handler On all PHY drivers that implement did_interrupt() reading the interrupt status bits clears them. This means we may loose an interrupt that is triggered between calling did_interrupt() and phy_clear_interrupt(). As part of the fix make it a requirement that did_interrupt() clears the interrupt. The Fixes tag refers to the first commit where the patch applies cleanly. Fixes: 49644e68f472 ("net: phy: add callback for custom interrupt handler to struct phy_driver") Reported-by: Michael Walle Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 98d54f81e36ba3bf92172791eba5ca5bd813989b Author: Linus Torvalds Date: Sun Mar 1 16:38:46 2020 -0600 Linux 5.6-rc4 commit e70869821a469029aeb056b4da96e5815cc5830e Merge: f853ed90e2e4 37b0b6b8b99c Author: Linus Torvalds Date: Sun Mar 1 16:35:08 2020 -0600 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Two more bug fixes (including a regression) for 5.6" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() jbd2: fix data races at struct journal_head commit f853ed90e2e49f4f6e585f995ffb25e093fe4df6 Merge: fb279f4e2386 86f7e90ce840 Author: Linus Torvalds Date: Sun Mar 1 15:16:35 2020 -0600 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "More bugfixes, including a few remaining "make W=1" issues such as too large frame sizes on some configurations. On the ARM side, the compiler was messing up shadow stacks between EL1 and EL2 code, which is easily fixed with __always_inline" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: VMX: check descriptor table exits on instruction emulation kvm: x86: Limit the number of "kvm: disabled by bios" messages KVM: x86: avoid useless copy of cpufreq policy KVM: allow disabling -Werror KVM: x86: allow compiling as non-module with W=1 KVM: Pre-allocate 1 cpumask variable per cpu for both pv tlb and pv ipis KVM: Introduce pv check helpers KVM: let declaration of kvm_get_running_vcpus match implementation KVM: SVM: allocate AVIC data structures based on kvm_amd module parameter arm64: Ask the compiler to __always_inline functions used by KVM at HYP KVM: arm64: Define our own swab32() to avoid a uapi static inline KVM: arm64: Ask the compiler to __always_inline functions used at HYP kvm: arm/arm64: Fold VHE entry/exit work into kvm_vcpu_run_vhe() KVM: arm/arm64: Fix up includes for trace.h commit 86f7e90ce840aa1db407d3ea6e9b3a52b2ce923c Author: Oliver Upton Date: Sat Feb 29 11:30:14 2020 -0800 KVM: VMX: check descriptor table exits on instruction emulation KVM emulates UMIP on hardware that doesn't support it by setting the 'descriptor table exiting' VM-execution control and performing instruction emulation. When running nested, this emulation is broken as KVM refuses to emulate L2 instructions by default. Correct this regression by allowing the emulation of descriptor table instructions if L1 hasn't requested 'descriptor table exiting'. Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Reported-by: Jan Kiszka Cc: stable@vger.kernel.org Cc: Paolo Bonzini Cc: Jim Mattson Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit 146033562e7e5d1c9aae9653986806664995f1d5 Author: Christian Hewitt Date: Thu Feb 20 19:33:10 2020 +0400 arm64: dts: meson: fix gxm-khadas-vim2 wifi before [6.418252] brcmfmac: F1 signature read @0x18000000=0x17224356 [6.435663] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2 [6.551259] brcmfmac: brcmf_sdiod_ramrw: membytes transfer failed [6.551275] brcmfmac: brcmf_sdio_verifymemory: error -84 on reading 2048 membytes at 0x00184000 [6.551352] brcmfmac: brcmf_sdio_download_firmware: dongle image file download failed after [6.657165] brcmfmac: F1 signature read @0x18000000=0x17224356 [6.660807] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2 [6.918643] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2 [6.918734] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [6.922724] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4356/2 wl0: Jun 16 2015 14:25:06 version 7.35.184.r1 (TOB) (r559293) FWID 01-b22ae69c Fixes: adc52bf7ef16 ("arm64: dts: meson: fix mmc v2 chips max frequencies") Suggested-by: Art Nikpal Signed-off-by: Christian Hewitt Signed-off-by: Kevin Hilman Link: https://lore.kernel.org/r/1582212790-11402-1-git-send-email-christianshewitt@gmail.com commit 52c0d4e306ca0261a896f5e2ad823112195b7f4b Author: Vladimir Oltean Date: Sat Feb 29 22:30:07 2020 +0200 net: dsa: sja1105: Don't destroy not-yet-created xmit_worker Fixes the following NULL pointer dereference on PHY connect error path teardown: [ 2.291010] sja1105 spi0.1: Probed switch chip: SJA1105T [ 2.310044] sja1105 spi0.1: Enabled switch tagging [ 2.314970] fsl-gianfar soc:ethernet@2d90000 eth2: error -19 setting up slave phy [ 2.322463] 8<--- cut here --- [ 2.325497] Unable to handle kernel NULL pointer dereference at virtual address 00000018 [ 2.333555] pgd = (ptrval) [ 2.336241] [00000018] *pgd=00000000 [ 2.339797] Internal error: Oops: 5 [#1] SMP ARM [ 2.344384] Modules linked in: [ 2.347420] CPU: 1 PID: 64 Comm: kworker/1:1 Not tainted 5.5.0-rc5 #1 [ 2.353820] Hardware name: Freescale LS1021A [ 2.358070] Workqueue: events deferred_probe_work_func [ 2.363182] PC is at kthread_destroy_worker+0x4/0x74 [ 2.368117] LR is at sja1105_teardown+0x70/0xb4 [ 2.372617] pc : [] lr : [] psr: 60000013 [ 2.378845] sp : eeac3d30 ip : eeab1900 fp : eef45480 [ 2.384036] r10: eef4549c r9 : 00000001 r8 : 00000000 [ 2.389227] r7 : eef527c0 r6 : 00000034 r5 : ed8ddd0c r4 : ed8ddc40 [ 2.395714] r3 : 00000000 r2 : 00000000 r1 : eef4549c r0 : 00000000 [ 2.402204] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 2.409297] Control: 10c5387d Table: 8020406a DAC: 00000051 [ 2.415008] Process kworker/1:1 (pid: 64, stack limit = 0x(ptrval)) [ 2.421237] Stack: (0xeeac3d30 to 0xeeac4000) [ 2.612635] [] (kthread_destroy_worker) from [] (sja1105_teardown+0x70/0xb4) [ 2.621379] [] (sja1105_teardown) from [] (dsa_switch_teardown.part.1+0x48/0x74) [ 2.630467] [] (dsa_switch_teardown.part.1) from [] (dsa_register_switch+0x8b0/0xbf4) [ 2.639984] [] (dsa_register_switch) from [] (sja1105_probe+0x2ac/0x464) [ 2.648378] [] (sja1105_probe) from [] (spi_drv_probe+0x7c/0xa0) [ 2.656081] [] (spi_drv_probe) from [] (really_probe+0x208/0x480) [ 2.663871] [] (really_probe) from [] (driver_probe_device+0x78/0x1c4) [ 2.672093] [] (driver_probe_device) from [] (bus_for_each_drv+0x80/0xc4) [ 2.680574] [] (bus_for_each_drv) from [] (__device_attach+0xd0/0x168) [ 2.688794] [] (__device_attach) from [] (bus_probe_device+0x84/0x8c) [ 2.696927] [] (bus_probe_device) from [] (deferred_probe_work_func+0x84/0xc4) [ 2.705842] [] (deferred_probe_work_func) from [] (process_one_work+0x22c/0x560) [ 2.714926] [] (process_one_work) from [] (worker_thread+0x2a8/0x5d4) [ 2.723059] [] (worker_thread) from [] (kthread+0x150/0x154) [ 2.730416] [] (kthread) from [] (ret_from_fork+0x14/0x2c) Checking for NULL pointer is correct because the per-port xmit kernel threads are created in sja1105_probe immediately after calling dsa_register_switch. Fixes: a68578c20a96 ("net: dsa: Make deferred_xmit private to sja1105") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 07758eb9ff52794fba15d03aa88d92dbd1b7d125 Author: Hangbin Liu Date: Sat Feb 29 17:27:13 2020 +0800 net/ipv6: use configured metric when add peer route When we add peer address with metric configured, IPv4 could set the dest metric correctly, but IPv6 do not. e.g. ]# ip addr add 192.0.2.1 peer 192.0.2.2/32 dev eth1 metric 20 ]# ip route show dev eth1 192.0.2.2 proto kernel scope link src 192.0.2.1 metric 20 ]# ip addr add 2001:db8::1 peer 2001:db8::2/128 dev eth1 metric 20 ]# ip -6 route show dev eth1 2001:db8::1 proto kernel metric 20 pref medium 2001:db8::2 proto kernel metric 256 pref medium Fix this by using configured metric instead of default one. Reported-by: Jianlin Shi Fixes: 8308f3ff1753 ("net/ipv6: Add support for specifying metric of connected routes") Reviewed-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 0395823b8d9a4d87bd1bf74359123461c2ae801b Author: Russell King Date: Fri Feb 28 19:39:41 2020 +0000 net: dsa: mv88e6xxx: fix lockup on warm boot If the switch is not hardware reset on a warm boot, interrupts can be left enabled, and possibly pending. This will cause us to enter an infinite loop trying to service an interrupt we are unable to handle, thereby preventing the kernel from booting. Ensure that the global 2 interrupt sources are disabled before we claim the parent interrupt. Observed on the ZII development revision B and C platforms with reworked serdes support, and using reboot -f to reboot the platform. Fixes: dc30c35be720 ("net: dsa: mv88e6xxx: Implement interrupt support.") Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 8a171c5cc9de7fb0a485341b790aba736978ed73 Author: Randy Dunlap Date: Thu Feb 27 18:09:44 2020 -0800 atm: nicstar: fix if-statement empty body warning When debugging via PRINTK() is not enabled, make the PRINTK() macro be an empty do-while block. Thix fixes a gcc warning when -Wextra is set: ../drivers/atm/nicstar.c:1819:23: warning: suggest braces around empty body in an ‘else’ statement [-Wempty-body] I have verified that there is no object code change (with gcc 7.5.0). Signed-off-by: Randy Dunlap Cc: Chas Williams <3chas3@gmail.com> Cc: linux-atm-general@lists.sourceforge.net Cc: netdev@vger.kernel.org Cc: David S. Miller Signed-off-by: David S. Miller commit 84b3268027641401bb8ad4427a90a3cce2eb86f5 Author: Pablo Neira Ayuso Date: Wed Feb 26 19:47:34 2020 +0100 netlink: Use netlink header as base to calculate bad attribute offset Userspace might send a batch that is composed of several netlink messages. The netlink_ack() function must use the pointer to the netlink header as base to calculate the bad attribute offset. Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit d64c7a08034b32c285e576208ae44fc3ba3fa7df Author: You-Sheng Yang Date: Wed Feb 26 23:37:10 2020 +0800 r8152: check disconnect status after long sleep Dell USB Type C docking WD19/WD19DC attaches additional peripherals as: /: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 5000M |__ Port 1: Dev 11, If 0, Class=Hub, Driver=hub/4p, 5000M |__ Port 3: Dev 12, If 0, Class=Hub, Driver=hub/4p, 5000M |__ Port 4: Dev 13, If 0, Class=Vendor Specific Class, Driver=r8152, 5000M where usb 2-1-3 is a hub connecting all USB Type-A/C ports on the dock. When hotplugging such dock with additional usb devices already attached on it, the probing process may reset usb 2.1 port, therefore r8152 ethernet device is also reset. However, during r8152 device init there are several for-loops that, when it's unable to retrieve hardware registers due to being disconnected from USB, may take up to 14 seconds each in practice, and that has to be completed before USB may re-enumerate devices on the bus. As a result, devices attached to the dock will only be available after nearly 1 minute after the dock was plugged in: [ 216.388290] [250] r8152 2-1.4:1.0: usb_probe_interface [ 216.388292] [250] r8152 2-1.4:1.0: usb_probe_interface - got id [ 258.830410] r8152 2-1.4:1.0 (unnamed net_device) (uninitialized): PHY not ready [ 258.830460] r8152 2-1.4:1.0 (unnamed net_device) (uninitialized): Invalid header when reading pass-thru MAC addr [ 258.830464] r8152 2-1.4:1.0 (unnamed net_device) (uninitialized): Get ether addr fail This happens in, for example, r8153_init: static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, void *data, u16 type) { if (test_bit(RTL8152_UNPLUG, &tp->flags)) return -ENODEV; ... } static u16 ocp_read_word(struct r8152 *tp, u16 type, u16 index) { u32 data; ... generic_ocp_read(tp, index, sizeof(tmp), &tmp, type | byen); data = __le32_to_cpu(tmp); ... return (u16)data; } static void r8153_init(struct r8152 *tp) { ... if (test_bit(RTL8152_UNPLUG, &tp->flags)) return; for (i = 0; i < 500; i++) { if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & AUTOLOAD_DONE) break; msleep(20); } ... } Since ocp_read_word() doesn't check the return status of generic_ocp_read(), and the only exit condition for the loop is to have a match in the returned value, such loops will only ends after exceeding its maximum runs when the device has been marked as disconnected, which takes 500 * 20ms = 10 seconds in theory, 14 in practice. To solve this long latency another test to RTL8152_UNPLUG flag should be added after those 20ms sleep to skip unnecessary loops, so that the device probe can complete early and proceed to parent port reset/reprobe process. This can be reproduced on all kernel versions up to latest v5.6-rc2, but after v5.5-rc7 the reproduce rate is dramatically lowered to 1/30 or less while it was around 1/2. Signed-off-by: You-Sheng Yang Signed-off-by: David S. Miller commit fb279f4e238617417b132a550f24c1e86d922558 Merge: 7557c1b3f715 38b17afb0ebb Author: Linus Torvalds Date: Sat Feb 29 19:16:46 2020 -0600 Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has three driver bugfixes for you. We agreed on the Mac regression to go in via I2C" * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: macintosh: therm_windtunnel: fix regression when instantiating devices i2c: altera: Fix potential integer overflow i2c: jz4780: silence log flood on txabrt commit 37b0b6b8b99c0e1c1f11abbe7cf49b6d03795b3f Author: Dan Carpenter Date: Fri Feb 28 12:22:56 2020 +0300 ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() If sbi->s_flex_groups_allocated is zero and the first allocation fails then this code will crash. The problem is that "i--" will set "i" to -1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1 is type promoted to unsigned and becomes UINT_MAX. Since UINT_MAX is more than zero, the condition is true so we call kvfree(new_groups[-1]). The loop will carry on freeing invalid memory until it crashes. Fixes: 7c990728b99e ("ext4: fix potential race between s_flex_groups online resizing and access") Reviewed-by: Suraj Jitindar Singh Signed-off-by: Dan Carpenter Cc: stable@kernel.org Link: https://lore.kernel.org/r/20200228092142.7irbc44yaz3by7nb@kili.mountain Signed-off-by: Theodore Ts'o commit 38b17afb0ebb9ecd41418d3c08bcf9198af4349d Author: Wolfram Sang Date: Tue Feb 25 15:12:29 2020 +0100 macintosh: therm_windtunnel: fix regression when instantiating devices Removing attach_adapter from this driver caused a regression for at least some machines. Those machines had the sensors described in their DT, too, so they didn't need manual creation of the sensor devices. The old code worked, though, because manual creation came first. Creation of DT devices then failed later and caused error logs, but the sensors worked nonetheless because of the manually created devices. When removing attach_adaper, manual creation now comes later and loses the race. The sensor devices were already registered via DT, yet with another binding, so the driver could not be bound to it. This fix refactors the code to remove the race and only manually creates devices if there are no DT nodes present. Also, the DT binding is updated to match both, the DT and manually created devices. Because we don't know which device creation will be used at runtime, the code to start the kthread is moved to do_probe() which will be called by both methods. Fixes: 3e7bed52719d ("macintosh: therm_windtunnel: drop using attach_adapter") Link: https://bugzilla.kernel.org/show_bug.cgi?id=201723 Reported-by: Erhard Furtner Tested-by: Erhard Furtner Acked-by: Michael Ellerman (powerpc) Signed-off-by: Wolfram Sang Cc: stable@kernel.org # v4.19+ commit b6a79b417f54ed2fe50bc7d62732afe58f01b931 Merge: 27ad6129a29e 94f18b9b24ee Author: Olof Johansson Date: Sat Feb 29 11:48:48 2020 -0800 Merge tag 'arm-soc/for-5.6/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 5.6, please pull the following: - Stefan adds missing Device Tree properties for the Raspberry Pi 3B and 4 LEDs to have proper default configuration - Nicolas adds an alias for the PCIe root complex node that is looked up by the Raspberry Pi firmware for patching in specific properties * tag 'arm-soc/for-5.6/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: bcm2711: Add pcie0 alias ARM: dts: bcm283x: Add missing properties to the PWR LED Link: https://lore.kernel.org/r/20200228181144.15148-2-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit 27ad6129a29e5f458fa843d4da393e9714aa46cb Merge: f9a15f39e50d 51c22d7b40dc Author: Olof Johansson Date: Sat Feb 29 11:47:43 2020 -0800 Merge tag 'omap-for-v5.6/fixes-rc3-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Few fixes for omaps for v5.6-rc cycle This series of changes contains few code fixes for issues recently discovered: - A build fix for ARMv6 only configs when CONFIG_HAVE_ARM_SMCCC is not set - A fix for ti-sysc quirk handling for 1-wire hdq reset And a handful of dts fixes that I had queued up and should have already sent earlier instead of waiting for the code fixes to get sorted out: - Fix naming of vsys_3v3 regulator for dra7-evm - Fix incorrect OPP node names for am437x-idk-evm - Fix IPU1 mux clock parent source for dra7 - Add missing PWM property for dra7 timers 13 to 16 - Add missing dma-ranges for dra7 PCIe nodes - Fix mmc3 max-frequency for dra76x * tag 'omap-for-v5.6/fixes-rc3-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: Fix compile if CONFIG_HAVE_ARM_SMCCC is not set arm: dts: dra76x: Fix mmc3 max-frequency ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes bus: ti-sysc: Fix 1-wire reset quirk ARM: dts: dra7-l4: mark timer13-16 as pwm capable ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source ARM: dts: am437x-idk-evm: Fix incorrect OPP node names ARM: dts: dra7-evm: Rename evm_3v3 regulator to vsys_3v3 Link: https://lore.kernel.org/r/pull-1582903541-589933@atomide.com Signed-off-by: Olof Johansson commit 6c5d911249290f41f7b50b43344a7520605b1acb Author: Qian Cai Date: Fri Feb 21 23:31:11 2020 -0500 jbd2: fix data races at struct journal_head journal_head::b_transaction and journal_head::b_next_transaction could be accessed concurrently as noticed by KCSAN, LTP: starting fsync04 /dev/zero: Can't open blockdev EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null) ================================================================== BUG: KCSAN: data-race in __jbd2_journal_refile_buffer [jbd2] / jbd2_write_access_granted [jbd2] write to 0xffff99f9b1bd0e30 of 8 bytes by task 25721 on cpu 70: __jbd2_journal_refile_buffer+0xdd/0x210 [jbd2] __jbd2_journal_refile_buffer at fs/jbd2/transaction.c:2569 jbd2_journal_commit_transaction+0x2d15/0x3f20 [jbd2] (inlined by) jbd2_journal_commit_transaction at fs/jbd2/commit.c:1034 kjournald2+0x13b/0x450 [jbd2] kthread+0x1cd/0x1f0 ret_from_fork+0x27/0x50 read to 0xffff99f9b1bd0e30 of 8 bytes by task 25724 on cpu 68: jbd2_write_access_granted+0x1b2/0x250 [jbd2] jbd2_write_access_granted at fs/jbd2/transaction.c:1155 jbd2_journal_get_write_access+0x2c/0x60 [jbd2] __ext4_journal_get_write_access+0x50/0x90 [ext4] ext4_mb_mark_diskspace_used+0x158/0x620 [ext4] ext4_mb_new_blocks+0x54f/0xca0 [ext4] ext4_ind_map_blocks+0xc79/0x1b40 [ext4] ext4_map_blocks+0x3b4/0x950 [ext4] _ext4_get_block+0xfc/0x270 [ext4] ext4_get_block+0x3b/0x50 [ext4] __block_write_begin_int+0x22e/0xae0 __block_write_begin+0x39/0x50 ext4_write_begin+0x388/0xb50 [ext4] generic_perform_write+0x15d/0x290 ext4_buffered_write_iter+0x11f/0x210 [ext4] ext4_file_write_iter+0xce/0x9e0 [ext4] new_sync_write+0x29c/0x3b0 __vfs_write+0x92/0xa0 vfs_write+0x103/0x260 ksys_write+0x9d/0x130 __x64_sys_write+0x4c/0x60 do_syscall_64+0x91/0xb05 entry_SYSCALL_64_after_hwframe+0x49/0xbe 5 locks held by fsync04/25724: #0: ffff99f9911093f8 (sb_writers#13){.+.+}, at: vfs_write+0x21c/0x260 #1: ffff99f9db4c0348 (&sb->s_type->i_mutex_key#15){+.+.}, at: ext4_buffered_write_iter+0x65/0x210 [ext4] #2: ffff99f5e7dfcf58 (jbd2_handle){++++}, at: start_this_handle+0x1c1/0x9d0 [jbd2] #3: ffff99f9db4c0168 (&ei->i_data_sem){++++}, at: ext4_map_blocks+0x176/0x950 [ext4] #4: ffffffff99086b40 (rcu_read_lock){....}, at: jbd2_write_access_granted+0x4e/0x250 [jbd2] irq event stamp: 1407125 hardirqs last enabled at (1407125): [] __find_get_block+0x107/0x790 hardirqs last disabled at (1407124): [] __find_get_block+0x49/0x790 softirqs last enabled at (1405528): [] __do_softirq+0x34c/0x57c softirqs last disabled at (1405521): [] irq_exit+0xa2/0xc0 Reported by Kernel Concurrency Sanitizer on: CPU: 68 PID: 25724 Comm: fsync04 Tainted: G L 5.6.0-rc2-next-20200221+ #7 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019 The plain reads are outside of jh->b_state_lock critical section which result in data races. Fix them by adding pairs of READ|WRITE_ONCE(). Reviewed-by: Jan Kara Signed-off-by: Qian Cai Link: https://lore.kernel.org/r/20200222043111.2227-1-cai@lca.pw Signed-off-by: Theodore Ts'o commit 5bea1336ed2c939328999c64de28792e8dc0699b Author: Guillaume La Roque Date: Fri Jan 17 14:34:23 2020 +0100 arm64: dts: meson-sm1-sei610: add missing interrupt-names add missing "host-wakeup interrupt names Fixes: 30388cc07572 ("arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt") Signed-off-by: Guillaume La Roque Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20200117133423.22602-1-glaroque@baylibre.com Signed-off-by: Kevin Hilman commit a469226d97e3354df6d013283b30f6e9936dc03d Author: Geert Uytterhoeven Date: Tue Jan 21 11:37:14 2020 +0100 ARM: meson: Drop unneeded select of COMMON_CLK Support for Amlogic Meson SoCs depends on ARCH_MULTI_V7, and thus on ARCH_MULTIPLATFORM. As the latter selects COMMON_CLK, there is no need for ARCH_MESON to select COMMON_CLK. Signed-off-by: Geert Uytterhoeven Cc: Kevin Hilman Cc: linux-amlogic@lists.infradead.org Acked-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20200121103722.1781-12-geert+renesas@glider.be Signed-off-by: Kevin Hilman commit 7557c1b3f715624f3bd4c809f03771ce9384eb7b Merge: 29795de0d242 03264ddde245 Author: Linus Torvalds Date: Sat Feb 29 09:58:47 2020 -0600 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes. Three are in drivers for fairly obvious bugs. The fourth is a set of regressions introduced by the compat_ioctl changes because some of the compat updates wrongly replaced .ioctl instead of .compat_ioctl" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: compat_ioctl: cdrom: Replace .ioctl with .compat_ioctl in four appropriate places scsi: zfcp: fix wrong data and display format of SFP+ temperature scsi: sd_sbc: Fix sd_zbc_report_zones() scsi: libfc: free response frame from GPN_ID commit bba42affa732d6fd5bd5c9678e6deacde2de1547 Author: Juergen Gross Date: Fri Feb 21 11:38:51 2020 +0100 x86/mm: Fix dump_pagetables with Xen PV Commit 2ae27137b2db89 ("x86: mm: convert dump_pagetables to use walk_page_range") broke Xen PV guests as the hypervisor reserved hole in the memory map was not taken into account. Fix that by starting the kernel range only at GUARD_HOLE_END_ADDR. Fixes: 2ae27137b2db89 ("x86: mm: convert dump_pagetables to use walk_page_range") Reported-by: Julien Grall Signed-off-by: Juergen Gross Signed-off-by: Thomas Gleixner Tested-by: Julien Grall Link: https://lkml.kernel.org/r/20200221103851.7855-1-jgross@suse.com commit 99bcd4a6e5b8ba201fdd252f1054689884899fee Author: Juergen Gross Date: Tue Feb 18 16:47:12 2020 +0100 x86/ioperm: Add new paravirt function update_io_bitmap() Commit 111e7b15cf10f6 ("x86/ioperm: Extend IOPL config to control ioperm() as well") reworked the iopl syscall to use I/O bitmaps. Unfortunately this broke Xen PV domains using that syscall as there is currently no I/O bitmap support in PV domains. Add I/O bitmap support via a new paravirt function update_io_bitmap which Xen PV domains can use to update their I/O bitmaps via a hypercall. Fixes: 111e7b15cf10f6 ("x86/ioperm: Extend IOPL config to control ioperm() as well") Reported-by: Jan Beulich Signed-off-by: Juergen Gross Signed-off-by: Thomas Gleixner Tested-by: Jan Beulich Reviewed-by: Jan Beulich Cc: # 5.5 Link: https://lkml.kernel.org/r/20200218154712.25490-1-jgross@suse.com commit 7977fed974d60a72733243cf54d7955cd6dccd91 Merge: 4c45945aa418 e0560ba6d92f Author: Ingo Molnar Date: Sat Feb 29 10:10:03 2020 +0100 Merge tag 'perf-urgent-for-mingo-5.6-20200228' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf annotate: Ravi Bangoria: - Fix segfault with source toggle. - Fix --show-total-period and --show-nr-samples for tui/stdio2. - Fix handling of settings in ~/.perfconfig versus the ones passed in the command line - Re-render title bar after switching back from script browser. - Fix options man page, document some missing ones. perf probe: He Zhe: - Check return value of strlist__add() for -ENOMEM. tools UAPI: Arnaldo Carvalho de Melo: - Sync x86's msr-index.h copy with the kernel sources. - Update tools's copy of x86's kvm.h headers. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 3567ee83c413a939d45fea2e2f2c4968a9f81460 Author: Charles Keepax Date: Fri Feb 28 15:42:14 2020 +0000 pinctrl: madera: Add missing call to pinctrl_unregister_mappings pinctrl_register_mappings is called in the pdata case, however a call to pinctrl_unregister_mappings is missing causing the mappings to be leaked on driver unbind. Add the missing call to correct this issue. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20200228154214.13916-1-ckeepax@opensource.cirrus.com Signed-off-by: Linus Walleij commit aafd56fc79041bf36f97712d4b35208cbe07db90 Author: Charles Keepax Date: Fri Feb 28 15:41:42 2020 +0000 pinctrl: core: Remove extra kref_get which blocks hogs being freed kref_init starts with the reference count at 1, which will be balanced by the pinctrl_put in pinctrl_unregister. The additional kref_get in pinctrl_claim_hogs will increase this count to 2 and cause the hogs to not get freed when pinctrl_unregister is called. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20200228154142.13860-1-ckeepax@opensource.cirrus.com Signed-off-by: Linus Walleij commit 51a21e0e7baf279fbd0b57f3e376f8762df8bb7d Author: Rob Herring Date: Fri Feb 21 16:27:10 2020 -0600 dt-bindings: Fix dtc warnings in examples Fix all the warnings in the DT binding schema examples when built with 'W=1'. This is in preparation to make that the default for examples. Reviewed-by: Linus Walleij Acked-by: Stephen Boyd Acked-by: Sam Ravnborg Acked-by: Vinod Koul Acked-by: Lee Jones Acked-by: Srinivas Kandagatla Acked-by: Mark Brown Acked-by: Bartosz Golaszewski Cc: Daniel Lezcano Cc: Kishon Vijay Abraham I Cc: Ulf Hansson Cc: Dmitry Torokhov Cc: Krzysztof Kozlowski Cc: Kukjin Kim Cc: Jonathan Cameron Cc: Thierry Reding Cc: Chen-Yu Tsai Cc: Maxime Ripard Cc: Alexandre Torgue Cc: Maxime Coquelin Signed-off-by: Rob Herring commit 29795de0d242a5ba45904b36a5fb67e38a304cb7 Merge: 2edc78b9a4b8 5901b51f3e5d Author: Linus Torvalds Date: Fri Feb 28 11:51:53 2020 -0800 Merge tag 'pci-v5.6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Fix build issue on 32-bit ARM with old compilers (Marek Szyprowski) - Update MAINTAINERS for recent Cadence driver file move (Lukas Bulwahn) * tag 'pci-v5.6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: MAINTAINERS: Correct Cadence PCI driver path PCI: brcmstb: Fix build on 32bit ARM platforms with older compilers commit 2edc78b9a4b868d7bfee4f87ea29f2df19b6e955 Merge: 74dea5d99d19 5b8ea58b6a33 Author: Linus Torvalds Date: Fri Feb 28 11:43:30 2020 -0800 Merge tag 'block-5.6-2020-02-28' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Passthrough insertion fix (Ming) - Kill off some unused arguments (John) - blktrace RCU fix (Jan) - Dead fields removal for null_blk (Dongli) - NVMe polled IO fix (Bijan) * tag 'block-5.6-2020-02-28' of git://git.kernel.dk/linux-block: nvme-pci: Hold cq_poll_lock while completing CQEs blk-mq: Remove some unused function arguments null_blk: remove unused fields in 'nullb_cmd' blktrace: Protect q->blk_trace with RCU blk-mq: insert passthrough request into hctx->dispatch directly commit 74dea5d99d19236608914d2c556134e4cdc21c60 Merge: c60c04021353 d87683620489 Author: Linus Torvalds Date: Fri Feb 28 11:39:14 2020 -0800 Merge tag 'io_uring-5.6-2020-02-28' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - Fix for a race with IOPOLL used with SQPOLL (Xiaoguang) - Only show ->fdinfo if procfs is enabled (Tobias) - Fix for a chain with multiple personalities in the SQEs - Fix for a missing free of personality idr on exit - Removal of the spin-for-work optimization - Fix for next work lookup on request completion - Fix for non-vec read/write result progation in case of links - Fix for a fileset references on switch - Fix for a recvmsg/sendmsg 32-bit compatability mode * tag 'io_uring-5.6-2020-02-28' of git://git.kernel.dk/linux-block: io_uring: fix 32-bit compatability with sendmsg/recvmsg io_uring: define and set show_fdinfo only if procfs is enabled io_uring: drop file set ref put/get on switch io_uring: import_single_range() returns 0/-ERROR io_uring: pick up link work on submit reference drop io-wq: ensure work->task_pid is cleared on init io-wq: remove spin-for-work optimization io_uring: fix poll_list race for SETUP_IOPOLL|SETUP_SQPOLL io_uring: fix personality idr leak io_uring: handle multiple personalities in link chains commit 8e093ea4d3593379be46b845b9e823179558047e Author: Tudor Ambarus Date: Fri Feb 28 15:55:32 2020 +0000 spi: atmel-quadspi: fix possible MMIO window size overrun The QSPI controller memory space is limited to 128MB: 0x9000_00000-0x9800_00000/0XD000_0000--0XD800_0000. There are nor flashes that are bigger in size than the memory size supported by the controller: Micron MT25QL02G (256 MB). Check if the address exceeds the MMIO window size. An improvement would be to add support for regular SPI mode and fall back to it when the flash memories overrun the controller's memory space. Fixes: 0e6aae08e9ae ("spi: Add QuadSPI driver for Atmel SAMA5D2") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20200228155437.1558219-1-tudor.ambarus@microchip.com Signed-off-by: Mark Brown commit f1861a7c58ba1ba43c7adff6909d9a920338e4a8 Author: Kuninori Morimoto Date: Fri Feb 28 10:48:35 2020 +0900 ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop() commit 1e5ddb6ba73894 ("ASoC: component: Add sync_stop PCM ops") added snd_soc_pcm_component_sync_stop(), but it is checking ioctrl instead of sync_stop. This is bug. This patch fixup it. Fixes: commit 1e5ddb6ba73894 ("ASoC: component: Add sync_stop PCM ops") Signed-off-by: Kuninori Morimoto Cc: Takashi Iwai Link: https://lore.kernel.org/r/8736av7a8c.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9b3193089e77d3b59b045146ff1c770dd899acb1 Author: Charles Keepax Date: Fri Feb 28 15:31:45 2020 +0000 ASoC: dapm: Correct DAPM handling of active widgets during shutdown commit c2caa4da46a4 ("ASoC: Fix widget powerdown on shutdown") added a set of the power state during snd_soc_dapm_shutdown to ensure the widgets powered off. However, when commit 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written") added the new_power member of the widget structure, to differentiate between the current power state and the target power state, it did not update the shutdown to use the new_power member. As new_power has not updated it will be left in the state set by the last DAPM sequence, ie. 1 for active widgets. So as the DAPM sequence for the shutdown proceeds it will turn the widgets on (despite them already being on) rather than turning them off. Fixes: 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written") Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20200228153145.21013-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 5b8ea58b6a338cb981670c4408225331aedb4b89 Merge: cae740a04b4d 9515743bfb39 Author: Jens Axboe Date: Fri Feb 28 10:02:36 2020 -0700 Merge branch 'nvme-5.6-rc4' of git://git.infradead.org/nvme into block-5.6 Pull NVMe fix from Keith. * 'nvme-5.6-rc4' of git://git.infradead.org/nvme: nvme-pci: Hold cq_poll_lock while completing CQEs commit c60c04021353c55b133519804734415f647f08bd Merge: 36428598126e cabe17d0173a Author: Linus Torvalds Date: Fri Feb 28 09:02:18 2020 -0800 Merge tag 'acpi-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Fix a couple of configuration issues in the ACPI watchdog (WDAT) driver (Mika Westerberg) and make it possible to disable that driver at boot time in case it still does not work as expected (Jean Delvare)" * tag 'acpi-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: watchdog: Set default timeout in probe ACPI: watchdog: Fix gas->access_width usage ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro ACPI: watchdog: Allow disabling WDAT at boot commit 36428598126ec20329537825ecd855ac77334301 Merge: bfeb4f997734 189c6967fe61 Author: Linus Torvalds Date: Fri Feb 28 08:49:52 2020 -0800 Merge tag 'pm-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Fix a recent cpufreq initialization regression (Rafael Wysocki), revert a devfreq commit that made incompatible changes and broke user land on some systems (Orson Zhai), drop a stale reference to a document that has gone away recently (Jonathan Neuschäfer), and fix a typo in a hibernation code comment (Alexandre Belloni)" * tag 'pm-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: Fix policy initialization for internal governor drivers Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" PM / hibernate: fix typo "reserverd_size" -> "reserved_size" Documentation: power: Drop reference to interface.rst commit bfeb4f9977348daaaf7283ff365d81f7ee95940a Merge: 45d0b75b98bf 0dda2ddb7ded Author: Linus Torvalds Date: Fri Feb 28 08:34:47 2020 -0800 Merge tag 'zonefs-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fixes from Damien Le Moal: "Two fixes in here: - Revert the initial decision to silently ignore IOCB_NOWAIT for asynchronous direct IOs to sequential zone files. Instead, return an error to the user to signal that the feature is not supported (from Christoph) - A fix to zonefs Kconfig to select FS_IOMAP to avoid build failures if no other file system already selected this option (from Johannes)" * tag 'zonefs-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: select FS_IOMAP zonefs: fix IOCB_NOWAIT handling commit 801b67f3eaafd3f2ec8b65d93142d4ffedba85df Author: Maor Gottlieb Date: Thu Feb 27 14:57:28 2020 +0200 RDMA/core: Fix pkey and port assignment in get_new_pps When port is part of the modify mask, then we should take it from the qp_attr and not from the old pps. Same for PKEY. Otherwise there are panics in some configurations: RIP: 0010:get_pkey_idx_qp_list+0x50/0x80 [ib_core] Code: c7 18 e8 13 04 30 ef 0f b6 43 06 48 69 c0 b8 00 00 00 48 03 85 a0 04 00 00 48 8b 50 20 48 8d 48 20 48 39 ca 74 1a 0f b7 73 04 <66> 39 72 10 75 08 eb 10 66 39 72 10 74 0a 48 8b 12 48 39 ca 75 f2 RSP: 0018:ffffafb3480932f0 EFLAGS: 00010203 RAX: ffff98059ababa10 RBX: ffff980d926e8cc0 RCX: ffff98059ababa30 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff98059ababa28 RBP: ffff98059b940000 R08: 00000000000310c0 R09: ffff97fe47c07480 R10: 0000000000000036 R11: 0000000000000200 R12: 0000000000000071 R13: ffff98059b940000 R14: ffff980d87f948a0 R15: 0000000000000000 FS: 00007f88deb31740(0000) GS:ffff98059f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000853e26001 CR4: 00000000001606e0 Call Trace: port_pkey_list_insert+0x3d/0x1b0 [ib_core] ? kmem_cache_alloc_trace+0x215/0x220 ib_security_modify_qp+0x226/0x3a0 [ib_core] _ib_modify_qp+0xcf/0x390 [ib_core] ipoib_init_qp+0x7f/0x200 [ib_ipoib] ? rvt_modify_port+0xd0/0xd0 [rdmavt] ? ib_find_pkey+0x99/0xf0 [ib_core] ipoib_ib_dev_open_default+0x1a/0x200 [ib_ipoib] ipoib_ib_dev_open+0x96/0x130 [ib_ipoib] ipoib_open+0x44/0x130 [ib_ipoib] __dev_open+0xd1/0x160 __dev_change_flags+0x1ab/0x1f0 dev_change_flags+0x23/0x60 do_setlink+0x328/0xe30 ? __nla_validate_parse+0x54/0x900 __rtnl_newlink+0x54e/0x810 ? __alloc_pages_nodemask+0x17d/0x320 ? page_fault+0x30/0x50 ? _cond_resched+0x15/0x30 ? kmem_cache_alloc_trace+0x1c8/0x220 rtnl_newlink+0x43/0x60 rtnetlink_rcv_msg+0x28f/0x350 ? kmem_cache_alloc+0x1fb/0x200 ? _cond_resched+0x15/0x30 ? __kmalloc_node_track_caller+0x24d/0x2d0 ? rtnl_calcit.isra.31+0x120/0x120 netlink_rcv_skb+0xcb/0x100 netlink_unicast+0x1e0/0x340 netlink_sendmsg+0x317/0x480 ? __check_object_size+0x48/0x1d0 sock_sendmsg+0x65/0x80 ____sys_sendmsg+0x223/0x260 ? copy_msghdr_from_user+0xdc/0x140 ___sys_sendmsg+0x7c/0xc0 ? skb_dequeue+0x57/0x70 ? __inode_wait_for_writeback+0x75/0xe0 ? fsnotify_grab_connector+0x45/0x80 ? __dentry_kill+0x12c/0x180 __sys_sendmsg+0x58/0xa0 do_syscall_64+0x5b/0x200 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f88de467f10 Link: https://lore.kernel.org/r/20200227125728.100551-1-leon@kernel.org Cc: Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Tested-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 Author: Jiri Slaby Date: Fri Feb 28 12:54:06 2020 +0100 vt: selection, push sel_lock up sel_lock cannot nest in the console lock. Thanks to syzkaller, the kernel states firmly: > WARNING: possible circular locking dependency detected > 5.6.0-rc3-syzkaller #0 Not tainted > ------------------------------------------------------ > syz-executor.4/20336 is trying to acquire lock: > ffff8880a2e952a0 (&tty->termios_rwsem){++++}, at: tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136 > > but task is already holding lock: > ffffffff89462e70 (sel_lock){+.+.}, at: paste_selection+0x118/0x470 drivers/tty/vt/selection.c:374 > > which lock already depends on the new lock. > > the existing dependency chain (in reverse order) is: > > -> #2 (sel_lock){+.+.}: > mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:1118 > set_selection_kernel+0x3b8/0x18a0 drivers/tty/vt/selection.c:217 > set_selection_user+0x63/0x80 drivers/tty/vt/selection.c:181 > tioclinux+0x103/0x530 drivers/tty/vt/vt.c:3050 > vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364 This is ioctl(TIOCL_SETSEL). Locks held on the path: console_lock -> sel_lock > -> #1 (console_lock){+.+.}: > console_lock+0x46/0x70 kernel/printk/printk.c:2289 > con_flush_chars+0x50/0x650 drivers/tty/vt/vt.c:3223 > n_tty_write+0xeae/0x1200 drivers/tty/n_tty.c:2350 > do_tty_write drivers/tty/tty_io.c:962 [inline] > tty_write+0x5a1/0x950 drivers/tty/tty_io.c:1046 This is write(). Locks held on the path: termios_rwsem -> console_lock > -> #0 (&tty->termios_rwsem){++++}: > down_write+0x57/0x140 kernel/locking/rwsem.c:1534 > tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136 > mkiss_receive_buf+0x12aa/0x1340 drivers/net/hamradio/mkiss.c:902 > tty_ldisc_receive_buf+0x12f/0x170 drivers/tty/tty_buffer.c:465 > paste_selection+0x346/0x470 drivers/tty/vt/selection.c:389 > tioclinux+0x121/0x530 drivers/tty/vt/vt.c:3055 > vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364 This is ioctl(TIOCL_PASTESEL). Locks held on the path: sel_lock -> termios_rwsem > other info that might help us debug this: > > Chain exists of: > &tty->termios_rwsem --> console_lock --> sel_lock Clearly. From the above, we have: console_lock -> sel_lock sel_lock -> termios_rwsem termios_rwsem -> console_lock Fix this by reversing the console_lock -> sel_lock dependency in ioctl(TIOCL_SETSEL). First, lock sel_lock, then console_lock. Signed-off-by: Jiri Slaby Reported-by: syzbot+26183d9746e62da329b8@syzkaller.appspotmail.com Fixes: 07e6124a1a46 ("vt: selection, close sel_buffer race") Cc: stable Link: https://lore.kernel.org/r/20200228115406.5735-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 4b70dd57a15d2f4685ac6e38056bad93e81e982f Author: Jiri Slaby Date: Fri Feb 28 12:54:05 2020 +0100 vt: selection, push console lock down We need to nest the console lock in sel_lock, so we have to push it down a bit. Fortunately, the callers of set_selection_* just lock the console lock around the function call. So moving it down is easy. In the next patch, we switch the order. Signed-off-by: Jiri Slaby Fixes: 07e6124a1a46 ("vt: selection, close sel_buffer race") Cc: stable Link: https://lore.kernel.org/r/20200228115406.5735-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 186e28a18aeb0fec99cc586fda337e6b23190791 Author: Christophe Leroy Date: Fri Feb 28 00:00:08 2020 +0000 selftests: pidfd: Add pidfd_fdinfo_test in .gitignore The commit identified below added pidfd_fdinfo_test but failed to add it to .gitignore Fixes: 2def297ec7fb ("pidfd: add tests for NSpid info in fdinfo") Signed-off-by: Christophe Leroy Acked-by: Christian Brauner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/966567c7dbaa26a06730d796354f8a086c0ee288.1582847778.git.christophe.leroy@c-s.fr Signed-off-by: Christian Brauner commit 22a34c6fe0ffc1d92ee26a25913fadf347258fd6 Author: Madhuparna Bhowmik Date: Thu Jan 30 11:50:28 2020 +0530 exit: Fix Sparse errors and warnings This patch fixes the following sparse error: kernel/exit.c:627:25: error: incompatible types in comparison expression And the following warning: kernel/exit.c:626:40: warning: incorrect type in assignment Signed-off-by: Madhuparna Bhowmik Acked-by: Oleg Nesterov Acked-by: Christian Brauner [christian.brauner@ubuntu.com: edit commit message] Link: https://lore.kernel.org/r/20200130062028.4870-1-madhuparnabhowmik10@gmail.com Signed-off-by: Christian Brauner commit 0c282b068eb26db0e85e2ab4ec6d1e932acda841 Author: Madhuparna Bhowmik Date: Mon Jan 27 23:28:21 2020 +0530 fork: Use RCU_INIT_POINTER() instead of rcu_access_pointer() Use RCU_INIT_POINTER() instead of rcu_access_pointer() in copy_sighand(). Suggested-by: Oleg Nesterov Signed-off-by: Madhuparna Bhowmik Acked-by: Oleg Nesterov Acked-by: Christian Brauner [christian.brauner@ubuntu.com: edit commit message] Link: https://lore.kernel.org/r/20200127175821.10833-1-madhuparnabhowmik10@gmail.com Signed-off-by: Christian Brauner commit e951445f4d3b5d0df69c0c5d18ab1e9058c20e52 Merge: ef935c25fd64 e43f1331e2ef Author: Paolo Bonzini Date: Fri Feb 28 11:46:59 2020 +0100 Merge tag 'kvmarm-fixes-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm fixes for 5.6, take #1 - Fix compilation on 32bit - Move VHE guest entry/exit into the VHE-specific entry code - Make sure all functions called by the non-VHE HYP code is tagged as __always_inline commit ef935c25fd648a17c27af5d1738b1884f78c5b75 Author: Erwan Velu Date: Thu Feb 27 19:00:46 2020 +0100 kvm: x86: Limit the number of "kvm: disabled by bios" messages In older version of systemd(219), at boot time, udevadm is called with : /usr/bin/udevadm trigger --type=devices --action=add" This program generates an echo "add" in /sys/devices/system/cpu/cpu/uevent, leading to the "kvm: disabled by bios" message in case of your Bios disabled the virtualization extensions. On a modern system running up to 256 CPU threads, this pollutes the Kernel logs. This patch offers to ratelimit this message to avoid any userspace program triggering this uevent printing this message too often. This patch is only a workaround but greatly reduce the pollution without breaking the current behavior of printing a message if some try to instantiate KVM on a system that doesn't support it. Note that recent versions of systemd (>239) do not have trigger this behavior. This patch will be useful at least for some using older systemd with recent Kernels. Signed-off-by: Erwan Velu Signed-off-by: Paolo Bonzini commit 189c6967fe61729fa7e9cdc32690b08fc7eebe41 Merge: f5739cb0b565 b0c609ab2057 1df97a02a937 Author: Rafael J. Wysocki Date: Fri Feb 28 11:00:50 2020 +0100 Merge branches 'pm-sleep' and 'pm-devfreq' * pm-sleep: PM / hibernate: fix typo "reserverd_size" -> "reserved_size" Documentation: power: Drop reference to interface.rst * pm-devfreq: Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" commit aaec7c03de92c35a96966631989950e6e27662db Author: Paolo Bonzini Date: Fri Feb 28 10:49:10 2020 +0100 KVM: x86: avoid useless copy of cpufreq policy struct cpufreq_policy is quite big and it is not a good idea to allocate one on the stack. Just use cpufreq_cpu_get and cpufreq_cpu_put which is even simpler. Reported-by: Christoph Hellwig Signed-off-by: Paolo Bonzini commit 4f337faf1c55e55bdc49df13fcb3a3c45655899e Author: Paolo Bonzini Date: Fri Feb 28 10:42:31 2020 +0100 KVM: allow disabling -Werror Restrict -Werror to well-tested configurations and allow disabling it via Kconfig. Reported-by: Christoph Hellwig Signed-off-by: Paolo Bonzini commit 575b255c1663c8fccc41fe965dcac281e3113c65 Author: Valdis Kletnieks Date: Thu Feb 27 21:49:52 2020 -0500 KVM: x86: allow compiling as non-module with W=1 Compile error with CONFIG_KVM_INTEL=y and W=1: CC arch/x86/kvm/vmx/vmx.o arch/x86/kvm/vmx/vmx.c:68:32: error: 'vmx_cpu_id' defined but not used [-Werror=unused-const-variable=] 68 | static const struct x86_cpu_id vmx_cpu_id[] = { | ^~~~~~~~~~ cc1: all warnings being treated as errors When building with =y, the MODULE_DEVICE_TABLE macro doesn't generate a reference to the structure (or any code at all). This makes W=1 compiles unhappy. Wrap both in a #ifdef to avoid the issue. Signed-off-by: Valdis Kletnieks [Do the same for CONFIG_KVM_AMD. - Paolo] Signed-off-by: Paolo Bonzini commit 8a9442f49c72bde43f982e53b74526ac37d3565b Author: Wanpeng Li Date: Tue Feb 18 09:08:24 2020 +0800 KVM: Pre-allocate 1 cpumask variable per cpu for both pv tlb and pv ipis Nick Desaulniers Reported: When building with: $ make CC=clang arch/x86/ CFLAGS=-Wframe-larger-than=1000 The following warning is observed: arch/x86/kernel/kvm.c:494:13: warning: stack frame size of 1064 bytes in function 'kvm_send_ipi_mask_allbutself' [-Wframe-larger-than=] static void kvm_send_ipi_mask_allbutself(const struct cpumask *mask, int vector) ^ Debugging with: https://github.com/ClangBuiltLinux/frame-larger-than via: $ python3 frame_larger_than.py arch/x86/kernel/kvm.o \ kvm_send_ipi_mask_allbutself points to the stack allocated `struct cpumask newmask` in `kvm_send_ipi_mask_allbutself`. The size of a `struct cpumask` is potentially large, as it's CONFIG_NR_CPUS divided by BITS_PER_LONG for the target architecture. CONFIG_NR_CPUS for X86_64 can be as high as 8192, making a single instance of a `struct cpumask` 1024 B. This patch fixes it by pre-allocate 1 cpumask variable per cpu and use it for both pv tlb and pv ipis.. Reported-by: Nick Desaulniers Acked-by: Nick Desaulniers Reviewed-by: Vitaly Kuznetsov Cc: Peter Zijlstra Cc: Nick Desaulniers Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit a262bca3aba03f0696995beb223c610e47533db3 Author: Wanpeng Li Date: Tue Feb 18 09:08:23 2020 +0800 KVM: Introduce pv check helpers Introduce some pv check helpers for consistency. Suggested-by: Vitaly Kuznetsov Reviewed-by: Konrad Rzeszutek Wilk Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit fcd07f9adc7dacc2532695cf9dd2284d49e716ff Author: Christian Borntraeger Date: Fri Feb 28 09:49:41 2020 +0100 KVM: let declaration of kvm_get_running_vcpus match implementation Sparse notices that declaration and implementation do not match: arch/s390/kvm/../../../virt/kvm/kvm_main.c:4435:17: warning: incorrect type in return expression (different address spaces) arch/s390/kvm/../../../virt/kvm/kvm_main.c:4435:17: expected struct kvm_vcpu [noderef] ** arch/s390/kvm/../../../virt/kvm/kvm_main.c:4435:17: got struct kvm_vcpu *[noderef] * Signed-off-by: Christian Borntraeger Signed-off-by: Paolo Bonzini commit 7943f4acea3caf0b6d5b6cdfce7d5a2b4a9aa608 Author: Paolo Bonzini Date: Tue Feb 25 08:54:26 2020 +0100 KVM: SVM: allocate AVIC data structures based on kvm_amd module parameter Even if APICv is disabled at startup, the backing page and ir_list need to be initialized in case they are needed later. The only case in which this can be skipped is for userspace irqchip, and that must be done because avic_init_backing_page dereferences vcpu->arch.apic (which is NULL for userspace irqchip). Tested-by: rmuncrief@humanavance.com Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=206579 Reviewed-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 45d0b75b98bf1de4b3a5b09188c75f3bfa3152b0 Merge: 7058b837899f f091bf39700d Author: Linus Torvalds Date: Thu Feb 27 21:52:18 2020 -0800 Merge tag 'drm-fixes-2020-02-28' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Just some fixes for this week: amdgpu, radeon and i915. The main i915 one is a regression Gen7 (Ivybridge/Haswell), this moves them back from trying to use the full-ppgtt support to the aliasing version it used to use due to gpu hangs. Otherwise it's pretty quiet. amdgpu: - Drop DRIVER_USE_AGP - Fix memory leak in GPU reset - Resume fix for raven radeon: - Drop DRIVER_USE_AGP i915: - downgrade gen7 back to aliasing-ppgtt to avoid GPU hangs - shrinker fix - pmu leak and double free fixes - gvt user after free and virtual display reset fixes - randconfig build fix" * tag 'drm-fixes-2020-02-28' of git://anongit.freedesktop.org/drm/drm: drm/radeon: Inline drm_get_pci_dev drm/amdgpu: Drop DRIVER_USE_AGP drm/i915: Avoid recursing onto active vma from the shrinker drm/i915/pmu: Avoid using globals for PMU events drm/i915/pmu: Avoid using globals for CPU hotplug state drm/i915/gtt: Downgrade gen7 (ivb, byt, hsw) back to aliasing-ppgtt drm/i915: fix header test with GCOV amdgpu/gmc_v9: save/restore sdpif regs during S3 drm/amdgpu: fix memory leak during TDR test(v2) drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime drm/i915/gvt: Separate display reset from ALL_ENGINES reset commit f091bf39700dd086ab244c823f389556fed0c513 Merge: e180af1970d5 8e9a400c706e Author: Dave Airlie Date: Fri Feb 28 12:40:41 2020 +1000 Merge tag 'drm-intel-fixes-2020-02-27' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.6-rc4: - downgrade gen7 back to aliasing-ppgtt to avoid GPU hangs - shrinker fix - pmu leak and double free fixes - gvt user after free and virtual display reset fixes - randconfig build fix Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/874kvcsh00.fsf@intel.com commit e180af1970d535f9d19309e91b0cd4379248b19f Merge: f8788d86ab28 eb12c957735b Author: Dave Airlie Date: Fri Feb 28 12:30:18 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-02-26' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-02-26: amdgpu: - Drop DRIVER_USE_AGP - Fix memory leak in GPU reset - Resume fix for raven radeon: - Drop DRIVER_USE_AGP Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200227034106.3912-1-alexander.deucher@amd.com commit 7058b837899fc978c9f8a033fa29ab07360a85c8 Merge: a2f0b878c3ca 3ee339eb2895 Author: Linus Torvalds Date: Thu Feb 27 16:34:41 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix leak in nl80211 AP start where we leak the ACL memory, from Johannes Berg. 2) Fix double mutex unlock in mac80211, from Andrei Otcheretianski. 3) Fix RCU stall in ipset, from Jozsef Kadlecsik. 4) Fix devlink locking in devlink_dpipe_table_register, from Madhuparna Bhowmik. 5) Fix race causing TX hang in ll_temac, from Esben Haabendal. 6) Stale eth hdr pointer in br_dev_xmit(), from Nikolay Aleksandrov. 7) Fix TX hash calculation bounds checking wrt. tc rules, from Amritha Nambiar. 8) Size netlink responses properly in schedule action code to take into consideration TCA_ACT_FLAGS. From Jiri Pirko. 9) Fix firmware paths for mscc PHY driver, from Antoine Tenart. 10) Don't register stmmac notifier multiple times, from Aaro Koskinen. 11) Various rmnet bug fixes, from Taehee Yoo. 12) Fix vsock deadlock in vsock transport release, from Stefano Garzarella. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (61 commits) net: dsa: mv88e6xxx: Fix masking of egress port mlxsw: pci: Wait longer before accessing the device after reset sfc: fix timestamp reconstruction at 16-bit rollover points vsock: fix potential deadlock in transport->release() unix: It's CONFIG_PROC_FS not CONFIG_PROCFS net: rmnet: fix packet forwarding in rmnet bridge mode net: rmnet: fix bridge mode bugs net: rmnet: use upper/lower device infrastructure net: rmnet: do not allow to change mux id if mux id is duplicated net: rmnet: remove rcu_read_lock in rmnet_force_unassociate_device() net: rmnet: fix suspicious RCU usage net: rmnet: fix NULL pointer dereference in rmnet_changelink() net: rmnet: fix NULL pointer dereference in rmnet_newlink() net: phy: marvell: don't interpret PHY status unless resolved mlx5: register lag notifier for init network namespace only unix: define and set show_fdinfo only if procfs is enabled hinic: fix a bug of rss configuration hinic: fix a bug of setting hw_ioctxt hinic: fix a irq affinity bug net/smc: check for valid ib_client_data ... commit fc37a1632d40c80c067eb1bc235139f5867a2667 Author: Desnes A. Nunes do Rosario Date: Thu Feb 27 10:47:15 2020 -0300 powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems PowerVM systems running compatibility mode on a few Power8 revisions are still vulnerable to the hardware defect that loses PMU exceptions arriving prior to a context switch. The software fix for this issue is enabled through the CPU_FTR_PMAO_BUG cpu_feature bit, nevertheless this bit also needs to be set for PowerVM compatibility mode systems. Fixes: 68f2f0d431d9ea4 ("powerpc: Add a cpu feature CPU_FTR_PMAO_BUG") Signed-off-by: Desnes A. Nunes do Rosario Reviewed-by: Leonardo Bras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200227134715.9715-1-desnesn@linux.ibm.com commit 5901b51f3e5d9129da3e59b10cc76e4cc983e940 Author: Lukas Bulwahn Date: Fri Feb 21 19:54:02 2020 +0100 MAINTAINERS: Correct Cadence PCI driver path de80f95ccb9c ("PCI: cadence: Move all files to per-device cadence directory") moved files of the PCI cadence drivers, but did not update the MAINTAINERS entry. Since then, ./scripts/get_maintainer.pl --self-test complains: warning: no file matches F: drivers/pci/controller/pcie-cadence* Repair the MAINTAINERS entry. Link: https://lore.kernel.org/r/20200221185402.4703-1-lukas.bulwahn@gmail.com Signed-off-by: Lukas Bulwahn Signed-off-by: Bjorn Helgaas commit ee63634bae02e13c8c0df1209a6a0ca5326f3189 Author: Shin'ichiro Kawasaki Date: Thu Feb 27 09:18:52 2020 +0900 dm zoned: Fix reference counter initial value of chunk works Dm-zoned initializes reference counters of new chunk works with zero value and refcount_inc() is called to increment the counter. However, the refcount_inc() function handles the addition to zero value as an error and triggers the warning as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 1506 at lib/refcount.c:25 refcount_warn_saturate+0x68/0xf0 ... CPU: 7 PID: 1506 Comm: systemd-udevd Not tainted 5.4.0+ #134 ... Call Trace: dmz_map+0x2d2/0x350 [dm_zoned] __map_bio+0x42/0x1a0 __split_and_process_non_flush+0x14a/0x1b0 __split_and_process_bio+0x83/0x240 ? kmem_cache_alloc+0x165/0x220 dm_process_bio+0x90/0x230 ? generic_make_request_checks+0x2e7/0x680 dm_make_request+0x3e/0xb0 generic_make_request+0xcf/0x320 ? memcg_drain_all_list_lrus+0x1c0/0x1c0 submit_bio+0x3c/0x160 ? guard_bio_eod+0x2c/0x130 mpage_readpages+0x182/0x1d0 ? bdev_evict_inode+0xf0/0xf0 read_pages+0x6b/0x1b0 __do_page_cache_readahead+0x1ba/0x1d0 force_page_cache_readahead+0x93/0x100 generic_file_read_iter+0x83a/0xe40 ? __seccomp_filter+0x7b/0x670 new_sync_read+0x12a/0x1c0 vfs_read+0x9d/0x150 ksys_read+0x5f/0xe0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ... After this warning, following refcount API calls for the counter all fail to change the counter value. Fix this by setting the initial reference counter value not zero but one for the new chunk works. Instead, do not call refcount_inc() via dmz_get_chunk_work() for the new chunks works. The failure was observed with linux version 5.4 with CONFIG_REFCOUNT_FULL enabled. Refcount rework was merged to linux version 5.5 by the commit 168829ad09ca ("Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip"). After this commit, CONFIG_REFCOUNT_FULL was removed and the failure was observed regardless of kernel configuration. Linux version 4.20 merged the commit 092b5648760a ("dm zoned: target: use refcount_t for dm zoned reference counters"). Before this commit, dm zoned used atomic_t APIs which does not check addition to zero, then this fix is not necessary. Fixes: 092b5648760a ("dm zoned: target: use refcount_t for dm zoned reference counters") Cc: stable@vger.kernel.org # 5.4+ Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit 41c526c5af46d4c4dab7f72c99000b7fac0b9702 Author: Mikulas Patocka Date: Mon Feb 24 10:20:30 2020 +0100 dm writecache: verify watermark during resume Verify the watermark upon resume - so that if the target is reloaded with lower watermark, it will start the cleanup process immediately. Fixes: 48debafe4f2f ("dm: add writecache target") Cc: stable@vger.kernel.org # 4.18+ Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit adc0daad366b62ca1bce3e2958a40b0b71a8b8b3 Author: Mikulas Patocka Date: Mon Feb 24 10:20:28 2020 +0100 dm: report suspended device during destroy The function dm_suspended returns true if the target is suspended. However, when the target is being suspended during unload, it returns false. An example where this is a problem: the test "!dm_suspended(wc->ti)" in writecache_writeback is not sufficient, because dm_suspended returns zero while writecache_suspend is in progress. As is, without an enhanced dm_suspended, simply switching from flush_workqueue to drain_workqueue still emits warnings: workqueue writecache-writeback: drain_workqueue() isn't complete after 10 tries workqueue writecache-writeback: drain_workqueue() isn't complete after 100 tries workqueue writecache-writeback: drain_workqueue() isn't complete after 200 tries workqueue writecache-writeback: drain_workqueue() isn't complete after 300 tries workqueue writecache-writeback: drain_workqueue() isn't complete after 400 tries writecache_suspend calls flush_workqueue(wc->writeback_wq) - this function flushes the current work. However, the workqueue may re-queue itself and flush_workqueue doesn't wait for re-queued works to finish. Because of this - the function writecache_writeback continues execution after the device was suspended and then concurrently with writecache_dtr, causing a crash in writecache_writeback. We must use drain_workqueue - that waits until the work and all re-queued works finish. As a prereq for switching to drain_workqueue, this commit fixes dm_suspended to return true after the presuspend hook and before the postsuspend hook - just like during a normal suspend. It allows simplifying the dm-integrity and dm-writecache targets so that they don't have to maintain suspended flags on their own. With this change use of drain_workqueue() can be used effectively. This change was tested with the lvm2 testsuite and cryptsetup testsuite and the are no regressions. Fixes: 48debafe4f2f ("dm: add writecache target") Cc: stable@vger.kernel.org # 4.18+ Reported-by: Corey Marthaler Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit d876836204897b6d7d911f942084f69a1e9d5c4d Author: Jens Axboe Date: Thu Feb 27 14:17:49 2020 -0700 io_uring: fix 32-bit compatability with sendmsg/recvmsg We must set MSG_CMSG_COMPAT if we're in compatability mode, otherwise the iovec import for these commands will not do the right thing and fail the command with -EINVAL. Found by running the test suite compiled as 32-bit. Cc: stable@vger.kernel.org Fixes: aa1fa28fc73e ("io_uring: add support for recvmsg()") Fixes: 0fa03c624d8f ("io_uring: add support for sendmsg()") Signed-off-by: Jens Axboe commit c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec Author: Jason Gunthorpe Date: Fri Feb 21 15:20:26 2020 +0000 RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() The algorithm pre-allocates a cm_id since allocation cannot be done while holding the cm.lock spinlock, however it doesn't free it on one error path, leading to a memory leak. Fixes: 067b171b8679 ("IB/cm: Share listening CM IDs") Link: https://lore.kernel.org/r/20200221152023.GA8680@ziepe.ca Signed-off-by: Jason Gunthorpe commit 59b5809655bdafb0767d3fd00a3e41711aab07e6 Author: Tony Luck Date: Tue Feb 25 17:17:37 2020 -0800 x86/mce: Fix logic and comments around MSR_PPIN_CTL There are two implemented bits in the PPIN_CTL MSR: Bit 0: LockOut (R/WO) Set 1 to prevent further writes to MSR_PPIN_CTL. Bit 1: Enable_PPIN (R/W) If 1, enables MSR_PPIN to be accessible using RDMSR. If 0, an attempt to read MSR_PPIN will cause #GP. So there are four defined values: 0: PPIN is disabled, PPIN_CTL may be updated 1: PPIN is disabled. PPIN_CTL is locked against updates 2: PPIN is enabled. PPIN_CTL may be updated 3: PPIN is enabled. PPIN_CTL is locked against updates Code would only enable the X86_FEATURE_INTEL_PPIN feature for case "2". When it should have done so for both case "2" and case "3". Fix the final test to just check for the enable bit. Also fix some of the other comments in this function. Fixes: 3f5a7896a509 ("x86/mce: Include the PPIN in MCE records when available") Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20200226011737.9958-1-tony.luck@intel.com commit 3ee339eb28959629db33aaa2b8cde4c63c6289eb Author: Andrew Lunn Date: Thu Feb 27 21:20:49 2020 +0100 net: dsa: mv88e6xxx: Fix masking of egress port Add missing ~ to the usage of the mask. Reported-by: Kevin Benson Reported-by: Chris Healy Fixes: 5c74c54ce6ff ("net: dsa: mv88e6xxx: Split monitor port configuration") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit ac004e84164e27d69017731a97b11402a69d854b Author: Amit Cohen Date: Thu Feb 27 21:07:53 2020 +0100 mlxsw: pci: Wait longer before accessing the device after reset During initialization the driver issues a reset to the device and waits for 100ms before checking if the firmware is ready. The waiting is necessary because before that the device is irresponsive and the first read can result in a completion timeout. While 100ms is sufficient for Spectrum-1 and Spectrum-2, it is insufficient for Spectrum-3. Fix this by increasing the timeout to 200ms. Fixes: da382875c616 ("mlxsw: spectrum: Extend to support Spectrum-3 ASIC") Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 23797b98909f34b75fd130369bde86f760db69d0 Author: Alex Maftei (amaftei) Date: Wed Feb 26 17:33:19 2020 +0000 sfc: fix timestamp reconstruction at 16-bit rollover points We can't just use the top bits of the last sync event as they could be off-by-one every 65,536 seconds, giving an error in reconstruction of 65,536 seconds. This patch uses the difference in the bottom 16 bits (mod 2^16) to calculate an offset that needs to be applied to the last sync event to get to the current time. Signed-off-by: Alexandru-Mihai Maftei Acked-by: Martin Habets Signed-off-by: David S. Miller commit 3f74957fcbeab703297ed0f135430414ed7e0dd0 Author: Stefano Garzarella Date: Wed Feb 26 11:58:18 2020 +0100 vsock: fix potential deadlock in transport->release() Some transports (hyperv, virtio) acquire the sock lock during the .release() callback. In the vsock_stream_connect() we call vsock_assign_transport(); if the socket was previously assigned to another transport, the vsk->transport->release() is called, but the sock lock is already held in the vsock_stream_connect(), causing a deadlock reported by syzbot: INFO: task syz-executor280:9768 blocked for more than 143 seconds. Not tainted 5.6.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor280 D27912 9768 9766 0x00000000 Call Trace: context_switch kernel/sched/core.c:3386 [inline] __schedule+0x934/0x1f90 kernel/sched/core.c:4082 schedule+0xdc/0x2b0 kernel/sched/core.c:4156 __lock_sock+0x165/0x290 net/core/sock.c:2413 lock_sock_nested+0xfe/0x120 net/core/sock.c:2938 virtio_transport_release+0xc4/0xd60 net/vmw_vsock/virtio_transport_common.c:832 vsock_assign_transport+0xf3/0x3b0 net/vmw_vsock/af_vsock.c:454 vsock_stream_connect+0x2b3/0xc70 net/vmw_vsock/af_vsock.c:1288 __sys_connect_file+0x161/0x1c0 net/socket.c:1857 __sys_connect+0x174/0x1b0 net/socket.c:1874 __do_sys_connect net/socket.c:1885 [inline] __se_sys_connect net/socket.c:1882 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1882 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe To avoid this issue, this patch remove the lock acquiring in the .release() callback of hyperv and virtio transports, and it holds the lock when we call vsk->transport->release() in the vsock core. Reported-by: syzbot+731710996d79d0d58fbc@syzkaller.appspotmail.com Fixes: 408624af4c89 ("vsock: use local transport when it is loaded") Signed-off-by: Stefano Garzarella Reviewed-by: Stefan Hajnoczi Signed-off-by: David S. Miller commit 5c05a164d441a1792791175e4959ea9df12f7e2b Author: David S. Miller Date: Thu Feb 27 11:52:35 2020 -0800 unix: It's CONFIG_PROC_FS not CONFIG_PROCFS Fixes: 3a12500ed5dd ("unix: define and set show_fdinfo only if procfs is enabled") Signed-off-by: David S. Miller commit 795c03a5d09c37f153affa0bdb416c16f678bd7e Merge: b82cf17ff195 ad3cc31b599e Author: David S. Miller Date: Thu Feb 27 11:45:07 2020 -0800 Merge branch 'net-rmnet-fix-several-bugs' Taehee Yoo says: ==================== net: rmnet: fix several bugs This patchset is to fix several bugs in RMNET module. 1. The first patch fixes NULL-ptr-deref in rmnet_newlink(). When rmnet interface is being created, it uses IFLA_LINK without checking NULL. So, if userspace doesn't set IFLA_LINK, panic will occur. In this patch, checking NULL pointer code is added. 2. The second patch fixes NULL-ptr-deref in rmnet_changelink(). To get real device in rmnet_changelink(), it uses IFLA_LINK. But, IFLA_LINK should not be used in rmnet_changelink(). 3. The third patch fixes suspicious RCU usage in rmnet_get_port(). rmnet_get_port() uses rcu_dereference_rtnl(). But, rmnet_get_port() is used by datapath. So, rcu_dereference_bh() should be used instead of rcu_dereference_rtnl(). 4. The fourth patch fixes suspicious RCU usage in rmnet_force_unassociate_device(). RCU critical section should not be scheduled. But, unregister_netdevice_queue() in the rmnet_force_unassociate_device() would be scheduled. So, the RCU warning occurs. In this patch, the rcu_read_lock() in the rmnet_force_unassociate_device() is removed because it's unnecessary. 5. The fifth patch fixes duplicate MUX ID case. RMNET MUX ID is unique. So, rmnet interface isn't allowed to be created, which have a duplicate MUX ID. But, only rmnet_newlink() checks this condition, rmnet_changelink() doesn't check this. So, duplicate MUX ID case would happen. 6. The sixth patch fixes upper/lower interface relationship problems. When IFLA_LINK is used, the upper/lower infrastructure should be used. Because it checks the maximum depth of upper/lower interfaces and it also checks circular interface relationship, etc. In this patch, netdev_upper_dev_link() is used. 7. The seventh patch fixes bridge related problems. a) ->ndo_del_slave() doesn't work. b) It couldn't detect circular upper/lower interface relationship. c) It couldn't prevent stack overflow because of too deep depth of upper/lower interface d) It doesn't check the number of lower interfaces. e) Panics because of several reasons. These problems are actually the same problem. So, this patch fixes these problems. 8. The eighth patch fixes packet forwarding issue in bridge mode Packet forwarding is not working in rmnet bridge mode. Because when a packet is forwarded, skb_push() for an ethernet header is needed. But it doesn't call skb_push(). So, the ethernet header will be lost. Change log: - update commit logs. - drop two patches in this patchset because of wrong target branch. - ("net: rmnet: add missing module alias") - ("net: rmnet: print error message when command fails") - remove unneessary rcu_read_lock() in the third patch. - use rcu_dereference_bh() instead of rcu_dereference in third patch. - do not allow to add a bridge device if rmnet interface is already bridge mode in the seventh patch. ==================== Signed-off-by: David S. Miller commit ad3cc31b599ea80f06b29ebdc18b3a39878a48d6 Author: Taehee Yoo Date: Thu Feb 27 12:26:15 2020 +0000 net: rmnet: fix packet forwarding in rmnet bridge mode Packet forwarding is not working in rmnet bridge mode. Because when a packet is forwarded, skb_push() for an ethernet header is needed. But it doesn't call skb_push(). So, the ethernet header will be lost. Test commands: modprobe rmnet ip netns add nst ip netns add nst2 ip link add veth0 type veth peer name veth1 ip link add veth2 type veth peer name veth3 ip link set veth1 netns nst ip link set veth3 netns nst2 ip link add rmnet0 link veth0 type rmnet mux_id 1 ip link set veth2 master rmnet0 ip link set veth0 up ip link set veth2 up ip link set rmnet0 up ip a a 192.168.100.1/24 dev rmnet0 ip netns exec nst ip link set veth1 up ip netns exec nst ip a a 192.168.100.2/24 dev veth1 ip netns exec nst2 ip link set veth3 up ip netns exec nst2 ip a a 192.168.100.3/24 dev veth3 ip netns exec nst2 ping 192.168.100.2 Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit d939b6d30bea1a2322bc536b12be0a7c4c2bccd7 Author: Taehee Yoo Date: Thu Feb 27 12:26:02 2020 +0000 net: rmnet: fix bridge mode bugs In order to attach a bridge interface to the rmnet interface, "master" operation is used. (e.g. ip link set dummy1 master rmnet0) But, in the rmnet_add_bridge(), which is a callback of ->ndo_add_slave() doesn't register lower interface. So, ->ndo_del_slave() doesn't work. There are other problems too. 1. It couldn't detect circular upper/lower interface relationship. 2. It couldn't prevent stack overflow because of too deep depth of upper/lower interface 3. It doesn't check the number of lower interfaces. 4. Panics because of several reasons. The root problem of these issues is actually the same. So, in this patch, these all problems will be fixed. Test commands: modprobe rmnet ip link add dummy0 type dummy ip link add rmnet0 link dummy0 type rmnet mux_id 1 ip link add dummy1 master rmnet0 type dummy ip link add dummy2 master rmnet0 type dummy ip link del rmnet0 ip link del dummy2 ip link del dummy1 Splat looks like: [ 41.867595][ T1164] general protection fault, probably for non-canonical address 0xdffffc0000000101I [ 41.869993][ T1164] KASAN: null-ptr-deref in range [0x0000000000000808-0x000000000000080f] [ 41.872950][ T1164] CPU: 0 PID: 1164 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 41.873915][ T1164] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 41.875161][ T1164] RIP: 0010:rmnet_unregister_bridge.isra.6+0x71/0xf0 [rmnet] [ 41.876178][ T1164] Code: 48 89 ef 48 89 c6 5b 5d e9 fc fe ff ff e8 f7 f3 ff ff 48 8d b8 08 08 00 00 48 ba 00 7 [ 41.878925][ T1164] RSP: 0018:ffff8880c4d0f188 EFLAGS: 00010202 [ 41.879774][ T1164] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000101 [ 41.887689][ T1164] RDX: dffffc0000000000 RSI: ffffffffb8cf64f0 RDI: 0000000000000808 [ 41.888727][ T1164] RBP: ffff8880c40e4000 R08: ffffed101b3c0e3c R09: 0000000000000001 [ 41.889749][ T1164] R10: 0000000000000001 R11: ffffed101b3c0e3b R12: 1ffff110189a1e3c [ 41.890783][ T1164] R13: ffff8880c4d0f200 R14: ffffffffb8d56160 R15: ffff8880ccc2c000 [ 41.891794][ T1164] FS: 00007f4300edc0c0(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000 [ 41.892953][ T1164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.893800][ T1164] CR2: 00007f43003bc8c0 CR3: 00000000ca53e001 CR4: 00000000000606f0 [ 41.894824][ T1164] Call Trace: [ 41.895274][ T1164] ? rcu_is_watching+0x2c/0x80 [ 41.895895][ T1164] rmnet_config_notify_cb+0x1f7/0x590 [rmnet] [ 41.896687][ T1164] ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet] [ 41.897611][ T1164] ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet] [ 41.898508][ T1164] ? __module_text_address+0x13/0x140 [ 41.899162][ T1164] notifier_call_chain+0x90/0x160 [ 41.899814][ T1164] rollback_registered_many+0x660/0xcf0 [ 41.900544][ T1164] ? netif_set_real_num_tx_queues+0x780/0x780 [ 41.901316][ T1164] ? __lock_acquire+0xdfe/0x3de0 [ 41.901958][ T1164] ? memset+0x1f/0x40 [ 41.902468][ T1164] ? __nla_validate_parse+0x98/0x1ab0 [ 41.903166][ T1164] unregister_netdevice_many.part.133+0x13/0x1b0 [ 41.903988][ T1164] rtnl_delete_link+0xbc/0x100 [ ... ] Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 037f9cdf72fb8a7ff9ec2b5dd05336ec1492bdf1 Author: Taehee Yoo Date: Thu Feb 27 12:25:43 2020 +0000 net: rmnet: use upper/lower device infrastructure netdev_upper_dev_link() is useful to manage lower/upper interfaces. And this function internally validates looping, maximum depth. All or most virtual interfaces that could have a real interface (e.g. macsec, macvlan, ipvlan etc.) use lower/upper infrastructure. Test commands: modprobe rmnet ip link add dummy0 type dummy ip link add rmnet1 link dummy0 type rmnet mux_id 1 for i in {2..100} do let A=$i-1 ip link add rmnet$i link rmnet$A type rmnet mux_id $i done ip link del dummy0 The purpose of the test commands is to make stack overflow. Splat looks like: [ 52.411438][ T1395] BUG: KASAN: slab-out-of-bounds in find_busiest_group+0x27e/0x2c00 [ 52.413218][ T1395] Write of size 64 at addr ffff8880c774bde0 by task ip/1395 [ 52.414841][ T1395] [ 52.430720][ T1395] CPU: 1 PID: 1395 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 52.496511][ T1395] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 52.513597][ T1395] Call Trace: [ 52.546516][ T1395] [ 52.558773][ T1395] Allocated by task 3171537984: [ 52.588290][ T1395] BUG: unable to handle page fault for address: ffffffffb999e260 [ 52.589311][ T1395] #PF: supervisor read access in kernel mode [ 52.590529][ T1395] #PF: error_code(0x0000) - not-present page [ 52.591374][ T1395] PGD d6818067 P4D d6818067 PUD d6819063 PMD 0 [ 52.592288][ T1395] Thread overran stack, or stack corrupted [ 52.604980][ T1395] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 52.605856][ T1395] CPU: 1 PID: 1395 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 52.611764][ T1395] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 52.621520][ T1395] RIP: 0010:stack_depot_fetch+0x10/0x30 [ 52.622296][ T1395] Code: ff e9 f9 fe ff ff 48 89 df e8 9c 1d 91 ff e9 ca fe ff ff cc cc cc cc cc cc cc 89 f8 0 [ 52.627887][ T1395] RSP: 0018:ffff8880c774bb60 EFLAGS: 00010006 [ 52.628735][ T1395] RAX: 00000000001f8880 RBX: ffff8880c774d140 RCX: 0000000000000000 [ 52.631773][ T1395] RDX: 000000000000001d RSI: ffff8880c774bb68 RDI: 0000000000003ff0 [ 52.649584][ T1395] RBP: ffffea00031dd200 R08: ffffed101b43e403 R09: ffffed101b43e403 [ 52.674857][ T1395] R10: 0000000000000001 R11: ffffed101b43e402 R12: ffff8880d900e5c0 [ 52.678257][ T1395] R13: ffff8880c774c000 R14: 0000000000000000 R15: dffffc0000000000 [ 52.694541][ T1395] FS: 00007fe867f6e0c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000 [ 52.764039][ T1395] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 52.815008][ T1395] CR2: ffffffffb999e260 CR3: 00000000c26aa005 CR4: 00000000000606e0 [ 52.862312][ T1395] Call Trace: [ 52.887133][ T1395] Modules linked in: dummy rmnet veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_dex [ 52.936749][ T1395] CR2: ffffffffb999e260 [ 52.965695][ T1395] ---[ end trace 7e32ca99482dbb31 ]--- [ 52.966556][ T1395] RIP: 0010:stack_depot_fetch+0x10/0x30 [ 52.971083][ T1395] Code: ff e9 f9 fe ff ff 48 89 df e8 9c 1d 91 ff e9 ca fe ff ff cc cc cc cc cc cc cc 89 f8 0 [ 53.003650][ T1395] RSP: 0018:ffff8880c774bb60 EFLAGS: 00010006 [ 53.043183][ T1395] RAX: 00000000001f8880 RBX: ffff8880c774d140 RCX: 0000000000000000 [ 53.076480][ T1395] RDX: 000000000000001d RSI: ffff8880c774bb68 RDI: 0000000000003ff0 [ 53.093858][ T1395] RBP: ffffea00031dd200 R08: ffffed101b43e403 R09: ffffed101b43e403 [ 53.112795][ T1395] R10: 0000000000000001 R11: ffffed101b43e402 R12: ffff8880d900e5c0 [ 53.139837][ T1395] R13: ffff8880c774c000 R14: 0000000000000000 R15: dffffc0000000000 [ 53.141500][ T1395] FS: 00007fe867f6e0c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000 [ 53.143343][ T1395] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.152007][ T1395] CR2: ffffffffb999e260 CR3: 00000000c26aa005 CR4: 00000000000606e0 [ 53.156459][ T1395] Kernel panic - not syncing: Fatal exception [ 54.213570][ T1395] Shutting down cpus with NMI [ 54.354112][ T1395] Kernel Offset: 0x33000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0x) [ 54.355687][ T1395] Rebooting in 5 seconds.. Fixes: b37f78f234bf ("net: qualcomm: rmnet: Fix crash on real dev unregistration") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 1dc49e9d164cd7e11c81279c83db84a147e14740 Author: Taehee Yoo Date: Thu Feb 27 12:25:19 2020 +0000 net: rmnet: do not allow to change mux id if mux id is duplicated Basically, duplicate mux id isn't be allowed. So, the creation of rmnet will be failed if there is duplicate mux id is existing. But, changelink routine doesn't check duplicate mux id. Test commands: modprobe rmnet ip link add dummy0 type dummy ip link add rmnet0 link dummy0 type rmnet mux_id 1 ip link add rmnet1 link dummy0 type rmnet mux_id 2 ip link set rmnet1 type rmnet mux_id 1 Fixes: 23790ef12082 ("net: qualcomm: rmnet: Allow to configure flags for existing devices") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit c026d970102e9af9958edefb4a015702c6aab636 Author: Taehee Yoo Date: Thu Feb 27 12:25:05 2020 +0000 net: rmnet: remove rcu_read_lock in rmnet_force_unassociate_device() The notifier_call() of the slave interface removes rmnet interface with unregister_netdevice_queue(). But, before calling unregister_netdevice_queue(), it acquires rcu readlock. In the RCU critical section, sleeping isn't be allowed. But, unregister_netdevice_queue() internally calls synchronize_net(), which would sleep. So, suspicious RCU usage warning occurs. Test commands: modprobe rmnet ip link add dummy0 type dummy ip link add dummy1 type dummy ip link add rmnet0 link dummy0 type rmnet mux_id 1 ip link set dummy1 master rmnet0 ip link del dummy0 Splat looks like: [ 79.639245][ T1195] ============================= [ 79.640134][ T1195] WARNING: suspicious RCU usage [ 79.640852][ T1195] 5.6.0-rc1+ #447 Not tainted [ 79.641657][ T1195] ----------------------------- [ 79.642472][ T1195] ./include/linux/rcupdate.h:273 Illegal context switch in RCU read-side critical section! [ 79.644043][ T1195] [ 79.644043][ T1195] other info that might help us debug this: [ 79.644043][ T1195] [ 79.645682][ T1195] [ 79.645682][ T1195] rcu_scheduler_active = 2, debug_locks = 1 [ 79.646980][ T1195] 2 locks held by ip/1195: [ 79.647629][ T1195] #0: ffffffffa3cf64f0 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x457/0x890 [ 79.649312][ T1195] #1: ffffffffa39256c0 (rcu_read_lock){....}, at: rmnet_config_notify_cb+0xf0/0x590 [rmnet] [ 79.651717][ T1195] [ 79.651717][ T1195] stack backtrace: [ 79.652650][ T1195] CPU: 3 PID: 1195 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 79.653702][ T1195] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 79.655037][ T1195] Call Trace: [ 79.655560][ T1195] dump_stack+0x96/0xdb [ 79.656252][ T1195] ___might_sleep+0x345/0x440 [ 79.656994][ T1195] synchronize_net+0x18/0x30 [ 79.661132][ T1195] netdev_rx_handler_unregister+0x40/0xb0 [ 79.666266][ T1195] rmnet_unregister_real_device+0x42/0xb0 [rmnet] [ 79.667211][ T1195] rmnet_config_notify_cb+0x1f7/0x590 [rmnet] [ 79.668121][ T1195] ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet] [ 79.669166][ T1195] ? rmnet_unregister_bridge.isra.6+0xf0/0xf0 [rmnet] [ 79.670286][ T1195] ? __module_text_address+0x13/0x140 [ 79.671139][ T1195] notifier_call_chain+0x90/0x160 [ 79.671973][ T1195] rollback_registered_many+0x660/0xcf0 [ 79.672893][ T1195] ? netif_set_real_num_tx_queues+0x780/0x780 [ 79.675091][ T1195] ? __lock_acquire+0xdfe/0x3de0 [ 79.675825][ T1195] ? memset+0x1f/0x40 [ 79.676367][ T1195] ? __nla_validate_parse+0x98/0x1ab0 [ 79.677290][ T1195] unregister_netdevice_many.part.133+0x13/0x1b0 [ 79.678163][ T1195] rtnl_delete_link+0xbc/0x100 [ ... ] Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 102210f7664442d8c0ce332c006ea90626df745b Author: Taehee Yoo Date: Thu Feb 27 12:24:45 2020 +0000 net: rmnet: fix suspicious RCU usage rmnet_get_port() internally calls rcu_dereference_rtnl(), which checks RTNL. But rmnet_get_port() could be called by packet path. The packet path is not protected by RTNL. So, the suspicious RCU usage problem occurs. Test commands: modprobe rmnet ip netns add nst ip link add veth0 type veth peer name veth1 ip link set veth1 netns nst ip link add rmnet0 link veth0 type rmnet mux_id 1 ip netns exec nst ip link add rmnet1 link veth1 type rmnet mux_id 1 ip netns exec nst ip link set veth1 up ip netns exec nst ip link set rmnet1 up ip netns exec nst ip a a 192.168.100.2/24 dev rmnet1 ip link set veth0 up ip link set rmnet0 up ip a a 192.168.100.1/24 dev rmnet0 ping 192.168.100.2 Splat looks like: [ 146.630958][ T1174] WARNING: suspicious RCU usage [ 146.631735][ T1174] 5.6.0-rc1+ #447 Not tainted [ 146.632387][ T1174] ----------------------------- [ 146.633151][ T1174] drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c:386 suspicious rcu_dereference_check() ! [ 146.634742][ T1174] [ 146.634742][ T1174] other info that might help us debug this: [ 146.634742][ T1174] [ 146.645992][ T1174] [ 146.645992][ T1174] rcu_scheduler_active = 2, debug_locks = 1 [ 146.646937][ T1174] 5 locks held by ping/1174: [ 146.647609][ T1174] #0: ffff8880c31dea70 (sk_lock-AF_INET){+.+.}, at: raw_sendmsg+0xab8/0x2980 [ 146.662463][ T1174] #1: ffffffff93925660 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x243/0x2150 [ 146.671696][ T1174] #2: ffffffff93925660 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x213/0x2940 [ 146.673064][ T1174] #3: ffff8880c19ecd58 (&dev->qdisc_running_key#7){+...}, at: ip_finish_output2+0x714/0x2150 [ 146.690358][ T1174] #4: ffff8880c5796898 (&dev->qdisc_xmit_lock_key#3){+.-.}, at: sch_direct_xmit+0x1e2/0x1020 [ 146.699875][ T1174] [ 146.699875][ T1174] stack backtrace: [ 146.701091][ T1174] CPU: 0 PID: 1174 Comm: ping Not tainted 5.6.0-rc1+ #447 [ 146.705215][ T1174] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 146.706565][ T1174] Call Trace: [ 146.707102][ T1174] dump_stack+0x96/0xdb [ 146.708007][ T1174] rmnet_get_port.part.9+0x76/0x80 [rmnet] [ 146.709233][ T1174] rmnet_egress_handler+0x107/0x420 [rmnet] [ 146.710492][ T1174] ? sch_direct_xmit+0x1e2/0x1020 [ 146.716193][ T1174] rmnet_vnd_start_xmit+0x3d/0xa0 [rmnet] [ 146.717012][ T1174] dev_hard_start_xmit+0x160/0x740 [ 146.717854][ T1174] sch_direct_xmit+0x265/0x1020 [ 146.718577][ T1174] ? register_lock_class+0x14d0/0x14d0 [ 146.719429][ T1174] ? dev_watchdog+0xac0/0xac0 [ 146.723738][ T1174] ? __dev_queue_xmit+0x15fd/0x2940 [ 146.724469][ T1174] ? lock_acquire+0x164/0x3b0 [ 146.725172][ T1174] __dev_queue_xmit+0x20c7/0x2940 [ ... ] Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 1eb1f43a6e37282348a41e3d68f5e9a6a4359212 Author: Taehee Yoo Date: Thu Feb 27 12:24:26 2020 +0000 net: rmnet: fix NULL pointer dereference in rmnet_changelink() In the rmnet_changelink(), it uses IFLA_LINK without checking NULL pointer. tb[IFLA_LINK] could be NULL pointer. So, NULL-ptr-deref could occur. rmnet already has a lower interface (real_dev). So, after this patch, rmnet_changelink() does not use IFLA_LINK anymore. Test commands: modprobe rmnet ip link add dummy0 type dummy ip link add rmnet0 link dummy0 type rmnet mux_id 1 ip link set rmnet0 type rmnet mux_id 2 Splat looks like: [ 90.578726][ T1131] general protection fault, probably for non-canonical address 0xdffffc0000000000I [ 90.581121][ T1131] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 90.582380][ T1131] CPU: 2 PID: 1131 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 90.584285][ T1131] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 90.587506][ T1131] RIP: 0010:rmnet_changelink+0x5a/0x8a0 [rmnet] [ 90.588546][ T1131] Code: 83 ec 20 48 c1 ea 03 80 3c 02 00 0f 85 6f 07 00 00 48 8b 5e 28 48 b8 00 00 00 00 00 0 [ 90.591447][ T1131] RSP: 0018:ffff8880ce78f1b8 EFLAGS: 00010247 [ 90.592329][ T1131] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff8880ce78f8b0 [ 90.593253][ T1131] RDX: 0000000000000000 RSI: ffff8880ce78f4a0 RDI: 0000000000000004 [ 90.594058][ T1131] RBP: ffff8880cf543e00 R08: 0000000000000002 R09: 0000000000000002 [ 90.594859][ T1131] R10: ffffffffc0586a40 R11: 0000000000000000 R12: ffff8880ca47c000 [ 90.595690][ T1131] R13: ffff8880ca47c000 R14: ffff8880cf545000 R15: 0000000000000000 [ 90.596553][ T1131] FS: 00007f21f6c7e0c0(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000 [ 90.597504][ T1131] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.599418][ T1131] CR2: 0000556e413db458 CR3: 00000000c917a002 CR4: 00000000000606e0 [ 90.600289][ T1131] Call Trace: [ 90.600631][ T1131] __rtnl_newlink+0x922/0x1270 [ 90.601194][ T1131] ? lock_downgrade+0x6e0/0x6e0 [ 90.601724][ T1131] ? rtnl_link_unregister+0x220/0x220 [ 90.602309][ T1131] ? lock_acquire+0x164/0x3b0 [ 90.602784][ T1131] ? is_bpf_image_address+0xff/0x1d0 [ 90.603331][ T1131] ? rtnl_newlink+0x4c/0x90 [ 90.603810][ T1131] ? kernel_text_address+0x111/0x140 [ 90.604419][ T1131] ? __kernel_text_address+0xe/0x30 [ 90.604981][ T1131] ? unwind_get_return_address+0x5f/0xa0 [ 90.605616][ T1131] ? create_prof_cpu_mask+0x20/0x20 [ 90.606304][ T1131] ? arch_stack_walk+0x83/0xb0 [ 90.606985][ T1131] ? stack_trace_save+0x82/0xb0 [ 90.607656][ T1131] ? stack_trace_consume_entry+0x160/0x160 [ 90.608503][ T1131] ? deactivate_slab.isra.78+0x2c5/0x800 [ 90.609336][ T1131] ? kasan_unpoison_shadow+0x30/0x40 [ 90.610096][ T1131] ? kmem_cache_alloc_trace+0x135/0x350 [ 90.610889][ T1131] ? rtnl_newlink+0x4c/0x90 [ 90.611512][ T1131] rtnl_newlink+0x65/0x90 [ ... ] Fixes: 23790ef12082 ("net: qualcomm: rmnet: Allow to configure flags for existing devices") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 93b5cbfa9636d385126f211dca9efa7e3f683202 Author: Taehee Yoo Date: Thu Feb 27 12:23:52 2020 +0000 net: rmnet: fix NULL pointer dereference in rmnet_newlink() rmnet registers IFLA_LINK interface as a lower interface. But, IFLA_LINK could be NULL. In the current code, rmnet doesn't check IFLA_LINK. So, panic would occur. Test commands: modprobe rmnet ip link add rmnet0 type rmnet mux_id 1 Splat looks like: [ 36.826109][ T1115] general protection fault, probably for non-canonical address 0xdffffc0000000000I [ 36.838817][ T1115] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 36.839908][ T1115] CPU: 1 PID: 1115 Comm: ip Not tainted 5.6.0-rc1+ #447 [ 36.840569][ T1115] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 36.841408][ T1115] RIP: 0010:rmnet_newlink+0x54/0x510 [rmnet] [ 36.841986][ T1115] Code: 83 ec 18 48 c1 e9 03 80 3c 01 00 0f 85 d4 03 00 00 48 8b 6a 28 48 b8 00 00 00 00 00 c [ 36.843923][ T1115] RSP: 0018:ffff8880b7e0f1c0 EFLAGS: 00010247 [ 36.844756][ T1115] RAX: dffffc0000000000 RBX: ffff8880d14cca00 RCX: 1ffff11016fc1e99 [ 36.845859][ T1115] RDX: 0000000000000000 RSI: ffff8880c3d04000 RDI: 0000000000000004 [ 36.846961][ T1115] RBP: 0000000000000000 R08: ffff8880b7e0f8b0 R09: ffff8880b6ac2d90 [ 36.848020][ T1115] R10: ffffffffc0589a40 R11: ffffed1016d585b7 R12: ffffffff88ceaf80 [ 36.848788][ T1115] R13: ffff8880c3d04000 R14: ffff8880b7e0f8b0 R15: ffff8880c3d04000 [ 36.849546][ T1115] FS: 00007f50ab3360c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000 [ 36.851784][ T1115] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.852422][ T1115] CR2: 000055871afe5ab0 CR3: 00000000ae246001 CR4: 00000000000606e0 [ 36.853181][ T1115] Call Trace: [ 36.853514][ T1115] __rtnl_newlink+0xbdb/0x1270 [ 36.853967][ T1115] ? lock_downgrade+0x6e0/0x6e0 [ 36.854420][ T1115] ? rtnl_link_unregister+0x220/0x220 [ 36.854936][ T1115] ? lock_acquire+0x164/0x3b0 [ 36.855376][ T1115] ? is_bpf_image_address+0xff/0x1d0 [ 36.855884][ T1115] ? rtnl_newlink+0x4c/0x90 [ 36.856304][ T1115] ? kernel_text_address+0x111/0x140 [ 36.856857][ T1115] ? __kernel_text_address+0xe/0x30 [ 36.857440][ T1115] ? unwind_get_return_address+0x5f/0xa0 [ 36.858063][ T1115] ? create_prof_cpu_mask+0x20/0x20 [ 36.858644][ T1115] ? arch_stack_walk+0x83/0xb0 [ 36.859171][ T1115] ? stack_trace_save+0x82/0xb0 [ 36.859710][ T1115] ? stack_trace_consume_entry+0x160/0x160 [ 36.860357][ T1115] ? deactivate_slab.isra.78+0x2c5/0x800 [ 36.860928][ T1115] ? kasan_unpoison_shadow+0x30/0x40 [ 36.861520][ T1115] ? kmem_cache_alloc_trace+0x135/0x350 [ 36.862125][ T1115] ? rtnl_newlink+0x4c/0x90 [ 36.864073][ T1115] rtnl_newlink+0x65/0x90 [ ... ] Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 94f18b9b24ee4d812ebd30ff848298a9f413f07a Author: Nicolas Saenz Julienne Date: Wed Feb 26 17:46:00 2020 +0100 ARM: dts: bcm2711: Add pcie0 alias Some bcm2711 revisions have different DMA constraints on the their PCIE bus. The lower common denominator, being able to access the lower 3GB of memory, is the default setting for now. Newer SoC revisions are able to access the whole memory space. Raspberry Pi 4's firmware is aware of this limitation and will correct the PCIE's dma-ranges property if a pcie0 alias is available. So add it. Fixes: d5c8dc0d4c88 ("ARM: dts: bcm2711: Enable PCIe controller") Signed-off-by: Nicolas Saenz Julienne Reviewed-by: Phil Elwell Signed-off-by: Florian Fainelli commit bff211bab301db890e38de872d43cbb459940daa Author: Stefan Wahren Date: Sun Feb 23 19:03:05 2020 +0100 ARM: dts: bcm283x: Add missing properties to the PWR LED This adds the missing properties to the PWR LED for the RPi 3 & 4 boards, which are already set for the other boards. Without them we will lose the LED state after suspend. Signed-off-by: Stefan Wahren Tested-by: Peter Robinson Signed-off-by: Florian Fainelli commit a2f0b878c3ca531a1706cb2a8b079cea3b17bafc Merge: 278de45e145b eabc8bcb292f Author: Linus Torvalds Date: Thu Feb 27 11:26:33 2020 -0800 Merge tag 'kbuild-fixes-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - fix missed rebuild of DT schema check - add some phony targets to PHONY - fix comments and documents * tag 'kbuild-fixes-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: get rid of trailing slash from subdir- example kbuild: add dt_binding_check to PHONY in a correct place kbuild: add dtbs_check to PHONY kbuild: remove unneeded semicolon at the end of cmd_dtb_check kbuild: fix DT binding schema rule to detect command line changes kbuild: remove wrong documentation about mandatory-y kbuild: add comment for V=2 mode commit b82cf17ff1957ec35eaee7dc519c365ecd06ba38 Author: Russell King Date: Thu Feb 27 09:44:49 2020 +0000 net: phy: marvell: don't interpret PHY status unless resolved Don't attempt to interpret the PHY specific status register unless the PHY is indicating that the resolution is valid. Reviewed-by: Andrew Lunn Signed-off-by: Russell King Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e387f7d5fccf95299135c88b799184c3bef6a705 Author: Jiri Pirko Date: Thu Feb 27 08:22:10 2020 +0100 mlx5: register lag notifier for init network namespace only The current code causes problems when the unregistering netdevice could be different then the registering one. Since the check in mlx5_lag_netdev_event() does not allow any other network namespace anyway, fix this by registerting the lag notifier per init network namespace only. Fixes: d48834f9d4b4 ("mlx5: Use dev_net netdevice notifier registrations") Signed-off-by: Jiri Pirko Tested-by: Aya Levin Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit 278de45e145bedff90072fb47bafdde8393f6a80 Merge: e46bfaba593c 4eb1b01de5b9 Author: Linus Torvalds Date: Thu Feb 27 11:13:27 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID subsystem fixes from Jiri Kosina: - syzkaller-reported error handling fixes in various drivers, from various people - increase of HID report buffer size to 8K, which is apparently needed by certain modern devices - a few new device-ID-specific fixes / quirks - battery charging status reporting fix in logitech-hidpp, from Filipe Laíns * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: hid-bigbenff: fix race condition for scheduled work during removal HID: hid-bigbenff: call hid_hw_stop() in case of error HID: hid-bigbenff: fix general protection fault caused by double kfree HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override HID: alps: Fix an error handling path in 'alps_input_configured()' HID: hiddev: Fix race in in hiddev_disconnect() HID: core: increase HID report buffer size to 8KiB HID: core: fix off-by-one memset in hid_report_raw_event() HID: apple: Add support for recent firmware on Magic Keyboards HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock HID: logitech-hidpp: BatteryVoltage: only read chargeStatus if extPower is active commit 3a12500ed5dd21a63da779ac73503f11085bbc1c Author: Tobias Klauser Date: Wed Feb 26 18:29:53 2020 +0100 unix: define and set show_fdinfo only if procfs is enabled Follow the pattern used with other *_show_fdinfo functions and only define unix_show_fdinfo and set it in proto_ops if CONFIG_PROCFS is set. Fixes: 3c32da19a858 ("unix: Show number of pending scm files of receive queue in fdinfo") Signed-off-by: Tobias Klauser Reviewed-by: Kirill Tkhai Signed-off-by: David S. Miller commit f4979b41f374c9a5c562df6e428e82629f882df0 Merge: a2f2ef4a54c0 386d4716fd91 Author: David S. Miller Date: Thu Feb 27 11:08:01 2020 -0800 Merge branch 'hinic-BugFixes' Luo bin says: ==================== hinic: BugFixes the bug fixed in patch #2 has been present since the first commit. the bugs fixed in patch #1 and patch #3 have been present since the following commits: patch #1: 352f58b0d9f2 ("net-next/hinic: Set Rxq irq to specific cpu for NUMA") patch #3: 421e9526288b ("hinic: add rss support") ==================== Signed-off-by: David S. Miller commit 386d4716fd91869e07c731657f2cde5a33086516 Author: Luo bin Date: Thu Feb 27 06:34:44 2020 +0000 hinic: fix a bug of rss configuration should use real receive queue number to configure hw rss indirect table rather than maximal queue number Signed-off-by: Luo bin Signed-off-by: David S. Miller commit d2ed69ce9ed3477e2a9527e6b89fe4689d99510e Author: Luo bin Date: Thu Feb 27 06:34:43 2020 +0000 hinic: fix a bug of setting hw_ioctxt a reserved field is used to signify prime physical function index in the latest firmware version, so we must assign a value to it correctly Signed-off-by: Luo bin Signed-off-by: David S. Miller commit 0bff777bd0cba73ad4cd0145696ad284d7e6a99f Author: Luo bin Date: Thu Feb 27 06:34:42 2020 +0000 hinic: fix a irq affinity bug can not use a local variable as an input parameter of irq_set_affinity_hint Signed-off-by: Luo bin Signed-off-by: David S. Miller commit e46bfaba593c36de591a1153746af6bcb40ef67c Merge: ed5fa5591866 adc10f5b0a03 Author: Linus Torvalds Date: Thu Feb 27 11:07:13 2020 -0800 Merge tag 'docs-5.6-fixes' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "A pair of docs-build fixes" * tag 'docs-5.6-fixes' of git://git.lwn.net/linux: docs: Fix empty parallelism argument docs: remove MPX from the x86 toc commit ed5fa5591866f95be1fe75cd267cf9df2c0390f5 Merge: bfdc6d91a25f 756125289285 Author: Linus Torvalds Date: Thu Feb 27 11:01:22 2020 -0800 Merge tag 'audit-pr-20200226' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fixes from Paul Moore: "Two fixes for problems found by syzbot: - Moving audit filter structure fields into a union caused some problems in the code which populates that filter structure. We keep the union (that idea is a good one), but we are fixing the code so that it doesn't needlessly set fields in the union and mess up the error handling. - The audit_receive_msg() function wasn't validating user input as well as it should in all cases, we add the necessary checks" * tag 'audit-pr-20200226' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: always check the netlink payload length in audit_receive_msg() audit: fix error handling in audit_data_to_entry() commit f9a15f39e50db14d2227083e8fe142b1262386f6 Merge: c689300b9c76 b83685bceedb Author: Olof Johansson Date: Thu Feb 27 10:07:47 2020 -0800 Merge tag 'tee-amdtee-fix-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Fix AMDTEE memory leak in amdtee_open_session() * tag 'tee-amdtee-fix-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee: (344 commits) tee: amdtee: fix memory leak in amdtee_open_session() Linux 5.6-rc2 ext4: improve explanation of a mount failure caused by a misconfigured kernel Input: cyapa - replace zero-length array with flexible-array member Input: tca6416-keypad - replace zero-length array with flexible-array member Input: gpio_keys_polled - replace zero-length array with flexible-array member IB/mlx5: Use div64_u64 for num_var_hw_entries calculation nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info nvme/pci: move cqe check after device shutdown nvme: prevent warning triggered by nvme_stop_keep_alive nvme/tcp: fix bug on double requeue when send fails cifs: make sure we do not overflow the max EA buffer size cifs: enable change notification for SMB2.1 dialect netdevice.h: fix all kernel-doc and Sphinx warnings net: dsa: tag_ar9331: Make sure there is headroom for tag net: dsa: tag_qca: Make sure there is headroom for tag net, ip6_tunnel: enhance tunnel locate with link check net/smc: no peer ID in CLC decline for SMCD net/smc: transfer fasync_list in case of fallback net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples() ... Link: https://lore.kernel.org/r/20200227165205.GA7926@jade Signed-off-by: Olof Johansson commit 735a6dd02222d8d070c7bb748f25895239ca8c92 Author: Sean Christopherson Date: Wed Feb 26 15:16:15 2020 -0800 x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes Explicitly set X86_FEATURE_OSPKE via set_cpu_cap() instead of calling get_cpu_cap() to pull the feature bit from CPUID after enabling CR4.PKE. Invoking get_cpu_cap() effectively wipes out any {set,clear}_cpu_cap() changes that were made between this_cpu->c_init() and setup_pku(), as all non-synthetic feature words are reinitialized from the CPU's CPUID values. Blasting away capability updates manifests most visibility when running on a VMX capable CPU, but with VMX disabled by BIOS. To indicate that VMX is disabled, init_ia32_feat_ctl() clears X86_FEATURE_VMX, using clear_cpu_cap() instead of setup_clear_cpu_cap() so that KVM can report which CPU is misconfigured (KVM needs to probe every CPU anyways). Restoring X86_FEATURE_VMX from CPUID causes KVM to think VMX is enabled, ultimately leading to an unexpected #GP when KVM attempts to do VMXON. Arguably, init_ia32_feat_ctl() should use setup_clear_cpu_cap() and let KVM figure out a different way to report the misconfigured CPU, but VMX is not the only feature bit that is affected, i.e. there is precedent that tweaking feature bits via {set,clear}_cpu_cap() after ->c_init() is expected to work. Most notably, x86_init_rdrand()'s clearing of X86_FEATURE_RDRAND when RDRAND malfunctions is also overwritten. Fixes: 0697694564c8 ("x86/mm/pkeys: Actually enable Memory Protection Keys in the CPU") Reported-by: Jacob Keller Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov Acked-by: Dave Hansen Tested-by: Jacob Keller Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200226231615.13664-1-sean.j.christopherson@intel.com commit c689300b9c76c1cdf80547251721704421dbcd5a Merge: f1e4920fe330 21b388dca138 Author: Olof Johansson Date: Thu Feb 27 10:00:02 2020 -0800 Merge tag 'renesas-fixes-for-v5.6-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas Fixes for v5.6 - Restore R-Car M3-W support, - Drop deprecated compatible value to ease DT binding conversion to json-schema. * tag 'renesas-fixes-for-v5.6-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: dts: r8a7779: Remove deprecated "renesas, rcar-sata" compatible value arm64: defconfig: Replace ARCH_R8A7796 by ARCH_R8A77960 Link: https://lore.kernel.org/r/20200226105236.18368-1-geert+renesas@glider.be Signed-off-by: Olof Johansson commit 3918e0667bbac99400b44fa5aef3f8be2eeada4a Author: Theodore Ts'o Date: Sun Feb 23 14:54:58 2020 -0500 dm thin metadata: fix lockdep complaint [ 3934.173244] ====================================================== [ 3934.179572] WARNING: possible circular locking dependency detected [ 3934.185884] 5.4.21-xfstests #1 Not tainted [ 3934.190151] ------------------------------------------------------ [ 3934.196673] dmsetup/8897 is trying to acquire lock: [ 3934.201688] ffffffffbce82b18 (shrinker_rwsem){++++}, at: unregister_shrinker+0x22/0x80 [ 3934.210268] but task is already holding lock: [ 3934.216489] ffff92a10cc5e1d0 (&pmd->root_lock){++++}, at: dm_pool_metadata_close+0xba/0x120 [ 3934.225083] which lock already depends on the new lock. [ 3934.564165] Chain exists of: shrinker_rwsem --> &journal->j_checkpoint_mutex --> &pmd->root_lock For a more detailed lockdep report, please see: https://lore.kernel.org/r/20200220234519.GA620489@mit.edu We shouldn't need to hold the lock while are just tearing down and freeing the whole metadata pool structure. Fixes: 44d8ebf436399a4 ("dm thin metadata: use pool locking at end of dm_pool_metadata_close") Signed-off-by: Theodore Ts'o Signed-off-by: Mike Snitzer commit 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 Author: Mikulas Patocka Date: Wed Feb 19 10:25:45 2020 -0500 dm cache: fix a crash due to incorrect work item cancelling The crash can be reproduced by running the lvm2 testsuite test lvconvert-thin-external-cache.sh for several minutes, e.g.: while :; do make check T=shell/lvconvert-thin-external-cache.sh; done The crash happens in this call chain: do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset -> memset -> __memset -- which accesses an invalid pointer in the vmalloc area. The work entry on the workqueue is executed even after the bitmap was freed. The problem is that cancel_delayed_work doesn't wait for the running work item to finish, so the work item can continue running and re-submitting itself even after cache_postsuspend. In order to make sure that the work item won't be running, we must use cancel_delayed_work_sync. Also, change flush_workqueue to drain_workqueue, so that if some work item submits itself or another work item, we are properly waiting for both of them. Fixes: c6b4fcbad044 ("dm: add cache target") Cc: stable@vger.kernel.org # v3.9 Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 697b4f1603e7358a02027ce4310fee0fe43cb286 Merge: e500ba0e71f0 51c22d7b40dc Author: Tony Lindgren Date: Thu Feb 27 08:57:48 2020 -0800 Merge branch 'omap-for-v5.6/fixes-rc3' into fixes commit 9515743bfb39c61aaf3d4f3219a645c8d1fe9a0e Author: Bijan Mottahedeh Date: Wed Feb 26 18:53:43 2020 -0800 nvme-pci: Hold cq_poll_lock while completing CQEs Completions need to consumed in the same order the controller submitted them, otherwise future completion entries may overwrite ones we haven't handled yet. Hold the nvme queue's poll lock while completing new CQEs to prevent another thread from freeing command tags for reuse out-of-order. Fixes: dabcefab45d3 ("nvme: provide optimized poll function for separate poll queues") Signed-off-by: Bijan Mottahedeh Reviewed-by: Sagi Grimberg Reviewed-by: Jens Axboe Signed-off-by: Keith Busch commit dfc6014e3b60713f375d0601d7549eed224c4615 Author: Sherry Sun Date: Thu Feb 27 16:34:12 2020 +0800 EDAC/synopsys: Do not print an error with back-to-back snprintf() calls handle_error() currently calls snprintf() a couple of times in succession to output the message for a CE/UE, therefore overwriting each part of the message which was formatted with the previous snprintf() call. As a result, only the part of the message from the last snprintf() call will be printed. The simplest and most effective way to fix this problem is to combine the whole string into one which to supply to a single snprintf() call. [ bp: Massage. ] Fixes: b500b4a029d57 ("EDAC, synopsys: Add ECC support for ZynqMP DDR controller") Signed-off-by: Sherry Sun Signed-off-by: Borislav Petkov Reviewed-by: James Morse Cc: Manish Narani Link: https://lkml.kernel.org/r/1582792452-32575-1-git-send-email-sherry.sun@nxp.com commit b83685bceedbeed33a6adc2d0579a011708d2b18 Author: Dan Carpenter Date: Mon Feb 24 13:51:39 2020 +0300 tee: amdtee: fix memory leak in amdtee_open_session() On these error paths the "sess" variable isn't freed. It's a refcounted pointer so we need to call kref_put(). I re-arranged the code a bit so the error case is always handled before the success case and the error paths are indented two tabs. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Rijo Thomas Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander commit e0560ba6d92f06dbe13e9d11c921a60c07ea6fcc Author: Ravi Bangoria Date: Tue Feb 4 10:22:31 2020 +0530 perf annotate: Fix segfault with source toggle While rendering annotate browser from perf report tui, we keep track of total number of lines(asm + source) in annotation->nr_entries and total number of asm lines in annotation->nr_asm_entries. But we don't reset them before starting. Thus if user annotates same function multiple times, we restart incrementing these fields with old values. This causes a segfault when user tries to toggle source code after annotating same function multiple times. Fix it. Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Jin Yao Cc: Namhyung Kim Cc: Song Liu Link: http://lore.kernel.org/lkml/20200204045233.474937-5-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit d3c03147bf8019bda821334428e0ba31ce4fb425 Author: Ravi Bangoria Date: Tue Feb 4 10:22:30 2020 +0530 perf annotate: Align struct annotate_args Align fields of struct annotate_args. Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Jin Yao Cc: Namhyung Kim Cc: Song Liu Link: http://lore.kernel.org/lkml/20200204045233.474937-4-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 2316f861ae9ca640708f9529ae40a6f0bd7ae048 Author: Ravi Bangoria Date: Tue Feb 4 10:22:29 2020 +0530 perf annotate: Simplify disasm_line allocation and freeing code We are allocating disasm_line object in annotation_line__new() instead of disasm_line__new(). Similarly annotation_line__delete() is actually freeing disasm_line object as well. This complexity is because of privsize. But we don't need privsize anymore so get rid of privsize and simplify disasm_line allocation and freeing code. Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Jin Yao Cc: Namhyung Kim Cc: Song Liu Link: http://lore.kernel.org/lkml/20200204045233.474937-3-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 73a7a271b3eee7b83f29b13866163776f1cbef89 Author: Marek Szyprowski Date: Thu Feb 27 12:51:46 2020 +0100 PCI: brcmstb: Fix build on 32bit ARM platforms with older compilers Some older compilers have no implementation for the helper for 64-bit unsigned division/modulo, so linking pcie-brcmstb driver causes the "undefined reference to `__aeabi_uldivmod'" error. *rc_bar2_size is always a power of two, because it is calculated as: "1ULL << fls64(entry->res->end - entry->res->start)", so the modulo operation in the subsequent check can be replaced by a simple logical AND with a proper mask. Link: https://lore.kernel.org/r/20200227115146.24515-1-m.szyprowski@samsung.com Fixes: c0452137034b ("PCI: brcmstb: Add Broadcom STB PCIe host controller driver") Signed-off-by: Marek Szyprowski Signed-off-by: Bjorn Helgaas Acked-by: Nicolas Saenz Julienne Acked-by: Lorenzo Pieralisi commit e0ad4d68548005adb54cc7c35fd9abf760a2a050 Author: Ravi Bangoria Date: Tue Feb 4 10:22:28 2020 +0530 perf annotate: Remove privsize from symbol__annotate() args privsize is passed as 0 from all the symbol__annotate() callers. Remove it from argument list. Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Jin Yao Cc: Namhyung Kim Cc: Song Liu Link: http://lore.kernel.org/lkml/20200204045233.474937-2-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit bd862b1d839221322b2e38eb8a06861604804b5e Author: He Zhe Date: Wed Feb 26 22:30:04 2020 +0800 perf probe: Check return value of strlist__add() for -ENOMEM strlist__add() may fail with -ENOMEM. Check it and give debugging hint in advance. Signed-off-by: He Zhe Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Kate Stewart Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lore.kernel.org/lkml/1582727404-180095-1-git-send-email-zhe.he@windriver.com Signed-off-by: Arnaldo Carvalho de Melo commit bebdb65e077267957f48e43d205d4a16cc7b8161 Author: Tobias Klauser Date: Wed Feb 26 18:38:32 2020 +0100 io_uring: define and set show_fdinfo only if procfs is enabled Follow the pattern used with other *_show_fdinfo functions and only define and use io_uring_show_fdinfo and its helper functions if CONFIG_PROC_FS is set. Fixes: 87ce955b24c9 ("io_uring: add ->show_fdinfo() for the io_uring file descriptor") Signed-off-by: Tobias Klauser Signed-off-by: Jens Axboe commit b0aaf4c8f31feb21de59df723231c286df2d6be3 Author: Ravi Bangoria Date: Thu Feb 13 12:13:06 2020 +0530 perf config: Document missing config options While documenting annotate.show_nr_samples config option, I found many other config options missing in perf-config documentation. Add them. Signed-off-by: Ravi Bangoria Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-9-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit cd0a9c518db123e2097e03eae374e822d82493fd Author: Ravi Bangoria Date: Thu Feb 13 12:13:05 2020 +0530 perf annotate: Fix perf config option description perf config annotate options says it works only with TUI, which is wrong. Most of the TUI options are applicable to stdio2 as well. So remove that generic line and add individual line with each option stating which browsers supports that option. Also, annotate.show_nr_samples config is missing in Documentation. Describe it. Signed-off-by: Ravi Bangoria Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-8-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 812b0f528240ab0e6c58911fcfcb61f4ed811ca2 Author: Ravi Bangoria Date: Thu Feb 13 12:13:04 2020 +0530 perf annotate: Prefer cmdline option over default config For all the perf-config options that can also be set from command line option, the preference is given to command line version in case of any conflict. But that's opposite in case of perf annotate. i.e. the more preference is given to default option rather than command line option. Fix it. Before: $ ./perf config annotate.show_nr_samples=false $ ./perf annotate shash --show-nr-samples Percent│ │24: mov -0xc(%rbp),%eax 49.19 │ imul $0x1003f,%eax,%ecx │ mov -0x18(%rbp),%rax After: Samples│ │24: mov -0xc(%rbp),%eax 1 │ imul $0x1003f,%eax,%ecx │ mov -0x18(%rbp),%rax Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-7-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 7384083ba616092e62df7bfb4f2034730e631e40 Author: Ravi Bangoria Date: Thu Feb 13 12:13:03 2020 +0530 perf annotate: Make perf config effective perf default config set by user in [annotate] section is totally ignored by annotate code. Fix it. Before: $ ./perf config annotate.hide_src_code=true annotate.show_nr_jumps=true annotate.show_nr_samples=true $ ./perf annotate shash │ unsigned h = 0; │ movl $0x0,-0xc(%rbp) │ while (*s) │ ↓ jmp 44 │ h = 65599 * h + *s++; 11.33 │24: mov -0xc(%rbp),%eax 43.50 │ imul $0x1003f,%eax,%ecx │ mov -0x18(%rbp),%rax After: │ movl $0x0,-0xc(%rbp) │ ↓ jmp 44 1 │1 24: mov -0xc(%rbp),%eax 4 │ imul $0x1003f,%eax,%ecx │ mov -0x18(%rbp),%rax Note that we have removed show_nr_samples and show_total_period from annotation_options because they are not used. Instead of them we use symbol_conf.show_nr_samples and symbol_conf.show_total_period. Committer testing: Using 'perf annotate --stdio2' to use the TUI rendering but emitting the output to stdio: # perf config # # perf config annotate.hide_src_code=true # perf config annotate.hide_src_code=true # # perf config annotate.show_nr_jumps=true # perf config annotate.show_nr_samples=true # perf config annotate.hide_src_code=true annotate.show_nr_jumps=true annotate.show_nr_samples=true # # Before: # perf annotate --stdio2 ObjectInstance::weak_pointer_was_finalized Samples: 1 of event 'cycles', 4000 Hz, Event count (approx.): 830873, [percent: local period] ObjectInstance::weak_pointer_was_finalized() /usr/lib64/libgjs.so.0.0.0 Percent 00000000000609f0 : endbr64 cmpq $0x0,0x20(%rdi) ↓ je 10 xor %eax,%eax ← retq xchg %ax,%ax 100.00 10: push %rbp cmpq $0x0,0x18(%rdi) mov %rdi,%rbp ↓ jne 20 1b: xor %eax,%eax pop %rbp ← retq nop 20: lea 0x18(%rdi),%rdi → callq JS_UpdateWeakPointerAfterGC(JS::Heap /dev/null Samples: 1 of event 'cycles', 4000 Hz, Event count (approx.): 830873, [percent: local period] ObjectInstance::weak_pointer_was_finalized() /usr/lib64/libgjs.so.0.0.0 Samples endbr64 cmpq $0x0,0x20(%rdi) ↓ je 10 xor %eax,%eax ← retq xchg %ax,%ax 1 1 10: push %rbp cmpq $0x0,0x18(%rdi) mov %rdi,%rbp ↓ jne 20 1 1b: xor %eax,%eax pop %rbp ← retq nop 1 20: lea 0x18(%rdi),%rdi → callq JS_UpdateWeakPointerAfterGC(JS::Heap /dev/null Samples: 1 of event 'cycles', 4000 Hz, Event count (approx.): 830873, [percent: local period] ObjectInstance::weak_pointer_was_finalized() /usr/lib64/libgjs.so.0.0.0 Samples endbr64 cmpq $0x0,0x20(%rdi) ↓ je 10 xor %eax,%eax ← retq xchg %ax,%ax 1 10: push %rbp cmpq $0x0,0x18(%rdi) mov %rdi,%rbp ↓ jne 20 1b: xor %eax,%eax pop %rbp ← retq nop 20: lea 0x18(%rdi),%rdi → callq JS_UpdateWeakPointerAfterGC(JS::Heap Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-6-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 7b43b6970474757da68e89efb76e892219dea9d8 Author: Ravi Bangoria Date: Thu Feb 13 12:13:02 2020 +0530 perf config: Introduce perf_config_u8() Introduce perf_config_u8() utility function to convert char * input into u8 destination. We will utilize it in followup patch. Signed-off-by: Ravi Bangoria Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-5-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 46ccb44269665bba6a9bf0f77fe776421fc2304c Author: Ravi Bangoria Date: Thu Feb 13 12:13:01 2020 +0530 perf annotate: Fix --show-nr-samples for tui/stdio2 perf annotate --show-nr-samples does not really show number of samples. The reason is we have two separate variables for the same purpose. One is in symbol_conf.show_nr_samples and another is annotation_options.show_nr_samples. We save command line option in symbol_conf.show_nr_samples but uses annotation_option.show_nr_samples while rendering tui/stdio2 browser. Though, we copy symbol_conf.show_nr_samples to annotation__default_options.show_nr_samples but that is not really effective as we don't use annotation__default_options once we copy default options to dynamic variable annotate.opts in cmd_annotate(). Instead of all these complication, keep only one variable and use it all over. symbol_conf.show_nr_samples is used by perf report/top as well. So let's kill annotation_options.show_nr_samples. On a side note, I've kept annotation_options.show_nr_samples definition because it's still used by perf-config code. Follow up patch to fix perf-config for annotate will remove annotation_options.show_nr_samples. Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-4-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 68aac855b643e1540012cbefa0dee06207c3dc64 Author: Ravi Bangoria Date: Thu Feb 13 12:13:00 2020 +0530 perf annotate: Fix --show-total-period for tui/stdio2 perf annotate --show-total-period does not really show total period. The reason is we have two separate variables for the same purpose. One is in symbol_conf.show_total_period and another is annotation_options.show_total_period. We save command line option in symbol_conf.show_total_period but uses annotation_option.show_total_period while rendering tui/stdio2 browser. Though, we copy symbol_conf.show_total_period to annotation__default_options.show_total_period but that is not really effective as we don't use annotation__default_options once we copy default options to dynamic variable annotate.opts in cmd_annotate(). Instead of all these complication, keep only one variable and use it all over. symbol_conf.show_total_period is used by perf report/top as well. So let's kill annotation_options.show_total_period. On a side note, I've kept annotation_options.show_total_period definition because it's still used by perf-config code. Follow up patch to fix perf-config for annotate will remove annotation_options.show_total_period. Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-3-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 54cf752cfb75602c256e94db6fdfd3de9dfbbef1 Author: Ravi Bangoria Date: Thu Feb 13 12:12:59 2020 +0530 perf annotate/tui: Re-render title bar after switching back from script browser The 'perf annotate' TUI browser provides a 'r' hot key to switch to a script browser. But the annotate browser title bar becomes hidden while switching back from script browser. Fix it. Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexey Budankov Cc: Changbin Du Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Song Liu Cc: Taeung Song Cc: Thomas Richter Cc: Yisheng Xie Link: http://lore.kernel.org/lkml/20200213064306.160480-2-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 6be7e07335486f5731cab748d80c68f20896581f Author: Gerd Hoffmann Date: Wed Feb 26 16:47:51 2020 +0100 drm/virtio: fix mmap page attributes virtio-gpu uses cached mappings, set drm_gem_shmem_object.map_cached accordingly. Cc: stable@vger.kernel.org Fixes: c66df701e783 ("drm/virtio: switch from ttm to gem shmem helpers") Reported-by: Gurchetan Singh Reported-by: Guillaume Gardet Signed-off-by: Gerd Hoffmann Reviewed-by: Gurchetan Singh Tested-by: Guillaume Gardet Link: http://patchwork.freedesktop.org/patch/msgid/20200226154752.24328-3-kraxel@redhat.com commit 1cad629257e76025bcbf490c58de550fb67d4d0e Author: Gerd Hoffmann Date: Wed Feb 26 16:47:50 2020 +0100 drm/shmem: add support for per object caching flags. Add map_cached bool to drm_gem_shmem_object, to request cached mappings on a per-object base. Check the flag before adding writecombine to pgprot bits. Cc: stable@vger.kernel.org Signed-off-by: Gerd Hoffmann Reviewed-by: Gurchetan Singh Tested-by: Guillaume Gardet Link: http://patchwork.freedesktop.org/patch/msgid/20200226154752.24328-2-kraxel@redhat.com commit 8e029eb0bcd6a7fab6dc9191152c085784c31ee6 Author: Paul Cercueil Date: Tue Feb 25 12:28:09 2020 -0300 MIPS: Fix CONFIG_MIPS_CMDLINE_DTB_EXTEND handling The CONFIG_MIPS_CMDLINE_DTB_EXTEND option is used so that the kernel arguments provided in the 'bootargs' property in devicetree are extended with the kernel arguments provided by the bootloader. The code was broken, as it didn't actually take any of the kernel arguments provided in devicetree when that option was set. Fixes: 7784cac69735 ("MIPS: cmdline: Clean up boot_command_line initialization") Cc: stable@vger.kernel.org Signed-off-by: Paul Cercueil Signed-off-by: Thomas Bogendoerfer commit 0d6f94fd498a7f9d15c5cbf64567727361fd35c0 Author: Arnaldo Carvalho de Melo Date: Thu Feb 27 09:51:30 2020 -0300 tools headers UAPI: Update tools's copy of kvm.h headers Picking the changes from: 5ef8acbdd687 ("KVM: nVMX: Emulate MTF when performing instruction emulation") Silencing this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h No change in tooling ensues, just the x86 kvm tooling gets rebuilt as those headers are included in its build: $ cp arch/x86/include/uapi/asm/kvm.h tools/arch/x86/include/uapi/asm/kvm.h $ make -C tools/perf make: Entering directory '/home/acme/git/perf/tools/perf' BUILD: Doing 'make -j12' parallel build Auto-detecting system features: ... dwarf: [ on ] ... disassembler-four-args: [ on ] DESCEND plugins CC /tmp/build/perf/arch/x86/util/kvm-stat.o LD /tmp/build/perf/arch/x86/util/perf-in.o LD /tmp/build/perf/arch/x86/perf-in.o LD /tmp/build/perf/arch/perf-in.o LD /tmp/build/perf/perf-in.o LINK /tmp/build/perf/perf $ As it doesn't seem to be used there: $ grep STATE tools/perf/arch/x86/util/kvm-stat.c $ And the 'perf trace' beautifier table generator isn't interested in these things: $ grep regex= tools/perf/trace/beauty/kvm_ioctl.sh regex='^#[[:space:]]*define[[:space:]]+KVM_(\w+)[[:space:]]+_IO[RW]*\([[:space:]]*KVMIO[[:space:]]*,[[:space:]]*(0x[[:xdigit:]]+).*' $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Oliver Upton Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit d8e3ee2e2b4ef36d7be3dd8a8fb6e136f2661203 Author: Arnaldo Carvalho de Melo Date: Thu Feb 27 09:23:35 2020 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 21b5ee59ef18 ("x86/cpu/amd: Enable the fixed Instructions Retired counter IRPERF") $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ git diff diff --git a/tools/arch/x86/include/asm/msr-index.h b/tools/arch/x86/include/asm/msr-index.h index ebe1685e92dd..d5e517d1c3dd 100644 --- a/tools/arch/x86/include/asm/msr-index.h +++ b/tools/arch/x86/include/asm/msr-index.h @@ -512,6 +512,8 @@ #define MSR_K7_HWCR 0xc0010015 #define MSR_K7_HWCR_SMMLOCK_BIT 0 #define MSR_K7_HWCR_SMMLOCK BIT_ULL(MSR_K7_HWCR_SMMLOCK_BIT) +#define MSR_K7_HWCR_IRPERF_EN_BIT 30 +#define MSR_K7_HWCR_IRPERF_EN BIT_ULL(MSR_K7_HWCR_IRPERF_EN_BIT) #define MSR_K7_FID_VID_CTL 0xc0010041 #define MSR_K7_FID_VID_STATUS 0xc0010042 $ That don't result in any change in tooling: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after $ To silence this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Jiri Olsa Cc: Kim Phillips Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 5dd8304981ecffa77bb72b1c57c4be5dfe6cfae9 Author: Thommy Jakobsson Date: Mon Feb 24 17:26:43 2020 +0100 spi/zynqmp: remove entry that causes a cs glitch In the public interface for chipselect, there is always an entry commented as "Dummy generic FIFO entry" pushed down to the fifo right after the activate/deactivate command. The dummy entry is 0x0, irregardless if the intention was to activate or deactive the cs. This causes the cs line to glitch rather than beeing activated in the case when there was an activate command. This has been observed on oscilloscope, and have caused problems for at least one specific flash device type connected to the qspi port. After the change the glitch is gone and cs goes active when intended. The reason why this worked before (except for the glitch) was because when sending the actual data, the CS bits are once again set. Since most flashes uses mode 0, there is always a half clk period anyway for cs to clk active setup time. If someone would rely on timing from a chip_select call to a transfer_one, it would fail though. It is unknown why the dummy entry was there in the first place, git log seems to be of no help in this case. The reference manual gives no indication of the necessity of this. In fact the lower 8 bits are a setup (or hold in case of deactivate) time expressed in cycles. So this should not be needed to fulfill any setup/hold timings. Signed-off-by: Thommy Jakobsson Reviewed-by: Naga Sureshkumar Relli Link: https://lore.kernel.org/r/20200224162643.29102-1-thommyj@gmail.com Signed-off-by: Mark Brown commit d1f37226431f5d9657aa144a40f2383adbcf27e1 Author: Cong Wang Date: Thu Dec 26 22:32:04 2019 -0800 dma-buf: free dmabuf->name in dma_buf_release() dma-buf name can be set via DMA_BUF_SET_NAME ioctl, but once set it never gets freed. Free it in dma_buf_release(). Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls") Reported-by: syzbot+b2098bc44728a4efb3e9@syzkaller.appspotmail.com Cc: Greg Hackmann Cc: Chenbo Feng Cc: Sumit Semwal Signed-off-by: Cong Wang Acked-by: Chenbo Feng Signed-off-by: Sumit Semwal Link: https://patchwork.freedesktop.org/patch/msgid/20191227063204.5813-1-xiyou.wangcong@gmail.com commit 2be30d34a387b8d97cc1b4be1223bfe0b75a0812 Author: Icenowy Zheng Date: Sat Feb 22 00:51:27 2020 +0800 drm/bridge: analogix-anx6345: fix set of link bandwidth Current code tries to store the link rate (in bps, which is a big number) in a u8, which surely overflow. Then it's converted back to bandwidth code (which is thus 0) and written to the chip. The code sometimes works because the chip will automatically fallback to the lowest possible DP link rate (1.62Gbps) when get the invalid value. However, on the eDP panel of Olimex TERES-I, which wants 2.7Gbps link, it failed. As we had already read the link bandwidth as bandwidth code in earlier code (to check whether it is supported), use it when setting bandwidth, instead of converting it to link rate and then converting back. Fixes: e1cff82c1097 ("drm/bridge: fix anx6345 compilation for v5.5") Signed-off-by: Icenowy Zheng Reviewed-by: Torsten Duwe Cc: Maxime Ripard Cc: Torsten Duwe Cc: Sam Ravnborg Cc: Linus Walleij Cc: Thomas Zimmermann Cc: Icenowy Zheng Cc: Stephen Rothwell Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200221165127.813325-1-icenowy@aosc.io commit 1df97a02a937abf8473ccf0ef12edefcb11671de Merge: f8788d86ab28 66d0e797bf09 Author: Rafael J. Wysocki Date: Thu Feb 27 11:21:23 2020 +0100 Merge tag 'devfreq-fixes-for-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull a devfreq fix for 5.6-rc4 from Chanwoo Choi: "Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" - This changes as devfreq(X) cause break some user space applications such as Android HAL from Unisoc and Hikey. In result, decide to revert it for preventing the HAL layer problem." * tag 'devfreq-fixes-for-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" commit edf0d283d988c0c7da53fa2cc1388649263470de Author: Madhuparna Bhowmik Date: Fri Feb 21 21:54:47 2020 +0530 ipv6: xfrm6_tunnel.c: Use built-in RCU list checking hlist_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: Steffen Klassert commit 289de35984815576793f579ec27248609e75976e Author: Vincent Guittot Date: Tue Feb 18 15:45:34 2020 +0100 sched/fair: Fix statistics for find_idlest_group() sgs->group_weight is not set while gathering statistics in update_sg_wakeup_stats(). This means that a group can be classified as fully busy with 0 running tasks if utilization is high enough. This path is mainly used for fork and exec. Fixes: 57abff067a08 ("sched/fair: Rework find_idlest_group()") Signed-off-by: Vincent Guittot Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Acked-by: Mel Gorman Link: https://lore.kernel.org/r/20200218144534.4564-1-vincent.guittot@linaro.org commit f5739cb0b56590d68d8df8a44659893b6d0084c3 Author: Rafael J. Wysocki Date: Wed Feb 26 22:39:27 2020 +0100 cpufreq: Fix policy initialization for internal governor drivers Before commit 1e4f63aecb53 ("cpufreq: Avoid creating excessively large stack frames") the initial value of the policy field in struct cpufreq_policy set by the driver's ->init() callback was implicitly passed from cpufreq_init_policy() to cpufreq_set_policy() if the default governor was neither "performance" nor "powersave". After that commit, however, cpufreq_init_policy() must take that case into consideration explicitly and handle it as appropriate, so make that happen. Fixes: 1e4f63aecb53 ("cpufreq: Avoid creating excessively large stack frames") Link: https://lore.kernel.org/linux-pm/39fb762880c27da110086741315ca8b111d781cd.camel@gmail.com/ Reported-by: Artem Bityutskiy Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar commit a2f2ef4a54c0d97aa6a8386f4ff23f36ebb488cf Author: Karsten Graul Date: Wed Feb 26 17:52:46 2020 +0100 net/smc: check for valid ib_client_data In smc_ib_remove_dev() check if the provided ib device was actually initialized for SMC before. Reported-by: syzbot+84484ccebdd4e5451d91@syzkaller.appspotmail.com Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client") Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 474a31e13a4e9749fb3ee55794d69d0f17ee0998 Author: Aaro Koskinen Date: Wed Feb 26 18:49:01 2020 +0200 net: stmmac: fix notifier registration We cannot register the same netdev notifier multiple times when probing stmmac devices. Register the notifier only once in module init, and also make debugfs creation/deletion safe against simultaneous notifier call. Fixes: 481a7d154cbb ("stmmac: debugfs entry name is not be changed when udev rename device name.") Signed-off-by: Aaro Koskinen Signed-off-by: David S. Miller commit c87a9d6fc6d555e4981f2ded77d9a8cce950743e Author: Antoine Tenart Date: Wed Feb 26 16:26:50 2020 +0100 net: phy: mscc: fix firmware paths The firmware paths for the VSC8584 PHYs not not contain the leading 'microchip/' directory, as used in linux-firmware, resulting in an error when probing the driver. This patch fixes it. Fixes: a5afc1678044 ("net: phy: mscc: add support for VSC8584 PHY") Signed-off-by: Antoine Tenart Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit be4e3c737eebd75815633f4b8fd766defaf0f1fc Author: Tony Lindgren Date: Sun Sep 15 13:15:52 2019 -0700 phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling We have an interrupt handler for the wake-up GPIO pin, but we're missing the code to wake-up the system. This can cause timeouts receiving data for the UART that shares the wake-up GPIO pin with the USB PHY. All we need to do is just wake the system and kick the autosuspend timeout to fix the issue. Fixes: 5d1ebbda0318 ("phy: mapphone-mdm6600: Add USB PHY driver for MDM6600 on Droid 4") Cc: Marcel Partap Cc: Merlijn Wajer Cc: Michael Scott Cc: NeKit Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit dc24f8b4ecd3d6c4153a1ec1bc2006ab32a41b8d Author: Paolo Abeni Date: Wed Feb 26 12:19:03 2020 +0100 mptcp: add dummy icsk_sync_mss() syzbot noted that the master MPTCP socket lacks the icsk_sync_mss callback, and was able to trigger a null pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8e171067 P4D 8e171067 PUD 93fa2067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8984 Comm: syz-executor066 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc900020b7b80 EFLAGS: 00010246 RAX: 1ffff110124ba600 RBX: 0000000000000000 RCX: ffff88809fefa600 RDX: ffff8880994cdb18 RSI: 0000000000000000 RDI: ffff8880925d3140 RBP: ffffc900020b7bd8 R08: ffffffff870225be R09: fffffbfff140652a R10: fffffbfff140652a R11: 0000000000000000 R12: ffff8880925d35d0 R13: ffff8880925d3140 R14: dffffc0000000000 R15: 1ffff110124ba6ba FS: 0000000001a0b880(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a6d6f000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: cipso_v4_sock_setattr+0x34b/0x470 net/ipv4/cipso_ipv4.c:1888 netlbl_sock_setattr+0x2a7/0x310 net/netlabel/netlabel_kapi.c:989 smack_netlabel security/smack/smack_lsm.c:2425 [inline] smack_inode_setsecurity+0x3da/0x4a0 security/smack/smack_lsm.c:2716 security_inode_setsecurity+0xb2/0x140 security/security.c:1364 __vfs_setxattr_noperm+0x16f/0x3e0 fs/xattr.c:197 vfs_setxattr fs/xattr.c:224 [inline] setxattr+0x335/0x430 fs/xattr.c:451 __do_sys_fsetxattr fs/xattr.c:506 [inline] __se_sys_fsetxattr+0x130/0x1b0 fs/xattr.c:495 __x64_sys_fsetxattr+0xbf/0xd0 fs/xattr.c:495 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x440199 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffcadc19e48 EFLAGS: 00000246 ORIG_RAX: 00000000000000be RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440199 RDX: 0000000020000200 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000003 R09: 00000000004002c8 R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000401a20 R13: 0000000000401ab0 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: CR2: 0000000000000000 Address the issue adding a dummy icsk_sync_mss callback. To properly sync the subflows mss and options list we need some additional infrastructure, which will land to net-next. Reported-by: syzbot+f4dfece964792d80b139@syzkaller.appspotmail.com Fixes: 2303f994b3e1 ("mptcp: Associate MPTCP context with TCP socket") Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: David S. Miller commit 4f31c532ad400a34dbdd836c204ed964d1ec2da5 Author: Sudheesh Mavila Date: Wed Feb 26 12:40:45 2020 +0530 net: phy: corrected the return value for genphy_check_and_restart_aneg and genphy_c45_check_and_restart_aneg When auto-negotiation is not required, return value should be zero. Changes v1->v2: - improved comments and code as Andrew Lunn and Heiner Kallweit suggestion - fixed issue in genphy_c45_check_and_restart_aneg as Russell King suggestion. Fixes: 2a10ab043ac5 ("net: phy: add genphy_check_and_restart_aneg()") Fixes: 1af9f16840e9 ("net: phy: add genphy_c45_check_and_restart_aneg()") Signed-off-by: Sudheesh Mavila Reviewed-by: Heiner Kallweit Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit f596c87005f7b1baeb7d62d9a9e25d68c3dfae10 Author: yangerkun Date: Wed Feb 26 11:54:35 2020 +0800 slip: not call free_netdev before rtnl_unlock in slip_open As the description before netdev_run_todo, we cannot call free_netdev before rtnl_unlock, fix it by reorder the code. Signed-off-by: yangerkun Reviewed-by: Oliver Hartkopp Signed-off-by: David S. Miller commit b6f6118901d1e867ac9177bbff3b00b185bd4fdc Author: Eric Dumazet Date: Tue Feb 25 11:52:29 2020 -0800 ipv6: restrict IPV6_ADDRFORM operation IPV6_ADDRFORM is able to transform IPv6 socket to IPv4 one. While this operation sounds illogical, we have to support it. One of the things it does for TCP socket is to switch sk->sk_prot to tcp_prot. We now have other layers playing with sk->sk_prot, so we should make sure to not interfere with them. This patch makes sure sk_prot is the default pointer for TCP IPv6 socket. syzbot reported : BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD a0113067 P4D a0113067 PUD a8771067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10686 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_release+0x165/0x1c0 net/ipv4/af_inet.c:427 __sock_release net/socket.c:605 [inline] sock_close+0xe1/0x260 net/socket.c:1283 __fput+0x2e4/0x740 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:313 task_work_run+0x176/0x1b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:164 [inline] prepare_exit_to_usermode+0x480/0x5b0 arch/x86/entry/common.c:195 syscall_return_slowpath+0x113/0x4a0 arch/x86/entry/common.c:278 do_syscall_64+0x11f/0x1c0 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c429 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2ae75dac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: 0000000000000000 RBX: 00007f2ae75db6d4 RCX: 000000000045c429 RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000004 RBP: 000000000076bf20 R08: 0000000000000038 R09: 0000000000000000 R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000a9d R14: 00000000004ccfb4 R15: 000000000076bf2c Modules linked in: CR2: 0000000000000000 ---[ end trace 82567b5207e87bae ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Eric Dumazet Reported-by: syzbot+1938db17e275e85dc328@syzkaller.appspotmail.com Cc: Daniel Borkmann Signed-off-by: David S. Miller commit 51e3dfa8906ace90c809235b3d3afebc166b6433 Author: Ursula Braun Date: Tue Feb 25 16:34:36 2020 +0100 net/smc: fix cleanup for linkgroup setup failures If an SMC connection to a certain peer is setup the first time, a new linkgroup is created. In case of setup failures, such a linkgroup is unusable and should disappear. As a first step the linkgroup is removed from the linkgroup list in smc_lgr_forget(). There are 2 problems: smc_listen_decline() might be called before linkgroup creation resulting in a crash due to calling smc_lgr_forget() with parameter NULL. If a setup failure occurs after linkgroup creation, the connection is never unregistered from the linkgroup, preventing linkgroup freeing. This patch introduces an enhanced smc_lgr_cleanup_early() function which * contains a linkgroup check for early smc_listen_decline() invocations * invokes smc_conn_free() to guarantee unregistering of the connection. * schedules fast linkgroup removal of the unusable linkgroup And the unused function smcd_conn_free() is removed from smc_core.h. Fixes: 3b2dec2603d5b ("net/smc: restructure client and server code in af_smc") Fixes: 2a0674fffb6bc ("net/smc: improve abnormal termination of link groups") Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 402482a6a78e5c61d8a2ec6311fc5b4aca392cd6 Author: Nicolas Saenz Julienne Date: Tue Feb 25 14:11:59 2020 +0100 net: bcmgenet: Clear ID_MODE_DIS in EXT_RGMII_OOB_CTRL when not needed Outdated Raspberry Pi 4 firmware might configure the external PHY as rgmii although the kernel currently sets it as rgmii-rxid. This makes connections unreliable as ID_MODE_DIS is left enabled. To avoid this, explicitly clear that bit whenever we don't need it. Fixes: da38802211cc ("net: bcmgenet: Add RGMII_RXID support") Signed-off-by: Nicolas Saenz Julienne Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 1521a67e6016664941f0917d50cb20053a8826a2 Author: Jiri Pirko Date: Tue Feb 25 13:54:12 2020 +0100 sched: act: count in the size of action flags bitfield The put of the flags was added by the commit referenced in fixes tag, however the size of the message was not extended accordingly. Fix this by adding size of the flags bitfield to the message size. Fixes: e38226786022 ("net: sched: update action implementations to support flags") Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit eabc8bcb292fb9a5757b0c8ab7751f41b0a104f8 Author: Masahiro Yamada Date: Thu Feb 27 02:44:58 2020 +0900 kbuild: get rid of trailing slash from subdir- example obj-* needs a trailing slash for a directory, but subdir-* does not. Signed-off-by: Masahiro Yamada commit 2eb51c75dcb354f8aef03d7648318b24630632e1 Author: Madhuparna Bhowmik Date: Tue Feb 25 17:57:45 2020 +0530 net: core: devlink.c: Use built-in RCU list checking list_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled. The devlink->lock is held when devlink_dpipe_table_find() is called in non RCU read side section. Therefore, pass struct devlink to devlink_dpipe_table_find() for lockdep checking. Signed-off-by: Madhuparna Bhowmik Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 98c5f7d44fef309e692c24c6d71131ee0f0871fb Author: Florian Fainelli Date: Mon Feb 24 15:56:32 2020 -0800 net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec We are still experiencing some packet loss with the existing advanced congestion buffering (ACB) settings with the IMP port configured for 2Gb/sec, so revert to conservative link speeds that do not produce packet loss until this is resolved. Fixes: 8f1880cbe8d0 ("net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec") Fixes: de34d7084edd ("net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port") Signed-off-by: Florian Fainelli Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller commit 574b238f64594cc0d87aad3f716ebab49fb663fa Merge: 9a005c3898aa 99b79c3900d4 Author: David S. Miller Date: Wed Feb 26 16:30:17 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes: 1) Perform garbage collection from workqueue to fix rcu detected stall in ipset hash set types, from Jozsef Kadlecsik. 2) Fix the forceadd evaluation path, also from Jozsef. 3) Fix nft_set_pipapo selftest, from Stefano Brivio. 4) Crash when add-flush-add element in pipapo set, also from Stefano. Add test to cover this crash. 5) Remove sysctl entry under mutex in hashlimit, from Cong Wang. ==================== Signed-off-by: David S. Miller commit bfdc6d91a25f4545bcd1b12e3219af4838142ef1 Merge: 91ad64a84e9e 0cbb4f9c6982 Author: Linus Torvalds Date: Wed Feb 26 15:54:52 2020 -0800 Merge tag 'tag-chrome-platform-fixes-for-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform fix from Benson Leung: "Fix a build warning" * tag 'tag-chrome-platform-fixes-for-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: wilco_ec: Include asm/unaligned instead of linux/ path commit 9a005c3898aa07cd5cdca77b7096814e6c478c92 Author: Jonathan Lemon Date: Mon Feb 24 15:29:09 2020 -0800 bnxt_en: add newline to netdev_*() format strings Add missing newlines to netdev_* format strings so the lines aren't buffered by the printk subsystem. Nitpicked-by: Jakub Kicinski Signed-off-by: Jonathan Lemon Acked-by: Michael Chan Signed-off-by: David S. Miller commit 99b79c3900d4627672c85d9f344b5b0f06bc2a4d Author: Cong Wang Date: Wed Feb 12 22:53:52 2020 -0800 netfilter: xt_hashlimit: unregister proc file before releasing mutex Before releasing the global mutex, we only unlink the hashtable from the hash list, its proc file is still not unregistered at this point. So syzbot could trigger a race condition where a parallel htable_create() could register the same file immediately after the mutex is released. Move htable_remove_proc_entry() back to mutex protection to fix this. And, fold htable_destroy() into htable_put() to make the code slightly easier to understand. Reported-and-tested-by: syzbot+d195fd3b9a364ddd6731@syzkaller.appspotmail.com Fixes: c4a3922d2d20 ("netfilter: xt_hashlimit: reduce hashlimit_mutex scope for htable_put()") Signed-off-by: Cong Wang Signed-off-by: Pablo Neira Ayuso commit 8e9a400c706ee5bcbc052d3ec9f87cfdbbd3f5cb Merge: 238734262142 b549c252b129 Author: Jani Nikula Date: Wed Feb 26 22:58:24 2020 +0200 Merge tag 'gvt-fixes-2020-02-26' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2020-02-26 - Fix virtual display reset (Tina) - Fix one use-after-free for dmabuf (Tina) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20200226103016.GC10413@zhen-hp.sh.intel.com commit e34f1753eebc428c312527662eb1b529cf260240 Author: Michal Kubecek Date: Mon Feb 24 20:42:12 2020 +0100 ethtool: limit bitset size Syzbot reported that ethnl_compact_sanity_checks() can be tricked into reading past the end of ETHTOOL_A_BITSET_VALUE and ETHTOOL_A_BITSET_MASK attributes and even the message by passing a value between (u32)(-31) and (u32)(-1) as ETHTOOL_A_BITSET_SIZE. The problem is that DIV_ROUND_UP(attr_nbits, 32) is 0 for such values so that zero length ETHTOOL_A_BITSET_VALUE will pass the length check but ethnl_bitmap32_not_zero() check would try to access up to 512 MB of attribute "payload". Prevent this overflow byt limiting the bitset size. Technically, compact bitset format would allow bitset sizes up to almost 2^18 (so that the nest size does not exceed U16_MAX) but bitsets used by ethtool are much shorter. S16_MAX, the largest value which can be directly used as an upper limit in policy, should be a reasonable compromise. Fixes: 10b518d4e6dd ("ethtool: netlink bitset handling") Reported-by: syzbot+7fd4ed5b4234ab1fdccd@syzkaller.appspotmail.com Reported-by: syzbot+709b7a64d57978247e44@syzkaller.appspotmail.com Reported-by: syzbot+983cb8fb2d17a7af549d@syzkaller.appspotmail.com Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit 6e11d1578fba8d09d03a286740ffcf336d53928c Author: Amritha Nambiar Date: Mon Feb 24 10:56:00 2020 -0800 net: Fix Tx hash bound checking Fixes the lower and upper bounds when there are multiple TCs and traffic is on the the same TC on the same device. The lower bound is represented by 'qoffset' and the upper limit for hash value is 'qcount + qoffset'. This gives a clean Rx to Tx queue mapping when there are multiple TCs, as the queue indices for upper TCs will be offset by 'qoffset'. v2: Fixed commit description based on comments. Fixes: 1b837d489e06 ("net: Revoke export for __skb_tx_hash, update it to just be static skb_tx_hash") Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx") Signed-off-by: Amritha Nambiar Reviewed-by: Alexander Duyck Reviewed-by: Sridhar Samudrala Signed-off-by: David S. Miller commit eb12c957735b582607e5842a06d1f4c62e185c1d Author: Daniel Vetter Date: Sat Feb 22 18:54:32 2020 +0100 drm/radeon: Inline drm_get_pci_dev It's the last user, and more importantly, it's the last non-legacy user of anything in drm_pci.c. The only tricky bit is the agp initialization. But a close look shows that radeon does not use the drm_agp midlayer (the main use of that is drm_bufs for legacy drivers), and instead could use the agp subsystem directly (like nouveau does already). Hence we can just pull this in too. A further step would be to entirely drop the use of drm_device->agp, but feels like too much churn just for this patch. Signed-off-by: Daniel Vetter Cc: Alex Deucher Cc: "Christian König" Cc: "David (ChunMing) Zhou" Cc: amd-gfx@lists.freedesktop.org Reviewed-by: Alex Deucher Reviewed-by: Emil Velikov Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8a3bddf67ce88b96531fb22c5a75d7f4dc41d155 Author: Daniel Vetter Date: Sat Feb 22 18:54:31 2020 +0100 drm/amdgpu: Drop DRIVER_USE_AGP This doesn't do anything except auto-init drm_agp support when you call drm_get_pci_dev(). Which amdgpu stopped doing with commit b58c11314a1706bf094c489ef5cb28f76478c704 Author: Alex Deucher Date: Fri Jun 2 17:16:31 2017 -0400 drm/amdgpu: drop deprecated drm_get_pci_dev and drm_put_dev No idea whether this was intentional or accidental breakage, but I guess anyone who manages to boot a this modern gpu behind an agp bridge deserves a price. A price I never expect anyone to ever collect :-) Cc: Alex Deucher Cc: "Christian König" Cc: Hawking Zhang Cc: Xiaojie Yuan Cc: Evan Quan Cc: "Tianci.Yin" Cc: "Marek Olšák" Cc: Hans de Goede Reviewed-by: Emil Velikov Reviewed-by: Alex Deucher Signed-off-by: Daniel Vetter Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 51c22d7b40dca8b39a33b2c3b03f13122a2a1af3 Author: Tony Lindgren Date: Fri Feb 21 09:29:45 2020 -0800 ARM: OMAP2+: Fix compile if CONFIG_HAVE_ARM_SMCCC is not set Recent omap changes added runtime checks to use omap_smccc_smc() when optee is configured in dts. As the omap-secure code can be built for ARMv6 only without ARMv7 and use custom smc calls, we now get a build error: omap-secure.c:(.text+0x94): undefined reference to `__arm_smccc_smc' As there secure calls are not used for ARMv6, we should not build secure-common, and not call omap_secure_init() for omap2. Fixes: c37baa06f8a9 ("ARM: OMAP2+: Fix undefined reference to omap_secure_init") Reported-by: kbuild test robot Cc: Aaro Koskinen Cc: Andrew F. Davis Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Marc Zyngier Cc: Rob Herring Cc: Russell King Cc: Steven Price Cc: Will Deacon Signed-off-by: Tony Lindgren commit 5267244ddc62496f1537afffef70e6e2e7d5764c Merge: fa63c0039787 aec551c7a00f Author: Tony Lindgren Date: Wed Feb 26 10:48:42 2020 -0800 Merge tag 'hdq-fix' into omap-for-v5.6/fixes-rc2 commit 683f65ded66a9a7ff01ed7280804d2132ebfdf7e Author: Evan Green Date: Tue Feb 11 14:37:00 2020 -0800 spi: pxa2xx: Add CS control clock quirk In some circumstances on Intel LPSS controllers, toggling the LPSS CS control register doesn't actually cause the CS line to toggle. This seems to be failure of dynamic clock gating that occurs after going through a suspend/resume transition, where the controller is sent through a reset transition. This ruins SPI transactions that either rely on delay_usecs, or toggle the CS line without sending data. Whenever CS is toggled, momentarily set the clock gating register to "Force On" to poke the controller into acting on CS. Signed-off-by: Rajat Jain Signed-off-by: Evan Green Link: https://lore.kernel.org/r/20200211223700.110252-1-rajatja@google.com Signed-off-by: Mark Brown commit fa63c0039787b8fbacf4d6a51e3ff44288f5b90b Author: Faiz Abbas Date: Tue Jan 28 19:17:59 2020 +0530 arm: dts: dra76x: Fix mmc3 max-frequency dra76x is not affected by i887 which requires mmc3 node to be limited to a max frequency of 64 MHz. Fix this by overwriting the correct value in the the dra76 specific dtsi. Fixes: 895bd4b3e5ec ("ARM: dts: Add support for dra76-evm") Cc: stable@vger.kernel.org Signed-off-by: Faiz Abbas Signed-off-by: Tony Lindgren commit 27f13774654ea6bd0b6fc9b97cce8d19e5735661 Author: Kishon Vijay Abraham I Date: Tue Jan 28 12:11:47 2020 +0530 ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes 'dma-ranges' in a PCI bridge node does correctly set dma masks for PCI devices not described in the DT. Certain DRA7 platforms (e.g., DRA76) has RAM above 32-bit boundary (accessible with LPAE config) though the PCIe bridge will be able to access only 32-bits. Add 'dma-ranges' property in PCIe RC DT nodes to indicate the host bridge can access only 32 bits. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Tony Lindgren commit 91ad64a84e9e63e2906ae714dfa3933dd3f64c64 Merge: b98cce1ef5c5 2910b5aa6f54 Author: Linus Torvalds Date: Wed Feb 26 10:34:42 2020 -0800 Merge tag 'trace-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing and bootconfig updates: "Fixes and changes to bootconfig before it goes live in a release. Change in API of bootconfig (before it comes live in a release): - Have a magic value "BOOTCONFIG" in initrd to know a bootconfig exists - Set CONFIG_BOOT_CONFIG to 'n' by default - Show error if "bootconfig" on cmdline but not compiled in - Prevent redefining the same value - Have a way to append values - Added a SELECT BLK_DEV_INITRD to fix a build failure Synthetic event fixes: - Switch to raw_smp_processor_id() for recording CPU value in preempt section. (No care for what the value actually is) - Fix samples always recording u64 values - Fix endianess - Check number of values matches number of fields - Fix a printing bug Fix of trace_printk() breaking postponed start up tests Make a function static that is only used in a single file" * tag 'trace-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: bootconfig: Fix CONFIG_BOOTTIME_TRACING dependency issue bootconfig: Add append value operator support bootconfig: Prohibit re-defining value on same key bootconfig: Print array as multiple commands for legacy command line bootconfig: Reject subkey and value on same parent key tools/bootconfig: Remove unneeded error message silencer bootconfig: Add bootconfig magic word for indicating bootconfig explicitly bootconfig: Set CONFIG_BOOT_CONFIG=n by default tracing: Clear trace_state when starting trace bootconfig: Mark boot_config_checksum() static tracing: Disable trace_printk() on post poned tests tracing: Have synthetic event test use raw_smp_processor_id() tracing: Fix number printing bug in print_synth_event() tracing: Check that number of vals matches number of synth event fields tracing: Make synth_event trace functions endian-correct tracing: Make sure synth_event_trace() example always uses u64 commit b98cce1ef5c5ecb8028531ec2305c4591c9b6ca1 Merge: 2fcc74178f6d be886ba90cce Author: Linus Torvalds Date: Wed Feb 26 10:28:59 2020 -0800 Merge tag 'linux-kselftest-kunit-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kunit fixes from Shuah Khan: "This Kselftest kunit update consists of fixes to documentation and the run-time tool from Brendan Higgins and Heidi Fahim" * tag 'linux-kselftest-kunit-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: run kunit_tool from any directory kunit: test: Improve error messages for kunit_tool when kunitconfig is invalid Documentation: kunit: fixed sphinx error in code block commit 2fcc74178f6dc06ecffcd1f601ca3a3e87b3012c Merge: cfe2ce49b9da ef89d0545132 Author: Linus Torvalds Date: Wed Feb 26 10:06:56 2020 -0800 Merge tag 'linux-kselftest-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: - fixes to TIMEOUT failures and out-of-tree compilation compilation errors from Michael Ellerman. - declutter git status fix from Christophe Leroy * tag 'linux-kselftest-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/rseq: Fix out-of-tree compilation selftests: Install settings files to fix TIMEOUT failures selftest/lkdtm: Don't pollute 'git status' commit aec551c7a00fb7eae049c0c4cc3208ca53e26355 Author: Tony Lindgren Date: Mon Feb 24 12:58:03 2020 -0800 bus: ti-sysc: Fix 1-wire reset quirk Because of the i2c quirk we have the reset quirks named in a confusing way. Let's fix the 1-wire quirk accordinlyg. Then let's switch to using better naming later on. Fixes: 4e23be473e30 ("bus: ti-sysc: Add support for module specific reset quirks") Signed-off-by: Tony Lindgren commit cfe2ce49b9da3959015e94b08f7494ade3ee0c49 Author: Christoph Hellwig Date: Wed Feb 26 07:39:29 2020 -0800 Revert "KVM: x86: enable -Werror" This reverts commit ead68df94d248c80fdbae220ae5425eb5af2e753. Using the -Werror flag breaks the build for me due to mostly harmless KASAN or similar warnings: arch/x86/kvm/x86.c: In function ‘kvm_timer_init’: arch/x86/kvm/x86.c:7209:1: error: the frame size of 1112 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Feel free to add a CONFIG_WERROR if you care strong enough, but don't break peoples builds for absolutely no good reason. Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit fda31c50292a5062332fa0343c084bd9f46604d9 Author: Linus Torvalds Date: Mon Feb 24 12:47:14 2020 -0800 signal: avoid double atomic counter increments for user accounting When queueing a signal, we increment both the users count of pending signals (for RLIMIT_SIGPENDING tracking) and we increment the refcount of the user struct itself (because we keep a reference to the user in the signal structure in order to correctly account for it when freeing). That turns out to be fairly expensive, because both of them are atomic updates, and particularly under extreme signal handling pressure on big machines, you can get a lot of cache contention on the user struct. That can then cause horrid cacheline ping-pong when you do these multiple accesses. So change the reference counting to only pin the user for the _first_ pending signal, and to unpin it when the last pending signal is dequeued. That means that when a user sees a lot of concurrent signal queuing - which is the only situation when this matters - the only atomic access needed is generally the 'sigpending' count update. This was noticed because of a particularly odd timing artifact on a dual-socket 96C/192T Cascade Lake platform: when you get into bad contention, on that machine for some reason seems to be much worse when the contention happens in the upper 32-byte half of the cacheline. As a result, the kernel test robot will-it-scale 'signal1' benchmark had an odd performance regression simply due to random alignment of the 'struct user_struct' (and pointed to a completely unrelated and apparently nonsensical commit for the regression). Avoiding the double increments (and decrements on the dequeueing side, of course) makes for much less contention and hugely improved performance on that will-it-scale microbenchmark. Quoting Feng Tang: "It makes a big difference, that the performance score is tripled! bump from original 17000 to 54000. Also the gap between 5.0-rc6 and 5.0-rc6+Jiri's patch is reduced to around 2%" [ The "2% gap" is the odd cacheline placement difference on that platform: under the extreme contention case, the effect of which half of the cacheline was hot was 5%, so with the reduced contention the odd timing artifact is reduced too ] It does help in the non-contended case too, but is not nearly as noticeable. Reported-and-tested-by: Feng Tang Cc: Eric W. Biederman Cc: Huang, Ying Cc: Philip Li Cc: Andi Kleen Cc: Jiri Olsa Cc: Peter Zijlstra Signed-off-by: Linus Torvalds commit dd3db2a34cff14e152da7c8e320297719a35abf9 Author: Jens Axboe Date: Wed Feb 26 10:23:43 2020 -0700 io_uring: drop file set ref put/get on switch Dan reports that he triggered a warning on ring exit doing some testing: percpu ref (io_file_data_ref_zero) <= 0 (0) after switching to atomic WARNING: CPU: 3 PID: 0 at lib/percpu-refcount.c:160 percpu_ref_switch_to_atomic_rcu+0xe8/0xf0 Modules linked in: CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.6.0-rc3+ #5648 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:percpu_ref_switch_to_atomic_rcu+0xe8/0xf0 Code: e7 ff 55 e8 eb d2 80 3d bd 02 d2 00 00 75 8b 48 8b 55 d8 48 c7 c7 e8 70 e6 81 c6 05 a9 02 d2 00 01 48 8b 75 e8 e8 3a d0 c5 ff <0f> 0b e9 69 ff ff ff 90 55 48 89 fd 53 48 89 f3 48 83 ec 28 48 83 RSP: 0018:ffffc90000110ef8 EFLAGS: 00010292 RAX: 0000000000000045 RBX: 7fffffffffffffff RCX: 0000000000000000 RDX: 0000000000000045 RSI: ffffffff825be7a5 RDI: ffffffff825bc32c RBP: ffff8881b75eac38 R08: 000000042364b941 R09: 0000000000000045 R10: ffffffff825beb40 R11: ffffffff825be78a R12: 0000607e46005aa0 R13: ffff888107dcdd00 R14: 0000000000000000 R15: 0000000000000009 FS: 0000000000000000(0000) GS:ffff8881b9d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f49e6a5ea20 CR3: 00000001b747c004 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_core+0x1e4/0x4d0 __do_softirq+0xdb/0x2f1 irq_exit+0xa0/0xb0 smp_apic_timer_interrupt+0x60/0x140 apic_timer_interrupt+0xf/0x20 RIP: 0010:default_idle+0x23/0x170 Code: ff eb ab cc cc cc cc 0f 1f 44 00 00 41 54 55 53 65 8b 2d 10 96 92 7e 0f 1f 44 00 00 e9 07 00 00 00 0f 00 2d 21 d0 51 00 fb f4 <65> 8b 2d f6 95 92 7e 0f 1f 44 00 00 5b 5d 41 5c c3 65 8b 05 e5 95 Turns out that this is due to percpu_ref_switch_to_atomic() only grabbing a reference to the percpu refcount if it's not already in atomic mode. io_uring drops a ref and re-gets it when switching back to percpu mode. We attempt to protect against this with the FFD_F_ATOMIC bit, but that isn't reliable. We don't actually need to juggle these refcounts between atomic and percpu switch, we can just do them when we've switched to atomic mode. This removes the need for FFD_F_ATOMIC, which wasn't reliable. Fixes: 05f3fb3c5397 ("io_uring: avoid ring quiesce for fixed file set unregister and update") Reported-by: Dan Melnic Signed-off-by: Jens Axboe commit cae740a04b4d6d5166f19ee5faf04ea2a1f34b3d Author: John Garry Date: Wed Feb 26 20:10:15 2020 +0800 blk-mq: Remove some unused function arguments The struct blk_mq_hw_ctx pointer argument in blk_mq_put_tag(), blk_mq_poll_nsecs(), and blk_mq_poll_hybrid_sleep() is unused, so remove it. Overall obj code size shows a minor reduction, before: text data bss dec hex filename 27306 1312 0 28618 6fca block/blk-mq.o 4303 272 0 4575 11df block/blk-mq-tag.o after: 27282 1312 0 28594 6fb2 block/blk-mq.o 4311 272 0 4583 11e7 block/blk-mq-tag.o Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Signed-off-by: John Garry -- This minor patch had been carried as part of the blk-mq shared tags RFC, I'd rather not carry it anymore as it required rebasing, so now or never.. Signed-off-by: Jens Axboe commit c473a8d03ea8e03ca9d649b0b6d72fbcf6212c05 Author: Masahiro Yamada Date: Sun Feb 23 04:04:34 2020 +0900 kbuild: add dt_binding_check to PHONY in a correct place The dt_binding_check is added to PHONY, but it is invisible when $(dtstree) is empty. So, it is not specified as phony for ARCH=x86 etc. Add it to PHONY outside the ifneq ... endif block. Signed-off-by: Masahiro Yamada Acked-by: Rob Herring commit 964a596db8db8c77c9903dd05655696696e6b3ad Author: Masahiro Yamada Date: Sun Feb 23 04:04:33 2020 +0900 kbuild: add dtbs_check to PHONY The dtbs_check should be a phony target, but currently it is not specified so. 'make dtbs_check' works even if a file named 'dtbs_check' exists because it depends on another phony target, scripts_dtc, but we should not rely on it. Add dtbs_check to PHONY. Signed-off-by: Masahiro Yamada Acked-by: Rob Herring commit fd63fab48f143f73b534821408a303241ed174f9 Author: Masahiro Yamada Date: Sun Feb 23 04:04:32 2020 +0900 kbuild: remove unneeded semicolon at the end of cmd_dtb_check This trailing semicolon is unneeded. Signed-off-by: Masahiro Yamada Acked-by: Rob Herring commit 7a04960560640ac5b0b89461f7757322b57d0c7a Author: Masahiro Yamada Date: Sun Feb 23 04:04:31 2020 +0900 kbuild: fix DT binding schema rule to detect command line changes This if_change_rule is not working properly; it cannot detect any command line change. The reason is because cmd-check in scripts/Kbuild.include compares $(cmd_$@) and $(cmd_$1), but cmd_dtc_dt_yaml does not exist here. For if_change_rule to work properly, the stem part of cmd_* and rule_* must match. Because this cmd_and_fixdep invokes cmd_dtc, this rule must be named rule_dtc. Fixes: 4f0e3a57d6eb ("kbuild: Add support for DT binding schema checks") Signed-off-by: Masahiro Yamada Acked-by: Rob Herring commit eccbde4f6c2b6ebc52b3e9103e6f2f73f5a9f79a Author: Masahiro Yamada Date: Wed Feb 19 10:15:19 2020 +0900 kbuild: remove wrong documentation about mandatory-y This sentence does not make sense in the section about mandatory-y. This seems to be a copy-paste mistake of commit fcc8487d477a ("uapi: export all headers under uapi directories"). The correct description would be "The convention is to list one mandatory-y per line ...". I just removed it instead of fixing it. If such information is needed, it could be commented in include/asm-generic/Kbuild and include/uapi/asm-generic/Kbuild. Signed-off-by: Masahiro Yamada commit 505b12b3861bc79d1b81c815faaf4910469a7006 Author: Randy Dunlap Date: Wed Feb 12 20:40:57 2020 -0800 kbuild: add comment for V=2 mode Complete the comments for valid values of KBUILD_VERBOSE, specifically for KBUILD_VERBOSE=2. Signed-off-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit 38b6a714941a285319734b9ccc30d34e107d5d7e Author: Dan Murphy Date: Wed Feb 26 07:03:05 2020 -0600 ASoC: tas2562: Fix sample rate error message Fix error message for setting the sample rate. It says bitwidth but should say sample rate. Signed-off-by: Dan Murphy Link: https://lore.kernel.org/r/20200226130305.12043-3-dmurphy@ti.com Signed-off-by: Mark Brown commit be36f9e7517e17810ec369626a128d7948942259 Author: Jason A. Donenfeld Date: Fri Feb 21 09:48:49 2020 +0100 efi: READ_ONCE rng seed size before munmap This function is consistent with using size instead of seed->size (except for one place that this patch fixes), but it reads seed->size without using READ_ONCE, which means the compiler might still do something unwanted. So, this commit simply adds the READ_ONCE wrapper. Fixes: 636259880a7e ("efi: Add support for seeding the RNG from a UEFI ...") Signed-off-by: Jason A. Donenfeld Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: linux-efi@vger.kernel.org Cc: Ingo Molnar Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20200217123354.21140-1-Jason@zx2c4.com Link: https://lore.kernel.org/r/20200221084849.26878-5-ardb@kernel.org commit 8319e9d5ad98ffccd19f35664382c73cea216193 Author: Ard Biesheuvel Date: Fri Feb 21 09:48:48 2020 +0100 efi/x86: Handle by-ref arguments covering multiple pages in mixed mode The mixed mode runtime wrappers are fragile when it comes to how the memory referred to by its pointer arguments are laid out in memory, due to the fact that it translates these addresses to physical addresses that the runtime services can dereference when running in 1:1 mode. Since vmalloc'ed pages (including the vmap'ed stack) are not contiguous in the physical address space, this scheme only works if the referenced memory objects do not cross page boundaries. Currently, the mixed mode runtime service wrappers require that all by-ref arguments that live in the vmalloc space have a size that is a power of 2, and are aligned to that same value. While this is a sensible way to construct an object that is guaranteed not to cross a page boundary, it is overly strict when it comes to checking whether a given object violates this requirement, as we can simply take the physical address of the first and the last byte, and verify that they point into the same physical page. When this check fails, we emit a WARN(), but then simply proceed with the call, which could cause data corruption if the next physical page belongs to a mapping that is entirely unrelated. Given that with vmap'ed stacks, this condition is much more likely to trigger, let's relax the condition a bit, but fail the runtime service call if it does trigger. Fixes: f6697df36bdf0bf7 ("x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y") Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: linux-efi@vger.kernel.org Cc: Ingo Molnar Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20200221084849.26878-4-ardb@kernel.org commit f80c9f6476db6c0802545aaa44eb9a38e751786a Author: Ard Biesheuvel Date: Fri Feb 21 09:48:47 2020 +0100 efi/x86: Remove support for EFI time and counter services in mixed mode Mixed mode calls at runtime are rather tricky with vmap'ed stacks, as we can no longer assume that data passed in by the callers of the EFI runtime wrapper routines is contiguous in physical memory. We need to fix this, but before we do, let's drop the implementations of routines that we know are never used on x86, i.e., the RTC related ones. Given that UEFI rev2.8 permits any runtime service to return EFI_UNSUPPORTED at runtime, let's return that instead. As get_next_high_mono_count() is never used at all, even on other architectures, let's make that return EFI_UNSUPPORTED too. Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: linux-efi@vger.kernel.org Cc: Ingo Molnar Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20200221084849.26878-3-ardb@kernel.org commit 63056e8b5ebf41d52170e9f5ba1fc83d1855278c Author: Ard Biesheuvel Date: Fri Feb 21 09:48:46 2020 +0100 efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper Hans reports that his mixed mode systems running v5.6-rc1 kernels hit the WARN_ON() in virt_to_phys_or_null_size(), caused by the fact that efi_guid_t objects on the vmap'ed stack happen to be misaligned with respect to their sizes. As a quick (i.e., backportable) fix, copy GUID pointer arguments to the local stack into a buffer that is naturally aligned to its size, so that it is guaranteed to cover only one physical page. Note that on x86, we cannot rely on the stack pointer being aligned the way the compiler expects, so we need to allocate an 8-byte aligned buffer of sufficient size, and copy the GUID into that buffer at an offset that is aligned to 16 bytes. Fixes: f6697df36bdf0bf7 ("x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y") Reported-by: Hans de Goede Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Tested-by: Hans de Goede Cc: linux-efi@vger.kernel.org Cc: Ingo Molnar Cc: Thomas Gleixner Link: https://lore.kernel.org/r/20200221084849.26878-2-ardb@kernel.org commit 4c45945aa418f5e2f31cdaf0b1484e146e29f72f Merge: c5f86891185c b103de53e09f Author: Ingo Molnar Date: Wed Feb 26 15:18:05 2020 +0100 Merge tag 'perf-urgent-for-mingo-5.6-20200220' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: auxtrace: Adrian Hunter: - Fix endless record after being terminated on arm-spe. Wei Li: - Fix endless record after being terminated on Intel PT and BTS and on ARM's cs-etm. perf test: Thomas Richter - Fix test trace+probe_vfs_getname.sh on s390 PowerPC: Arnaldo Carvalho de Melo: - Sync powerpc syscall.tbl with the kernel sources. BPF: Arnaldo Carvalho de Melo: - Remove extraneous bpf/ subdir from bpf.h headers used to build bpf events. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 3a9015988b3d41027cda61f4fdeaaeee73be8b24 Author: Jens Axboe Date: Tue Feb 25 17:48:55 2020 -0700 io_uring: import_single_range() returns 0/-ERROR Unlike the other core import helpers, import_single_range() returns 0 on success, not the length imported. This means that links that depend on the result of non-vec based IORING_OP_{READ,WRITE} that were added for 5.5 get errored when they should not be. Fixes: 3a6820f2bb8a ("io_uring: add non-vectored read/write commands") Signed-off-by: Jens Axboe commit 2a44f46781617c5040372b59da33553a02b1f46d Author: Jens Axboe Date: Tue Feb 25 13:25:41 2020 -0700 io_uring: pick up link work on submit reference drop If work completes inline, then we should pick up a dependent link item in __io_queue_sqe() as well. If we don't do so, we're forced to go async with that item, which is suboptimal. This also fixes an issue with io_put_req_find_next(), which always looks up the next work item. That should only be done if we're dropping the last reference to the request, to prevent multiple lookups of the same work item. Outside of being a fix, this also enables a good cleanup series for 5.7, where we never have to pass 'nxt' around or into the work handlers. Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0954df70fba743d8cdaa09ccf6ba8e4ad09628de Author: Stefano Brivio Date: Fri Feb 21 03:04:22 2020 +0100 selftests: nft_concat_range: Add test for reported add/flush/add issue Add a specific test for the crash reported by Phil Sutter and addressed in the previous patch. The test cases that, in my intention, should have covered these cases, that is, the ones from the 'concurrency' section, don't run these sequences tightly enough and spectacularly failed to catch this. While at it, define a convenient way to add these kind of tests, by adding a "reported issues" test section. It's more convenient, for this particular test, to execute the set setup in its own function. However, future test cases like this one might need to call setup functions, and will typically need no tools other than nft, so allow for this in check_tools(). The original form of the reproducer used here was provided by Phil. Reported-by: Phil Sutter Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 212d58c106fd0f2704664be2bb173e14cb4e86d3 Author: Stefano Brivio Date: Fri Feb 21 03:04:21 2020 +0100 nft_set_pipapo: Actually fetch key data in nft_pipapo_remove() Phil reports that adding elements, flushing and re-adding them right away: nft add table t '{ set s { type ipv4_addr . inet_service; flags interval; }; }' nft add element t s '{ 10.0.0.1 . 22-25, 10.0.0.1 . 10-20 }' nft flush set t s nft add element t s '{ 10.0.0.1 . 10-20, 10.0.0.1 . 22-25 }' triggers, almost reliably, a crash like this one: [ 71.319848] general protection fault, probably for non-canonical address 0x6f6b6e696c2e756e: 0000 [#1] PREEMPT SMP PTI [ 71.321540] CPU: 3 PID: 1201 Comm: kworker/3:2 Not tainted 5.6.0-rc1-00377-g2bb07f4e1d861 #192 [ 71.322746] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014 [ 71.324430] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 71.325387] RIP: 0010:nft_set_elem_destroy+0xa5/0x110 [nf_tables] [ 71.326164] Code: 89 d4 84 c0 74 0e 8b 77 44 0f b6 f8 48 01 df e8 41 ff ff ff 45 84 e4 74 36 44 0f b6 63 08 45 84 e4 74 2c 49 01 dc 49 8b 04 24 <48> 8b 40 38 48 85 c0 74 4f 48 89 e7 4c 8b [ 71.328423] RSP: 0018:ffffc9000226fd90 EFLAGS: 00010282 [ 71.329225] RAX: 6f6b6e696c2e756e RBX: ffff88813ab79f60 RCX: ffff88813931b5a0 [ 71.330365] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88813ab79f9a [ 71.331473] RBP: ffff88813ab79f60 R08: 0000000000000008 R09: 0000000000000000 [ 71.332627] R10: 000000000000021c R11: 0000000000000000 R12: ffff88813ab79fc2 [ 71.333615] R13: ffff88813b3adf50 R14: dead000000000100 R15: ffff88813931b8a0 [ 71.334596] FS: 0000000000000000(0000) GS:ffff88813bd80000(0000) knlGS:0000000000000000 [ 71.335780] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.336577] CR2: 000055ac683710f0 CR3: 000000013a222003 CR4: 0000000000360ee0 [ 71.337533] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.338557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.339718] Call Trace: [ 71.340093] nft_pipapo_destroy+0x7a/0x170 [nf_tables_set] [ 71.340973] nft_set_destroy+0x20/0x50 [nf_tables] [ 71.341879] nf_tables_trans_destroy_work+0x246/0x260 [nf_tables] [ 71.342916] process_one_work+0x1d5/0x3c0 [ 71.343601] worker_thread+0x4a/0x3c0 [ 71.344229] kthread+0xfb/0x130 [ 71.344780] ? process_one_work+0x3c0/0x3c0 [ 71.345477] ? kthread_park+0x90/0x90 [ 71.346129] ret_from_fork+0x35/0x40 [ 71.346748] Modules linked in: nf_tables_set nf_tables nfnetlink 8021q [last unloaded: nfnetlink] [ 71.348153] ---[ end trace 2eaa8149ca759bcc ]--- [ 71.349066] RIP: 0010:nft_set_elem_destroy+0xa5/0x110 [nf_tables] [ 71.350016] Code: 89 d4 84 c0 74 0e 8b 77 44 0f b6 f8 48 01 df e8 41 ff ff ff 45 84 e4 74 36 44 0f b6 63 08 45 84 e4 74 2c 49 01 dc 49 8b 04 24 <48> 8b 40 38 48 85 c0 74 4f 48 89 e7 4c 8b [ 71.350017] RSP: 0018:ffffc9000226fd90 EFLAGS: 00010282 [ 71.350019] RAX: 6f6b6e696c2e756e RBX: ffff88813ab79f60 RCX: ffff88813931b5a0 [ 71.350019] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88813ab79f9a [ 71.350020] RBP: ffff88813ab79f60 R08: 0000000000000008 R09: 0000000000000000 [ 71.350021] R10: 000000000000021c R11: 0000000000000000 R12: ffff88813ab79fc2 [ 71.350022] R13: ffff88813b3adf50 R14: dead000000000100 R15: ffff88813931b8a0 [ 71.350025] FS: 0000000000000000(0000) GS:ffff88813bd80000(0000) knlGS:0000000000000000 [ 71.350026] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.350027] CR2: 000055ac683710f0 CR3: 000000013a222003 CR4: 0000000000360ee0 [ 71.350028] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.350028] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.350030] Kernel panic - not syncing: Fatal exception [ 71.350412] Kernel Offset: disabled [ 71.365922] ---[ end Kernel panic - not syncing: Fatal exception ]--- which is caused by dangling elements that have been deactivated, but never removed. On a flush operation, nft_pipapo_walk() walks through all the elements in the mapping table, which are then deactivated by nft_flush_set(), one by one, and added to the commit list for removal. Element data is then freed. On transaction commit, nft_pipapo_remove() is called, and failed to remove these elements, leading to the stale references in the mapping. The first symptom of this, revealed by KASan, is a one-byte use-after-free in subsequent calls to nft_pipapo_walk(), which is usually not enough to trigger a panic. When stale elements are used more heavily, though, such as double-free via nft_pipapo_destroy() as in Phil's case, the problem becomes more noticeable. The issue comes from that fact that, on a flush operation, nft_pipapo_remove() won't get the actual key data via elem->key, elements to be deleted upon commit won't be found by the lookup via pipapo_get(), and removal will be skipped. Key data should be fetched via nft_set_ext_key(), instead. Reported-by: Phil Sutter Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 8c8c06207bcfc5a7e5918fc0a0f7f7b9a2e196d6 Author: Ahzo Date: Tue Feb 25 13:56:14 2020 -0500 drm/ttm: fix leaking fences via ttm_buffer_object_transfer Set the drm_device to NULL, so that the newly created buffer object doesn't appear to use the embedded gem object. This is necessary, because otherwise no corresponding dma_resv_fini for the dma_resv_init is called, resulting in a memory leak. The dma_resv_fini in ttm_bo_release_list is only called if the embedded gem object is not used, which is determined by checking if the drm_device is NULL. Bug: https://gitlab.freedesktop.org/drm/amd/issues/958 Fixes: 1e053b10ba60 ("drm/ttm: use gem reservation object") Reviewed-by: Christian König Signed-off-by: Ahzo Signed-off-by: Alex Deucher Signed-off-by: Christian König Link: https://patchwork.freedesktop.org/patch/355089/ commit 9ea4894ba4492c1afeff3142f34bcf9af706a2e1 Merge: d0820556507b 8af1c6fbd923 Author: Pablo Neira Ayuso Date: Wed Feb 26 13:55:15 2020 +0100 Merge branch 'master' of git://blackhole.kfki.hu/nf Jozsef Kadlecsik says: ==================== ipset patches for nf The first one is larger than usual, but the issue could not be solved simpler. Also, it's a resend of the patch I submitted a few days ago, with a one line fix on top of that: the size of the comment extensions was not taken into account at reporting the full size of the set. - Fix "INFO: rcu detected stall in hash_xxx" reports of syzbot by introducing region locking and using workqueue instead of timer based gc of timed out entries in hash types of sets in ipset. - Fix the forceadd evaluation path - the bug was also uncovered by the syzbot. ==================== Signed-off-by: Pablo Neira Ayuso commit 238734262142075056653b4de091458e0ca858f2 Author: Chris Wilson Date: Fri Feb 21 22:18:18 2020 +0000 drm/i915: Avoid recursing onto active vma from the shrinker We mark the vma as active while binding it in order to protect outselves from being shrunk under mempressure. This only works if we are strict in not attempting to shrink active objects. <6> [472.618968] Workqueue: events_unbound fence_work [i915] <4> [472.618970] Call Trace: <4> [472.618974] ? __schedule+0x2e5/0x810 <4> [472.618978] schedule+0x37/0xe0 <4> [472.618982] schedule_preempt_disabled+0xf/0x20 <4> [472.618984] __mutex_lock+0x281/0x9c0 <4> [472.618987] ? mark_held_locks+0x49/0x70 <4> [472.618989] ? _raw_spin_unlock_irqrestore+0x47/0x60 <4> [472.619038] ? i915_vma_unbind+0xae/0x110 [i915] <4> [472.619084] ? i915_vma_unbind+0xae/0x110 [i915] <4> [472.619122] i915_vma_unbind+0xae/0x110 [i915] <4> [472.619165] i915_gem_object_unbind+0x1dc/0x400 [i915] <4> [472.619208] i915_gem_shrink+0x328/0x660 [i915] <4> [472.619250] ? i915_gem_shrink_all+0x38/0x60 [i915] <4> [472.619282] i915_gem_shrink_all+0x38/0x60 [i915] <4> [472.619325] vm_alloc_page.constprop.25+0x1aa/0x240 [i915] <4> [472.619330] ? rcu_read_lock_sched_held+0x4d/0x80 <4> [472.619363] ? __alloc_pd+0xb/0x30 [i915] <4> [472.619366] ? module_assert_mutex_or_preempt+0xf/0x30 <4> [472.619368] ? __module_address+0x23/0xe0 <4> [472.619371] ? is_module_address+0x26/0x40 <4> [472.619374] ? static_obj+0x34/0x50 <4> [472.619376] ? lockdep_init_map+0x4d/0x1e0 <4> [472.619407] setup_page_dma+0xd/0x90 [i915] <4> [472.619437] alloc_pd+0x29/0x50 [i915] <4> [472.619470] __gen8_ppgtt_alloc+0x443/0x6b0 [i915] <4> [472.619503] gen8_ppgtt_alloc+0xd7/0x300 [i915] <4> [472.619535] ppgtt_bind_vma+0x2a/0xe0 [i915] <4> [472.619577] __vma_bind+0x26/0x40 [i915] <4> [472.619611] fence_work+0x1c/0x90 [i915] <4> [472.619617] process_one_work+0x26a/0x620 Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200221221818.2861432-1-chris@chris-wilson.co.uk (cherry picked from commit 6f24e41022f28061368776ea1514db0a6e67a9b1) Signed-off-by: Jani Nikula commit 2de0147d77168d6a227c00eb9c5a49374e1582a3 Author: Michał Winiarski Date: Wed Feb 19 17:18:22 2020 +0100 drm/i915/pmu: Avoid using globals for PMU events Attempting to bind / unbind module from devices where we have both integrated and discreete GPU handled by i915, will cause us to try and double free the global state, hitting null ptr deref in free_event_attributes. Let's move it to i915_pmu. Fixes: 05488673a4d4 ("drm/i915/pmu: Support multiple GPUs") Signed-off-by: Michał Winiarski Cc: Chris Wilson Cc: Michal Wajdeczko Cc: Tvrtko Ursulin Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200219161822.24592-2-michal.winiarski@intel.com (cherry picked from commit 46129dc10f47c5c2b51c93a82b7b2aca46574ae0) Signed-off-by: Jani Nikula commit 19ee5e8da6129d8d828201a12264ab3d09153ec4 Author: Michał Winiarski Date: Wed Feb 19 17:18:21 2020 +0100 drm/i915/pmu: Avoid using globals for CPU hotplug state Attempting to bind / unbind module from devices where we have both integrated and discreete GPU handled by i915 can lead to leaks and warnings from cpuhp: Error: Removing state XXX which has instances left. Let's move the state to i915_pmu. Fixes: 05488673a4d4 ("drm/i915/pmu: Support multiple GPUs") Signed-off-by: Michał Winiarski Cc: Chris Wilson Cc: Michal Wajdeczko Cc: Tvrtko Ursulin Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200219161822.24592-1-michal.winiarski@intel.com (cherry picked from commit f5a179d4687d4e7bfadd7cbda7ee5d0bad76761f) Signed-off-by: Jani Nikula commit eee18939e5767dbe3a98b3ea172e7fd7ba7d403c Author: Chris Wilson Date: Mon Feb 24 10:11:20 2020 +0000 drm/i915/gtt: Downgrade gen7 (ivb, byt, hsw) back to aliasing-ppgtt Full-ppgtt on gen7 is proving to be highly unstable and not robust. Closes: https://gitlab.freedesktop.org/drm/intel/issues/694 Fixes: 3cd6e8860ecd ("drm/i915/gen7: Re-enable full-ppgtt for ivb & hsw") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Jani Nikula Cc: Dave Airlie Acked-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20200224101120.4024481-1-chris@chris-wilson.co.uk (cherry picked from commit 4fbe112a569526e46fa2accb5763c069f78cb431) Signed-off-by: Jani Nikula commit b5dacc8fb52c690e2cdf7df3ae36bd1cf20e63dd Author: Jani Nikula Date: Fri Feb 21 12:54:14 2020 +0200 drm/i915: fix header test with GCOV $(CC) with $(CFLAGS_GCOV) assumes the output filename with .gcno suffix appended is writable. This is not the case when the output filename is /dev/null: HDRTEST drivers/gpu/drm/i915/display/intel_frontbuffer.h /dev/null:1:0: error: cannot open /dev/null.gcno HDRTEST drivers/gpu/drm/i915/display/intel_ddi.h /dev/null:1:0: error: cannot open /dev/null.gcno make[5]: *** [../drivers/gpu/drm/i915/Makefile:307: drivers/gpu/drm/i915/display/intel_ddi.hdrtest] Error 1 make[5]: *** Waiting for unfinished jobs.... make[5]: *** [../drivers/gpu/drm/i915/Makefile:307: drivers/gpu/drm/i915/display/intel_frontbuffer.hdrtest] Error 1 Filter out $(CFLAGS_GVOC) from the header test $(c_flags) as they don't make sense here anyway. References: http://lore.kernel.org/r/d8112767-4089-4c58-d7d3-2ce03139858a@infradead.org Reported-by: Randy Dunlap Fixes: c6d4a099a240 ("drm/i915: reimplement header test feature") Cc: Masahiro Yamada Acked-by: Randy Dunlap Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200221105414.14358-1-jani.nikula@intel.com (cherry picked from commit 408c1b3253dab93da175690dc0e21dd8bccf3371) Signed-off-by: Jani Nikula commit 0dda2ddb7ded1395189e95d43106469687c07795 Author: Johannes Thumshirn Date: Tue Feb 25 22:03:33 2020 +0100 zonefs: select FS_IOMAP Zonefs makes use of iomap internally, so it should also select iomap in Kconfig. Signed-off-by: Johannes Thumshirn Signed-off-by: Damien Le Moal commit 7c69eb84d98a28c428f902318c20c53cf29c9084 Author: Christoph Hellwig Date: Fri Feb 21 06:37:23 2020 -0800 zonefs: fix IOCB_NOWAIT handling IOCB_NOWAIT can't just be ignored as it breaks applications expecting it not to block. Just refuse the operation as applications must handle that (e.g. by falling back to a thread pool). Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system") Signed-off-by: Christoph Hellwig Signed-off-by: Damien Le Moal commit 2910b5aa6f545c044173a5cab3dbb7f43e23916d Author: Masami Hiramatsu Date: Tue Feb 25 23:36:41 2020 +0900 bootconfig: Fix CONFIG_BOOTTIME_TRACING dependency issue Since commit d8a953ddde5e ("bootconfig: Set CONFIG_BOOT_CONFIG=n by default") also changed the CONFIG_BOOTTIME_TRACING to select CONFIG_BOOT_CONFIG to show the boot-time tracing on the menu, it introduced wrong dependencies with BLK_DEV_INITRD as below. WARNING: unmet direct dependencies detected for BOOT_CONFIG Depends on [n]: BLK_DEV_INITRD [=n] Selected by [y]: - BOOTTIME_TRACING [=y] && TRACING_SUPPORT [=y] && FTRACE [=y] && TRACING [=y] This makes the CONFIG_BOOT_CONFIG selects CONFIG_BLK_DEV_INITRD to fix this error and make CONFIG_BOOTTIME_TRACING=n by default, so that both boot-time tracing and boot configuration off but those appear on the menu list. Link: http://lkml.kernel.org/r/158264140162.23842.11237423518607465535.stgit@devnote2 Fixes: d8a953ddde5e ("bootconfig: Set CONFIG_BOOT_CONFIG=n by default") Reported-by: Randy Dunlap Compiled-tested-by: Randy Dunlap Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit deddc9e8c0e05c2a770d3c9e6683c7ae216741ca Author: Vadim Pasternak Date: Tue Feb 25 00:52:02 2020 +0200 hwmon: (pmbus/xdpe12284) Add callback for vout limits conversion Provide read_word_data() callback for overvoltage and undervoltage output readouts conversion. These registers are presented in 'slinear11' format, while default conversion for 'vout' class for the devices is 'vid'. It is resulted in wrong conversion in pmbus_reg2data() for in{3-4}_lcrit and in{3-4}_crit attributes. ) Fixes: aaafb7c8eb1c ("hwmon: (pmbus) Add support for Infineon Multi-phase xdpe122 family controllers") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20200224225202.19576-1-vadimp@mellanox.com [gropeck: Adjusted to mainline PMBus API] Signed-off-by: Guenter Roeck commit 2d141dd2caa78fbaf87b57c27769bdc14975ab3d Author: Jens Axboe Date: Tue Feb 25 11:52:56 2020 -0700 io-wq: ensure work->task_pid is cleared on init We use ->task_pid for exit cancellation, but we need to ensure it's cleared to zero for io_req_work_grab_env() to do the right thing. Take a suggestion from Bart and clear the whole thing, just setting the function passed in. This makes it more future proof as well. Fixes: 36282881a795 ("io-wq: add io_wq_cancel_pid() to cancel based on a specific pid") Signed-off-by: Jens Axboe commit d364847eed890211444ad74496bb549f838c6018 Author: Thomas Gleixner Date: Tue Feb 25 14:55:15 2020 +0100 x86/mce/therm_throt: Undo thermal polling properly on CPU offline Chris Wilson reported splats from running the thermal throttling workqueue callback on offlined CPUs. The problem is that that callback should not even run on offlined CPUs but it happens nevertheless because the offlining callback thermal_throttle_offline() does not symmetrically undo the setup work done in its onlining counterpart. IOW, 1. The thermal interrupt vector should be masked out before ... 2. ... cancelling any pending work synchronously so that no new work is enqueued anymore. Do those things and fix the issue properly. [ bp: Write commit message. ] Fixes: f6656208f04e ("x86/mce/therm_throt: Optimize notifications of thermal throttle") Reported-by: Chris Wilson Tested-by: Pandruvada, Srinivas Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/158120068234.18291.7938335950259651295@skylake-alporthouse-com commit eb9d8ddbc107d02e489681f9dcbf93949e1a99a4 Author: Tomeu Vizoso Date: Wed Feb 12 14:22:36 2020 -0600 drm/panfrost: Don't try to map on error faults If the exception type isn't a translation fault, don't try to map and instead go straight to a terminal fault. Otherwise, we can get flooded by kernel warnings and further faults. Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") Signed-off-by: Rob Herring Signed-off-by: Tomeu Vizoso Reviewed-by: Steven Price Reviewed-by: Tomeu Vizoso Acked-by: Alyssa Rosenzweig Link: https://patchwork.freedesktop.org/patch/msgid/20200212202236.13095-1-robh@kernel.org commit a8e41f6033a0c5633d55d6e35993c9e2005d872f Author: Jason A. Donenfeld Date: Tue Feb 25 18:05:35 2020 +0800 icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n The icmpv6_send function has long had a static inline implementation with an empty body for CONFIG_IPV6=n, so that code calling it doesn't need to be ifdef'd. The new icmpv6_ndo_send function, which is intended for drivers as a drop-in replacement with an identical function signature, should follow the same pattern. Without this patch, drivers that used to work with CONFIG_IPV6=n now result in a linker error. Cc: Chen Zhou Reported-by: Hulk Robot Fixes: 0b41713b6066 ("icmp: introduce helper for nat'd source address in network device context") Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 55dee1bc0d72877b99805e42e0205087e98b9edd Author: Scott Mayhew Date: Mon Feb 24 16:29:32 2020 -0500 nfs: add minor version to nfs_server_key for fscache An NFS client that mounts multiple exports from the same NFS server with higher NFSv4 versions disabled (i.e. 4.2) and without forcing a specific NFS version results in fscache index cookie collisions and the following messages: [ 570.004348] FS-Cache: Duplicate cookie detected Each nfs_client structure should have its own fscache index cookie, so add the minorversion to nfs_server_key. Link: https://bugzilla.kernel.org/show_bug.cgi?id=200145 Signed-off-by: Scott Mayhew Signed-off-by: Dave Wysochanski Signed-off-by: Anna Schumaker commit 75a9b9176157f3095d3099adf512b5a233addbc7 Author: Scott Mayhew Date: Tue Feb 25 11:05:22 2020 -0500 NFS: Fix leak of ctx->nfs_server.hostname If userspace passes an nfs_mount_data struct in the data argument of mount(2), then nfs23_parse_monolithic() or nfs4_parse_monolithic() will allocate memory for ctx->nfs_server.hostname. This needs to be freed in nfs_parse_source(), which also allocates memory for ctx->nfs_server.hostname, otherwise a leak will occur. Reported-by: syzbot+193c375dcddb4f345091@syzkaller.appspotmail.com Fixes: f2aedb713c28 ("NFS: Add fs_context support.") Signed-off-by: Scott Mayhew Signed-off-by: Anna Schumaker commit 1821b26a1fed8fca57a96ef87bac7a6a48e78815 Author: Scott Mayhew Date: Thu Feb 20 08:06:20 2020 -0500 NFS: Don't hard-code the fs_type when submounting Hard-coding the fstype causes "nfs4" mounts to appear as "nfs", which breaks scripts that do "umount -at nfs4". Reported-by: Patrick Steinhardt Fixes: f2aedb713c28 ("NFS: Add fs_context support.") Signed-off-by: Scott Mayhew Signed-off-by: Anna Schumaker commit c5f86891185c408b2241ba9a82ae8622d8386aff Merge: d67f250e9634 8458ca147c20 Author: Linus Torvalds Date: Tue Feb 25 10:14:39 2020 -0800 Merge tag 'riscv-for-linux-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: "This contains a handful of RISC-V related fixes that I've collected and would like to target for 5.6-rc4: - A fix to set up the PMPs on boot, which allows the kernel to access memory on systems that don't set up permissive PMPs before getting to Linux. This only effects machine-mode kernels, which currently means only NOMMU kernels. - A fix to avoid enabling supervisor-mode interrupts when running in machine-mode, also only for NOMMU kernels. - A pair of fixes to our KASAN support to avoid corrupting memory. - A gitignore fix. This boots on QEMU's virt board for me" * tag 'riscv-for-linux-5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: adjust the indent riscv: allocate a complete page size for each page table riscv: Fix gitignore RISC-V: Don't enable all interrupts in trap_init() riscv: set pmp configuration if kernel is running in M-mode commit d67f250e96344f006e3a6be148def4c6537d05a0 Merge: 63623fd44972 3234f4ed3066 Author: Linus Torvalds Date: Tue Feb 25 10:09:41 2020 -0800 Merge branch 'mips-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "Here are a few MIPS fixes, and a MAINTAINERS update to hand over MIPS maintenance to Thomas Bogendoerfer - this will be my final pull request as MIPS maintainer. Thanks for your helpful comments, useful corrections & responsiveness during the time I've fulfilled the role, and I'm sure I'll pop up elsewhere in the tree somewhere down the line" * 'mips-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MAINTAINERS: Hand MIPS over to Thomas MIPS: ingenic: DTS: Fix watchdog nodes MIPS: X1000: Fix clock of watchdog node. MIPS: vdso: Wrap -mexplicit-relocs in cc-option MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()' MIPS: cavium_octeon: Fix syncw generation. mips: vdso: add build time check that no 'jalr t9' calls left MIPS: Disable VDSO time functionality on microMIPS mips: vdso: fix 'jalr t9' crash in vdso code commit 7fc2e47f40dd77ab1fcbda6db89614a0173d89c7 Author: Mikulas Patocka Date: Mon Feb 17 08:11:35 2020 -0500 dm integrity: fix invalid table returned due to argument count mismatch If the flag SB_FLAG_RECALCULATE is present in the superblock, but it was not specified on the command line (i.e. ic->recalculate_flag is false), dm-integrity would return invalid table line - the reported number of arguments would not match the real number. Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode") Cc: stable@vger.kernel.org # v5.2+ Reported-by: Ondrej Kozina Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 53770f0ec5fd417429775ba006bc4abe14002335 Author: Mikulas Patocka Date: Mon Feb 17 07:43:03 2020 -0500 dm integrity: fix a deadlock due to offloading to an incorrect workqueue If we need to perform synchronous I/O in dm_integrity_map_continue(), we must make sure that we are not in the map function - in order to avoid the deadlock due to bio queuing in generic_make_request. To avoid the deadlock, we offload the request to metadata_wq. However, metadata_wq also processes metadata updates for write requests. If there are too many requests that get offloaded to metadata_wq at the beginning of dm_integrity_map_continue, the workqueue metadata_wq becomes clogged and the system is incapable of processing any metadata updates. This causes a deadlock because all the requests that need to do metadata updates wait for metadata_wq to proceed and metadata_wq waits inside wait_and_add_new_range until some existing request releases its range lock (which doesn't happen because the range lock is released after metadata update). In order to fix the deadlock, we create a new workqueue offload_wq and offload requests to it - so that processing of offload_wq is independent from processing of metadata_wq. Fixes: 7eada909bfd7 ("dm: add integrity target") Cc: stable@vger.kernel.org # v4.12+ Reported-by: Heinz Mauelshagen Tested-by: Heinz Mauelshagen Signed-off-by: Heinz Mauelshagen Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit d5bdf66108419cdb39da361b58ded661c29ff66e Author: Mikulas Patocka Date: Fri Feb 7 11:42:30 2020 -0500 dm integrity: fix recalculation when moving from journal mode to bitmap mode If we resume a device in bitmap mode and the on-disk format is in journal mode, we must recalculate anything above ic->sb->recalc_sector. Otherwise, there would be non-recalculated blocks which would cause I/O errors. Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 20055448dc1b439c87d0cb602e6d0469b0a3aaad Merge: efbd9129dfe8 5eb40257047f Author: Stephen Boyd Date: Tue Feb 25 08:57:00 2020 -0800 Merge tag 'imx-clk-fixes-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-fixes Pull an i.MX clk fix from Shawn Guo: A fix on i.MX8MN I2C4 and UART1 clock IDs, which clash with PWM2 and PWM3 ID. This bug makes I2C4 and UART1 device in i.MX8MN DT point to PWM2 and PWM3 clock. * tag 'imx-clk-fixes-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: clk: imx8mn: Fix incorrect clock defines commit 93d7c3185893b185e7f4347f8986b9b521254a6e Author: Dongli Zhang Date: Mon Feb 24 10:39:11 2020 -0800 null_blk: remove unused fields in 'nullb_cmd' 'list', 'll_list' and 'csd' are no longer used. The 'list' is not used since it was introduced by commit f2298c0403b0 ("null_blk: multi queue aware block test driver"). The 'll_list' is no longer used since commit 3c395a969acc ("null_blk: set a separate timer for each command"). The 'csd' is no longer used since commit ce2c350b2cfe ("null_blk: use blk_complete_request and blk_mq_complete_request"). Reviewed-by: Bart Van Assche Signed-off-by: Dongli Zhang Signed-off-by: Jens Axboe commit a3ed353cf8015ba84a0407a5dc3ffee038166ab0 Author: Shirish S Date: Mon Jan 27 16:35:24 2020 +0530 amdgpu/gmc_v9: save/restore sdpif regs during S3 fixes S3 issue with IOMMU + S/G enabled @ 64M VRAM. Suggested-by: Alex Deucher Signed-off-by: Shirish S Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4829f89855f1d3a3d8014e74cceab51b421503db Author: Monk Liu Date: Sat Feb 8 19:01:21 2020 +0800 drm/amdgpu: fix memory leak during TDR test(v2) fix system memory leak v2: fix coding style Signed-off-by: Monk Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3030fd4cb783377eca0e2a3eee63724a5c66ee15 Author: Jens Axboe Date: Tue Feb 25 08:47:30 2020 -0700 io-wq: remove spin-for-work optimization Andres reports that buffered IO seems to suck up more cycles than we would like, and he narrowed it down to the fact that the io-wq workers will briefly spin for more work on completion of a work item. This was a win on the networking side, but apparently some other cases take a hit because of it. Remove the optimization to avoid burning more CPU than we have to for disk IO. Reported-by: Andres Freund Signed-off-by: Jens Axboe commit bdcd3eab2a9ae0ac93f27275b6895dd95e5bf360 Author: Xiaoguang Wang Date: Tue Feb 25 22:12:08 2020 +0800 io_uring: fix poll_list race for SETUP_IOPOLL|SETUP_SQPOLL After making ext4 support iopoll method: let ext4_file_operations's iopoll method be iomap_dio_iopoll(), we found fio can easily hang in fio_ioring_getevents() with below fio job: rm -f testfile; sync; sudo fio -name=fiotest -filename=testfile -iodepth=128 -thread -rw=write -ioengine=io_uring -hipri=1 -sqthread_poll=1 -direct=1 -bs=4k -size=10G -numjobs=8 -runtime=2000 -group_reporting with IORING_SETUP_SQPOLL and IORING_SETUP_IOPOLL enabled. There are two issues that results in this hang, one reason is that when IORING_SETUP_SQPOLL and IORING_SETUP_IOPOLL are enabled, fio does not use io_uring_enter to get completed events, it relies on kernel io_sq_thread to poll for completed events. Another reason is that there is a race: when io_submit_sqes() in io_sq_thread() submits a batch of sqes, variable 'inflight' will record the number of submitted reqs, then io_sq_thread will poll for reqs which have been added to poll_list. But note, if some previous reqs have been punted to io worker, these reqs will won't be in poll_list timely. io_sq_thread() will only poll for a part of previous submitted reqs, and then find poll_list is empty, reset variable 'inflight' to be zero. If app just waits these deferred reqs and does not wake up io_sq_thread again, then hang happens. For app that entirely relies on io_sq_thread to poll completed requests, let io_iopoll_req_issued() wake up io_sq_thread properly when adding new element to poll_list, and when io_sq_thread prepares to sleep, check whether poll_list is empty again, if not empty, continue to poll. Signed-off-by: Xiaoguang Wang Signed-off-by: Jens Axboe commit c780e86dd48ef6467a1146cf7d0fe1e05a635039 Author: Jan Kara Date: Thu Feb 6 15:28:12 2020 +0100 blktrace: Protect q->blk_trace with RCU KASAN is reporting that __blk_add_trace() has a use-after-free issue when accessing q->blk_trace. Indeed the switching of block tracing (and thus eventual freeing of q->blk_trace) is completely unsynchronized with the currently running tracing and thus it can happen that the blk_trace structure is being freed just while __blk_add_trace() works on it. Protect accesses to q->blk_trace by RCU during tracing and make sure we wait for the end of RCU grace period when shutting down tracing. Luckily that is rare enough event that we can afford that. Note that postponing the freeing of blk_trace to an RCU callback should better be avoided as it could have unexpected user visible side-effects as debugfs files would be still existing for a short while block tracing has been shut down. Link: https://bugzilla.kernel.org/show_bug.cgi?id=205711 CC: stable@vger.kernel.org Reviewed-by: Chaitanya Kulkarni Reviewed-by: Ming Lei Tested-by: Ming Lei Reviewed-by: Bart Van Assche Reported-by: Tristan Madani Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit d0820556507bd7aef4f3a615b1b6eb66eb9785fe Author: Stefano Brivio Date: Fri Feb 21 03:11:56 2020 +0100 selftests: nft_concat_range: Move option for 'list ruleset' before command Before nftables commit fb9cea50e8b3 ("main: enforce options before commands"), 'nft list ruleset -a' happened to work, but it's wrong and won't work anymore. Replace it by 'nft -a list ruleset'. Reported-by: Chen Yi Fixes: 611973c1e06f ("selftests: netfilter: Introduce tests for sets with range concatenation") Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit adc10f5b0a03606e30c704cff1f0283a696d0260 Author: Kees Cook Date: Fri Feb 21 16:02:39 2020 -0800 docs: Fix empty parallelism argument When there was no parallelism (no top-level -j arg and a pre-1.7 sphinx-build), the argument passed would be empty ("") instead of just being missing, which would (understandably) badly confuse sphinx-build. Fix this by removing the quotes. Reported-by: Rafael J. Wysocki Fixes: 51e46c7a4007 ("docs, parallelism: Rearrange how jobserver reservations are made") Cc: stable@vger.kernel.org # v5.5 only Signed-off-by: Kees Cook Signed-off-by: Jonathan Corbet commit 53ace1195263b30fd593677dd67559e879ed9aa2 Author: Stephen Kitt Date: Fri Feb 21 21:57:33 2020 +0100 docs: remove MPX from the x86 toc MPX was removed in commit 45fc24e89b7c ("x86/mpx: remove MPX from arch/x86"), this removes the corresponding entry in the x86 toc. This was suggested by a Sphinx warning. Signed-off-by: Stephen Kitt Fixes: 45fc24e89b7cc ("x86/mpx: remove MPX from arch/x86") Acked-by: Dave Hansen Signed-off-by: Jonathan Corbet commit 25962e1a7f1d522f1b57ead2f266fab570042a70 Author: Frieder Schrempf Date: Tue Feb 25 08:23:20 2020 +0000 dmaengine: imx-sdma: Fix the event id check to include RX event for UART6 On i.MX6UL/ULL and i.MX6SX the DMA event id for the RX channel of UART6 is '0'. To fix the broken DMA support for UART6, we change the check for event_id0 to include '0' as a valid id. Fixes: 1ec1e82f2510 ("dmaengine: Add Freescale i.MX SDMA support") Signed-off-by: Frieder Schrempf Reviewed-by: Fabio Estevam Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200225082139.7646-1-frieder.schrempf@kontron.de Signed-off-by: Vinod Koul commit b549c252b1292aea959cd9b83537fcb9384a6112 Author: Tina Zhang Date: Tue Feb 25 13:35:27 2020 +0800 drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime Deleting dmabuf item's list head after releasing its container can lead to KASAN-reported issue: BUG: KASAN: use-after-free in __list_del_entry_valid+0x15/0xf0 Read of size 8 at addr ffff88818a4598a8 by task kworker/u8:3/13119 So fix this issue by puting deleting dmabuf_objs ahead of releasing its container. Fixes: dfb6ae4e14bd6 ("drm/i915/gvt: Handle orphan dmabuf_objs") Signed-off-by: Tina Zhang Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20200225053527.8336-2-tina.zhang@intel.com commit 3234f4ed3066a58cd5ce8edcf752fa4fe0c95cb5 Author: Paul Burton Date: Sat Feb 22 09:04:17 2020 -0800 MAINTAINERS: Hand MIPS over to Thomas My time with MIPS the company has reached its end, and so at best I'll have little time spend on maintaining arch/mips/. Ralf last authored a patch over 2 years ago, the last time he committed one is even further back & activity was sporadic for a while before that. The reality is that he isn't active. Having a new maintainer with time to do things properly will be beneficial all round. Thomas Bogendoerfer has been involved in MIPS development for a long time & has offered to step up as maintainer, so add Thomas and remove myself & Ralf from the MIPS entry. Ralf already has an entry in CREDITS to honor his contributions, so this just adds one for me. Signed-off-by: Paul Burton Reviewed-by: Philippe Mathieu-Daudé Acked-by: Thomas Bogendoerfer Cc: Ralf Baechle Cc: linux-kernel@vger.kernel.org Cc: linux-mips@vger.kernel.org commit c33ee1301c393a241d6424e36eff1071811b1064 Author: Dmitry Osipenko Date: Sun Feb 9 19:33:39 2020 +0300 dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list The interrupt handler puts a half-completed DMA descriptor on a free list and then schedules tasklet to process bottom half of the descriptor that executes client's callback, this creates possibility to pick up the busy descriptor from the free list. Thus, let's disallow descriptor's re-use until it is fully processed. Signed-off-by: Dmitry Osipenko Acked-by: Jon Hunter Cc: Link: https://lore.kernel.org/r/20200209163356.6439-3-digetx@gmail.com Signed-off-by: Vinod Koul commit 94788af4ed039476ff3527b0e6a12c1dc42cb022 Author: Dmitry Osipenko Date: Sun Feb 9 19:33:38 2020 +0300 dmaengine: tegra-apb: Fix use-after-free I was doing some experiments with I2C and noticed that Tegra APB DMA driver crashes sometime after I2C DMA transfer termination. The crash happens because tegra_dma_terminate_all() bails out immediately if pending list is empty, and thus, it doesn't release the half-completed descriptors which are getting re-used before ISR tasklet kicks-in. tegra-i2c 7000c400.i2c: DMA transfer timeout elants_i2c 0-0010: elants_i2c_irq: failed to read data: -110 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 142 at lib/list_debug.c:45 __list_del_entry_valid+0x45/0xac list_del corruption, ddbaac44->next is LIST_POISON1 (00000100) Modules linked in: CPU: 0 PID: 142 Comm: kworker/0:2 Not tainted 5.5.0-rc2-next-20191220-00175-gc3605715758d-dirty #538 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: events_freezable_power_ thermal_zone_device_check [] (unwind_backtrace) from [] (show_stack+0x11/0x14) [] (show_stack) from [] (dump_stack+0x85/0x94) [] (dump_stack) from [] (__warn+0xc1/0xc4) [] (__warn) from [] (warn_slowpath_fmt+0x61/0x78) [] (warn_slowpath_fmt) from [] (__list_del_entry_valid+0x45/0xac) [] (__list_del_entry_valid) from [] (tegra_dma_tasklet+0x5b/0x154) [] (tegra_dma_tasklet) from [] (tasklet_action_common.constprop.0+0x41/0x7c) [] (tasklet_action_common.constprop.0) from [] (__do_softirq+0xd3/0x2a8) [] (__do_softirq) from [] (irq_exit+0x7b/0x98) [] (irq_exit) from [] (__handle_domain_irq+0x45/0x80) [] (__handle_domain_irq) from [] (gic_handle_irq+0x45/0x7c) [] (gic_handle_irq) from [] (__irq_svc+0x65/0x94) Exception stack(0xde2ebb90 to 0xde2ebbd8) Signed-off-by: Dmitry Osipenko Acked-by: Jon Hunter Cc: Link: https://lore.kernel.org/r/20200209163356.6439-2-digetx@gmail.com Signed-off-by: Vinod Koul commit 3d2ed431b8f39483477bc3c3a2aefbc9778ffe12 Author: Phong LE Date: Wed Feb 19 15:13:24 2020 +0100 drm/mediatek: Handle component type MTK_DISP_OVL_2L correctly The larb device remains NULL if the type is MTK_DISP_OVL_2L. A kernel panic is raised when a crtc uses mtk_smi_larb_get or mtk_smi_larb_put. Fixes: b17bdd0d7a73 ("drm/mediatek: add component OVL_2L0") Signed-off-by: Phong LE Signed-off-by: CK Hu commit 01e99aeca3979600302913cef3f89076786f32c8 Author: Ming Lei Date: Tue Feb 25 09:04:32 2020 +0800 blk-mq: insert passthrough request into hctx->dispatch directly For some reason, device may be in one situation which can't handle FS request, so STS_RESOURCE is always returned and the FS request will be added to hctx->dispatch. However passthrough request may be required at that time for fixing the problem. If passthrough request is added to scheduler queue, there isn't any chance for blk-mq to dispatch it given we prioritize requests in hctx->dispatch. Then the FS IO request may never be completed, and IO hang is caused. So passthrough request has to be added to hctx->dispatch directly for fixing the IO hang. Fix this issue by inserting passthrough request into hctx->dispatch directly together withing adding FS request to the tail of hctx->dispatch in blk_mq_dispatch_rq_list(). Actually we add FS request to tail of hctx->dispatch at default, see blk_mq_request_bypass_insert(). Then it becomes consistent with original legacy IO request path, in which passthrough request is always added to q->queue_head. Cc: Dongli Zhang Cc: Christoph Hellwig Cc: Ewan D. Milne Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3614d05b5e6baf487e88fb114d884da172edd61a Merge: 823d81b0fa2c 253216ffb2a0 Author: David S. Miller Date: Mon Feb 24 15:43:38 2020 -0800 Merge tag 'mac80211-for-net-2020-02-24' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg ==================== A few fixes: * remove a double mutex-unlock * fix a leak in an error path * NULL pointer check * include if_vlan.h where needed * avoid RCU list traversal when not under RCU ==================== Signed-off-by: David S. Miller commit 756125289285f6e55a03861bf4b6257aa3d19a93 Author: Paul Moore Date: Mon Feb 24 16:38:57 2020 -0500 audit: always check the netlink payload length in audit_receive_msg() This patch ensures that we always check the netlink payload length in audit_receive_msg() before we take any action on the payload itself. Cc: stable@vger.kernel.org Reported-by: syzbot+399c44bf1f43b8747403@syzkaller.appspotmail.com Reported-by: syzbot+e4b12d8d202701f08b6d@syzkaller.appspotmail.com Signed-off-by: Paul Moore commit 8458ca147c204e7db124e8baa8fede219006e80d Author: Zong Li Date: Fri Feb 7 17:52:45 2020 +0800 riscv: adjust the indent Adjust the indent to match Linux coding style. Signed-off-by: Zong Li Signed-off-by: Palmer Dabbelt commit a0a31fd84f8f66828790d860545d4167777d58c6 Author: Zong Li Date: Fri Feb 7 17:52:44 2020 +0800 riscv: allocate a complete page size for each page table Each page table should be created by allocating a complete page size for it. Otherwise, the content of the page table would be corrupted somewhere through memory allocation which allocates the memory at the middle of the page table for other use. Signed-off-by: Zong Li Signed-off-by: Palmer Dabbelt commit 8308a09e87d2cb51adb186dc7d5a5c1913fb0758 Author: Amadeusz Sławiński Date: Mon Feb 24 07:52:02 2020 -0500 ASoC: Intel: Skylake: Fix available clock counter incrementation Incrementation of avail_clk_cnt was incorrectly moved to error path. Put it back to success path. Fixes: 6ee927f2f01466 ('ASoC: Intel: Skylake: Fix NULL ptr dereference when unloading clk dev') Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200224125202.13784-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 1c5312308c96556ae209e8eb1423c38d4a113759 Author: Kuninori Morimoto Date: Fri Feb 21 10:25:18 2020 +0900 ASoC: soc-pcm/soc-compress: don't use snd_soc_dapm_stream_stop() commit b0edff42360ab4 ("ASoC: soc-pcm/soc-compress: use snd_soc_dapm_stream_stop() for SND_SOC_DAPM_STREAM_STOP") uses snd_soc_dapm_stream_stop() for soc_compr_free_fe() and dpcm_fe_dai_shutdown() because it didn't care about pmdown_time. But, it didn't need to care. This patch rollback to original code. Some system will wait unneeded timed-out without this patch. Special Thanks for reporting to Chris Gorman. ... intel_sst_acpi 808622A8:00: Wait timed-out condition:0x0, msg_id:0x1 fw_state 0x3 intel_sst_acpi 808622A8:00: fw returned err -16 sst-mfld-platform sst-mfld-platform: ASoC: PRE_PMD: pcm0_in event failed: -16 ... Fixes: commit b0edff42360ab4 ("ASoC: soc-pcm/soc-compress: use snd_soc_dapm_stream_stop() for SND_SOC_DAPM_STREAM_STOP") Reported-by: Chris Gorman Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87lfowspeb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fb4b5f13464c468a9c10ae1ab8ba9aa352d0256a Author: Joe Perches Date: Fri Feb 21 05:20:45 2020 -0800 cifs: Use #define in cifs_dbg All other uses of cifs_dbg use defines so change this one. Signed-off-by: Joe Perches Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 86f740f2aed5ea7fe1aa86dc2df0fb4ab0f71088 Author: Aurelien Aptel Date: Fri Feb 21 11:19:06 2020 +0100 cifs: fix rename() by ensuring source handle opened with DELETE bit To rename a file in SMB2 we open it with the DELETE access and do a special SetInfo on it. If the handle is missing the DELETE bit the server will fail the SetInfo with STATUS_ACCESS_DENIED. We currently try to reuse any existing opened handle we have with cifs_get_writable_path(). That function looks for handles with WRITE access but doesn't check for DELETE, making rename() fail if it finds a handle to reuse. Simple reproducer below. To select handles with the DELETE bit, this patch adds a flag argument to cifs_get_writable_path() and find_writable_file() and the existing 'bool fsuid_only' argument is converted to a flag. The cifsFileInfo struct only stores the UNIX open mode but not the original SMB access flags. Since the DELETE bit is not mapped in that mode, this patch stores the access mask in cifs_fid on file open, which is accessible from cifsFileInfo. Simple reproducer: #include #include #include #include #include #include #define E(s) perror(s), exit(1) int main(int argc, char *argv[]) { int fd, ret; if (argc != 3) { fprintf(stderr, "Usage: %s A B\n" "create&open A in write mode, " "rename A to B, close A\n", argv[0]); return 0; } fd = openat(AT_FDCWD, argv[1], O_WRONLY|O_CREAT|O_SYNC, 0666); if (fd == -1) E("openat()"); ret = rename(argv[1], argv[2]); if (ret) E("rename()"); ret = close(fd); if (ret) E("close()"); return ret; } $ gcc -o bugrename bugrename.c $ ./bugrename /mnt/a /mnt/b rename(): Permission denied Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") CC: Stable Signed-off-by: Aurelien Aptel Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky Reviewed-by: Paulo Alcantara (SUSE) commit ec57010acd03428a749d2600bf09bd537eaae993 Author: Steve French Date: Wed Feb 19 23:59:32 2020 -0600 cifs: add missing mount option to /proc/mounts We were not displaying the mount option "signloosely" in /proc/mounts for cifs mounts which some users found confusing recently Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 154255233830e1e4dd0d99ac929a5dce588c0b81 Author: Paulo Alcantara (SUSE) Date: Thu Feb 20 19:49:35 2020 -0300 cifs: fix potential mismatch of UNC paths Ensure that full_path is an UNC path that contains '\\' as delimiter, which is required by cifs_build_devname(). The build_path_from_dentry_optional_prefix() function may return a path with '/' as delimiter when using SMB1 UNIX extensions, for example. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French Acked-by: Ronnie Sahlberg commit fc513fac56e1b626ae48a74d7551d9c35c50129e Author: Ronnie Sahlberg Date: Wed Feb 19 06:01:03 2020 +1000 cifs: don't leak -EAGAIN for stat() during reconnect If from cifs_revalidate_dentry_attr() the SMB2/QUERY_INFO call fails with an error, such as STATUS_SESSION_EXPIRED, causing the session to be reconnected it is possible we will leak -EAGAIN back to the application even for system calls such as stat() where this is not a valid error. Fix this by re-trying the operation from within cifs_revalidate_dentry_attr() if cifs_get_inode_info*() returns -EAGAIN. This fixes stat() and possibly also other system calls that uses cifs_revalidate_dentry*(). Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky Reviewed-by: Aurelien Aptel CC: Stable commit 03264ddde2453f6877a7d637d84068079632a3c5 Author: Adam Williamson Date: Wed Feb 19 17:50:07 2020 +0100 scsi: compat_ioctl: cdrom: Replace .ioctl with .compat_ioctl in four appropriate places Arnd Bergmann inadvertently typoed these in d320a9551e394 and 64cbfa96551a; they seem to be the cause of https://bugzilla.redhat.com/show_bug.cgi?id=1801353 , invalid SCSI commands when udev tries to query a DVD drive. [arnd] Found another instance of the same bug, also introduced in my compat_ioctl series. Link: https://bugzilla.redhat.com/show_bug.cgi?id=1801353 Link: https://lore.kernel.org/r/20200219165139.3467320-1-arnd@arndb.de Fixes: c103d6ee69f9 ("compat_ioctl: ide: floppy: add handler") Fixes: 64cbfa96551a ("compat_ioctl: move cdrom commands into cdrom.c") Fixes: d320a9551e39 ("compat_ioctl: scsi: move ioctl handling into drivers") Bisected-by: Chris Murphy Signed-off-by: Arnd Bergmann Signed-off-by: Adam Williamson Signed-off-by: Martin K. Petersen commit 63623fd44972d1ed2bfb6e0fb631dfcf547fd1e7 Merge: 7031ecffab86 a93236fcbe1d Author: Linus Torvalds Date: Mon Feb 24 11:48:17 2020 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Bugfixes, including the fix for CVE-2020-2732 and a few issues found by 'make W=1'" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: s390: rstify new ioctls in api.rst KVM: nVMX: Check IO instruction VM-exit conditions KVM: nVMX: Refactor IO bitmap checks into helper function KVM: nVMX: Don't emulate instructions in guest mode KVM: nVMX: Emulate MTF when performing instruction emulation KVM: fix error handling in svm_hardware_setup KVM: SVM: Fix potential memory leak in svm_cpu_init() KVM: apic: avoid calculating pending eoi from an uninitialized val KVM: nVMX: clear PIN_BASED_POSTED_INTR from nested pinbased_ctls only when apicv is globally disabled KVM: nVMX: handle nested posted interrupts when apicv is disabled for L1 kvm: x86: svm: Fix NULL pointer dereference when AVIC not enabled KVM: VMX: Add VMX_FEATURE_USR_WAIT_PAUSE KVM: nVMX: Hold KVM's srcu lock when syncing vmcs12->shadow KVM: x86: don't notify userspace IOAPIC on edge-triggered interrupt EOI kvm/emulate: fix a -Werror=cast-function-type KVM: x86: fix incorrect comparison in trace event KVM: nVMX: Fix some obsolete comments and grammar error KVM: x86: fix missing prototypes KVM: x86: enable -Werror commit 7031ecffab86199c2c688f7a723d03dfa6910fa6 Merge: bc570c14b260 c9cc0517bba9 Author: Linus Torvalds Date: Mon Feb 24 11:40:23 2020 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a Kconfig-related build error and an integer overflow in chacha20poly1305" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: chacha20poly1305 - prevent integer overflow on large input tee: amdtee: amdtee depends on CRYPTO_DEV_CCP_DD commit bc570c14b260946a66e13882eace862dc6eb16f8 Merge: 2e90ca68b0d2 bf4498ad3f9a Author: Linus Torvalds Date: Mon Feb 24 11:32:15 2020 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull tmpfs fix from Al Viro: "Regression from fs_parse series this cycle..." * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: tmpfs: deny and force are not huge mount options commit 2e90ca68b0d2f5548804f22f0dd61145516171e3 Author: Linus Torvalds Date: Fri Feb 21 12:43:35 2020 -0800 floppy: check FDC index for errors before assigning it Jordy Zomer reported a KASAN out-of-bounds read in the floppy driver in wait_til_ready(). Which on the face of it can't happen, since as Willy Tarreau points out, the function does no particular memory access. Except through the FDCS macro, which just indexes a static allocation through teh current fdc, which is always checked against N_FDC. Except the checking happens after we've already assigned the value. The floppy driver is a disgrace (a lot of it going back to my original horrd "design"), and has no real maintainer. Nobody has the hardware, and nobody really cares. But it still gets used in virtual environment because it's one of those things that everybody supports. The whole thing should be re-written, or at least parts of it should be seriously cleaned up. The 'current fdc' index, which is used by the FDCS macro, and which is often shadowed by a local 'fdc' variable, is a prime example of how not to write code. But because nobody has the hardware or the motivation, let's just fix up the immediate problem with a nasty band-aid: test the fdc index before actually assigning it to the static 'fdc' variable. Reported-by: Jordy Zomer Cc: Willy Tarreau Cc: Dan Carpenter Signed-off-by: Linus Torvalds commit 823d81b0fa2cd83a640734e74caee338b5d3c093 Author: Nikolay Aleksandrov Date: Mon Feb 24 18:46:22 2020 +0200 net: bridge: fix stale eth hdr pointer in br_dev_xmit In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but if the packet has the vlan header inside (e.g. bridge with disabled tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() to extract the vid before filtering which in turn calls pskb_may_pull() and we may end up with a stale eth pointer. Moreover the cached eth header pointer will generally be wrong after that operation. Remove the eth header caching and just use eth_hdr() directly, the compiler does the right thing and calculates it only once so we don't lose anything. Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit e4686c2d08ea1a45c262af5269c2aa6b977b85e2 Merge: 6132c1d9033d 1d63b8d66d14 Author: David S. Miller Date: Mon Feb 24 10:58:57 2020 -0800 Merge branch 'net-ll_temac-Bugfixes' Esben Haabendal says: ==================== net: ll_temac: Bugfixes Fix a number of bugs which have been present since the first commit. The bugs fixed in patch 1,2 and 4 have all been observed in real systems, and was relatively easy to reproduce given an appropriate stress setup. Changes since v1: - Changed error handling of of dma_map_single() in temac_start_xmit() to drop packet instead of returning NETDEV_TX_BUSY. ==================== Signed-off-by: David S. Miller commit 1d63b8d66d146deaaedbe16c80de105f685ea012 Author: Esben Haabendal Date: Fri Feb 21 07:47:58 2020 +0100 net: ll_temac: Handle DMA halt condition caused by buffer underrun The SDMA engine used by TEMAC halts operation when it has finished processing of the last buffer descriptor in the buffer ring. Unfortunately, no interrupt event is generated when this happens, so we need to setup another mechanism to make sure DMA operation is restarted when enough buffers have been added to the ring. Fixes: 92744989533c ("net: add Xilinx ll_temac device driver") Signed-off-by: Esben Haabendal Signed-off-by: David S. Miller commit 770d9c67974c4c71af4beb786dc43162ad2a15ba Author: Esben Haabendal Date: Fri Feb 21 07:47:45 2020 +0100 net: ll_temac: Fix RX buffer descriptor handling on GFP_ATOMIC pressure Failures caused by GFP_ATOMIC memory pressure have been observed, and due to the missing error handling, results in kernel crash such as [1876998.350133] kernel BUG at mm/slub.c:3952! [1876998.350141] invalid opcode: 0000 [#1] PREEMPT SMP PTI [1876998.350147] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.3.0-scnxt #1 [1876998.350150] Hardware name: N/A N/A/COMe-bIP2, BIOS CCR2R920 03/01/2017 [1876998.350160] RIP: 0010:kfree+0x1ca/0x220 [1876998.350164] Code: 85 db 74 49 48 8b 95 68 01 00 00 48 31 c2 48 89 10 e9 d7 fe ff ff 49 8b 04 24 a9 00 00 01 00 75 0b 49 8b 44 24 08 a8 01 75 02 <0f> 0b 49 8b 04 24 31 f6 a9 00 00 01 00 74 06 41 0f b6 74 24 5b [1876998.350172] RSP: 0018:ffffc900000f0df0 EFLAGS: 00010246 [1876998.350177] RAX: ffffea00027f0708 RBX: ffff888008d78000 RCX: 0000000000391372 [1876998.350181] RDX: 0000000000000000 RSI: ffffe8ffffd01400 RDI: ffff888008d78000 [1876998.350185] RBP: ffff8881185a5d00 R08: ffffc90000087dd8 R09: 000000000000280a [1876998.350189] R10: 0000000000000002 R11: 0000000000000000 R12: ffffea0000235e00 [1876998.350193] R13: ffff8881185438a0 R14: 0000000000000000 R15: ffff888118543870 [1876998.350198] FS: 0000000000000000(0000) GS:ffff88811f300000(0000) knlGS:0000000000000000 [1876998.350203] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 s#1 Part1 [1876998.350206] CR2: 00007f8dac7b09f0 CR3: 000000011e20a006 CR4: 00000000001606e0 [1876998.350210] Call Trace: [1876998.350215] [1876998.350224] ? __netif_receive_skb_core+0x70a/0x920 [1876998.350229] kfree_skb+0x32/0xb0 [1876998.350234] __netif_receive_skb_core+0x70a/0x920 [1876998.350240] __netif_receive_skb_one_core+0x36/0x80 [1876998.350245] process_backlog+0x8b/0x150 [1876998.350250] net_rx_action+0xf7/0x340 [1876998.350255] __do_softirq+0x10f/0x353 [1876998.350262] irq_exit+0xb2/0xc0 [1876998.350265] do_IRQ+0x77/0xd0 [1876998.350271] common_interrupt+0xf/0xf [1876998.350274] In order to handle such failures more graceful, this change splits the receive loop into one for consuming the received buffers, and one for allocating new buffers. When GFP_ATOMIC allocations fail, the receive will continue with the buffers that is still there, and with the expectation that the allocations will succeed in a later call to receive. Fixes: 92744989533c ("net: add Xilinx ll_temac device driver") Signed-off-by: Esben Haabendal Signed-off-by: David S. Miller commit d07c849cd2b97d6809430dfb7e738ad31088037a Author: Esben Haabendal Date: Fri Feb 21 07:47:33 2020 +0100 net: ll_temac: Add more error handling of dma_map_single() calls This adds error handling to the remaining dma_map_single() calls, so that behavior is well defined if/when we run out of DMA memory. Fixes: 92744989533c ("net: add Xilinx ll_temac device driver") Signed-off-by: Esben Haabendal Signed-off-by: David S. Miller commit 84823ff80f7403752b59e00bb198724100dc611c Author: Esben Haabendal Date: Fri Feb 21 07:47:21 2020 +0100 net: ll_temac: Fix race condition causing TX hang It is possible that the interrupt handler fires and frees up space in the TX ring in between checking for sufficient TX ring space and stopping the TX queue in temac_start_xmit. If this happens, the queue wake from the interrupt handler will occur before the queue is stopped, causing a lost wakeup and the adapter's transmit hanging. To avoid this, after stopping the queue, check again whether there is sufficient space in the TX ring. If so, wake up the queue again. This is a port of the similar fix in axienet driver, commit 7de44285c1f6 ("net: axienet: Fix race condition causing TX hang"). Fixes: 23ecc4bde21f ("net: ll_temac: fix checksum offload logic") Signed-off-by: Esben Haabendal Signed-off-by: David S. Miller commit a93236fcbe1d0248461b29c0f87cb0b510c94e6f Author: Christian Borntraeger Date: Mon Feb 24 11:15:59 2020 +0100 KVM: s390: rstify new ioctls in api.rst We also need to rstify the new ioctls that we added in parallel to the rstification of the kvm docs. Signed-off-by: Christian Borntraeger Reviewed-by: David Hildenbrand Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit a40df28c5640f13405f5617aff3e985f7e72cde7 Author: Mauro Carvalho Chehab Date: Sun Feb 23 09:59:53 2020 +0100 docs: dt: fix several broken doc references There are several DT doc references that require manual fixes. I found 3 cases fixed on this patch: - directory named "binding/" instead of "bindings/"; - .txt to .yaml renames; - file renames (still on txt format); Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Miquel Raynal Reviewed-by: Jérôme Pouiller Acked-by: Mark Brown Signed-off-by: Rob Herring commit 54b3719d82e0816271e35579a9967b8a3b42296d Author: Mauro Carvalho Chehab Date: Sat Feb 22 10:00:02 2020 +0100 docs: dt: fix several broken references due to renames Several DT references got broken due to txt->yaml conversion. Those are auto-fixed by running: scripts/documentation-file-ref-check --fix Signed-off-by: Mauro Carvalho Chehab Acked-by: Andrew Jeffery Reviewed-by: Dan Murphy Reviewed-by: Amit Kucheria Signed-off-by: Rob Herring commit f1e4920fe3303aa983073197bcbc97d6c6119ba7 Merge: 515fa3ee9de2 f10e58a5d20e Author: Olof Johansson Date: Mon Feb 24 09:57:04 2020 -0800 Merge tag 'imx-fixes-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.6: - Build v7_cpu_resume() unconditionally to fix system hang in case that suspend is disabled but cpuidle support is enabled. - Drop unexisting Ethernet PHY device from imx8qxp-mek board. - Fix SRAM compatible strings on imx6dl-colibri-eval-v3 board. - Fix imx-scu driver to make sure that all messages words are written sequentially. - A series from Leonard Crestez to fix i.MX SC API users, having all messages aligned on 4 bytes. - Fix eMMC supply for phycore-som board. - Drop bogus frequency setting from imx7-colibri SD/MMC device, so that HS200 mode starts working and delivers better performance. - Fix opp-supported-hw for i.MX7D to get consumer and industrial parts work with correct frequency settings. - Restore MDIO compatible to the correct one for LS1021A SoC. * tag 'imx-fixes-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: soc: imx-scu: Align imx sc msg structs to 4 firmware: imx: Align imx_sc_msg_req_cpu_start to 4 firmware: imx: scu-pd: Align imx sc msg structs to 4 firmware: imx: misc: Align imx sc msg structs to 4 firmware: imx: scu: Ensure sequential TX ARM: dts: imx7-colibri: Fix frequency for sd/mmc arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties ARM: dts: ls1021a: Restore MDIO compatible to gianfar ARM: dts: imx7d: fix opp-supported-hw ARM: imx: build v7_cpu_resume() unconditionally ARM: dts: imx6: phycore-som: fix emmc supply Link: https://lore.kernel.org/r/20200224120334.GH27688@dragon Signed-off-by: Olof Johansson commit 515fa3ee9de2b1543250ae47685e1b7e05a7a8ef Merge: 0e26cbdfb32e 10dc62d0ae41 Author: Olof Johansson Date: Mon Feb 24 09:54:10 2020 -0800 Merge tag 'omap-for-v5.6/droid4-lcd-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fix LCD backlight issue for droid4 There was a bit of an integration glitch with the LED backlight series. The LED related parts got merged into v5.6-rc1, but the actual backlight driver got left out. This caused an issue on at least droid4 where the LCD backlight can not yet be enabled automatically. And the LCD backlight can no longer be enabled manually either via sysfs. The integration glitch happened because some pending comments from me. There was some confusion on which device tree property we should use for the default brightness property. After discussing how to fix this on the mailing lists, we came to the conclusion that it's best to fix this issue properly by adding the missing driver. The other solutions would mean backpedaling and try to come up with some temporary solution that really does not solve the issue for users. The patch for led_bl.c has been around for quite a while and tested by many users and was assumed to be merged as part of the LED backlight series. For the brightness property to use, we ended up using the more common "default-brightness-level" rather than "default-brightness" used by some backlight drivers. * tag 'omap-for-v5.6/droid4-lcd-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: droid4: Configure LED backlight for lm3532 backlight: add led-backlight driver Link: https://lore.kernel.org/r/pull-1582303901-96693@atomide.com Signed-off-by: Olof Johansson commit 0e26cbdfb32ed5bb65ca4640716c62129865b59c Merge: 3bf3c9744694 b460e0a9e240 Author: Olof Johansson Date: Mon Feb 24 09:53:00 2020 -0800 Merge tag 'reset-fixes-for-v5.6' of git://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v5.6 Fix the intel,rcu-gw binding schema for the intel,global-reset property, fix whitespace in the MAINTAINERS keyword entry, and add missing CONFIG_HAS_IOMEM dependency to CONFIG_RESET_INTEL_GW and CONFIG_RESET_BRCMSTB_RESCAL. * tag 'reset-fixes-for-v5.6' of git://git.pengutronix.de/git/pza/linux: reset: intel: add unspecified HAS_IOMEM dependency reset: brcmstb-rescal: add unspecified HAS_IOMEM dependency MAINTAINERS: fix style in RESET CONTROLLER FRAMEWORK dt-bindings: reset: intel,rcu-gw: Fix intel,global-reset schema Link: https://lore.kernel.org/r/e6eaa409883cbae8d1e818b732b98c3362635712.camel@pengutronix.de Signed-off-by: Olof Johansson commit a3fd4bfe85fbb67cf4ec1232d0af625ece3c508b Author: Benjamin Block Date: Wed Feb 19 16:09:25 2020 +0100 scsi: zfcp: fix wrong data and display format of SFP+ temperature When implementing support for retrieval of local diagnostic data from the FCP channel, the wrong data format was assumed for the temperature of the local SFP+ connector. The Fibre Channel Link Services (FC-LS-3) specification is not clear on the format of the stored integer, and only after consulting the SNIA specification SFF-8472 did we realize it is stored as two's complement. Thus, the used data and display format is wrong, and highly misleading for users when the temperature should drop below 0°C (however unlikely that may be). To fix this, change the data format in `struct fsf_qtcb_bottom_port` from unsigned to signed, and change the printf format string used to generate `zfcp_sysfs_adapter_diag_sfp_temperature_show()` from `%hu` to `%hd`. Link: https://lore.kernel.org/r/d6e3be5428da5c9490cfff4df7cae868bc9f1a7e.1582039501.git.bblock@linux.ibm.com Fixes: a10a61e807b0 ("scsi: zfcp: support retrieval of SFP Data via Exchange Port Data") Fixes: 6028f7c4cd87 ("scsi: zfcp: introduce sysfs interface for diagnostics of local SFP transceiver") Cc: # 5.5+ Reviewed-by: Jens Remus Reviewed-by: Fedor Loshakov Reviewed-by: Steffen Maier Signed-off-by: Benjamin Block Signed-off-by: Martin K. Petersen commit 51fdaa0490241e8cd41b40cbf43a336d1a014460 Author: Damien Le Moal Date: Wed Feb 19 15:38:00 2020 +0900 scsi: sd_sbc: Fix sd_zbc_report_zones() The block layer generic blk_revalidate_disk_zones() checks the validity of zone descriptors reported by a disk using the blk_revalidate_zone_cb() callback function executed for each zone descriptor. If a ZBC disk reports invalid zone descriptors, blk_revalidate_disk_zones() returns an error and sd_zbc_read_zones() changes the disk capacity to 0, which in turn results in the gendisk structure capacity to be set to 0. This all works well for the first revalidate pass on a disk and the block layer detects the capactiy change. On the second revalidate pass, blk_revalidate_disk_zones() is called again and sd_zbc_report_zones() executed to check the zones a second time. However, for this second pass, the gendisk capacity is now 0, which results in sd_zbc_report_zones() to do nothing and to report success and no zones. blk_revalidate_disk_zones() in turn returns success and sets the disk queue chunk_sectors limit with zero as no zones were checked, causing a oops to trigger on the BUG_ON(!is_power_of_2(chunk_sectors)) in blk_queue_chunk_sectors(). Fix this by using the sdkp capacity field rather than the gendisk capacity for the report zones loop in sd_zbc_report_zones(). Also add a check to return immediately an error if the sdkp capacity is 0. With this fix, invalid/buggy ZBC disk scan does not trigger a oops and are exposed with a 0 capacity. This change also preserve the chance for the disk to be correctly revalidated on the second revalidate pass as the scsi disk structure capacity field is always set to the disk reported value when sd_zbc_report_zones() is called. Link: https://lore.kernel.org/r/20200219063800.880834-1-damien.lemoal@wdc.com Fixes: d41003513e61 ("block: rework zone reporting") Cc: Cc: # v5.5 Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit d288bddd8374e0a043ac9dde64a1ae6a09411d74 Author: Martin Fuzzey Date: Wed Jan 29 14:40:06 2020 +0100 dmaengine: imx-sdma: fix context cache There is a DMA problem with the serial ports on i.MX6. When the following sequence is performed: 1) Open a port 2) Write some data 3) Close the port 4) Open a *different* port 5) Write some data 6) Close the port The second write sends nothing and the second close hangs. If the first close() is omitted it works. Adding logs to the the UART driver shows that the DMA is being setup but the callback is never invoked for the second write. This used to work in 4.19. Git bisect leads to: ad0d92d: "dmaengine: imx-sdma: refine to load context only once" This commit adds a "context_loaded" flag used to avoid unnecessary context setups. However the flag is only reset in sdma_channel_terminate_work(), which is only invoked in a worker triggered by sdma_terminate_all() IF there is an active descriptor. So, if no active descriptor remains when the channel is terminated, the flag is not reset and, when the channel is later reused the old context is used. Fix the problem by always resetting the flag in sdma_free_chan_resources(). Cc: stable@vger.kernel.org Signed-off-by: Martin Fuzzey Fixes: ad0d92d7ba6a ("dmaengine: imx-sdma: refine to load context only once") Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/1580305274-27274-1-git-send-email-martin.fuzzey@flowbird.group Signed-off-by: Vinod Koul commit 3104abd1161bd9cfcad91a29fea72b87d813cf48 Author: Lukas Bulwahn Date: Sun Feb 23 10:09:50 2020 +0100 MAINTAINERS: clean up PCIE DRIVER FOR CAVIUM THUNDERX Commit e1ac611f57c9 ("dt-bindings: PCI: Convert generic host binding to DT schema") combines all information from pci-thunder-{pem,ecam}.txt into host-generic-pci.yaml, and deleted the two files in Documentation/devicetree/bindings/pci/. Since then, ./scripts/get_maintainer.pl --self-test complains: no file matches F: Documentation/devicetree/bindings/pci/pci-thunder-* As the PCIE DRIVER FOR CAVIUM THUNDERX-relevant information is only a small part of the host-generic-pci.yaml, do not add this file to the PCIE DRIVER FOR CAVIUM THUNDERX entry, and only drop the reference to the removed files. Signed-off-by: Lukas Bulwahn Acked-by: Robert Richter Signed-off-by: Rob Herring commit 50e7e7f6f2d040dd16a636f408eab9184abc63f8 Author: Dave Jiang Date: Wed Feb 19 10:24:56 2020 -0700 dmaengine: idxd: wq size configuration needs to check global max size The current size_store() function for idxd sysfs does not check the total wq size. This allows configuration of all wqs with total wq size. Add check to make sure the wq sysfs attribute rejects storing of size over the total wq size. Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver") Reported-by: Jerry Chen Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/158213309629.2509.3583411832507185041.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 88402c5b1ba7498217027c8a54e8df61d030500c Author: Dave Jiang Date: Wed Feb 19 10:24:08 2020 -0700 dmaengine: idxd: sysfs input of wq incorrect wq type should return error Currently when inputing an unrecognized wq type, we set the wq type to "none". It really should return error and not change the existing wq type that's in the kernel. Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver") Reported-by: Yixin Zhang Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/158213304803.2290.13336343633425868211.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 36d5d22090d13fd3a7a8c9663a711cbe6970aac8 Author: Dan Carpenter Date: Mon Feb 17 17:40:50 2020 +0300 dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() The caller is already holding the lock so this will deadlock. Fixes: 0b58828c923e ("DMAENGINE: COH 901 318 remove irq counting") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20200217144050.3i4ymbytogod4ijn@kili.mountain Signed-off-by: Vinod Koul commit 41726c9a50e7464beca7112d0aebf3a0090c62d2 Author: Jens Axboe Date: Sun Feb 23 13:11:42 2020 -0700 io_uring: fix personality idr leak We somehow never free the idr, even though we init it for every ctx. Free it when the rest of the ring data is freed. Fixes: 071698e13ac6 ("io_uring: allow registering credentials") Reviewed-by: Stefano Garzarella Signed-off-by: Jens Axboe commit fbb30168c7395b9cfeb9e6f7b0c0bca854a6552d Author: John Bates Date: Thu Feb 20 14:53:19 2020 -0800 drm/virtio: fix resource id creation race The previous code was not thread safe and caused undefined behavior from spurious duplicate resource IDs. In this patch, an atomic_t is used instead. We no longer see any duplicate IDs in tests with this change. Fixes: 16065fcdd19d ("drm/virtio: do NOT reuse resource ids") Signed-off-by: John Bates Reviewed-by: Chia-I Wu Link: http://patchwork.freedesktop.org/patch/msgid/20200220225319.45621-1-jbates@chromium.org Signed-off-by: Gerd Hoffmann commit d171c45da874e3858a83e6377e00280a507fe2f2 Author: Ezequiel Garcia Date: Tue Feb 4 20:38:37 2020 +0100 media: hantro: Fix broken media controller links The driver currently creates a broken topology, with a source-to-source link and a sink-to-sink link instead of two source-to-sink links. Reported-by: Nicolas Dufresne Cc: # for v5.3 and up Signed-off-by: Ezequiel Garcia Tested-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 044041cd5227ec9ccf969f4bf1cc08bffe13b9d3 Author: Hans Verkuil Date: Tue Feb 4 19:19:22 2020 +0100 media: mc-entity.c: use & to check pad flags, not == These are bits so to test if a pad is a sink you use & but not ==. It looks like the only reason this hasn't caused problems before is that media_get_pad_index() is currently only used with pads that do not set the MEDIA_PAD_FL_MUST_CONNECT flag. So a pad really had only the SINK or SOURCE flag set and nothing else. Signed-off-by: Hans Verkuil Cc: # for v5.3 and up Signed-off-by: Mauro Carvalho Chehab commit 316e730f1d8bb029fe6cec2468fb2a50424485b3 Author: Hans Verkuil Date: Tue Feb 4 19:13:06 2020 +0100 media: v4l2-mem2mem.c: fix broken links The topology that v4l2_m2m_register_media_controller() creates for a processing block actually created a source-to-source link and a sink-to-sink link instead of two source-to-sink links. Unfortunately v4l2-compliance never checked for such bad links, so this went unreported for quite some time. Signed-off-by: Hans Verkuil Reported-by: Nicolas Dufresne Cc: # for v4.19 and up Signed-off-by: Mauro Carvalho Chehab commit 49a56266f96f2c6608373464af8755b431ef1513 Author: Hans Verkuil Date: Tue Feb 4 13:45:04 2020 +0100 media: vicodec: process all 4 components for RGB32 formats Only ARGB32-type pixelformat were assumed to have 4 components, which is wrong since RGB32-type pixelformats may have an alpha channel, so they should also assume 4 color components. The XRGB32-type pixelformats really have only 3 color components, but this complicated matters since that creates strides that are sometimes width * 3 and sometimes width * 4, and in fact this can result in buffer overflows. Keep things simple by just always processing all 4 color components. In the future we might want to optimize this again for the XRGB32-type pixelformats, but for now keep it simple and robust. Signed-off-by: Hans Verkuil Cc: # for v5.4 and up Signed-off-by: Mauro Carvalho Chehab commit aa9eda76129c9f44c4dd7e233b04bc70c0f56e12 Author: Hans Verkuil Date: Fri Jan 24 15:52:38 2020 +0100 media: pulse8-cec: close serio in disconnect, not adap_free The serio_close() call was moved to pulse8_cec_adap_free(), but that can be too late if that is called after the serio core pulled down the serio already, in which case you get a kernel oops. Keep it in the disconnect(). Signed-off-by: Hans Verkuil Fixes: 601282d65b96 ("media: pulse8-cec: use adap_free callback") Signed-off-by: Mauro Carvalho Chehab commit 34a818882e2f84704059dead1f02eb8943e222c3 Author: Hans Verkuil Date: Fri Jan 24 12:53:32 2020 +0100 media: pulse8-cec: INIT_DELAYED_WORK was called too late If earlier in the connect() an error occurred, then pulse8_cec_adap_free was called by cec_delete_adapter, and that free function tried to cancel the ping_eeprom_work workqueue, but that workqueue hasn't been initialized yet, resulting in a kernel warning. Move the initialization of that workqueue up to where the other workqueues are initialized. Signed-off-by: Hans Verkuil Fixes: 601282d65b96 ("media: pulse8-cec: use adap_free callback") Signed-off-by: Mauro Carvalho Chehab commit 21b388dca138b0fc540c76b065bc83281762a9b4 Author: Geert Uytterhoeven Date: Wed Feb 19 16:39:29 2020 +0100 ARM: dts: r8a7779: Remove deprecated "renesas, rcar-sata" compatible value The "renesas,rcar-sata" compatible value was deprecated by "renesas,sata-r8a7779" many years ago, in commit e67adb4e669db834 ("sata_rcar: Add R-Car Gen2 SATA PHY support"). Drop it. Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20200219153929.11073-1-geert+renesas@glider.be commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add Author: Naveen N. Rao Date: Thu Feb 20 17:01:32 2020 +0530 powerpc: Include .BTF section Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld: ld: warning: orphan section `.BTF' from `.btf.vmlinux.bin.o' being placed in section `.BTF' Include .BTF section in vmlinux explicitly to fix the same. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200220113132.857132-1-naveen.n.rao@linux.vnet.ibm.com commit a43ab30dcd4a1abcdd0d2461bf1cf7c0817f6cd3 Author: Ondrej Jirman Date: Fri Feb 21 21:27:26 2020 +0100 bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads When doing a 16-bit read that returns data in the MSB byte, the RSB_DATA register will keep the MSB byte unchanged when doing the following 8-bit read. sunxi_rsb_read() will then return a result that contains high byte from 16-bit read mixed with the 8-bit result. The consequence is that after this happens the PMIC's regmap will look like this: (0x33 is the high byte from the 16-bit read) % cat /sys/kernel/debug/regmap/sunxi-rsb-3a3/registers 00: 33 01: 33 02: 33 03: 33 04: 33 05: 33 06: 33 07: 33 08: 33 09: 33 0a: 33 0b: 33 0c: 33 0d: 33 0e: 33 [snip] Fix this by masking the result of the read with the correct mask based on the size of the read. There are no 16-bit users in the mainline kernel, so this doesn't need to get into the stable tree. Signed-off-by: Ondrej Jirman Acked-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard commit 3eb55e6f753a379e293395de8d5f3be28351a7f8 Author: Tina Zhang Date: Fri Feb 21 10:32:34 2020 +0800 drm/i915/gvt: Separate display reset from ALL_ENGINES reset ALL_ENGINES reset doesn't clobber display with the current gvt-g supported platforms. Thus ALL_ENGINES reset shouldn't reset the display engine registers emulated by gvt-g. This fixes guest warning like [ 14.622026] [drm] Initialized i915 1.6.0 20200114 for 0000:00:03.0 on minor 0 [ 14.967917] fbcon: i915drmfb (fb0) is primary device [ 25.100188] [drm:drm_atomic_helper_wait_for_dependencies [drm_kms_helper]] E RROR [CRTC:51:pipe A] flip_done timed out [ 25.100860] -----------[ cut here ]----------- [ 25.100861] pll on state mismatch (expected 0, found 1) [ 25.101024] WARNING: CPU: 1 PID: 30 at drivers/gpu/drm/i915/display/intel_dis play.c:14382 verify_single_dpll_state.isra.115+0x28f/0x320 [i915] [ 25.101025] Modules linked in: intel_rapl_msr intel_rapl_common kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel i915 aesni_intel cr ypto_simd cryptd glue_helper cec rc_core video drm_kms_helper joydev drm input_l eds i2c_algo_bit serio_raw fb_sys_fops syscopyarea sysfillrect sysimgblt mac_hid qemu_fw_cfg sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 e1000 psmouse i2c_piix4 pata_acpi floppy [ 25.101052] CPU: 1 PID: 30 Comm: kworker/u4:1 Not tainted 5.5.0+ #1 [ 25.101053] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1 .12.1-0-ga5cab58 04/01/2014 [ 25.101055] Workqueue: events_unbound async_run_entry_fn [ 25.101092] RIP: 0010:verify_single_dpll_state.isra.115+0x28f/0x320 [i915] [ 25.101093] Code: e0 d9 ff e9 a3 fe ff ff 80 3d e9 c2 11 00 00 44 89 f6 48 c7 c7 c0 9d 88 c0 75 3b e8 eb df d9 ff e9 c7 fe ff ff e8 d1 e0 ae c4 <0f> 0b e9 7a fe ff ff 80 3d c0 c2 11 00 00 8d 71 41 89 c2 48 c7 c7 [ 25.101093] RSP: 0018:ffffb1de80107878 EFLAGS: 00010286 [ 25.101094] RAX: 0000000000000000 RBX: ffffb1de80107884 RCX: 0000000000000007 [ 25.101095] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff94fdfdd19740 [ 25.101095] RBP: ffffb1de80107938 R08: 0000000d6bfdc7b4 R09: 000000000000002b [ 25.101096] R10: ffff94fdf82dc000 R11: 0000000000000225 R12: 00000000000001f8 [ 25.101096] R13: ffff94fdb3ca6a90 R14: ffff94fdb3ca0000 R15: 0000000000000000 [ 25.101097] FS: 0000000000000000(0000) GS:ffff94fdfdd00000(0000) knlGS:00000 00000000000 [ 25.101098] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.101098] CR2: 00007fbc3e2be9c8 CR3: 000000003339a003 CR4: 0000000000360ee0 [ 25.101101] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.101101] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.101102] Call Trace: [ 25.101139] intel_atomic_commit_tail+0xde4/0x1520 [i915] [ 25.101141] ? flush_workqueue_prep_pwqs+0xfa/0x130 [ 25.101142] ? flush_workqueue+0x198/0x3c0 [ 25.101174] intel_atomic_commit+0x2ad/0x320 [i915] [ 25.101209] drm_atomic_commit+0x4a/0x50 [drm] [ 25.101220] drm_client_modeset_commit_atomic+0x1c4/0x200 [drm] [ 25.101231] drm_client_modeset_commit_force+0x47/0x170 [drm] [ 25.101250] drm_fb_helper_restore_fbdev_mode_unlocked+0x4e/0xa0 [drm_kms_hel per] [ 25.101255] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] [ 25.101287] intel_fbdev_set_par+0x1a/0x40 [i915] [ 25.101289] ? con_is_visible+0x2e/0x60 [ 25.101290] fbcon_init+0x378/0x600 [ 25.101292] visual_init+0xd5/0x130 [ 25.101296] do_bind_con_driver+0x217/0x430 [ 25.101297] do_take_over_console+0x7d/0x1b0 [ 25.101298] do_fbcon_takeover+0x5c/0xb0 [ 25.101299] fbcon_fb_registered+0x199/0x1a0 [ 25.101301] register_framebuffer+0x22c/0x330 [ 25.101306] __drm_fb_helper_initial_config_and_unlock+0x31a/0x520 [drm_kms_h elper] [ 25.101311] drm_fb_helper_initial_config+0x35/0x40 [drm_kms_helper] [ 25.101341] intel_fbdev_initial_config+0x18/0x30 [i915] [ 25.101342] async_run_entry_fn+0x3c/0x150 [ 25.101343] process_one_work+0x1fd/0x3f0 [ 25.101344] worker_thread+0x34/0x410 [ 25.101346] kthread+0x121/0x140 [ 25.101346] ? process_one_work+0x3f0/0x3f0 [ 25.101347] ? kthread_park+0x90/0x90 [ 25.101350] ret_from_fork+0x35/0x40 [ 25.101351] --[ end trace b5b47d44cd998ba1 ]-- Fixes: 6294b61ba769 ("drm/i915/gvt: add missing display part reset for vGPU reset") Signed-off-by: Tina Zhang Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20200221023234.28635-1-tina.zhang@intel.com commit 253216ffb2a002a682c6f68bd3adff5b98b71de8 Author: Madhuparna Bhowmik Date: Sun Feb 23 20:03:02 2020 +0530 mac80211: rx: avoid RCU list traversal under mutex local->sta_mtx is held in __ieee80211_check_fast_rx_iface(). No need to use list_for_each_entry_rcu() as it also requires a cond argument to avoid false lockdep warnings when not used in RCU read-side section (with CONFIG_PROVE_RCU_LIST). Therefore use list_for_each_entry(); Signed-off-by: Madhuparna Bhowmik Link: https://lore.kernel.org/r/20200223143302.15390-1-madhuparnabhowmik10@gmail.com Signed-off-by: Johannes Berg commit e3ae39edbce6dc933fb1393490d1b5d76d3edb90 Author: Johannes Berg Date: Mon Feb 24 09:38:15 2020 +0100 nl80211: explicitly include if_vlan.h We use that here, and do seem to get it through some recursive include, but better include it explicitly. Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200224093814.1b9c258fec67.I45ac150d4e11c72eb263abec9f1f0c7add9bef2b@changeid Signed-off-by: Johannes Berg commit b642d4825441bf30c72b72deb739bd2d5f53af08 Author: Ondrej Jirman Date: Sat Feb 22 23:31:53 2020 +0100 ARM: dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection USB-ID signal has a pullup on the schematic, but in reality it's not pulled up, so add a GPIO pullup. And we also need a usb0_vbus_power-supply for VBUS detection. This fixes OTG mode detection and charging issues on TBS A711 tablet. The issues came from ID pin reading 0, causing host mode to be enabled, when it should not be, leading to DRVVBUS being enabled, which disabled the charger. Fixes: f2f221c7810b824e ("ARM: dts: sun8i: a711: Enable USB OTG") Signed-off-by: Ondrej Jirman Signed-off-by: Maxime Ripard commit a40550952c000667b20082d58077bc647da6c890 Author: Ondrej Jirman Date: Sat Feb 22 23:31:52 2020 +0100 ARM: dts: sun8i-a83t-tbs-a711: HM5065 doesn't like such a high voltage Lowering the voltage solves the quick image degradation over time (minutes), that was probably caused by overheating. Signed-off-by: Ondrej Jirman Signed-off-by: Maxime Ripard commit f10e58a5d20e1cf3a39a842da92c9dd0c3c23849 Author: Leonard Crestez Date: Thu Feb 20 18:29:39 2020 +0200 soc: imx-scu: Align imx sc msg structs to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y. Fix by marking with __aligned(4). Fixes: 73feb4d0f8f1 ("soc: imx-scu: Add SoC UID(unique identifier) support") Signed-off-by: Leonard Crestez Signed-off-by: Shawn Guo commit f5bfeff44612d304deb100065a9f712309dc2783 Author: Leonard Crestez Date: Thu Feb 20 18:29:36 2020 +0200 firmware: imx: Align imx_sc_msg_req_cpu_start to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y. Fix by marking with __aligned(4). Fixes: d90bf296ae18 ("firmware: imx: Add support to start/stop a CPU") Signed-off-by: Leonard Crestez Signed-off-by: Shawn Guo commit 7c1a1c814ccc858633c761951c2546041202b24e Author: Leonard Crestez Date: Thu Feb 20 18:29:35 2020 +0200 firmware: imx: scu-pd: Align imx sc msg structs to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y. Fix by marking with __aligned(4). Fixes: c800cd7824bd ("firmware: imx: add SCU power domain driver") Signed-off-by: Leonard Crestez Signed-off-by: Shawn Guo commit 1e6a4eba693ac72e6f91b4252458c933110e5f4c Author: Leonard Crestez Date: Thu Feb 20 18:29:34 2020 +0200 firmware: imx: misc: Align imx sc msg structs to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y: BUG: KASAN: stack-out-of-bounds in imx_mu_send_data+0x108/0x1f0 It shouldn't cause an issues in normal use because these structs are always allocated on the stack. Fixes: 15e1f2bc8b3b ("firmware: imx: add misc svc support") Signed-off-by: Leonard Crestez Signed-off-by: Shawn Guo commit 26d0fba29c96241de8a9d16f045b1de49875884c Author: Leonard Crestez Date: Thu Feb 20 18:10:01 2020 +0200 firmware: imx: scu: Ensure sequential TX SCU requires that all messages words are written sequentially but linux MU driver implements multiple independent channels for each register so ordering between different channels must be ensured by SCU API interface. Wait for tx_done before every send to ensure that no queueing happens at the mailbox channel level. Fixes: edbee095fafb ("firmware: imx: add SCU firmware driver support") Signed-off-by: Leonard Crestez Cc: Reviewed-by: Peng Fan Reviewed-by:: Oleksij Rempel Signed-off-by: Shawn Guo commit 6132c1d9033d158bd0464e90bc46544fbe0bd6bc Author: Madhuparna Bhowmik Date: Sun Feb 23 16:52:33 2020 +0530 net: core: devlink.c: Hold devlink->lock from the beginning of devlink_dpipe_table_register() devlink_dpipe_table_find() should be called under either rcu_read_lock() or devlink->lock. devlink_dpipe_table_register() calls devlink_dpipe_table_find() without holding the lock and acquires it later. Therefore hold the devlink->lock from the beginning of devlink_dpipe_table_register(). Suggested-by: Jiri Pirko Signed-off-by: Madhuparna Bhowmik Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 503ba7c6961034ff0047707685644cad9287c226 Author: Florian Fainelli Date: Thu Feb 20 15:34:53 2020 -0800 net: phy: Avoid multiple suspends It is currently possible for a PHY device to be suspended as part of a network device driver's suspend call while it is still being attached to that net_device, either via phy_suspend() or implicitly via phy_stop(). Later on, when the MDIO bus controller get suspended, we would attempt to suspend again the PHY because it is still attached to a network device. This is both a waste of time and creates an opportunity for improper clock/power management bugs to creep in. Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 44343418d0f2f623cb9da6f5000df793131cbe3b Author: Marek Vasut Date: Sun Feb 23 14:38:40 2020 +0100 net: ks8851-ml: Fix IRQ handling and locking The KS8851 requires that packet RX and TX are mutually exclusive. Currently, the driver hopes to achieve this by disabling interrupt from the card by writing the card registers and by disabling the interrupt on the interrupt controller. This however is racy on SMP. Replace this approach by expanding the spinlock used around the ks_start_xmit() TX path to ks_irq() RX path to assure true mutual exclusion and remove the interrupt enabling/disabling, which is now not needed anymore. Furthermore, disable interrupts also in ks_net_stop(), which was missing before. Note that a massive improvement here would be to re-use the KS8851 driver approach, which is to move the TX path into a worker thread, interrupt handling to threaded interrupt, and synchronize everything with mutexes, but that would be a much bigger rework, for a separate patch. Signed-off-by: Marek Vasut Cc: David S. Miller Cc: Lukas Wunner Cc: Petr Stetiar Cc: YueHaibing Signed-off-by: David S. Miller commit 52df1e564eb0470b2ecd1481e457932f09f49f5d Author: Jonathan Neuschäfer Date: Sun Feb 23 18:46:31 2020 +0100 docs: networking: phy: Rephrase paragraph for clarity Let's make it a little easier to read. Signed-off-by: Jonathan Neuschäfer Signed-off-by: David S. Miller commit c77ec025346f122bb74719725331c6386bbb86b7 Author: Mauro Carvalho Chehab Date: Sat Feb 22 10:00:04 2020 +0100 docs: adm1177: fix a broken reference This reference was missing the .rst extension. This would be OK if it were using the :doc: directive. So, switch to it. As a side effect, this will create cross-reference links at html output. Signed-off-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/8d37f465888656224855a21f5bb01edb1ca66cf3.1582361738.git.mchehab+huawei@kernel.org Signed-off-by: Guenter Roeck commit 2773fe1d31c42ffae2a9cb9a6055d99dd86e2fee Author: Oleksandr Suvorov Date: Wed Feb 19 13:11:24 2020 +0000 ARM: dts: imx7-colibri: Fix frequency for sd/mmc SD/MMC on Colibri iMX7S/D modules successfully support 200Mhz frequency in HS200 mode. Removing the unnecessary max-frequency limit significantly increases the performance: == before fix ==== root@colibri-imx7-emmc:~# hdparm -t /dev/mmcblk0 /dev/mmcblk0: Timing buffered disk reads: 252 MB in 3.02 seconds = 83.54 MB/sec ================== === after fix ==== root@colibri-imx7-emmc:~# hdparm -t /dev/mmcblk0 /dev/mmcblk0: Timing buffered disk reads: 408 MB in 3.00 seconds = 135.94 MB/sec ================== Fixes: f928a4a377e4 ("ARM: dts: imx7: add Toradex Colibri iMX7D 1GB (eMMC) support") Signed-off-by: Oleksandr Suvorov Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 193155c8c9429f57400daf1f2ef0075016767112 Author: Jens Axboe Date: Sat Feb 22 23:22:19 2020 -0700 io_uring: handle multiple personalities in link chains If we have a chain of requests and they don't all use the same credentials, then the head of the chain will be issued with the credentails of the tail of the chain. Ensure __io_queue_sqe() overrides the credentials, if they are different. Once we do that, we can clean up the creds handling as well, by only having io_submit_sqe() do the lookup of a personality. It doesn't need to assign it, since __io_queue_sqe() now always does the right thing. Fixes: 75c6a03904e0 ("io_uring: support using a registered personality for commands") Reported-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 66d0e797bf095d407479c89952d42b1d96ef0a7f Author: Orson Zhai Date: Fri Feb 21 01:37:04 2020 +0800 Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs" This reverts commit 4585fbcb5331fc910b7e553ad3efd0dd7b320d14. The name changing as devfreq(X) breaks some user space applications, such as Android HAL from Unisoc and Hikey [1]. The device name will be changed unexpectly after every boot depending on module init sequence. It will make trouble to setup some system configuration like selinux for Android. So we'd like to revert it back to old naming rule before any better way being found. [1] https://lkml.org/lkml/2018/5/8/1042 Cc: John Stultz Cc: Greg Kroah-Hartman Cc: stable@vger.kernel.org Signed-off-by: Orson Zhai Acked-by: Greg Kroah-Hartman Signed-off-by: Chanwoo Choi commit dad8cea7add96a353fa1898b5ccefbb72da66f29 Author: Neal Cardwell Date: Sat Feb 22 11:21:15 2020 -0500 tcp: fix TFO SYNACK undo to avoid double-timestamp-undo In a rare corner case the new logic for undo of SYNACK RTO could result in triggering the warning in tcp_fastretrans_alert() that says: WARN_ON(tp->retrans_out != 0); The warning looked like: WARNING: CPU: 1 PID: 1 at net/ipv4/tcp_input.c:2818 tcp_ack+0x13e0/0x3270 The sequence that tickles this bug is: - Fast Open server receives TFO SYN with data, sends SYNACK - (client receives SYNACK and sends ACK, but ACK is lost) - server app sends some data packets - (N of the first data packets are lost) - server receives client ACK that has a TS ECR matching first SYNACK, and also SACKs suggesting the first N data packets were lost - server performs TS undo of SYNACK RTO, then immediately enters recovery - buggy behavior then performed a *second* undo that caused the connection to be in CA_Open with retrans_out != 0 Basically, the incoming ACK packet with SACK blocks causes us to first undo the cwnd reduction from the SYNACK RTO, but then immediately enters fast recovery, which then makes us eligible for undo again. And then tcp_rcv_synrecv_state_fastopen() accidentally performs an undo using a "mash-up" of state from two different loss recovery phases: it uses the timestamp info from the ACK of the original SYNACK, and the undo_marker from the fast recovery. This fix refines the logic to only invoke the tcp_try_undo_loss() inside tcp_rcv_synrecv_state_fastopen() if the connection is still in CA_Loss. If peer SACKs triggered fast recovery, then tcp_rcv_synrecv_state_fastopen() can't safely undo. Fixes: 794200d66273 ("tcp: undo cwnd on Fast Open spurious SYNACK retransmit") Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit f6f13c125e05603f68f5bf31f045b95e6d493598 Author: Haiyang Zhang Date: Fri Feb 21 08:32:18 2020 -0800 hv_netvsc: Fix unwanted wakeup in netvsc_attach() When netvsc_attach() is called by operations like changing MTU, etc., an extra wakeup may happen while netvsc_attach() calling rndis_filter_device_add() which sends rndis messages when queue is stopped in netvsc_detach(). The completion message will wake up queue 0. We can reproduce the issue by changing MTU etc., then the wake_queue counter from "ethtool -S" will increase beyond stop_queue counter: stop_queue: 0 wake_queue: 1 The issue causes queue wake up, and counter increment, no other ill effects in current code. So we didn't see any network problem for now. To fix this, initialize tx_disable to true, and set it to false when the NIC is ready to be attached or registered. Fixes: 7b2ee50c0cd5 ("hv_netvsc: common detach logic") Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit e08658a657f974590809290c62e889f0fd420200 Author: Ravi Bangoria Date: Sat Feb 22 13:50:49 2020 +0530 powerpc/watchpoint: Don't call dar_within_range() for Book3S DAR is set to the first byte of overlap between actual access and watched range at DSI on Book3S processor. But actual access range might or might not be within user asked range. So for Book3S, it must not call dar_within_range(). This revert portion of commit 39413ae00967 ("powerpc/hw_breakpoints: Rewrite 8xx breakpoints to allow any address range size."). Before patch: # ./tools/testing/selftests/powerpc/ptrace/perf-hwbreak ... TESTED: No overlap FAILED: Partial overlap: 0 != 2 TESTED: Partial overlap TESTED: No overlap FAILED: Full overlap: 0 != 2 failure: perf_hwbreak After patch: TESTED: No overlap TESTED: Partial overlap TESTED: Partial overlap TESTED: No overlap TESTED: Full overlap success: perf_hwbreak Fixes: 39413ae00967 ("powerpc/hw_breakpoints: Rewrite 8xx breakpoints to allow any address range size.") Reported-by: Michael Ellerman Signed-off-by: Ravi Bangoria Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200222082049.330435-1-ravi.bangoria@linux.ibm.com commit f8788d86ab28f61f7b46eb6be375f8a726783636 Author: Linus Torvalds Date: Sun Feb 23 16:17:42 2020 -0800 Linux 5.6-rc3 commit eae7172f8141eb98e64e6e81acc9e9d5b2add127 Author: Daniele Palmas Date: Fri Feb 21 14:17:05 2020 +0100 net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch usbnet creates network interfaces with min_mtu = 0 and max_mtu = ETH_MAX_MTU. These values are not modified by qmi_wwan when the network interface is created initially, allowing, for example, to set mtu greater than 1500. When a raw_ip switch is done (raw_ip set to 'Y', then set to 'N') the mtu values for the network interface are set through ether_setup, with min_mtu = ETH_MIN_MTU and max_mtu = ETH_DATA_LEN, not allowing anymore to set mtu greater than 1500 (error: mtu greater than device maximum). The patch restores the original min/max mtu values set by usbnet after a raw_ip switch. Signed-off-by: Daniele Palmas Acked-by: Bjørn Mork Signed-off-by: David S. Miller commit d2eee25858f246051b49c42c411629c78513e2a8 Merge: a3163ca03f99 a5ae50dea911 Author: Linus Torvalds Date: Sun Feb 23 09:43:50 2020 -0800 Merge tag 'for-5.6-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "These are fixes that were found during testing with help of error injection, plus some other stable material. There's a fixup to patch added to rc1 causing locking in wrong context warnings, tests found one more deadlock scenario. The patches are tagged for stable, two of them now in the queue but we'd like all three released at the same time. I'm not happy about fixes to fixes in such a fast succession during rcs, but I hope we found all the fallouts of commit 28553fa992cb ('Btrfs: fix race between shrinking truncate and fiemap')" * tag 'for-5.6-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: fix deadlock during fast fsync when logging prealloc extents beyond eof Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents btrfs: fix bytes_may_use underflow in prealloc error condtition btrfs: handle logged extent failure properly btrfs: do not check delayed items are empty for single transaction cleanup btrfs: reset fs_root to NULL on error in open_ctree btrfs: destroy qgroup extent records on transaction abort commit a3163ca03f9913ba2c2fb6a06305f3dca98adfd1 Merge: c6188dff33fb 9db176bceb5c Author: Linus Torvalds Date: Sun Feb 23 09:42:19 2020 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "More miscellaneous ext4 bug fixes (all stable fodder)" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix mount failure with quota configured as module jbd2: fix ocfs2 corrupt when clearing block group bits ext4: fix race between writepages and enabling EXT4_EXTENTS_FL ext4: rename s_journal_flag_rwsem to s_writepages_rwsem ext4: fix potential race between s_flex_groups online resizing and access ext4: fix potential race between s_group_info online resizing and access ext4: fix potential race between online resizing and write operations ext4: add cond_resched() to __ext4_find_entry() ext4: fix a data race in EXT4_I(inode)->i_disksize commit c6188dff33fba320826e87e387ae6efffab0525d Merge: dca132a60f22 99db590b083f Author: Linus Torvalds Date: Sun Feb 23 09:37:41 2020 -0800 Merge tag 'csky-for-linus-5.6-rc3' of git://github.com/c-sky/csky-linux Pull csky updates from Guo Ren: "Sorry, I missed 5.6-rc1 merge window, but in this pull request the most are the fixes and the rests are between fixes and features. The only outside modification is the MAINTAINERS file update with our mailing list. - cache flush implementation fixes - ftrace modify panic fix - CONFIG_SMP boot problem fix - fix pt_regs saving for atomic.S - fix fixaddr_init without highmem. - fix stack protector support - fix fake Tightly-Coupled Memory code compile and use - fix some typos and coding convention" * tag 'csky-for-linus-5.6-rc3' of git://github.com/c-sky/csky-linux: (23 commits) csky: Replace by csky: Implement copy_thread_tls csky: Add PCI support csky: Minimize defconfig to support buildroot config.fragment csky: Add setup_initrd check code csky: Cleanup old Kconfig options arch/csky: fix some Kconfig typos csky: Fixup compile warning for three unimplemented syscalls csky: Remove unused cache implementation csky: Fixup ftrace modify panic csky: Add flush_icache_mm to defer flush icache all csky: Optimize abiv2 copy_to_user_page with VM_EXEC csky: Enable defer flush_dcache_page for abiv2 cpus (807/810/860) csky: Remove unnecessary flush_icache_* implementation csky: Support icache flush without specific instructions csky/Kconfig: Add Kconfig.platforms to support some drivers csky/smp: Fixup boot failed when CONFIG_SMP csky: Set regs->usp to kernel sp, when the exception is from kernel csky/mm: Fixup export invalid_pte_table symbol csky: Separate fixaddr_init from highmem ... commit 35a571346a94fb93b5b3b6a599675ef3384bc75c Author: Oliver Upton Date: Tue Feb 4 15:26:31 2020 -0800 KVM: nVMX: Check IO instruction VM-exit conditions Consult the 'unconditional IO exiting' and 'use IO bitmaps' VM-execution controls when checking instruction interception. If the 'use IO bitmaps' VM-execution control is 1, check the instruction access against the IO bitmaps to determine if the instruction causes a VM-exit. Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit e71237d3ff1abf9f3388337cfebf53b96df2020d Author: Oliver Upton Date: Tue Feb 4 15:26:30 2020 -0800 KVM: nVMX: Refactor IO bitmap checks into helper function Checks against the IO bitmap are useful for both instruction emulation and VM-exit reflection. Refactor the IO bitmap checks into a helper function. Signed-off-by: Oliver Upton Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 07721feee46b4b248402133228235318199b05ec Author: Paolo Bonzini Date: Tue Feb 4 15:26:29 2020 -0800 KVM: nVMX: Don't emulate instructions in guest mode vmx_check_intercept is not yet fully implemented. To avoid emulating instructions disallowed by the L1 hypervisor, refuse to emulate instructions by default. Cc: stable@vger.kernel.org [Made commit, added commit msg - Oliver] Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit 5ef8acbdd687c9d72582e2c05c0b9756efb37863 Author: Oliver Upton Date: Fri Feb 7 02:36:07 2020 -0800 KVM: nVMX: Emulate MTF when performing instruction emulation Since commit 5f3d45e7f282 ("kvm/x86: add support for MONITOR_TRAP_FLAG"), KVM has allowed an L1 guest to use the monitor trap flag processor-based execution control for its L2 guest. KVM simply forwards any MTF VM-exits to the L1 guest, which works for normal instruction execution. However, when KVM needs to emulate an instruction on the behalf of an L2 guest, the monitor trap flag is not emulated. Add the necessary logic to kvm_skip_emulated_instruction() to synthesize an MTF VM-exit to L1 upon instruction emulation for L2. Fixes: 5f3d45e7f282 ("kvm/x86: add support for MONITOR_TRAP_FLAG") Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit dd58f3c95c98e6e2cf30d9e562cae0503c5f2713 Author: Li RongQing Date: Sun Feb 23 16:13:12 2020 +0800 KVM: fix error handling in svm_hardware_setup rename svm_hardware_unsetup as svm_hardware_teardown, move it before svm_hardware_setup, and call it to free all memory if fail to setup in svm_hardware_setup, otherwise memory will be leaked remove __exit attribute for it since it is called in __init function Signed-off-by: Li RongQing Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 39f3b41aa7cae917f928ef9f31d09da28188e5ed Author: Paolo Abeni Date: Fri Feb 21 19:42:13 2020 +0100 net: genetlink: return the error code when attribute parsing fails. Currently if attribute parsing fails and the genl family does not support parallel operation, the error code returned by __nlmsg_parse() is discarded by genl_family_rcv_msg_attrs_parse(). Be sure to report the error for all genl families. Fixes: c10e6cf85e7d ("net: genetlink: push attrbuf allocation and parsing to a separate function") Fixes: ab5b526da048 ("net: genetlink: always allocate separate attrs for dumpit ops") Signed-off-by: Paolo Abeni Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 3e72dfdf8227b052393f71d820ec7599909dddc2 Author: Matteo Croce Date: Fri Feb 21 12:28:38 2020 +0100 ipv4: ensure rcu_read_lock() in cipso_v4_error() Similarly to commit c543cb4a5f07 ("ipv4: ensure rcu_read_lock() in ipv4_link_failure()"), __ip_options_compile() must be called under rcu protection. Fixes: 3da1ed7ac398 ("net: avoid use IPCB in cipso_v4_error") Suggested-by: Guillaume Nault Signed-off-by: Matteo Croce Acked-by: Paul Moore Signed-off-by: David S. Miller commit 42d84c8490f9f0931786f1623191fcab397c3d64 Author: Eugenio Pérez Date: Fri Feb 21 12:06:56 2020 +0100 vhost: Check docket sk_family instead of call getname Doing so, we save one call to get data we already have in the struct. Also, since there is no guarantee that getname use sockaddr_ll parameter beyond its size, we add a little bit of security here. It should do not do beyond MAX_ADDR_LEN, but syzbot found that ax25_getname writes more (72 bytes, the size of full_sockaddr_ax25, versus 20 + 32 bytes of sockaddr_ll + MAX_ADDR_LEN in syzbot repro). Fixes: 3a4d5c94e9593 ("vhost_net: a kernel-level virtio server") Reported-by: syzbot+f2a62d07a5198c819c7b@syzkaller.appspotmail.com Signed-off-by: Eugenio Pérez Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit 99db590b083fa2bc60adfcb5c839a62db4ef1d79 Author: Geert Uytterhoeven Date: Wed Feb 12 11:10:58 2020 +0100 csky: Replace by The C-Sky platform code is not a clock provider, and just needs to call of_clk_init(). Hence it can include instead of . Signed-off-by: Geert Uytterhoeven Signed-off-by: Guo Ren commit dca132a60f226f4cbaa98807518a5ca6cff112ce Merge: f3cc24942e95 51dede9c05df Author: Linus Torvalds Date: Sat Feb 22 18:02:10 2020 -0800 Merge tag 'ras-urgent-2020-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fixes from Thomas Gleixner: "Two fixes for the AMD MCE driver: - Populate the per CPU MCA bank descriptor pointer only after it has been completely set up to prevent a use-after-free in case that one of the subsequent initialization step fails - Implement a proper release function for the sysfs entries of MCA threshold controls instead of freeing the memory right in the CPU teardown code, which leads to another use-after-free when the associated sysfs file is opened and accessed" * tag 'ras-urgent-2020-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce/amd: Fix kobject lifetime x86/mce/amd: Publish the bank pointer only after setup has succeeded commit 2ad3e17ebf94b7b7f3f64c050ff168f9915345eb Author: Paul Moore Date: Sat Feb 22 20:36:47 2020 -0500 audit: fix error handling in audit_data_to_entry() Commit 219ca39427bf ("audit: use union for audit_field values since they are mutually exclusive") combined a number of separate fields in the audit_field struct into a single union. Generally this worked just fine because they are generally mutually exclusive. Unfortunately in audit_data_to_entry() the overlap can be a problem when a specific error case is triggered that causes the error path code to attempt to cleanup an audit_field struct and the cleanup involves attempting to free a stored LSM string (the lsm_str field). Currently the code always has a non-NULL value in the audit_field.lsm_str field as the top of the for-loop transfers a value into audit_field.val (both .lsm_str and .val are part of the same union); if audit_data_to_entry() fails and the audit_field struct is specified to contain a LSM string, but the audit_field.lsm_str has not yet been properly set, the error handling code will attempt to free the bogus audit_field.lsm_str value that was set with audit_field.val at the top of the for-loop. This patch corrects this by ensuring that the audit_field.val is only set when needed (it is cleared when the audit_field struct is allocated with kcalloc()). It also corrects a few other issues to ensure that in case of error the proper error code is returned. Cc: stable@vger.kernel.org Fixes: 219ca39427bf ("audit: use union for audit_field values since they are mutually exclusive") Reported-by: syzbot+1f4d90ead370d72e450b@syzkaller.appspotmail.com Signed-off-by: Paul Moore commit f3cc24942e955604232e3b4b0dac6a54cbc7c679 Merge: fca1037864a9 2546287c5fb3 Author: Linus Torvalds Date: Sat Feb 22 17:25:46 2020 -0800 Merge tag 'irq-urgent-2020-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "Two fixes for the irq core code which are follow ups to the recent MSI fixes: - The WARN_ON which was put into the MSI setaffinity callback for paranoia reasons actually triggered via a callchain which escaped when all the possible ways to reach that code were analyzed. The proc/irq/$N/*affinity interfaces have a quirk which came in when ALPHA moved to the generic interface: In case that the written affinity mask does not contain any online CPU it calls into ALPHAs magic auto affinity setting code. A few years later this mechanism was also made available to x86 for no good reasons and in a way which circumvents all sanity checks for interrupts which cannot have their affinity set from process context on X86 due to the way the X86 interrupt delivery works. It would be possible to make this work properly, but there is no point in doing so. If the interrupt is not yet started then the affinity setting has no effect and if it is started already then it is already assigned to an online CPU so there is no point to randomly move it to some other CPU. Just return EINVAL as the code has done before that change forever. - The new MSI quirk bit in the irq domain flags turned out to be already occupied, which escaped the author and the reviewers because the already in use bits were 0,6,2,3,4,5 listed in that order. That bit 6 was simply overlooked because the ordering was straight forward linear otherwise. So the new bit ended up being a duplicate. Fix it up by switching the oddball 6 to the obvious 1" * tag 'irq-urgent-2020-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/irqdomain: Make sure all irq domain flags are distinct genirq/proc: Reject invalid affinity masks (again) commit fca1037864a9fb75c9c48cb65649b24de8101ec4 Merge: 0a115e5f23b9 21b5ee59ef18 Author: Linus Torvalds Date: Sat Feb 22 17:08:16 2020 -0800 Merge tag 'x86-urgent-2020-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "Two fixes for x86: - Remove the __force_oder definiton from the kaslr boot code as it is already defined in the page table code which makes GCC 10 builds fail because it changed the default to -fno-common. - Address the AMD erratum 1054 concerning the IRPERF capability and enable the Instructions Retired fixed counter on machines which are not affected by the erratum" * tag 'x86-urgent-2020-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu/amd: Enable the fixed Instructions Retired counter IRPERF x86/boot/compressed: Don't declare __force_order in kaslr_64.c commit 0a115e5f23b948be369faf14d3bccab283830f56 Merge: b88025ea47ec 4c5fd3b791a0 Author: Linus Torvalds Date: Sat Feb 22 11:38:20 2020 -0800 Merge tag 'zonefs-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: "A single patch fixing typos in the documentation file" * tag 'zonefs-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: fix documentation typos etc. commit b88025ea47ec8aea47f0c283d182ab26bae2970d Merge: f6c69b7f5145 c7849be9cc2d Author: Linus Torvalds Date: Sat Feb 22 11:12:55 2020 -0800 Merge tag 'io_uring-5.6-2020-02-22' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Here's a small collection of fixes that were queued up: - Remove unnecessary NULL check (Dan) - Missing io_req_cancelled() call in fallocate (Pavel) - Put the cleanup check for aux data in the right spot (Pavel) - Two fixes for SQPOLL (Stefano, Xiaoguang)" * tag 'io_uring-5.6-2020-02-22' of git://git.kernel.dk/linux-block: io_uring: fix __io_iopoll_check deadlock in io_sq_thread io_uring: prevent sq_thread from spinning when it should stop io_uring: fix use-after-free by io_cleanup_req() io_uring: remove unnecessary NULL checks io_uring: add missing io_req_cancelled() commit f6c69b7f51456a914da11c4ad1b14eba933d36aa Merge: b98b809c0a13 ae7bbc091351 Author: Linus Torvalds Date: Sat Feb 22 11:09:06 2020 -0800 Merge tag 'block-5.6-2020-02-22' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Just a set of NVMe fixes via Keith" * tag 'block-5.6-2020-02-22' of git://git.kernel.dk/linux-block: nvme-multipath: Fix memory leak with ana_log_buf nvme: Fix uninitialized-variable warning nvme-pci: Use single IRQ vector for old Apple models nvme/pci: Add sleep quirk for Samsung and Toshiba drives commit b98b809c0a1311239605e8d2ce1583191d3efd5b Merge: 5b442b1a4e9a 807b9515b7d0 Author: Linus Torvalds Date: Sat Feb 22 11:00:52 2020 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four non-core fixes. Two are reverts of target fixes which turned out to have unwanted side effects, one is a revert of an RDMA fix with the same problem and the final one fixes an incorrect warning about memory allocation failures in megaraid_sas (the driver actually reduces the allocation size until it succeeds)" Signed-off-by: James E.J. Bottomley * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session" scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout" scsi: megaraid_sas: silence a warning scsi: Revert "target/core: Inline transport_lun_remove_cmd()" commit 5b442b1a4e9a19def99309b9831e276c21352ac1 Merge: fea630215a9e e61d23922532 Author: Linus Torvalds Date: Sat Feb 22 10:52:54 2020 -0800 Merge tag 'hwmon-for-v5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix crash in w83627ehf driver seen with W83627DHG-P - Fix lockdep splat in acpi_power_meter driver - Fix xdpe12284 documentation Sphinx warnings * tag 'hwmon-for-v5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (w83627ehf) Fix crash seen with W83627DHG-P hwmon: (acpi_power_meter) Fix lockdep splat Documentation/hwmon: fix xdpe12284 Sphinx warnings commit fea630215a9e767fd3917b2cb09ec3ded58f88a2 Merge: 591dd4c10146 854bdbae9058 Author: Linus Torvalds Date: Sat Feb 22 10:49:59 2020 -0800 Merge tag 'devicetree-fixes-for-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes deom Rob Herring: "A handful of fixes in DT bindings for MDIO bus, Allwinner CSI, OMAP HSMMC, and Tegra124 EMC" * tag 'devicetree-fixes-for-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: media: csi: Fix clocks description dt-bindings: media: csi: Add interconnects properties dt-bindings: net: mdio: remove compatible string from example dt-bindings: memory-controller: Update example for Tegra124 EMC dt-bindings: mmc: omap-hsmmc: Fix SDIO interrupt commit 591dd4c10146e541b9f7a461cb6b638ab313718d Merge: 54dedb5b571d 2db01da8d25f Author: Linus Torvalds Date: Sat Feb 22 10:43:41 2020 -0800 Merge tag 's390-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Remove ieee_emulation_warnings sysctl which is a dead code. - Avoid triggering rebuild of the kernel during make install. - Enable protected virtualization guest support in default configs. - Fix cio_ignore seq_file .next function to increase position index. And use kobj_to_dev instead of container_of in cio code. - Fix storage block address lists to contain absolute addresses in qdio code. - Few clang warnings and spelling fixes. * tag 's390-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/qdio: fill SBALEs with absolute addresses s390/qdio: fill SL with absolute addresses s390: remove obsolete ieee_emulation_warnings s390: make 'install' not depend on vmlinux s390/kaslr: Fix casts in get_random s390/mm: Explicitly compare PAGE_DEFAULT_KEY against zero in storage_key_init_range s390/pkey/zcrypt: spelling s/crytp/crypt/ s390/cio: use kobj_to_dev() API s390/defconfig: enable CONFIG_PROTECTED_VIRTUALIZATION_GUEST s390/cio: cio_ignore_proc_seq_next should increase position index commit c7849be9cc2dd2754c48ddbaca27c2de6d80a95d Author: Xiaoguang Wang Date: Sat Feb 22 14:46:05 2020 +0800 io_uring: fix __io_iopoll_check deadlock in io_sq_thread Since commit a3a0e43fd770 ("io_uring: don't enter poll loop if we have CQEs pending"), if we already events pending, we won't enter poll loop. In case SETUP_IOPOLL and SETUP_SQPOLL are both enabled, if app has been terminated and don't reap pending events which are already in cq ring, and there are some reqs in poll_list, io_sq_thread will enter __io_iopoll_check(), and find pending events, then return, this loop will never have a chance to exit. I have seen this issue in fio stress tests, to fix this issue, let io_sq_thread call io_iopoll_getevents() with argument 'min' being zero, and remove __io_iopoll_check(). Fixes: a3a0e43fd770 ("io_uring: don't enter poll loop if we have CQEs pending") Signed-off-by: Xiaoguang Wang Signed-off-by: Jens Axboe commit 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 Author: Jozsef Kadlecsik Date: Sat Feb 22 12:01:43 2020 +0100 netfilter: ipset: Fix forceadd evaluation path When the forceadd option is enabled, the hash:* types should find and replace the first entry in the bucket with the new one if there are no reuseable (deleted or timed out) entries. However, the position index was just not set to zero and remained the invalid -1 if there were no reuseable entries. Reported-by: syzbot+6a86565c74ebe30aea18@syzkaller.appspotmail.com Fixes: 23c42a403a9c ("netfilter: ipset: Introduction of new commands and protocol version 7") Signed-off-by: Jozsef Kadlecsik commit e43f1331e2ef913b8c566920c9af75e0ccdd1d3f Author: James Morse Date: Thu Feb 20 16:58:39 2020 +0000 arm64: Ask the compiler to __always_inline functions used by KVM at HYP KVM uses some of the static-inline helpers like icache_is_vipt() from its HYP code. This assumes the function is inlined so that the code is mapped to EL2. The compiler may decide not to inline these, and the out-of-line version may not be in the __hyp_text section. Add the additional __always_ hint to these static-inlines that are used by KVM. Signed-off-by: James Morse Signed-off-by: Marc Zyngier Acked-by: Will Deacon Link: https://lore.kernel.org/r/20200220165839.256881-4-james.morse@arm.com commit 8c2d146ee7a2e0782eea4dd70fddc1c837140136 Author: James Morse Date: Thu Feb 20 16:58:38 2020 +0000 KVM: arm64: Define our own swab32() to avoid a uapi static inline KVM uses swab32() when mediating GIC MMIO accesses if the GICV is badly aligned, and the host and guest differ in endianness. arm64 doesn't provide a __arch_swab32(), so __fswab32() is always backed by the macro implementation that the compiler reduces to a single instruction. But the static-inline causes problems for KVM if the compiler chooses not to inline this function, it may not be located in the __hyp_text where __vgic_v2_perform_cpuif_access() needs it. Create our own __kvm_swab32() macro that calls ___constant_swab32() directly. This way we know it will always be inlined. Signed-off-by: James Morse Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200220165839.256881-3-james.morse@arm.com commit 5c37f1ae1c335800d16b207cb578009c695dcd39 Author: James Morse Date: Thu Feb 20 16:58:37 2020 +0000 KVM: arm64: Ask the compiler to __always_inline functions used at HYP On non VHE CPUs, KVM's __hyp_text contains code run at EL2 while the rest of the kernel runs at EL1. This code lives in its own section with start and end markers so we can map it to EL2. The compiler may decide not to inline static-inline functions from the header file. It may also decide not to put these out-of-line functions in the same section, meaning they aren't mapped when called at EL2. Clang-9 does exactly this with __kern_hyp_va() and a few others when x18 is reserved for the shadow call stack. Add the additional __always_ hint to all the static-inlines that are called from a hyp file. Signed-off-by: James Morse Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200220165839.256881-2-james.morse@arm.com ---- kvm_get_hyp_vector() pulls in all the regular per-cpu accessors and this_cpu_has_cap(), fortunately its only called for VHE. commit f66ee0410b1c3481ee75e5db9b34547b4d582465 Author: Jozsef Kadlecsik Date: Tue Feb 11 23:20:43 2020 +0100 netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports In the case of huge hash:* types of sets, due to the single spinlock of a set the processing of the whole set under spinlock protection could take too long. There were four places where the whole hash table of the set was processed from bucket to bucket under holding the spinlock: - During resizing a set, the original set was locked to exclude kernel side add/del element operations (userspace add/del is excluded by the nfnetlink mutex). The original set is actually just read during the resize, so the spinlocking is replaced with rcu locking of regions. However, thus there can be parallel kernel side add/del of entries. In order not to loose those operations a backlog is added and replayed after the successful resize. - Garbage collection of timed out entries was also protected by the spinlock. In order not to lock too long, region locking is introduced and a single region is processed in one gc go. Also, the simple timer based gc running is replaced with a workqueue based solution. The internal book-keeping (number of elements, size of extensions) is moved to region level due to the region locking. - Adding elements: when the max number of the elements is reached, the gc was called to evict the timed out entries. The new approach is that the gc is called just for the matching region, assuming that if the region (proportionally) seems to be full, then the whole set does. We could scan the other regions to check every entry under rcu locking, but for huge sets it'd mean a slowdown at adding elements. - Listing the set header data: when the set was defined with timeout support, the garbage collector was called to clean up timed out entries to get the correct element numbers and set size values. Now the set is scanned to check non-timed out entries, without actually calling the gc for the whole set. Thanks to Florian Westphal for helping me to solve the SOFTIRQ-safe -> SOFTIRQ-unsafe lock order issues during working on the patch. Reported-by: syzbot+4b0e9d4ff3cf117837e5@syzkaller.appspotmail.com Reported-by: syzbot+c27b8d5010f45c666ed1@syzkaller.appspotmail.com Reported-by: syzbot+68a806795ac89df3aa1c@syzkaller.appspotmail.com Fixes: 23c42a403a9c ("netfilter: ipset: Introduction of new commands and protocol version 7") Signed-off-by: Jozsef Kadlecsik commit 9db176bceb5c5df4990486709da386edadc6bd1d Author: Jan Kara Date: Fri Feb 21 11:08:35 2020 +0100 ext4: fix mount failure with quota configured as module When CONFIG_QFMT_V2 is configured as a module, the test in ext4_feature_set_ok() fails and so mount of filesystems with quota or project features fails. Fix the test to use IS_ENABLED macro which works properly even for modules. Link: https://lore.kernel.org/r/20200221100835.9332-1-jack@suse.cz Fixes: d65d87a07476 ("ext4: improve explanation of a mount failure caused by a misconfigured kernel") Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 8eedabfd66b68a4623beec0789eac54b8c9d0fb6 Author: wangyan Date: Thu Feb 20 21:46:14 2020 +0800 jbd2: fix ocfs2 corrupt when clearing block group bits I found a NULL pointer dereference in ocfs2_block_group_clear_bits(). The running environment: kernel version: 4.19 A cluster with two nodes, 5 luns mounted on two nodes, and do some file operations like dd/fallocate/truncate/rm on every lun with storage network disconnection. The fallocate operation on dm-23-45 caused an null pointer dereference. The information of NULL pointer dereference as follows: [577992.878282] JBD2: Error -5 detected when updating journal superblock for dm-23-45. [577992.878290] Aborting journal on device dm-23-45. ... [577992.890778] JBD2: Error -5 detected when updating journal superblock for dm-24-46. [577992.890908] __journal_remove_journal_head: freeing b_committed_data [577992.890916] (fallocate,88392,52):ocfs2_extend_trans:474 ERROR: status = -30 [577992.890918] __journal_remove_journal_head: freeing b_committed_data [577992.890920] (fallocate,88392,52):ocfs2_rotate_tree_right:2500 ERROR: status = -30 [577992.890922] __journal_remove_journal_head: freeing b_committed_data [577992.890924] (fallocate,88392,52):ocfs2_do_insert_extent:4382 ERROR: status = -30 [577992.890928] (fallocate,88392,52):ocfs2_insert_extent:4842 ERROR: status = -30 [577992.890928] __journal_remove_journal_head: freeing b_committed_data [577992.890930] (fallocate,88392,52):ocfs2_add_clusters_in_btree:4947 ERROR: status = -30 [577992.890933] __journal_remove_journal_head: freeing b_committed_data [577992.890939] __journal_remove_journal_head: freeing b_committed_data [577992.890949] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [577992.890950] Mem abort info: [577992.890951] ESR = 0x96000004 [577992.890952] Exception class = DABT (current EL), IL = 32 bits [577992.890952] SET = 0, FnV = 0 [577992.890953] EA = 0, S1PTW = 0 [577992.890954] Data abort info: [577992.890955] ISV = 0, ISS = 0x00000004 [577992.890956] CM = 0, WnR = 0 [577992.890958] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000f8da07a9 [577992.890960] [0000000000000020] pgd=0000000000000000 [577992.890964] Internal error: Oops: 96000004 [#1] SMP [577992.890965] Process fallocate (pid: 88392, stack limit = 0x00000000013db2fd) [577992.890968] CPU: 52 PID: 88392 Comm: fallocate Kdump: loaded Tainted: G W OE 4.19.36 #1 [577992.890969] Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 0.98 08/25/2019 [577992.890971] pstate: 60400009 (nZCv daif +PAN -UAO) [577992.891054] pc : _ocfs2_free_suballoc_bits+0x63c/0x968 [ocfs2] [577992.891082] lr : _ocfs2_free_suballoc_bits+0x618/0x968 [ocfs2] [577992.891084] sp : ffff0000c8e2b810 [577992.891085] x29: ffff0000c8e2b820 x28: 0000000000000000 [577992.891087] x27: 00000000000006f3 x26: ffffa07957b02e70 [577992.891089] x25: ffff807c59d50000 x24: 00000000000006f2 [577992.891091] x23: 0000000000000001 x22: ffff807bd39abc30 [577992.891093] x21: ffff0000811d9000 x20: ffffa07535d6a000 [577992.891097] x19: ffff000001681638 x18: ffffffffffffffff [577992.891098] x17: 0000000000000000 x16: ffff000080a03df0 [577992.891100] x15: ffff0000811d9708 x14: 203d207375746174 [577992.891101] x13: 73203a524f525245 x12: 20373439343a6565 [577992.891103] x11: 0000000000000038 x10: 0101010101010101 [577992.891106] x9 : ffffa07c68a85d70 x8 : 7f7f7f7f7f7f7f7f [577992.891109] x7 : 0000000000000000 x6 : 0000000000000080 [577992.891110] x5 : 0000000000000000 x4 : 0000000000000002 [577992.891112] x3 : ffff000001713390 x2 : 2ff90f88b1c22f00 [577992.891114] x1 : ffff807bd39abc30 x0 : 0000000000000000 [577992.891116] Call trace: [577992.891139] _ocfs2_free_suballoc_bits+0x63c/0x968 [ocfs2] [577992.891162] _ocfs2_free_clusters+0x100/0x290 [ocfs2] [577992.891185] ocfs2_free_clusters+0x50/0x68 [ocfs2] [577992.891206] ocfs2_add_clusters_in_btree+0x198/0x5e0 [ocfs2] [577992.891227] ocfs2_add_inode_data+0x94/0xc8 [ocfs2] [577992.891248] ocfs2_extend_allocation+0x1bc/0x7a8 [ocfs2] [577992.891269] ocfs2_allocate_extents+0x14c/0x338 [ocfs2] [577992.891290] __ocfs2_change_file_space+0x3f8/0x610 [ocfs2] [577992.891309] ocfs2_fallocate+0xe4/0x128 [ocfs2] [577992.891316] vfs_fallocate+0x11c/0x250 [577992.891317] ksys_fallocate+0x54/0x88 [577992.891319] __arm64_sys_fallocate+0x28/0x38 [577992.891323] el0_svc_common+0x78/0x130 [577992.891325] el0_svc_handler+0x38/0x78 [577992.891327] el0_svc+0x8/0xc My analysis process as follows: ocfs2_fallocate __ocfs2_change_file_space ocfs2_allocate_extents ocfs2_extend_allocation ocfs2_add_inode_data ocfs2_add_clusters_in_btree ocfs2_insert_extent ocfs2_do_insert_extent ocfs2_rotate_tree_right ocfs2_extend_rotate_transaction ocfs2_extend_trans jbd2_journal_restart jbd2__journal_restart /* handle->h_transaction is NULL, * is_handle_aborted(handle) is true */ handle->h_transaction = NULL; start_this_handle return -EROFS; ocfs2_free_clusters _ocfs2_free_clusters _ocfs2_free_suballoc_bits ocfs2_block_group_clear_bits ocfs2_journal_access_gd __ocfs2_journal_access jbd2_journal_get_undo_access /* I think jbd2_write_access_granted() will * return true, because do_get_write_access() * will return -EROFS. */ if (jbd2_write_access_granted(...)) return 0; do_get_write_access /* handle->h_transaction is NULL, it will * return -EROFS here, so do_get_write_access() * was not called. */ if (is_handle_aborted(handle)) return -EROFS; /* bh2jh(group_bh) is NULL, caused NULL pointer dereference */ undo_bg = (struct ocfs2_group_desc *) bh2jh(group_bh)->b_committed_data; If handle->h_transaction == NULL, then jbd2_write_access_granted() does not really guarantee that journal_head will stay around, not even speaking of its b_committed_data. The bh2jh(group_bh) can be removed after ocfs2_journal_access_gd() and before call "bh2jh(group_bh)->b_committed_data". So, we should move is_handle_aborted() check from do_get_write_access() into jbd2_journal_get_undo_access() and jbd2_journal_get_write_access() before the call to jbd2_write_access_granted(). Link: https://lore.kernel.org/r/f72a623f-b3f1-381a-d91d-d22a1c83a336@huawei.com Signed-off-by: Yan Wang Signed-off-by: Theodore Ts'o Reviewed-by: Jun Piao Reviewed-by: Jan Kara Cc: stable@kernel.org commit cb85f4d23f794e24127f3e562cb3b54b0803f456 Author: Eric Biggers Date: Wed Feb 19 10:30:47 2020 -0800 ext4: fix race between writepages and enabling EXT4_EXTENTS_FL If EXT4_EXTENTS_FL is set on an inode while ext4_writepages() is running on it, the following warning in ext4_add_complete_io() can be hit: WARNING: CPU: 1 PID: 0 at fs/ext4/page-io.c:234 ext4_put_io_end_defer+0xf0/0x120 Here's a minimal reproducer (not 100% reliable) (root isn't required): while true; do sync done & while true; do rm -f file touch file chattr -e file echo X >> file chattr +e file done The problem is that in ext4_writepages(), ext4_should_dioread_nolock() (which only returns true on extent-based files) is checked once to set the number of reserved journal credits, and also again later to select the flags for ext4_map_blocks() and copy the reserved journal handle to ext4_io_end::handle. But if EXT4_EXTENTS_FL is being concurrently set, the first check can see dioread_nolock disabled while the later one can see it enabled, causing the reserved handle to unexpectedly be NULL. Since changing EXT4_EXTENTS_FL is uncommon, and there may be other races related to doing so as well, fix this by synchronizing changing EXT4_EXTENTS_FL with ext4_writepages() via the existing s_writepages_rwsem (previously called s_journal_flag_rwsem). This was originally reported by syzbot without a reproducer at https://syzkaller.appspot.com/bug?extid=2202a584a00fffd19fbf, but now that dioread_nolock is the default I also started seeing this when running syzkaller locally. Link: https://lore.kernel.org/r/20200219183047.47417-3-ebiggers@kernel.org Reported-by: syzbot+2202a584a00fffd19fbf@syzkaller.appspotmail.com Fixes: 6b523df4fb5a ("ext4: use transaction reservation for extent conversion in ext4_end_io") Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara Cc: stable@kernel.org commit bbd55937de8f2754adc5792b0f8e5ff7d9c0420e Author: Eric Biggers Date: Wed Feb 19 10:30:46 2020 -0800 ext4: rename s_journal_flag_rwsem to s_writepages_rwsem In preparation for making s_journal_flag_rwsem synchronize ext4_writepages() with changes to both the EXTENTS and JOURNAL_DATA flags (rather than just JOURNAL_DATA as it does currently), rename it to s_writepages_rwsem. Link: https://lore.kernel.org/r/20200219183047.47417-2-ebiggers@kernel.org Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara Cc: stable@kernel.org commit 7c990728b99ed6fbe9c75fc202fce1172d9916da Author: Suraj Jitindar Singh Date: Tue Feb 18 19:08:51 2020 -0800 ext4: fix potential race between s_flex_groups online resizing and access During an online resize an array of s_flex_groups structures gets replaced so it can get enlarged. If there is a concurrent access to the array and this memory has been reused then this can lead to an invalid memory access. The s_flex_group array has been converted into an array of pointers rather than an array of structures. This is to ensure that the information contained in the structures cannot get out of sync during a resize due to an accessor updating the value in the old structure after it has been copied but before the array pointer is updated. Since the structures them- selves are no longer copied but only the pointers to them this case is mitigated. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206443 Link: https://lore.kernel.org/r/20200221053458.730016-4-tytso@mit.edu Signed-off-by: Suraj Jitindar Singh Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 54dedb5b571d2fb0d65c3957ecfa9b32ce28d7f0 Merge: 63f01d852c75 8645e56a4ad6 Author: Linus Torvalds Date: Fri Feb 21 16:10:10 2020 -0800 Merge tag 'for-linus-5.6-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Two small fixes for Xen: - a fix to avoid warnings with new gcc - a fix for incorrectly disabled interrupts when calling _cond_resched()" * tag 'for-linus-5.6-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: Enable interrupts when calling _cond_resched() x86/xen: Distribute switch variables for initialization commit 63f01d852c75366fb4d15ce217d12c48b69a4bcc Merge: 2865936259e2 dcde237319e6 Author: Linus Torvalds Date: Fri Feb 21 16:03:36 2020 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "It's all straightforward apart from the changes to mmap()/mremap() in relation to their handling of address arguments from userspace with non-zero tag bits in the upper byte. The change to brk() is necessary to fix a nasty user-visible regression in malloc(), but we tightened up mmap() and mremap() at the same time because they also allow the user to create virtual aliases by accident. It's much less likely than brk() to matter in practice, but enforcing the principle of "don't permit the creation of mappings using tagged addresses" leads to a straightforward ABI without having to worry about the "but what if a crazy program did foo?" aspect of things. Summary: - Fix regression in malloc() caused by ignored address tags in brk() - Add missing brackets around argument to untagged_addr() macro - Fix clang build when using binutils assembler - Fix silly typo in virtual memory map documentation" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: mm: Avoid creating virtual address aliases in brk()/mmap()/mremap() docs: arm64: fix trivial spelling enought to enough in memory.rst arm64: memory: Add missing brackets to untagged_addr() macro arm64: lse: Fix LSE atomics with LLVM commit 2865936259e27629fac422bc80c9b55ca1f108a5 Merge: 0c0ddd6ae47c 9eb425b2e04e Author: Linus Torvalds Date: Fri Feb 21 15:57:56 2020 -0800 Merge tag 'powerpc-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Some more powerpc fixes for 5.6. This is two weeks worth as I was out sick last week: - Three fixes for the recently added VMAP_STACK on 32-bit. - Three fixes related to hugepages on 8xx (32-bit). - A fix for a bug in our transactional memory handling that could lead to a kernel crash if we saw a page fault during signal delivery. - A fix for a deadlock in our PCI EEH (Enhanced Error Handling) code. - A couple of other minor fixes. Thanks to: Christophe Leroy, Erhard F, Frederic Barrat, Gustavo Luiz Duarte, Larry Finger, Leonardo Bras, Oliver O'Halloran, Sam Bobroff" * tag 'powerpc-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/entry: Fix an #if which should be an #ifdef in entry_32.S powerpc/xmon: Fix whitespace handling in getstring() powerpc/6xx: Fix power_save_ppc32_restore() with CONFIG_VMAP_STACK powerpc/chrp: Fix enter_rtas() with CONFIG_VMAP_STACK powerpc/32s: Fix DSI and ISI exceptions for CONFIG_VMAP_STACK powerpc/tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery powerpc/8xx: Fix clearing of bits 20-23 in ITLB miss powerpc/hugetlb: Fix 8M hugepages on 8xx powerpc/hugetlb: Fix 512k hugepages on 8xx with 16k page size powerpc/eeh: Fix deadlock handling dead PHB commit ff6993bb79b9f99bdac0b5378169052931b65432 Author: Igor Druzhinin Date: Tue Jan 14 14:43:19 2020 +0000 scsi: libfc: free response frame from GPN_ID fc_disc_gpn_id_resp() should be the last function using it so free it here to avoid memory leak. Link: https://lore.kernel.org/r/1579013000-14570-2-git-send-email-igor.druzhinin@citrix.com Reviewed-by: Hannes Reinecke Signed-off-by: Igor Druzhinin Signed-off-by: Martin K. Petersen commit 0c0ddd6ae47c9238c18f475bcca675ca74c9dc31 Merge: bb65619e9732 44144c809e39 Author: Linus Torvalds Date: Fri Feb 21 13:02:49 2020 -0800 Merge tag 'linux-watchdog-5.6-rc3' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog fixes from Wim Van Sebroeck: - mtk_wdt needs RESET_CONTROLLER to build - da9062 driver fixes: - fix power management ops - do not ping the hw during stop() - add dependency on I2C * tag 'linux-watchdog-5.6-rc3' of git://www.linux-watchdog.org/linux-watchdog: watchdog: da9062: Add dependency on I2C watchdog: da9062: fix power management ops watchdog: da9062: do not ping the hw during stop() watchdog: fix mtk_wdt.c RESET_CONTROLLER build error commit bb65619e97323b8d62dd4d7549b9b7fe8a774706 Merge: e5553ac71e58 74ba569a15a0 Author: Linus Torvalds Date: Fri Feb 21 12:57:05 2020 -0800 Merge tag 'char-misc-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for 5.6-rc3. Also included in here are some updates for some documentation files that I seem to be maintaining these days. The driver fixes are: - small fixes for the habanalabs driver - fsi driver bugfix All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Documentation/process: Swap out the ambassador for Canonical habanalabs: patched cb equals user cb in device memset habanalabs: do not halt CoreSight during hard reset habanalabs: halt the engines before hard-reset MAINTAINERS: remove unnecessary ':' characters fsi: aspeed: add unspecified HAS_IOMEM dependency COPYING: state that all contributions really are covered by this file Documentation/process: Change Microsoft contact for embargoed hardware issues embargoed-hardware-issues: drop Amazon contact as the email address now bounces Documentation/process: Add Arm contact for embargoed HW issues commit e5553ac71e584c3aa443e211ca2afded6071b5b6 Merge: ef11f1b76a59 9a4556bd8f23 Author: Linus Torvalds Date: Fri Feb 21 12:53:53 2020 -0800 Merge tag 'staging-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for 5.6-rc3, along with the removal of an unused/unneeded driver as well. The android vsoc driver is not needed anymore by anyone, so it was removed. The other driver fixes are: - ashmem bugfixes - greybus audio driver bugfix - wireless driver bugfixes and tiny cleanups to error paths All of these have been in linux-next for a while now with no reported issues" * tag 'staging-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: Remove unneeded goto statements staging: rtl8188eu: Remove some unneeded goto statements staging: rtl8723bs: Fix potential overuse of kernel memory staging: rtl8188eu: Fix potential overuse of kernel memory staging: rtl8723bs: Fix potential security hole staging: rtl8188eu: Fix potential security hole staging: greybus: use after free in gb_audio_manager_remove_all() staging: android: Delete the 'vsoc' driver staging: rtl8723bs: fix copy of overlapping memory staging: android: ashmem: Disallow ashmem memory from being remapped staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi. commit 1cef21842ff3b6043c459b6462183e70295b5b19 Author: Scott Mayhew Date: Fri Feb 21 15:21:38 2020 -0500 NFS: Ensure the fs_context has the correct fs_type before mounting This is necessary because unless userspace explicitly requests fstype "nfs4" (either via "mount -t nfs4" or by calling the "mount.nfs4" helper directly), the fstype will default to "nfs". This was fine on older kernels because the super_block->s_type was set via mount_info->nfs_mod->nfs_fs, which was set when parsing the mount options and subsequently passed in the "type" argument of sget(). After commit f2aedb713c28 ("NFS: Add fs_context support."), sget_fc(), which has no "type" argument, is called instead. In sget_fc(), the super_block->s_type is set via fs_context->fs_type, which was set when the filesystem context was initially created. Reported-by: Patrick Steinhardt Fixes: f2aedb713c28 ("NFS: Add fs_context support.") Signed-off-by: Scott Mayhew Signed-off-by: Anna Schumaker commit ef11f1b76a59833cfadbe88a9513ca01b14a2b88 Merge: cee853e825a9 07e6124a1a46 Author: Linus Torvalds Date: Fri Feb 21 12:48:29 2020 -0800 Merge tag 'tty-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are a number of small tty and serial driver fixes for 5.6-rc3 that resolve a bunch of reported issues. They are: - vt selection and ioctl fixes - serdev bugfix - atmel serial driver fixes - qcom serial driver fixes - other minor serial driver fixes All of these have been in linux-next for a while with no reported issues" * tag 'tty-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vt: selection, close sel_buffer race vt: selection, handle pending signals in paste_selection serial: cpm_uart: call cpm_muram_init before registering console tty: serial: qcom_geni_serial: Fix RX cancel command failure serial: 8250: Check UPF_IRQ_SHARED in advance tty: serial: imx: setup the correct sg entry for tx dma vt: vt_ioctl: fix race in VT_RESIZEX vt: fix scrollback flushing on background consoles tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode serdev: ttyport: restore client ops on deregistration serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE commit cee853e825a9ab64b54bd53f991e98f832c47317 Merge: 88f8bbfa94ce 8b978be8d067 Author: Linus Torvalds Date: Fri Feb 21 12:44:53 2020 -0800 Merge tag 'usb-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here are a number of small USB driver fixes for 5.6-rc3. Included in here are: - MAINTAINER file updates - USB gadget driver fixes - usb core quirk additions and fixes for regressions - xhci driver fixes - usb serial driver id additions and fixes - thunderbolt bugfix Thunderbolt patches come in through here now that USB4 is really thunderbolt. All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (34 commits) USB: misc: iowarrior: add support for the 100 device thunderbolt: Prevent crash if non-active NVMem file is read usb: gadget: udc-xilinx: Fix xudc_stop() kernel-doc format USB: misc: iowarrior: add support for the 28 and 28L devices USB: misc: iowarrior: add support for 2 OEMed devices USB: Fix novation SourceControl XL after suspend xhci: Fix memory leak when caching protocol extended capability PSI tables - take 2 Revert "xhci: Fix memory leak when caching protocol extended capability PSI tables" MAINTAINERS: Sort entries in database for THUNDERBOLT usb: dwc3: debug: fix string position formatting mixup with ret and len usb: gadget: serial: fix Tx stall after buffer overflow usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows usb: dwc2: Fix in ISOC request length checking usb: gadget: composite: Support more than 500mA MaxPower usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus usb: gadget: u_audio: Fix high-speed max packet size usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields USB: core: clean up endpoint-descriptor parsing USB: quirks: blacklist duplicate ep on Sound Devices USBPre2 ... commit 88f8bbfa94ce18eff7b322256ec4b5f885dea969 Merge: 3dc55dba6723 97d9a4e9619a Author: Linus Torvalds Date: Fri Feb 21 12:18:02 2020 -0800 Merge tag 'drm-fixes-2020-02-21' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Varied fixes for rc3. i915 is the largest, they are seeing some ACPI problems with their CI which hopefully get solved soon [1]. msm has a bunch of fixes for new hw added in the merge, a bunch of amdgpu fixes, and nouveau adds support for some new firmwares for turing tu11x GPUs that were just released into linux-firmware by nvidia, they operate the same as the ones we already have for tu10x so should be fine to hook up. Otherwise it's just misc fixes for panfrost and sun4i. core: - Allow only one rotation argument, and allow zero rotation in video cmdline. i915: - Workaround missing Display Stream Compression (DSC) state readout by forcing modeset when its enabled at probe - Fix EHL port clock voltage level requirements - Fix queuing retire workers on the virtual engine - Fix use of partially initialized waiters - Stop using drm_pci_alloc/drm_pci/free - Fix rewind of RING_TAIL by forcing a context reload - Fix locking on resetting ring->head - Propagate our bug filing URL change to stable kernels panfrost: - Small compiler warning fix for panfrost. - Fix when using performance counters in panfrost when using per fd address space. sun4xi: - Fix dt binding nouveau: - tu11x modesetting fix - ACR/GR firmware support for tu11x (fw is public now) msm: - fix UBWC on GPU and display side for sc7180 - fix DSI suspend/resume issue encountered on sc7180 - fix some breakage on so called "linux-android" devices (fallout from sc7180/a618 support, not seen earlier due to bootloader/firmware differences) - couple other misc fixes amdgpu: - HDCP fixes - xclk fix for raven - GFXOFF fixes" [1] The Intel suspend testing should now be fixed by commit 63fb9623427f ("ACPI: PM: s2idle: Check fixed wakeup events in acpi_s2idle_wake()") * tag 'drm-fixes-2020-02-21' of git://anongit.freedesktop.org/drm/drm: (39 commits) drm/amdgpu/display: clean up hdcp workqueue handling drm/amdgpu: add is_raven_kicker judgement for raven1 drm/i915/gt: Avoid resetting ring->head outside of its timeline mutex drm/i915/execlists: Always force a context reload when rewinding RING_TAIL drm/i915: Wean off drm_pci_alloc/drm_pci_free drm/i915/gt: Protect defer_request() from new waiters drm/i915/gt: Prevent queuing retire workers on the virtual engine drm/i915/dsc: force full modeset whenever DSC is enabled at probe drm/i915/ehl: Update port clock voltage level requirements drm/i915: Update drm/i915 bug filing URL MAINTAINERS: Update drm/i915 bug filing URL drm/i915: Initialise basic fence before acquiring seqno drm/i915/gem: Require per-engine reset support for non-persistent contexts drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets drm/nouveau/gr/tu11x: initial support drm/nouveau/acr/tu11x: initial support drm/amdgpu/gfx10: disable gfxoff when reading rlc clock drm/amdgpu/gfx9: disable gfxoff when reading rlc clock drm/amdgpu/soc15: fix xclk for raven drm/amd/powerplay: always refetch the enabled features status on dpm enablement ... commit 3dc55dba67231fc22352483f5ca737df96cdc1e6 Merge: b0dd1eb220c0 36a44bcdd8df Author: Linus Torvalds Date: Fri Feb 21 11:59:51 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Limit xt_hashlimit hash table size to avoid OOM or hung tasks, from Cong Wang. 2) Fix deadlock in xsk by publishing global consumer pointers when NAPI is finished, from Magnus Karlsson. 3) Set table field properly to RT_TABLE_COMPAT when necessary, from Jethro Beekman. 4) NLA_STRING attributes are not necessary NULL terminated, deal wiht that in IFLA_ALT_IFNAME. From Eric Dumazet. 5) Fix checksum handling in atlantic driver, from Dmitry Bezrukov. 6) Handle mtu==0 devices properly in wireguard, from Jason A. Donenfeld. 7) Fix several lockdep warnings in bonding, from Taehee Yoo. 8) Fix cls_flower port blocking, from Jason Baron. 9) Sanitize internal map names in libbpf, from Toke Høiland-Jørgensen. 10) Fix RDMA race in qede driver, from Michal Kalderon. 11) Fix several false lockdep warnings by adding conditions to list_for_each_entry_rcu(), from Madhuparna Bhowmik. 12) Fix sleep in atomic in mlx5 driver, from Huy Nguyen. 13) Fix potential deadlock in bpf_map_do_batch(), from Yonghong Song. 14) Hey, variables declared in switch statement before any case statements are not initialized. I learn something every day. Get rids of this stuff in several parts of the networking, from Kees Cook. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (99 commits) bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs. bnxt_en: Improve device shutdown method. net: netlink: cap max groups which will be considered in netlink_bind() net: thunderx: workaround BGX TX Underflow issue ionic: fix fw_status read net: disable BRIDGE_NETFILTER by default net: macb: Properly handle phylink on at91rm9200 s390/qeth: fix off-by-one in RX copybreak check s390/qeth: don't warn for napi with 0 budget s390/qeth: vnicc Fix EOPNOTSUPP precedence openvswitch: Distribute switch variables for initialization net: ip6_gre: Distribute switch variables for initialization net: core: Distribute switch variables for initialization udp: rehash on disconnect net/tls: Fix to avoid gettig invalid tls record bpf: Fix a potential deadlock with bpf_map_do_batch bpf: Do not grab the bucket spinlock by default on htab batch ops ice: Wait for VF to be reset/ready before configuration ice: Don't tell the OS that link is going down ice: Don't reject odd values of usecs set by user ... commit b0dd1eb220c06892e0a4098378c4296650f3f8db Merge: 63fb9623427f bb8d00ff51a0 Author: Linus Torvalds Date: Fri Feb 21 11:40:10 2020 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: - A few y2038 fixes which missed the merge window while dependencies in NFS were being sorted out. - A bunch of fixes. Some minor, some not. * emailed patches from Andrew Morton : MAINTAINERS: use tabs for SAFESETID lib/stackdepot.c: fix global out-of-bounds in stack_slabs mm/sparsemem: pfn_to_page is not valid yet on SPARSEMEM mm/vmscan.c: don't round up scan size for online memory cgroup lib/string.c: update match_string() doc-strings with correct behavior mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps() mm/swapfile.c: fix a comment in sys_swapon() scripts/get_maintainer.pl: deprioritize old Fixes: addresses get_maintainer: remove uses of P: for maintainer name selftests/vm: add missed tests in run_vmtests include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" y2038: hide timeval/timespec/itimerval/itimerspec types y2038: remove unused time32 interfaces y2038: remove ktime to/from timespec/timeval conversion commit bb8d00ff51a0c5e58cebd2e698a778f4e3d34d48 Author: Randy Dunlap Date: Thu Feb 20 20:04:33 2020 -0800 MAINTAINERS: use tabs for SAFESETID Use tabs for indentation instead of spaces for SAFESETID. All (!) other entries in MAINTAINERS use tabs (according to my simple grepping). Link: http://lkml.kernel.org/r/2bb2e52a-2694-816d-57b4-6cabfadd6c1a@infradead.org Signed-off-by: Randy Dunlap Cc: Micah Morton Cc: James Morris Cc: "Serge E. Hallyn" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 305e519ce48e935702c32241f07d393c3c8fed3e Author: Alexander Potapenko Date: Thu Feb 20 20:04:30 2020 -0800 lib/stackdepot.c: fix global out-of-bounds in stack_slabs Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption. Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com Fixes: cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB") Signed-off-by: Alexander Potapenko Reported-by: Walter Wu Cc: Dmitry Vyukov Cc: Matthias Brugger Cc: Thomas Gleixner Cc: Josh Poimboeuf Cc: Kate Stewart Cc: Greg Kroah-Hartman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 18e19f195cd888f65643a77a0c6aee8f5be6439a Author: Wei Yang Date: Thu Feb 20 20:04:27 2020 -0800 mm/sparsemem: pfn_to_page is not valid yet on SPARSEMEM When we use SPARSEMEM instead of SPARSEMEM_VMEMMAP, pfn_to_page() doesn't work before sparse_init_one_section() is called. This leads to a crash when hotplug memory: BUG: unable to handle page fault for address: 0000000006400000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP PTI CPU: 3 PID: 221 Comm: kworker/u16:1 Tainted: G W 5.5.0-next-20200205+ #343 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: kacpi_hotplug acpi_hotplug_work_fn RIP: 0010:__memset+0x24/0x30 Code: cc cc cc cc cc cc 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3 RSP: 0018:ffffb43ac0373c80 EFLAGS: 00010a87 RAX: ffffffffffffffff RBX: ffff8a1518800000 RCX: 0000000000050000 RDX: 0000000000000000 RSI: 00000000000000ff RDI: 0000000006400000 RBP: 0000000000140000 R08: 0000000000100000 R09: 0000000006400000 R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000 R13: 0000000000000028 R14: 0000000000000000 R15: ffff8a153ffd9280 FS: 0000000000000000(0000) GS:ffff8a153ab00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000006400000 CR3: 0000000136fca000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sparse_add_section+0x1c9/0x26a __add_pages+0xbf/0x150 add_pages+0x12/0x60 add_memory_resource+0xc8/0x210 __add_memory+0x62/0xb0 acpi_memory_device_add+0x13f/0x300 acpi_bus_attach+0xf6/0x200 acpi_bus_scan+0x43/0x90 acpi_device_hotplug+0x275/0x3d0 acpi_hotplug_work_fn+0x1a/0x30 process_one_work+0x1a7/0x370 worker_thread+0x30/0x380 kthread+0x112/0x130 ret_from_fork+0x35/0x40 We should use memmap as it did. On x86 the impact is limited to x86_32 builds, or x86_64 configurations that override the default setting for SPARSEMEM_VMEMMAP. Other memory hotplug archs (arm64, ia64, and ppc) also default to SPARSEMEM_VMEMMAP=y. [dan.j.williams@intel.com: changelog update] {rppt@linux.ibm.com: changelog update] Link: http://lkml.kernel.org/r/20200219030454.4844-1-bhe@redhat.com Fixes: ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug") Signed-off-by: Wei Yang Signed-off-by: Baoquan He Acked-by: David Hildenbrand Reviewed-by: Baoquan He Reviewed-by: Dan Williams Acked-by: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 76073c646f5f4999d763f471df9e38a5a912d70d Author: Gavin Shan Date: Thu Feb 20 20:04:24 2020 -0800 mm/vmscan.c: don't round up scan size for online memory cgroup Commit 68600f623d69 ("mm: don't miss the last page because of round-off error") makes the scan size round up to @denominator regardless of the memory cgroup's state, online or offline. This affects the overall reclaiming behavior: the corresponding LRU list is eligible for reclaiming only when its size logically right shifted by @sc->priority is bigger than zero in the former formula. For example, the inactive anonymous LRU list should have at least 0x4000 pages to be eligible for reclaiming when we have 60/12 for swappiness/priority and without taking scan/rotation ratio into account. After the roundup is applied, the inactive anonymous LRU list becomes eligible for reclaiming when its size is bigger than or equal to 0x1000 in the same condition. (0x4000 >> 12) * 60 / (60 + 140 + 1) = 1 ((0x1000 >> 12) * 60) + 200) / (60 + 140 + 1) = 1 aarch64 has 512MB huge page size when the base page size is 64KB. The memory cgroup that has a huge page is always eligible for reclaiming in that case. The reclaiming is likely to stop after the huge page is reclaimed, meaing the further iteration on @sc->priority and the silbing and child memory cgroups will be skipped. The overall behaviour has been changed. This fixes the issue by applying the roundup to offlined memory cgroups only, to give more preference to reclaim memory from offlined memory cgroup. It sounds reasonable as those memory is unlikedly to be used by anyone. The issue was found by starting up 8 VMs on a Ampere Mustang machine, which has 8 CPUs and 16 GB memory. Each VM is given with 2 vCPUs and 2GB memory. It took 264 seconds for all VMs to be completely up and 784MB swap is consumed after that. With this patch applied, it took 236 seconds and 60MB swap to do same thing. So there is 10% performance improvement for my case. Note that KSM is disable while THP is enabled in the testing. total used free shared buff/cache available Mem: 16196 10065 2049 16 4081 3749 Swap: 8175 784 7391 total used free shared buff/cache available Mem: 16196 11324 3656 24 1215 2936 Swap: 8175 60 8115 Link: http://lkml.kernel.org/r/20200211024514.8730-1-gshan@redhat.com Fixes: 68600f623d69 ("mm: don't miss the last page because of round-off error") Signed-off-by: Gavin Shan Acked-by: Roman Gushchin Cc: [4.20+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c11d3fa0116a6bc832a9e387427caa16f8de5ef2 Author: Alexandru Ardelean Date: Thu Feb 20 20:04:21 2020 -0800 lib/string.c: update match_string() doc-strings with correct behavior There were a few attempts at changing behavior of the match_string() helpers (i.e. 'match_string()' & 'sysfs_match_string()'), to change & extend the behavior according to the doc-string. But the simplest approach is to just fix the doc-strings. The current behavior is fine as-is, and some bugs were introduced trying to fix it. As for extending the behavior, new helpers can always be introduced if needed. The match_string() helpers behave more like 'strncmp()' in the sense that they go up to n elements or until the first NULL element in the array of strings. This change updates the doc-strings with this info. Link: http://lkml.kernel.org/r/20200213072722.8249-1-alexandru.ardelean@analog.com Signed-off-by: Alexandru Ardelean Acked-by: Andy Shevchenko Cc: Kees Cook Cc: "Tobin C . Harding" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 75866af62b439859d5146b7093ceb6b482852683 Author: Vasily Averin Date: Thu Feb 20 20:04:18 2020 -0800 mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps() for_each_mem_cgroup() increases css reference counter for memory cgroup and requires to use mem_cgroup_iter_break() if the walk is cancelled. Link: http://lkml.kernel.org/r/c98414fb-7e1f-da0f-867a-9340ec4bd30b@virtuozzo.com Fixes: 0a4465d34028 ("mm, memcg: assign memcg-aware shrinkers bitmap to memcg") Signed-off-by: Vasily Averin Acked-by: Kirill Tkhai Acked-by: Michal Hocko Reviewed-by: Roman Gushchin Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fed98ef4d8b665316479dd35cbd92d3e2ff470a3 Author: Christoph Hellwig Date: Thu Feb 20 20:04:15 2020 -0800 mm/swapfile.c: fix a comment in sys_swapon() claim_swapfile now always takes i_rwsem. Link: http://lkml.kernel.org/r/20200114161225.309792-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ef82fcefb99300ede6f4d38a8100845b2dc8e30 Author: Douglas Anderson Date: Thu Feb 20 20:04:12 2020 -0800 scripts/get_maintainer.pl: deprioritize old Fixes: addresses Recently, I found that get_maintainer was causing me to send emails to the old addresses for maintainers. Since I usually just trust the output of get_maintainer to know the right email address, I didn't even look carefully and fired off two patch series that went to the wrong place. Oops. The problem was introduced recently when trying to add signatures from Fixes. The problem was that these email addresses were added too early in the process of compiling our list of places to send. Things added to the list earlier are considered more canonical and when we later added maintainer entries we ended up deduplicating to the old address. Here are two examples using mainline commits (to make it easier to replicate) for the two maintainers that I messed up recently: $ git format-patch d8549bcd0529~..d8549bcd0529 $ ./scripts/get_maintainer.pl 0001-clk-Add-clk_hw*.patch | grep Boyd Stephen Boyd ... $ git format-patch 6d1238aa3395~..6d1238aa3395 $ ./scripts/get_maintainer.pl 0001-arm64-dts-qcom-qcs404*.patch | grep Andy Andy Gross Let's move the adding of addresses from Fixes: to the end since the email addresses from these are much more likely to be older. After this patch the above examples get the right addresses for the two examples. Link: http://lkml.kernel.org/r/20200127095001.1.I41fba9f33590bfd92cd01960161d8384268c6569@changeid Fixes: 2f5bd343694e ("scripts/get_maintainer.pl: add signatures from Fixes: lines in commit message") Signed-off-by: Douglas Anderson Acked-by: Joe Perches Cc: Stephen Boyd Cc: Bjorn Andersson Cc: Andy Gross Cc: Kees Cook Cc: Dan Carpenter Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ef0c08192ac09e29ddd676b3ca6c4a501f277f10 Author: Joe Perches Date: Thu Feb 20 20:04:09 2020 -0800 get_maintainer: remove uses of P: for maintainer name Commit 1ca84ed6425f ("MAINTAINERS: Reclaim the P: tag for Maintainer Entry Profile") changed the use of the "P:" tag from "Person" to "Profile (ie: special subsystem coding styles and characteristics)" Change how get_maintainer.pl parses the "P:" tag to match. Link: http://lkml.kernel.org/r/ca53823fc5d25c0be32ad937d0207a0589c08643.camel@perches.com Signed-off-by: Joe Perches Acked-by: Dan Williams Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9e69fa46275b63f670ced0f11095af1841c73fca Author: SeongJae Park Date: Thu Feb 20 20:04:06 2020 -0800 selftests/vm: add missed tests in run_vmtests The commits introducing 'mlock-random-test'[1], 'map_fiex_noreplace'[2], and 'thuge-gen'[3] have not added those in the 'run_vmtests' script and thus the 'run_tests' command of kselftests doesn't run those. This commit adds those in the script. 'gup_benchmark' and 'transhuge-stress' are also not included in the 'run_vmtests', but this commit does not add those because those are for performance measurement rather than pass/fail tests. [1] commit 26b4224d9961 ("selftests: expanding more mlock selftest") [2] commit 91cbacc34512 ("tools/testing/selftests/vm/map_fixed_noreplace.c: add test for MAP_FIXED_NOREPLACE") [3] commit fcc1f2d5dd34 ("selftests: add a test program for variable huge page sizes in mmap/shmget") Link: http://lkml.kernel.org/r/20200206085144.29126-1-sj38.park@gmail.com Signed-off-by: SeongJae Park Cc: Uladzislau Rezki (Sony) Cc: Masami Hiramatsu Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 467d12f5c7842896d2de3ced74e4147ee29e97c8 Author: Christian Borntraeger Date: Thu Feb 20 20:04:03 2020 -0800 include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap QEMU has a funny new build error message when I use the upstream kernel headers: CC block/file-posix.o In file included from /home/cborntra/REPOS/qemu/include/qemu/timer.h:4, from /home/cborntra/REPOS/qemu/include/qemu/timed-average.h:29, from /home/cborntra/REPOS/qemu/include/block/accounting.h:28, from /home/cborntra/REPOS/qemu/include/block/block_int.h:27, from /home/cborntra/REPOS/qemu/block/file-posix.c:30: /usr/include/linux/swab.h: In function `__swab': /home/cborntra/REPOS/qemu/include/qemu/bitops.h:20:34: error: "sizeof" is not defined, evaluates to 0 [-Werror=undef] 20 | #define BITS_PER_LONG (sizeof (unsigned long) * BITS_PER_BYTE) | ^~~~~~ /home/cborntra/REPOS/qemu/include/qemu/bitops.h:20:41: error: missing binary operator before token "(" 20 | #define BITS_PER_LONG (sizeof (unsigned long) * BITS_PER_BYTE) | ^ cc1: all warnings being treated as errors make: *** [/home/cborntra/REPOS/qemu/rules.mak:69: block/file-posix.o] Error 1 rm tests/qemu-iotests/socket_scm_helper.o This was triggered by commit d5767057c9a ("uapi: rename ext2_swab() to swab() and share globally in swab.h"). That patch is doing #include but it uses BITS_PER_LONG. The kernel file asm/bitsperlong.h provide only __BITS_PER_LONG. Let us use the __ variant in swap.h Link: http://lkml.kernel.org/r/20200213142147.17604-1-borntraeger@de.ibm.com Fixes: d5767057c9a ("uapi: rename ext2_swab() to swab() and share globally in swab.h") Signed-off-by: Christian Borntraeger Cc: Yury Norov Cc: Allison Randal Cc: Joe Perches Cc: Thomas Gleixner Cc: William Breathitt Gray Cc: Torsten Hilbrich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit edf28f4061afe4c2d9eb1c3323d90e882c1d6800 Author: Ioanna Alifieraki Date: Thu Feb 20 20:04:00 2020 -0800 Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" This reverts commit a97955844807e327df11aa33869009d14d6b7de0. Commit a97955844807 ("ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()") removes a lock that is needed. This leads to a process looping infinitely in exit_sem() and can also lead to a crash. There is a reproducer available in [1] and with the commit reverted the issue does not reproduce anymore. Using the reproducer found in [1] is fairly easy to reach a point where one of the child processes is looping infinitely in exit_sem between for(;;) and if (semid == -1) block, while it's trying to free its last sem_undo structure which has already been freed by freeary(). Each sem_undo struct is on two lists: one per semaphore set (list_id) and one per process (list_proc). The list_id list tracks undos by semaphore set, and the list_proc by process. Undo structures are removed either by freeary() or by exit_sem(). The freeary function is invoked when the user invokes a syscall to remove a semaphore set. During this operation freeary() traverses the list_id associated with the semaphore set and removes the undo structures from both the list_id and list_proc lists. For this case, exit_sem() is called at process exit. Each process contains a struct sem_undo_list (referred to as "ulp") which contains the head for the list_proc list. When the process exits, exit_sem() traverses this list to remove each sem_undo struct. As in freeary(), whenever a sem_undo struct is removed from list_proc, it is also removed from the list_id list. Removing elements from list_id is safe for both exit_sem() and freeary() due to sem_lock(). Removing elements from list_proc is not safe; freeary() locks &un->ulp->lock when it performs list_del_rcu(&un->list_proc) but exit_sem() does not (locking was removed by commit a97955844807 ("ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"). This can result in the following situation while executing the reproducer [1] : Consider a child process in exit_sem() and the parent in freeary() (because of semctl(sid[i], NSEM, IPC_RMID)). - The list_proc for the child contains the last two undo structs A and B (the rest have been removed either by exit_sem() or freeary()). - The semid for A is 1 and semid for B is 2. - exit_sem() removes A and at the same time freeary() removes B. - Since A and B have different semid sem_lock() will acquire different locks for each process and both can proceed. The bug is that they remove A and B from the same list_proc at the same time because only freeary() acquires the ulp lock. When exit_sem() removes A it makes ulp->list_proc.next to point at B and at the same time freeary() removes B setting B->semid=-1. At the next iteration of for(;;) loop exit_sem() will try to remove B. The only way to break from for(;;) is for (&un->list_proc == &ulp->list_proc) to be true which is not. Then exit_sem() will check if B->semid=-1 which is and will continue looping in for(;;) until the memory for B is reallocated and the value at B->semid is changed. At that point, exit_sem() will crash attempting to unlink B from the lists (this can be easily triggered by running the reproducer [1] a second time). To prove this scenario instrumentation was added to keep information about each sem_undo (un) struct that is removed per process and per semaphore set (sma). CPU0 CPU1 [caller holds sem_lock(sma for A)] ... freeary() exit_sem() ... ... ... sem_lock(sma for B) spin_lock(A->ulp->lock) ... list_del_rcu(un_A->list_proc) list_del_rcu(un_B->list_proc) Undo structures A and B have different semid and sem_lock() operations proceed. However they belong to the same list_proc list and they are removed at the same time. This results into ulp->list_proc.next pointing to the address of B which is already removed. After reverting commit a97955844807 ("ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()") the issue was no longer reproducible. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1694779 Link: http://lkml.kernel.org/r/20191211191318.11860-1-ioanna-maria.alifieraki@canonical.com Fixes: a97955844807 ("ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()") Signed-off-by: Ioanna Alifieraki Acked-by: Manfred Spraul Acked-by: Herton R. Krzesinski Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Cc: Joel Fernandes (Google) Cc: Davidlohr Bueso Cc: Jay Vosburgh Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c766d1472c70d25ad475cf56042af1652e792b23 Author: Arnd Bergmann Date: Thu Feb 20 20:03:57 2020 -0800 y2038: hide timeval/timespec/itimerval/itimerspec types There are no in-kernel users remaining, but there may still be users that include linux/time.h instead of sys/time.h from user space, so leave the types available to user space while hiding them from kernel space. Only the __kernel_old_* versions of these types remain now. Link: http://lkml.kernel.org/r/20200110154232.4104492-4-arnd@arndb.de Signed-off-by: Arnd Bergmann Acked-by: Thomas Gleixner Cc: Deepa Dinamani Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 412c53a680a97cb1ae2c0ab60230e193bee86387 Author: Arnd Bergmann Date: Thu Feb 20 20:03:54 2020 -0800 y2038: remove unused time32 interfaces No users remain, so kill these off before we grow new ones. Link: http://lkml.kernel.org/r/20200110154232.4104492-3-arnd@arndb.de Signed-off-by: Arnd Bergmann Acked-by: Thomas Gleixner Cc: Deepa Dinamani Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 595abbaff5db121428247a2e6ab368734472e101 Author: Arnd Bergmann Date: Thu Feb 20 20:03:50 2020 -0800 y2038: remove ktime to/from timespec/timeval conversion A couple of helpers are now obsolete and can be removed, so drivers can no longer start using them and instead use y2038-safe interfaces. Link: http://lkml.kernel.org/r/20200110154232.4104492-2-arnd@arndb.de Signed-off-by: Arnd Bergmann Acked-by: Thomas Gleixner Cc: Deepa Dinamani Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 63fb9623427fbb44e3782233b6e4714057b76ff2 Author: Rafael J. Wysocki Date: Fri Feb 21 01:46:18 2020 +0100 ACPI: PM: s2idle: Check fixed wakeup events in acpi_s2idle_wake() Commit fdde0ff8590b ("ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system") overlooked the fact that fixed events can wake up the system too and broke RTC wakeup from suspend-to-idle as a result. Fix this issue by checking the fixed events in acpi_s2idle_wake() in addition to checking wakeup GPEs and break out of the suspend-to-idle loop if the status bits of any enabled fixed events are set then. Fixes: fdde0ff8590b ("ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system") Reported-and-tested-by: Chris Wilson Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit e61d2392253220477813b43412090dccdcac601f Author: Guenter Roeck Date: Thu Feb 20 06:29:48 2020 -0800 hwmon: (w83627ehf) Fix crash seen with W83627DHG-P Loading the driver on a system with W83627DHG-P crashes as follows. w83627ehf: Found W83627DHG-P chip at 0x290 BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 0 PID: 604 Comm: sensors Not tainted 5.6.0-rc2-00055-gca7e1fd1026c #29 Hardware name: /D425KT, BIOS MWPNT10N.86A.0132.2013.0726.1534 07/26/2013 RIP: 0010:w83627ehf_read_string+0x27/0x70 [w83627ehf] Code: [... ] RSP: 0018:ffffb95980657df8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff96caaa7f5218 RCX: 0000000000000000 RDX: 0000000000000015 RSI: 0000000000000001 RDI: ffff96caa736ec08 RBP: 0000000000000000 R08: ffffb95980657e20 R09: 0000000000000001 R10: ffff96caaa635cc0 R11: 0000000000000000 R12: ffff96caa9f7cf00 R13: ffff96caa9ec3d00 R14: ffff96caa9ec3d28 R15: ffff96caa9ec3d40 FS: 00007fbc7c4e2740(0000) GS:ffff96caabc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000129d58000 CR4: 00000000000006f0 Call Trace: ? cp_new_stat+0x12d/0x160 hwmon_attr_show_string+0x37/0x70 [hwmon] dev_attr_show+0x14/0x50 sysfs_kf_seq_show+0xb5/0x1b0 seq_read+0xcf/0x460 vfs_read+0x9b/0x150 ksys_read+0x5f/0xe0 do_syscall_64+0x48/0x190 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ... Temperature labels are not always present. Adjust sysfs attribute visibility accordingly. Reported-by: Meelis Roos Suggested-by: Dr. David Alan Gilbert Reviewed-by: Dr. David Alan Gilbert Cc: Meelis Roos Cc: Dr. David Alan Gilbert Fixes: 266cd5835947 ("hwmon: (w83627ehf) convert to with_info interface") Signed-off-by: Guenter Roeck commit d80b64ff297e40c2b6f7d7abc1b3eba70d22a068 Author: Miaohe Lin Date: Sat Jan 4 16:56:49 2020 +0800 KVM: SVM: Fix potential memory leak in svm_cpu_init() When kmalloc memory for sd->sev_vmcbs failed, we forget to free the page held by sd->save_area. Also get rid of the var r as '-ENOMEM' is actually the only possible outcome here. Reviewed-by: Liran Alon Reviewed-by: Vitaly Kuznetsov Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 23520b2def95205f132e167cf5b25c609975e959 Author: Miaohe Lin Date: Fri Feb 21 22:04:46 2020 +0800 KVM: apic: avoid calculating pending eoi from an uninitialized val When pv_eoi_get_user() fails, 'val' may remain uninitialized and the return value of pv_eoi_get_pending() becomes random. Fix the issue by initializing the variable. Reviewed-by: Vitaly Kuznetsov Signed-off-by: Miaohe Lin Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit a4443267800af240072280c44521caab61924e55 Author: Vitaly Kuznetsov Date: Thu Feb 20 18:22:04 2020 +0100 KVM: nVMX: clear PIN_BASED_POSTED_INTR from nested pinbased_ctls only when apicv is globally disabled When apicv is disabled on a vCPU (e.g. by enabling KVM_CAP_HYPERV_SYNIC*), nothing happens to VMX MSRs on the already existing vCPUs, however, all new ones are created with PIN_BASED_POSTED_INTR filtered out. This is very confusing and results in the following picture inside the guest: $ rdmsr -ax 0x48d ff00000016 7f00000016 7f00000016 7f00000016 This is observed with QEMU and 4-vCPU guest: QEMU creates vCPU0, does KVM_CAP_HYPERV_SYNIC2 and then creates the remaining three. L1 hypervisor may only check CPU0's controls to find out what features are available and it will be very confused later. Switch to setting PIN_BASED_POSTED_INTR control based on global 'enable_apicv' setting. Signed-off-by: Vitaly Kuznetsov Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 91a5f413af596ad01097e59bf487eb07cb3f1331 Author: Vitaly Kuznetsov Date: Thu Feb 20 18:22:05 2020 +0100 KVM: nVMX: handle nested posted interrupts when apicv is disabled for L1 Even when APICv is disabled for L1 it can (and, actually, is) still available for L2, this means we need to always call vmx_deliver_nested_posted_interrupt() when attempting an interrupt delivery. Suggested-by: Paolo Bonzini Signed-off-by: Vitaly Kuznetsov Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 93fd9666c269877fffb74e14f52792d9c000c1f2 Author: Suravee Suthikulpanit Date: Fri Feb 21 08:52:17 2020 -0600 kvm: x86: svm: Fix NULL pointer dereference when AVIC not enabled Launching VM w/ AVIC disabled together with pass-through device results in NULL pointer dereference bug with the following call trace. RIP: 0010:svm_refresh_apicv_exec_ctrl+0x17e/0x1a0 [kvm_amd] Call Trace: kvm_vcpu_update_apicv+0x44/0x60 [kvm] kvm_arch_vcpu_ioctl_run+0x3f4/0x1c80 [kvm] kvm_vcpu_ioctl+0x3d8/0x650 [kvm] do_vfs_ioctl+0xaa/0x660 ? tomoyo_file_ioctl+0x19/0x20 ksys_ioctl+0x67/0x90 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x57/0x190 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Investigation shows that this is due to the uninitialized usage of struct vapu_svm.ir_list in the svm_set_pi_irte_mode(), which is called from svm_refresh_apicv_exec_ctrl(). The ir_list is initialized only if AVIC is enabled. So, fixes by adding a check if AVIC is enabled in the svm_refresh_apicv_exec_ctrl(). Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206579 Fixes: 8937d762396d ("kvm: x86: svm: Add support to (de)activate posted interrupts.") Signed-off-by: Suravee Suthikulpanit Tested-by: Alex Williamson Signed-off-by: Paolo Bonzini commit 624e18f92f2ec449c2b3a6d388c0dccc45e4c4d7 Author: Xiaoyao Li Date: Sun Feb 16 18:48:57 2020 +0800 KVM: VMX: Add VMX_FEATURE_USR_WAIT_PAUSE Commit 159348784ff0 ("x86/vmx: Introduce VMX_FEATURES_*") missed bit 26 (enable user wait and pause) of Secondary Processor-based VM-Execution Controls. Add VMX_FEATURE_USR_WAIT_PAUSE flag so that it shows up in /proc/cpuinfo, and use it to define SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE to make them uniform. Signed-off-by: Xiaoyao Li Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit c9dfd3fb08352d439f0399b6fabe697681d2638c Author: wanpeng li Date: Mon Feb 17 18:37:43 2020 +0800 KVM: nVMX: Hold KVM's srcu lock when syncing vmcs12->shadow For the duration of mapping eVMCS, it derefences ->memslots without holding ->srcu or ->slots_lock when accessing hv assist page. This patch fixes it by moving nested_sync_vmcs12_to_shadow to prepare_guest_switch, where the SRCU is already taken. It can be reproduced by running kvm's evmcs_test selftest. ============================= warning: suspicious rcu usage 5.6.0-rc1+ #53 tainted: g w ioe ----------------------------- ./include/linux/kvm_host.h:623 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by evmcs_test/8507: #0: ffff9ddd156d00d0 (&vcpu->mutex){+.+.}, at: kvm_vcpu_ioctl+0x85/0x680 [kvm] stack backtrace: cpu: 6 pid: 8507 comm: evmcs_test tainted: g w ioe 5.6.0-rc1+ #53 hardware name: dell inc. optiplex 7040/0jctf8, bios 1.4.9 09/12/2016 call trace: dump_stack+0x68/0x9b kvm_read_guest_cached+0x11d/0x150 [kvm] kvm_hv_get_assist_page+0x33/0x40 [kvm] nested_enlightened_vmentry+0x2c/0x60 [kvm_intel] nested_vmx_handle_enlightened_vmptrld.part.52+0x32/0x1c0 [kvm_intel] nested_sync_vmcs12_to_shadow+0x439/0x680 [kvm_intel] vmx_vcpu_run+0x67a/0xe60 [kvm_intel] vcpu_enter_guest+0x35e/0x1bc0 [kvm] kvm_arch_vcpu_ioctl_run+0x40b/0x670 [kvm] kvm_vcpu_ioctl+0x370/0x680 [kvm] ksys_ioctl+0x235/0x850 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x77/0x780 entry_syscall_64_after_hwframe+0x49/0xbe Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 7455a8327674e1a7c9a1f5dd1b0743ab6713f6d1 Author: Miaohe Lin Date: Fri Feb 14 10:32:38 2020 +0800 KVM: x86: don't notify userspace IOAPIC on edge-triggered interrupt EOI Commit 13db77347db1 ("KVM: x86: don't notify userspace IOAPIC on edge EOI") said, edge-triggered interrupts don't set a bit in TMR, which means that IOAPIC isn't notified on EOI. And var level indicates level-triggered interrupt. But commit 3159d36ad799 ("KVM: x86: use generic function for MSI parsing") replace var level with irq.level by mistake. Fix it by changing irq.level to irq.trig_mode. Cc: stable@vger.kernel.org Fixes: 3159d36ad799 ("KVM: x86: use generic function for MSI parsing") Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 89604523a76eb3e13014b2bdab7f8870becee284 Author: Ard Biesheuvel Date: Tue Feb 18 09:15:34 2020 +0100 ARM: 8961/2: Fix Kbuild issue caused by per-task stack protector GCC plugin When using plugins, GCC requires that the -fplugin= options precedes any of its plugin arguments appearing on the command line as well. This is usually not a concern, but as it turns out, this requirement is causing some issues with ARM's per-task stack protector plugin and Kbuild's implementation of $(cc-option). When the per-task stack protector plugin is enabled, and we tweak the implementation of cc-option not to pipe the stderr output of GCC to /dev/null, the following output is generated when GCC is executed in the context of cc-option: cc1: error: plugin arm_ssp_per_task_plugin should be specified before \ -fplugin-arg-arm_ssp_per_task_plugin-tso=1 in the command line cc1: error: plugin arm_ssp_per_task_plugin should be specified before \ -fplugin-arg-arm_ssp_per_task_plugin-offset=24 in the command line These errors will cause any option passed to cc-option to be treated as unsupported, which is obviously incorrect. The cause of this issue is the fact that the -fplugin= argument is added to GCC_PLUGINS_CFLAGS, whereas the arguments above are added to KBUILD_CFLAGS, and the contents of the former get filtered out of the latter before being passed to the GCC running the cc-option test, and so the -fplugin= option does not appear at all on the GCC command line. Adding the arguments to GCC_PLUGINS_CFLAGS instead of KBUILD_CFLAGS would be the correct approach here, if it weren't for the fact that we are using $(eval) to defer the moment that they are added until after asm-offsets.h is generated, which is after the point where the contents of GCC_PLUGINS_CFLAGS are added to KBUILD_CFLAGS. So instead, we have to add our plugin arguments to both. For similar reasons, we cannot append DISABLE_ARM_SSP_PER_TASK_PLUGIN to KBUILD_CFLAGS, as it will be passed to GCC when executing in the context of cc-option, whereas the other plugin arguments will have been filtered out, resulting in a similar error and false negative result as above. So add it to ccflags-y instead. Fixes: 189af4657186da08 ("ARM: smp: add support for per-task stack canaries") Reported-by: Merlijn Wajer Tested-by: Tony Lindgren Acked-by: Kees Cook Reviewed-by: Masahiro Yamada Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King commit f87b1c49bc675da30d8e1e8f4b60b800312c7b90 Author: Kees Cook Date: Mon Feb 10 02:04:17 2020 +0100 ARM: 8958/1: rename missed uaccess .fixup section When the uaccess .fixup section was renamed to .text.fixup, one case was missed. Under ld.bfd, the orphaned section was moved close to .text (since they share the "ax" bits), so things would work normally on uaccess faults. Under ld.lld, the orphaned section was placed outside the .text section, making it unreachable. Link: https://github.com/ClangBuiltLinux/linux/issues/282 Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1020633#c44 Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.1912032147340.17114@knanqh.ubzr Link: https://lore.kernel.org/lkml/202002071754.F5F073F1D@keescook/ Fixes: c4a84ae39b4a5 ("ARM: 8322/1: keep .text and .fixup regions closer together") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Ard Biesheuvel Reviewed-by: Nick Desaulniers Signed-off-by: Russell King commit 45939ce292b4b11159719faaf60aba7d58d5fe33 Author: Florian Fainelli Date: Tue Jan 28 20:22:13 2020 +0100 ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional() It is possible for a system with an ARMv8 timer to run a 32-bit kernel. When this happens we will unconditionally have the vDSO code remove the __vdso_gettimeofday and __vdso_clock_gettime symbols because cntvct_functional() returns false since it does not match that compatibility string. Fixes: ecf99a439105 ("ARM: 8331/1: VDSO initialization, mapping, and synchronization") Signed-off-by: Florian Fainelli Signed-off-by: Russell King commit ae7bbc091351a4c6ebddfbe36eb5eb7a149cd7a2 Merge: f25372ffc3f6 3b7830904e17 Author: Jens Axboe Date: Fri Feb 21 09:18:00 2020 -0700 Merge branch 'nvme-5.6-rc3' of git://git.infradead.org/nvme into block-5.6 Pull NVMe fixes from Keith. * 'nvme-5.6-rc3' of git://git.infradead.org/nvme: nvme-multipath: Fix memory leak with ana_log_buf nvme: Fix uninitialized-variable warning nvme-pci: Use single IRQ vector for old Apple models nvme/pci: Add sleep quirk for Samsung and Toshiba drives commit 7143b5ac5750f404ff3a594b34fdf3fc2f99f828 Author: Stefano Garzarella Date: Fri Feb 21 16:42:16 2020 +0100 io_uring: prevent sq_thread from spinning when it should stop This patch drops 'cur_mm' before calling cond_resched(), to prevent the sq_thread from spinning even when the user process is finished. Before this patch, if the user process ended without closing the io_uring fd, the sq_thread continues to spin until the 'sq_thread_idle' timeout ends. In the worst case where the 'sq_thread_idle' parameter is bigger than INT_MAX, the sq_thread will spin forever. Fixes: 6c271ce2f1d5 ("io_uring: add submission polling") Signed-off-by: Stefano Garzarella Signed-off-by: Jens Axboe commit 4c48e549f39f8ed10cf8a0b6cb96f5eddf0391ce Author: Leonard Crestez Date: Thu Feb 20 18:29:37 2020 +0200 pinctrl: imx: scu: Align imx sc msg structs to 4 The imx SC api strongly assumes that messages are composed out of 4-bytes words but some of our message structs have odd sizeofs. This produces many oopses with CONFIG_KASAN=y. Fix by marking with __aligned(4). Fixes: b96eea718bf6 ("pinctrl: fsl: add scu based pinctrl support") Signed-off-by: Leonard Crestez Link: https://lore.kernel.org/r/bd7ad5fd755739a6d8d5f4f65e03b3ca4f457bd2.1582216144.git.leonard.crestez@nxp.com Signed-off-by: Linus Walleij commit dc7a06b0dbbafac8623c2b7657e61362f2f479a7 Author: Nicolas Belin Date: Thu Feb 20 14:15:12 2020 +0100 pinctrl: meson-gxl: fix GPIOX sdio pins In the gxl driver, the sdio cmd and clk pins are inverted. It has not caused any issue so far because devices using these pins always take both pins so the resulting configuration is OK. Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") Reviewed-by: Jerome Brunet Signed-off-by: Nicolas Belin Link: https://lore.kernel.org/r/1582204512-7582-1-git-send-email-nbelin@baylibre.com Signed-off-by: Linus Walleij commit a5ae50dea9111db63d30d700766dd5509602f7ad Author: Filipe Manana Date: Thu Feb 20 13:29:49 2020 +0000 Btrfs: fix deadlock during fast fsync when logging prealloc extents beyond eof While logging the prealloc extents of an inode during a fast fsync we call btrfs_truncate_inode_items(), through btrfs_log_prealloc_extents(), while holding a read lock on a leaf of the inode's root (not the log root, the fs/subvol root), and then that function locks the file range in the inode's iotree. This can lead to a deadlock when: * the fsync is ranged * the file has prealloc extents beyond eof * writeback for a range different from the fsync range starts during the fsync * the size of the file is not sector size aligned Because when finishing an ordered extent we lock first a file range and then try to COW the fs/subvol tree to insert an extent item. The following diagram shows how the deadlock can happen. CPU 1 CPU 2 btrfs_sync_file() --> for range [0, 1MiB) --> inode has a size of 1MiB and has 1 prealloc extent beyond the i_size, starting at offset 4MiB flushes all delalloc for the range [0MiB, 1MiB) and waits for the respective ordered extents to complete --> before task at CPU 1 locks the inode, a write into file range [1MiB, 2MiB + 1KiB) is made --> i_size is updated to 2MiB + 1KiB --> writeback is started for that range, [1MiB, 2MiB + 4KiB) --> end offset rounded up to be sector size aligned btrfs_log_dentry_safe() btrfs_log_inode_parent() btrfs_log_inode() btrfs_log_changed_extents() btrfs_log_prealloc_extents() --> does a search on the inode's root --> holds a read lock on leaf X btrfs_finish_ordered_io() --> locks range [1MiB, 2MiB + 4KiB) --> end offset rounded up to be sector size aligned --> tries to cow leaf X, through insert_reserved_file_extent() --> already locked by the task at CPU 1 btrfs_truncate_inode_items() --> gets an i_size of 2MiB + 1KiB, which is not sector size aligned --> tries to lock file range [2MiB, (u64)-1) --> the start range is rounded down from 2MiB + 1K to 2MiB to be sector size aligned --> but the subrange [2MiB, 2MiB + 4KiB) is already locked by task at CPU 2 which is waiting to get a write lock on leaf X for which we are holding a read lock *** deadlock *** This results in a stack trace like the following, triggered by test case generic/561 from fstests: [ 2779.973608] INFO: task kworker/u8:6:247 blocked for more than 120 seconds. [ 2779.979536] Not tainted 5.6.0-rc2-btrfs-next-53 #1 [ 2779.984503] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2779.990136] kworker/u8:6 D 0 247 2 0x80004000 [ 2779.990457] Workqueue: btrfs-endio-write btrfs_work_helper [btrfs] [ 2779.990466] Call Trace: [ 2779.990491] ? __schedule+0x384/0xa30 [ 2779.990521] schedule+0x33/0xe0 [ 2779.990616] btrfs_tree_read_lock+0x19e/0x2e0 [btrfs] [ 2779.990632] ? remove_wait_queue+0x60/0x60 [ 2779.990730] btrfs_read_lock_root_node+0x2f/0x40 [btrfs] [ 2779.990782] btrfs_search_slot+0x510/0x1000 [btrfs] [ 2779.990869] btrfs_lookup_file_extent+0x4a/0x70 [btrfs] [ 2779.990944] __btrfs_drop_extents+0x161/0x1060 [btrfs] [ 2779.990987] ? mark_held_locks+0x6d/0xc0 [ 2779.990994] ? __slab_alloc.isra.49+0x99/0x100 [ 2779.991060] ? insert_reserved_file_extent.constprop.19+0x64/0x300 [btrfs] [ 2779.991145] insert_reserved_file_extent.constprop.19+0x97/0x300 [btrfs] [ 2779.991222] ? start_transaction+0xdd/0x5c0 [btrfs] [ 2779.991291] btrfs_finish_ordered_io+0x4f4/0x840 [btrfs] [ 2779.991405] btrfs_work_helper+0xaa/0x720 [btrfs] [ 2779.991432] process_one_work+0x26d/0x6a0 [ 2779.991460] worker_thread+0x4f/0x3e0 [ 2779.991481] ? process_one_work+0x6a0/0x6a0 [ 2779.991489] kthread+0x103/0x140 [ 2779.991499] ? kthread_create_worker_on_cpu+0x70/0x70 [ 2779.991515] ret_from_fork+0x3a/0x50 (...) [ 2780.026211] INFO: task fsstress:17375 blocked for more than 120 seconds. [ 2780.027480] Not tainted 5.6.0-rc2-btrfs-next-53 #1 [ 2780.028482] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2780.030035] fsstress D 0 17375 17373 0x00004000 [ 2780.030038] Call Trace: [ 2780.030044] ? __schedule+0x384/0xa30 [ 2780.030052] schedule+0x33/0xe0 [ 2780.030075] lock_extent_bits+0x20c/0x320 [btrfs] [ 2780.030094] ? btrfs_truncate_inode_items+0xf4/0x1150 [btrfs] [ 2780.030098] ? rcu_read_lock_sched_held+0x59/0xa0 [ 2780.030102] ? remove_wait_queue+0x60/0x60 [ 2780.030122] btrfs_truncate_inode_items+0x133/0x1150 [btrfs] [ 2780.030151] ? btrfs_set_path_blocking+0xb2/0x160 [btrfs] [ 2780.030165] ? btrfs_search_slot+0x379/0x1000 [btrfs] [ 2780.030195] btrfs_log_changed_extents.isra.8+0x841/0x93e [btrfs] [ 2780.030202] ? do_raw_spin_unlock+0x49/0xc0 [ 2780.030215] ? btrfs_get_num_csums+0x10/0x10 [btrfs] [ 2780.030239] btrfs_log_inode+0xf83/0x1124 [btrfs] [ 2780.030251] ? __mutex_unlock_slowpath+0x45/0x2a0 [ 2780.030275] btrfs_log_inode_parent+0x2a0/0xe40 [btrfs] [ 2780.030282] ? dget_parent+0xa1/0x370 [ 2780.030309] btrfs_log_dentry_safe+0x4a/0x70 [btrfs] [ 2780.030329] btrfs_sync_file+0x3f3/0x490 [btrfs] [ 2780.030339] do_fsync+0x38/0x60 [ 2780.030343] __x64_sys_fdatasync+0x13/0x20 [ 2780.030345] do_syscall_64+0x5c/0x280 [ 2780.030348] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2780.030356] RIP: 0033:0x7f2d80f6d5f0 [ 2780.030361] Code: Bad RIP value. [ 2780.030362] RSP: 002b:00007ffdba3c8548 EFLAGS: 00000246 ORIG_RAX: 000000000000004b [ 2780.030364] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2d80f6d5f0 [ 2780.030365] RDX: 00007ffdba3c84b0 RSI: 00007ffdba3c84b0 RDI: 0000000000000003 [ 2780.030367] RBP: 000000000000004a R08: 0000000000000001 R09: 00007ffdba3c855c [ 2780.030368] R10: 0000000000000078 R11: 0000000000000246 R12: 00000000000001f4 [ 2780.030369] R13: 0000000051eb851f R14: 00007ffdba3c85f0 R15: 0000557a49220d90 So fix this by making btrfs_truncate_inode_items() not lock the range in the inode's iotree when the target root is a log root, since it's not needed to lock the range for log roots as the protection from the inode's lock and log_mutex are all that's needed. Fixes: 28553fa992cb28 ("Btrfs: fix race between shrinking truncate and fiemap") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 5f811c57c99205e048926293bb812c750a6ea562 Author: Masami Hiramatsu Date: Fri Feb 21 17:13:52 2020 +0900 bootconfig: Add append value operator support Add append value operator "+=" support to bootconfig syntax. With this operator, user can add new value to the key as an entry of array instead of overwriting. For example, foo = bar ... foo += baz Then the key "foo" has "bar" and "baz" values as an array. Link: http://lkml.kernel.org/r/158227283195.12842.8310503105963275584.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 4e4694d8729f7cd6381f6691e8f83e378fce3160 Author: Masami Hiramatsu Date: Fri Feb 21 17:13:42 2020 +0900 bootconfig: Prohibit re-defining value on same key Currently, bootconfig adds a new value on the existing key to the tail of an array. But this looks a bit confusing because an admin can easily rewrite the original value in the same config file. This rejects the following value re-definition. key = value1 ... key = value2 You should rewrite value1 to value2 in this case. Link: http://lkml.kernel.org/r/158227282199.12842.10110929876059658601.stgit@devnote2 Suggested-by: Steven Rostedt (VMware) Signed-off-by: Masami Hiramatsu [ Fixed spelling of arraies to arrays ] Signed-off-by: Steven Rostedt (VMware) commit 3b7830904e17202524bad1974505a9bfc718d31f Author: Logan Gunthorpe Date: Thu Feb 20 13:29:53 2020 -0700 nvme-multipath: Fix memory leak with ana_log_buf kmemleak reports a memory leak with the ana_log_buf allocated by nvme_mpath_init(): unreferenced object 0xffff888120e94000 (size 8208): comm "nvme", pid 6884, jiffies 4295020435 (age 78786.312s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000e2360188>] kmalloc_order+0x97/0xc0 [<0000000079b18dd4>] kmalloc_order_trace+0x24/0x100 [<00000000f50c0406>] __kmalloc+0x24c/0x2d0 [<00000000f31a10b9>] nvme_mpath_init+0x23c/0x2b0 [<000000005802589e>] nvme_init_identify+0x75f/0x1600 [<0000000058ef911b>] nvme_loop_configure_admin_queue+0x26d/0x280 [<00000000673774b9>] nvme_loop_create_ctrl+0x2a7/0x710 [<00000000f1c7a233>] nvmf_dev_write+0xc66/0x10b9 [<000000004199f8d0>] __vfs_write+0x50/0xa0 [<0000000065466fef>] vfs_write+0xf3/0x280 [<00000000b0db9a8b>] ksys_write+0xc6/0x160 [<0000000082156b91>] __x64_sys_write+0x43/0x50 [<00000000c34fbb6d>] do_syscall_64+0x77/0x2f0 [<00000000bbc574c9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe nvme_mpath_init() is called by nvme_init_identify() which is called in multiple places (nvme_reset_work(), nvme_passthru_end(), etc). This means nvme_mpath_init() may be called multiple times before nvme_mpath_uninit() (which is only called on nvme_free_ctrl()). When nvme_mpath_init() is called multiple times, it overwrites the ana_log_buf pointer with a new allocation, thus leaking the previous allocation. To fix this, free ana_log_buf before allocating a new one. Fixes: 0d0b660f214dc490 ("nvme: add ANA support") Cc: Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Logan Gunthorpe Signed-off-by: Keith Busch commit 138c9c32f090894614899eca15e0bb7279f59865 Author: Lukas Wunner Date: Tue Feb 18 13:08:00 2020 +0100 spi: spidev: Fix CS polarity if GPIO descriptors are used Commit f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs") amended of_spi_parse_dt() to always set SPI_CS_HIGH for SPI slaves whose Chip Select is defined by a "cs-gpios" devicetree property. This change broke userspace applications which issue an SPI_IOC_WR_MODE ioctl() to an spidev: Chip Select polarity will be incorrect unless the application is changed to set SPI_CS_HIGH. And once changed, it will be incompatible with kernels not containing the commit. Fix by setting SPI_CS_HIGH in spidev_ioctl() (under the same conditions as in of_spi_parse_dt()). Fixes: f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs") Reported-by: Simon Han Signed-off-by: Lukas Wunner Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/fca3ba7cdc930cd36854666ceac4fbcf01b89028.1582027457.git.lukas@wunner.de Signed-off-by: Mark Brown Cc: stable@vger.kernel.org # v5.1+ commit 136b5cd2e2f97581ae560cff0db2a3b5369112da Author: Yuji Sasaki Date: Fri Feb 14 13:13:40 2020 +0530 spi: qup: call spi_qup_pm_resume_runtime before suspending spi_qup_suspend() will cause synchronous external abort when runtime suspend is enabled and applied, as it tries to access SPI controller register while clock is already disabled in spi_qup_pm_suspend_runtime(). Signed-off-by: Yuji sasaki Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20200214074340.2286170-1-vkoul@kernel.org Signed-off-by: Mark Brown commit d5888c8e55861789a8d9dca73d8a2a279d25822d Author: Geert Uytterhoeven Date: Mon Feb 17 11:17:41 2020 +0100 arm64: defconfig: Replace ARCH_R8A7796 by ARCH_R8A77960 CONFIG_ARCH_R8A7796 was replaced by CONFIG_ARCH_R8A77960, cfr. commits 39e57e14d7eaf818 ("soc: renesas: Add ARCH_R8A77960 for existing R-Car M3-W") and 24240845c87185fe ("soc: renesas: Remove ARCH_R8A7796"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20200217101741.3758-1-geert+renesas@glider.be commit 22946f37557e27697aabc8e4f62642bfe4a17fd8 Author: Jerome Brunet Date: Fri Feb 21 13:11:46 2020 +0100 ASoC: meson: g12a: add tohdmitx reset Reset the g12a hdmi codec glue on probe. This ensure a sane startup state. Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20200221121146.1498427-1-jbrunet@baylibre.com Signed-off-by: Mark Brown commit b500c086e4110829a308c23e83a7cdc65b26228a Author: Stephan Gerhold Date: Fri Feb 14 12:03:24 2020 +0100 iio: magnetometer: ak8974: Fix negative raw values in sysfs At the moment, reading from in_magn_*_raw in sysfs tends to return large values around 65000, even though the output of ak8974 is actually limited to ±32768. This happens because the value is never converted to the signed 16-bit integer variant. Add an explicit cast to s16 to fix this. Fixes: 7c94a8b2ee8c ("iio: magn: add a driver for AK8974") Signed-off-by: Stephan Gerhold Reviewed-by: Linus Waleij Cc: Signed-off-by: Jonathan Cameron commit 2546287c5fb363a0165933ae2181c92f03e701d0 Author: Zenghui Yu Date: Fri Feb 21 10:07:25 2020 +0800 genirq/irqdomain: Make sure all irq domain flags are distinct This was noticed when printing debugfs for MSIs on my ARM64 server. The new dstate IRQD_MSI_NOMASK_QUIRK came out surprisingly while it should only be the x86 stuff for the time being... The new MSI quirk flag uses the same bit as IRQ_DOMAIN_NAME_ALLOCATED which is oddly defined as bit 6 for no good reason. Switch it to the non used bit 1. Fixes: 6f1a4891a592 ("x86/apic/msi: Plug non-maskable MSI affinity race") Signed-off-by: Zenghui Yu Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200221020725.2038-1-yuzenghui@huawei.com commit 0daa63ed4c6c4302790ce67b7a90c0997ceb7514 Author: Andrei Otcheretianski Date: Fri Feb 21 10:47:20 2020 +0100 mac80211: Remove a redundant mutex unlock The below-mentioned commit changed the code to unlock *inside* the function, but previously the unlock was *outside*. It failed to remove the outer unlock, however, leading to double unlock. Fix this. Fixes: 33483a6b88e4 ("mac80211: fix missing unlock on error in ieee80211_mark_sta_auth()") Signed-off-by: Andrei Otcheretianski Link: https://lore.kernel.org/r/20200221104719.cce4741cf6eb.I671567b185c8a4c2409377e483fd149ce590f56d@changeid [rewrite commit message to better explain what happened] Signed-off-by: Johannes Berg commit a7ee7d44b57c9ae174088e53a668852b7f4f452d Author: Johannes Berg Date: Fri Feb 21 10:44:50 2020 +0100 cfg80211: check reg_rule for NULL in handle_channel_custom() We may end up with a NULL reg_rule after the loop in handle_channel_custom() if the bandwidth didn't fit, check if this is the case and bail out if so. Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200221104449.3b558a50201c.I4ad3725c4dacaefd2d18d3cc65ba6d18acd5dbfe@changeid Signed-off-by: Johannes Berg commit 9951ebfcdf2b97dbb28a5d930458424341e61aa2 Author: Johannes Berg Date: Fri Feb 21 10:41:43 2020 +0100 nl80211: fix potential leak in AP start If nl80211_parse_he_obss_pd() fails, we leak the previously allocated ACL memory. Free it in this case. Fixes: 796e90f42b7e ("cfg80211: add support for parsing OBBS_PD attributes") Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200221104142.835aba4cdd14.I1923b55ba9989c57e13978f91f40bfdc45e60cbd@changeid Signed-off-by: Johannes Berg commit 4c5fd3b791a06021084b42d5610400f846d206b5 Author: Randy Dunlap Date: Wed Feb 19 17:28:21 2020 -0800 zonefs: fix documentation typos etc. Fix typos, spellos, etc. in zonefs.txt. Signed-off-by: Randy Dunlap Cc: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Signed-off-by: Damien Le Moal commit 0ed41b33882c577e1d6582913163a2f5727765fe Author: Florian Fainelli Date: Thu Feb 20 20:14:23 2020 -0800 phy: brcm-sata: Correct MDIO operations for 40nm platforms The logic to write to MDIO registers on 40nm platforms was wrong because it would use the port number as an offset from the base address rather than the bank address of the PHY. This is hardly noticeable because the only programming we do is enabling SSC or not, which is not really causing an observable functional change. Correct that mistake by passing down the struct brcm_sata_port structure down to the brcm_sata_mdio_wr() and brcm_sata_mdio_rd() functions and do the proper offsetting for 28nm, respectively 40nm platforms from there. This means that brcm_sata_pcb_base() is now useless and is therefore removed. Fixes: c1602a1a0fbe ("phy: phy_brcmstb_sata: add support for MIPS-based platforms") Signed-off-by: Florian Fainelli Signed-off-by: Kishon Vijay Abraham I commit 0b9f386c4be6493d282aab0af6f9b70c62142777 Author: Guo Ren Date: Wed Feb 12 10:24:52 2020 +0800 csky: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Cc: Amanieu d'Antras Signed-off-by: Guo Ren commit 5b49c82dadfe0f3741778f57385f964ec1514863 Author: MaJun Date: Mon Jan 27 10:56:21 2020 +0800 csky: Add PCI support Add the pci related code for csky arch to support basic pci virtual function, such as qemu virt-pci-9pfs. Signed-off-by: MaJun Signed-off-by: Guo Ren commit dc2efc0028dd5c4bf0f7324806c9a196958aaad3 Author: Ma Jun Date: Sun Feb 2 17:56:58 2020 +0800 csky: Minimize defconfig to support buildroot config.fragment Some bsp (eg: buildroot) has defconfig.fragment design to add more configs into the defconfig in linux source code tree. For example, we could put different cpu configs into different defconfig.fragments, but they all use the same defconfig in Linux. Signed-off-by: Ma Jun Signed-off-by: Guo Ren commit d46869aaab7981f9153d3271228005a52ef18591 Author: Guo Ren Date: Tue Oct 8 14:25:13 2019 +0800 csky: Add setup_initrd check code We should give some necessary check for initrd just like other architectures and it seems that setup_initrd() could be a common code for all architectures. Signed-off-by: Guo Ren commit 4ec575b78521b4573e85aec451930cb040582455 Author: Krzysztof Kozlowski Date: Thu Jan 30 20:22:40 2020 +0100 csky: Cleanup old Kconfig options CONFIG_CLKSRC_OF is gone since commit bb0eb050a577 ("clocksource/drivers: Rename CLKSRC_OF to TIMER_OF"). The platform already selects TIMER_OF. CONFIG_HAVE_DMA_API_DEBUG is gone since commit 6e88628d03dd ("dma-debug: remove CONFIG_HAVE_DMA_API_DEBUG"). CONFIG_DEFAULT_DEADLINE is gone since commit f382fb0bcef4 ("block: remove legacy IO schedulers"). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Guo Ren commit bebd26ab623616728d6e72b5c74a47bfff5287d8 Author: Randy Dunlap Date: Fri Jan 31 17:52:30 2020 -0800 arch/csky: fix some Kconfig typos Fix wording in help text for the CPU_HAS_LDSTEX symbol. Signed-off-by: Randy Dunlap Signed-off-by: Guo Ren Signed-off-by: Guo Ren commit 2305f60b76110cb3e8658a4ae85d1f7eb0c66a5b Author: Guo Ren Date: Sun Feb 2 14:11:11 2020 +0800 csky: Fixup compile warning for three unimplemented syscalls Implement fstat64, fstatat64, clone3 syscalls to fixup checksyscalls.sh compile warnings. Signed-off-by: Guo Ren commit 9025fd48a8aeddade845afa353d4bbab7f19dbf2 Author: Guo Ren Date: Sun Feb 2 10:58:38 2020 +0800 csky: Remove unused cache implementation Only for coding convention, these codes are unnecessary for abiv2. Signed-off-by: Guo Ren commit 359ae00d12589c31cf103894d0f32588d523ca83 Author: Guo Ren Date: Sun Feb 2 09:58:42 2020 +0800 csky: Fixup ftrace modify panic During ftrace init, linux will replace all function prologues (call_mcout) with nops, but it need flush_dcache and invalidate_icache to make it work. So flush_cache functions couldn't be nested called by ftrace framework. Signed-off-by: Guo Ren commit 997153b9a75c08d545ad45e6f8ceb432435d2425 Author: Guo Ren Date: Fri Jan 31 20:33:10 2020 +0800 csky: Add flush_icache_mm to defer flush icache all Some CPUs don't support icache.va instruction to maintain the whole smp cores' icache. Using icache.all + IPI casue a lot on performace and using defer mechanism could reduce the number of calling icache _flush_all functions. Signed-off-by: Guo Ren commit cc1f6563a92ced0889775d0587316d725b6e1a68 Author: Guo Ren Date: Mon Jan 27 19:57:29 2020 +0800 csky: Optimize abiv2 copy_to_user_page with VM_EXEC Only when vma is for VM_EXEC, we need sync dcache & icache. eg: - gdb ptrace modify user space instruction code area. Add VM_EXEC condition to reduce unnecessary cache flush. The abiv1 cpus' cache are all VIPT, so we still need to deal with dcache aliasing problem. But there is optimized way to use cache color, just like what's done in arch/csky/abiv1/inc/abi/page.h. Signed-off-by: Guo Ren commit d936a7e708dcf22344c4420e8b0e36f5d5f8c073 Author: Guo Ren Date: Mon Jan 27 01:20:36 2020 +0800 csky: Enable defer flush_dcache_page for abiv2 cpus (807/810/860) Instead of flushing cache per update_mmu_cache() called, we use flush_dcache_page to reduce the frequency of flashing the cache. As abiv2 cpus are all PIPT for icache & dcache, we needn't handle dcache aliasing problem. But their icache can't snoop dcache, so we still need sync_icache_dcache in update_mmu_cache(). Signed-off-by: Guo Ren commit a1176734132c630b50908c36563e05fb3599682c Author: Guo Ren Date: Sat Jan 25 00:37:09 2020 +0800 csky: Remove unnecessary flush_icache_* implementation The abiv2 CPUs are all PIPT cache, so there is no need to implement flush_icache_page function. The function flush_icache_user_range hasn't been used, so just remove it. The function flush_cache_range is not necessary for PIPT cache when tlb mapping changed. Signed-off-by: Guo Ren commit 761b4f694cb90b63ca2739ac8a8a176342636e5e Author: Guo Ren Date: Wed Jan 22 11:15:14 2020 +0800 csky: Support icache flush without specific instructions Some CPUs don't support icache specific instructions to flush icache lines in broadcast way. We use cpu control registers to flush local icache and use IPI to notify other cores. Signed-off-by: Guo Ren commit a736fa1ed772e3640e1bfaab36032c5a285d6a7b Author: Guo Ren Date: Sat Jan 11 13:44:32 2020 +0800 csky/Kconfig: Add Kconfig.platforms to support some drivers Such as snps,dw-apb-ictl Signed-off-by: Guo Ren commit c9492737b25ca32679ba3163609d938c9abfd508 Author: Guo Ren Date: Tue Jan 7 12:21:25 2020 +0800 csky/smp: Fixup boot failed when CONFIG_SMP If we use a non-ipi-support interrupt controller, it will cause panic here. We should let cpu up and work with CONFIG_SMP, when we use a non-ipi intc. Signed-off-by: Guo Ren commit f8e17c17b81070f38062dce79ca7f4541851dadd Author: Guo Ren Date: Tue Dec 17 11:12:55 2019 +0800 csky: Set regs->usp to kernel sp, when the exception is from kernel In the past, we didn't care about kernel sp when saving pt_reg. But in some cases, we still need pt_reg->usp to represent the kernel stack before enter exception. For cmpxhg in atomic.S, we need save and restore usp for above. Signed-off-by: Guo Ren commit 7f4a567332f035ab16b29010fbd04a0f10183c77 Author: Guo Ren Date: Mon Dec 30 15:53:37 2019 +0800 csky/mm: Fixup export invalid_pte_table symbol There is no present bit in csky pmd hardware, so we need to prepare invalid_pte_table for empty pmd entry and the functions (pmd_none & pmd_present) in pgtable.h need invalid_pte_talbe to get result. If a module use these functions, we need export the symbol for it. Signed-off-by: Guo Ren Cc: Mo Qihui Cc: Zhange Jian commit f136008f31e91060d6b6e6e031cb2c827448e280 Author: Guo Ren Date: Sun Dec 1 22:34:19 2019 +0800 csky: Separate fixaddr_init from highmem After fixaddr_init is separated from highmem, we could use tcm without highmem selected. (610 (abiv1) don't support highmem, but it could use tcm now.) Signed-off-by: Guo Ren commit f525bb2c9e7cf1e3c43ab57704c9e1c836d30b34 Author: Guo Ren Date: Wed Nov 27 08:44:33 2019 +0800 csky: Tightly-Coupled Memory or Sram support The implementation are not only used by TCM but also used by sram on SOC bus. It follow existed linux tcm software interface, so that old tcm application codes could be re-used directly. Software interface list in asm/tcm.h: - Variables/Const: __tcmdata, __tcmconst - Functions: __tcmfunc, __tcmlocalfunc - Malloc/Free: tcm_alloc, tcm_free In linux menuconfig: - Choose a TCM contain instrctions + data or separated in ITCM/DTCM. - Determine TCM_BASE (DTCM_BASE) in phyiscal address. - Determine size of TCM or ITCM(DTCM) in page counts. Here is hello tcm example from Documentation/arm/tcm.rst which could be directly used: /* Uninitialized data */ static u32 __tcmdata tcmvar; /* Initialized data */ static u32 __tcmdata tcmassigned = 0x2BADBABEU; /* Constant */ static const u32 __tcmconst tcmconst = 0xCAFEBABEU; static void __tcmlocalfunc tcm_to_tcm(void) { int i; for (i = 0; i < 100; i++) tcmvar ++; } static void __tcmfunc hello_tcm(void) { /* Some abstract code that runs in ITCM */ int i; for (i = 0; i < 100; i++) { tcmvar ++; } tcm_to_tcm(); } static void __init test_tcm(void) { u32 *tcmem; int i; hello_tcm(); printk("Hello TCM executed from ITCM RAM\n"); printk("TCM variable from testrun: %u @ %p\n", tcmvar, &tcmvar); tcmvar = 0xDEADBEEFU; printk("TCM variable: 0x%x @ %p\n", tcmvar, &tcmvar); printk("TCM assigned variable: 0x%x @ %p\n", tcmassigned, &tcmassigned); printk("TCM constant: 0x%x @ %p\n", tcmconst, &tcmconst); /* Allocate some TCM memory from the pool */ tcmem = tcm_alloc(20); if (tcmem) { printk("TCM Allocated 20 bytes of TCM @ %p\n", tcmem); tcmem[0] = 0xDEADBEEFU; tcmem[1] = 0x2BADBABEU; tcmem[2] = 0xCAFEBABEU; tcmem[3] = 0xDEADBEEFU; tcmem[4] = 0x2BADBABEU; for (i = 0; i < 5; i++) printk("TCM tcmem[%d] = %08x\n", i, tcmem[i]); tcm_free(tcmem, 20); } } TODO: - Separate fixup mapping from highmem - Support abiv1 Signed-off-by: Guo Ren commit 2f78c73f78c39dabc5c44ad8dd61fd6ec65636d6 Author: Mao Han Date: Fri Oct 11 10:56:55 2019 +0800 csky: Initial stack protector support This is a basic -fstack-protector support without per-task canary switching. The protector will report something like when stack corruption is detected: It's tested with strcpy local array overflow in sys_kill and get: stack-protector: Kernel stack is corrupted in: sys_kill+0x23c/0x23c TODO: - Support task switch for different cannary Signed-off-by: Mao Han Signed-off-by: Guo Ren commit fd1d98650ac0042d475155116e65fd17eb379542 Author: Guo Ren Date: Tue Oct 8 14:37:02 2019 +0800 MAINTAINERS: csky: Add mailing list for csky Add mailing list and it's convenient for maintain C-SKY subsystem. Signed-off-by: Guo Ren commit df3da4ea5a0fc5d115c90d5aa6caa4dd433750a7 Author: Suraj Jitindar Singh Date: Tue Feb 18 19:08:50 2020 -0800 ext4: fix potential race between s_group_info online resizing and access During an online resize an array of pointers to s_group_info gets replaced so it can get enlarged. If there is a concurrent access to the array in ext4_get_group_info() and this memory has been reused then this can lead to an invalid memory access. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206443 Link: https://lore.kernel.org/r/20200221053458.730016-3-tytso@mit.edu Signed-off-by: Suraj Jitindar Singh Signed-off-by: Theodore Ts'o Reviewed-by: Balbir Singh Cc: stable@kernel.org commit 1d0c3924a92e69bfa91163bda83c12a994b4d106 Author: Theodore Ts'o Date: Sat Feb 15 16:40:37 2020 -0500 ext4: fix potential race between online resizing and write operations During an online resize an array of pointers to buffer heads gets replaced so it can get enlarged. If there is a racing block allocation or deallocation which uses the old array, and the old array has gotten reused this can lead to a GPF or some other random kernel memory getting modified. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206443 Link: https://lore.kernel.org/r/20200221053458.730016-2-tytso@mit.edu Reported-by: Suraj Jitindar Singh Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 97d9a4e9619a822c5baf6a63e6f5b80fee4d4213 Merge: c1368b347fe8 15de9cb5c9c8 Author: Dave Airlie Date: Fri Feb 21 12:46:54 2020 +1000 Merge tag 'drm-intel-fixes-2020-02-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.6-rc3: - Workaround missing Display Stream Compression (DSC) state readout by forcing modeset when its enabled at probe - Fix EHL port clock voltage level requirements - Fix queuing retire workers on the virtual engine - Fix use of partially initialized waiters - Stop using drm_pci_alloc/drm_pci/free - Fix rewind of RING_TAIL by forcing a context reload - Fix locking on resetting ring->head - Propagate our bug filing URL change to stable kernels Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87y2sxtsrd.fsf@intel.com commit c1368b347fe81d9271412797fea8788dd5dc16b3 Merge: 7c42545cad10 dde2bb2da01e Author: Dave Airlie Date: Fri Feb 21 12:30:23 2020 +1000 Merge tag 'drm-misc-fixes-2020-02-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.6-rc3: - Fix dt binding for sunxi. - Allow only 1 rotation argument, and allow 0 rotation in video cmdline. - Small compiler warning fix for panfrost. - Fix when using performance counters in panfrost when using per fd address space. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/f5a6370d-9898-6c72-43e4-5bb56a99b6f2@linux.intel.com commit 36a44bcdd8df092d76c11bc213e81c5817d4e302 Merge: 3a20773beeee 8743db4a9acf Author: David S. Miller Date: Thu Feb 20 16:05:42 2020 -0800 Merge branch 'bnxt_en-shutdown-and-kexec-kdump-related-fixes' Michael Chan says: ==================== bnxt_en: shutdown and kexec/kdump related fixes. 2 small patches to fix kexec shutdown and kdump kernel driver init issues. ==================== Signed-off-by: David S. Miller commit 8743db4a9acfd51f805ac0c87bcaae92c42d1061 Author: Vasundhara Volam Date: Thu Feb 20 17:26:35 2020 -0500 bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs. If crashed kernel does not shutdown the NIC properly, PCIe FLR is required in the kdump kernel in order to initialize all the functions properly. Fixes: d629522e1d66 ("bnxt_en: Reduce memory usage when running in kdump kernel.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 5567ae4a8d569d996d0d88d0eceb76205e4c7ce5 Author: Vasundhara Volam Date: Thu Feb 20 17:26:34 2020 -0500 bnxt_en: Improve device shutdown method. Especially when bnxt_shutdown() is called during kexec, we need to disable MSIX and disable Bus Master to completely quiesce the device. Make these 2 calls unconditionally in the shutdown method. Fixes: c20dc142dd7b ("bnxt_en: Disable bus master during PCI shutdown and driver unload.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 3a20773beeeeadec41477a5ba872175b778ff752 Author: Nikolay Aleksandrov Date: Thu Feb 20 16:42:13 2020 +0200 net: netlink: cap max groups which will be considered in netlink_bind() Since nl_groups is a u32 we can't bind more groups via ->bind (netlink_bind) call, but netlink has supported more groups via setsockopt() for a long time and thus nlk->ngroups could be over 32. Recently I added support for per-vlan notifications and increased the groups to 33 for NETLINK_ROUTE which exposed an old bug in the netlink_bind() code causing out-of-bounds access on archs where unsigned long is 32 bits via test_bit() on a local variable. Fix this by capping the maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively capping them at 32 which is the minimum of allocated groups and the maximum groups which can be bound via netlink_bind(). CC: Christophe Leroy CC: Richard Guy Briggs Fixes: 4f520900522f ("netlink: have netlink per-protocol bind function return an error code.") Reported-by: Erhard F. Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 971617c3b761c876d686a2188220a33898c90e99 Author: Tim Harvey Date: Wed Feb 19 15:19:36 2020 -0800 net: thunderx: workaround BGX TX Underflow issue While it is not yet understood why a TX underflow can easily occur for SGMII interfaces resulting in a TX wedge. It has been found that disabling/re-enabling the LMAC resolves the issue. Signed-off-by: Tim Harvey Reviewed-by: Robert Jones Signed-off-by: David S. Miller commit 68b759a75d6257759d1e37ff13f2d0659baf1112 Author: Shannon Nelson Date: Wed Feb 19 14:59:42 2020 -0800 ionic: fix fw_status read The fw_status field is only 8 bits, so fix the read. Also, we only want to look at the one status bit, to allow for future use of the other bits, and watch for a bad PCI read. Fixes: 97ca486592c0 ("ionic: add heartbeat check") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit ebe7acadf5a9c4b67475e766e0e80ae6a2a79c61 Merge: ca7e1fd1026c 5780b9abd530 Author: Linus Torvalds Date: Thu Feb 20 15:15:16 2020 -0800 Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull IMA fixes from Mimi Zohar: "Two bug fixes and an associated change for each. The one that adds SM3 to the IMA list of supported hash algorithms is a simple change, but could be considered a new feature" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: add sm3 algorithm to hash algorithm configuration list crypto: rename sm3-256 to sm3 in hash_algo_name efi: Only print errors about failing to get certs if EFI vars are found x86/ima: use correct identifier for SetupMode variable commit 98bda63e20daab95bdc084ce00459a4f622a0505 Author: Roman Kiryanov Date: Wed Feb 19 13:40:06 2020 -0800 net: disable BRIDGE_NETFILTER by default The description says 'If unsure, say N.' but the module is built as M by default (once the dependencies are satisfied). When the module is selected (Y or M), it enables NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS which alter kernel internal structures. We (Android Studio Emulator) currently do not use this module and think this it is more consistent to have it disabled by default as opposite to disabling it explicitly to prevent enabling NETFILTER_FAMILY_BRIDGE and SKB_EXTENSIONS. Signed-off-by: Roman Kiryanov Acked-by: Florian Westphal Signed-off-by: David S. Miller commit ac2fcfa9fd26db67d7000677c05629c34cc94564 Author: Alexandre Belloni Date: Wed Feb 19 15:15:51 2020 +0100 net: macb: Properly handle phylink on at91rm9200 at91ether_init was handling the phy mode and speed but since the switch to phylink, the NCFGR register got overwritten by macb_mac_config(). The issue is that the RM9200_RMII bit and the MACB_CLK_DIV32 field are cleared but never restored as they conflict with the PAE, GBE and PCSSEL bits. Add new capability to differentiate between EMAC and the other versions of the IP and use it to set and avoid clearing the relevant bits. Also, this fixes a NULL pointer dereference in macb_mac_link_up as the EMAC doesn't use any rings/bufffers/queues. Fixes: 7897b071ac3b ("net: macb: convert to phylink") Signed-off-by: Alexandre Belloni Signed-off-by: David S. Miller commit 88b913718db94697497028b85acbec8b180a4333 Author: Masami Hiramatsu Date: Thu Feb 20 21:19:42 2020 +0900 bootconfig: Print array as multiple commands for legacy command line Print arraied values as multiple same options for legacy kernel command line. With this rule, if the "kernel.*" and "init.*" array entries in bootconfig are printed out as multiple same options, e.g. kernel { console = "ttyS0,115200" console += "tty0" } will be correctly converted to console="ttyS0,115200" console="tty0" in the kernel command line. Link: http://lkml.kernel.org/r/158220118213.26565.8163300497009463916.stgit@devnote2 Reported-by: Borislav Petkov Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit a24d286f36104ed45108a5a36f3868938434772f Author: Masami Hiramatsu Date: Thu Feb 20 21:19:12 2020 +0900 bootconfig: Reject subkey and value on same parent key Reject if a value node is mixed with subkey node on same parent key node. A value node can not co-exist with subkey node under some key node, e.g. key = value key.subkey = another-value This is not be allowed because bootconfig API is not designed to handle such case. Link: http://lkml.kernel.org/r/158220115232.26565.7792340045009731803.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 15e95037b45f24f9ab6d4f0bd101d4df0be24c1d Author: Masami Hiramatsu Date: Thu Feb 20 21:18:52 2020 +0900 tools/bootconfig: Remove unneeded error message silencer Remove error message silent knob, we don't need it anymore because we can check if there is a bootconfig by checking the magic word. If there is a magic word, but failed to load a bootconfig from initrd, there is a real problem. Link: http://lkml.kernel.org/r/158220113256.26565.14264598654427773104.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 85c46b78da58398be1c5166f55063c0512decd39 Author: Masami Hiramatsu Date: Thu Feb 20 21:18:42 2020 +0900 bootconfig: Add bootconfig magic word for indicating bootconfig explicitly Add bootconfig magic word to the end of bootconfig on initrd image for indicating explicitly the bootconfig is there. Also tools/bootconfig treats wrong size or wrong checksum or parse error as an error, because if there is a bootconfig magic word, there must be a bootconfig. The bootconfig magic word is "#BOOTCONFIG\n", 12 bytes word. Thus the block image of the initrd file with bootconfig is as follows. [Initrd][bootconfig][size][csum][#BOOTCONFIG\n] Link: http://lkml.kernel.org/r/158220112263.26565.3944814205960612841.stgit@devnote2 Suggested-by: Steven Rostedt Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit d8a953ddde5ec30a36810d0a892c3949b50849e9 Author: Masami Hiramatsu Date: Thu Feb 20 21:18:33 2020 +0900 bootconfig: Set CONFIG_BOOT_CONFIG=n by default Set CONFIG_BOOT_CONFIG=n by default. This also warns user if CONFIG_BOOT_CONFIG=n but "bootconfig" is given in the kernel command line. Link: http://lkml.kernel.org/r/158220111291.26565.9036889083940367969.stgit@devnote2 Suggested-by: Steven Rostedt Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 7ab215f22d04067094de8c81c20ba4c565ff8dd4 Author: Masami Hiramatsu Date: Mon Feb 17 18:52:39 2020 +0900 tracing: Clear trace_state when starting trace Clear trace_state data structure when starting trace in __synth_event_trace_start() internal function. Currently trace_state is initialized only in the synth_event_trace_start() API, but the trace_state in synth_event_trace() and synth_event_trace_array() are on the stack without initialization. This means those APIs will see wrong parameters and wil skip closing process in __synth_event_trace_end() because trace_state->disabled may be !0. Link: http://lkml.kernel.org/r/158193315899.8868.1781259176894639952.stgit@devnote2 Reviewed-by: Tom Zanussi Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 08d9e686426f7557d3f1cda219ff907397c89d53 Author: Qiujun Huang Date: Sun Feb 16 19:28:31 2020 +0800 bootconfig: Mark boot_config_checksum() static In fact, this function is only used in this file, so mark it with 'static'. Link: http://lkml.kernel.org/r/1581852511-14163-1-git-send-email-hqjagain@gmail.com Acked-by: Masami Hiramatsu Signed-off-by: Qiujun Huang Signed-off-by: Steven Rostedt (VMware) commit 78041c0c9e935d9ce4086feeff6c569ed88ddfd4 Author: Steven Rostedt (VMware) Date: Thu Feb 20 15:38:01 2020 -0500 tracing: Disable trace_printk() on post poned tests The tracing seftests checks various aspects of the tracing infrastructure, and one is filtering. If trace_printk() is active during a self test, it can cause the filtering to fail, which will disable that part of the trace. To keep the selftests from failing because of trace_printk() calls, trace_printk() checks the variable tracing_selftest_running, and if set, it does not write to the tracing buffer. As some tracers were registered earlier in boot, the selftest they triggered would fail because not all the infrastructure was set up for the full selftest. Thus, some of the tests were post poned to when their infrastructure was ready (namely file system code). The postpone code did not set the tracing_seftest_running variable, and could fail if a trace_printk() was added and executed during their run. Cc: stable@vger.kernel.org Fixes: 9afecfbb95198 ("tracing: Postpone tracer start-up tests till the system is more robust") Signed-off-by: Steven Rostedt (VMware) commit 3c18a9be7c9d4f53239795282c5d927f73f534b3 Author: Steven Rostedt (VMware) Date: Thu Feb 20 16:29:50 2020 -0500 tracing: Have synthetic event test use raw_smp_processor_id() The test code that tests synthetic event creation pushes in as one of its test fields the current CPU using "smp_processor_id()". As this is just something to see if the value is correctly passed in, and the actual CPU used does not matter, use raw_smp_processor_id(), otherwise with debug preemption enabled, a warning happens as the smp_processor_id() is called without preemption enabled. Link: http://lkml.kernel.org/r/20200220162950.35162579@gandalf.local.home Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 8645e56a4ad6dcbf504872db7f14a2f67db88ef2 Author: Thomas Gleixner Date: Wed Feb 19 18:30:26 2020 +0100 xen: Enable interrupts when calling _cond_resched() xen_maybe_preempt_hcall() is called from the exception entry point xen_do_hypervisor_callback with interrupts disabled. _cond_resched() evades the might_sleep() check in cond_resched() which would have caught that and schedule_debug() unfortunately lacks a check for irqs_disabled(). Enable interrupts around the call and use cond_resched() to catch future issues. Fixes: fdfd811ddde3 ("x86/xen: allow privcmd hypercalls to be preempted") Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/878skypjrh.fsf@nanos.tec.linutronix.de Reviewed-by: Juergen Gross Signed-off-by: Boris Ostrovsky commit ac0a68997935c4acb92eaae5ad8982e0bb432d56 Author: Matthias Reichl Date: Thu Feb 20 21:29:56 2020 +0100 ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path When we get a clock error during probe we have to call regulator_bulk_disable before bailing out, otherwise we trigger a warning in regulator_put. Fix this by using "goto err" like in the error cases above. Fixes: 5a3af1293194d ("ASoC: pcm512x: Add PCM512x driver") Signed-off-by: Matthias Reichl Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200220202956.29233-1-hias@horus.com Signed-off-by: Mark Brown commit 784bd0847eda032ed2f3522f87250655a18c0190 Author: Tom Zanussi Date: Fri Feb 14 16:56:41 2020 -0600 tracing: Fix number printing bug in print_synth_event() Fix a varargs-related bug in print_synth_event() which resulted in strange output and oopses on 32-bit x86 systems. The problem is that trace_seq_printf() expects the varargs to match the format string, but print_synth_event() was always passing u64 values regardless. This results in unspecified behavior when unpacking with va_arg() in trace_seq_printf(). Add a function that takes the size into account when calling trace_seq_printf(). Before: modprobe-1731 [003] .... 919.039758: gen_synth_test: next_pid_field=777(null)next_comm_field=hula hoops ts_ns=1000000 ts_ms=1000 cpu=3(null)my_string_field=thneed my_int_field=598(null) After: insmod-1136 [001] .... 36.634590: gen_synth_test: next_pid_field=777 next_comm_field=hula hoops ts_ns=1000000 ts_ms=1000 cpu=1 my_string_field=thneed my_int_field=598 Link: http://lkml.kernel.org/r/a9b59eb515dbbd7d4abe53b347dccf7a8e285657.1581720155.git.zanussi@kernel.org Reported-by: Steven Rostedt (VMware) Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 3843083772dc2afde790a6d7160658b00a808da1 Author: Tom Zanussi Date: Fri Feb 14 16:56:40 2020 -0600 tracing: Check that number of vals matches number of synth event fields Commit 7276531d4036('tracing: Consolidate trace() functions') inadvertently dropped the synth_event_trace() and synth_event_trace_array() checks that verify the number of values passed in matches the number of fields in the synthetic event being traced, so add them back. Link: http://lkml.kernel.org/r/32819cac708714693669e0dfe10fe9d935e94a16.1581720155.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 1d9d4c90194a8c3b2f7da9f4bf3f8ba2ed810656 Author: Tom Zanussi Date: Fri Feb 14 16:56:39 2020 -0600 tracing: Make synth_event trace functions endian-correct synth_event_trace(), synth_event_trace_array() and __synth_event_add_val() write directly into the trace buffer and need to take endianness into account, like trace_event_raw_event_synth() does. Link: http://lkml.kernel.org/r/2011354355e405af9c9d28abba430d1f5ff7771a.1581720155.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 279eef0531928a6669230879a6eed081513ad5a3 Author: Tom Zanussi Date: Fri Feb 14 16:56:38 2020 -0600 tracing: Make sure synth_event_trace() example always uses u64 synth_event_trace() is the varargs version of synth_event_trace_array(), which takes an array of u64, as do synth_event_add_val() et al. To not only be consistent with those, but also to address the fact that synth_event_trace() expects every arg to be of the same type since it doesn't also pass in e.g. a format string, the caller needs to make sure all args are of the same type, u64. u64 is used because it needs to accomodate the largest type available in synthetic events, which is u64. This fixes the bug reported by the kernel test robot/Rong Chen. Link: https://lore.kernel.org/lkml/20200212113444.GS12867@shao2-debian/ Link: http://lkml.kernel.org/r/894c4e955558b521210ee0642ba194a9e603354c.1581720155.git.zanussi@kernel.org Fixes: 9fe41efaca084 ("tracing: Add synth event generation test module") Reported-by: kernel test robot Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 0d5b8d7055652fd6b079671d00fa78fcd0e2cd7c Merge: 16a556eeb7ed 54a61fbc020f Author: David S. Miller Date: Thu Feb 20 10:30:47 2020 -0800 Merge branch 's390-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2020-02-20 please apply the following patch series for qeth to netdev's net tree. This corrects three minor issues: 1) return a more fitting errno when VNICC cmds are not supported, 2) remove a bogus WARN in the NAPI code, and 3) be _very_ pedantic about the RX copybreak. ==================== Signed-off-by: David S. Miller commit 54a61fbc020fd2e305680871c453abcf7fc0339b Author: Julian Wiedmann Date: Thu Feb 20 15:54:56 2020 +0100 s390/qeth: fix off-by-one in RX copybreak check The RX copybreak is intended as the _max_ value where the frame's data should be copied. So for frame_len == copybreak, don't build an SG skb. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 420579dba126c6111b5a3dea062f21a7e4e647c6 Author: Julian Wiedmann Date: Thu Feb 20 15:54:55 2020 +0100 s390/qeth: don't warn for napi with 0 budget Calling napi->poll() with 0 budget is a legitimate use by netpoll. Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 6f3846f0955308b6d1b219419da42b8de2c08845 Author: Alexandra Winter Date: Thu Feb 20 15:54:54 2020 +0100 s390/qeth: vnicc Fix EOPNOTSUPP precedence When getting or setting VNICC parameters, the error code EOPNOTSUPP should have precedence over EBUSY. EBUSY is used because vnicc feature and bridgeport feature are mutually exclusive, which is a temporary condition. Whereas EOPNOTSUPP indicates that the HW does not support all or parts of the vnicc feature. This issue causes the vnicc sysfs params to show 'blocked by bridgeport' for HW that does not support VNICC at all. Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support") Signed-off-by: Alexandra Winter Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit e500ba0e71f0b8652e67f8801cf7c33dad3ee4a4 Merge: 10dc62d0ae41 00a39c92c8ab Author: Tony Lindgren Date: Thu Feb 20 10:02:02 2020 -0800 Merge branch 'omap-for-v5.6/fixes-rc2' into fixes commit 16a556eeb7ed2dc3709fe2c5be76accdfa4901ab Author: Kees Cook Date: Wed Feb 19 22:23:09 2020 -0800 openvswitch: Distribute switch variables for initialization Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain. To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body. net/openvswitch/flow_netlink.c: In function ‘validate_set’: net/openvswitch/flow_netlink.c:2711:29: warning: statement will never be executed [-Wswitch-unreachable] 2711 | const struct ovs_key_ipv4 *ipv4_key; | ^~~~~~~~ [1] https://bugs.llvm.org/show_bug.cgi?id=44916 Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 46d30cb1045c2ab1ada269702c8c84d6446baf81 Author: Kees Cook Date: Wed Feb 19 22:23:07 2020 -0800 net: ip6_gre: Distribute switch variables for initialization Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain. To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body. net/ipv6/ip6_gre.c: In function ‘ip6gre_err’: net/ipv6/ip6_gre.c:440:32: warning: statement will never be executed [-Wswitch-unreachable] 440 | struct ipv6_tlv_tnl_enc_lim *tel; | ^~~ net/ipv6/ip6_tunnel.c: In function ‘ip6_tnl_err’: net/ipv6/ip6_tunnel.c:520:32: warning: statement will never be executed [-Wswitch-unreachable] 520 | struct ipv6_tlv_tnl_enc_lim *tel; | ^~~ [1] https://bugs.llvm.org/show_bug.cgi?id=44916 Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 161d179261f95ac56f61f94f89304e0620534230 Author: Kees Cook Date: Wed Feb 19 22:23:04 2020 -0800 net: core: Distribute switch variables for initialization Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain. To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body. net/core/skbuff.c: In function ‘skb_checksum_setup_ip’: net/core/skbuff.c:4809:7: warning: statement will never be executed [-Wswitch-unreachable] 4809 | int err; | ^~~ [1] https://bugs.llvm.org/show_bug.cgi?id=44916 Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 00a39c92c8ab94727f021297d1748531af113fcd Author: Grygorii Strashko Date: Wed Feb 19 18:21:26 2020 +0200 ARM: dts: dra7-l4: mark timer13-16 as pwm capable DMTimers 13 - 16 are PWM capable and also can be used for CPTS input signals generation. Hence, mark them as "ti,timer-pwm". Signed-off-by: Grygorii Strashko Reviewed-by: Lokesh Vutla Signed-off-by: Tony Lindgren commit 78722d37b2b4cf9178295e2aa5510880e6135fd7 Author: Suman Anna Date: Tue Feb 11 09:51:03 2020 -0600 ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source The IPU1 functional clock is the output of a mux clock (represented by ipu1_gfclk_mux previously) and the clock source for this has been updated to be sourced from dpll_core_h22x2_ck in commit 39879c7d963e ("ARM: dts: dra7xx-clocks: Source IPU1 functional clock from CORE DPLL"). ipu1_gfclk_mux is an obsolete clock now with the clkctrl conversion, and this clock source parenting is lost during the new clkctrl layout conversion. Remove this stale clock and fix up the clock source for this mux clock using the latest equivalent clkctrl clock. This restores the previous logic and ensures that the IPU1 continues to run at the same frequency of IPU2 and independent of the ABE DPLL. Fixes: b5f8ffbb6fad ("ARM: dts: dra7: convert to use new clkctrl layout") Signed-off-by: Suman Anna Signed-off-by: Tony Lindgren commit 31623468be0bf57617b8057dcd335693935a9491 Author: Suman Anna Date: Mon Feb 10 15:04:23 2020 -0600 ARM: dts: am437x-idk-evm: Fix incorrect OPP node names The commit 337c6c9a69af ("ARM: dts: am437x-idk-evm: Disable OPP50 for MPU") adjusts couple of OPP nodes defined in the common am4372.dtsi file, but used outdated node names. This results in these getting treated as new OPP nodes with missing properties. Fix this properly by using the correct node names as updated in commit b9cb2ba71848 ("ARM: dts: Use - instead of @ for DT OPP entries for TI SoCs"). Reported-by: Roger Quadros Fixes: 337c6c9a69af ("ARM: dts: am437x-idk-evm: Disable OPP50 for MPU") Signed-off-by: Suman Anna Signed-off-by: Tony Lindgren commit d6c01c25f00d0491d92a3132387dbbcd717c3b92 Author: Peter Ujfalusi Date: Fri Jan 24 14:11:39 2020 +0200 ARM: dts: dra7-evm: Rename evm_3v3 regulator to vsys_3v3 On the new schematics it is renamed and the same name is used on other dra7 boards. Signed-off-by: Peter Ujfalusi Signed-off-by: Tony Lindgren commit 6affca140cbea01f497c4f4e16f1e2be7f74bd04 Author: Max Gurtovoy Date: Thu Feb 20 12:08:18 2020 +0200 RDMA/rw: Fix error flow during RDMA context initialization In case the SGL was mapped for P2P DMA operation, we must unmap it using pci_p2pdma_unmap_sg during the error unwind of rdma_rw_ctx_init() Fixes: 7f73eac3a713 ("PCI/P2PDMA: Introduce pci_p2pdma_unmap_sg()") Link: https://lore.kernel.org/r/20200220100819.41860-1-maxg@mellanox.com Signed-off-by: Max Gurtovoy Reviewed-by: Leon Romanovsky Reviewed-by: Logan Gunthorpe Signed-off-by: Jason Gunthorpe commit b78a8552d77f8efb7c4fbd92a91b890c32b89528 Author: Qian Cai Date: Mon Feb 17 11:48:26 2020 -0500 kvm/emulate: fix a -Werror=cast-function-type arch/x86/kvm/emulate.c: In function 'x86_emulate_insn': arch/x86/kvm/emulate.c:5686:22: error: cast between incompatible function types from 'int (*)(struct x86_emulate_ctxt *)' to 'void (*)(struct fastop *)' [-Werror=cast-function-type] rc = fastop(ctxt, (fastop_t)ctxt->execute); Fix it by using an unnamed union of a (*execute) function pointer and a (*fastop) function pointer. Fixes: 3009afc6e39e ("KVM: x86: Use a typedef for fastop functions") Suggested-by: Paolo Bonzini Signed-off-by: Qian Cai Signed-off-by: Paolo Bonzini commit 147f1a1fe5d7e6b01b8df4d0cbd6f9eaf6b6c73b Author: Paolo Bonzini Date: Thu Feb 13 18:24:48 2020 +0100 KVM: x86: fix incorrect comparison in trace event The "u" field in the event has three states, -1/0/1. Using u8 however means that comparison with -1 will always fail, so change to signed char. Signed-off-by: Paolo Bonzini commit 9038ec99ceb94fb8d93ade5e236b2928f0792c7c Author: Kees Cook Date: Wed Feb 19 22:23:18 2020 -0800 x86/xen: Distribute switch variables for initialization Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain. To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body. arch/x86/xen/enlighten_pv.c: In function ‘xen_write_msr_safe’: arch/x86/xen/enlighten_pv.c:904:12: warning: statement will never be executed [-Wswitch-unreachable] 904 | unsigned which; | ^~~~~ [1] https://bugs.llvm.org/show_bug.cgi?id=44916 Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20200220062318.69299-1-keescook@chromium.org Reviewed-by: Juergen Gross [boris: made @which an 'unsigned int'] Signed-off-by: Boris Ostrovsky commit ef89d0545132d685f73da6f58b7e7fe002536f91 Author: Michael Ellerman Date: Thu Feb 20 22:37:48 2020 +1100 selftests/rseq: Fix out-of-tree compilation Currently if you build with O=... the rseq tests don't build: $ make O=$PWD/output -C tools/testing/selftests/ TARGETS=rseq make: Entering directory '/linux/tools/testing/selftests' ... make[1]: Entering directory '/linux/tools/testing/selftests/rseq' gcc -O2 -Wall -g -I./ -I../../../../usr/include/ -L./ -Wl,-rpath=./ -shared -fPIC rseq.c -lpthread -o /linux/output/rseq/librseq.so gcc -O2 -Wall -g -I./ -I../../../../usr/include/ -L./ -Wl,-rpath=./ basic_test.c -lpthread -lrseq -o /linux/output/rseq/basic_test /usr/bin/ld: cannot find -lrseq collect2: error: ld returned 1 exit status This is because the library search path points to the source directory, not the output. We can fix it by changing the library search path to $(OUTPUT). Signed-off-by: Michael Ellerman Signed-off-by: Shuah Khan commit b9167c8078c3527de6da241c8a1a75a9224ed90a Author: Michael Ellerman Date: Thu Feb 20 15:42:41 2020 +1100 selftests: Install settings files to fix TIMEOUT failures Commit 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") added a 45 second timeout for tests, and also added a way for tests to customise the timeout via a settings file. For example the ftrace tests take multiple minutes to run, so they were given longer in commit b43e78f65b1d ("tracing/selftests: Turn off timeout setting"). This works when the tests are run from the source tree. However if the tests are installed with "make -C tools/testing/selftests install", the settings files are not copied into the install directory. When the tests are then run from the install directory the longer timeouts are not applied and the tests timeout incorrectly. So add the settings files to TEST_FILES of the appropriate Makefiles to cause the settings files to be installed using the existing install logic. Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") Signed-off-by: Michael Ellerman Signed-off-by: Shuah Khan commit 68ca0fd272dac9a9f78fbf14b5e65de34f12c1b4 Author: Christophe Leroy Date: Thu Feb 6 08:11:39 2020 +0000 selftest/lkdtm: Don't pollute 'git status' Commit 46d1a0f03d66 ("selftests/lkdtm: Add tests for LKDTM targets") added generation of lkdtm test scripts. Ignore those generated scripts when performing 'git status' Fixes: 46d1a0f03d66 ("selftests/lkdtm: Add tests for LKDTM targets") Signed-off-by: Christophe Leroy Signed-off-by: Shuah Khan commit 10dc62d0ae4167770e9ab150fc1ab55baa82e010 Author: Tony Lindgren Date: Wed Feb 19 11:25:27 2020 -0800 ARM: dts: droid4: Configure LED backlight for lm3532 With the LED backlight changes merged, we still need the dts configured to have backlight working for droid4. Based on an earlier patch from Pavel Machek , let's configure the backlight but update the value range to be more usable. We have a range of 256 register values split into 8 steps, so we can generate the brightness levels backwards with: $ for i in 0 1 2 3 4 5 6 7; do echo "255 - ${i} * (256 / 8)" | bc; done To avoid more confusion why the LCD backlight is still not on, let's also enable LED backlight as a loadable module for omap2plus_defconfig. Cc: Merlijn Wajer Cc: Pavel Machek Reviewed-by: Sebastian Reichel Acked-by: Pavel Machek Signed-off-by: Tony Lindgren commit 58aa7729310db04ffcc022c98002dd8fcb486c58 Author: Grygorii Strashko Date: Fri Feb 14 21:08:01 2020 +0200 phy: ti: gmii-sel: do not fail in case of gmii The "gmii" PHY interface mode is supported on TI AM335x/437x/5xx SoCs, so don't fail if it's selected. Signed-off-by: Grygorii Strashko Signed-off-by: Kishon Vijay Abraham I commit eefed634eb61e4094b9fb8183cb8d43b26838517 Author: Grygorii Strashko Date: Fri Feb 14 21:08:00 2020 +0200 phy: ti: gmii-sel: fix set of copy-paste errors - under PHY_INTERFACE_MODE_MII the 'mode' func parameter is assigned instead of 'gmii_sel_mode' and it's working only because the default value 'gmii_sel_mode' is set to 0. - console outputs use 'rgmii_id' and 'mode' values to print PHY mode instead of using 'submode' value which is representing PHY interface mode now. This patch fixes above two cases. Signed-off-by: Grygorii Strashko Signed-off-by: Kishon Vijay Abraham I commit 63d68382f5fb5f71772357e31841c19c4a133182 Author: Pierre-Louis Bossart Date: Wed Feb 19 16:21:30 2020 -0600 ASoC: soc-core: fix for_rtd_codec_dai_rollback() macro The use of parentheses to protect the argument is fine for (i)++ but not for (--i). Fixes: 83f94a2e293d61 ("ASoC: soc-core: add snd_soc_close_delayed_work()") Signed-off-by: Pierre-Louis Bossart Acked-by: Kuninori Morimoto Cc: Kuninori Morimoto Link: https://lore.kernel.org/r/20200219222130.29933-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit b0c609ab2057d0953fa05e7566f0c0e8a28fa9e1 Author: Alexandre Belloni Date: Fri Feb 14 15:06:21 2020 +0100 PM / hibernate: fix typo "reserverd_size" -> "reserved_size" Fix a mistake in a variable name in a comment. Signed-off-by: Alexandre Belloni Signed-off-by: Rafael J. Wysocki commit 14ba91c74782f4d470f4d7c7cf585e29d4761035 Author: Jonathan Neuschäfer Date: Tue Feb 18 15:58:18 2020 +0100 Documentation: power: Drop reference to interface.rst It has been merged into sleep-states.rst. Fixes: c21502efdaed ("Documentation: admin-guide: PM: Update sleep states documentation") Signed-off-by: Jonathan Neuschäfer Signed-off-by: Rafael J. Wysocki commit dcde237319e626d1ec3c9d8b7613032f0fd4663a Author: Catalin Marinas Date: Wed Feb 19 12:31:56 2020 +0000 mm: Avoid creating virtual address aliases in brk()/mmap()/mremap() Currently the arm64 kernel ignores the top address byte passed to brk(), mmap() and mremap(). When the user is not aware of the 56-bit address limit or relies on the kernel to return an error, untagging such pointers has the potential to create address aliases in user-space. Passing a tagged address to munmap(), madvise() is permitted since the tagged pointer is expected to be inside an existing mapping. The current behaviour breaks the existing glibc malloc() implementation which relies on brk() with an address beyond 56-bit to be rejected by the kernel. Remove untagging in the above functions by partially reverting commit ce18d171cb73 ("mm: untag user pointers in mmap/munmap/mremap/brk"). In addition, update the arm64 tagged-address-abi.rst document accordingly. Link: https://bugzilla.redhat.com/1797052 Fixes: ce18d171cb73 ("mm: untag user pointers in mmap/munmap/mremap/brk") Cc: # 5.4.x- Cc: Florian Weimer Reviewed-by: Andrew Morton Reported-by: Victor Stinner Acked-by: Will Deacon Acked-by: Andrey Konovalov Signed-off-by: Catalin Marinas Signed-off-by: Will Deacon commit ce4a64e1f656138e2a1481049ea554720f86b43a Author: Scott Branden Date: Wed Feb 19 14:14:03 2020 -0800 docs: arm64: fix trivial spelling enought to enough in memory.rst Fix trivial spelling error enought to enough in memory.rst. Cc: trivial@kernel.org Signed-off-by: Scott Branden Signed-off-by: Will Deacon commit ae99fb8baafc881b35aa0b79d7ac0178a7c40c89 Author: Randy Dunlap Date: Sun Feb 16 20:42:36 2020 -0800 Documentation/admin-guide/acpi: fix fan_performance_states.rst warnings Fix Sphinx format warnings in fan_performace_states.rst by adding indentation. Documentation/admin-guide/acpi/fan_performance_states.rst:21: WARNING: Literal block ends without a blank line; unexpected unindent. Documentation/admin-guide/acpi/fan_performance_states.rst:41: WARNING: Literal block expected; none found. Signed-off-by: Randy Dunlap Signed-off-by: Rafael J. Wysocki commit 9424ef56e13a1f14c57ea161eed3ecfdc7b2770e Author: Shijie Luo Date: Sat Feb 15 03:02:06 2020 -0500 ext4: add cond_resched() to __ext4_find_entry() We tested a soft lockup problem in linux 4.19 which could also be found in linux 5.x. When dir inode takes up a large number of blocks, and if the directory is growing when we are searching, it's possible the restart branch could be called many times, and the do while loop could hold cpu a long time. Here is the call trace in linux 4.19. [ 473.756186] Call trace: [ 473.756196] dump_backtrace+0x0/0x198 [ 473.756199] show_stack+0x24/0x30 [ 473.756205] dump_stack+0xa4/0xcc [ 473.756210] watchdog_timer_fn+0x300/0x3e8 [ 473.756215] __hrtimer_run_queues+0x114/0x358 [ 473.756217] hrtimer_interrupt+0x104/0x2d8 [ 473.756222] arch_timer_handler_virt+0x38/0x58 [ 473.756226] handle_percpu_devid_irq+0x90/0x248 [ 473.756231] generic_handle_irq+0x34/0x50 [ 473.756234] __handle_domain_irq+0x68/0xc0 [ 473.756236] gic_handle_irq+0x6c/0x150 [ 473.756238] el1_irq+0xb8/0x140 [ 473.756286] ext4_es_lookup_extent+0xdc/0x258 [ext4] [ 473.756310] ext4_map_blocks+0x64/0x5c0 [ext4] [ 473.756333] ext4_getblk+0x6c/0x1d0 [ext4] [ 473.756356] ext4_bread_batch+0x7c/0x1f8 [ext4] [ 473.756379] ext4_find_entry+0x124/0x3f8 [ext4] [ 473.756402] ext4_lookup+0x8c/0x258 [ext4] [ 473.756407] __lookup_hash+0x8c/0xe8 [ 473.756411] filename_create+0xa0/0x170 [ 473.756413] do_mkdirat+0x6c/0x140 [ 473.756415] __arm64_sys_mkdirat+0x28/0x38 [ 473.756419] el0_svc_common+0x78/0x130 [ 473.756421] el0_svc_handler+0x38/0x78 [ 473.756423] el0_svc+0x8/0xc [ 485.755156] watchdog: BUG: soft lockup - CPU#2 stuck for 22s! [tmp:5149] Add cond_resched() to avoid soft lockup and to provide a better system responding. Link: https://lore.kernel.org/r/20200215080206.13293-1-luoshijie1@huawei.com Signed-off-by: Shijie Luo Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara Cc: stable@kernel.org commit 35df4299a6487f323b0aca120ea3f485dfee2ae3 Author: Qian Cai Date: Fri Feb 7 09:29:11 2020 -0500 ext4: fix a data race in EXT4_I(inode)->i_disksize EXT4_I(inode)->i_disksize could be accessed concurrently as noticed by KCSAN, BUG: KCSAN: data-race in ext4_write_end [ext4] / ext4_writepages [ext4] write to 0xffff91c6713b00f8 of 8 bytes by task 49268 on cpu 127: ext4_write_end+0x4e3/0x750 [ext4] ext4_update_i_disksize at fs/ext4/ext4.h:3032 (inlined by) ext4_update_inode_size at fs/ext4/ext4.h:3046 (inlined by) ext4_write_end at fs/ext4/inode.c:1287 generic_perform_write+0x208/0x2a0 ext4_buffered_write_iter+0x11f/0x210 [ext4] ext4_file_write_iter+0xce/0x9e0 [ext4] new_sync_write+0x29c/0x3b0 __vfs_write+0x92/0xa0 vfs_write+0x103/0x260 ksys_write+0x9d/0x130 __x64_sys_write+0x4c/0x60 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe read to 0xffff91c6713b00f8 of 8 bytes by task 24872 on cpu 37: ext4_writepages+0x10ac/0x1d00 [ext4] mpage_map_and_submit_extent at fs/ext4/inode.c:2468 (inlined by) ext4_writepages at fs/ext4/inode.c:2772 do_writepages+0x5e/0x130 __writeback_single_inode+0xeb/0xb20 writeback_sb_inodes+0x429/0x900 __writeback_inodes_wb+0xc4/0x150 wb_writeback+0x4bd/0x870 wb_workfn+0x6b4/0x960 process_one_work+0x54c/0xbe0 worker_thread+0x80/0x650 kthread+0x1e0/0x200 ret_from_fork+0x27/0x50 Reported by Kernel Concurrency Sanitizer on: CPU: 37 PID: 24872 Comm: kworker/u261:2 Tainted: G W O L 5.5.0-next-20200204+ #5 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019 Workqueue: writeback wb_workfn (flush-7:0) Since only the read is operating as lockless (outside of the "i_data_sem"), load tearing could introduce a logic bug. Fix it by adding READ_ONCE() for the read and WRITE_ONCE() for the write. Signed-off-by: Qian Cai Link: https://lore.kernel.org/r/1581085751-31793-1-git-send-email-cai@lca.pw Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 7c42545cad101fbb9811b55a3b9b697efba6555a Merge: ec0bd60a4790 f287d3d19769 Author: Dave Airlie Date: Thu Feb 20 12:00:06 2020 +1000 Merge branch 'linux-5.6' of git://github.com/skeggsb/linux into drm-fixes Nothing major here, another TU1xx modesetting fix, and hooking up ACR/GR support on TU11x now that NVIDIA have made the firmware available. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Wed Feb 19 14:36:14 2020 -0800 hwmon: (acpi_power_meter) Fix lockdep splat Damien Le Moal reports a lockdep splat with the acpi_power_meter, observed with Linux v5.5 and later. ====================================================== WARNING: possible circular locking dependency detected 5.6.0-rc2+ #629 Not tainted ------------------------------------------------------ python/1397 is trying to acquire lock: ffff888619080070 (&resource->lock){+.+.}, at: show_power+0x3c/0xa0 [acpi_power_meter] but task is already holding lock: ffff88881643f188 (kn->count#119){++++}, at: kernfs_seq_start+0x6a/0x160 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (kn->count#119){++++}: __kernfs_remove+0x626/0x7e0 kernfs_remove_by_name_ns+0x41/0x80 remove_attrs+0xcb/0x3c0 [acpi_power_meter] acpi_power_meter_notify+0x1f7/0x310 [acpi_power_meter] acpi_ev_notify_dispatch+0x198/0x1f3 acpi_os_execute_deferred+0x4d/0x70 process_one_work+0x7c8/0x1340 worker_thread+0x94/0xc70 kthread+0x2ed/0x3f0 ret_from_fork+0x24/0x30 -> #0 (&resource->lock){+.+.}: __lock_acquire+0x20be/0x49b0 lock_acquire+0x127/0x340 __mutex_lock+0x15b/0x1350 show_power+0x3c/0xa0 [acpi_power_meter] dev_attr_show+0x3f/0x80 sysfs_kf_seq_show+0x216/0x410 seq_read+0x407/0xf90 vfs_read+0x152/0x2c0 ksys_read+0xf3/0x1d0 do_syscall_64+0x95/0x1010 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(kn->count#119); lock(&resource->lock); lock(kn->count#119); lock(&resource->lock); *** DEADLOCK *** 4 locks held by python/1397: #0: ffff8890242d64e0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x9b/0xb0 #1: ffff889040be74e0 (&p->lock){+.+.}, at: seq_read+0x6b/0xf90 #2: ffff8890448eb880 (&of->mutex){+.+.}, at: kernfs_seq_start+0x47/0x160 #3: ffff88881643f188 (kn->count#119){++++}, at: kernfs_seq_start+0x6a/0x160 stack backtrace: CPU: 10 PID: 1397 Comm: python Not tainted 5.6.0-rc2+ #629 Hardware name: Supermicro Super Server/X11DPL-i, BIOS 3.1 05/21/2019 Call Trace: dump_stack+0x97/0xe0 check_noncircular+0x32e/0x3e0 ? print_circular_bug.isra.0+0x1e0/0x1e0 ? unwind_next_frame+0xb9a/0x1890 ? entry_SYSCALL_64_after_hwframe+0x49/0xbe ? graph_lock+0x79/0x170 ? __lockdep_reset_lock+0x3c0/0x3c0 ? mark_lock+0xbc/0x1150 __lock_acquire+0x20be/0x49b0 ? mark_held_locks+0xe0/0xe0 ? stack_trace_save+0x91/0xc0 lock_acquire+0x127/0x340 ? show_power+0x3c/0xa0 [acpi_power_meter] ? device_remove_bin_file+0x10/0x10 ? device_remove_bin_file+0x10/0x10 __mutex_lock+0x15b/0x1350 ? show_power+0x3c/0xa0 [acpi_power_meter] ? show_power+0x3c/0xa0 [acpi_power_meter] ? mutex_lock_io_nested+0x11f0/0x11f0 ? lock_downgrade+0x6a0/0x6a0 ? kernfs_seq_start+0x47/0x160 ? lock_acquire+0x127/0x340 ? kernfs_seq_start+0x6a/0x160 ? device_remove_bin_file+0x10/0x10 ? show_power+0x3c/0xa0 [acpi_power_meter] show_power+0x3c/0xa0 [acpi_power_meter] dev_attr_show+0x3f/0x80 ? memset+0x20/0x40 sysfs_kf_seq_show+0x216/0x410 seq_read+0x407/0xf90 ? security_file_permission+0x16f/0x2c0 vfs_read+0x152/0x2c0 Problem is that reading an attribute takes the kernfs lock in the kernfs code, then resource->lock in the driver. During an ACPI notification, the opposite happens: The resource lock is taken first, followed by the kernfs lock when sysfs attributes are removed and re-created. Presumably this is now seen due to some locking related changes in kernfs after v5.4, but it was likely always a problem. Fix the problem by not blindly acquiring the lock in the notification function. It is only needed to protect the various update functions. However, those update functions are called anyway when sysfs attributes are read. This means that we can just stop calling those functions from the notifier, and the resource lock in the notifier function is no longer needed. That leaves two situations: First, METER_NOTIFY_CONFIG removes and re-allocates capability strings. While it did so under the resource lock, _displaying_ those strings was not protected, creating a race condition. To solve this problem, selectively protect both removal/creation and reporting of capability attributes with the resource lock. Second, removing and re-creating the attribute files is no longer protected by the resource lock. That doesn't matter since access to each individual attribute is protected by the kernfs lock. Userspace may get messed up if attributes disappear and reappear under its nose, but that is not different than today, and there is nothing we can do about it without major driver restructuring. Last but not least, when removing the driver, remove attribute functions first, then release capability strings. This avoids yet another race condition. Reported-by: Damien Le Moal Cc: Damien Le Moal Cc: stable@vger.kernel.org # v5.5+ Tested-by: Damien Le Moal Signed-off-by: Guenter Roeck commit ca7e1fd1026c5af6a533b4b5447e1d2f153e28f2 Merge: 4b205766d8fc 9a0584f05687 Author: Linus Torvalds Date: Wed Feb 19 17:22:10 2020 -0800 Merge tag 'linux-kselftest-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "Fixes to build failures and other test bugs" * tag 'linux-kselftest-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: openat2: fix build error on newer glibc selftests: use LDLIBS for libraries instead of LDFLAGS selftests: fix too long argument selftests: allow detection of build failures Kernel selftests: tpm2: check for tpm support selftests/ftrace: Have pid filter test use instance flag selftests: fix spelling mistaked "chaigned" -> "chained" commit 854bdbae9058bcf09b0add70b6047bc9ca776de2 Author: Maxime Ripard Date: Mon Feb 10 11:04:17 2020 +0100 dt-bindings: media: csi: Fix clocks description Commit 1de243b07666 ("media: dt-bindings: media: sun4i-csi: Add compatible for CSI1 on A10/A20") introduced support for the CSI1 controller on A10 and A20 that unlike CSI0 doesn't have an ISP and therefore only have two clocks, the bus and module clocks. The clocks and clock-names properties have thus been modified to allow either two or tree clocks. However, the current list has the ISP clock at the second position, which means the bindings expects a list of either bus and isp, or bus, isp and mod. The initial intent of the patch was obviously to have bus and mod in the former case. Let's fix the binding so that it validates properly. Fixes: 1de243b07666 ("media: dt-bindings: media: sun4i-csi: Add compatible for CSI1 on A10/A20") Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 303d37b4b0522150c0c7701d84934bc13199bebc Author: Maxime Ripard Date: Mon Feb 10 11:04:16 2020 +0100 dt-bindings: media: csi: Add interconnects properties The Allwinner CSI controller is sitting beside the MBUS that is represented as an interconnect. Make sure that the interconnect properties are valid in the binding. Fixes: 7866d6903ce8 ("media: dt-bindings: media: sun4i-csi: Add compatible for CSI0 on R40") Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 867c1859590f3bbc13d9cfb46c90c8202769d0e5 Author: Grygorii Strashko Date: Fri Feb 14 21:44:08 2020 +0200 dt-bindings: net: mdio: remove compatible string from example Remove vendor specific compatible string from example, otherwise DT YAML schemas validation may trigger warnings specific to TI ti,davinci_mdio and not to the generic MDIO example. For example, the "bus_freq" is required for davinci_mdio, but not required for generic mdio example. As result following warning will be produced: mdio.example.dt.yaml: mdio@5c030000: 'bus_freq' is a required property Signed-off-by: Grygorii Strashko Signed-off-by: Rob Herring commit 3044d9891bdb98ebae5c9e6fb1bd7f007bf7cad6 Author: Thierry Reding Date: Tue Jan 14 13:38:21 2020 +0100 dt-bindings: memory-controller: Update example for Tegra124 EMC The example in the Tegra124 EMC device tree binding looks like an old version that doesn't contain all the required fields. Update it with a version from the current DTS files to fix the make dt_binding_check target. Reported-by: Rob Herring Signed-off-by: Thierry Reding [robh: also fix missing '#reset-cells'] Signed-off-by: Rob Herring commit ec0bd60a4790066bb4426f87a878816392552257 Merge: 99edb18b86d9 8fc7036ee652 Author: Dave Airlie Date: Thu Feb 20 11:01:28 2020 +1000 Merge tag 'drm-msm-fixes-2020-02-16' of https://gitlab.freedesktop.org/drm/msm into drm-fixes + fix UBWC on GPU and display side for sc7180 + fix DSI suspend/resume issue encountered on sc7180 + fix some breakage on so called "linux-android" devices (fallout from sc7180/a618 support, not seen earlier due to bootloader/firmware differences) + couple other misc fixes Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Thu Feb 20 10:46:17 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-02-19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-02-19: amdgpu: - HDCP fixes - xclk fix for raven - GFXOFF fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200219173954.3847-1-alexander.deucher@amd.com commit 41f57cfde186dba6e357f9db25eafbed017e4487 Merge: fca07a937a27 b9aff38de2cb Author: David S. Miller Date: Wed Feb 19 16:42:35 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2020-02-19 The following pull-request contains BPF updates for your *net* tree. We've added 10 non-merge commits during the last 10 day(s) which contain a total of 10 files changed, 93 insertions(+), 31 deletions(-). The main changes are: 1) batched bpf hashtab fixes from Brian and Yonghong. 2) various selftests and libbpf fixes. ==================== Signed-off-by: David S. Miller commit fca07a937a27e720df7310bc5e68a11e5d2ff3c5 Merge: 303d0403b8c2 c54d209c78b8 Author: David S. Miller Date: Wed Feb 19 16:38:16 2020 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2020-02-19 This series contains fixes to the ice driver. Brett fixes an issue where if a user sets an odd [tx|rx]-usecs value through ethtool, the request is denied because the hardware is set to have an ITR with 2us granularity. Also fix an issue where the VF has not been completely removed/reset after being unbound from the host driver, so resolve this by waiting for the VF remove/reset process to happen before checking if the VF is disabled. Michal fixes an issue, where when the user changes flow control via ethtool, the OS is told the link is going down when that may not be the case. Before the fix, the only way to get out of this state was to take the interface down and up again. ==================== Signed-off-by: David S. Miller commit 303d0403b8c25e994e4a6e45389e173cf8706fb5 Author: Willem de Bruijn Date: Wed Feb 19 14:16:32 2020 -0500 udp: rehash on disconnect As of the below commit, udp sockets bound to a specific address can coexist with one bound to the any addr for the same port. The commit also phased out the use of socket hashing based only on port (hslot), in favor of always hashing on {addr, port} (hslot2). The change broke the following behavior with disconnect (AF_UNSPEC): server binds to 0.0.0.0:1337 server connects to 127.0.0.1:80 server disconnects client connects to 127.0.0.1:1337 client sends "hello" server reads "hello" // times out, packet did not find sk On connect the server acquires a specific source addr suitable for routing to its destination. On disconnect it reverts to the any addr. The connect call triggers a rehash to a different hslot2. On disconnect, add the same to return to the original hslot2. Skip this step if the socket is going to be unhashed completely. Fixes: 4cdeeee9252a ("net: udp: prefer listeners bound to an address") Reported-by: Pavel Roskin Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 06f5201c6392f998a49ca9c9173e2930c8eb51d8 Author: Rohit Maheshwari Date: Wed Feb 19 09:40:22 2020 +0530 net/tls: Fix to avoid gettig invalid tls record Current code doesn't check if tcp sequence number is starting from (/after) 1st record's start sequnce number. It only checks if seq number is before 1st record's end sequnce number. This problem will always be a possibility in re-transmit case. If a record which belongs to a requested seq number is already deleted, tls_get_record will start looking into list and as per the check it will look if seq number is before the end seq of 1st record, which will always be true and will return 1st record always, it should in fact return NULL. As part of the fix, start looking each record only if the sequence number lies in the list else return NULL. There is one more check added, driver look for the start marker record to handle tcp packets which are before the tls offload start sequence number, hence return 1st record if the record is tls start marker and seq number is before the 1st record's starting sequence number. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Rohit Maheshwari Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 88d5271c1efbd89713092b962070cf9af2fcd7c4 Author: Tomas Paukrt Date: Wed Jan 22 21:10:39 2020 +0100 dt-bindings: mmc: omap-hsmmc: Fix SDIO interrupt SDIO interrupt must be specified correctly as IRQ_TYPE_LEVEL_LOW instead of GPIO_ACTIVE_LOW. Signed-off-by: Tomas Paukrt Signed-off-by: Rob Herring commit e7167043ee508739fc9c5030494f94bea48cee23 Author: Damien Le Moal Date: Wed Feb 12 19:34:23 2020 +0900 riscv: Fix gitignore Tell git to not track the compiled boot/loader and boot/loader.lds files. Signed-off-by: Damien Le Moal Signed-off-by: Palmer Dabbelt commit b9aff38de2cb166476988020428985c5f7412ffc Author: Yonghong Song Date: Wed Feb 19 15:47:57 2020 -0800 bpf: Fix a potential deadlock with bpf_map_do_batch Commit 057996380a42 ("bpf: Add batch ops to all htab bpf map") added lookup_and_delete batch operation for hash table. The current implementation has bpf_lru_push_free() inside the bucket lock, which may cause a deadlock. syzbot reports: -> #2 (&htab->buckets[i].lock#2){....}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:159 htab_lru_map_delete_node+0xce/0x2f0 kernel/bpf/hashtab.c:593 __bpf_lru_list_shrink_inactive kernel/bpf/bpf_lru_list.c:220 [inline] __bpf_lru_list_shrink+0xf9/0x470 kernel/bpf/bpf_lru_list.c:266 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:340 [inline] bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline] bpf_lru_pop_free+0x87c/0x1670 kernel/bpf/bpf_lru_list.c:499 prealloc_lru_pop+0x2c/0xa0 kernel/bpf/hashtab.c:132 __htab_lru_percpu_map_update_elem+0x67e/0xa90 kernel/bpf/hashtab.c:1069 bpf_percpu_hash_update+0x16e/0x210 kernel/bpf/hashtab.c:1585 bpf_map_update_value.isra.0+0x2d7/0x8e0 kernel/bpf/syscall.c:181 generic_map_update_batch+0x41f/0x610 kernel/bpf/syscall.c:1319 bpf_map_do_batch+0x3f5/0x510 kernel/bpf/syscall.c:3348 __do_sys_bpf+0x9b7/0x41e0 kernel/bpf/syscall.c:3460 __se_sys_bpf kernel/bpf/syscall.c:3355 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:3355 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (&loc_l->lock){....}: check_prev_add kernel/locking/lockdep.c:2475 [inline] check_prevs_add kernel/locking/lockdep.c:2580 [inline] validate_chain kernel/locking/lockdep.c:2970 [inline] __lock_acquire+0x2596/0x4a00 kernel/locking/lockdep.c:3954 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4484 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:159 bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:516 [inline] bpf_lru_push_free+0x250/0x5b0 kernel/bpf/bpf_lru_list.c:555 __htab_map_lookup_and_delete_batch+0x8d4/0x1540 kernel/bpf/hashtab.c:1374 htab_lru_map_lookup_and_delete_batch+0x34/0x40 kernel/bpf/hashtab.c:1491 bpf_map_do_batch+0x3f5/0x510 kernel/bpf/syscall.c:3348 __do_sys_bpf+0x1f7d/0x41e0 kernel/bpf/syscall.c:3456 __se_sys_bpf kernel/bpf/syscall.c:3355 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:3355 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Possible unsafe locking scenario: CPU0 CPU2 ---- ---- lock(&htab->buckets[i].lock#2); lock(&l->lock); lock(&htab->buckets[i].lock#2); lock(&loc_l->lock); *** DEADLOCK *** To fix the issue, for htab_lru_map_lookup_and_delete_batch() in CPU0, let us do bpf_lru_push_free() out of the htab bucket lock. This can avoid the above deadlock scenario. Fixes: 057996380a42 ("bpf: Add batch ops to all htab bpf map") Reported-by: syzbot+a38ff3d9356388f2fb83@syzkaller.appspotmail.com Reported-by: syzbot+122b5421d14e68f29cd1@syzkaller.appspotmail.com Suggested-by: Hillf Danton Suggested-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Reviewed-by: Jakub Sitnicki Acked-by: Brian Vazquez Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20200219234757.3544014-1-yhs@fb.com commit 492e0d0d6f2eb4badfd2868addf9da0f651eba0e Author: Brian Vazquez Date: Tue Feb 18 09:25:52 2020 -0800 bpf: Do not grab the bucket spinlock by default on htab batch ops Grabbing the spinlock for every bucket even if it's empty, was causing significant perfomance cost when traversing htab maps that have only a few entries. This patch addresses the issue by checking first the bucket_cnt, if the bucket has some entries then we go and grab the spinlock and proceed with the batching. Tested with a htab of size 50K and different value of populated entries. Before: Benchmark Time(ns) CPU(ns) --------------------------------------------- BM_DumpHashMap/1 2759655 2752033 BM_DumpHashMap/10 2933722 2930825 BM_DumpHashMap/200 3171680 3170265 BM_DumpHashMap/500 3639607 3635511 BM_DumpHashMap/1000 4369008 4364981 BM_DumpHashMap/5k 11171919 11134028 BM_DumpHashMap/20k 69150080 69033496 BM_DumpHashMap/39k 190501036 190226162 After: Benchmark Time(ns) CPU(ns) --------------------------------------------- BM_DumpHashMap/1 202707 200109 BM_DumpHashMap/10 213441 210569 BM_DumpHashMap/200 478641 472350 BM_DumpHashMap/500 980061 967102 BM_DumpHashMap/1000 1863835 1839575 BM_DumpHashMap/5k 8961836 8902540 BM_DumpHashMap/20k 69761497 69322756 BM_DumpHashMap/39k 187437830 186551111 Fixes: 057996380a42 ("bpf: Add batch ops to all htab bpf map") Signed-off-by: Brian Vazquez Signed-off-by: Alexei Starovoitov Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200218172552.215077-1-brianvv@google.com commit be886ba90cce2fb2f5a4dbcda8f3be3fd1b2f484 Author: Heidi Fahim Date: Tue Feb 18 14:19:16 2020 -0800 kunit: run kunit_tool from any directory Implemented small fix so that the script changes work directories to the root of the linux kernel source tree from which kunit.py is run. This enables the user to run kunit from any working directory. Originally considered using os.path.join but this is more error prone as we would have to find all file path usages and modify them accordingly. Using os.chdir ensures that the entire script is run within /linux. Signed-off-by: Heidi Fahim Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit dde54b9492a8ba46bcd7e7e26172adf2bfcea817 Author: Heidi Fahim Date: Tue Nov 26 14:36:16 2019 -0800 kunit: test: Improve error messages for kunit_tool when kunitconfig is invalid Previous error message for invalid kunitconfig was vague. Added to it so that it lists invalid fields and prompts for them to be removed. Added validate_config function returning whether or not this kconfig is valid. Signed-off-by: Heidi Fahim Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit ae232e45acf9621f2c96b41ca3af006ac7552c33 Author: Tomi Valkeinen Date: Wed Feb 19 11:46:10 2020 -0800 backlight: add led-backlight driver This patch adds a led-backlight driver (led_bl), which is similar to pwm_bl except the driver uses a LED class driver to adjust the brightness in the HW. Multiple LEDs can be used for a single backlight. Signed-off-by: Tomi Valkeinen Signed-off-by: Jean-Jacques Hiblot Acked-by: Pavel Machek Reviewed-by: Daniel Thompson Acked-by: Lee Jones Acked-by: Tony Lindgren Tested-by: Tony Lindgren Tested-by: Guido Günther Signed-off-by: Pavel Machek Signed-off-by: Tony Lindgren commit 4ca501d6aaf21de31541deac35128bbea8427aa6 Author: Nathan Chancellor Date: Mon Feb 17 13:43:18 2020 -0700 RDMA/core: Fix use of logical OR in get_new_pps Clang warns: ../drivers/infiniband/core/security.c:351:41: warning: converting the enum constant to a boolean [-Wint-in-bool-context] if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) { ^ 1 warning generated. A bitwise OR should have been used instead. Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") Link: https://lore.kernel.org/r/20200217204318.13609-1-natechancellor@gmail.com Link: https://github.com/ClangBuiltLinux/linux/issues/889 Reported-by: Dan Carpenter Signed-off-by: Nathan Chancellor Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit c54d209c78b8a3d0a75e710993833ebe1eb3273b Author: Brett Creeley Date: Tue Feb 18 13:22:06 2020 -0800 ice: Wait for VF to be reset/ready before configuration The configuration/command below is failing when the VF in the xml file is already bound to the host iavf driver. pci_0000_af_0_0.xml:
> virsh attach-device domain_name pci_0000_af_0_0.xml error: Failed to attach device from pci_0000_af_0_0.xml error: Cannot set interface MAC/vlanid to 00:de:ad:00:11:01/0 for ifname ens1f1 vf 0: Device or resource busy This is failing because the VF has not been completely removed/reset after being unbound (via the virsh command above) from the host iavf driver and ice_set_vf_mac() checks if the VF is disabled before waiting for the reset to finish. Fix this by waiting for the VF remove/reset process to happen before checking if the VF is disabled. Also, since many functions for VF administration on the PF were more or less calling the same 3 functions (ice_wait_on_vf_reset(), ice_is_vf_disabled(), and ice_check_vf_init()) move these into the helper function ice_check_vf_ready_for_cfg(). Then call this function in any flow that attempts to configure/query a VF from the PF. Lastly, increase the maximum wait time in ice_wait_on_vf_reset() to 800ms, and modify/add the #define(s) that determine the wait time. This was done for robustness because in rare/stress cases VF removal can take a max of ~800ms and previously the wait was a max of ~300ms. Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 8a55c08d3bbc9ffc9639f69f742e59ebd99f913b Author: Michal Swiatkowski Date: Thu Feb 13 13:31:24 2020 -0800 ice: Don't tell the OS that link is going down Remove code that tell the OS that link is going down when user change flow control via ethtool. When link is up it isn't certain that link goes down after 0x0605 aq command. If link doesn't go down, OS thinks that link is down, but physical link is up. To reset this state user have to take interface down and up. If link goes down after 0x0605 command, FW send information about that and after that driver tells the OS that the link goes down. So this code in ethtool is unnecessary. Signed-off-by: Michal Swiatkowski Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 840f8ad0aaf20044e2fb099095bbce27c02f58da Author: Brett Creeley Date: Thu Feb 13 13:31:23 2020 -0800 ice: Don't reject odd values of usecs set by user Currently if a user sets an odd [tx|rx]-usecs value through ethtool, the request is denied because the hardware is set to have an ITR granularity of 2us. This caused poor customer experience. Fix this by aligning to a register allowed value, which results in rounding down. Also, print a once per ring container type message to be clear about our intentions. Also, change the ITR_TO_REG define to be the bitwise and of the ITR setting and the ICE_ITR_MASK. This makes the purpose of ITR_TO_REG more obvious. Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 242c46c023610dbc0213fc8fb6b71eb836bc5d95 Author: Dragos Tarcatu Date: Fri Feb 7 20:53:25 2020 +0200 ASoC: topology: Fix memleak in soc_tplg_manifest_load() In case of ABI version mismatch, _manifest needs to be freed as it is just a copy of the original topology manifest. However, if a driver manifest handler is defined, that would get executed and the cleanup is never reached. Fix that by getting the return status of manifest() instead of returning directly. Fixes: 583958fa2e52 ("ASoC: topology: Make manifest backward compatible from ABI v4") Signed-off-by: Dragos Tarcatu Link: https://lore.kernel.org/r/20200207185325.22320-3-dragos_tarcatu@mentor.com Signed-off-by: Mark Brown commit 2b2d5c4db732c027a14987cfccf767dac1b45170 Author: Dragos Tarcatu Date: Fri Feb 7 20:53:24 2020 +0200 ASoC: topology: Fix memleak in soc_tplg_link_elems_load() If soc_tplg_link_config() fails, _link needs to be freed in case of topology ABI version mismatch. However the current code is returning directly and ends up leaking memory in this case. This patch fixes that. Fixes: 593d9e52f9bb ("ASoC: topology: Add support to configure existing physical DAI links") Signed-off-by: Dragos Tarcatu Link: https://lore.kernel.org/r/20200207185325.22320-2-dragos_tarcatu@mentor.com Signed-off-by: Mark Brown commit 33c4acbe2f4e8f2866914b1fb90ce74fc7216c21 Author: Madhuparna Bhowmik Date: Wed Feb 19 20:47:46 2020 +0530 bridge: br_stp: Use built-in RCU list checking list_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit c3331d2fe3fd4d5e321f2467d01f72de7edfb5d0 Author: Dmitry Osipenko Date: Wed Feb 19 18:01:22 2020 +0300 nfc: pn544: Fix occasional HW initialization failure The PN544 driver checks the "enable" polarity during of driver's probe and it's doing that by turning ON and OFF NFC with different polarities until enabling succeeds. It takes some time for the hardware to power-down, and thus, to deassert the IRQ that is raised by turning ON the hardware. Since the delay after last power-down of the polarity-checking process is missed in the code, the interrupt may trigger immediately after installing the IRQ handler (right after the checking is done), which results in IRQ handler trying to touch the disabled HW and ends with marking NFC as 'DEAD' during of the driver's probe: pn544_hci_i2c 1-002a: NFC: nfc_en polarity : active high pn544_hci_i2c 1-002a: NFC: invalid len byte shdlc: llc_shdlc_recv_frame: NULL Frame -> link is dead This patch fixes the occasional NFC initialization failure on Nexus 7 device. Signed-off-by: Dmitry Osipenko Signed-off-by: David S. Miller commit 21b5ee59ef18e27d85810584caf1f7ddc705ea83 Author: Kim Phillips Date: Wed Feb 19 18:52:43 2020 +0100 x86/cpu/amd: Enable the fixed Instructions Retired counter IRPERF Commit aaf248848db50 ("perf/x86/msr: Add AMD IRPERF (Instructions Retired) performance counter") added support for access to the free-running counter via 'perf -e msr/irperf/', but when exercised, it always returns a 0 count: BEFORE: $ perf stat -e instructions,msr/irperf/ true Performance counter stats for 'true': 624,833 instructions 0 msr/irperf/ Simply set its enable bit - HWCR bit 30 - to make it start counting. Enablement is restricted to all machines advertising IRPERF capability, except those susceptible to an erratum that makes the IRPERF return bad values. That erratum occurs in Family 17h models 00-1fh [1], but not in F17h models 20h and above [2]. AFTER (on a family 17h model 31h machine): $ perf stat -e instructions,msr/irperf/ true Performance counter stats for 'true': 621,690 instructions 622,490 msr/irperf/ [1] Revision Guide for AMD Family 17h Models 00h-0Fh Processors [2] Revision Guide for AMD Family 17h Models 30h-3Fh Processors The revision guides are available from the bugzilla Link below. [ bp: Massage commit message. ] Fixes: aaf248848db50 ("perf/x86/msr: Add AMD IRPERF (Instructions Retired) performance counter") Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov Cc: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 Link: http://lkml.kernel.org/r/20200214201805.13830-1-kim.phillips@amd.com commit a7a9456e8d28e81030f7cf6f1f59f907089916a9 Author: Amol Grover Date: Wed Feb 19 15:30:11 2020 +0530 net: hsr: Pass lockdep expression to RCU lists node_db is traversed using list_for_each_entry_rcu outside an RCU read-side critical section but under the protection of hsr->list_lock. Hence, add corresponding lockdep expression to silence false-positive warnings, and harden RCU lists. Signed-off-by: Amol Grover Signed-off-by: David S. Miller commit 11479e8e3cd896673a15af21cd0f145a4752f01a Author: Paul Cercueil Date: Tue Feb 11 11:53:37 2020 -0300 MIPS: ingenic: DTS: Fix watchdog nodes The devicetree ABI was broken on purpose by commit 6d532143c915 ("watchdog: jz4740: Use regmap provided by TCU driver"), and commit 1d9c30745455 ("watchdog: jz4740: Use WDT clock provided by TCU driver"). The commit message of the latter explains why the ABI was broken. However, the current devicetree files were not updated to the new ABI described in Documentation/devicetree/bindings/timer/ingenic,tcu.txt, so the watchdog driver would not probe. Fix this problem by updating the watchdog nodes to comply with the new ABI. Fixes: 6d532143c915 ("watchdog: jz4740: Use regmap provided by TCU driver") Signed-off-by: Paul Cercueil Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: Rob Herring Cc: Mark Rutland Cc: Zhou Yanjie Cc: od@zcrc.me Cc: linux-mips@vger.kernel.org Cc: devicetree@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: # v5.5+ commit eb41113870c94dd7e519c69184efc171b7327699 Author: 周琰杰 (Zhou Yanjie) Date: Sun Feb 16 20:10:28 2020 +0800 MIPS: X1000: Fix clock of watchdog node. The devicetree ABI was broken on purpose by commit 6d532143c915 ("watchdog: jz4740: Use regmap provided by TCU driver"), and commit 1d9c30745455 ("watchdog: jz4740: Use WDT clock provided by TCU driver"). The commit message of the latter explains why the ABI was broken. However, the current devicetree files were not updated to the new ABI described in Documentation/devicetree/bindings/timer/ingenic,tcu.txt, so the watchdog driver would not probe. Fix this problem by updating the clock of watchdog node from "&cgu X1000_CLK_RTCLK" to "&tcu TCU_CLK_WDT" to comply with the new ABI. Fixes: 7a16ccd300c2 ("[v8,1/4] MIPS: Ingenic: Add Ingenic X1000 support."). Signed-off-by: 周琰杰 (Zhou Yanjie) Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: devicetree@vger.kernel.org Cc: paul@crapouillou.net Cc: robh+dt@kernel.org Cc: mark.rutland@arm.com Cc: ralf@linux-mips.org Cc: sernia.zhou@foxmail.com Cc: zhenwenjin@gmail.com Cc: dongsheng.qiu@ingenic.com commit 7822dee5d17a02c2b77da60c1cb50089ea64fd9b Merge: 7c8c1697c79d 13a7e459a41a Author: David S. Miller Date: Wed Feb 19 10:31:26 2020 -0800 Merge tag 'mlx5-fixes-2020-02-18' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2020-02-18 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v5.3 ('net/mlx5: Fix sleep while atomic in mlx5_eswitch_get_vepa') For -stable v5.4 ('net/mlx5: DR, Fix matching on vport gvmi') ('net/mlx5e: Fix crash in recovery flow without devlink reporter') For -stable v5.5 ('net/mlx5e: Reset RQ doorbell counter before moving RQ state from RST to RDY') ('net/mlx5e: Don't clear the whole vf config when switching modes') ==================== Signed-off-by: David S. Miller commit 72cf3b3df423c1bbd8fa1056fed009d3a260f8a9 Author: Nathan Chancellor Date: Mon Feb 17 14:11:49 2020 -0700 MIPS: vdso: Wrap -mexplicit-relocs in cc-option Clang does not support this option and errors out: clang-11: error: unknown argument: '-mexplicit-relocs' Clang does not appear to need this flag like GCC does because the jalr check that was added in commit 976c23af3ee5 ("mips: vdso: add build time check that no 'jalr t9' calls left") passes just fine with $ make ARCH=mips CC=clang CROSS_COMPILE=mipsel-linux-gnu- malta_defconfig arch/mips/vdso/ even before commit d3f703c4359f ("mips: vdso: fix 'jalr t9' crash in vdso code"). -mrelax-pic-calls has been supported since clang 9, which is the earliest version that could build a working MIPS kernel, and it is the default for clang so just leave it be. Fixes: d3f703c4359f ("mips: vdso: fix 'jalr t9' crash in vdso code") Link: https://github.com/ClangBuiltLinux/linux/issues/890 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: clang-built-linux@googlegroups.com commit e4103312d7b7afb8a3a7a842a33ef2b1856b2c0f Author: Parav Pandit Date: Wed Feb 12 09:26:29 2020 +0200 Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" This reverts commit 219d2e9dfda9431b808c28d5efc74b404b95b638. The call chain below requires the cm_id_priv's destination address to be setup before performing rdma_bind_addr(). Otherwise source port allocation fails as cma_port_is_unique() no longer sees the correct tuple to allow duplicate users of the source port. rdma_resolve_addr() cma_bind_addr() rdma_bind_addr() cma_get_port() cma_alloc_any_port() cma_port_is_unique() <- compared with zero daddr This can result in false failures to connect, particularly if the source port range is restricted. Fixes: 219d2e9dfda9 ("RDMA/cma: Simplify rdma_resolve_addr() error flow") Link: https://lore.kernel.org/r/20200212072635.682689-4-leon@kernel.org Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 4b205766d8fcb1627429ff31a4b36248b71a0df1 Merge: fa079ba8a98d ab362fffa0fe Author: Linus Torvalds Date: Wed Feb 19 09:34:25 2020 -0800 Merge tag 'iommu-fixes-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Compile warning fix for the Intel IOMMU driver - Fix kdump boot with Intel IOMMU enabled and in passthrough mode - Disable AMD IOMMU on a Laptop/Embedded platform because the delay it introduces in DMA transactions causes screen flickering there with 4k monitors - Make domain_free function in QCOM IOMMU driver robust and not leak memory/dereference NULL pointers - Fix ARM-SMMU module parameter prefix names * tag 'iommu-fixes-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/arm-smmu: Restore naming of driver parameter prefix iommu/qcom: Fix bogus detach logic iommu/amd: Disable IOMMU on Stoney Ridge systems iommu/vt-d: Simplify check in identity_mapping() iommu/vt-d: Remove deferred_attach_domain() iommu/vt-d: Do deferred attachment in iommu_need_mapping() iommu/vt-d: Move deferred device attachment into helper function iommu/vt-d: Add attach_deferred() helper iommu/vt-d: Fix compile warning from intel-svm.h commit fa079ba8a98ddc1101ddec902e95eea40ef1e0dc Merge: 0a44cac81050 385536090b18 Author: Linus Torvalds Date: Wed Feb 19 09:26:59 2020 -0800 Merge tag 'sound-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The only largish change in this pull request is about the revert of the recent max98090 and its relevant patches due to regressions. Other than that, all small fixes for ALSA core (covering KCSAN fuzzer warnings in ALSA sequencer and rawmidi), Intel SOF HD-audio fixes, AMD ACP fixes, usual HD-audio quirks, and various ASoC fixes" * tag 'sound-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs ALSA: hda/realtek - Apply quirk for yet another MSI laptop ASoC: sun8i-codec: Fix setting DAI data format ALSA: hda/realtek - Apply quirk for MSI GP63, too ASoC: amd: ACP needs to be powered off in BIOS. ASoC: hdmi-codec: set plugged_cb to NULL when component removing ASoC: dapm: remove snd_soc_dapm_put_enum_double_locked ASoC: max98090: revert invalid fix for handling SHDN ALSA: rawmidi: Avoid bit fields for state flags ALSA: seq: Fix concurrent access to queue current tick/time ALSA: seq: Avoid concurrent access to queue flags ASoC: codec2codec: avoid invalid/double-free of pcm runtime ASoC: amd: Buffer Size instead of MAX Buffer ASoC: SOF: Intel: hda: move i915 init earlier ASoC: SOF: Intel: hda: fix ordering bug in resume flow ALSA: hda: do not override bus codec_mask in link_get() ASoC: atmel: fix atmel_ssc_set_audio link failure ASoC: fsl_sai: Fix exiting path on probing failure commit 15755854d53b4bbb0bb37a0fce66f0156cfc8a17 Author: Keith Busch Date: Thu Feb 20 00:59:36 2020 +0900 nvme: Fix uninitialized-variable warning gcc may detect a false positive on nvme using an unintialized variable if setting features fails. Since this is not a fast path, explicitly initialize this variable to suppress the warning. Reported-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 2db01da8d25f0420c411e788a9e1ba39269ae37b Author: Julian Wiedmann Date: Tue Feb 11 09:27:38 2020 +0100 s390/qdio: fill SBALEs with absolute addresses sbale->addr holds an absolute address (or for some FCP usage, an opaque request ID), and should only be used with proper virt/phys translation. Signed-off-by: Julian Wiedmann Reviewed-by: Benjamin Block Signed-off-by: Vasily Gorbik commit e9091ffd6a0aaced111b5d6ead5eaab5cd7101bc Author: Julian Wiedmann Date: Mon Feb 10 10:48:11 2020 +0100 s390/qdio: fill SL with absolute addresses As the comment says, sl->sbal holds an absolute address. qeth currently solves this through wild casting, while zfcp doesn't care. Handle this properly in the code that actually builds the SL. Signed-off-by: Julian Wiedmann Reviewed-by: Alexandra Winter Reviewed-by: Steffen Maier [for qdio] Reviewed-by: Benjamin Block Signed-off-by: Vasily Gorbik commit df6d4f9db79c1a5d6f48b59db35ccd1e9ff9adfc Author: H.J. Lu Date: Thu Jan 16 12:46:51 2020 -0800 x86/boot/compressed: Don't declare __force_order in kaslr_64.c GCC 10 changed the default to -fno-common, which leads to LD arch/x86/boot/compressed/vmlinux ld: arch/x86/boot/compressed/pgtable_64.o:(.bss+0x0): multiple definition of `__force_order'; \ arch/x86/boot/compressed/kaslr_64.o:(.bss+0x0): first defined here make[2]: *** [arch/x86/boot/compressed/Makefile:119: arch/x86/boot/compressed/vmlinux] Error 1 Since __force_order is already provided in pgtable_64.c, there is no need to declare __force_order in kaslr_64.c. Signed-off-by: H.J. Lu Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20200124181811.4780-1-hjl.tools@gmail.com commit 6c62ce8073daf27ae3fd03b6929d6cea3887eeb2 Author: Alex Deucher Date: Tue Feb 18 13:20:30 2020 -0500 drm/amdgpu/display: clean up hdcp workqueue handling Use the existence of the workqueue itself to determine when to enable HDCP features rather than sprinkling asic checks all over the code. Also add a check for the existence of the hdcp workqueue in the irq handling on the off chance we get and HPD RX interrupt with the CP bit set. This avoids a crash if the driver doesn't support HDCP for a particular asic. Fixes: 96a3b32e67236f ("drm/amd/display: only enable HDCP for DCN+") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206519 Reviewed-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit debcf83770073f90c9b075134650fdc758ff3033 Author: changzhu Date: Fri Feb 14 10:57:17 2020 +0800 drm/amdgpu: add is_raven_kicker judgement for raven1 The rlc version of raven_kicer_rlc is different from the legacy rlc version of raven_rlc. So it needs to add a judgement function for raven_kicer_rlc and avoid disable GFXOFF when loading raven_kicer_rlc. Signed-off-by: changzhu Reviewed-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 98f7b86a0becc1154b1a6df6e75c9695dfd87e0d Author: Andy Shevchenko Date: Wed Feb 12 12:32:18 2020 +0200 nvme-pci: Use single IRQ vector for old Apple models People reported that old Apple machines are not working properly if the non-first IRQ vector is in use. Set quirk for that models to limit IRQ to use first vector only. Based on original patch by GitHub user npx001. Link: https://github.com/Dunedan/mbp-2016-linux/issues/9 Cc: Benjamin Herrenschmidt Cc: Leif Liddy Signed-off-by: Andy Shevchenko Signed-off-by: Keith Busch commit 1fae37accfc5872af3905d4ba71dc6ab15829be7 Author: Shyjumon N Date: Thu Feb 6 13:17:25 2020 -0700 nvme/pci: Add sleep quirk for Samsung and Toshiba drives The Samsung SSD SM981/PM981 and Toshiba SSD KBG40ZNT256G on the Lenovo C640 platform experience runtime resume issues when the SSDs are kept in sleep/suspend mode for long time. This patch applies the 'Simple Suspend' quirk to these configurations. With this patch, the issue had not been observed in a 1+ day test. Reviewed-by: Jon Derrick Reviewed-by: Christoph Hellwig Signed-off-by: Shyjumon N Signed-off-by: Keith Busch commit d0022c0ef29b78bcbe8a5c5894bd2307143afce1 Author: Will Deacon Date: Wed Feb 19 10:19:13 2020 +0000 arm64: memory: Add missing brackets to untagged_addr() macro Add brackets around the evaluation of the 'addr' parameter to the untagged_addr() macro so that the cast to 'u64' applies to the result of the expression. Cc: Fixes: 597399d0cb91 ("arm64: tags: Preserve tags for addresses translated via TTBR1") Reported-by: Linus Torvalds Signed-off-by: Will Deacon commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e Author: Takashi Iwai Date: Tue Feb 18 12:17:37 2020 +0100 ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output dpcm_show_state() invokes multiple snprintf() calls to concatenate formatted strings on the fixed size buffer. The usage of snprintf() is supposed for avoiding the buffer overflow, but it doesn't work as expected because snprintf() doesn't return the actual output size but the size to be written. Fix this bug by replacing all snprintf() calls with scnprintf() calls. Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM") Signed-off-by: Takashi Iwai Acked-by: Cezary Rojewski Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de Signed-off-by: Mark Brown commit 549cd0ba04dcfe340c349cd983bd440480fae8ee Author: Takashi Iwai Date: Tue Feb 18 12:17:36 2020 +0100 ASoC: intel: skl: Fix possible buffer overflow in debug outputs The debugfs output of intel skl driver writes strings with multiple snprintf() calls with the fixed size. This was supposed to avoid the buffer overflow but actually it still would, because snprintf() returns the expected size to be output, not the actual output size. Fix it by replacing snprintf() calls with scnprintf(). Fixes: d14700a01f91 ("ASoC: Intel: Skylake: Debugfs facility to dump module config") Signed-off-by: Takashi Iwai Acked-by: Cezary Rojewski Link: https://lore.kernel.org/r/20200218111737.14193-3-tiwai@suse.de Signed-off-by: Mark Brown commit 64bbacc5f08c01954890981c63de744df1f29a30 Author: Takashi Iwai Date: Tue Feb 18 12:17:35 2020 +0100 ASoC: intel: skl: Fix pin debug prints skl_print_pins() loops over all given pins but it overwrites the text at the very same position while increasing the returned length. Fix this to show the all pin contents properly. Fixes: d14700a01f91 ("ASoC: Intel: Skylake: Debugfs facility to dump module config") Signed-off-by: Takashi Iwai Acked-by: Cezary Rojewski Link: https://lore.kernel.org/r/20200218111737.14193-2-tiwai@suse.de Signed-off-by: Mark Brown commit 140588bfed2727e9a4814211617a79401d74922f Author: Stephen Kitt Date: Fri Feb 14 18:26:28 2020 +0100 s390: remove obsolete ieee_emulation_warnings s390 math emulation was removed with commit 5a79859ae0f3 ("s390: remove 31 bit support"), rendering ieee_emulation_warnings useless. The code still built because it was protected by CONFIG_MATHEMU, which was no longer selectable. This patch removes the sysctl_ieee_emulation_warnings declaration and the sysctl entry declaration. Link: https://lkml.kernel.org/r/20200214172628.3598516-1-steve@sk2.org Reviewed-by: Vasily Gorbik Signed-off-by: Stephen Kitt Signed-off-by: Vasily Gorbik commit ab362fffa0feb0da23191111e60b641d39130053 Author: Will Deacon Date: Tue Feb 18 17:27:56 2020 +0000 iommu/arm-smmu: Restore naming of driver parameter prefix Extending the Arm SMMU driver to allow for modular builds changed KBUILD_MODNAME to be "arm_smmu_mod" so that a single module could be built from the multiple existing object files without the need to rename any source files. This inadvertently changed the name of the driver parameters, which may lead to runtime issues if bootloaders are relying on the old names for correctness (e.g. "arm-smmu.disable_bypass=0"). Although MODULE_PARAM_PREFIX can be overridden to restore the old naming for builtin parameters, only the new name is matched by modprobe and so loading the driver as a module would cause parameters specified on the kernel command line to be ignored. Instead, rename "arm_smmu_mod" to "arm_smmu". Whilst it's a bit of a bodge, this allows us to create a single module without renaming any files and makes use of the fact that underscores and hyphens can be used interchangeably in parameter names. Cc: Robin Murphy Cc: Russell King Reported-by: Li Yang Fixes: cd221bd24ff5 ("iommu/arm-smmu: Allow building as a module") Signed-off-by: Will Deacon Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel commit faf305c51aeabd1ea2d7131e798ef5f55f4a7750 Author: Robin Murphy Date: Tue Feb 18 18:12:41 2020 +0000 iommu/qcom: Fix bogus detach logic Currently, the implementation of qcom_iommu_domain_free() is guaranteed to do one of two things: WARN() and leak everything, or dereference NULL and crash. That alone is terrible, but in fact the whole idea of trying to track the liveness of a domain via the qcom_domain->iommu pointer as a sanity check is full of fundamentally flawed assumptions. Make things robust and actually functional by not trying to be quite so clever. Reported-by: Brian Masney Tested-by: Brian Masney Reported-by: Naresh Kamboju Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu") Signed-off-by: Robin Murphy Tested-by: Stephan Gerhold Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Joerg Roedel commit 1d7cb11e1090526bc714cda98ca3484c3b30ff76 Author: Kishon Vijay Abraham I Date: Tue Feb 18 17:44:18 2020 +0530 phy: core: Fix phy_get() to not return error on link creation failure commit 987351e1ea77 ("phy: core: Add consumer device link support") added device link support between PHY consumer and PHY provider. However certain peripherals (DWC3 ULPI) have cyclic dependency between the PHY provider and PHY consumer causing the device link creation to fail. Instead of erroring out on failure to create device link, only add a debug print to indicate device link creation failed to get USB working again in multiple platforms. Fixes: 987351e1ea77 ("phy: core: Add consumer device link support") Cc: Alexandre Torgue Signed-off-by: Kishon Vijay Abraham I Reviewed-by: Alexandre TORGUE commit 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 Author: Tony Lindgren Date: Tue Feb 4 07:36:02 2020 -0800 phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval I've noticed that when writing data to the modem the writes can time out at some point eventually. Looks like kicking the modem idle GPIO every 600 ms instead of once a second fixes the issue. Note that this rate is different from our runtime PM autosuspend rate MDM6600_MODEM_IDLE_DELAY_MS that we still want to keep at 1 second, so let's add a separate define for PHY_MDM6600_IDLE_KICK_MS. Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend") Cc: Marcel Partap Cc: Merlijn Wajer Cc: Michael Scott Cc: NeKit Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit 3dfee47b215e49788cfc80e474820ea2e948c031 Author: Kai-Heng Feng Date: Mon Feb 10 15:51:15 2020 +0800 iommu/amd: Disable IOMMU on Stoney Ridge systems Serious screen flickering when Stoney Ridge outputs to a 4K monitor. Use identity-mapping and PCI ATS doesn't help this issue. According to Alex Deucher, IOMMU isn't enabled on Windows, so let's do the same here to avoid screen flickering on 4K monitor. Cc: Alex Deucher Bug: https://gitlab.freedesktop.org/drm/amd/issues/961 Signed-off-by: Kai-Heng Feng Acked-by: Alex Deucher Signed-off-by: Joerg Roedel commit 2d0b1919457ad78036f24169968cadc6f55d37ec Author: Dave Jiang Date: Tue Feb 18 09:51:58 2020 -0700 dmaengine: idxd: correct reserved token calculation The calcuation for limit of reserved token did not take into account the change the user wanted vs the current group reserved token. This causes changing of the reserved token to be possible only after we set the value of the reserved token back to 0. Fix calculation so we can set a value that is non zero for reserved token. Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver") Reported-by: Jerry Chen Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/158204471889.37789.7749177228265869168.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit c37c0ab029569a75fd180edb03d411e7a28a936f Author: Hui Wang Date: Wed Feb 19 13:23:06 2020 +0800 ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 Need to chain the THINKPAD_ACPI, otherwise the mute led will not work. Fixes: d2cd795c4ece ("ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen") Cc: Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20200219052306.24935-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit 8390318c04bb24cc4d41ac03e009b0748882f99f Author: Peter Ujfalusi Date: Fri Feb 14 11:14:41 2020 +0200 dmaengine: ti: k3-udma: Fix terminated transfer handling When we receive back the descriptor of the terminated transfer the cookie must be marked as completed to make sure that the accounting is correct. In udma_tx_status() the status should be marked as completed if the channel is no longer running (it can only happen if the channel is not yet started for the first time, or after a channel termination). Fixes: 25dcb5dd7b7ce ("dmaengine: ti: New driver for K3 UDMA") Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200214091441.27535-7-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit c7450bb211f3ded7cb6e4d305855683ed7d04e60 Author: Peter Ujfalusi Date: Fri Feb 14 11:14:40 2020 +0200 dmaengine: ti: k3-udma: Use the channel direction in pause/resume functions It should be possible to pause, resume and check the pause state of a channel even if we do not have active transfer. udma_is_chan_paused() can trigger NULL pointer reference in it's current form when the status is checked while uc->desc is NULL. Fixes: 25dcb5dd7b7ce ("dmaengine: ti: New driver for K3 UDMA") Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200214091441.27535-6-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 6cf668a4ef829b9a11d74a4954f02a1767403246 Author: Peter Ujfalusi Date: Fri Feb 14 11:14:39 2020 +0200 dmaengine: ti: k3-udma: Use the TR counter helper for slave_sg and cyclic Use the generic TR setup function to get the TR counters for both cyclic and slave_sg transfers. This way the period_size for cyclic and sg_dma_len() for slave_sg can be as large as (SZ_64K - 1) * (SZ_64K - 1) and we can handle cases when the length is >SZ_64K and a prime number. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200214091441.27535-5-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit a97934071fc3b0a5e52c89e06da68bcac0481de3 Author: Peter Ujfalusi Date: Fri Feb 14 11:14:38 2020 +0200 dmaengine: ti: k3-udma: Move the TR counter calculation to helper function Move the TR counter parameter configuration code out from the prep_memcpy callback to a helper function to allow a generic re-usable code for other TR based transfers. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200214091441.27535-4-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 16cd3c670183d788f5a0dfe41415d3386ba92ed9 Author: Peter Ujfalusi Date: Fri Feb 14 11:14:37 2020 +0200 dmaengine: ti: k3-udma: Workaround for RX teardown with stale data in peer When a channel is asked to be stopped (teardown) and we do not have active descriptor to receive stale data buffered on the remote side then the teardown will not complete as UDMA needs a descriptor to be able to flush out the DMA pipe. The peer is trying to push the data to UDMA in teardown, but UDMA is pushing back because it has no descriptor which would allow it to drain the data. The workaround is to create 1K 'trashcan' to receive the discarded data and set up descriptors for packet and TR mode channels. When a channel is stopped and there is no active descriptor then a descriptor is pushed to the ring for UDMA before the teardown is initiated. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200214091441.27535-3-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 1c83767c9d417c4cc45d95f09b3a6e6c6b5417b5 Author: Vignesh Raghavendra Date: Fri Feb 14 11:14:36 2020 +0200 dmaengine: ti: k3-udma: Use ktime/usleep_range based TX completion check In some cases (McSPI for example) the jiffie and delayed_work based workaround can cause big throughput drop. Switch to use ktime/usleep_range based implementation to be able to sustain speed for PDMA based peripherals. Signed-off-by: Vignesh Raghavendra Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200214091441.27535-2-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 13a7e459a41a56d788ab33d825c6205379bbb711 Author: Erez Shitrit Date: Tue Jan 14 09:27:27 2020 +0200 net/mlx5: DR, Handle reformat capability over sw-steering tables On flow table creation, send the relevant flags according to what the FW currently supports. When FW doesn't support reformat option over SW-steering managed table, the driver shouldn't pass this. Fixes: 988fd6b32d07 ("net/mlx5: DR, Pass table flags at creation to lower layer") Signed-off-by: Erez Shitrit Signed-off-by: Saeed Mahameed commit 76781623f009d5615b67f0675230ef90eaa9272a Author: Paul Blakey Date: Tue Dec 31 17:04:15 2019 +0200 net/mlx5: Fix lowest FDB pool size The pool sizes represent the pool sizes in the fw. when we request a pool size from fw, it will return the next possible group. We track how many pools the fw has left and start requesting groups from the big to the small. When we start request 4k group, which doesn't exists in fw, fw wants to allocate the next possible size, 64k, but will fail since its exhausted. The correct smallest pool size in fw is 128 and not 4k. Fixes: 39ac237ce009 ("net/mlx5: E-Switch, Refactor chains and priorities") Signed-off-by: Paul Blakey Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 383de108157c881074f32914b61125e299820bd2 Author: Dmytro Linkin Date: Wed Feb 12 11:32:39 2020 +0200 net/mlx5e: Don't clear the whole vf config when switching modes There is no need to reset all vf config (except link state) between legacy and switchdev modes changes. Also, set link state to AUTO, when legacy enabled. Fixes: 3b83b6c2e024 ("net/mlx5e: Clear VF config when switching modes") Signed-off-by: Dmytro Linkin Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 52d214976d4f64504c1bbb52d47b46a5a3d5ee42 Author: Hamdan Igbaria Date: Wed Feb 5 14:31:12 2020 +0200 net/mlx5: DR, Fix matching on vport gvmi Set vport gvmi in the tag, only when source gvmi is set in the bit mask. Fixes: 26d688e3 ("net/mlx5: DR, Add Steering entry (STE) utilities") Signed-off-by: Hamdan Igbaria Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 1ad6c43c6a7b8627240c6cc19c69e31fedc596a7 Author: Aya Levin Date: Wed Feb 12 15:17:25 2020 +0200 net/mlx5e: Fix crash in recovery flow without devlink reporter When health reporters are not supported, recovery function is invoked directly, not via devlink health reporters. In this direct flow, the recover function input parameter was passed incorrectly and is causing a kernel oops. This patch is fixing the input parameter. Following call trace is observed on rx error health reporting. Internal error: Oops: 96000007 [#1] PREEMPT SMP Process kworker/u16:4 (pid: 4584, stack limit = 0x00000000c9e45703) Call trace: mlx5e_rx_reporter_err_rq_cqe_recover+0x30/0x164 [mlx5_core] mlx5e_health_report+0x60/0x6c [mlx5_core] mlx5e_reporter_rq_cqe_err+0x6c/0x90 [mlx5_core] mlx5e_rq_err_cqe_work+0x20/0x2c [mlx5_core] process_one_work+0x168/0x3d0 worker_thread+0x58/0x3d0 kthread+0x108/0x134 Fixes: c50de4af1d63 ("net/mlx5e: Generalize tx reporter's functionality") Signed-off-by: Aya Levin Signed-off-by: Parav Pandit Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 5ee090ed0da649b1febae2b7c285ac77d1e55a0c Author: Aya Levin Date: Mon Dec 9 14:08:18 2019 +0200 net/mlx5e: Reset RQ doorbell counter before moving RQ state from RST to RDY Initialize RQ doorbell counters to zero prior to moving an RQ from RST to RDY state. Per HW spec, when RQ is back to RDY state, the descriptor ID on the completion is reset. The doorbell record must comply. Fixes: 8276ea1353a4 ("net/mlx5e: Report and recover from CQE with error on RQ") Signed-off-by: Aya Levin Reported-by: Tariq Toukan Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 3d9c5e023a0dbf3e117bb416cfefd9405bf5af0c Author: Huy Nguyen Date: Mon Feb 3 16:32:18 2020 -0600 net/mlx5: Fix sleep while atomic in mlx5_eswitch_get_vepa rtnl_bridge_getlink is protected by rcu lock, so mlx5_eswitch_get_vepa cannot take mutex lock. Two possible issues can happen: 1. User at the same time change vepa mode via RTM_SETLINK command. 2. User at the same time change the switchdev mode via devlink netlink interface. Case 1 cannot happen because rtnl executes one message in order. Case 2 can happen but we do not expect user to change the switchdev mode when changing vepa. Even if a user does it, so he will read a value which is no longer valid. Fixes: 8da202b24913 ("net/mlx5: E-Switch, Add support for VEPA in legacy mode.") Signed-off-by: Huy Nguyen Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 26c4b4758fce8f0ae744335e1762213be29db441 Author: Fabio Estevam Date: Mon Feb 17 16:15:03 2020 -0300 arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY There is only on Ethernet port and one Ethernet PHY on imx8qxp-mek. Remove the unexisting ethphy1 port. This fixes a run-time warning: mdio_bus 5b040000.ethernet-1: MDIO device at address 1 is missing. Fixes: fdea904e85e1 ("arm64: dts: imx: add imx8qxp mek support") Signed-off-by: Fabio Estevam Reviewed-by: Leonard Crestez Signed-off-by: Shawn Guo commit 929a3af90f0f4bd7132d83552c1a98c83f60ef7e Author: Pavel Begunkov Date: Wed Feb 19 00:19:09 2020 +0300 io_uring: fix use-after-free by io_cleanup_req() io_cleanup_req() should be called before req->io is freed, and so shouldn't be after __io_free_req() -> __io_req_aux_free(). Also, it will be ignored for in io_free_req_many(), which use __io_req_aux_free(). Place cleanup_req() into __io_req_aux_free(). Fixes: 99bc4c38537d774 ("io_uring: fix iovec leaks") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 7c8c1697c79d3905965f12cb1408e8c6274ac5c1 Merge: a2cfb96cc365 9a7712048f9d Author: David S. Miller Date: Tue Feb 18 15:44:13 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net This batch contains Netfilter fixes for net: 1) Restrict hashlimit size to 1048576, from Cong Wang. 2) Check for offload flags from nf_flow_table_offload_setup(), this fixes a crash in case the hardware offload is disabled. From Florian Westphal. 3) Three preparation patches to extend the conntrack clash resolution, from Florian. 4) Extend clash resolution to deal with DNS packets from the same flow racing to set up the NAT configuration. 5) Small documentation fix in pipapo, from Stefano Brivio. 6) Remove misleading unlikely() from pipapo_refill(), also from Stefano. 7) Reduce hashlimit mutex scope, from Cong Wang. This patch is actually triggering another problem, still under discussion, another patch to fix this will follow up. ==================== Signed-off-by: David S. Miller commit e75fd33b3f744f644061a4f9662bd63f5434f806 Author: Filipe Manana Date: Thu Feb 13 12:29:50 2020 +0000 Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents In btrfs_wait_ordered_range() once we find an ordered extent that has finished with an error we exit the loop and don't wait for any other ordered extents that might be still in progress. All the users of btrfs_wait_ordered_range() expect that there are no more ordered extents in progress after that function returns. So past fixes such like the ones from the two following commits: ff612ba7849964 ("btrfs: fix panic during relocation after ENOSPC before writeback happens") 28aeeac1dd3080 ("Btrfs: fix panic when starting bg cache writeout after IO error") don't work when there are multiple ordered extents in the range. Fix that by making btrfs_wait_ordered_range() wait for all ordered extents even after it finds one that had an error. Link: https://github.com/kdave/btrfs-progs/issues/228#issuecomment-569777554 CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Qu Wenruo Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b778cf962d71a0e737923d55d0432f3bd287258e Author: Josef Bacik Date: Thu Feb 13 10:47:31 2020 -0500 btrfs: fix bytes_may_use underflow in prealloc error condtition I hit the following warning while running my error injection stress testing: WARNING: CPU: 3 PID: 1453 at fs/btrfs/space-info.h:108 btrfs_free_reserved_data_space_noquota+0xfd/0x160 [btrfs] RIP: 0010:btrfs_free_reserved_data_space_noquota+0xfd/0x160 [btrfs] Call Trace: btrfs_free_reserved_data_space+0x4f/0x70 [btrfs] __btrfs_prealloc_file_range+0x378/0x470 [btrfs] elfcorehdr_read+0x40/0x40 ? elfcorehdr_read+0x40/0x40 ? btrfs_commit_transaction+0xca/0xa50 [btrfs] ? dput+0xb4/0x2a0 ? btrfs_log_dentry_safe+0x55/0x70 [btrfs] ? btrfs_sync_file+0x30e/0x420 [btrfs] ? do_fsync+0x38/0x70 ? __x64_sys_fdatasync+0x13/0x20 ? do_syscall_64+0x5b/0x1b0 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 This happens if we fail to insert our reserved file extent. At this point we've already converted our reservation from ->bytes_may_use to ->bytes_reserved. However once we break we will attempt to free everything from [cur_offset, end] from ->bytes_may_use, but our extent reservation will overlap part of this. Fix this problem by adding ins.offset (our extent allocation size) to cur_offset so we remove the actual remaining part from ->bytes_may_use. I validated this fix using my inject-error.py script python inject-error.py -o should_fail_bio -t cache_save_setup -t \ __btrfs_prealloc_file_range \ -t insert_reserved_file_extent.constprop.0 \ -r "-5" ./run-fsstress.sh where run-fsstress.sh simply mounts and runs fsstress on a disk. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit bd727173e4432fe6cb70ba108dc1f3602c5409d7 Author: Josef Bacik Date: Thu Feb 13 10:47:30 2020 -0500 btrfs: handle logged extent failure properly If we're allocating a logged extent we attempt to insert an extent record for the file extent directly. We increase space_info->bytes_reserved, because the extent entry addition will call btrfs_update_block_group(), which will convert the ->bytes_reserved to ->bytes_used. However if we fail at any point while inserting the extent entry we will bail and leave space on ->bytes_reserved, which will trigger a WARN_ON() on umount. Fix this by pinning the space if we fail to insert, which is what happens in every other failure case that involves adding the extent entry. CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1e90315149f3fe148e114a5de86f0196d1c21fa5 Author: Josef Bacik Date: Thu Feb 13 10:47:29 2020 -0500 btrfs: do not check delayed items are empty for single transaction cleanup btrfs_assert_delayed_root_empty() will check if the delayed root is completely empty, but this is a filesystem-wide check. On cleanup we may have allowed other transactions to begin, for whatever reason, and thus the delayed root is not empty. So remove this check from cleanup_one_transation(). This however can stay in btrfs_cleanup_transaction(), because it checks only after all of the transactions have been properly cleaned up, and thus is valid. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 315bf8ef914f31d51d084af950703aa1e09a728c Author: Josef Bacik Date: Thu Feb 13 10:47:28 2020 -0500 btrfs: reset fs_root to NULL on error in open_ctree While running my error injection script I hit a panic when we tried to clean up the fs_root when freeing the fs_root. This is because fs_info->fs_root == PTR_ERR(-EIO), which isn't great. Fix this by setting fs_info->fs_root = NULL; if we fail to read the root. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Nikolay Borisov Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 81f7eb00ff5bb8326e82503a32809421d14abb8a Author: Jeff Mahoney Date: Tue Feb 11 15:25:37 2020 +0800 btrfs: destroy qgroup extent records on transaction abort We clean up the delayed references when we abort a transaction but we leave the pending qgroup extent records behind, leaking memory. This patch destroys the extent records when we destroy the delayed refs and makes sure ensure they're gone before releasing the transaction. Fixes: 3368d001ba5d ("btrfs: qgroup: Record possible quota-related extent for qgroup.") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Jeff Mahoney [ Rebased to latest upstream, remove to_qgroup() helper, use rbtree_postorder_for_each_entry_safe() wrapper ] Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9eb425b2e04e0e3006adffea5bf5f227a896f128 Author: Christophe Leroy Date: Tue Feb 18 14:09:29 2020 +0000 powerpc/entry: Fix an #if which should be an #ifdef in entry_32.S Fixes: 12c3f1fd87bf ("powerpc/32s: get rid of CPU_FTR_601 feature") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a99fc0ad65b87a1ba51cfa3e0e9034ee294c3e07.1582034961.git.christophe.leroy@c-s.fr commit 0a44cac8105059eb756ed4276e932e54e1ba004d Merge: 2b72104b8c12 75467ee48a5e Author: Linus Torvalds Date: Tue Feb 18 15:06:38 2020 -0800 Merge tag 'dma-mapping-5.6' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - give command line cma= precedence over the CONFIG_ option (Nicolas Saenz Julienne) - always allow 32-bit DMA, even for weirdly placed ZONE_DMA - improve the debug printks when memory is not addressable, to help find problems with swiotlb initialization * tag 'dma-mapping-5.6' of git://git.infradead.org/users/hch/dma-mapping: dma-direct: improve DMA mask overflow reporting dma-direct: improve swiotlb error reporting dma-direct: relax addressability checks in dma_direct_supported dma-contiguous: CMA: give precedence to cmdline commit 2b72104b8c12504176fb5fc1442d6e54e31e338b Merge: 6551d5c56eb0 dc10e4181c05 Author: Linus Torvalds Date: Tue Feb 18 14:54:30 2020 -0800 Merge tag 'tpmdd-next-20200217' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "Two bug fixes" * tag 'tpmdd-next-20200217' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm: Initialize crypto_id of allocated_banks to HASH_ALGO__LAST tpm: Revert tpm_tis_spi_mod.ko to tpm_tis_spi.ko. commit 6551d5c56eb0d02db2274d7a8d26c333deba7fd2 Author: Linus Torvalds Date: Tue Feb 18 10:12:58 2020 -0800 pipe: make sure to wake up everybody when the last reader/writer closes Andrei Vagin reported that commit 0ddad21d3e99 ("pipe: use exclusive waits when reading or writing") broke one of the CRIU tests. He even has a trivial reproducer: #include #include #include int main() { int p[2]; pid_t p1, p2; int status; if (pipe(p) == -1) return 1; p1 = fork(); if (p1 == 0) { close(p[1]); read(p[0], &status, sizeof(status)); return 0; } p2 = fork(); if (p2 == 0) { close(p[1]); read(p[0], &status, sizeof(status)); return 0; } sleep(1); close(p[1]); wait(&status); wait(&status); return 0; } and the problem - once he points it out - is obvious. We use these nice exclusive waits, but when the last writer goes away, it then needs to wake up _every_ reader (and conversely, the last reader disappearing needs to wake every writer, of course). In fact, when going through this, we had several small oddities around how to wake things. We did in fact wake every reader when we changed the size of the pipe buffers. But that's entirely pointless, since that just acts as a possible source of new space - no new data to read. And when we change the size of the buffer, we don't need to wake all writers even when we add space - that case acts just as if somebody made space by reading, and any writer that finds itself not filling it up entirely will wake the next one. On the other hand, on the exit path, we tried to limit the wakeups with the proper poll keys etc, which is entirely pointless, because at that point we obviously need to wake up everybody. So don't do that: just wake up everybody - but only do that if the counts changed to zero. So fix those non-IO wakeups to be more proper: space change doesn't add any new data, but it might make room for writers, so it wakes up a writer. And the actual changes to reader/writer counts should wake up everybody, since everybody is affected (ie readers will all see EOF if the writers have gone away, and writers will all get EPIPE if all readers have gone away). Fixes: 0ddad21d3e99 ("pipe: use exclusive waits when reading or writing") Reported-and-tested-by: Andrei Vagin Cc: Josh Triplett Cc: Matthew Wilcox Signed-off-by: Linus Torvalds commit 9a7712048f9d43da5022e75eca3d6b81080e76d3 Author: Stefano Brivio Date: Fri Feb 14 18:14:14 2020 +0100 netfilter: nft_set_pipapo: Don't abuse unlikely() in pipapo_refill() I originally used unlikely() in the if (match_only) clause, which we hit on the mapping table for the last field in a set, to ensure we avoid branching to the rest of for loop body, which is executed more frequently. However, Pablo reports, this is confusing as it gives the impression that this is not a common case, and it's actually not the intended usage of unlikely(). I couldn't observe any statistical difference in matching rates on x864_64 and aarch64 without it, so just drop it. Reported-by: Pablo Neira Ayuso Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit bd97ad51a7eb1b02049deca56bc26d96cabbac8a Author: Stefano Brivio Date: Fri Feb 14 18:14:13 2020 +0100 netfilter: nft_set_pipapo: Fix mapping table example in comments In both insertion and lookup examples, the two element pointers of rule mapping tables were swapped. Fix that. Reported-by: Pablo Neira Ayuso Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit a2cfb96cc3654c6d451020480a4bcfbbca564350 Author: Madhuparna Bhowmik Date: Wed Feb 19 01:28:20 2020 +0530 flow_table.c: Use built-in RCU list checking hlist_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit 53742e69e85d2eb7ed56f58d277bc3e682f8949e Author: Madhuparna Bhowmik Date: Wed Feb 19 01:28:02 2020 +0530 datapath.c: Use built-in RCU list checking hlist_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit fed48423f14d9fa184b262d7c35d9dc1c3698500 Author: Madhuparna Bhowmik Date: Wed Feb 19 01:27:42 2020 +0530 vport.c: Use built-in RCU list checking hlist_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit 7790614616458b6dd3d90652acfa6b7443ee7041 Author: Madhuparna Bhowmik Date: Wed Feb 19 01:24:25 2020 +0530 meter.c: Use built-in RCU list checking hlist_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit 9facfdb5467382a21fc0bd4211ced26c06f28832 Author: Madhuparna Bhowmik Date: Wed Feb 19 00:11:32 2020 +0530 netlabel_domainhash.c: Use built-in RCU list checking list_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit 8c70c3d72833a08214ff8c8df1f7d9778509888d Author: Madhuparna Bhowmik Date: Tue Feb 18 23:47:18 2020 +0530 net: netlabel: Use built-in RCU list checking list_for_each_entry_rcu() has built-in RCU and lock checking. Pass cond argument to list_for_each_entry_rcu() to silence false lockdep warning when CONFIG_PROVE_RCU_LIST is enabled by default. Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit 379349e9bc3b42b8b2f8f7a03f64a97623fff323 Author: Paolo Abeni Date: Tue Feb 18 18:15:44 2020 +0100 Revert "net: dev: introduce support for sch BYPASS for lockless qdisc" This reverts commit ba27b4cdaaa66561aaedb2101876e563738d36fe Ahmed reported ouf-of-order issues bisected to commit ba27b4cdaaa6 ("net: dev: introduce support for sch BYPASS for lockless qdisc"). I can't find any working solution other than a plain revert. This will introduce some minor performance regressions for pfifo_fast qdisc. I plan to address them in net-next with more indirect call wrapper boilerplate for qdiscs. Reported-by: Ahmad Fatoum Fixes: ba27b4cdaaa6 ("net: dev: introduce support for sch BYPASS for lockless qdisc") Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 29f20dd6258a6f9c434992a0f1fc522caecda7ef Author: Jonathan Neuschäfer Date: Tue Feb 18 16:47:01 2020 +0100 net: phy: broadcom: Fix a typo ("firsly") Signed-off-by: Jonathan Neuschäfer Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 310006cab991fa895cc3a42c53609778b0d50d46 Author: Dan Murphy Date: Tue Feb 18 12:52:52 2020 -0600 ASoC: tas2562: Return invalid for when bitwidth is invalid If the bitwidth passed in to the set_bitwidth function is not supported then return an error. Fixes: 29b74236bd57 ("ASoC: tas2562: Introduce the TAS2562 amplifier") Signed-off-by: Dan Murphy Link: https://lore.kernel.org/r/20200218185252.26290-1-dmurphy@ti.com Signed-off-by: Mark Brown commit bf4498ad3f9a0f7202cf90e52b5ce9bb31700b91 Author: Hugh Dickins Date: Mon Feb 17 20:04:19 2020 -0800 tmpfs: deny and force are not huge mount options 5.6-rc1 commit 2710c957a8ef ("fs_parse: get rid of ->enums") regressed the huge tmpfs mount options to an earlier state: "deny" and "force" are not valid there, and can crash the kernel. Delete those lines. Signed-off-by: Hugh Dickins Signed-off-by: Al Viro commit d99bfed58d9698c0ea1dbf47e4fdf4b87cc7203f Author: Florian Westphal Date: Mon Feb 17 16:54:38 2020 +0100 mptcp: fix bogus socket flag values Dan Carpenter reports static checker warnings due to bogus BIT() usage: net/mptcp/subflow.c:571 subflow_write_space() warn: test_bit() takes a bit number net/mptcp/subflow.c:694 subflow_state_change() warn: test_bit() takes a bit number net/mptcp/protocol.c:261 ssk_check_wmem() warn: test_bit() takes a bit number [..] This is harmless (we use bits 1 & 2 instead of 0 and 1), but would break eventually when adding BIT(5) (or 6, depends on size of 'long'). Just use 0 and 1, the values are only passed to test/set/clear_bit functions. Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path") Reported-by: Dan Carpenter Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit af6565adb02d3129d3fae4d9d5da945abaf4417a Author: Michal Kalderon Date: Mon Feb 17 13:37:18 2020 +0200 qede: Fix race between rdma destroy workqueue and link change event If an event is added while the rdma workqueue is being destroyed it could lead to several races, list corruption, null pointer dereference during queue_work or init_queue. This fixes the race between the two flows which can occur during shutdown. A kref object and a completion object are added to the rdma_dev structure, these are initialized before the workqueue is created. The refcnt is used to indicate work is being added to the workqueue and ensures the cleanup flow won't start while we're in the middle of adding the event. Once the work is added, the refcnt is decreased and the cleanup flow is safe to run. Fixes: cee9fbd8e2e ("qede: Add qedr framework") Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 8b978be8d067f58b29cbbf0579e88bb4a2d4350a Merge: bab5417f5f01 da0f3e0201b8 Author: Greg Kroah-Hartman Date: Tue Feb 18 19:39:29 2020 +0100 Merge tag 'thunderbolt-fix-for-v5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fix for v5.6-rc3 Single fix that orders the THUNDERBOLT MAINTAINERS record according to parse-maintainers.pl. * tag 'thunderbolt-fix-for-v5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: MAINTAINERS: Sort entries in database for THUNDERBOLT commit 6a1ce99dc4bde564e4a072936f9d41f4a439140e Author: Anup Patel Date: Sun Feb 2 16:32:02 2020 +0530 RISC-V: Don't enable all interrupts in trap_init() Historically, we have been enabling all interrupts for each HART in trap_init(). Ideally, we should only enable M-mode interrupts for M-mode kernel and S-mode interrupts for S-mode kernel in trap_init(). Currently, we get suprious S-mode interrupts on Kendryte K210 board running M-mode NO-MMU kernel because we are enabling all interrupts in trap_init(). To fix this, we only enable software and external interrupt in trap_init(). In future, trap_init() will only enable software interrupt and PLIC driver will enable external interrupt using CPU notifiers. Fixes: a4c3733d32a7 ("riscv: abstract out CSR names for supervisor vs machine mode") Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Palmer Dabbelt [QMEU virt machine with SMP] [Palmer: Move the Fixes up to a newer commit] Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt commit 297a31e3e8318f533cff4fe33ffaefb74f72c6e2 Author: Dan Carpenter Date: Mon Feb 17 17:39:45 2020 +0300 io_uring: remove unnecessary NULL checks The "kmsg" pointer can't be NULL and we have already dereferenced it so a check here would be useless. Reviewed-by: Stefano Garzarella Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe commit dd1f6308b28edf0452dd5dc7877992903ec61e69 Author: Vincenzo Frascino Date: Tue Feb 18 16:49:06 2020 +0000 arm64: lse: Fix LSE atomics with LLVM Commit e0d5896bd356 ("arm64: lse: fix LSE atomics with LLVM's integrated assembler") broke the build when clang is used in connjunction with the binutils assembler ("-no-integrated-as"). This happens because __LSE_PREAMBLE is defined as ".arch armv8-a+lse", which overrides the version of the CPU architecture passed via the "-march" paramter to gas: $ aarch64-none-linux-gnu-as -EL -I ./arch/arm64/include -I ./arch/arm64/include/generated -I ./include -I ./include -I ./arch/arm64/include/uapi -I ./arch/arm64/include/generated/uapi -I ./include/uapi -I ./include/generated/uapi -I ./init -I ./init -march=armv8.3-a -o init/do_mounts.o /tmp/do_mounts-d7992a.s /tmp/do_mounts-d7992a.s: Assembler messages: /tmp/do_mounts-d7992a.s:1959: Error: selected processor does not support `autiasp' /tmp/do_mounts-d7992a.s:2021: Error: selected processor does not support `paciasp' /tmp/do_mounts-d7992a.s:2157: Error: selected processor does not support `autiasp' /tmp/do_mounts-d7992a.s:2175: Error: selected processor does not support `paciasp' /tmp/do_mounts-d7992a.s:2494: Error: selected processor does not support `autiasp' Fix the issue by replacing ".arch armv8-a+lse" with ".arch_extension lse". Sami confirms that the clang integrated assembler does now support the '.arch_extension' directive, so this change will be fine even for LTO builds in future. Fixes: e0d5896bd356cd ("arm64: lse: fix LSE atomics with LLVM's integrated assembler") Cc: Catalin Marinas Cc: Will Deacon Reported-by: Amit Kachhap Tested-by: Sami Tolvanen Signed-off-by: Vincenzo Frascino Signed-off-by: Will Deacon commit c68a9032299e837b56d356de9250c93094f7e0e3 Author: Greentime Hu Date: Thu Jan 9 11:17:40 2020 +0800 riscv: set pmp configuration if kernel is running in M-mode When the kernel is running in S-mode, the expectation is that the bootloader or SBI layer will configure the PMP to allow the kernel to access physical memory. But, when the kernel is running in M-mode and is started with the ELF "loader", there's probably no bootloader or SBI layer involved to configure the PMP. Thus, we need to configure the PMP ourselves to enable the kernel to access all regions. Signed-off-by: Greentime Hu Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt commit b103de53e09f20d645eb313477f52d1993347605 Author: Arnaldo Carvalho de Melo Date: Tue Feb 18 10:28:52 2020 -0300 perf arch powerpc: Sync powerpc syscall.tbl with the kernel sources Copy over powerpc syscall.tbl to grab changes from the below commits fddb5d430ad9 ("open: introduce openat2(2) syscall") 9a2cef09c801 ("arch: wire up pidfd_getfd syscall") Now 'perf trace' on powerpc will be able to map from those syscall strings to the right syscall numbers, i.e. perf trace -e pidfd* Will include 'pidfd_getfd' as well as: perf trace open* Will cover all 'open' variants. Reported-by: Stephen Rothwell Reviewed-by: Ravi Bangoria Cc: Adrian Hunter Cc: Aleksa Sarai Cc: Al Viro Cc: Christian Brauner Cc: Jiri Olsa Cc: Namhyung Kim Cc: Naveen N. Rao Cc: Nicholas Piggin Cc: Sargun Dhillon Signed-off-by: Arnaldo Carvalho de Melo commit 1ddb32da4a629fa7f87873d0b6836c2e1feb7518 Author: Joerg Roedel Date: Mon Feb 17 17:29:55 2020 +0100 iommu/vt-d: Simplify check in identity_mapping() The function only has one call-site and there it is never called with dummy or deferred devices. Simplify the check in the function to account for that. Fixes: 1ee0186b9a12 ("iommu/vt-d: Refactor find_domain() helper") Cc: stable@vger.kernel.org # v5.5 Reviewed-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 96d170f3b1a607612caf3618c534d5c64fc2d61b Author: Joerg Roedel Date: Mon Feb 17 17:27:44 2020 +0100 iommu/vt-d: Remove deferred_attach_domain() The function is now only a wrapper around find_domain(). Remove the function and call find_domain() directly at the call-sites. Fixes: 1ee0186b9a12 ("iommu/vt-d: Refactor find_domain() helper") Cc: stable@vger.kernel.org # v5.5 Reviewed-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit a11bfde9c77df1fd350ea27169ab921f511bf5d0 Author: Joerg Roedel Date: Mon Feb 17 17:20:59 2020 +0100 iommu/vt-d: Do deferred attachment in iommu_need_mapping() The attachment of deferred devices needs to happen before the check whether the device is identity mapped or not. Otherwise the check will return wrong results, cause warnings boot failures in kdump kernels, like WARNING: CPU: 0 PID: 318 at ../drivers/iommu/intel-iommu.c:592 domain_get_iommu+0x61/0x70 [...] Call Trace: __intel_map_single+0x55/0x190 intel_alloc_coherent+0xac/0x110 dmam_alloc_attrs+0x50/0xa0 ahci_port_start+0xfb/0x1f0 [libahci] ata_host_start.part.39+0x104/0x1e0 [libata] With the earlier check the kdump boot succeeds and a crashdump is written. Fixes: 1ee0186b9a12 ("iommu/vt-d: Refactor find_domain() helper") Cc: stable@vger.kernel.org # v5.5 Reviewed-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 034d98cc0cdcde2415c6f598fa9125e3eaa02569 Author: Joerg Roedel Date: Mon Feb 17 17:16:19 2020 +0100 iommu/vt-d: Move deferred device attachment into helper function Move the code that does the deferred device attachment into a separate helper function. Fixes: 1ee0186b9a12 ("iommu/vt-d: Refactor find_domain() helper") Cc: stable@vger.kernel.org # v5.5 Reviewed-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 1d4615978f525b769990a4a4ef22fb1b9a04cdf1 Author: Joerg Roedel Date: Mon Feb 17 17:12:37 2020 +0100 iommu/vt-d: Add attach_deferred() helper Implement a helper function to check whether a device's attach process is deferred. Fixes: 1ee0186b9a12 ("iommu/vt-d: Refactor find_domain() helper") Cc: stable@vger.kernel.org # v5.5 Reviewed-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 113e6b7e15e23dc45d5c66eb66bb91a627812e36 Author: Toke Høiland-Jørgensen Date: Mon Feb 17 18:17:01 2020 +0100 libbpf: Sanitise internal map names so they are not rejected by the kernel The kernel only accepts map names with alphanumeric characters, underscores and periods in their name. However, the auto-generated internal map names used by libbpf takes their prefix from the user-supplied BPF object name, which has no such restriction. This can lead to "Invalid argument" errors when trying to load a BPF program using global variables. Fix this by sanitising the map names, replacing any non-allowed characters with underscores. Fixes: d859900c4c56 ("bpf, libbpf: support global data/bss/rodata sections") Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200217171701.215215-1-toke@redhat.com commit f25975f42f2f8f2a01303054d6a70c7ceb1fcf54 Author: Toke Høiland-Jørgensen Date: Tue Feb 18 14:03:34 2020 +0100 bpf, uapi: Remove text about bpf_redirect_map() giving higher performance The performance of bpf_redirect() is now roughly the same as that of bpf_redirect_map(). However, David Ahern pointed out that the header file has not been updated to reflect this, and still says that a significant performance increase is possible when using bpf_redirect_map(). Remove this text from the bpf_redirect_map() description, and reword the description in bpf_redirect() slightly. Also fix the 'Return' section of the bpf_redirect_map() documentation. Fixes: 1d233886dd90 ("xdp: Use bulking for non-map XDP_REDIRECT and consolidate code paths") Reported-by: David Ahern Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Daniel Borkmann Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20200218130334.29889-1-toke@redhat.com commit 4eb1b01de5b9d8596d6c103efcf1a15cfc1bedf7 Author: Hanno Zulla Date: Tue Feb 18 12:39:31 2020 +0100 HID: hid-bigbenff: fix race condition for scheduled work during removal It's possible that there is scheduled work left while the device is already being removed, which can cause a kernel crash. Adding a flag will avoid this. Signed-off-by: Hanno Zulla Signed-off-by: Benjamin Tissoires commit 976a54d0f4202cb412a3b1fc7f117e1d97db35f3 Author: Hanno Zulla Date: Tue Feb 18 12:38:34 2020 +0100 HID: hid-bigbenff: call hid_hw_stop() in case of error It's required to call hid_hw_stop() once hid_hw_start() was called previously, so error cases need to handle this. Also, hid_hw_close() is not necessary during removal. Signed-off-by: Hanno Zulla Signed-off-by: Benjamin Tissoires commit 789a2c250340666220fa74bc6c8f58497e3863b3 Author: Hanno Zulla Date: Tue Feb 18 12:37:47 2020 +0100 HID: hid-bigbenff: fix general protection fault caused by double kfree The struct *bigben was allocated via devm_kzalloc() and then used as a parameter in input_ff_create_memless(). This caused a double kfree during removal of the device, since both the managed resource API and ml_ff_destroy() in drivers/input/ff-memless.c would call kfree() on it. Signed-off-by: Hanno Zulla Signed-off-by: Benjamin Tissoires commit ad60ba0c2e6da6ff573c5ac57708fbc443bbb473 Author: Adrian Hunter Date: Mon Feb 17 10:23:00 2020 +0200 perf auxtrace: Add auxtrace_record__read_finish() All ->read_finish() implementations are doing the same thing. Add a helper function so that they can share the same implementation. Signed-off-by: Adrian Hunter Reviewed-by: Leo Yan Tested-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Jiri Olsa Cc: Kim Phillips Cc: Wei Li Link: http://lore.kernel.org/lkml/20200217082300.6301-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d6bc34c5ec18c3544c4b0d85963768dfbcd24184 Author: Adrian Hunter Date: Fri Feb 14 15:26:53 2020 +0200 perf arm-spe: Fix endless record after being terminated In __cmd_record(), when receiving SIGINT(ctrl + c), a 'done' flag will be set and the event list will be disabled by evlist__disable() once. While in auxtrace_record.read_finish(), the related events will be enabled again, if they are continuous, the recording seems to be endless. If the event is disabled, don't enable it again here. Based-on-patch-by: Wei Li Signed-off-by: Adrian Hunter Cc: Jiri Olsa Cc: Tan Xiaojun Cc: stable@vger.kernel.org # 5.4+ Link: http://lore.kernel.org/lkml/20200214132654.20395-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit c9f2833cb472cf9e0a49b7bcdc210a96017a7bfd Author: Wei Li Date: Fri Feb 14 15:26:52 2020 +0200 perf cs-etm: Fix endless record after being terminated In __cmd_record(), when receiving SIGINT(ctrl + c), a 'done' flag will be set and the event list will be disabled by evlist__disable() once. While in auxtrace_record.read_finish(), the related events will be enabled again, if they are continuous, the recording seems to be endless. If the cs_etm event is disabled, we don't enable it again here. Note: This patch is NOT tested since i don't have such a machine with coresight feature, but the code seems buggy same as arm-spe and intel-pt. Tester notes: Thanks for looping, Adrian. Applied this patch and tested with CoreSight on juno board, it works well. Signed-off-by: Wei Li Reviewed-by: Leo Yan Reviewed-by: Mathieu Poirier Tested-by: Leo Yan Cc: Jiri Olsa Cc: Tan Xiaojun Cc: stable@vger.kernel.org # 5.4+ Link: http://lore.kernel.org/lkml/20200214132654.20395-4-adrian.hunter@intel.com [ahunter: removed redundant 'else' after 'return'] Signed-off-by: Adrian Hunter Signed-off-by: Arnaldo Carvalho de Melo commit 783fed2f35e2a6771c8dc6ee29b8c4b9930783ce Author: Wei Li Date: Fri Feb 14 15:26:51 2020 +0200 perf intel-bts: Fix endless record after being terminated In __cmd_record(), when receiving SIGINT(ctrl + c), a 'done' flag will be set and the event list will be disabled by evlist__disable() once. While in auxtrace_record.read_finish(), the related events will be enabled again, if they are continuous, the recording seems to be endless. If the intel_bts event is disabled, we don't enable it again here. Note: This patch is NOT tested since i don't have such a machine with intel_bts feature, but the code seems buggy same as arm-spe and intel-pt. Signed-off-by: Wei Li Cc: Jiri Olsa Cc: Tan Xiaojun Cc: stable@vger.kernel.org # 5.4+ Link: http://lore.kernel.org/lkml/20200214132654.20395-3-adrian.hunter@intel.com [ahunter: removed redundant 'else' after 'return'] Signed-off-by: Adrian Hunter Signed-off-by: Arnaldo Carvalho de Melo commit 2da4dd3d6973ffdfba4fa07f53240fda7ab22929 Author: Wei Li Date: Fri Feb 14 15:26:50 2020 +0200 perf intel-pt: Fix endless record after being terminated In __cmd_record(), when receiving SIGINT(ctrl + c), a 'done' flag will be set and the event list will be disabled by evlist__disable() once. While in auxtrace_record.read_finish(), the related events will be enabled again, if they are continuous, the recording seems to be endless. If the intel_pt event is disabled, we don't enable it again here. Before the patch: huawei@huawei-2288H-V5:~/linux-5.5-rc4/tools/perf$ ./perf record -e \ intel_pt//u -p 46803 ^C^C^C^C^C^C After the patch: huawei@huawei-2288H-V5:~/linux-5.5-rc4/tools/perf$ ./perf record -e \ intel_pt//u -p 48591 ^C[ perf record: Woken up 0 times to write data ] Warning: AUX data lost 504 times out of 4816! [ perf record: Captured and wrote 2024.405 MB perf.data ] Signed-off-by: Wei Li Cc: Jiri Olsa Cc: Tan Xiaojun Cc: stable@vger.kernel.org # 5.4+ Link: http://lore.kernel.org/lkml/20200214132654.20395-2-adrian.hunter@intel.com [ ahunter: removed redundant 'else' after 'return' ] Signed-off-by: Adrian Hunter Signed-off-by: Arnaldo Carvalho de Melo commit 2bbc83537614517730e9f2811195004b712de207 Author: Thomas Richter Date: Mon Feb 17 11:21:11 2020 +0100 perf test: Fix test trace+probe_vfs_getname.sh on s390 This test places a kprobe to function getname_flags() in the kernel which has the following prototype: struct filename *getname_flags(const char __user *filename, int flags, int *empty) The 'filename' argument points to a filename located in user space memory. Looking at commit 88903c464321c ("tracing/probe: Add ustring type for user-space string") the kprobe should indicate that user space memory is accessed. Output before: [root@m35lp76 perf]# ./perf test 66 67 66: Use vfs_getname probe to get syscall args filenames : FAILED! 67: Check open filename arg using perf trace + vfs_getname: FAILED! [root@m35lp76 perf]# Output after: [root@m35lp76 perf]# ./perf test 66 67 66: Use vfs_getname probe to get syscall args filenames : Ok 67: Check open filename arg using perf trace + vfs_getname: Ok [root@m35lp76 perf]# Comments from Masami Hiramatsu: This bug doesn't happen on x86 or other archs on which user address space and kernel address space is the same. On some arches (ppc64 in this case?) user address space is partially or completely the same as kernel address space. (Yes, they switch the world when running into the kernel) In this case, we need to use different data access functions for each space. That is why I introduced the "ustring" type for kprobe events. As far as I can see, Thomas's patch is sane. Thomas, could you show us your result on your test environment? Comments from Thomas Richter: Test results for s/390 included above. Signed-off-by: Thomas Richter Acked-by: Masami Hiramatsu Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Vasily Gorbik Link: http://lore.kernel.org/lkml/20200217102111.61137-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3b573bf318d894b4290e194c4d7dbcba8c1f6ead Author: Arnaldo Carvalho de Melo Date: Fri Feb 14 16:21:40 2020 -0300 perf bpf: Remove bpf/ subdir from bpf.h headers used to build bpf events The bpf.h file needed gets installed in /usr/lib/include/perf/bpf/bpf.h, and /usr/lib/include/perf/ is added to the include path passed to clang to build the eBPF bytecode, so just remove "bpf/", its directly in the path passed already. This was working by accident, fix it. I.e. now this is back working: # cat /home/acme/git/perf/tools/perf/examples/bpf/hello.c #include int syscall_enter(openat)(void *args) { puts("Hello, world\n"); return 0; } license(GPL); # perf trace -e /home/acme/git/perf/tools/perf/examples/bpf/hello.c 0.000 pickup/21493 __bpf_stdout__(Hello, world) 56.462 sh/13539 __bpf_stdout__(Hello, world) 56.536 sh/13539 __bpf_stdout__(Hello, world) 56.673 sh/13539 __bpf_stdout__(Hello, world) 56.781 sh/13539 __bpf_stdout__(Hello, world) 56.707 perf/13182 __bpf_stdout__(Hello, world) 56.849 perf/13182 __bpf_stdout__(Hello, world) ^C # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-d9myswhgo8gfi3vmehdqpxa7@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5780b9abd530982c2bb1018e2c52c05ab3c30b45 Author: Tianjia Zhang Date: Mon Feb 10 20:44:40 2020 +0800 ima: add sm3 algorithm to hash algorithm configuration list sm3 has been supported by the ima hash algorithm, but it is not yet in the Kconfig configuration list. After adding, both ima and tpm2 can support sm3 well. Signed-off-by: Tianjia Zhang Signed-off-by: Mimi Zohar commit 6a30e1b1dcad0ba94fae757f797812d7d8dcb72c Author: Tianjia Zhang Date: Mon Feb 10 20:44:39 2020 +0800 crypto: rename sm3-256 to sm3 in hash_algo_name The name sm3-256 is defined in hash_algo_name in hash_info, but the algorithm name implemented in sm3_generic.c is sm3, which will cause the sm3-256 algorithm to be not found in some application scenarios of the hash algorithm, and an ENOENT error will occur. For example, IMA, keys, and other subsystems that reference hash_algo_name all use the hash algorithm of sm3. Fixes: 5ca4c20cfd37 ("keys, trusted: select hash algorithm for TPM2 chips") Signed-off-by: Tianjia Zhang Reviewed-by: Pascal van Leeuwen Signed-off-by: Mimi Zohar commit 3be54d558c75562e42bc83d665df024bd79d399b Author: Javier Martinez Canillas Date: Mon Feb 17 12:39:47 2020 +0100 efi: Only print errors about failing to get certs if EFI vars are found If CONFIG_LOAD_UEFI_KEYS is enabled, the kernel attempts to load the certs from the db, dbx and MokListRT EFI variables into the appropriate keyrings. But it just assumes that the variables will be present and prints an error if the certs can't be loaded, even when is possible that the variables may not exist. For example the MokListRT variable will only be present if shim is used. So only print an error message about failing to get the certs list from an EFI variable if this is found. Otherwise these printed errors just pollute the kernel log ring buffer with confusing messages like the following: [ 5.427251] Couldn't get size: 0x800000000000000e [ 5.427261] MODSIGN: Couldn't get UEFI db list [ 5.428012] Couldn't get size: 0x800000000000000e [ 5.428023] Couldn't get UEFI MokListRT Reported-by: Hans de Goede Signed-off-by: Javier Martinez Canillas Tested-by: Hans de Goede Acked-by: Ard Biesheuvel Signed-off-by: Mimi Zohar commit 385536090b18534967b1073d0f18b5b86d793c30 Merge: 44eeb081b863 96781fd941b3 Author: Takashi Iwai Date: Tue Feb 18 13:33:39 2020 +0100 Merge tag 'asoc-fix-v5.6-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.6 A few fixes sent in since the merge window, none of them with global impact but all important for the users they affect. commit 066bc3576e653b615ee3f5230a89d69c8ebeeb71 Author: Oliver O'Halloran Date: Mon Feb 17 15:13:43 2020 +1100 powerpc/xmon: Fix whitespace handling in getstring() The ls (lookup symbol) and zr (reboot) commands use xmon's getstring() helper to read a string argument from the xmon prompt. This function skips over leading whitespace, but doesn't check if the first "non-whitespace" character is a newline which causes some odd behaviour ( indicates a the enter key was pressed): 0:mon> ls printk printk: c0000000001680c4 0:mon> ls printk Symbol ' printk' not found. 0:mon> With commit 2d9b332d99b ("powerpc/xmon: Allow passing an argument to ppc_md.restart()") we have a similar problem with the zr command. Previously zr took no arguments so "zr would trigger a reboot. With that patch applied a second newline needs to be sent in order for the reboot to occur. Fix this by checking if the leading whitespace ended on a newline: 0:mon> ls Symbol '' not found. Fixes: 2d9b332d99b2 ("powerpc/xmon: Allow passing an argument to ppc_md.restart()") Reported-by: Michael Ellerman Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200217041343.2454-1-oohall@gmail.com commit 477f3488a94e35380c82a7498d46f10fa5f3edd2 Author: Christophe Leroy Date: Fri Feb 14 06:53:00 2020 +0000 powerpc/6xx: Fix power_save_ppc32_restore() with CONFIG_VMAP_STACK power_save_ppc32_restore() is called during exception entry, before re-enabling the MMU. It substracts KERNELBASE from the address of nap_save_msscr0 to access it. With CONFIG_VMAP_STACK enabled, data MMU translation has already been re-enabled, so power_save_ppc32_restore() has to access nap_save_msscr0 by its virtual address. Reported-by: Larry Finger Signed-off-by: Christophe Leroy Fixes: cd08f109e262 ("powerpc/32s: Enable CONFIG_VMAP_STACK") Tested-by: Larry Finger Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/7bce32ccbab3ba3e3e0f27da6961bf6313df97ed.1581663140.git.christophe.leroy@c-s.fr commit 5a528eb67908bcf493f3583cb4726fbd8e129605 Author: Christophe Leroy Date: Fri Feb 14 08:39:50 2020 +0000 powerpc/chrp: Fix enter_rtas() with CONFIG_VMAP_STACK With CONFIG_VMAP_STACK, data MMU has to be enabled to read data on the stack. Fixes: cd08f109e262 ("powerpc/32s: Enable CONFIG_VMAP_STACK") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d2330584f8c42d3039896e2b56f5d39676dc919c.1581669558.git.christophe.leroy@c-s.fr commit 232ca1eecafed8c54491017f0612c33d8c742d74 Author: Christophe Leroy Date: Sat Feb 15 10:14:25 2020 +0000 powerpc/32s: Fix DSI and ISI exceptions for CONFIG_VMAP_STACK hash_page() needs to read page tables from kernel memory. When entire kernel memory is mapped by BATs, which is normally the case when CONFIG_STRICT_KERNEL_RWX is not set, it works even if the page hosting the page table is not referenced in the MMU hash table. However, if the page where the page table resides is not covered by a BAT, a DSI fault can be encountered from hash_page(), and it loops forever. This can happen when CONFIG_STRICT_KERNEL_RWX is selected and the alignment of the different regions is too small to allow covering the entire memory with BATs. This also happens when CONFIG_DEBUG_PAGEALLOC is selected or when booting with 'nobats' flag. Also, if the page containing the kernel stack is not present in the MMU hash table, registers cannot be saved and a recursive DSI fault is encountered. To allow hash_page() to properly do its job at all time and load the MMU hash table whenever needed, it must run with data MMU disabled. This means it must be called before re-enabling data MMU. To allow this, registers clobbered by hash_page() and create_hpte() have to be saved in the thread struct together with SRR0, SSR1, DAR and DSISR. It is also necessary to ensure that DSI prolog doesn't overwrite regs saved by prolog of the current running exception. That means: - DSI can only use SPRN_SPRG_SCRATCH0 - Exceptions must free SPRN_SPRG_SCRATCH0 before writing to the stack. This also fixes the Oops reported by Erhard when create_hpte() is called by add_hash_page(). Due to prolog size increase, a few more exceptions had to get split in two parts. Fixes: cd08f109e262 ("powerpc/32s: Enable CONFIG_VMAP_STACK") Reported-by: Erhard F. Signed-off-by: Christophe Leroy Tested-by: Erhard F. Tested-by: Larry Finger Signed-off-by: Michael Ellerman Link: https://bugzilla.kernel.org/show_bug.cgi?id=206501 Link: https://lore.kernel.org/r/64a4aa44686e9fd4b01333401367029771d9b231.1581761633.git.christophe.leroy@c-s.fr commit 2464cc4c345699adea52c7aef75707207cb8a2f6 Author: Gustavo Luiz Duarte Date: Tue Feb 11 00:38:29 2020 -0300 powerpc/tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery After a treclaim, we expect to be in non-transactional state. If we don't clear the current thread's MSR[TS] before we get preempted, then tm_recheckpoint_new_task() will recheckpoint and we get rescheduled in suspended transaction state. When handling a signal caught in transactional state, handle_rt_signal64() calls get_tm_stackpointer() that treclaims the transaction using tm_reclaim_current() but without clearing the thread's MSR[TS]. This can cause the TM Bad Thing exception below if later we pagefault and get preempted trying to access the user's sigframe, using __put_user(). Afterwards, when we are rescheduled back into do_page_fault() (but now in suspended state since the thread's MSR[TS] was not cleared), upon executing 'rfid' after completion of the page fault handling, the exception is raised because a transition from suspended to non-transactional state is invalid. Unexpected TM Bad Thing exception at c00000000000de44 (msr 0x8000000302a03031) tm_scratch=800000010280b033 Oops: Unrecoverable exception, sig: 6 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries CPU: 25 PID: 15547 Comm: a.out Not tainted 5.4.0-rc2 #32 NIP: c00000000000de44 LR: c000000000034728 CTR: 0000000000000000 REGS: c00000003fe7bd70 TRAP: 0700 Not tainted (5.4.0-rc2) MSR: 8000000302a03031 CR: 44000884 XER: 00000000 CFAR: c00000000000dda4 IRQMASK: 0 PACATMSCRATCH: 800000010280b033 GPR00: c000000000034728 c000000f65a17c80 c000000001662800 00007fffacf3fd78 GPR04: 0000000000001000 0000000000001000 0000000000000000 c000000f611f8af0 GPR08: 0000000000000000 0000000078006001 0000000000000000 000c000000000000 GPR12: c000000f611f84b0 c00000003ffcb200 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 c000000f611f8140 GPR24: 0000000000000000 00007fffacf3fd68 c000000f65a17d90 c000000f611f7800 GPR28: c000000f65a17e90 c000000f65a17e90 c000000001685e18 00007fffacf3f000 NIP [c00000000000de44] fast_exception_return+0xf4/0x1b0 LR [c000000000034728] handle_rt_signal64+0x78/0xc50 Call Trace: [c000000f65a17c80] [c000000000034710] handle_rt_signal64+0x60/0xc50 (unreliable) [c000000f65a17d30] [c000000000023640] do_notify_resume+0x330/0x460 [c000000f65a17e20] [c00000000000dcc4] ret_from_except_lite+0x70/0x74 Instruction dump: 7c4ff120 e8410170 7c5a03a6 38400000 f8410060 e8010070 e8410080 e8610088 60000000 60000000 e8810090 e8210078 <4c000024> 48000000 e8610178 88ed0989 ---[ end trace 93094aa44b442f87 ]--- The simplified sequence of events that triggers the above exception is: ... # userspace in NON-TRANSACTIONAL state tbegin # userspace in TRANSACTIONAL state signal delivery # kernelspace in SUSPENDED state handle_rt_signal64() get_tm_stackpointer() treclaim # kernelspace in NON-TRANSACTIONAL state __put_user() page fault happens. We will never get back here because of the TM Bad Thing exception. page fault handling kicks in and we voluntarily preempt ourselves do_page_fault() __schedule() __switch_to(other_task) our task is rescheduled and we recheckpoint because the thread's MSR[TS] was not cleared __switch_to(our_task) switch_to_tm() tm_recheckpoint_new_task() trechkpt # kernelspace in SUSPENDED state The page fault handling resumes, but now we are in suspended transaction state do_page_fault() completes rfid <----- trying to get back where the page fault happened (we were non-transactional back then) TM Bad Thing # illegal transition from suspended to non-transactional This patch fixes that issue by clearing the current thread's MSR[TS] just after treclaim in get_tm_stackpointer() so that we stay in non-transactional state in case we are preempted. In order to make treclaim and clearing the thread's MSR[TS] atomic from a preemption perspective when CONFIG_PREEMPT is set, preempt_disable/enable() is used. It's also necessary to save the previous value of the thread's MSR before get_tm_stackpointer() is called so that it can be exposed to the signal handler later in setup_tm_sigcontexts() to inform the userspace MSR at the moment of the signal delivery. Found with tm-signal-context-force-tm kernel selftest. Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context") Cc: stable@vger.kernel.org # v3.9 Signed-off-by: Gustavo Luiz Duarte Acked-by: Michael Neuling Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200211033831.11165-1-gustavold@linux.ibm.com commit 44eeb081b8630bb3ad3cd381d1ae1831463e48bb Author: Takashi Iwai Date: Tue Feb 18 10:14:09 2020 +0100 ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs Some code in HD-audio driver calls snprintf() in a loop and still expects that the return value were actually written size, while snprintf() returns the expected would-be length instead. When the given buffer limit were small, this leads to a buffer overflow. Use scnprintf() for addressing those issues. It returns the actually written size unlike snprintf(). Cc: Link: https://lore.kernel.org/r/20200218091409.27162-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 839cbf0531428f3f9535077a461b8631359c1165 Author: Bibby Hsieh Date: Mon Feb 17 17:10:19 2020 +0800 drm/mediatek: Make sure previous message done or be aborted before send Mediatek CMDQ driver removed atomic parameter and implementation related to atomic. DRM driver need to make sure previous message done or be aborted before we send next message. If previous message is still waiting for event, it means the setting hasn't been updated into display hardware register, we can abort the message and send next message to update the newest setting into display hardware. If previous message already started, we have to wait it until transmission has been completed. So we flush mbox client before we send new message to controller driver. Signed-off-by: Bibby Hsieh Signed-off-by: CK Hu commit cc5049ae4d457194796f854eb2e38b9727ad8c2d Author: Takashi Iwai Date: Tue Feb 18 09:09:15 2020 +0100 ALSA: hda/realtek - Apply quirk for yet another MSI laptop MSI GP65 laptop with SSID 1462:1293 requires the same quirk as other MSI models. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204159 Cc: Link: https://lore.kernel.org/r/20200218080915.3433-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f Author: Sven Eckelmann Date: Sun Feb 16 13:02:06 2020 +0100 batman-adv: Don't schedule OGM for disabled interface A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined. Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL. Reported-by: syzbot+a98f2016f40b9cd3818a@syzkaller.appspotmail.com Reported-by: syzbot+ac36b6a33c28a491e929@syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann Cc: Hillf Danton Signed-off-by: Simon Wunderlich commit 60fa8c13ab1a33b8b958efb1510ec2fd8a064bcc Author: Bibby Hsieh Date: Mon Feb 17 17:10:20 2020 +0800 drm/mediatek: Move gce event property to mutex device node According mtk hardware design, stream_done0 and stream_done1 are generated by mutex, so we move gce event property to mutex device mode. Signed-off-by: Bibby Hsieh Signed-off-by: CK Hu commit 15de9cb5c9c83a23be92b8f7a1178cead1486587 Author: Chris Wilson Date: Tue Feb 11 12:01:31 2020 +0000 drm/i915/gt: Avoid resetting ring->head outside of its timeline mutex We manipulate ring->head while active in i915_request_retire underneath the timeline manipulation. We cannot rely on a stable ring->head outside of the timeline->mutex, in particular while setting up the context for resume and reset. Closes: https://gitlab.freedesktop.org/drm/intel/issues/1126 Fixes: 0881954965e3 ("drm/i915: Introduce intel_context.pin_mutex for pin management") Fixes: e5dadff4b093 ("drm/i915: Protect request retirement with timeline->mutex") References: f3c0efc9fe7a ("drm/i915/execlists: Leave resetting ring to intel_ring") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: Tvrtko Ursulin Cc: Mika Kuoppala Reviewed-by: Andi Shyti Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200211120131.958949-1-chris@chris-wilson.co.uk (cherry picked from commit 42827350f75c56d0fe9f15d8425a1390528958b6) Signed-off-by: Jani Nikula commit b1339ecac661e1cf3e1dc78ac56bff3aeeaeb92c Author: Chris Wilson Date: Fri Feb 7 21:14:52 2020 +0000 drm/i915/execlists: Always force a context reload when rewinding RING_TAIL If we rewind the RING_TAIL on a context, due to a preemption event, we must force the context restore for the RING_TAIL update to be properly handled. Rather than note which preemption events may cause us to rewind the tail, compare the new request's tail with the previously submitted RING_TAIL, as it turns out that timeslicing was causing unexpected rewinds. -0 0d.s2 1280851190us : __execlists_submission_tasklet: 0000:00:02.0 rcs0: expired last=130:4698, prio=3, hint=3 -0 0d.s2 1280851192us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 66:119966, current 119964 -0 0d.s2 1280851195us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 130:4698, current 4695 -0 0d.s2 1280851198us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 130:4696, current 4695 ^---- Note we unwind 2 requests from the same context -0 0d.s2 1280851208us : __i915_request_submit: 0000:00:02.0 rcs0: fence 130:4696, current 4695 -0 0d.s2 1280851213us : __i915_request_submit: 0000:00:02.0 rcs0: fence 134:1508, current 1506 ^---- But to apply the new timeslice, we have to replay the first request before the new client can start -- the unexpected RING_TAIL rewind -0 0d.s2 1280851219us : trace_ports: 0000:00:02.0 rcs0: submit { 130:4696*, 134:1508 } synmark2-5425 2..s. 1280851239us : process_csb: 0000:00:02.0 rcs0: cs-irq head=5, tail=0 synmark2-5425 2..s. 1280851240us : process_csb: 0000:00:02.0 rcs0: csb[0]: status=0x00008002:0x00000000 ^---- Preemption event for the ELSP update; note the lite-restore synmark2-5425 2..s. 1280851243us : trace_ports: 0000:00:02.0 rcs0: preempted { 130:4698, 66:119966 } synmark2-5425 2..s. 1280851246us : trace_ports: 0000:00:02.0 rcs0: promote { 130:4696*, 134:1508 } synmark2-5425 2.... 1280851462us : __i915_request_commit: 0000:00:02.0 rcs0: fence 130:4700, current 4695 synmark2-5425 2.... 1280852111us : __i915_request_commit: 0000:00:02.0 rcs0: fence 130:4702, current 4695 synmark2-5425 2.Ns1 1280852296us : process_csb: 0000:00:02.0 rcs0: cs-irq head=0, tail=2 synmark2-5425 2.Ns1 1280852297us : process_csb: 0000:00:02.0 rcs0: csb[1]: status=0x00000814:0x00000000 synmark2-5425 2.Ns1 1280852299us : trace_ports: 0000:00:02.0 rcs0: completed { 130:4696!, 134:1508 } synmark2-5425 2.Ns1 1280852301us : process_csb: 0000:00:02.0 rcs0: csb[2]: status=0x00000818:0x00000040 synmark2-5425 2.Ns1 1280852302us : trace_ports: 0000:00:02.0 rcs0: completed { 134:1508, 0:0 } synmark2-5425 2.Ns1 1280852313us : process_csb: process_csb:2336 GEM_BUG_ON(!i915_request_completed(*execlists->active) && !reset_in_progress(execlists)) Fixes: 8ee36e048c98 ("drm/i915/execlists: Minimalistic timeslicing") Referenecs: 82c69bf58650 ("drm/i915/gt: Detect if we miss WaIdleLiteRestore") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Cc: # v5.4+ Link: https://patchwork.freedesktop.org/patch/msgid/20200207211452.2860634-1-chris@chris-wilson.co.uk (cherry picked from commit 5ba32c7be81e53ea8a27190b0f6be98e6c6779af) Signed-off-by: Jani Nikula commit aa3146193ae25d0fe4b96d815169a135db2e8f01 Author: Chris Wilson Date: Sun Feb 2 15:39:34 2020 +0000 drm/i915: Wean off drm_pci_alloc/drm_pci_free drm_pci_alloc and drm_pci_free are just very thin wrappers around dma_alloc_coherent, with a note that we should be removing them. Furthermore since commit de09d31dd38a50fdce106c15abd68432eebbd014 Author: Kirill A. Shutemov Date: Fri Jan 15 16:51:42 2016 -0800 page-flags: define PG_reserved behavior on compound pages As far as I can see there's no users of PG_reserved on compound pages. Let's use PF_NO_COMPOUND here. drm_pci_alloc has been declared broken since it mixes GFP_COMP and SetPageReserved. Avoid this conflict by weaning ourselves off using the abstraction and using the dma functions directly. Reported-by: Taketo Kabe Closes: https://gitlab.freedesktop.org/drm/intel/issues/1027 Fixes: de09d31dd38a ("page-flags: define PG_reserved behavior on compound pages") Signed-off-by: Chris Wilson Cc: # v4.5+ Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200202153934.3899472-1-chris@chris-wilson.co.uk (cherry picked from commit c6790dc22312f592c1434577258b31c48c72d52a) Signed-off-by: Jani Nikula commit c12b59adf21329b97609a9e23519055d6877c7b1 Author: Bibby Hsieh Date: Thu Feb 13 09:23:53 2020 +0800 drm/mediatek: Add fb swap in async_update Besides x, y position, width and height, fb also need updating in async update. Fixes: 920fffcc8912 ("drm/mediatek: update cursors by using async atomic update") Signed-off-by: Bibby Hsieh Tested-by: Enric Balletbo i Serra Signed-off-by: CK Hu commit 551c5f5574759802b2549709b92bfdc7ddf36972 Author: Bibby Hsieh Date: Thu Feb 13 09:23:52 2020 +0800 drm/mediatek: Add plane check in async_check function MTK do rotation checking and transferring in layer check function, but we do not check that in atomic_check, so add back in atomic_check function. Fixes: 920fffcc8912 ("drm/mediatek: update cursors by using async atomic update") Signed-off-by: Bibby Hsieh Signed-off-by: CK Hu commit 9b64208f74fbd0e920475ecfe9326f8443fdc3a5 Author: Hangbin Liu Date: Mon Feb 17 11:43:15 2020 +0800 selftests: forwarding: vxlan_bridge_1d: use more proper tos value 0x11 and 0x12 set the ECN bits based on RFC2474, it would be better to avoid that. 0x14 and 0x18 would be better and works as well. Reported-by: Petr Machata Fixes: 4e867c9a50ff ("selftests: forwarding: vxlan_bridge_1d: fix tos value") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 82969e6ef0430a31d58342009e64c7634512eb53 Author: Alexandre Belloni Date: Fri Feb 14 15:32:24 2020 +0100 net: cnic: fix spelling mistake "reserverd" -> "reserved" The reserved member should be named reserved3. Signed-off-by: Alexandre Belloni Signed-off-by: David S. Miller commit 245709ec8be89af46ea7ef0444c9c80913999d99 Author: Xin Long Date: Tue Feb 18 12:07:53 2020 +0800 sctp: move the format error check out of __sctp_sf_do_9_1_abort When T2 timer is to be stopped, the asoc should also be deleted, otherwise, there will be no chance to call sctp_association_free and the asoc could last in memory forever. However, in sctp_sf_shutdown_sent_abort(), after adding the cmd SCTP_CMD_TIMER_STOP for T2 timer, it may return error due to the format error from __sctp_sf_do_9_1_abort() and miss adding SCTP_CMD_ASSOC_FAILED where the asoc will be deleted. This patch is to fix it by moving the format error check out of __sctp_sf_do_9_1_abort(), and do it before adding the cmd SCTP_CMD_TIMER_STOP for T2 timer. Thanks Hangbin for reporting this issue by the fuzz testing. v1->v2: - improve the comment in the code as Marcelo's suggestion. Fixes: 96ca468b86b0 ("sctp: check invalid value of length parameter in error cause") Reported-by: Hangbin Liu Acked-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 8a9093c79863b58cc2f9874d7ae788f0d622a596 Author: Jason Baron Date: Mon Feb 17 15:38:09 2020 -0500 net: sched: correct flower port blocking tc flower rules that are based on src or dst port blocking are sometimes ineffective due to uninitialized stack data. __skb_flow_dissect() extracts ports from the skb for tc flower to match against. However, the port dissection is not done when when the FLOW_DIS_IS_FRAGMENT bit is set in key_control->flags. All callers of __skb_flow_dissect(), zero-out the key_control field except for fl_classify() as used by the flower classifier. Thus, the FLOW_DIS_IS_FRAGMENT may be set on entry to __skb_flow_dissect(), since key_control is allocated on the stack and may not be initialized. Since key_basic and key_control are present for all flow keys, let's make sure they are initialized. Fixes: 62230715fd24 ("flow_dissector: do not dissect l4 ports for fragments") Co-developed-by: Eric Dumazet Signed-off-by: Eric Dumazet Acked-by: Cong Wang Signed-off-by: Jason Baron Signed-off-by: David S. Miller commit b1da3acc781ce445445d959b41064d209a27bc2d Merge: eaea2947063a 2c2a7552dd64 Author: Linus Torvalds Date: Mon Feb 17 21:08:37 2020 -0800 Merge tag 'ecryptfs-5.6-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs Pull eCryptfs fixes from Tyler Hicks: - downgrade the eCryptfs maintenance status to "Odd Fixes" - change my email address - fix a couple memory leaks in error paths - stability improvement to avoid a needless BUG_ON() * tag 'ecryptfs-5.6-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: ecryptfs: replace BUG_ON with error handling code eCryptfs: Replace deactivated email address MAINTAINERS: eCryptfs: Update maintainer address and downgrade status ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() ecryptfs: fix a memory leak bug in parse_tag_1_packet() commit 0a923a76d615b4f54456ce6c52865bb0d5b5516d Author: Randy Dunlap Date: Sun Feb 16 20:44:09 2020 -0800 Documentation/hwmon: fix xdpe12284 Sphinx warnings Fix Sphinx format warnings by adding a blank line. Documentation/hwmon/xdpe12284.rst:28: WARNING: Unexpected indentation. Documentation/hwmon/xdpe12284.rst:29: WARNING: Block quote ends without a blank line; unexpected unindent. Signed-off-by: Randy Dunlap Cc: Jean Delvare Cc: Guenter Roeck Cc: linux-hwmon@vger.kernel.org Cc: Vadim Pasternak Link: https://lore.kernel.org/r/0094c570-dd4c-dc0e-386d-ea1c39b6a582@infradead.org Signed-off-by: Guenter Roeck commit a81541041ceb55bcec9a8bb8ad3482263f0a205a Author: Horatiu Vultur Date: Mon Feb 17 09:31:33 2020 +0100 net: mscc: fix in frame extraction Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted by reading chuncks of 4 bytes from a register. In case the IFH and frames were read corretly it would try to read the next frame. In case there are no more frames in the queue, it checks if there were any previous errors and in that case clear the queue. But this check will always succeed also when there are no errors. Because when extracting the IFH the error is checked against 4(number of bytes read) and then the error is set only if the extraction of the frame failed. So in a happy case where there are no errors the err variable is still 4. So it could be a case where after the check that there are no more frames in the queue, a frame will arrive in the queue but because the error is not reseted, it would try to flush the queue. So the frame will be lost. The fix consist in resetting the error after reading the IFH. Signed-off-by: Horatiu Vultur Acked-by: Alexandre Belloni Signed-off-by: David S. Miller commit 96781fd941b39e1f78098009344ebcd7af861c67 Author: Samuel Holland Date: Mon Feb 17 00:42:22 2020 -0600 ASoC: sun8i-codec: Fix setting DAI data format Use the correct mask for this two-bit field. This fixes setting the DAI data format to RIGHT_J or DSP_A. Fixes: 36c684936fae ("ASoC: Add sun8i digital audio codec") Signed-off-by: Samuel Holland Acked-by: Chen-Yu Tsai Cc: stable@kernel.org Link: https://lore.kernel.org/r/20200217064250.15516-7-samuel@sholland.org Signed-off-by: Mark Brown commit eaea2947063ac694cddff1787d43e7807490dbc7 Merge: 11a48a5a18c6 52e29e331070 Author: Linus Torvalds Date: Mon Feb 17 13:26:30 2020 -0800 Merge tag 'for-5.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "This is the fix for sleeping in a locked section bug reported by Dave Jones, caused by a patch dependence in development and pulled branches. I picked the existing patch over the fixup that Filipe sent, as it's a bit more generic fix. I've verified it with a specific test case, some rsync stress and one round of fstests" * tag 'for-5.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: don't set path->leave_spinning for truncate commit 19b5f3b419a61808ff2713f1f30b8a88fe14ac9b Author: Chris Wilson Date: Thu Feb 6 20:49:13 2020 +0000 drm/i915/gt: Protect defer_request() from new waiters Mika spotted <4>[17436.705441] general protection fault: 0000 [#1] PREEMPT SMP PTI <4>[17436.705447] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.5.0+ #1 <4>[17436.705449] Hardware name: System manufacturer System Product Name/Z170M-PLUS, BIOS 3805 05/16/2018 <4>[17436.705512] RIP: 0010:__execlists_submission_tasklet+0xc4d/0x16e0 [i915] <4>[17436.705516] Code: c5 4c 8d 60 e0 75 17 e9 8c 07 00 00 49 8b 44 24 20 49 39 c5 4c 8d 60 e0 0f 84 7a 07 00 00 49 8b 5c 24 08 49 8b 87 80 00 00 00 <48> 39 83 d8 fe ff ff 75 d9 48 8b 83 88 fe ff ff a8 01 0f 84 b6 05 <4>[17436.705518] RSP: 0018:ffffc9000012ce80 EFLAGS: 00010083 <4>[17436.705521] RAX: ffff88822ae42000 RBX: 5a5a5a5a5a5a5a5a RCX: dead000000000122 <4>[17436.705523] RDX: ffff88822ae42588 RSI: ffff8881e32a7908 RDI: ffff8881c429fd48 <4>[17436.705525] RBP: ffffc9000012cf00 R08: ffff88822ae42588 R09: 00000000fffffffe <4>[17436.705527] R10: ffff8881c429fb80 R11: 00000000a677cf08 R12: ffff8881c42a0aa8 <4>[17436.705529] R13: ffff8881c429fd38 R14: ffff88822ae42588 R15: ffff8881c429fb80 <4>[17436.705532] FS: 0000000000000000(0000) GS:ffff88822ed00000(0000) knlGS:0000000000000000 <4>[17436.705534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[17436.705536] CR2: 00007f858c76d000 CR3: 0000000005610003 CR4: 00000000003606e0 <4>[17436.705538] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 <4>[17436.705540] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 <4>[17436.705542] Call Trace: <4>[17436.705545] <4>[17436.705603] execlists_submission_tasklet+0xc0/0x130 [i915] which is us consuming a partially initialised new waiter in defer_requests(). We can prevent this by initialising the i915_dependency prior to making it visible, and since we are using a concurrent list_add/iterator mark them up to the compiler. Fixes: 8ee36e048c98 ("drm/i915/execlists: Minimalistic timeslicing") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200206204915.2636606-2-chris@chris-wilson.co.uk (cherry picked from commit f14f27b1663269a81ed62d3961fe70250a1a0623) Signed-off-by: Jani Nikula commit e543e370ec3160c06c2cd897477150dfb23f1afd Author: Chris Wilson Date: Thu Feb 6 20:49:12 2020 +0000 drm/i915/gt: Prevent queuing retire workers on the virtual engine Virtual engines are fleeting. They carry a reference count and may be freed when their last request is retired. This makes them unsuitable for the task of housing engine->retire.work so assert that it is not used. Tvrtko tracked down an instance where we did indeed violate this rule. In virtual_submit_request, we flush a completed request directly with __i915_request_submit and this causes us to queue that request on the veng's breadcrumb list and signal it. Leading us down a path where we should not attach the retire. Reported-by: Tvrtko Ursulin Fixes: dc93c9b69315 ("drm/i915/gt: Schedule request retirement when signaler idles") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200206204915.2636606-1-chris@chris-wilson.co.uk (cherry picked from commit f91d8156ab8afb32447cd2bf3189219bab943f18) Signed-off-by: Jani Nikula commit 2e0a576511f656933adfe56ef03b9cf3e64b21b7 Author: Jani Nikula Date: Thu Feb 13 16:04:11 2020 +0200 drm/i915/dsc: force full modeset whenever DSC is enabled at probe We lack full state readout of DSC config, which may lead to DSC enable using a config that's all zeros, failing spectacularly. Force full modeset and thus compute config at probe to get a sane state, until we implement DSC state readout. Any fastset that did appear to work with DSC at probe, worked by coincidence. [1] is an example of a change that triggered the issue on TGL DSI DSC. [1] http://patchwork.freedesktop.org/patch/msgid/20200212150102.7600-1-ville.syrjala@linux.intel.com Cc: Manasi Navare Cc: Vandita Kulkarni Cc: Ville Syrjala Cc: stable@vger.kernel.org Fixes: fbacb15ea814 ("drm/i915/dsc: add basic hardware state readout support") Acked-by: Matt Roper Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200213140412.32697-3-stanislav.lisovskiy@intel.com (cherry picked from commit a4277aa398d76db109d6b8420934f68daf69a6c3) Signed-off-by: Jani Nikula commit 58e9121c32a245fab47f29ab4ad29dd62470a7e8 Author: Matt Roper Date: Thu Feb 6 16:14:16 2020 -0800 drm/i915/ehl: Update port clock voltage level requirements Voltage level depends not only on the cdclk, but also on the DDI clock. Last time the bspec voltage level table for EHL was updated, we only updated the cdclk requirements, but forgot to account for the new port clock criteria. Bspec: 21809 Fixes: d147483884ed ("drm/i915/ehl: Update voltage level checks") Cc: José Roberto de Souza Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20200207001417.1229251-1-matthew.d.roper@intel.com Reviewed-by: José Roberto de Souza (cherry picked from commit 9d5fd37ed7e26efdbe90f492d7eb8b53dcdb61d6) Signed-off-by: Jani Nikula commit 7ddc7005a0aa2f43a826b71f5d6bd7d4b90f8f2a Author: Jani Nikula Date: Wed Feb 12 18:04:34 2020 +0200 drm/i915: Update drm/i915 bug filing URL We've moved from bugzilla to gitlab. Cc: stable@vger.kernel.org Reviewed-by: Chris Wilson Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200212160434.6437-2-jani.nikula@intel.com (cherry picked from commit ddae4d7af0bbe3b2051f1603459a8b24e9a19324) Signed-off-by: Jani Nikula commit 96228b7df33f8eb9006f8ae96949400aed9bd303 Author: Jani Nikula Date: Wed Feb 12 18:04:33 2020 +0200 MAINTAINERS: Update drm/i915 bug filing URL We've moved from bugzilla to gitlab. Cc: stable@vger.kernel.org Reviewed-by: Chris Wilson Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200212160434.6437-1-jani.nikula@intel.com (cherry picked from commit 3a6a4f0810c8ade6f1ff63c34aa9834176b9d88b) Signed-off-by: Jani Nikula commit dc10e4181c05a2315ddc375e963b7c763b5ee0df Author: Roberto Sassu Date: Mon Feb 10 11:00:41 2020 +0100 tpm: Initialize crypto_id of allocated_banks to HASH_ALGO__LAST chip->allocated_banks, an array of tpm_bank_info structures, contains the list of TPM algorithm IDs of allocated PCR banks. It also contains the corresponding ID of the crypto subsystem, so that users of the TPM driver can calculate a digest for a PCR extend operation. However, if there is no mapping between TPM algorithm ID and crypto ID, the crypto_id field of tpm_bank_info remains set to zero (the array is allocated and initialized with kcalloc() in tpm2_get_pcr_allocation()). Zero should not be used as value for unknown mappings, as it is a valid crypto ID (HASH_ALGO_MD4). Thus, initialize crypto_id to HASH_ALGO__LAST. Cc: stable@vger.kernel.org # 5.1.x Fixes: 879b589210a9 ("tpm: retrieve digest size of unknown algorithms with PCR read") Signed-off-by: Roberto Sassu Reviewed-by: Petr Vorel Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit faaca0a0d48e7b122f6e7e2521f4f6fc487d0451 Author: Jarkko Sakkinen Date: Tue Feb 4 14:16:27 2020 +0200 tpm: Revert tpm_tis_spi_mod.ko to tpm_tis_spi.ko. Revert tpm_tis_spi_mod.ko back to tpm_tis_spi.ko as the rename could break user space scripts. This can be achieved by renaming tpm_tis_spi.c as tpm_tis_spi_main.c. Then tpm_tis_spi-y can be used inside the makefile. Cc: Andrey Pronin Cc: Stephen Boyd Cc: stable@vger.kernel.org # 5.5.x Fixes: 797c0113c9a4 ("tpm: tpm_tis_spi: Support cr50 devices") Reported-by: Alexander Steffen Tested-by: Alexander Steffen Reviewed-by: Stephen Boyd Signed-off-by: Jarkko Sakkinen commit c01e8da2cdb99303547d25b3dbffa3afec56738a Author: Chris Wilson Date: Mon Feb 3 09:41:48 2020 +0000 drm/i915: Initialise basic fence before acquiring seqno Inside the intel_timeline_get_seqno(), we currently track the retirement of the old cachelines by listening to the new request. This requires that the new request is ready to be used and so requires a minimum bit of initialisation prior to getting the new seqno. Fixes: b1e3177bd1d8 ("drm/i915: Coordinate i915_active with its own mutex") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Matthew Auld Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200203094152.4150550-2-chris@chris-wilson.co.uk (cherry picked from commit 855e39e65cfc33a73724f1cc644ffc5754864a20) Signed-off-by: Jani Nikula commit dea8d5ce46d7e7f7270b9804df7d1174f88bfd99 Author: Chris Wilson Date: Thu Jan 30 16:45:53 2020 +0000 drm/i915/gem: Require per-engine reset support for non-persistent contexts To enable non-persistent contexts, we require a means of cancelling any inflight work from that context. This is first done "gracefully" by using preemption to kick the active context off the engine, and then forcefully by resetting the engine if it is active. If we are unable to reset the engine to remove hostile userspace, we should not allow userspace to opt into using non-persistent contexts. If the per-engine reset fails, we still do a full GPU reset, but that is rare and usually indicative of much deeper issues. The damage is already done. However, the goal of the interface to allow long running compute jobs without causing collateral damage elsewhere, and if we are unable to support that we should make that known by not providing the interface (and falsely pretending we can). Fixes: a0e047156cde ("drm/i915/gem: Make context persistence optional") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Jon Bloomfield Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20200130164553.1937718-1-chris@chris-wilson.co.uk (cherry picked from commit d1b9b5f127bc3797fc274cfa4f363e039f045c3a) Signed-off-by: Jani Nikula commit 94e90f727f7424d827256023cace829cad6896f4 Author: Masahiro Yamada Date: Sun Feb 16 23:48:29 2020 +0900 s390: make 'install' not depend on vmlinux For the same reason as commit 19514fc665ff ("arm, kbuild: make "make install" not depend on vmlinux"), the install targets should never trigger the rebuild of the kernel. The variable, CONFIGURE, is not set by anyone. Remove it as well. Link: https://lkml.kernel.org/r/20200216144829.27023-1-masahiroy@kernel.org Signed-off-by: Masahiro Yamada Signed-off-by: Vasily Gorbik commit 788d671517b5c81efbed9310ccbadb8cca86a08e Author: Nathan Chancellor Date: Sat Feb 8 07:10:52 2020 -0700 s390/kaslr: Fix casts in get_random Clang warns: ../arch/s390/boot/kaslr.c:78:25: warning: passing 'char *' to parameter of type 'const u8 *' (aka 'const unsigned char *') converts between pointers to integer types with different sign [-Wpointer-sign] (char *) entropy, (char *) entropy, ^~~~~~~~~~~~~~~~ ../arch/s390/include/asm/cpacf.h:280:28: note: passing argument to parameter 'src' here u8 *dest, const u8 *src, long src_len) ^ 2 warnings generated. Fix the cast to match what else is done in this function. Fixes: b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)") Link: https://github.com/ClangBuiltLinux/linux/issues/862 Link: https://lkml.kernel.org/r/20200208141052.48476-1-natechancellor@gmail.com Signed-off-by: Nathan Chancellor Signed-off-by: Vasily Gorbik commit 380324734956c64cd060e1db4304f3117ac15809 Author: Nathan Chancellor Date: Thu Feb 13 23:42:07 2020 -0700 s390/mm: Explicitly compare PAGE_DEFAULT_KEY against zero in storage_key_init_range Clang warns: In file included from ../arch/s390/purgatory/purgatory.c:10: In file included from ../include/linux/kexec.h:18: In file included from ../include/linux/crash_core.h:6: In file included from ../include/linux/elfcore.h:5: In file included from ../include/linux/user.h:1: In file included from ../arch/s390/include/asm/user.h:11: ../arch/s390/include/asm/page.h:45:6: warning: converting the result of '<<' to a boolean always evaluates to false [-Wtautological-constant-compare] if (PAGE_DEFAULT_KEY) ^ ../arch/s390/include/asm/page.h:23:44: note: expanded from macro 'PAGE_DEFAULT_KEY' #define PAGE_DEFAULT_KEY (PAGE_DEFAULT_ACC << 4) ^ 1 warning generated. Explicitly compare this against zero to silence the warning as it is intended to be used in a boolean context. Fixes: de3fa841e429 ("s390/mm: fix compile for PAGE_DEFAULT_KEY != 0") Link: https://github.com/ClangBuiltLinux/linux/issues/860 Link: https://lkml.kernel.org/r/20200214064207.10381-1-natechancellor@gmail.com Acked-by: Christian Borntraeger Signed-off-by: Nathan Chancellor Signed-off-by: Vasily Gorbik commit 05ccaca003e4f26aceb7f075c073a49159af6e9e Author: Geert Uytterhoeven Date: Wed Feb 12 09:46:22 2020 +0100 s390/pkey/zcrypt: spelling s/crytp/crypt/ Fix typos in a comments. Link: https://lkml.kernel.org/r/20200212084622.9219-1-geert+renesas@glider.be Signed-off-by: Geert Uytterhoeven Signed-off-by: Vasily Gorbik commit 0d730b57b95f7e703bb5789de91a7ece6d3a68ac Author: chenqiwu Date: Fri Feb 14 21:51:33 2020 +0800 s390/cio: use kobj_to_dev() API Use kobj_to_dev() API instead of container_of(). Reviewed-by: Cornelia Huck Signed-off-by: chenqiwu Signed-off-by: chenqiwu Message-Id: <1581688293-17283-1-git-send-email-qiwuchen55@gmail.com> Signed-off-by: Vasily Gorbik commit b16c3724dd717a354d0f0257fd647ef5518982aa Author: Christian Borntraeger Date: Thu Feb 13 11:13:13 2020 -0500 s390/defconfig: enable CONFIG_PROTECTED_VIRTUALIZATION_GUEST The guest support for protected virtualization is default on most distributions. Also refresh defconfig and debug_defconfig. Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit 8b101a5e14f2161869636ff9cb4907b7749dc0c2 Author: Vasily Averin Date: Fri Jan 24 08:48:55 2020 +0300 s390/cio: cio_ignore_proc_seq_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283 Link: https://lore.kernel.org/r/d44c53a7-9bc1-15c7-6d4a-0c10cb9dffce@virtuozzo.com Reviewed-by: Cornelia Huck Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Averin Signed-off-by: Vasily Gorbik commit e20d3a055a457a10a4c748ce5b7c2ed3173a1324 Author: Johannes Krude Date: Wed Feb 12 20:32:27 2020 +0100 bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill This if guards whether user-space wants a copy of the offload-jited bytecode and whether this bytecode exists. By erroneously doing a bitwise AND instead of a logical AND on user- and kernel-space buffer-size can lead to no data being copied to user-space especially when user-space size is a power of two and bigger then the kernel-space buffer. Fixes: fcfb126defda ("bpf: add new jited info fields in bpf_dev_offload and bpf_prog_info") Signed-off-by: Johannes Krude Signed-off-by: Daniel Borkmann Acked-by: Jakub Kicinski Link: https://lore.kernel.org/bpf/20200212193227.GA3769@phlox.h.transitiv.net commit 52e29e331070cd7d52a64cbf1b0958212a340e28 Author: Josef Bacik Date: Fri Jan 17 09:02:20 2020 -0500 btrfs: don't set path->leave_spinning for truncate The only time we actually leave the path spinning is if we're truncating a small amount and don't actually free an extent, which is not a common occurrence. We have to set the path blocking in order to add the delayed ref anyway, so the first extent we find we set the path to blocking and stay blocking for the duration of the operation. With the upcoming file extent map stuff there will be another case that we have to have the path blocking, so just swap to blocking always. Note: this patch also fixes a warning after 28553fa992cb ("Btrfs: fix race between shrinking truncate and fiemap") got merged that inserts extent locks around truncation so the path must not leave spinning locks after btrfs_search_slot. [70.794783] BUG: sleeping function called from invalid context at mm/slab.h:565 [70.794834] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1141, name: rsync [70.794863] 5 locks held by rsync/1141: [70.794876] #0: ffff888417b9c408 (sb_writers#17){.+.+}, at: mnt_want_write+0x20/0x50 [70.795030] #1: ffff888428de28e8 (&type->i_mutex_dir_key#13/1){+.+.}, at: lock_rename+0xf1/0x100 [70.795051] #2: ffff888417b9c608 (sb_internal#2){.+.+}, at: start_transaction+0x394/0x560 [70.795124] #3: ffff888403081768 (btrfs-fs-01){++++}, at: btrfs_try_tree_write_lock+0x2f/0x160 [70.795203] #4: ffff888403086568 (btrfs-fs-00){++++}, at: btrfs_try_tree_write_lock+0x2f/0x160 [70.795222] CPU: 5 PID: 1141 Comm: rsync Not tainted 5.6.0-rc2-backup+ #2 [70.795362] Call Trace: [70.795374] dump_stack+0x71/0xa0 [70.795445] ___might_sleep.part.96.cold.106+0xa6/0xb6 [70.795459] kmem_cache_alloc+0x1d3/0x290 [70.795471] alloc_extent_state+0x22/0x1c0 [70.795544] __clear_extent_bit+0x3ba/0x580 [70.795557] ? _raw_spin_unlock_irq+0x24/0x30 [70.795569] btrfs_truncate_inode_items+0x339/0xe50 [70.795647] btrfs_evict_inode+0x269/0x540 [70.795659] ? dput.part.38+0x29/0x460 [70.795671] evict+0xcd/0x190 [70.795682] __dentry_kill+0xd6/0x180 [70.795754] dput.part.38+0x2ad/0x460 [70.795765] do_renameat2+0x3cb/0x540 [70.795777] __x64_sys_rename+0x1c/0x20 Reported-by: Dave Jones Fixes: 28553fa992cb ("Btrfs: fix race between shrinking truncate and fiemap") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba commit a655e2b107d463ce2745188ce050d07daed09a71 Author: Takashi Iwai Date: Mon Feb 17 16:19:47 2020 +0100 ALSA: hda/realtek - Apply quirk for MSI GP63, too The same quirk that was applied to MSI GL73 is needed for MSI GP63, too. Adding the entry with the SSID 1462:1228. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206503 Cc: Link: https://lore.kernel.org/r/20200217151947.17528-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b3f15ec3d809ccf2e171ca4e272a220d3c1a3e05 Author: Mark Rutland Date: Mon Feb 10 11:47:57 2020 +0000 kvm: arm/arm64: Fold VHE entry/exit work into kvm_vcpu_run_vhe() With VHE, running a vCPU always requires the sequence: 1. kvm_arm_vhe_guest_enter(); 2. kvm_vcpu_run_vhe(); 3. kvm_arm_vhe_guest_exit() ... and as we invoke this from the shared arm/arm64 KVM code, 32-bit arm has to provide stubs for all three functions. To simplify the common code, and make it easier to make further modifications to the arm64-specific portions in the near future, let's fold kvm_arm_vhe_guest_enter() and kvm_arm_vhe_guest_exit() into kvm_vcpu_run_vhe(). The 32-bit stubs for kvm_arm_vhe_guest_enter() and kvm_arm_vhe_guest_exit() are removed, as they are no longer used. The 32-bit stub for kvm_vcpu_run_vhe() is left as-is. There should be no functional change as a result of this patch. Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200210114757.2889-1-mark.rutland@arm.com commit 3bc7b6c15fffdf3f818df31198c8c040ad8f7ea9 Author: Ravulapati Vishnu vardhan rao Date: Mon Feb 17 16:09:19 2020 +0530 ASoC: amd: ACP needs to be powered off in BIOS. Removed this logic because It is BIOS which needs to power off the ACP power domian through ACP_PGFSM_CTRL register when you De-initialize ACP Engine. Signed-off-by: Ravulapati Vishnu vardhan rao Link: https://lore.kernel.org/r/1581935964-15059-1-git-send-email-Vishnuvardhanrao.Ravulapati@amd.com Signed-off-by: Mark Brown commit 4aadf4b49ec7d80c5db842ca28479d07108c9484 Author: Tzung-Bi Shih Date: Mon Feb 17 11:16:52 2020 +0800 ASoC: hdmi-codec: set plugged_cb to NULL when component removing Sets plugged_cb to NULL when component removing to notify its consumers : no further plugged status report is required. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200217105513.1.Icc323daaf71ad02f191fd8d91136b01b61eca5e3@changeid Signed-off-by: Mark Brown commit 44144c809e39d64ff9931c7e8956c42b2baa89e6 Author: Guenter Roeck Date: Sat Feb 8 05:08:03 2020 -0800 watchdog: da9062: Add dependency on I2C Since commit 057b52b4b3d58 ("watchdog: da9062: make restart handler atomic safe"), the driver calls i2c functions directly. It now therefore depends on I2C. This is a hard dependency which overrides COMPILE_TEST. Reported-by: kbuild test robot Reported-by: Randy Dunlap Fixes: 057b52b4b3d58 ("watchdog: da9062: make restart handler atomic safe") Cc: Marco Felsch Cc: Adam Thomson Cc: Stefan Lengfeld Reviewed-by: Marco Felsch Acked-by: Randy Dunlap Acked-by: Geert Uytterhoeven Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8541673d2a5f2faccff345e35991e2f9887779ea Author: Marco Felsch Date: Fri Feb 7 08:15:18 2020 +0100 watchdog: da9062: fix power management ops This fixes commit f6c98b08381c ("watchdog: da9062: add power management ops"). During discussion [1] we agreed that this should be configurable because it is a device quirk if we can't use the hw watchdog auto suspend function. [1] https://lore.kernel.org/linux-watchdog/20191128171931.22563-1-m.felsch@pengutronix.de/ Signed-off-by: Marco Felsch Fixes: f6c98b08381c ("watchdog: da9062: add power management ops") Reviewed-by: Guenter Roeck Reviewed-by: Adam Thomson Link: https://lore.kernel.org/r/20200207071518.5559-1-m.felsch@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e9a0e65eda3f78d0b04ec6136c591c000cbc3b76 Author: Marco Felsch Date: Mon Jan 20 10:17:29 2020 +0100 watchdog: da9062: do not ping the hw during stop() The da9062 hw has a minimum ping cool down phase of at least 200ms. The driver takes that into account by setting the min_hw_heartbeat_ms to 300ms and the core guarantees that the hw limit is observed for the ping() calls. But the core can't guarantee the required minimum ping cool down phase if a stop() command is send immediately after the ping() command. So it is not allowed to ping the watchdog within the stop() command as the driver does. Remove the ping can be done without doubts because the watchdog gets disabled anyway and a (re)start resets the watchdog counter too. Signed-off-by: Marco Felsch Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200120091729.16256-1-m.felsch@pengutronix.de [groeck: Updated description] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 463bfeeead97416ad2b141421f51888054dc0e18 Author: Miaohe Lin Date: Fri Feb 14 10:44:05 2020 +0800 KVM: nVMX: Fix some obsolete comments and grammar error Fix wrong variable names and grammar error in comment. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit d970a325561da5e611596cbb06475db3755ce823 Author: Paolo Bonzini Date: Thu Feb 13 18:22:55 2020 +0100 KVM: x86: fix missing prototypes Reported with "make W=1" due to -Wmissing-prototypes. Reported-by: Qian Cai Reviewed-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 5eee7c625d414fb62985439ed58ab755d8988c76 Author: Randy Dunlap Date: Mon Feb 3 08:10:29 2020 -0800 watchdog: fix mtk_wdt.c RESET_CONTROLLER build error Fix build error when CONFIG_RESET_CONTROLLER is not set by selecting RESET_CONTROLLER. ld: drivers/watchdog/mtk_wdt.o: in function `mtk_wdt_probe': mtk_wdt.c:(.text+0x3ec): undefined reference to `devm_reset_controller_register' Signed-off-by: Randy Dunlap Fixes: c254e103082b74e ("watchdog: mtk_wdt: mt8183: Add reset controller") Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Matthias Brugger Cc: linux-watchdog@vger.kernel.org Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/77c1e557-4941-3806-2933-6c3583576390@infradead.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 74ba569a15a08b988bc059ad515980f51e85be79 Merge: 3da627073b56 cf01514c5c6e Author: Greg Kroah-Hartman Date: Mon Feb 17 11:58:16 2020 +0100 Merge tag 'misc-habanalabs-fixes-2020-02-11' of git://people.freedesktop.org/~gabbayo/linux into char-misc-linus Oded writes: This tag contains the following fixes: - Two fixes to the reset process of the ASIC. Without these fixes, the reset process might take a long time and produce a kernel panic. Alternatively, the ASIC could get stuck. - Fix to reference counting of a command buffer object. It was kref_put one more time than it should have been. * tag 'misc-habanalabs-fixes-2020-02-11' of git://people.freedesktop.org/~gabbayo/linux: habanalabs: patched cb equals user cb in device memset habanalabs: do not halt CoreSight during hard reset habanalabs: halt the engines before hard-reset commit 6a757c07e51f80ac34325fcd558490d2d1439e1b Author: Florian Westphal Date: Mon Feb 3 17:37:07 2020 +0100 netfilter: conntrack: allow insertion of clashing entries This patch further relaxes the need to drop an skb due to a clash with an existing conntrack entry. Current clash resolution handles the case where the clash occurs between two identical entries (distinct nf_conn objects with same tuples), i.e.: Original Reply existing: 10.2.3.4:42 -> 10.8.8.8:53 10.2.3.4:42 <- 10.0.0.6:5353 clashing: 10.2.3.4:42 -> 10.8.8.8:53 10.2.3.4:42 <- 10.0.0.6:5353 ... existing handling will discard the unconfirmed clashing entry and makes skb->_nfct point to the existing one. The skb can then be processed normally just as if the clash would not have existed in the first place. For other clashes, the skb needs to be dropped. This frequently happens with DNS resolvers that send A and AAAA queries back-to-back when NAT rules are present that cause packets to get different DNAT transformations applied, for example: -m statistics --mode random ... -j DNAT --dnat-to 10.0.0.6:5353 -m statistics --mode random ... -j DNAT --dnat-to 10.0.0.7:5353 In this case the A or AAAA query is dropped which incurs a costly delay during name resolution. This patch also allows this collision type: Original Reply existing: 10.2.3.4:42 -> 10.8.8.8:53 10.2.3.4:42 <- 10.0.0.6:5353 clashing: 10.2.3.4:42 -> 10.8.8.8:53 10.2.3.4:42 <- 10.0.0.7:5353 In this case, clash is in original direction -- the reply direction is still unique. The change makes it so that when the 2nd colliding packet is received, the clashing conntrack is tagged with new IPS_NAT_CLASH_BIT, gets a fixed 1 second timeout and is inserted in the reply direction only. The entry is hidden from 'conntrack -L', it will time out quickly and it can be early dropped because it will never progress to the ASSURED state. To avoid special-casing the delete code path to special case the ORIGINAL hlist_nulls node, a new helper, "hlist_nulls_add_fake", is added so hlist_nulls_del() will work. Example: CPU A: CPU B: 1. 10.2.3.4:42 -> 10.8.8.8:53 (A) 2. 10.2.3.4:42 -> 10.8.8.8:53 (AAAA) 3. Apply DNAT, reply changed to 10.0.0.6 4. 10.2.3.4:42 -> 10.8.8.8:53 (AAAA) 5. Apply DNAT, reply changed to 10.0.0.7 6. confirm/commit to conntrack table, no collisions 7. commit clashing entry Reply comes in: 10.2.3.4:42 <- 10.0.0.6:5353 (A) -> Finds a conntrack, DNAT is reversed & packet forwarded to 10.2.3.4:42 10.2.3.4:42 <- 10.0.0.7:5353 (AAAA) -> Finds a conntrack, DNAT is reversed & packet forwarded to 10.2.3.4:42 The conntrack entry is deleted from table, as it has the NAT_CLASH bit set. In case of a retransmit from ORIGINAL dir, all further packets will get the DNAT transformation to 10.0.0.6. I tried to come up with other solutions but they all have worse problems. Alternatives considered were: 1. Confirm ct entries at allocation time, not in postrouting. a. will cause uneccesarry work when the skb that creates the conntrack is dropped by ruleset. b. in case nat is applied, ct entry would need to be moved in the table, which requires another spinlock pair to be taken. c. breaks the 'unconfirmed entry is private to cpu' assumption: we would need to guard all nfct->ext allocation requests with ct->lock spinlock. 2. Make the unconfirmed list a hash table instead of a pcpu list. Shares drawback c) of the first alternative. 3. Document this is expected and force users to rearrange their ruleset (e.g. by using "-m cluster" instead of "-m statistics"). nft has the 'jhash' expression which can be used instead of 'numgen'. Major drawback: doesn't fix what I consider a bug, not very realistic and I believe its reasonable to have the existing rulesets to 'just work'. 4. Document this is expected and force users to steer problematic packets to the same CPU -- this would serialize the "allocate new conntrack entry/nat table evaluation/perform nat/confirm entry", so no race can occur. Similar drawback to 3. Another advantage of this patch compared to 1) and 2) is that there are no changes to the hot path; things are handled in the udp tracker and the clash resolution path. Cc: rcu@vger.kernel.org Cc: "Paul E. McKenney" Cc: Josh Triplett Cc: Jozsef Kadlecsik Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bab5417f5f0118ce914bc5b2f8381e959e891155 Author: Greg Kroah-Hartman Date: Fri Feb 14 08:11:48 2020 -0800 USB: misc: iowarrior: add support for the 100 device Add a new device id for the 100 devie. It has 4 interfaces like the 28 and 28L devices but a larger endpoint so more I/O pins. Cc: Christoph Jung Cc: stable Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20200214161148.GA3963518@kroah.com Signed-off-by: Greg Kroah-Hartman commit f287d3d19769b1d22cba4e51fa0487f2697713c9 Author: Lyude Paul Date: Wed Feb 12 18:11:49 2020 -0500 drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets While certain modeset operations on gv100+ need us to temporarily disable the LUT, we make the mistake of sometimes neglecting to reprogram the LUT after such modesets. In particular, moving a head from one encoder to another seems to trigger this quite often. GV100+ is very picky about having a LUT in most scenarios, so this causes the display engine to hang with the following error code: disp: chid 1 stat 00005080 reason 5 [INVALID_STATE] mthd 0200 data 00000001 code 0000002d) So, fix this by always re-programming the LUT if we're clearing it in a state where the wndw is still visible, and has a XLUT handle programmed. Signed-off-by: Lyude Paul Fixes: facaed62b4cb ("drm/nouveau/kms/gv100: initial support") Cc: # v4.18+ Signed-off-by: Ben Skeggs commit b99ef12b80cfe48a14e7918c2f799c37d2195aca Author: Ben Skeggs Date: Wed Jan 15 06:34:22 2020 +1000 drm/nouveau/gr/tu11x: initial support Signed-off-by: Ben Skeggs commit 072663f86d62571fe540d9e1d24eb873a1b1182f Author: Ben Skeggs Date: Wed Jan 15 06:34:22 2020 +1000 drm/nouveau/acr/tu11x: initial support Signed-off-by: Ben Skeggs commit 5eb40257047fb11085d582b7b9ccd0bffe900726 Author: Anson Huang Date: Mon Feb 17 11:01:35 2020 +0800 clk: imx8mn: Fix incorrect clock defines IMX8MN_CLK_I2C4 and IMX8MN_CLK_UART1's index definitions are incorrect, fix them. Fixes: 1e80936a42e1 ("dt-bindings: imx: Add clock binding doc for i.MX8MN") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit bcbf53a0dab50980867476994f6079c1ec5bb3a3 Author: Johan Hovold Date: Wed Feb 12 11:46:29 2020 +0100 ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties The sram-node compatible properties have mistakingly combined the model-specific string with the generic "mtd-ram" string. Note that neither "cy7c1019dv33-10zsxi, mtd-ram" or "cy7c1019dv33-10zsxi" are used by any in-kernel driver and they are not present in any binding. The physmap driver will however bind to platform devices that specify "mtd-ram". Fixes: fc48e76489fd ("ARM: dts: imx6: Add support for Toradex Colibri iMX6 module") Cc: Sanchayan Maity Cc: Marcel Ziswiler Cc: Shawn Guo Signed-off-by: Johan Hovold Reviewed-by: Oleksandr Suvorov Signed-off-by: Shawn Guo commit 9a6a0dea16177ccaecc116f560232e63bec115f1 Author: Paul Cercueil Date: Sun Feb 16 16:39:43 2020 -0300 net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt() The call to of_get_mac_address() can return -EPROBE_DEFER, for instance when the MAC address is read from a NVMEM driver that did not probe yet. Cc: H. Nikolaus Schaller Cc: Mathieu Malaterre Signed-off-by: Paul Cercueil Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit d2f273f0a9205257b91af1d3d461ee29688c2f24 Author: Randy Dunlap Date: Sat Feb 15 15:34:07 2020 -0800 skbuff.h: fix all kernel-doc warnings Fix all kernel-doc warnings in . Fixes these warnings: ../include/linux/skbuff.h:890: warning: Function parameter or member 'list' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'dev_scratch' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'ip_defrag_offset' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'skb_mstamp_ns' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member '__cloned_offset' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'head_frag' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member '__pkt_type_offset' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'encapsulation' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'encap_hdr_csum' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'csum_valid' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member '__pkt_vlan_present_offset' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'vlan_present' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'csum_complete_sw' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'csum_level' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'inner_protocol_type' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'remcsum_offload' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'sender_cpu' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'reserved_tailroom' not described in 'sk_buff' ../include/linux/skbuff.h:890: warning: Function parameter or member 'inner_ipproto' not described in 'sk_buff' Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 8955b4357d6fc98734b53855b76ee37014a7e492 Author: Randy Dunlap Date: Sat Feb 15 13:41:12 2020 -0800 skbuff: remove stale bit mask comments Remove stale comments since this flag is no longer a bit mask but is a bit field. Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 66256e0b15bd72e1e1c24c4cef4281a95636781c Author: Randy Dunlap Date: Sat Feb 15 11:42:37 2020 -0800 net/sock.h: fix all kernel-doc warnings Fix all kernel-doc warnings for . Fixes these warnings: ../include/net/sock.h:232: warning: Function parameter or member 'skc_addrpair' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_portpair' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_ipv6only' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_net_refcnt' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_v6_daddr' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_v6_rcv_saddr' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_cookie' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_listener' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_tw_dr' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_rcv_wnd' not described in 'sock_common' ../include/net/sock.h:232: warning: Function parameter or member 'skc_tw_rcv_nxt' not described in 'sock_common' ../include/net/sock.h:498: warning: Function parameter or member 'sk_rx_skb_cache' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'sk_wq_raw' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'tcp_rtx_queue' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'sk_tx_skb_cache' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'sk_route_forced_caps' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'sk_txtime_report_errors' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'sk_validate_xmit_skb' not described in 'sock' ../include/net/sock.h:498: warning: Function parameter or member 'sk_bpf_storage' not described in 'sock' ../include/net/sock.h:2024: warning: No description found for return value of 'sk_wmem_alloc_get' ../include/net/sock.h:2035: warning: No description found for return value of 'sk_rmem_alloc_get' ../include/net/sock.h:2046: warning: No description found for return value of 'sk_has_allocations' ../include/net/sock.h:2082: warning: No description found for return value of 'skwq_has_sleeper' ../include/net/sock.h:2244: warning: No description found for return value of 'sk_page_frag' ../include/net/sock.h:2444: warning: Function parameter or member 'tcp_rx_skb_cache_key' not described in 'DECLARE_STATIC_KEY_FALSE' ../include/net/sock.h:2444: warning: Excess function parameter 'sk' description in 'DECLARE_STATIC_KEY_FALSE' ../include/net/sock.h:2444: warning: Excess function parameter 'skb' description in 'DECLARE_STATIC_KEY_FALSE' Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 58292104832fef6cb4a89f736012c0e0724c3442 Author: Marek Vasut Date: Sat Feb 15 17:54:19 2020 +0100 net: ks8851-ml: Fix 16-bit IO operation The Micrel KSZ8851-16MLLI datasheet DS00002357B page 12 states that BE[3:0] signals are active high. This contradicts the measurements of the behavior of the actual chip, where these signals behave as active low. For example, to read the CIDER register, the bus must expose 0xc0c0 during the address phase, which means BE[3:0]=4'b1100. Signed-off-by: Marek Vasut Cc: David S. Miller Cc: Lukas Wunner Cc: Petr Stetiar Cc: YueHaibing Signed-off-by: David S. Miller commit edacb098ea9c31589276152f09b4439052c0f2b1 Author: Marek Vasut Date: Sat Feb 15 17:54:18 2020 +0100 net: ks8851-ml: Fix 16-bit data access The packet data written to and read from Micrel KSZ8851-16MLLI must be byte-swapped in 16-bit mode, add this byte-swapping. Signed-off-by: Marek Vasut Cc: David S. Miller Cc: Lukas Wunner Cc: Petr Stetiar Cc: YueHaibing Signed-off-by: David S. Miller commit 69233bba6543a37755158ca3382765387b8078df Author: Marek Vasut Date: Sat Feb 15 17:54:17 2020 +0100 net: ks8851-ml: Remove 8-bit bus accessors This driver is mixing 8-bit and 16-bit bus accessors for reasons unknown, however the speculation is that this was some sort of attempt to support the 8-bit bus mode. As per the KS8851-16MLL documentation, all two registers accessed via the 8-bit accessors are internally 16-bit registers, so reading them using 16-bit accessors is fine. The KS_CCR read can be converted to 16-bit read outright, as it is already a concatenation of two 8-bit reads of that register. The KS_RXQCR accesses are 8-bit only, however writing the top 8 bits of the register is OK as well, since the driver caches the entire 16-bit register value anyway. Finally, the driver is not used by any hardware in the kernel right now. The only hardware available to me is one with 16-bit bus, so I have no way to test the 8-bit bus mode, however it is unlikely this ever really worked anyway. If the 8-bit bus mode is ever required, it can be easily added by adjusting the 16-bit accessors to do 2 consecutive accesses, which is how this should have been done from the beginning. Signed-off-by: Marek Vasut Cc: David S. Miller Cc: Lukas Wunner Cc: Petr Stetiar Cc: YueHaibing Signed-off-by: David S. Miller commit 357b41caf949c57e426f1c5f18574b6b46583406 Author: Matthieu Baerts Date: Sat Feb 15 15:45:56 2020 +0100 mptcp: select CRYPTO Without this modification and if CRYPTO is not selected, we have this warning: WARNING: unmet direct dependencies detected for CRYPTO_LIB_SHA256 Depends on [n]: CRYPTO [=n] Selected by [y]: - MPTCP [=y] && NET [=y] && INET [=y] MPTCP selects CRYPTO_LIB_SHA256 which seems to depend on CRYPTO. CRYPTO is now selected to avoid this issue. Even though the config system prints that warning, it looks like sha256.c is compiled and linked even without CONFIG_CRYPTO. Since MPTCP will end up needing CONFIG_CRYPTO anyway in future commits -- currently in preparation for net-next -- we propose to add it now to fix the warning. The dependency in the config system comes from the fact that CRYPTO_LIB_SHA256 is defined in "lib/crypto/Kconfig" which is sourced from "crypto/Kconfig" only if CRYPTO is selected. Fixes: 65492c5a6ab5 (mptcp: move from sha1 (v0) to sha256 (v1)) Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit c230978fb7d59d69ce6992623d948fb84abbf9e6 Merge: c4c10784293e b3e80d44f5b1 Author: David S. Miller Date: Sun Feb 16 19:32:11 2020 -0800 Merge branch 'bonding-fix-bonding-interface-bugs' Taehee Yoo says: ==================== bonding: fix bonding interface bugs This patchset fixes lockdep problem in bonding interface 1. The first patch is to add missing netdev_update_lockdep_key(). After bond_release(), netdev_update_lockdep_key() should be called. But both ioctl path and attribute path don't call netdev_update_lockdep_key(). This patch adds missing netdev_update_lockdep_key(). 2. The second patch is to export netdev_next_lower_dev_rcu symbol. netdev_next_lower_dev_rcu() is useful to implement the function, which is to walk their all lower interfaces. This patch is actually a preparing patch for the third patch. 3. The last patch is to fix lockdep waring in bond_get_stats(). The stats_lock uses a dynamic lockdep key. So, after "nomaster" operation, updating the dynamic lockdep key routine is needed. but it doesn't So, lockdep warning occurs. Change log: v1 -> v2: - Update headline from "fix bonding interface bugs" to "bonding: fix bonding interface bugs" - Drop a patch("bonding: do not collect slave's stats") - Add new patches - ("net: export netdev_next_lower_dev_rcu()") - ("bonding: fix lockdep warning in bond_get_stats()") ==================== Signed-off-by: David S. Miller commit b3e80d44f5b1b470dd9e2dbc6816e63a5c519709 Author: Taehee Yoo Date: Sat Feb 15 10:50:40 2020 +0000 bonding: fix lockdep warning in bond_get_stats() In the "struct bonding", there is stats_lock. This lock protects "bond_stats" in the "struct bonding". bond_stats is updated in the bond_get_stats() and this function would be executed concurrently. So, the lock is needed. Bonding interfaces would be nested. So, either stats_lock should use dynamic lockdep class key or stats_lock should be used by spin_lock_nested(). In the current code, stats_lock is using a dynamic lockdep class key. But there is no updating stats_lock_key routine So, lockdep warning will occur. Test commands: ip link add bond0 type bond ip link add bond1 type bond ip link set bond0 master bond1 ip link set bond0 nomaster ip link set bond1 master bond0 Splat looks like: [ 38.420603][ T957] 5.5.0+ #394 Not tainted [ 38.421074][ T957] ------------------------------------------------------ [ 38.421837][ T957] ip/957 is trying to acquire lock: [ 38.422399][ T957] ffff888063262cd8 (&bond->stats_lock_key#2){+.+.}, at: bond_get_stats+0x90/0x4d0 [bonding] [ 38.423528][ T957] [ 38.423528][ T957] but task is already holding lock: [ 38.424526][ T957] ffff888065fd2cd8 (&bond->stats_lock_key){+.+.}, at: bond_get_stats+0x90/0x4d0 [bonding] [ 38.426075][ T957] [ 38.426075][ T957] which lock already depends on the new lock. [ 38.426075][ T957] [ 38.428536][ T957] [ 38.428536][ T957] the existing dependency chain (in reverse order) is: [ 38.429475][ T957] [ 38.429475][ T957] -> #1 (&bond->stats_lock_key){+.+.}: [ 38.430273][ T957] _raw_spin_lock+0x30/0x70 [ 38.430812][ T957] bond_get_stats+0x90/0x4d0 [bonding] [ 38.431451][ T957] dev_get_stats+0x1ec/0x270 [ 38.432088][ T957] bond_get_stats+0x1a5/0x4d0 [bonding] [ 38.432767][ T957] dev_get_stats+0x1ec/0x270 [ 38.433322][ T957] rtnl_fill_stats+0x44/0xbe0 [ 38.433866][ T957] rtnl_fill_ifinfo+0xeb2/0x3720 [ 38.434474][ T957] rtmsg_ifinfo_build_skb+0xca/0x170 [ 38.435081][ T957] rtmsg_ifinfo_event.part.33+0x1b/0xb0 [ 38.436848][ T957] rtnetlink_event+0xcd/0x120 [ 38.437455][ T957] notifier_call_chain+0x90/0x160 [ 38.438067][ T957] netdev_change_features+0x74/0xa0 [ 38.438708][ T957] bond_compute_features.isra.45+0x4e6/0x6f0 [bonding] [ 38.439522][ T957] bond_enslave+0x3639/0x47b0 [bonding] [ 38.440225][ T957] do_setlink+0xaab/0x2ef0 [ 38.440786][ T957] __rtnl_newlink+0x9c5/0x1270 [ 38.441463][ T957] rtnl_newlink+0x65/0x90 [ 38.442075][ T957] rtnetlink_rcv_msg+0x4a8/0x890 [ 38.442774][ T957] netlink_rcv_skb+0x121/0x350 [ 38.443451][ T957] netlink_unicast+0x42e/0x610 [ 38.444282][ T957] netlink_sendmsg+0x65a/0xb90 [ 38.444992][ T957] ____sys_sendmsg+0x5ce/0x7a0 [ 38.445679][ T957] ___sys_sendmsg+0x10f/0x1b0 [ 38.446365][ T957] __sys_sendmsg+0xc6/0x150 [ 38.447007][ T957] do_syscall_64+0x99/0x4f0 [ 38.447668][ T957] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 38.448538][ T957] [ 38.448538][ T957] -> #0 (&bond->stats_lock_key#2){+.+.}: [ 38.449554][ T957] __lock_acquire+0x2d8d/0x3de0 [ 38.450148][ T957] lock_acquire+0x164/0x3b0 [ 38.450711][ T957] _raw_spin_lock+0x30/0x70 [ 38.451292][ T957] bond_get_stats+0x90/0x4d0 [bonding] [ 38.451950][ T957] dev_get_stats+0x1ec/0x270 [ 38.452425][ T957] bond_get_stats+0x1a5/0x4d0 [bonding] [ 38.453362][ T957] dev_get_stats+0x1ec/0x270 [ 38.453825][ T957] rtnl_fill_stats+0x44/0xbe0 [ 38.454390][ T957] rtnl_fill_ifinfo+0xeb2/0x3720 [ 38.456257][ T957] rtmsg_ifinfo_build_skb+0xca/0x170 [ 38.456998][ T957] rtmsg_ifinfo_event.part.33+0x1b/0xb0 [ 38.459351][ T957] rtnetlink_event+0xcd/0x120 [ 38.460086][ T957] notifier_call_chain+0x90/0x160 [ 38.460829][ T957] netdev_change_features+0x74/0xa0 [ 38.461752][ T957] bond_compute_features.isra.45+0x4e6/0x6f0 [bonding] [ 38.462705][ T957] bond_enslave+0x3639/0x47b0 [bonding] [ 38.463476][ T957] do_setlink+0xaab/0x2ef0 [ 38.464141][ T957] __rtnl_newlink+0x9c5/0x1270 [ 38.464897][ T957] rtnl_newlink+0x65/0x90 [ 38.465522][ T957] rtnetlink_rcv_msg+0x4a8/0x890 [ 38.466215][ T957] netlink_rcv_skb+0x121/0x350 [ 38.466895][ T957] netlink_unicast+0x42e/0x610 [ 38.467583][ T957] netlink_sendmsg+0x65a/0xb90 [ 38.468285][ T957] ____sys_sendmsg+0x5ce/0x7a0 [ 38.469202][ T957] ___sys_sendmsg+0x10f/0x1b0 [ 38.469884][ T957] __sys_sendmsg+0xc6/0x150 [ 38.470587][ T957] do_syscall_64+0x99/0x4f0 [ 38.471245][ T957] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 38.472093][ T957] [ 38.472093][ T957] other info that might help us debug this: [ 38.472093][ T957] [ 38.473438][ T957] Possible unsafe locking scenario: [ 38.473438][ T957] [ 38.474898][ T957] CPU0 CPU1 [ 38.476234][ T957] ---- ---- [ 38.480171][ T957] lock(&bond->stats_lock_key); [ 38.480808][ T957] lock(&bond->stats_lock_key#2); [ 38.481791][ T957] lock(&bond->stats_lock_key); [ 38.482754][ T957] lock(&bond->stats_lock_key#2); [ 38.483416][ T957] [ 38.483416][ T957] *** DEADLOCK *** [ 38.483416][ T957] [ 38.484505][ T957] 3 locks held by ip/957: [ 38.485048][ T957] #0: ffffffffbccf6230 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x457/0x890 [ 38.486198][ T957] #1: ffff888065fd2cd8 (&bond->stats_lock_key){+.+.}, at: bond_get_stats+0x90/0x4d0 [bonding] [ 38.487625][ T957] #2: ffffffffbc9254c0 (rcu_read_lock){....}, at: bond_get_stats+0x5/0x4d0 [bonding] [ 38.488897][ T957] [ 38.488897][ T957] stack backtrace: [ 38.489646][ T957] CPU: 1 PID: 957 Comm: ip Not tainted 5.5.0+ #394 [ 38.490497][ T957] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 38.492810][ T957] Call Trace: [ 38.493219][ T957] dump_stack+0x96/0xdb [ 38.493709][ T957] check_noncircular+0x371/0x450 [ 38.494344][ T957] ? lookup_address+0x60/0x60 [ 38.494923][ T957] ? print_circular_bug.isra.35+0x310/0x310 [ 38.495699][ T957] ? hlock_class+0x130/0x130 [ 38.496334][ T957] ? __lock_acquire+0x2d8d/0x3de0 [ 38.496979][ T957] __lock_acquire+0x2d8d/0x3de0 [ 38.497607][ T957] ? register_lock_class+0x14d0/0x14d0 [ 38.498333][ T957] ? check_chain_key+0x236/0x5d0 [ 38.499003][ T957] lock_acquire+0x164/0x3b0 [ 38.499800][ T957] ? bond_get_stats+0x90/0x4d0 [bonding] [ 38.500706][ T957] _raw_spin_lock+0x30/0x70 [ 38.501435][ T957] ? bond_get_stats+0x90/0x4d0 [bonding] [ 38.502311][ T957] bond_get_stats+0x90/0x4d0 [bonding] [ ... ] But, there is another problem. The dynamic lockdep class key is protected by RTNL, but bond_get_stats() would be called outside of RTNL. So, it would use an invalid dynamic lockdep class key. In order to fix this issue, stats_lock uses spin_lock_nested() instead of a dynamic lockdep key. The bond_get_stats() calls bond_get_lowest_level_rcu() to get the correct nest level value, which will be used by spin_lock_nested(). The "dev->lower_level" indicates lower nest level value, but this value is invalid outside of RTNL. So, bond_get_lowest_level_rcu() returns valid lower nest level value in the RCU critical section. bond_get_lowest_level_rcu() will be work only when LOCKDEP is enabled. Fixes: 089bca2caed0 ("bonding: use dynamic lockdep key instead of subclass") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 7151affeef8d527f50b4b68a871fd28bd660023f Author: Taehee Yoo Date: Sat Feb 15 10:50:21 2020 +0000 net: export netdev_next_lower_dev_rcu() netdev_next_lower_dev_rcu() will be used to implement a function, which is to walk all lower interfaces. There are already functions that they walk their lower interface. (netdev_walk_all_lower_dev_rcu, netdev_walk_all_lower_dev()). But, there would be cases that couldn't be covered by given netdev_walk_all_lower_dev_{rcu}() function. So, some modules would want to implement own function, which is to walk all lower interfaces. In the next patch, netdev_next_lower_dev_rcu() will be used. In addition, this patch removes two unused prototypes in netdevice.h. Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 064ff66e2bef84f1153087612032b5b9eab005bd Author: Taehee Yoo Date: Sat Feb 15 10:50:08 2020 +0000 bonding: add missing netdev_update_lockdep_key() After bond_release(), netdev_update_lockdep_key() should be called. But both ioctl path and attribute path don't call netdev_update_lockdep_key(). This patch adds missing netdev_update_lockdep_key(). Test commands: ip link add bond0 type bond ip link add bond1 type bond ifenslave bond0 bond1 ifenslave -d bond0 bond1 ifenslave bond1 bond0 Splat looks like: [ 29.501182][ T1046] WARNING: possible circular locking dependency detected [ 29.501945][ T1039] hardirqs last disabled at (1962): [] handle_mm_fault+0x13f/0x700 [ 29.503442][ T1046] 5.5.0+ #322 Not tainted [ 29.503447][ T1046] ------------------------------------------------------ [ 29.504277][ T1039] softirqs last enabled at (1180): [] __do_softirq+0x678/0x981 [ 29.505443][ T1046] ifenslave/1046 is trying to acquire lock: [ 29.505886][ T1039] softirqs last disabled at (1169): [] irq_exit+0x17a/0x1a0 [ 29.509997][ T1046] ffff88805d5da280 (&dev->addr_list_lock_key#3){+...}, at: dev_mc_sync_multiple+0x95/0x120 [ 29.511243][ T1046] [ 29.511243][ T1046] but task is already holding lock: [ 29.512192][ T1046] ffff8880460f2280 (&dev->addr_list_lock_key#4){+...}, at: bond_enslave+0x4482/0x47b0 [bonding] [ 29.514124][ T1046] [ 29.514124][ T1046] which lock already depends on the new lock. [ 29.514124][ T1046] [ 29.517297][ T1046] [ 29.517297][ T1046] the existing dependency chain (in reverse order) is: [ 29.518231][ T1046] [ 29.518231][ T1046] -> #1 (&dev->addr_list_lock_key#4){+...}: [ 29.519076][ T1046] _raw_spin_lock+0x30/0x70 [ 29.519588][ T1046] dev_mc_sync_multiple+0x95/0x120 [ 29.520208][ T1046] bond_enslave+0x448d/0x47b0 [bonding] [ 29.520862][ T1046] bond_option_slaves_set+0x1a3/0x370 [bonding] [ 29.521640][ T1046] __bond_opt_set+0x1ff/0xbb0 [bonding] [ 29.522438][ T1046] __bond_opt_set_notify+0x2b/0xf0 [bonding] [ 29.523251][ T1046] bond_opt_tryset_rtnl+0x92/0xf0 [bonding] [ 29.524082][ T1046] bonding_sysfs_store_option+0x8a/0xf0 [bonding] [ 29.524959][ T1046] kernfs_fop_write+0x276/0x410 [ 29.525620][ T1046] vfs_write+0x197/0x4a0 [ 29.526218][ T1046] ksys_write+0x141/0x1d0 [ 29.526818][ T1046] do_syscall_64+0x99/0x4f0 [ 29.527430][ T1046] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.528265][ T1046] [ 29.528265][ T1046] -> #0 (&dev->addr_list_lock_key#3){+...}: [ 29.529272][ T1046] __lock_acquire+0x2d8d/0x3de0 [ 29.529935][ T1046] lock_acquire+0x164/0x3b0 [ 29.530638][ T1046] _raw_spin_lock+0x30/0x70 [ 29.531187][ T1046] dev_mc_sync_multiple+0x95/0x120 [ 29.531790][ T1046] bond_enslave+0x448d/0x47b0 [bonding] [ 29.532451][ T1046] bond_option_slaves_set+0x1a3/0x370 [bonding] [ 29.533163][ T1046] __bond_opt_set+0x1ff/0xbb0 [bonding] [ 29.533789][ T1046] __bond_opt_set_notify+0x2b/0xf0 [bonding] [ 29.534595][ T1046] bond_opt_tryset_rtnl+0x92/0xf0 [bonding] [ 29.535500][ T1046] bonding_sysfs_store_option+0x8a/0xf0 [bonding] [ 29.536379][ T1046] kernfs_fop_write+0x276/0x410 [ 29.537057][ T1046] vfs_write+0x197/0x4a0 [ 29.537640][ T1046] ksys_write+0x141/0x1d0 [ 29.538251][ T1046] do_syscall_64+0x99/0x4f0 [ 29.538870][ T1046] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.539659][ T1046] [ 29.539659][ T1046] other info that might help us debug this: [ 29.539659][ T1046] [ 29.540953][ T1046] Possible unsafe locking scenario: [ 29.540953][ T1046] [ 29.541883][ T1046] CPU0 CPU1 [ 29.542540][ T1046] ---- ---- [ 29.543209][ T1046] lock(&dev->addr_list_lock_key#4); [ 29.543880][ T1046] lock(&dev->addr_list_lock_key#3); [ 29.544873][ T1046] lock(&dev->addr_list_lock_key#4); [ 29.545863][ T1046] lock(&dev->addr_list_lock_key#3); [ 29.546525][ T1046] [ 29.546525][ T1046] *** DEADLOCK *** [ 29.546525][ T1046] [ 29.547542][ T1046] 5 locks held by ifenslave/1046: [ 29.548196][ T1046] #0: ffff88806044c478 (sb_writers#5){.+.+}, at: vfs_write+0x3bb/0x4a0 [ 29.549248][ T1046] #1: ffff88805af00890 (&of->mutex){+.+.}, at: kernfs_fop_write+0x1cf/0x410 [ 29.550343][ T1046] #2: ffff88805b8b54b0 (kn->count#157){.+.+}, at: kernfs_fop_write+0x1f2/0x410 [ 29.551575][ T1046] #3: ffffffffaecf4cf0 (rtnl_mutex){+.+.}, at: bond_opt_tryset_rtnl+0x5f/0xf0 [bonding] [ 29.552819][ T1046] #4: ffff8880460f2280 (&dev->addr_list_lock_key#4){+...}, at: bond_enslave+0x4482/0x47b0 [bonding] [ 29.554175][ T1046] [ 29.554175][ T1046] stack backtrace: [ 29.554907][ T1046] CPU: 0 PID: 1046 Comm: ifenslave Not tainted 5.5.0+ #322 [ 29.555854][ T1046] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 29.557064][ T1046] Call Trace: [ 29.557504][ T1046] dump_stack+0x96/0xdb [ 29.558054][ T1046] check_noncircular+0x371/0x450 [ 29.558723][ T1046] ? print_circular_bug.isra.35+0x310/0x310 [ 29.559486][ T1046] ? hlock_class+0x130/0x130 [ 29.560100][ T1046] ? __lock_acquire+0x2d8d/0x3de0 [ 29.560761][ T1046] __lock_acquire+0x2d8d/0x3de0 [ 29.561366][ T1046] ? register_lock_class+0x14d0/0x14d0 [ 29.562045][ T1046] ? find_held_lock+0x39/0x1d0 [ 29.562641][ T1046] lock_acquire+0x164/0x3b0 [ 29.563199][ T1046] ? dev_mc_sync_multiple+0x95/0x120 [ 29.563872][ T1046] _raw_spin_lock+0x30/0x70 [ 29.564464][ T1046] ? dev_mc_sync_multiple+0x95/0x120 [ 29.565146][ T1046] dev_mc_sync_multiple+0x95/0x120 [ 29.565793][ T1046] bond_enslave+0x448d/0x47b0 [bonding] [ 29.566487][ T1046] ? bond_update_slave_arr+0x940/0x940 [bonding] [ 29.567279][ T1046] ? bstr_printf+0xc20/0xc20 [ 29.567857][ T1046] ? stack_trace_consume_entry+0x160/0x160 [ 29.568614][ T1046] ? deactivate_slab.isra.77+0x2c5/0x800 [ 29.569320][ T1046] ? check_chain_key+0x236/0x5d0 [ 29.569939][ T1046] ? sscanf+0x93/0xc0 [ 29.570442][ T1046] ? vsscanf+0x1e20/0x1e20 [ 29.571003][ T1046] bond_option_slaves_set+0x1a3/0x370 [bonding] [ ... ] Fixes: ab92d68fc22f ("net: core: add generic lockdep keys") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit c4c10784293ec89746721b1a40cb730b0106deea Author: Christophe JAILLET Date: Sat Feb 15 08:17:28 2020 +0100 NFC: pn544: Fix a typo in a debug message The ending character of the string shoulb be \n, not \b. Fixes: 17936b43f0fd ("NFC: Standardize logging style") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 6699170376ab941c1cc5c3bcefa766efc3575c73 Author: Michal Kubecek Date: Sat Feb 15 01:55:53 2020 +0100 ethtool: fix application of verbose no_mask bitset A bitset without mask in a _SET request means we want exactly the bits in the bitset to be set. This works correctly for compact format but when verbose format is parsed, ethnl_update_bitset32_verbose() only sets the bits present in the request bitset but does not clear the rest. This can cause incorrect results like lion:~ # ethtool eth0 | grep Wake Supports Wake-on: pumbg Wake-on: g lion:~ # ethtool -s eth0 wol u lion:~ # ethtool eth0 | grep Wake Supports Wake-on: pumbg Wake-on: ug when the second ethtool command issues request ETHTOOL_MSG_WOL_SET ETHTOOL_A_WOL_HEADER ETHTOOL_A_HEADER_DEV_NAME = "eth0" ETHTOOL_A_WOL_MODES ETHTOOL_A_BITSET_NOMASK ETHTOOL_A_BITSET_BITS ETHTOOL_A_BITSET_BITS_BIT ETHTOOL_BITSET_BIT_INDEX = 1 Fix the logic by clearing the whole target bitmap before we start iterating through the request bits. Fixes: 10b518d4e6dd ("ethtool: netlink bitset handling") Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit d965a5432d4c3e6b9c3d2bc1d4a800013bbf76f6 Author: Florian Fainelli Date: Fri Feb 14 15:26:19 2020 -0800 net: dsa: b53: Ensure the default VID is untagged We need to ensure that the default VID is untagged otherwise the switch will be sending tagged frames and the results can be problematic. This is especially true with b53 switches that use VID 0 as their default VLAN since VID 0 has a special meaning. Fixes: fea83353177a ("net: dsa: b53: Fix default VLAN ID") Fixes: 061f6a505ac3 ("net: dsa: Add ndo_vlan_rx_{add, kill}_vid implementation") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 82d81bb070cf109b3b5167597239dfa5c45558a5 Merge: b6e4a1aeeb14 1fbc33b0a7fe Author: David S. Miller Date: Sun Feb 16 19:21:56 2020 -0800 Merge branch 'wireguard-fixes' Jason A. Donenfeld says: ==================== wireguard fixes for 5.6-rc2 Here are four fixes for wireguard collected since rc1: 1) Some small cleanups to the test suite to help massively parallel builds. 2) A change in how we reset our load calculation to avoid a more expensive comparison, suggested by Matt Dunwoodie. 3) I've been loading more and more of wireguard's surface into syzkaller, trying to get our coverage as complete as possible, leading in this case to a fix for mtu=0 devices. 4) A removal of superfluous code, pointed out by Eric Dumazet. v2 fixes a logical problem in the patch for (3) pointed out by Eric Dumazet. v3 replaces some non-obvious bitmath in (3) with a more obvious expression, and adds patch (4). ==================== Signed-off-by: David S. Miller commit 1fbc33b0a7feb6ca72bf7dc8a05d81485ee8ee2e Author: Jason A. Donenfeld Date: Fri Feb 14 23:57:23 2020 +0100 wireguard: socket: remove extra call to synchronize_net synchronize_net() is a wrapper around synchronize_rcu(), so there's no point in having synchronize_net and synchronize_rcu back to back, despite the documentation comment suggesting maybe it's somewhat useful, "Wait for packets currently being received to be done." This commit removes the extra call. Signed-off-by: Jason A. Donenfeld Suggested-by: Eric Dumazet Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 175f1ca9a9ed8689d2028da1a7c624bb4fb4ff7e Author: Jason A. Donenfeld Date: Fri Feb 14 23:57:22 2020 +0100 wireguard: send: account for mtu=0 devices It turns out there's an easy way to get packets queued up while still having an MTU of zero, and that's via persistent keep alive. This commit makes sure that in whatever condition, we don't wind up dividing by zero. Note that an MTU of zero for a wireguard interface is something quasi-valid, so I don't think the correct fix is to limit it via min_mtu. This can be reproduced easily with: ip link add wg0 type wireguard ip link add wg1 type wireguard ip link set wg0 up mtu 0 ip link set wg1 up wg set wg0 private-key <(wg genkey) wg set wg1 listen-port 1 private-key <(wg genkey) peer $(wg show wg0 public-key) wg set wg0 peer $(wg show wg1 public-key) persistent-keepalive 1 endpoint 127.0.0.1:1 However, while min_mtu=0 seems fine, it makes sense to restrict the max_mtu. This commit also restricts the maximum MTU to the greatest number for which rounding up to the padding multiple won't overflow a signed integer. Packets this large were always rejected anyway eventually, due to checks deeper in, but it seems more sound not to even let the administrator configure something that won't work anyway. We use this opportunity to clean up this function a bit so that it's clear which paths we're expecting. Signed-off-by: Jason A. Donenfeld Cc: Eric Dumazet Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 2a8a4df36462aa85b0db87b7c5ea145ba67e34a8 Author: Jason A. Donenfeld Date: Fri Feb 14 23:57:21 2020 +0100 wireguard: receive: reset last_under_load to zero This is a small optimization that prevents more expensive comparisons from happening when they are no longer necessary, by clearing the last_under_load variable whenever we wind up in a state where we were under load but we no longer are. Signed-off-by: Jason A. Donenfeld Suggested-by: Matt Dunwoodie Signed-off-by: David S. Miller commit 04ddf1208f03e1dbc39a4619c40eba640051b950 Author: Jason A. Donenfeld Date: Fri Feb 14 23:57:20 2020 +0100 wireguard: selftests: reduce complexity and fix make races This gives us fewer dependencies and shortens build time, fixes up some hash checking race conditions, and also fixes missing directory creation that caused issues on massively parallel builds. Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit b6e4a1aeeb14cad595f70b31cc376903d322c821 Author: Mat Martineau Date: Fri Feb 14 14:14:29 2020 -0800 mptcp: Protect subflow socket options before connection completes Userspace should not be able to directly manipulate subflow socket options before a connection is established since it is not yet known if it will be an MPTCP subflow or a TCP fallback subflow. TCP fallback subflows can be more directly controlled by userspace because they are regular TCP connections, while MPTCP subflow sockets need to be configured for the specific needs of MPTCP. Use the same logic as sendmsg/recvmsg to ensure that socket option calls are only passed through to known TCP fallback subflows. Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 6f08e98d62799e53c89dbf2c9a49d77e20ca648c Author: Arun Parameswaran Date: Fri Feb 14 13:47:46 2020 -0800 net: phy: restore mdio regs in the iproc mdio driver The mii management register in iproc mdio block does not have a retention register so it is lost on suspend. Save and restore value of register while resuming from suspend. Fixes: bb1a619735b4 ("net: phy: Initialize mdio clock at probe function") Signed-off-by: Arun Parameswaran Signed-off-by: Scott Branden Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e08ad80551b4b33c02f2fce1522f6c227d3976cf Author: Eric Dumazet Date: Fri Feb 14 07:53:53 2020 -0800 net: add strict checks in netdev_name_node_alt_destroy() netdev_name_node_alt_destroy() does a lookup over all device names of a namespace. We need to make sure the name belongs to the device of interest, and that we do not destroy its primary name, since we rely on it being not deleted : dev->name_node would indeed point to freed memory. syzbot report was the following : BUG: KASAN: use-after-free in dev_net include/linux/netdevice.h:2206 [inline] BUG: KASAN: use-after-free in mld_force_mld_version net/ipv6/mcast.c:1172 [inline] BUG: KASAN: use-after-free in mld_in_v2_mode_only net/ipv6/mcast.c:1180 [inline] BUG: KASAN: use-after-free in mld_in_v1_mode+0x203/0x230 net/ipv6/mcast.c:1190 Read of size 8 at addr ffff88809886c588 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 dev_net include/linux/netdevice.h:2206 [inline] mld_force_mld_version net/ipv6/mcast.c:1172 [inline] mld_in_v2_mode_only net/ipv6/mcast.c:1180 [inline] mld_in_v1_mode+0x203/0x230 net/ipv6/mcast.c:1190 mld_send_initial_cr net/ipv6/mcast.c:2083 [inline] mld_dad_timer_expire+0x24/0x230 net/ipv6/mcast.c:2118 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1146 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61 Code: 68 73 c5 f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 94 be 59 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 84 be 59 00 fb f4 cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 de 2a 74 f9 e8 09 RSP: 0018:ffffc90000d3fd68 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff136761a RBX: ffff8880a99fc340 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffff8880a99fcbd4 RBP: ffffc90000d3fd98 R08: ffff8880a99fc340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 R13: ffffffff8aa5a1c0 R14: 0000000000000000 R15: 0000000000000001 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:686 default_idle_call+0x84/0xb0 kernel/sched/idle.c:94 cpuidle_idle_call kernel/sched/idle.c:154 [inline] do_idle+0x3c8/0x6e0 kernel/sched/idle.c:269 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361 start_secondary+0x2f4/0x410 arch/x86/kernel/smpboot.c:264 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242 Allocated by task 10229: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc mm/kasan/common.c:515 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:488 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 __do_kmalloc_node mm/slab.c:3616 [inline] __kmalloc_node+0x4e/0x70 mm/slab.c:3623 kmalloc_node include/linux/slab.h:578 [inline] kvmalloc_node+0x68/0x100 mm/util.c:574 kvmalloc include/linux/mm.h:645 [inline] kvzalloc include/linux/mm.h:653 [inline] alloc_netdev_mqs+0x98/0xe40 net/core/dev.c:9797 rtnl_create_link+0x22d/0xaf0 net/core/rtnetlink.c:3047 __rtnl_newlink+0xf9f/0x1790 net/core/rtnetlink.c:3309 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3377 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5438 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5456 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 __sys_sendto+0x262/0x380 net/socket.c:1998 __do_compat_sys_socketcall net/compat.c:771 [inline] __se_compat_sys_socketcall net/compat.c:719 [inline] __ia32_compat_sys_socketcall+0x530/0x710 net/compat.c:719 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline] do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 Freed by task 10229: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:476 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 __netdev_name_node_alt_destroy+0x1ff/0x2a0 net/core/dev.c:322 netdev_name_node_alt_destroy+0x57/0x80 net/core/dev.c:334 rtnl_alt_ifname net/core/rtnetlink.c:3518 [inline] rtnl_linkprop.isra.0+0x575/0x6f0 net/core/rtnetlink.c:3567 rtnl_dellinkprop+0x46/0x60 net/core/rtnetlink.c:3588 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5438 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5456 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __compat_sys_sendmsg net/compat.c:642 [inline] __do_compat_sys_sendmsg net/compat.c:649 [inline] __se_compat_sys_sendmsg net/compat.c:646 [inline] __ia32_compat_sys_sendmsg+0x7a/0xb0 net/compat.c:646 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline] do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 The buggy address belongs to the object at ffff88809886c000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 1416 bytes inside of 4096-byte region [ffff88809886c000, ffff88809886d000) The buggy address belongs to the page: page:ffffea0002621b00 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0 flags: 0xfffe0000010200(slab|head) raw: 00fffe0000010200 ffffea0002610d08 ffffea0002607608 ffff8880aa402000 raw: 0000000000000000 ffff88809886c000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809886c480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809886c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88809886c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809886c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809886c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 36fbf1e52bd3 ("net: rtnetlink: add linkprop commands to add and delete alternative ifnames") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Jiri Pirko Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 0b634c0e73450342c84ceef34547e23a77946948 Merge: 4e867c9a50ff 5a292c89a84d Author: David S. Miller Date: Sun Feb 16 19:03:40 2020 -0800 Merge branch 'atlantic-fixes' Igor Russkikh says: ==================== Marvell atlantic 2020/02 updates Hi David, here is another set of bugfixes on AQC family found on last integration phase. ==================== Signed-off-by: David S. Miller commit 5a292c89a84d49b598f8978f154bdda48b1072c0 Author: Dmitry Bogdanov Date: Fri Feb 14 18:44:58 2020 +0300 net: atlantic: fix out of range usage of active_vlans array fix static checker warning: drivers/net/ethernet/aquantia/atlantic/aq_filters.c:166 aq_check_approve_fvlan() error: passing untrusted data to 'test_bit()' Reported-by: Dan Carpenter Fixes: 7975d2aff5af: ("net: aquantia: add support of rx-vlan-filter offload") Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit 52a22f4d6ff95e8bdca557765c04893eb5dd83fd Author: Pavel Belous Date: Fri Feb 14 18:44:57 2020 +0300 net: atlantic: possible fault in transition to hibernation during hibernation freeze, aq_nic_stop could be invoked on a stopped device. That may cause panic on access to not yet allocated vector/ring structures. Add a check to stop device if it is not yet stopped. Similiarly after freeze in hibernation thaw, aq_nic_start could be invoked on a not initialized net device. Result will be the same. Add a check to start device if it is initialized. In our case, this is the same as started. Fixes: 8aaa112a57c1 ("net: atlantic: refactoring pm logic") Signed-off-by: Pavel Belous Signed-off-by: Nikita Danilov Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 Author: Pavel Belous Date: Fri Feb 14 18:44:56 2020 +0300 net: atlantic: fix potential error handling Code inspection found that in case of mapping error we do return current 'ret' value. But beside error, it is used to count number of descriptors allocated for the packet. In that case map_skb function could return '1'. Changing it to return zero (number of mapped descriptors for skb) Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") Signed-off-by: Pavel Belous Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit a4980919ad6a7be548d499bc5338015e1a9191c6 Author: Pavel Belous Date: Fri Feb 14 18:44:55 2020 +0300 net: atlantic: fix use after free kasan warn skb->len is used to calculate statistics after xmit invocation. Under a stress load it may happen that skb will be xmited, rx interrupt will come and skb will be freed, all before xmit function is even returned. Eventually, skb->len will access unallocated area. Moving stats calculation into tx_clean routine. Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") Reported-by: Christophe Vu-Brugier Signed-off-by: Igor Russkikh Signed-off-by: Pavel Belous Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit b42726fcf76e9367e524392e0ead7e672cc0791c Author: Nikita Danilov Date: Fri Feb 14 18:44:54 2020 +0300 net: atlantic: better loopback mode handling Add checks to not enable multiple loopback modes simultaneously, It was also discovered that for dma loopback to function correctly promisc mode should be enabled on device. Fixes: ea4b4d7fc106 ("net: atlantic: loopback tests via private flags") Signed-off-by: Nikita Danilov Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit f08a464c27ca0a4050333baa271504b27ce834b7 Author: Egor Pomozov Date: Fri Feb 14 18:44:53 2020 +0300 net: atlantic: ptp gpio adjustments Clock adjustment data should be passed to FW as well, otherwise in some cases a drift was observed when using GPIO features. Signed-off-by: Egor Pomozov Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit e7b5f97e6574dc4918e375d5f8d24ec31653cd6d Author: Igor Russkikh Date: Fri Feb 14 18:44:52 2020 +0300 net: atlantic: check rpc result and wait for rpc address Artificial HW reliability tests revealed a possible hangup in the driver. Normally, when device disappears from bus, all register reads returns 0xFFFFFFFF. At remote procedure invocation towards FW there is a logic where result is compared with -1 in a loop. That caused an infinite loop if hardware due to some issues disappears from bus. Add extra result checks to prevent this. Signed-off-by: Dmitry Bogdanov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 15beab0a9d797be1b7c67458da007a62269be29a Author: Dmitry Bezrukov Date: Fri Feb 14 18:44:51 2020 +0300 net: atlantic: checksum compat issue Yet another checksum offload compatibility issue was found. The known issue is that AQC HW marks tcp packets with 0xFFFF checksum as invalid (1). This is workarounded in driver, passing all the suspicious packets up to the stack for further csum validation. Another HW problem (2) is that it hides invalid csum of LRO aggregated packets inside of the individual descriptors. That was workarounded by forced scan of all LRO descriptors for checksum errors. However the scan logic was joint for both LRO and multi-descriptor packets (jumbos). And this causes the issue. We have to drop LRO packets with the detected bad checksum because of (2), but we have to pass jumbo packets to stack because of (1). When using windows tcp partner with jumbo frames but with LSO disabled driver discards such frames as bad checksummed. But only LRO frames should be dropped, not jumbos. On such a configurations tcp stream have a chance of drops and stucks. (1) 76f254d4afe2 ("net: aquantia: tcp checksum 0xffff being handled incorrectly") (2) d08b9a0a3ebd ("net: aquantia: do not pass lro session with invalid tcp checksum") Fixes: d08b9a0a3ebd ("net: aquantia: do not pass lro session with invalid tcp checksum") Signed-off-by: Dmitry Bezrukov Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit 4e867c9a50ff1a07ed0b86c3b1c8bc773933d728 Author: Hangbin Liu Date: Thu Feb 13 17:40:54 2020 +0800 selftests: forwarding: vxlan_bridge_1d: fix tos value After commit 71130f29979c ("vxlan: fix tos value before xmit") we start strict vxlan xmit tos value by RT_TOS(), which limits the tos value less than 0x1E. With current value 0x40 the test will failed with "v1: Expected to capture 10 packets, got 0". So let's choose a smaller tos value for testing. Fixes: d417ecf533fe ("selftests: forwarding: vxlan_bridge_1d: Add a TOS test") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 44bfa9c5e5f06c72540273813e4c66beb5a8c213 Author: Eric Dumazet Date: Wed Feb 12 20:58:26 2020 -0800 net: rtnetlink: fix bugs in rtnl_alt_ifname() Since IFLA_ALT_IFNAME is an NLA_STRING, we have no guarantee it is nul terminated. We should use nla_strdup() instead of kstrdup(), since this helper will make sure not accessing out-of-bounds data. BUG: KMSAN: uninit-value in strlen+0x5e/0xa0 lib/string.c:535 CPU: 1 PID: 19157 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 strlen+0x5e/0xa0 lib/string.c:535 kstrdup+0x7f/0x1a0 mm/util.c:59 rtnl_alt_ifname net/core/rtnetlink.c:3495 [inline] rtnl_linkprop+0x85d/0xc00 net/core/rtnetlink.c:3553 rtnl_newlinkprop+0x9d/0xb0 net/core/rtnetlink.c:3568 rtnetlink_rcv_msg+0x1153/0x1570 net/core/rtnetlink.c:5424 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45b3b9 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff1c7b1ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff1c7b1b6d4 RCX: 000000000045b3b9 RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000009cb R14: 00000000004cb3dd R15: 000000000075bf2c Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2774 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4382 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] netlink_sendmsg+0x7d3/0x14d0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 36fbf1e52bd3 ("net: rtnetlink: add linkprop commands to add and delete alternative ifnames") Signed-off-by: Eric Dumazet Cc: Jiri Pirko Reported-by: syzbot Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit e6a41c23df0d5da01540d2abef41591589c0b4be Author: Alexandre Belloni Date: Wed Feb 12 17:45:38 2020 +0100 net: macb: ensure interface is not suspended on at91rm9200 Because of autosuspend, at91ether_start is called with clocks disabled. Ensure that pm_runtime doesn't suspend the interface as soon as it is opened as there is no pm_runtime support is the other relevant parts of the platform support for at91rm9200. Fixes: d54f89af6cc4 ("net: macb: Add pm runtime support") Signed-off-by: Alexandre Belloni Reviewed-by: Claudiu Beznea Acked-by: Nicolas Ferre Signed-off-by: David S. Miller commit 540e585a79e9d643ede077b73bcc7aa2d7b4d919 Author: Jethro Beekman Date: Wed Feb 12 16:43:41 2020 +0100 net: fib_rules: Correctly set table field when table number exceeds 8 bits In 709772e6e06564ed94ba740de70185ac3d792773, RT_TABLE_COMPAT was added to allow legacy software to deal with routing table numbers >= 256, but the same change to FIB rule queries was overlooked. Signed-off-by: Jethro Beekman Signed-off-by: David S. Miller commit 0d4597c8c5abdeeaf50774066c16683f30184dc8 Author: Leon Romanovsky Date: Tue Feb 11 19:03:55 2020 -0800 net/rds: Track user mapped pages through special API Convert net/rds to use the newly introduces pin_user_pages() API, which properly sets FOLL_PIN. Setting FOLL_PIN is now required for code that requires tracking of pinned pages. Note that this effectively changes the code's behavior: it now ultimately calls set_page_dirty_lock(), instead of set_page_dirty(). This is probably more accurate. As Christoph Hellwig put it, "set_page_dirty() is only safe if we are dealing with a file backed page where we have reference on the inode it hangs off." [1] [1] https://lore.kernel.org/r/20190723153640.GB720@lst.de Cc: Hans Westgaard Ry Cc: Santosh Shilimkar Signed-off-by: Leon Romanovsky Signed-off-by: John Hubbard Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit afecdb376bd81d7e16578f0cfe82a1aec7ae18f3 Author: Benjamin Poirier Date: Wed Feb 12 10:41:07 2020 +0900 ipv6: Fix nlmsg_flags when splitting a multipath route When splitting an RTA_MULTIPATH request into multiple routes and adding the second and later components, we must not simply remove NLM_F_REPLACE but instead replace it by NLM_F_CREATE. Otherwise, it may look like the netlink message was malformed. For example, ip route add 2001:db8::1/128 dev dummy0 ip route change 2001:db8::1/128 nexthop via fe80::30:1 dev dummy0 \ nexthop via fe80::30:2 dev dummy0 results in the following warnings: [ 1035.057019] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1035.057517] IPv6: NLM_F_CREATE should be set when creating new route This patch makes the nlmsg sequence look equivalent for __ip6_ins_rt() to what it would get if the multipath route had been added in multiple netlink operations: ip route add 2001:db8::1/128 dev dummy0 ip route change 2001:db8::1/128 nexthop via fe80::30:1 dev dummy0 ip route append 2001:db8::1/128 nexthop via fe80::30:2 dev dummy0 Fixes: 27596472473a ("ipv6: fix ECMP route replacement") Signed-off-by: Benjamin Poirier Reviewed-by: Michal Kubecek Reviewed-by: David Ahern Signed-off-by: David S. Miller commit e404b8c7cfb31654c9024d497cec58a501501692 Author: Benjamin Poirier Date: Wed Feb 12 10:41:06 2020 +0900 ipv6: Fix route replacement with dev-only route After commit 27596472473a ("ipv6: fix ECMP route replacement") it is no longer possible to replace an ECMP-able route by a non ECMP-able route. For example, ip route add 2001:db8::1/128 via fe80::1 dev dummy0 ip route replace 2001:db8::1/128 dev dummy0 does not work as expected. Tweak the replacement logic so that point 3 in the log of the above commit becomes: 3. If the new route is not ECMP-able, and no matching non-ECMP-able route exists, replace matching ECMP-able route (if any) or add the new route. We can now summarize the entire replace semantics to: When doing a replace, prefer replacing a matching route of the same "ECMP-able-ness" as the replace argument. If there is no such candidate, fallback to the first route found. Fixes: 27596472473a ("ipv6: fix ECMP route replacement") Signed-off-by: Benjamin Poirier Reviewed-by: Michal Kubecek Signed-off-by: David S. Miller commit e8023b030ce1748930e2dc76353a262fe47d4745 Author: Hangbin Liu Date: Tue Feb 11 15:32:56 2020 +0800 selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing For tc ip_proto filter, when we extract the flow via __skb_flow_dissect() without flag FLOW_DISSECTOR_F_STOP_AT_ENCAP, we will continue extract to the inner proto. So for GRE + ICMP messages, we should not track GRE proto, but inner ICMP proto. For test mirror_gre.sh, it may make user confused if we capture ICMP message on $h3(since the flow is GRE message). So I move the capture dev to h3-gt{4,6}, and only capture ICMP message. Before the fix: ]# ./mirror_gre.sh TEST: ingress mirror to gretap (skip_hw) [ OK ] TEST: egress mirror to gretap (skip_hw) [ OK ] TEST: ingress mirror to ip6gretap (skip_hw) [ OK ] TEST: egress mirror to ip6gretap (skip_hw) [ OK ] TEST: ingress mirror to gretap: envelope MAC (skip_hw) [FAIL] Expected to capture 10 packets, got 0. TEST: egress mirror to gretap: envelope MAC (skip_hw) [FAIL] Expected to capture 10 packets, got 0. TEST: ingress mirror to ip6gretap: envelope MAC (skip_hw) [FAIL] Expected to capture 10 packets, got 0. TEST: egress mirror to ip6gretap: envelope MAC (skip_hw) [FAIL] Expected to capture 10 packets, got 0. TEST: two simultaneously configured mirrors (skip_hw) [ OK ] WARN: Could not test offloaded functionality After fix: ]# ./mirror_gre.sh TEST: ingress mirror to gretap (skip_hw) [ OK ] TEST: egress mirror to gretap (skip_hw) [ OK ] TEST: ingress mirror to ip6gretap (skip_hw) [ OK ] TEST: egress mirror to ip6gretap (skip_hw) [ OK ] TEST: ingress mirror to gretap: envelope MAC (skip_hw) [ OK ] TEST: egress mirror to gretap: envelope MAC (skip_hw) [ OK ] TEST: ingress mirror to ip6gretap: envelope MAC (skip_hw) [ OK ] TEST: egress mirror to ip6gretap: envelope MAC (skip_hw) [ OK ] TEST: two simultaneously configured mirrors (skip_hw) [ OK ] WARN: Could not test offloaded functionality Fixes: ba8d39871a10 ("selftests: forwarding: Add test for mirror to gretap") Signed-off-by: Hangbin Liu Reviewed-by: Petr Machata Tested-by: Petr Machata Signed-off-by: David S. Miller commit a4031afb9d10d97f4d0285844abbc0ab04245304 Author: Christophe Leroy Date: Sun Feb 9 18:14:42 2020 +0000 powerpc/8xx: Fix clearing of bits 20-23 in ITLB miss In ITLB miss handled the line supposed to clear bits 20-23 on the L2 ITLB entry is buggy and does indeed nothing, leading to undefined value which could allow execution when it shouldn't. Properly do the clearing with the relevant instruction. Fixes: 74fabcadfd43 ("powerpc/8xx: don't use r12/SPRN_SPRG_SCRATCH2 in TLB Miss handlers") Cc: stable@vger.kernel.org # v5.0+ Signed-off-by: Christophe Leroy Reviewed-by: Leonardo Bras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/4f70c2778163affce8508a210f65d140e84524b4.1581272050.git.christophe.leroy@c-s.fr commit 50a175dd18de7a647e72aca7daf4744e3a5a81e3 Author: Christophe Leroy Date: Sun Feb 9 16:02:41 2020 +0000 powerpc/hugetlb: Fix 8M hugepages on 8xx With HW assistance all page tables must be 4k aligned, the 8xx drops the last 12 bits during the walk. Redefine HUGEPD_SHIFT_MASK to mask last 12 bits out. HUGEPD_SHIFT_MASK is used to for alignment of page table cache. Fixes: 22569b881d37 ("powerpc/8xx: Enable 8M hugepage support with HW assistance") Cc: stable@vger.kernel.org # v5.0+ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/778b1a248c4c7ca79640eeff7740044da6a220a0.1581264115.git.christophe.leroy@c-s.fr commit f2b67ef90b0d5eca0f2255e02cf2f620bc0ddcdb Author: Christophe Leroy Date: Thu Feb 6 13:50:28 2020 +0000 powerpc/hugetlb: Fix 512k hugepages on 8xx with 16k page size Commit 55c8fc3f4930 ("powerpc/8xx: reintroduce 16K pages with HW assistance") redefined pte_t as a struct of 4 pte_basic_t, because in 16K pages mode there are four identical entries in the page table. But the size of hugepage tables is calculated based of the size of (void *). Therefore, we end up with page tables of size 1k instead of 4k for 512k pages. As 512k hugepage tables are the same size as standard page tables, ie 4k, use the standard page tables instead of PGT_CACHE tables. Fixes: 3fb69c6a1a13 ("powerpc/8xx: Enable 512k hugepage support with HW assistance") Cc: stable@vger.kernel.org # v5.0+ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/90ec56a2315be602494619ed0223bba3b0b8d619.1580997007.git.christophe.leroy@c-s.fr commit d4f194ed9eb9841a8f978710e4d24296f791a85b Author: Sam Bobroff Date: Fri Feb 7 15:57:31 2020 +1100 powerpc/eeh: Fix deadlock handling dead PHB Recovering a dead PHB can currently cause a deadlock as the PCI rescan/remove lock is taken twice. This is caused as part of an existing bug in eeh_handle_special_event(). The pe is processed while traversing the PHBs even though the pe is unrelated to the loop. This causes the pe to be, incorrectly, processed more than once. Untangling this section can move the pe processing out of the loop and also outside the locked section, correcting both problems. Fixes: 2e25505147b8 ("powerpc/eeh: Fix crash when edev->pdev changes") Cc: stable@vger.kernel.org # 5.4+ Signed-off-by: Sam Bobroff Reviewed-by: Frederic Barrat Tested-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/0547e82dbf90ee0729a2979a8cac5c91665c621f.1581051445.git.sbobroff@linux.ibm.com commit 11a48a5a18c63fd7621bb050228cebf13566e4d8 Author: Linus Torvalds Date: Sun Feb 16 13:16:59 2020 -0800 Linux 5.6-rc2 commit ab02b61f24c76b1659086fcc8b00cbeeb6e95ac7 Merge: 44024adb4aab e0354d147e58 Author: Linus Torvalds Date: Sun Feb 16 13:05:46 2020 -0800 Merge tag 'for-linus-5.6-1' of https://github.com/cminyard/linux-ipmi Pull IPMI update from Corey Minyard: "Minor bug fixes for IPMI I know this is late; I've been travelling and, well, I've been distracted. This is just a few bug fixes and adding i2c support to the IPMB driver, which is something I wanted from the beginning for it" * tag 'for-linus-5.6-1' of https://github.com/cminyard/linux-ipmi: drivers: ipmi: fix off-by-one bounds check that leads to a out-of-bounds write ipmi:ssif: Handle a possible NULL pointer reference drivers: ipmi: Modify max length of IPMB packet drivers: ipmi: Support raw i2c packet in IPMB commit 44024adb4aabefd275c6f9c00cac323473447dd5 Merge: b982df72ef84 120881b9e888 Author: Linus Torvalds Date: Sun Feb 16 13:01:42 2020 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Bugfixes and improvements to selftests. On top of this, Mauro converted the KVM documentation to rst format, which was very welcome" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (44 commits) docs: virt: guest-halt-polling.txt convert to ReST docs: kvm: review-checklist.txt: rename to ReST docs: kvm: Convert timekeeping.txt to ReST format docs: kvm: Convert s390-diag.txt to ReST format docs: kvm: Convert ppc-pv.txt to ReST format docs: kvm: Convert nested-vmx.txt to ReST format docs: kvm: Convert mmu.txt to ReST format docs: kvm: Convert locking.txt to ReST format docs: kvm: Convert hypercalls.txt to ReST format docs: kvm: arm/psci.txt: convert to ReST docs: kvm: convert arm/hyp-abi.txt to ReST docs: kvm: Convert api.txt to ReST format docs: kvm: convert devices/xive.txt to ReST docs: kvm: convert devices/xics.txt to ReST docs: kvm: convert devices/vm.txt to ReST docs: kvm: convert devices/vfio.txt to ReST docs: kvm: convert devices/vcpu.txt to ReST docs: kvm: convert devices/s390_flic.txt to ReST docs: kvm: convert devices/mpic.txt to ReST docs: kvm: convert devices/arm-vgit.txt to ReST ... commit b982df72ef8404de99597f1d956b6137533b429a Merge: e29c6a13ddf5 4d59588c09f2 Author: Linus Torvalds Date: Sun Feb 16 12:49:36 2020 -0800 Merge tag 'edac_urgent_for_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: "Two fixes for use-after-free and memory leaking in the EDAC core, by Robert Richter. Debug options like DEBUG_TEST_DRIVER_REMOVE, KASAN and DEBUG_KMEMLEAK unearthed issues with the lifespan of memory allocated by the EDAC memory controller descriptor due to misdesigned memory freeing, done partially by the EDAC core *and* the driver core, which is problematic to say the least. These two are minimal fixes to take care of stable - a proper rework is following which cleans up that mess properly" * tag 'edac_urgent_for_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/sysfs: Remove csrow objects on errors EDAC/mc: Fix use-after-free and memleaks during device removal commit e29c6a13ddf56217563f03fbc6ba9bb72dcbf2e4 Merge: 713db3560410 f25372ffc3f6 Author: Linus Torvalds Date: Sun Feb 16 12:35:52 2020 -0800 Merge tag 'block-5.6-2020-02-16' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Not a lot here, which is great, basically just three small bcache fixes from Coly, and four NVMe fixes via Keith" * tag 'block-5.6-2020-02-16' of git://git.kernel.dk/linux-block: nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info nvme/pci: move cqe check after device shutdown nvme: prevent warning triggered by nvme_stop_keep_alive nvme/tcp: fix bug on double requeue when send fails bcache: remove macro nr_to_fifo_front() bcache: Revert "bcache: shrink btree node cache after bch_btree_check()" bcache: ignore pending signals when creating gc and allocator thread commit 713db356041071d16360e82247de3107ec9ed57f Merge: 288b27a06e4f 1b9867eb6120 Author: Linus Torvalds Date: Sun Feb 16 11:43:45 2020 -0800 Merge tag 'for-5.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two races fixed, memory leak fix, sysfs directory fixup and two new log messages: - two fixed race conditions: extent map merging and truncate vs fiemap - create the right sysfs directory with device information and move the individual device dirs under it - print messages when the tree-log is replayed at mount time or cannot be replayed on remount" * tag 'for-5.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: sysfs, move device id directories to UUID/devinfo btrfs: sysfs, add UUID/devinfo kobject Btrfs: fix race between shrinking truncate and fiemap btrfs: log message when rw remount is attempted with unclean tree-log btrfs: print message when tree-log replay starts Btrfs: fix race between using extent maps and merging them btrfs: ref-verify: fix memory leaks commit 288b27a06e4f8f7bad63792cf015c160ae578d89 Merge: 8a8b80967b42 85db6b7ae65f Author: Linus Torvalds Date: Sun Feb 16 11:41:29 2020 -0800 Merge tag '5.6-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Four small CIFS/SMB3 fixes. One (the EA overflow fix) for stable" * tag '5.6-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: make sure we do not overflow the max EA buffer size cifs: enable change notification for SMB2.1 dialect cifs: Fix mode output in debugging statements cifs: fix mount option display for sec=krb5i commit 8a8b80967b421218d89c1af61e759c54ab94fdb6 Merge: db70e26e33ee d65d87a07476 Author: Linus Torvalds Date: Sun Feb 16 11:12:06 2020 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Miscellaneous ext4 bug fixes (all stable fodder)" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: improve explanation of a mount failure caused by a misconfigured kernel jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() ext4: add cond_resched() to ext4_protect_reserved_inode ext4: fix checksum errors with indexed dirs ext4: fix support for inode sizes > 1024 bytes ext4: simplify checking quota limits in ext4_statfs() ext4: don't assume that mmp_nodename/bdevname have NUL commit 7fbeb95d0f68e21e6ca61284f1ac681630976947 Author: Pavel Begunkov Date: Sun Feb 16 01:01:18 2020 +0300 io_uring: add missing io_req_cancelled() fallocate_finish() is missing cancellation check. Add it. It's safe to do that, as only flags setup and sqe fields copy are done before it gets into __io_fallocate(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit db70e26e33eef1b148ca1c9f50de92203ec7e82e Merge: 54654e142d9e 3dbae1553897 Author: Linus Torvalds Date: Sat Feb 15 16:49:25 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a few drivers have been updated to use flexible-array syntax instead of GCC extension - ili210x touchscreen driver now supports the 2120 protocol flavor - a couple more of Synaptics devices have been switched over to RMI4 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cyapa - replace zero-length array with flexible-array member Input: tca6416-keypad - replace zero-length array with flexible-array member Input: gpio_keys_polled - replace zero-length array with flexible-array member Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list Input: synaptics - enable SMBus on ThinkPad L470 Input: synaptics - switch T470s to RMI4 by default Input: gpio_keys - replace zero-length array with flexible-array member Input: goldfish_events - replace zero-length array with flexible-array member Input: psmouse - switch to using i2c_new_scanned_device() Input: ili210x - add ili2120 support Input: ili210x - fix return value of is_visible function commit 54654e142d9ed3f7382767d6da769a2887888a75 Merge: b719ae070ee2 685eff513183 Author: Linus Torvalds Date: Sat Feb 15 16:38:49 2020 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Not too much going on here, though there are about four fixes related to stuff merged during the last merge window. We also see the return of a syzkaller instance with access to RDMA devices, and a few bugs detected by that squished. - Fix three crashers and a memory memory leak for HFI1 - Several bugs found by syzkaller - A bug fix for the recent QP counters feature on older mlx5 HW - Locking inversion in cxgb4 - Unnecessary WARN_ON in siw - A umad crasher regression during unload, from a bug fix for something else - Bugs introduced in the merge window: - Missed list_del in uverbs file rework, core and mlx5 devx - Unexpected integer math truncation in the mlx5 VAR patches - Compilation bug fix for the VAR patches on 32 bit" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/mlx5: Use div64_u64 for num_var_hw_entries calculation RDMA/core: Fix protection fault in get_pkey_idx_qp_list RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq RDMA/mlx5: Prevent overflow in mmap offset calculations IB/umad: Fix kernel crash while unloading ib_umad RDMA/mlx5: Fix async events cleanup flows RDMA/core: Add missing list deletion on freeing event queue RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready() RDMA/iw_cxgb4: initiate CLOSE when entering TERM IB/mlx5: Return failure when rts2rts_qp_counters_set_id is not supported RDMA/core: Fix invalid memory access in spec_filter_size IB/rdmavt: Reset all QPs when the device is shut down IB/hfi1: Close window for pq and request coliding IB/hfi1: Acquire lock to release TID entries when user file is closed RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create commit b719ae070ee2371c37d846616ef7453ec6811990 Merge: 3e71e1214b66 3bf3c9744694 Author: Linus Torvalds Date: Sat Feb 15 13:16:47 2020 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "A handful of fixes that have come in since the merge window: - Fix of PCI interrupt map on arm64 fast model (SW emulator) - Fixlet for sound on ST platforms and a small cleanup of deprecated DT properties - A stack buffer overflow fix for moxtet - Fuse driver build fix for Tegra194 - A few config updates to turn on new drivers merged this cycle" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: bus: moxtet: fix potential stack buffer overflow soc/tegra: fuse: Fix build with Tegra194 configuration ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi ARM: dts: sti: Remove deprecated snps PHY properties for stih410-b2260 arm64: defconfig: Enable DRM_SUN6I_DSI arm64: defconfig: Enable CONFIG_SUN8I_THERMAL ARM: sunxi: Enable CONFIG_SUN8I_THERMAL arm64: defconfig: Set bcm2835-dma as built-in ARM: configs: Cleanup old Kconfig options ARM: npcm: Bring back GPIOLIB support arm64: dts: fast models: Fix FVP PCI interrupt-map property commit 3e71e1214b6643faf90157e6655a86227938b080 Merge: bd516133cc90 c7ff8573ad21 Author: Linus Torvalds Date: Sat Feb 15 13:10:38 2020 -0800 Merge tag 's390-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Enable paes-s390 cipher selftests in testmgr (acked-by Herbert Xu). - Fix protected key length update in PKEY_SEC2PROTK ioctl and increase card/queue requests counter to 64-bit in crypto code. - Fix clang warning in get_tod_clock. - Fix ultravisor info length extensions handling. - Fix style of SPDX License Identifier in vfio-ccw. - Avoid unnecessary GFP_ATOMIC and simplify ACK tracking in qdio. * tag 's390-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: crypto/testmgr: enable selftests for paes-s390 ciphers s390/time: Fix clk type in get_tod_clock s390/uv: Fix handling of length extensions s390/qdio: don't allocate *aob array with GFP_ATOMIC s390/qdio: simplify ACK tracking s390/zcrypt: fix card and queue total counter wrap s390/pkey: fix missing length of protected key on return vfio-ccw: Use the correct style for SPDX License Identifier commit bd516133cc9067ef52518e1c9497c46cb8424ea9 Merge: ef78e5b7de5d 205447fa9e0a Author: Linus Torvalds Date: Sat Feb 15 13:03:50 2020 -0800 Merge tag 'hwmon-for-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix compatible string typos in the xdpe12284 driver, and a wrong bit value in the ltc2978 driver" * tag 'hwmon-for-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (pmbus/xdpe12284) fix typo in compatible strings hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions. commit ef78e5b7de5da49769c337a17dcff7d4e82ee6cd Merge: da99f9355b53 e9f5490c3574 Author: Linus Torvalds Date: Sat Feb 15 12:51:22 2020 -0800 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Misc fixes all over the place: - Fix NUMA over-balancing between lightly loaded nodes. This is fallout of the big load-balancer rewrite. - Fix the NOHZ remote loadavg update logic, which fixes anomalies like reported 150 loadavg on mostly idle CPUs. - Fix XFS performance/scalability - Fix throttled groups unbound task-execution bug - Fix PSI procfs boundary condition - Fix the cpu.uclamp.{min,max} cgroup configuration write checks - Fix DocBook annotations - Fix RCU annotations - Fix overly CPU-intensive housekeeper CPU logic loop on large CPU counts" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix kernel-doc warning in attach_entity_load_avg() sched/core: Annotate curr pointer in rq with __rcu sched/psi: Fix OOB write when writing 0 bytes to PSI files sched/fair: Allow a per-CPU kthread waking a task to stack on the same CPU, to fix XFS performance regression sched/fair: Prevent unlimited runtime on throttled group sched/nohz: Optimize get_nohz_timer_target() sched/uclamp: Reject negative values in cpu_uclamp_write() sched/fair: Allow a small load imbalance between low utilisation SD_NUMA domains timers/nohz: Update NOHZ load in remote tick sched/core: Don't skip remote tick for idle CPUs commit bef8e2dfceed6daeb6ca3e8d33f9c9d43b926580 Author: Christophe JAILLET Date: Sun Feb 2 21:19:22 2020 +0100 MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()' Pointer on the memory allocated by 'alloc_progmem()' is stored in 'v->load_addr'. So this is this memory that should be freed by 'release_progmem()'. 'release_progmem()' is only a call to 'kfree()'. With the current code, there is both a double free and a memory leak. Fix it by passing the correct pointer to 'release_progmem()'. Fixes: e01402b115ccc ("More AP / SP bits for the 34K, the Malta bits and things. Still wants") Signed-off-by: Christophe JAILLET Signed-off-by: Paul Burton Cc: ralf@linux-mips.org Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: kernel-janitors@vger.kernel.org commit 97e914b7de3c943011779b979b8093fdc0d85722 Author: Mark Tomlinson Date: Wed Feb 12 10:24:55 2020 +1300 MIPS: cavium_octeon: Fix syncw generation. The Cavium Octeon CPU uses a special sync instruction for implementing wmb, and due to a CPU bug, the instruction must appear twice. A macro had been defined to hide this: #define __SYNC_rpt(type) (1 + (type == __SYNC_wmb)) which was intended to evaluate to 2 for __SYNC_wmb, and 1 for any other type of sync. However, this expression is evaluated by the assembler, and not the compiler, and the result of '==' in the assembler is 0 or -1, not 0 or 1 as it is in C. The net result was wmb() producing no code at all. The simple fix in this patch is to change the '+' to '-'. Fixes: bf92927251b3 ("MIPS: barrier: Add __SYNC() infrastructure") Signed-off-by: Mark Tomlinson Tested-by: Chris Packham Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 976c23af3ee5bd3447a7bfb6c356ceb4acf264a6 Author: Victor Kamensky Date: Tue Feb 11 11:24:34 2020 -0800 mips: vdso: add build time check that no 'jalr t9' calls left vdso shared object cannot have GOT based PIC 'jalr t9' calls because nobody set GOT table in vdso. Contributing into vdso .o files are compiled in PIC mode and as result for internal static functions calls compiler will generate 'jalr t9' instructions. Those are supposed to be converted into PC relative 'bal' calls by linker when relocation are processed. Mips global GOT entries do have dynamic relocations and they will be caught by cmd_vdso_check Makefile rule. Static PIC calls go through mips local GOT entries that do not have dynamic relocations. For those 'jalr t9' calls could be present but without dynamic relocations and they need to be converted to 'bal' calls by linker. Add additional build time check to make sure that no 'jalr t9' slip through because of some toolchain misconfiguration that prevents 'jalr t9' to 'bal' conversion. Signed-off-by: Victor Kamensky Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Ralf Baechle Cc: James Hogan Cc: Vincenzo Frascino Cc: bruce.ashfield@gmail.com Cc: richard.purdie@linuxfoundation.org commit 07015d7a103c4420b69a287b8ef4d2535c0f4106 Author: Paul Burton Date: Sat Feb 15 12:38:36 2020 -0800 MIPS: Disable VDSO time functionality on microMIPS A check we're about to add to pick up on function calls that depend on bogus use of the GOT in the VDSO picked up on instances of such function calls in microMIPS builds. Since the code appears genuinely problematic, and given the relatively small amount of use & testing that microMIPS sees, go ahead & disable the VDSO for microMIPS builds. Signed-off-by: Paul Burton commit da99f9355b53ebc565747d0072ff038f3d9fa875 Merge: 829e69446995 dfb9b69e3b84 Author: Linus Torvalds Date: Sat Feb 15 12:30:42 2020 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Fixes and HW enablement patches: - Tooling fixes, most of which are tooling header synchronization with v5.6 changes - Fix kprobes fallout on ARM - Add Intel Elkhart Lake support and extend Tremont support, these are relatively simple and should only affect those models - Fix the AMD family 17h generic event table" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) perf llvm: Fix script used to obtain kernel make directives to work with new kbuild tools headers kvm: Sync linux/kvm.h with the kernel sources tools headers kvm: Sync kvm headers with the kernel sources tools arch x86: Sync asm/cpufeatures.h with the kernel sources tools headers x86: Sync disabled-features.h tools include UAPI: Sync sound/asound.h copy tools headers UAPI: Sync asm-generic/mman-common.h with the kernel perf tools: Add arm64 version of get_cpuid() tools headers UAPI: Sync drm/i915_drm.h with the kernel sources tools headers uapi: Sync linux/fscrypt.h with the kernel sources tools headers UAPI: Sync sched.h with the kernel perf trace: Resolve prctl's 'option' arg strings to numbers perf beauty prctl: Export the 'options' strarray tools headers UAPI: Sync prctl.h with the kernel sources tools headers UAPI: Sync copy of arm64's asm/unistd.h with the kernel sources perf maps: Move kmap::kmaps setup to maps__insert() perf maps: Fix map__clone() for struct kmap perf maps: Mark ksymbol DSOs with kernel type perf maps: Mark module DSOs with kernel type tools include UAPI: Sync x86's syscalls_64.tbl, generic unistd.h and fcntl.h to pick up openat2 and pidfd_getfd ... commit d3f703c4359ff06619b2322b91f69710453e6b6d Author: Victor Kamensky Date: Tue Feb 11 11:24:33 2020 -0800 mips: vdso: fix 'jalr t9' crash in vdso code Observed that when kernel is built with Yocto mips64-poky-linux-gcc, and mips64-poky-linux-gnun32-gcc toolchain, resulting vdso contains 'jalr t9' instructions in its code and since in vdso case nobody sets GOT table code crashes when instruction reached. On other hand observed that when kernel is built mips-poky-linux-gcc toolchain, the same 'jalr t9' instruction are replaced with PC relative function calls using 'bal' instructions. The difference boils down to -mrelax-pic-calls and -mexplicit-relocs gcc options that gets different default values depending on gcc target triplets and corresponding binutils. -mrelax-pic-calls got enabled by default only in mips-poky-linux-gcc case. MIPS binutils ld relies on R_MIPS_JALR relocation to convert 'jalr t9' into 'bal' and such relocation is generated only if -mrelax-pic-calls option is on. Please note 'jalr t9' conversion to 'bal' can happen only to static functions. These static PIC calls use mips local GOT entries that are supposed to be filled with start of DSO value by run-time linker (missing in VDSO case) and they do not have dynamic relocations. Global mips GOT entries must have dynamic relocations and they should be prevented by cmd_vdso_check Makefile rule. Solution call out -mrelax-pic-calls and -mexplicit-relocs options explicitly while compiling MIPS vdso code. That would get correct and consistent between different toolchains behaviour. Reported-by: Bruce Ashfield Signed-off-by: Victor Kamensky Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Ralf Baechle Cc: James Hogan Cc: Vincenzo Frascino Cc: richard.purdie@linuxfoundation.org commit 29e8c8253d7d5265f58122c0a7902e26df6c6f61 Author: Fabrice Gasnier Date: Fri Feb 14 17:46:35 2020 +0100 iio: trigger: stm32-timer: disable master mode when stopping Master mode should be disabled when stopping. This mainly impacts possible other use-case after timer has been stopped. Currently, master mode remains set (from start routine). Fixes: 6fb34812c2a2 ("iio: stm32 trigger: Add support for TRGO2 triggers") Signed-off-by: Fabrice Gasnier Cc: Signed-off-by: Jonathan Cameron commit 3bf3c9744694803bd2d6f0ee70a6369b980530fd Author: Marek Behún Date: Sat Feb 15 15:21:30 2020 +0100 bus: moxtet: fix potential stack buffer overflow The input_read function declares the size of the hex array relative to sizeof(buf), but buf is a pointer argument of the function. The hex array is meant to contain hexadecimal representation of the bin array. Link: https://lore.kernel.org/r/20200215142130.22743-1-marek.behun@nic.cz Fixes: 5bc7f990cd98 ("bus: Add support for Moxtet bus") Signed-off-by: Marek Behún Reported-by: sohu0106 Signed-off-by: Olof Johansson commit d65d87a07476aa17df2dcb3ad18c22c154315bec Author: Theodore Ts'o Date: Fri Feb 14 18:11:19 2020 -0500 ext4: improve explanation of a mount failure caused by a misconfigured kernel If CONFIG_QFMT_V2 is not enabled, but CONFIG_QUOTA is enabled, when a user tries to mount a file system with the quota or project quota enabled, the kernel will emit a very confusing messsage: EXT4-fs warning (device vdc): ext4_enable_quotas:5914: Failed to enable quota tracking (type=0, err=-3). Please run e2fsck to fix. EXT4-fs (vdc): mount failed We will now report an explanatory message indicating which kernel configuration options have to be enabled, to avoid customer/sysadmin confusion. Link: https://lore.kernel.org/r/20200215012738.565735-1-tytso@mit.edu Google-Bug-Id: 149093531 Fixes: 7c319d328505b778 ("ext4: make quota as first class supported feature") Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit dfb9b69e3b84791e4c6b954ac3cc0c4a545484f2 Merge: f861854e1b43 62765941155e Author: Ingo Molnar Date: Sat Feb 15 09:35:11 2020 +0100 Merge tag 'perf-urgent-for-mingo-5.6-20200214' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: BPF: Arnaldo Carvalho de Melo: - Fix script used to obtain kernel make directives to work with new kbuild used for building BPF programs. maps: Jiri Olsa: - Fixup kmap->kmaps backpointer in kernel maps. arm64: John Garry: - Add arm64 version of get_cpuid() to get proper, arm64 specific output from 'perf list' and other tools. perf top: Kim Phillips: - Update kernel idle symbols so that output in AMD systems is in line with other systems. perf stat: Kim Phillips: - Don't report a null stalled cycles per insn metric. tools headers: Arnaldo Carvalho de Melo: - Sync tools/ headers with the kernel sources to get things like syscall numbers and new arguments so that 'perf trace' can decode and use them in tracepoint filters, e.g. prctl's new PR_{G,S}ET_IO_FLUSHER options. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 3dbae15538972c9e1578cb216964c2840361a538 Author: Gustavo A. R. Silva Date: Fri Feb 14 17:03:12 2020 -0800 Input: cyapa - replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200214172132.GA28389@embeddedor Signed-off-by: Dmitry Torokhov commit 94bef5d57992f9e987a9b7e8fa736ee204ac4f7a Author: Gustavo A. R. Silva Date: Fri Feb 14 17:02:11 2020 -0800 Input: tca6416-keypad - replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200214172022.GA27490@embeddedor Signed-off-by: Dmitry Torokhov commit 3d87c75d84e20d8812dbfba87e46ffca29d75d40 Author: Gustavo A. R. Silva Date: Fri Feb 14 17:01:46 2020 -0800 Input: gpio_keys_polled - replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200214171907.GA26588@embeddedor Signed-off-by: Dmitry Torokhov commit 829e6944699530c47739b5ef091f8137526c1494 Merge: cf556edfde6c 5d63944f8206 Author: Linus Torvalds Date: Fri Feb 14 14:46:11 2020 -0800 Merge tag 'nfs-for-5.6-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client bugfixes from Anna Schumaker: "The only stable fix this time is the DMA scatter-gather list bug fixed by Chuck. The rest fix up races and refcounting issues that have been found during testing. Stable fix: - fix DMA scatter-gather list mapping imbalance The rest: - fix directory verifier races - fix races between open and dentry revalidation - fix revalidation of dentries with delegations - fix "cachethis" setting for writes - fix delegation and delegation cred pinning" * tag 'nfs-for-5.6-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4: Ensure the delegation cred is pinned when we call delegreturn NFSv4: Ensure the delegation is pinned in nfs_do_return_delegation() NFSv4.1 make cachethis=no for writes xprtrdma: Fix DMA scatter-gather list mapping imbalance NFSv4: Fix revalidation of dentries with delegations NFSv4: Fix races between open and dentry revalidation NFS: Fix up directory verifier races commit cf556edfde6cfc293ce63de02ac23f725e41dfb1 Merge: ca60ad6a6bc4 3b20bc2fe4c0 Author: Linus Torvalds Date: Fri Feb 14 14:42:31 2020 -0800 Merge tag 'ceph-for-5.6-rc2' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: - make O_DIRECT | O_APPEND combination work better - redo the server path canonicalization patch that went into -rc1 - fix the 'noacl' mount option that got broken by the conversion to the new mount API in 5.5 * tag 'ceph-for-5.6-rc2' of https://github.com/ceph/ceph-client: ceph: noacl mount option is effectively ignored ceph: canonicalize server path in place ceph: do not execute direct write in parallel if O_APPEND is specified commit 807b9515b7d044cf77df31f1af9d842a76ecd5cb Author: Bart Van Assche Date: Wed Feb 12 21:09:00 2020 -0800 scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session" Since commit e9d3009cb936 introduced a regression and since the fix for that regression was not perfect, revert this commit. Link: https://marc.info/?l=target-devel&m=158157054906195 Cc: Rahul Kundu Cc: Mike Marciniszyn Cc: Sagi Grimberg Reported-by: Dakshaja Uppalapati Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session") Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 76261ada16dcc3be610396a46d35acc3efbda682 Author: Bart Van Assche Date: Wed Feb 12 21:08:59 2020 -0800 scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout" Since commit 04060db41178 introduces soft lockups when toggling network interfaces, revert it. Link: https://marc.info/?l=target-devel&m=158157054906196 Cc: Rahul Kundu Cc: Mike Marciniszyn Cc: Sagi Grimberg Reported-by: Dakshaja Uppalapati Fixes: 04060db41178 ("scsi: RDMA/isert: Fix a recently introduced regression related to logout") Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit ca60ad6a6bc4aa88c02c6f103dd80df54689ea4d Merge: 2019fc96af22 2ca10259b418 Author: Linus Torvalds Date: Fri Feb 14 13:47:02 2020 -0800 Merge tag 'io_uring-5.6-2020-02-14' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Here's a set of fixes for io_uring: - Various fixes with cleanups from Pavel, fixing corner cases where we're not correctly dealing with iovec cleanup. - Clarify that statx/openat/openat2 don't accept fixed files - Buffered raw device write EOPTNOTSUPP fix - Ensure async workers grab current->fs - A few task exit fixes with pending requests that grab the file table - send/recvmsg async load fix - io-wq offline node setup fix - CQ overflow flush in poll" * tag 'io_uring-5.6-2020-02-14' of git://git.kernel.dk/linux-block: (21 commits) io_uring: prune request from overflow list on flush io-wq: don't call kXalloc_node() with non-online node io_uring: retain sockaddr_storage across send/recvmsg async punt io_uring: cancel pending async work if task exits io-wq: add io_wq_cancel_pid() to cancel based on a specific pid io-wq: make io_wqe_cancel_work() take a match handler io_uring: fix openat/statx's filename leak io_uring: fix double prep iovec leak io_uring: fix async close() with f_op->flush() io_uring: allow AT_FDCWD for non-file openat/openat2/statx io_uring: grab ->fs as part of async preparation io-wq: add support for inheriting ->fs io_uring: retry raw bdev writes if we hit -EOPNOTSUPP io_uring: add cleanup for openat()/statx() io_uring: fix iovec leaks io_uring: remove unused struct io_async_open io_uring: flush overflowed CQ events in the io_uring_poll() io_uring: statx/openat/openat2 don't support fixed files io_uring: fix deferred req iovec leak io_uring: fix 1-bit bitfields to be unsigned ... commit 2019fc96af228b412bdb2e8e0ad4b1fc12046a51 Merge: 4e03e4e6d2a0 a1fa83bdab78 Author: Linus Torvalds Date: Fri Feb 14 12:40:38 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix interrupt name truncation in mv88e6xxx dsa driver, from Andrew Lunn. 2) Process generic XDP even if SKB is cloned, from Toke Høiland-Jørgensen. 3) Fix leak of kernel memory to userspace in smc, from Eric Dumazet. 4) Add some missing netlink attribute validation to matchall and flower, from Davide Caratti. 5) Send icmp responses properly when NAT has been applied to the frame before we get to the tunnel emitting the icmp, from Jason Donenfeld. 6) Make sure there is enough SKB headroom when adding dsa tags for qca and ar9331. From Per Forlin. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (62 commits) netdevice.h: fix all kernel-doc and Sphinx warnings net: dsa: tag_ar9331: Make sure there is headroom for tag net: dsa: tag_qca: Make sure there is headroom for tag net, ip6_tunnel: enhance tunnel locate with link check net/smc: no peer ID in CLC decline for SMCD net/smc: transfer fasync_list in case of fallback net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples() net: hns3: fix VF bandwidth does not take effect in some case net: hns3: add management table after IMP reset mac80211: fix wrong 160/80+80 MHz setting cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE xfrm: interface: use icmp_ndo_send helper wireguard: device: use icmp_ndo_send helper sunvnet: use icmp_ndo_send helper gtp: use icmp_ndo_send helper icmp: introduce helper for nat'd source address in network device context net/sched: flower: add missing validation of TCA_FLOWER_FLAGS net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS net/flow_dissector: remove unexist field description page_pool: refill page when alloc.count of pool is zero ... commit 4e03e4e6d2a03a9f2edeefaec12d4f336dee824d Merge: 81f3011cbf50 3629ac5b9253 Author: Linus Torvalds Date: Fri Feb 14 12:34:30 2020 -0800 Merge tag 'pm-5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Fix three issues related to the handling of wakeup events signaled through the ACPI SCI while suspended to idle (Rafael Wysocki) and unexport an internal cpufreq variable (Yangtao Li)" * tag 'pm-5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system ACPICA: Introduce acpi_any_gpe_status_set() ACPI: PM: s2idle: Avoid possible race related to the EC GPE ACPI: EC: Fix flushing of pending work cpufreq: Make cpufreq_global_kobject static commit 81f3011cbf501fef3a954821dbc362084f6b686b Merge: 3f0d329371c0 0fbb027b44e7 Author: Linus Torvalds Date: Fri Feb 14 12:27:54 2020 -0800 Merge tag 'sound-5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The only common change is the regression fix of the previous PCM fix patch for managed buffers while the rest are usual suspects, USB-audio and HD-audio device-specific quirks. The change for UAC2 clock validation workaround became a bit big, but the changes are fairly straightforward" * tag 'sound-5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: Fix double hw_free calls ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000 ALSA: hda/realtek - Fix silent output on MSI-GL73 ALSA: hda/realtek - Add more codec supported Headset Button ALSA: usb-audio: Apply sample rate quirk for Audioengine D1 ALSA: usb-audio: Fix UAC2/3 effect unit parsing ALSA: usb-audio: Apply 48kHz fixed rate playback for Jabra Evolve 65 headset commit 3f0d329371c08dfa3227f1716e522f3a8a081155 Merge: b19e8c684703 6f4134b30b6e Author: Linus Torvalds Date: Fri Feb 14 12:23:16 2020 -0800 Merge tag 'drm-fixes-2020-02-14' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "The core has a build fix for edid code on certain compilers/arches/, one MST fix and one vgem fix. Regular amdgpu fixes, and a couple of small driver fixes. The i915 fixes are bit larger than normal for this stage, but they were having CI issues last week, and they hadn't sent any fixes last week due to this. core: - edid build fix mst: - fix NULL ptr deref vgem: - fix close after free msm: - better dma-api usage sun4i: - disable allow_fb_modifiers amdgpu: - Additional OD fixes for navi - Misc display fixes - VCN 2.5 DPG fix - Prevent build errors on PowerPC on some configs - GDS EDC fix i915: - dsi/acpi fixes - gvt locking and allocation fixes - gem/gt fixes - bios timing parameters fix" * tag 'drm-fixes-2020-02-14' of git://anongit.freedesktop.org/drm/drm: (50 commits) drm/i915: Mark the removal of the i915_request from the sched.link drm/i915/execlists: Reclaim the hanging virtual request drm/i915/execlists: Take a reference while capturing the guilty request drm/i915/execlists: Offline error capture drm/i915/gt: Allow temporary suspension of inflight requests drm/i915: Keep track of request among the scheduling lists drm/i915/gem: Tighten checks and acquiring the mmap object drm/i915: Fix preallocated barrier list append drm/i915/gt: Acquire ce->active before ce->pin_count/ce->pin_mutex drm/i915: Tighten atomicity of i915_active_acquire vs i915_active_release drm/i915: Stub out i915_gpu_coredump_put drm/amdgpu:/navi10: use the ODCAP enum to index the caps array drm/amdgpu: update smu_v11_0_pptable.h drm/amdgpu: correct comment to clear up the confusion drm/amd/display: DCN2.x Do not program DPPCLK if same value drm/amd/display: Don't map ATOM_ENABLE to ATOM_INIT drm/amdgpu/vcn2.5: fix warning drm/amdgpu: limit GDS clearing workaround in cold boot sequence drm/amdgpu: fix amdgpu pmu to use hwc->config instead of hwc->conf amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags ... commit 2c2a7552dd6465e8fde6bc9cccf8d66ed1c1eb72 Author: Aditya Pakki Date: Fri Feb 14 12:21:01 2020 -0600 ecryptfs: replace BUG_ON with error handling code In crypt_scatterlist, if the crypt_stat argument is not set up correctly, the kernel crashes. Instead, by returning an error code upstream, the error is handled safely. The issue is detected via a static analysis tool written by us. Fixes: 237fead619984 (ecryptfs: fs/Makefile and fs/Kconfig) Signed-off-by: Aditya Pakki Signed-off-by: Tyler Hicks commit f8e48a8408f5e23dd514916fda128a87e34f8ffd Author: Tyler Hicks Date: Thu Feb 13 21:25:54 2020 +0000 eCryptfs: Replace deactivated email address Replace a recently deactived email address with one that I'll be able to personally control and keep alive. Signed-off-by: Tyler Hicks commit 726464596b5d3f10b7c655129a62168e5c17d60c Author: Tyler Hicks Date: Wed Feb 12 23:35:03 2020 +0000 MAINTAINERS: eCryptfs: Update maintainer address and downgrade status Adjust my email address to a personal account. Downgrade the status of eCryptfs maintenance to 'Odd Fixes' since it has not been part of my work responsibilities recently and I've had little personal time to devote to it. eCryptfs hasn't seen active development in some time. New deployments of file level encryption should use more modern solutions, such as fscrypt, where possible. Signed-off-by: Tyler Hicks commit 685eff513183d6d64a5f413531e683d23b8b198b Author: Jason Gunthorpe Date: Thu Feb 6 10:27:54 2020 -0400 IB/mlx5: Use div64_u64 for num_var_hw_entries calculation On i386: ERROR: "__udivdi3" [drivers/infiniband/hw/mlx5/mlx5_ib.ko] undefined! ERROR: "__divdi3" [drivers/infiniband/hw/mlx5/mlx5_ib.ko] undefined! Fixes: f164be8c0366 ("IB/mlx5: Extend caps stage to handle VAR capabilities") Reported-by: Randy Dunlap Acked-by: Randy Dunlap # build-tested Reported-by: Alexander Lobakin Signed-off-by: Jason Gunthorpe commit b08c3ed609aabc4e76e74edc4404f0c26279d7ed Author: Alex Deucher Date: Wed Feb 12 08:52:32 2020 -0500 drm/amdgpu/gfx10: disable gfxoff when reading rlc clock Otherwise we readback all ones. Fixes rlc counter readback while gfxoff is active. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 120cf959308e1bda984e40a9edd25ee2d6262efd Author: Alex Deucher Date: Wed Feb 12 08:51:29 2020 -0500 drm/amdgpu/gfx9: disable gfxoff when reading rlc clock Otherwise we readback all ones. Fixes rlc counter readback while gfxoff is active. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c657b936ea98630ef5ba4f130ab1ad5c534d0165 Author: Alex Deucher Date: Wed Feb 12 01:46:16 2020 -0500 drm/amdgpu/soc15: fix xclk for raven It's 25 Mhz (refclk / 4). This fixes the interpretation of the rlc clock counter. Acked-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit aad4e2dbe543bc1633bc208ac7bddc4f0bb185ba Author: Evan Quan Date: Tue Feb 11 12:39:53 2020 +0800 drm/amd/powerplay: always refetch the enabled features status on dpm enablement Otherwise, the cached dpm features status may be inconsistent under some case(e.g. baco reset of Navi asic). Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit c6f8c440441029d5621ee5153676243234a4b76e Author: Bhawanpreet Lakha Date: Fri Feb 7 10:41:20 2020 -0500 drm/amd/display: fix dtm unloading there was a type in the terminate command. We should be calling psp_dtm_unload() instead of psp_hdcp_unload() Fixes: 143f23053333 ("drm/amdgpu: psp DTM init") Signed-off-by: Bhawanpreet Lakha Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 43064f5c8b8818e35fa254496ef00aabd63d547a Author: Bhawanpreet Lakha Date: Thu Feb 6 14:26:38 2020 -0500 drm/amd/display: fix backwards byte order in rx_caps. We were using incorrect byte order after we started using the drm_defines So fix it. Fixes: 02837a91ae75 ("drm/amd/display: add and use defines from drm_hdcp.h") Signed-off-by: JinZe.Xu Signed-off-by: Bhawanpreet Lakha Reviewed-by: Wenjing Liu Signed-off-by: Alex Deucher commit f25372ffc3f6c2684b57fb718219137e6ee2b64c Author: Yi Zhang Date: Fri Feb 14 18:48:02 2020 +0800 nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info nvme fw-activate operation will get bellow warning log, fix it by update the parameter order [ 113.231513] nvme nvme0: Get FW SLOT INFO log error Fixes: 0e98719b0e4b ("nvme: simplify the API for getting log pages") Reported-by: Sujith Pandel Reviewed-by: David Milburn Signed-off-by: Yi Zhang Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit fa46c6fb5d61b1f17b06d7c6ef75478b576304c7 Author: Keith Busch Date: Thu Feb 13 01:41:05 2020 +0900 nvme/pci: move cqe check after device shutdown Many users have reported nvme triggered irq_startup() warnings during shutdown. The driver uses the nvme queue's irq to synchronize scanning for completions, and enabling an interrupt affined to only offline CPUs triggers the alarming warning. Move the final CQE check to after disabling the device and all registered interrupts have been torn down so that we do not have any IRQ to synchronize. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206509 Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit 97b2512ad000a409b4073dd1a71e4157d76675cb Author: Nigel Kirkland Date: Mon Feb 10 16:01:45 2020 -0800 nvme: prevent warning triggered by nvme_stop_keep_alive Delayed keep alive work is queued on system workqueue and may be cancelled via nvme_stop_keep_alive from nvme_reset_wq, nvme_fc_wq or nvme_wq. Check_flush_dependency detects mismatched attributes between the work-queue context used to cancel the keep alive work and system-wq. Specifically system-wq does not have the WQ_MEM_RECLAIM flag, whereas the contexts used to cancel keep alive work have WQ_MEM_RECLAIM flag. Example warning: workqueue: WQ_MEM_RECLAIM nvme-reset-wq:nvme_fc_reset_ctrl_work [nvme_fc] is flushing !WQ_MEM_RECLAIM events:nvme_keep_alive_work [nvme_core] To avoid the flags mismatch, delayed keep alive work is queued on nvme_wq. However this creates a secondary concern where work and a request to cancel that work may be in the same work queue - namely err_work in the rdma and tcp transports, which will want to flush/cancel the keep alive work which will now be on nvme_wq. After reviewing the transports, it looks like err_work can be moved to nvme_reset_wq. In fact that aligns them better with transition into RESETTING and performing related reset work in nvme_reset_wq. Change nvme-rdma and nvme-tcp to perform err_work in nvme_reset_wq. Signed-off-by: Nigel Kirkland Signed-off-by: James Smart Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit 2d570a7c0251c594489a2c16b82b14ae30345c03 Author: Anton Eidelman Date: Mon Feb 10 10:37:18 2020 -0800 nvme/tcp: fix bug on double requeue when send fails When nvme_tcp_io_work() fails to send to socket due to connection close/reset, error_recovery work is triggered from nvme_tcp_state_change() socket callback. This cancels all the active requests in the tagset, which requeues them. The failed request, however, was ended and thus requeued individually as well unless send returned -EPIPE. Another return code to be treated the same way is -ECONNRESET. Double requeue caused BUG_ON(blk_queued_rq(rq)) in blk_mq_requeue_request() from either the individual requeue of the failed request or the bulk requeue from blk_mq_tagset_busy_iter(, nvme_cancel_request, ); Signed-off-by: Anton Eidelman Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit 85db6b7ae65f33be4bb44f1c28261a3faa126437 Author: Ronnie Sahlberg Date: Thu Feb 13 12:14:47 2020 +1000 cifs: make sure we do not overflow the max EA buffer size RHBZ: 1752437 Before we add a new EA we should check that this will not overflow the maximum buffer we have available to read the EAs back. Otherwise we can get into a situation where the EAs are so big that we can not read them back to the client and thus we can not list EAs anymore or delete them. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French CC: Stable commit 2c6251ad91afc2e3c671c904702e8d121d3d50c0 Author: Steve French Date: Wed Feb 12 22:37:08 2020 -0600 cifs: enable change notification for SMB2.1 dialect It was originally enabled only for SMB3 or later dialects, but had requests to add it to SMB2.1 mounts as well given the large number of systems at that dialect level. Signed-off-by: Steve French Reported-by: L Walsh Acked-by: Ronnie Sahlberg commit 8f486296459c084b106d907414540301bd9485fd Author: Tzung-Bi Shih Date: Fri Feb 14 18:57:43 2020 +0800 ASoC: dapm: remove snd_soc_dapm_put_enum_double_locked Reverts commit 839284e79482 ("ASoC: dapm: add snd_soc_dapm_put_enum_double_locked"). Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200214105744.82258-3-tzungbi@google.com Signed-off-by: Mark Brown commit 4b8a1ca4628343829f373bf0d4e087fe50c451e5 Author: Tzung-Bi Shih Date: Fri Feb 14 18:57:42 2020 +0800 ASoC: max98090: revert invalid fix for handling SHDN Reverts commit 62d5ae4cafb7 ("ASoC: max98090: save and restore SHDN when changing sensitive registers"). A critical side-effect was observed: when keep playing something, the recorded sound has chance to break (clipping). Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200214105744.82258-2-tzungbi@google.com Signed-off-by: Mark Brown commit a1fa83bdab784fa0ff2e92870011c0dcdbd2f680 Author: Randy Dunlap Date: Wed Feb 12 22:28:20 2020 -0800 netdevice.h: fix all kernel-doc and Sphinx warnings Eliminate all kernel-doc and Sphinx warnings in . Fixes these warnings: ../include/linux/netdevice.h:2100: warning: Function parameter or member 'gso_partial_features' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'l3mdev_ops' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'xfrmdev_ops' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'tlsdev_ops' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'name_assign_type' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'ieee802154_ptr' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'mpls_ptr' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'xdp_prog' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'gro_flush_timeout' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'xdp_bulkq' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'xps_cpus_map' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'xps_rxqs_map' not described in 'net_device' ../include/linux/netdevice.h:2100: warning: Function parameter or member 'qdisc_hash' not described in 'net_device' ../include/linux/netdevice.h:3552: WARNING: Inline emphasis start-string without end-string. ../include/linux/netdevice.h:3552: WARNING: Inline emphasis start-string without end-string. Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 3ea89fa795c5e994141a21ea6d68d5a2d5fe8780 Merge: 5fdcce211b3a ddc9abaf5d99 Author: David S. Miller Date: Fri Feb 14 07:34:51 2020 -0800 Merge branch 'dsa-headroom' Per Forlin says: ==================== net: dsa: Make sure there is headroom for tag Sorry for re-posting yet another time.... I manage to include multiple email-senders and forgot to include cover-letter. Let's hope everyhthing is in order this time. Fix two tag drivers to make sure there is headroom for the tag data. ==================== Signed-off-by: David S. Miller commit ddc9abaf5d9924569afe09a605c9012089d0c25b Author: Per Forlin Date: Thu Feb 13 15:37:10 2020 +0100 net: dsa: tag_ar9331: Make sure there is headroom for tag Passing tag size to skb_cow_head will make sure there is enough headroom for the tag data. This change does not introduce any overhead in case there is already available headroom for tag. Signed-off-by: Per Forlin Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 04fb91243a853dbde216d829c79d9632e52aa8d9 Author: Per Forlin Date: Thu Feb 13 15:37:09 2020 +0100 net: dsa: tag_qca: Make sure there is headroom for tag Passing tag size to skb_cow_head will make sure there is enough headroom for the tag data. This change does not introduce any overhead in case there is already available headroom for tag. Signed-off-by: Per Forlin Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 5fdcce211b3a41c3fed229333027f59a94a2f265 Author: William Dauchy Date: Thu Feb 13 18:19:22 2020 +0100 net, ip6_tunnel: enhance tunnel locate with link check With ipip, it is possible to create an extra interface explicitly attached to a given physical interface: # ip link show tunl0 4: tunl0@NONE: mtu 1480 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ipip 0.0.0.0 brd 0.0.0.0 # ip link add tunl1 type ipip dev eth0 # ip link show tunl1 6: tunl1@eth0: mtu 1480 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ipip 0.0.0.0 brd 0.0.0.0 But it is not possible with ip6tnl: # ip link show ip6tnl0 5: ip6tnl0@NONE: mtu 1452 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/tunnel6 :: brd :: # ip link add ip6tnl1 type ip6tnl dev eth0 RTNETLINK answers: File exists This patch aims to make it possible by adding link comparaison in both tunnel locate and lookup functions; we also modify mtu calculation when attached to an interface with a lower mtu. This permits to make use of x-netns communication by moving the newly created tunnel in a given netns. Signed-off-by: William Dauchy Reviewed-by: Nicolas Dichtel Signed-off-by: David S. Miller commit bab8f1ff17da0701bb580fcb025de6fca0da3dcf Merge: 6f4ecbe284df f24667779b53 Author: Olof Johansson Date: Fri Feb 14 07:24:38 2020 -0800 Merge tag 'sti-dt-for-5.7-round1' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti into arm/fixes STi dt fixes: ------------- - remove deprecated Synopsys PHY dt properties - fix sound frame-inversion property * tag 'sti-dt-for-5.7-round1' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti: ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi ARM: dts: sti: Remove deprecated snps PHY properties for stih410-b2260 Link: https://lore.kernel.org/r/afe20a6d-061b-a93c-2e60-206b0e8d0f81@st.com Signed-off-by: Olof Johansson commit b32cb6fcf1f81449a388f3fd2be14454a2c644da Merge: 907e51e41ad9 33181ea7f5a6 Author: David S. Miller Date: Fri Feb 14 07:16:08 2020 -0800 Merge tag 'mac80211-for-net-2020-02-14' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just a few fixes: * avoid running out of tracking space for frames that need to be reported to userspace by using more bits * fix beacon handling suppression by adding some relevant elements to the CRC calculation * fix quiet mode in action frames * fix crash in ethtool for virt_wifi and similar * add a missing policy entry * fix 160 & 80+80 bandwidth to take local capabilities into account ==================== Signed-off-by: David S. Miller commit 907e51e41ad9061b49811750475bfeb75c0f2b3c Merge: dc221a28d094 369537c97024 Author: David S. Miller Date: Fri Feb 14 07:09:36 2020 -0800 Merge branch 'smc-fixes' Karsten Graul says: ==================== net/smc: fixes for -net Fix a syzbot finding and a problem with the CLC handshake content. ==================== Signed-off-by: David S. Miller commit 369537c97024dca99303a8d4d6ab38b4f54d3909 Author: Ursula Braun Date: Fri Feb 14 08:59:00 2020 +0100 net/smc: no peer ID in CLC decline for SMCD Just SMCR requires a CLC Peer ID, but not SMCD. The field should be zero for SMCD. Fixes: c758dfddc1b5 ("net/smc: add SMC-D support in CLC messages") Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 67f562e3e147750a02b2a91d21a163fc44a1d13e Author: Ursula Braun Date: Fri Feb 14 08:58:59 2020 +0100 net/smc: transfer fasync_list in case of fallback SMC does not work together with FASTOPEN. If sendmsg() is called with flag MSG_FASTOPEN in SMC_INIT state, the SMC-socket switches to fallback mode. To handle the previous ioctl FIOASYNC call correctly in this case, it is necessary to transfer the socket wait queue fasync_list to the internal TCP socket. Reported-by: syzbot+4b1fe8105f8044a26162@syzkaller.appspotmail.com Fixes: ee9dfbef02d18 ("net/smc: handle sockopts forcing fallback") Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit dc221a28d0944f1a28755caa66bf58bfa47e26d1 Merge: 803381f9f117 47327c9315b2 Author: David S. Miller Date: Fri Feb 14 07:05:18 2020 -0800 Merge branch 'hns3-fixes' Huazhong Tan says: ==================== net: hns3: fixes for -net This series includes three bugfixes for the HNS3 ethernet driver. [patch 1] fixes a management table lost issue after IMP reset. [patch 2] fixes a VF bandwidth configuration not work problem. [patch 3] fixes a problem related to IPv6 address copying. ==================== Signed-off-by: David S. Miller commit 47327c9315b2f3ae4ab659457977a26669631f20 Author: Guangbin Huang Date: Fri Feb 14 09:53:43 2020 +0800 net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples() The IPv6 address defined in struct in6_addr is specified as big endian, but there is no specified endian in struct hclge_fd_rule_tuples, so it will cause a problem if directly use memcpy() to copy ipv6 address between these two structures since this field in struct hclge_fd_rule_tuples is little endian. This patch fixes this problem by using be32_to_cpu() to convert endian of IPv6 address of struct in6_addr before copying. Fixes: d93ed94fbeaf ("net: hns3: add aRFS support for PF") Signed-off-by: Guangbin Huang Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 19eb1123b4e9337fe20b1763fec528f837ec6568 Author: Yonglong Liu Date: Fri Feb 14 09:53:42 2020 +0800 net: hns3: fix VF bandwidth does not take effect in some case When enabling 4 TC after setting the bandwidth of VF, the bandwidth of VF will resume to default value, because of the qset resources changed in this case. This patch fixes it by using a fixed VF's qset resources according to HNAE3_MAX_TC macro. Fixes: ee9e44248f52 ("net: hns3: add support for configuring bandwidth of VF on the host") Signed-off-by: Yonglong Liu Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit d0db7ed397517c8b2be24a0d1abfa15df776908e Author: Yufeng Mo Date: Fri Feb 14 09:53:41 2020 +0800 net: hns3: add management table after IMP reset In the current process, the management table is missing after the IMP reset. This patch adds the management table to the reset process. Fixes: f5aac71c0327 ("net: hns3: add manager table initialization for hardware") Signed-off-by: Yufeng Mo Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit dfa9a5efe8b932a84b3b319250aa3ac60c20f876 Author: Takashi Iwai Date: Fri Feb 14 12:13:16 2020 +0100 ALSA: rawmidi: Avoid bit fields for state flags The rawmidi state flags (opened, append, active_sensing) are stored in bit fields that can be potentially racy when concurrently accessed without any locks. Although the current code should be fine, there is also no any real benefit by keeping the bitfields for this kind of short number of members. This patch changes those bit fields flags to the simple bool fields. There should be no size increase of the snd_rawmidi_substream by this change. Reported-by: syzbot+576cc007eb9f2c968200@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20200214111316.26939-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit dc7497795e014d84699c3b8809ed6df35352dd74 Author: Takashi Iwai Date: Fri Feb 14 12:13:15 2020 +0100 ALSA: seq: Fix concurrent access to queue current tick/time snd_seq_check_queue() passes the current tick and time of the given queue as a pointer to snd_seq_prioq_cell_out(), but those might be updated concurrently by the seq timer update. Fix it by retrieving the current tick and time via the proper helper functions at first, and pass those values to snd_seq_prioq_cell_out() later in the loops. snd_seq_timer_get_cur_time() takes a new argument and adjusts with the current system time only when it's requested so; this update isn't needed for snd_seq_check_queue(), as it's called either from the interrupt handler or right after queuing. Also, snd_seq_timer_get_cur_tick() is changed to read the value in the spinlock for the concurrency, too. Reported-by: syzbot+fd5e0eaa1a32999173b2@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20200214111316.26939-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit bb51e669fa49feb5904f452b2991b240ef31bc97 Author: Takashi Iwai Date: Fri Feb 14 12:13:14 2020 +0100 ALSA: seq: Avoid concurrent access to queue flags The queue flags are represented in bit fields and the concurrent access may result in unexpected results. Although the current code should be mostly OK as it's only reading a field while writing other fields as KCSAN reported, it's safer to cover both with a proper spinlock protection. This patch fixes the possible concurrent read by protecting with q->owner_lock. Also the queue owner field is protected as well since it's the field to be protected by the lock itself. Reported-by: syzbot+65c6c92d04304d0a8efc@syzkaller.appspotmail.com Reported-by: syzbot+e60ddfa48717579799dd@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20200214111316.26939-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 62765941155e487b351a72479078bd6fec973563 Author: Arnaldo Carvalho de Melo Date: Fri Feb 14 09:34:43 2020 -0300 perf llvm: Fix script used to obtain kernel make directives to work with new kbuild Before this patch: # ./perf test 39 41 39: LLVM search and compile : 39.1: Basic BPF llvm compile : Ok 39.2: kbuild searching : FAILED! 39.3: Compile source for BPF prologue generation : Skip 39.4: Compile source for BPF relocation : Skip 41: BPF filter : 41.1: Basic BPF filtering : Ok 41.2: BPF pinning : Ok 41.3: BPF prologue generation : FAILED! 41.4: BPF relocation checker : Skip # Using 'perf test -v' for these tests shows that it is not finding uapi/linux/fs.h, which ends up being because we don't setup the right header path. Fix it. After this patch: # perf test 39 41 39: LLVM search and compile : 39.1: Basic BPF llvm compile : Ok 39.2: kbuild searching : Ok 39.3: Compile source for BPF prologue generation : Ok 39.4: Compile source for BPF relocation : Ok 41: BPF filter : 41.1: Basic BPF filtering : Ok 41.2: BPF pinning : Ok 41.3: BPF prologue generation : Ok 41.4: BPF relocation checker : Ok # Longer description: In llvm-utils.c we use some techniques to obtain the kbuild make directives and that recently stopped working as now 'ar' gets called and expects to find the dummy.o used to echo these variables: $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(EXTRA_CFLAGS) Add the $(CC) line to satisfy that, making sure this works with all kernels, i.e. preserving the temp directory and files in it used for this technique we can see that it works everywhere: # make -s -C /lib/modules/5.4.18-100.fc30.x86_64/build M=/tmp/tmp.qgaFHgxjZ4/ clean # ls -la /tmp/tmp.qgaFHgxjZ4/ total 4 drwx------. 2 root root 80 Feb 14 09:42 . drwxrwxrwt. 47 root root 1200 Feb 14 09:42 .. -rw-r--r--. 1 root root 0 Feb 13 17:14 dummy.c -rw-r--r--. 1 root root 121 Feb 13 17:14 Makefile # # cat /tmp/tmp.qgaFHgxjZ4/Makefile obj-y := dummy.o $(obj)/%.o: $(src)/%.c @echo -n "$(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(EXTRA_CFLAGS)" $(CC) -c -o $@ $< # Then build with an old kernel Makefile: # make -s -C /lib/modules/5.4.18-100.fc30.x86_64/build M=/tmp/tmp.qgaFHgxjZ4/ dummy.o -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/9/include -I./arch/x86/include -I./arch/x86/include/generated -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/kconfig.h # # ls -la /tmp/tmp.qgaFHgxjZ4/ total 8 drwx------. 2 root root 100 Feb 14 09:43 . drwxrwxrwt. 47 root root 1200 Feb 14 09:43 .. -rw-r--r--. 1 root root 0 Feb 13 17:14 dummy.c -rw-r--r--. 1 root root 936 Feb 14 09:43 dummy.o -rw-r--r--. 1 root root 121 Feb 13 17:14 Makefile # And a new one: # make -s -C /lib/modules/5.4.18-100.fc30.x86_64/build M=/tmp/tmp.qgaFHgxjZ4/ clean # ls -la /tmp/tmp.qgaFHgxjZ4/ total 4 drwx------. 2 root root 80 Feb 14 09:43 . drwxrwxrwt. 47 root root 1200 Feb 14 09:43 .. -rw-r--r--. 1 root root 0 Feb 13 17:14 dummy.c -rw-r--r--. 1 root root 121 Feb 13 17:14 Makefile # make -s -C /lib/modules/5.6.0-rc1+/build M=/tmp/tmp.qgaFHgxjZ4/ dummy.o -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/9/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h # # ls -la /tmp/tmp.qgaFHgxjZ4/ total 16 drwx------. 2 root root 160 Feb 14 09:44 . drwxrwxrwt. 47 root root 1200 Feb 14 09:44 .. -rw-r--r--. 1 root root 158 Feb 14 09:44 built-in.a -rw-r--r--. 1 root root 149 Feb 14 09:44 .built-in.a.cmd -rw-r--r--. 1 root root 0 Feb 13 17:14 dummy.c -rw-r--r--. 1 root root 936 Feb 14 09:44 dummy.o -rw-r--r--. 1 root root 121 Feb 13 17:14 Makefile -rw-r--r--. 1 root root 0 Feb 14 09:44 modules.order # Reported-by: Thomas Richter Tested-by: Thomas Richter Cc: Adrian Hunter Cc: Daniel Borkmann Cc: He Kuang Cc: Jiri Olsa Cc: Masahiro Yamada Cc: Namhyung Kim Cc: Sumanth Korikkar Cc: Vasily Gorbik Cc: Wang Nan Cc: Zefan Li Link: https://www.spinics.net/lists/linux-perf-users/msg10600.html Signed-off-by: Arnaldo Carvalho de Melo commit 3629ac5b92535793ba6226e243c2324a20c35fae Merge: fdde0ff8590b 183edb20e60a Author: Rafael J. Wysocki Date: Fri Feb 14 10:40:48 2020 +0100 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: Make cpufreq_global_kobject static commit 33181ea7f5a62a17fbe55f0f73428ecb5e686be8 Author: Shay Bar Date: Mon Feb 10 15:07:28 2020 +0200 mac80211: fix wrong 160/80+80 MHz setting Before this patch, STA's would set new width of 160/80+80 MHz based on AP capability only. This is wrong because STA may not support > 80MHz BW. Fix is to verify STA has 160/80+80 MHz capability before increasing its width to > 80MHz. The "support_80_80" and "support_160" setting is based on: "Table 9-272 — Setting of the Supported Channel Width Set subfield and Extended NSS BW Support subfield at a STA transmitting the VHT Capabilities Information field" From "Draft P802.11REVmd_D3.0.pdf" Signed-off-by: Aviad Brikman Signed-off-by: Shay Bar Link: https://lore.kernel.org/r/20200210130728.23674-1-shay.bar@celeno.com Signed-off-by: Johannes Berg commit ea75080110a4c1fa011b0a73cb8f42227143ee3e Author: Sergey Matyukevich Date: Thu Feb 13 13:16:16 2020 +0000 cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE The nl80211_policy is missing for NL80211_ATTR_STATUS_CODE attribute. As a result, for strictly validated commands, it's assumed to not be supported. Signed-off-by: Sergey Matyukevich Link: https://lore.kernel.org/r/20200213131608.10541-2-sergey.matyukevich.os@quantenna.com Signed-off-by: Johannes Berg commit be0aba826c4a6ba5929def1962a90d6127871969 Author: Kai-Heng Feng Date: Fri Feb 14 14:53:07 2020 +0800 HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override The Surfbook E11B uses the SIPODEV SP1064 touchpad, which does not supply descriptors, so it has to be added to the override list. BugLink: https://bugs.launchpad.net/bugs/1858299 Signed-off-by: Kai-Heng Feng Reviewed-by: Hans de Goede Signed-off-by: Benjamin Tissoires commit cba6437a1854fde5934098ec3bd0ee83af3129f5 Author: Thomas Gleixner Date: Wed Feb 12 12:19:41 2020 +0100 genirq/proc: Reject invalid affinity masks (again) Qian Cai reported that the WARN_ON() in the x86/msi affinity setting code, which catches cases where the affinity setting is not done on the CPU which is the current target of the interrupt, triggers during CPU hotplug stress testing. It turns out that the warning which was added with the commit addressing the MSI affinity race unearthed yet another long standing bug. If user space writes a bogus affinity mask, i.e. it contains no online CPUs, then it calls irq_select_affinity_usr(). This was introduced for ALPHA in eee45269b0f5 ("[PATCH] Alpha: convert to generic irq framework (generic part)") and subsequently made available for all architectures in 18404756765c ("genirq: Expose default irq affinity mask (take 3)") which introduced the circumvention of the affinity setting restrictions for interrupt which cannot be moved in process context. The whole exercise is bogus in various aspects: 1) If the interrupt is already started up then there is absolutely no point to honour a bogus interrupt affinity setting from user space. The interrupt is already assigned to an online CPU and it does not make any sense to reassign it to some other randomly chosen online CPU. 2) If the interupt is not yet started up then there is no point either. A subsequent startup of the interrupt will invoke irq_setup_affinity() anyway which will chose a valid target CPU. So the only correct solution is to just return -EINVAL in case user space wrote an affinity mask which does not contain any online CPUs, except for ALPHA which has it's own magic sauce for this. Fixes: 18404756765c ("genirq: Expose default irq affinity mask (take 3)") Reported-by: Qian Cai Signed-off-by: Thomas Gleixner Tested-by: Qian Cai Link: https://lkml.kernel.org/r/878sl8xdbm.fsf@nanos.tec.linutronix.de commit 51dede9c05df2b78acd6dcf6a17d21f0877d2d7b Author: Thomas Gleixner Date: Thu Feb 13 19:01:34 2020 +0100 x86/mce/amd: Fix kobject lifetime Accessing the MCA thresholding controls in sysfs concurrently with CPU hotplug can lead to a couple of KASAN-reported issues: BUG: KASAN: use-after-free in sysfs_file_ops+0x155/0x180 Read of size 8 at addr ffff888367578940 by task grep/4019 and BUG: KASAN: use-after-free in show_error_count+0x15c/0x180 Read of size 2 at addr ffff888368a05514 by task grep/4454 for example. Both result from the fact that the threshold block creation/teardown code frees the descriptor memory itself instead of defining proper ->release function and leaving it to the driver core to take care of that, after all sysfs accesses have completed. Do that and get rid of the custom freeing code, fixing the above UAFs in the process. [ bp: write commit message. ] Fixes: 95268664390b ("[PATCH] x86_64: mce_amd support for family 0x10 processors") Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20200214082801.13836-1-bp@alien8.de commit c9cc0517bba9f0213f1e55172feceb99e5512daf Author: Jason A. Donenfeld Date: Thu Feb 6 12:42:01 2020 +0100 crypto: chacha20poly1305 - prevent integer overflow on large input This code assigns src_len (size_t) to sl (int), which causes problems when src_len is very large. Probably nobody in the kernel should be passing this much data to chacha20poly1305 all in one go anyway, so I don't think we need to change the algorithm or introduce larger types or anything. But we should at least error out early in this case and print a warning so that we get reports if this does happen and can look into why anybody is possibly passing it that much data or if they're accidently passing -1 or similar. Fixes: d95312a3ccc0 ("crypto: lib/chacha20poly1305 - reimplement crypt_from_sg() routine") Cc: Ard Biesheuvel Cc: stable@vger.kernel.org # 5.5+ Signed-off-by: Jason A. Donenfeld Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 6f4134b30b6ee33e2fd4d602099e6c5e60d0351a Merge: e44c1e3a2941 2aaaa5ee1c3d Author: Dave Airlie Date: Fri Feb 14 13:03:51 2020 +1000 Merge tag 'drm-intel-next-fixes-2020-02-13' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.6-rc2 Most of these were aimed at a "next fixes" pull already during the merge window, but there were issues with the baseline I used, which resulted in a lot of issues in CI. I've regenerated this stuff piecemeal now, adding gradually to it, and it seems healthy now. Due to the issues this is much bigger than I'd like. But it was obviously necessary to take the time to ensure it's not garbage... Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/878sl6yfrn.fsf@intel.com commit e44c1e3a2941fa51d8a2455e61340309d49fc3a5 Merge: 7ebdc26a315a e33a8cfda519 Author: Dave Airlie Date: Fri Feb 14 13:00:56 2020 +1000 Merge tag 'amd-drm-fixes-5.6-2020-02-12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.6-2020-02-12: amdgpu: - Additional OD fixes for navi - Misc display fixes - VCN 2.5 DPG fix - Prevent build errors on PowerPC on some configs - GDS EDC fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200212224746.3992-1-alexander.deucher@amd.com commit 7ebdc26a315ac0f13369eaf922bcee3ede576438 Merge: 984f0103fcd1 e1cf35b94c5f Author: Dave Airlie Date: Fri Feb 14 12:57:47 2020 +1000 Merge tag 'drm-misc-next-fixes-2020-02-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-next fixes for v5.6: - Fix build error in drm/edid. - Plug close-after-free race in vgem_gem_create. - Handle CONFIG_DMA_API_DEBUG_SG better in drm/msm. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/551b6183-a581-9d12-10a9-24cd929de425@linux.intel.com commit 984f0103fcd153363f77eb6dc68ab6caf8a5a779 Merge: bb6d3fb354c5 7e0cf7e9936c Author: Dave Airlie Date: Fri Feb 14 12:52:49 2020 +1000 Merge tag 'drm-misc-fixes-2020-02-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fixes for v5.6: - Revert allow_fb_modifiers in sun4i, as it causes a regression for DE2 and DE3. - Fix null pointer deref in drm_dp_mst_process_up_req(). Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/672810c3-4212-0a46-337b-2cb855573fd2@linux.intel.com commit 7155c44624d061692b4c13aa8343f119c67d4fc0 Author: Vladimir Oltean Date: Sun Jan 26 21:49:50 2020 +0200 ARM: dts: ls1021a: Restore MDIO compatible to gianfar The difference between "fsl,etsec2-mdio" and "gianfar" has to do with the .get_tbipa function, which calculates the address of the TBIPA register automatically, if not explicitly specified. [ see drivers/net/ethernet/freescale/fsl_pq_mdio.c ]. On LS1021A, the TBIPA register is at offset 0x30 within the port register block, which is what the "gianfar" method of calculating addresses actually does. Luckily, the bad "compatible" is inconsequential for ls1021a.dtsi, because the TBIPA register is explicitly specified via the second "reg" (<0x0 0x2d10030 0x0 0x4>), so the "get_tbipa" function is dead code. Nonetheless it's good to restore it to its correct value. Background discussion: https://www.spinics.net/lists/stable/msg361156.html Fixes: c7861adbe37f ("ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect") Reported-by: Pavel Machek Signed-off-by: Vladimir Oltean Signed-off-by: Shawn Guo commit 5179a9dfa9440c1781816e2c9a183d1d2512dc61 Author: Benjamin Tissoires Date: Thu Feb 13 17:07:47 2020 -0800 Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list The Yoga 11e is using LEN0049, but it doesn't have a trackstick. Thus, there is no need to create a software top buttons row. However, it seems that the device works under SMBus, so keep it as part of the smbus_pnp_ids. Signed-off-by: Benjamin Tissoires Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200115013023.9710-1-benjamin.tissoires@redhat.com Signed-off-by: Dmitry Torokhov commit b8a3d819f872e0a3a0a6db0dbbcd48071042fb98 Author: Gaurav Agrawal Date: Thu Feb 13 17:06:10 2020 -0800 Input: synaptics - enable SMBus on ThinkPad L470 Add touchpad LEN2044 to the list, as it is capable of working with psmouse.synaptics_intertouch=1 Signed-off-by: Gaurav Agrawal Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/CADdtggVzVJq5gGNmFhKSz2MBwjTpdN5YVOdr4D3Hkkv=KZRc9g@mail.gmail.com Signed-off-by: Dmitry Torokhov commit bf502391353b928e63096127e5fd8482080203f5 Author: Lyude Paul Date: Thu Feb 13 16:59:15 2020 -0800 Input: synaptics - switch T470s to RMI4 by default This supports RMI4 and everything seems to work, including the touchpad buttons. So, let's enable this by default. Signed-off-by: Lyude Paul Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200204194322.112638-1-lyude@redhat.com Signed-off-by: Dmitry Torokhov commit a1b9b65edfd8f195dafaebf68f7d321eb9b3ab82 Author: Gustavo A. R. Silva Date: Thu Feb 13 16:57:00 2020 -0800 Input: gpio_keys - replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200213002600.GA31916@embeddedor.com Signed-off-by: Dmitry Torokhov commit cfb8d7811f815d17babadd87436300261fd54de7 Author: Gustavo A. R. Silva Date: Thu Feb 13 16:56:48 2020 -0800 Input: goldfish_events - replace zero-length array with flexible-array member The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200213002430.GA31056@embeddedor.com Signed-off-by: Dmitry Torokhov commit 54d6477dca3b65b7b77a903fe60a9447bc836e7f Author: Peng Fan Date: Sun Jan 19 10:09:32 2020 +0000 ARM: dts: imx7d: fix opp-supported-hw Per i.MX7D Document Number: IMX7DCEC Rev. 6, 03/2019, there are only consumer/industrial parts, and 1.2GHz is only support in consumer parts. So exclude automotive from 792/996MHz/1.2GHz and exclude industrial from 1.2GHz. Fixes: d7bfba7296ca ("ARM: dts: imx7d: Update cpufreq OPP table") Cc: Leonard Crestez Signed-off-by: Peng Fan Reviewed-by: Leonard Crestez Signed-off-by: Shawn Guo commit 2ca10259b4189a433c309054496dd6af1415f992 Author: Jens Axboe Date: Thu Feb 13 17:17:35 2020 -0700 io_uring: prune request from overflow list on flush Carter reported an issue where he could produce a stall on ring exit, when we're cleaning up requests that match the given file table. For this particular test case, a combination of a few things caused the issue: - The cq ring was overflown - The request being canceled was in the overflow list The combination of the above means that the cq overflow list holds a reference to the request. The request is canceled correctly, but since the overflow list holds a reference to it, the final put won't happen. Since the final put doesn't happen, the request remains in the inflight. Hence we never finish the cancelation flush. Fix this by removing requests from the overflow list if we're canceling them. Cc: stable@vger.kernel.org # 5.5 Reported-by: Carter Li 李通洲 Signed-off-by: Jens Axboe commit 3da627073b56955b4f1d028c4b8092af59375938 Author: Tyler Hicks Date: Thu Feb 13 21:48:42 2020 +0000 Documentation/process: Swap out the ambassador for Canonical John Johansen will take over as the process ambassador for Canonical when dealing with embargoed hardware issues. Cc: John Johansen Cc: linux-kernel@vger.kernel.org Cc: linux-doc@vger.kernel.org Cc: Alex Shi Cc: Harry Wei Cc: Thomas Gleixner Cc: Greg Kroah-Hartman Cc: Jonathan Corbet Acked-by: John Johansen Signed-off-by: Tyler Hicks Link: https://lore.kernel.org/r/20200213214842.21312-1-tyhicks@canonical.com Signed-off-by: Greg Kroah-Hartman commit cabe17d0173ab04bd3f87b8199ae75f43f1ea473 Author: Mika Westerberg Date: Wed Feb 12 17:59:41 2020 +0300 ACPI: watchdog: Set default timeout in probe If the BIOS default timeout for the watchdog is too small userspace may not have enough time to configure new timeout after opening the device before the system is already reset. For this reason program default timeout of 30 seconds in the driver probe and allow userspace to change this from command line or through module parameter (wdat_wdt.timeout). Reported-by: Jean Delvare Signed-off-by: Mika Westerberg Reviewed-by: Jean Delvare Signed-off-by: Rafael J. Wysocki commit 2ba33a4e9e22ac4dda928d3e9b5978a3a2ded4e0 Author: Mika Westerberg Date: Wed Feb 12 17:59:40 2020 +0300 ACPI: watchdog: Fix gas->access_width usage ACPI Generic Address Structure (GAS) access_width field is not in bytes as the driver seems to expect in few places so fix this by using the newly introduced macro ACPI_ACCESS_BYTE_WIDTH(). Fixes: b1abf6fc4982 ("ACPI / watchdog: Fix off-by-one error at resource assignment") Fixes: 058dfc767008 ("ACPI / watchdog: Add support for WDAT hardware watchdog") Reported-by: Jean Delvare Signed-off-by: Mika Westerberg Reviewed-by: Jean Delvare Cc: 4.16+ # 4.16+ Signed-off-by: Rafael J. Wysocki commit 1dade3a7048ccfc675650cd2cf13d578b095e5fb Author: Mika Westerberg Date: Wed Feb 12 17:59:39 2020 +0300 ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro Sometimes it is useful to find the access_width field value in bytes and not in bits so add a helper that can be used for this purpose. Suggested-by: Jean Delvare Signed-off-by: Mika Westerberg Reviewed-by: Jean Delvare Cc: 4.16+ # 4.16+ Signed-off-by: Rafael J. Wysocki commit b19e8c68470385dd2c5440876591fddb02c8c402 Merge: 1d40890aae81 d91771848f0a Author: Linus Torvalds Date: Thu Feb 13 14:36:57 2020 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Summary below, but it's all reasonably straightforward. There are some more fixes on the horizon, but nothing disastrous yet. Summary: - Fix build when KASLR is enabled but CONFIG_ARCH_RANDOM is not set - Fix context-switching of SSBS state on systems that implement it - Fix spinlock compiler warning introduced during the merge window - Fix incorrect header inclusion (linux/clk-provider.h) - Use SYSCTL_{ZERO,ONE} instead of rolling our own static variables - Don't scream if optional SMMUv3 PMU irq is missing - Remove some unused function prototypes" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: time: Replace by arm64: Fix CONFIG_ARCH_RANDOM=n build perf/smmuv3: Use platform_get_irq_optional() for wired interrupt arm64/spinlock: fix a -Wunused-function warning arm64: ssbs: Fix context-switch when SSBS is present on all CPUs arm64: use shared sysctl constants arm64: Drop do_el0_ia_bp_hardening() & do_sp_pc_abort() declarations commit 1d40890aae812378fdcf47e203abf49476f9c071 Merge: 64ae1342f898 a924eae75106 Author: Linus Torvalds Date: Thu Feb 13 14:34:58 2020 -0800 Merge tag 'gpio-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: - Revert two patches to gpio_do_set_config() and implement the proper solution that works, also drop an unecessary call in set_config() - Fix up the lockdep class for hierarchical IRQ domains. - Remove some bridge code for line directions. - Fix a register access bug in the Xilinx driver. * tag 'gpio-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: sifive: fix static checker warning spmi: pmic-arb: Set lockdep class for hierarchical irq domains gpio: xilinx: Fix bug where the wrong GPIO register is written to gpiolib: remove unnecessary argument from set_config call gpio: bd71828: Remove unneeded defines for GPIO_LINE_DIRECTION_IN/OUT MAINTAINERS: Sort entries in database for GPIO gpiolib: fix gpio_do_set_config() Revert "gpiolib: remove set but not used variable 'config'" Revert "gpiolib: Remove duplicated function gpio_do_set_config()" commit 803381f9f117493d6204d82445a530c834040fe6 Merge: 07134cf69623 45942ba890e6 Author: David S. Miller Date: Thu Feb 13 14:19:00 2020 -0800 Merge branch 'icmp-account-for-NAT-when-sending-icmps-from-ndo-layer' Jason A. Donenfeld says: ==================== icmp: account for NAT when sending icmps from ndo layer The ICMP routines use the source address for two reasons: 1. Rate-limiting ICMP transmissions based on source address, so that one source address cannot provoke a flood of replies. If the source address is wrong, the rate limiting will be incorrectly applied. 2. Choosing the interface and hence new source address of the generated ICMP packet. If the original packet source address is wrong, ICMP replies will be sent from the wrong source address, resulting in either a misdelivery, infoleak, or just general network admin confusion. Most of the time, the icmp_send and icmpv6_send routines can just reach down into the skb's IP header to determine the saddr. However, if icmp_send or icmpv6_send is being called from a network device driver -- there are a few in the tree -- then it's possible that by the time icmp_send or icmpv6_send looks at the packet, the packet's source address has already been transformed by SNAT or MASQUERADE or some other transformation that CONNTRACK knows about. In this case, the packet's source address is most certainly the *wrong* source address to be used for the purpose of ICMP replies. Rather, the source address we want to use for ICMP replies is the original one, from before the transformation occurred. Fortunately, it's very easy to just ask CONNTRACK if it knows about this packet, and if so, how to fix it up. The saddr is the only field in the header we need to fix up, for the purposes of the subsequent processing in the icmp_send and icmpv6_send functions, so we do the lookup very early on, so that the rest of the ICMP machinery can progress as usual. Changes v3->v4: - Add back the skb_shared checking, since the previous assumption isn't actually true [Eric]. This implies dropping the additional patches v3 had for removing skb_share_check from various drivers. We can revisit that general set of ideas later, but that's probably better suited as a net-next patchset rather than this stable one which is geared at fixing bugs. So, this implements things in the safe conservative way. Changes v2->v3: - Add selftest to ensure this actually does what we want and never regresses. - Check the size of the skb header before operating on it. - Use skb_ensure_writable to ensure we can modify the cloned skb [Florian]. - Conditionalize this on IPS_SRC_NAT so we don't do anything unnecessarily [Florian]. - It turns out that since we're calling these from the xmit path, skb_share_check isn't required, so remove that [Florian]. This simplifes the code a bit too. **The supposition here is that skbs passed to ndo_start_xmit are _never_ shared. If this is not correct NOW IS THE TIME TO PIPE UP, for doom awaits us later.** - While investigating the shared skb business, several drivers appeared to be calling it incorrectly in the xmit path, so this series also removes those unnecessary calls, based on the supposition mentioned in the previous point. Changes v1->v2: - icmpv6 takes subtly different types than icmpv4, like u32 instead of be32, u8 instead of int. - Since we're technically writing to the skb, we need to make sure it's not a shared one [Dave, 2017]. - Restore the original skb data after icmp_send returns. All current users are freeing the packet right after, so it doesn't matter, but future users might not. - Remove superfluous route lookup in sunvnet [Dave]. - Use NF_NAT instead of NF_CONNTRACK for condition [Florian]. - Include this cover letter [Dave]. ==================== Signed-off-by: David S. Miller commit 45942ba890e6f35232727a5fa33d732681f4eb9f Author: Jason A. Donenfeld Date: Tue Feb 11 20:47:09 2020 +0100 xfrm: interface: use icmp_ndo_send helper Because xfrmi is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. Signed-off-by: Jason A. Donenfeld Cc: Nicolas Dichtel Cc: Steffen Klassert Signed-off-by: David S. Miller commit a12d7f3cbdc72c7625881c8dc2660fc2c979fdf2 Author: Jason A. Donenfeld Date: Tue Feb 11 20:47:08 2020 +0100 wireguard: device: use icmp_ndo_send helper Because wireguard is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. This commit adds a small test to the wireguard test suite to ensure that the new functions continue doing the right thing in the context of wireguard. It does this by setting up a condition that will definately evoke an icmp error message from the driver, but along a nat'd path. Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 67c9a7e1e3ac491b5df018803639addc36f154ba Author: Jason A. Donenfeld Date: Tue Feb 11 20:47:07 2020 +0100 sunvnet: use icmp_ndo_send helper Because sunvnet is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. While we're at it, doing the additional route lookup before calling icmp_ndo_send is superfluous, since this is the job of the icmp code in the first place. Signed-off-by: Jason A. Donenfeld Cc: Shannon Nelson Signed-off-by: David S. Miller commit e0fce6f945a26d4e953a147fe7ca11410322c9fe Author: Jason A. Donenfeld Date: Tue Feb 11 20:47:06 2020 +0100 gtp: use icmp_ndo_send helper Because gtp is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. Signed-off-by: Jason A. Donenfeld Cc: Harald Welte Signed-off-by: David S. Miller commit 0b41713b606694257b90d61ba7e2712d8457648b Author: Jason A. Donenfeld Date: Tue Feb 11 20:47:05 2020 +0100 icmp: introduce helper for nat'd source address in network device context This introduces a helper function to be called only by network drivers that wraps calls to icmp[v6]_send in a conntrack transformation, in case NAT has been used. We don't want to pollute the non-driver path, though, so we introduce this as a helper to be called by places that actually make use of this, as suggested by Florian. Signed-off-by: Jason A. Donenfeld Cc: Florian Westphal Signed-off-by: David S. Miller commit 64ae1342f8980d05c3df414a022b8123aa76c56b Merge: 0bf999f9c5e7 2343d1529aff Author: Linus Torvalds Date: Thu Feb 13 14:17:39 2020 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a Kconfig anomaly when lib/crypto is enabled without Crypto API" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: Kconfig - allow tests to be disabled when manager is disabled commit 07134cf6962377875288b06232d0c41c69d31752 Merge: 6ee2deb6fbed e2debf0852c4 Author: David S. Miller Date: Thu Feb 13 14:16:35 2020 -0800 Merge branch 'skip_sw-skip_hw-validation' Davide Caratti says: ==================== add missing validation of 'skip_hw/skip_sw' ensure that all classifiers currently supporting HW offload validate the 'flags' parameter provided by user: - patch 1/2 fixes cls_matchall - patch 2/2 fixes cls_flower ==================== Signed-off-by: David S. Miller commit e2debf0852c4d66ba1a8bde12869b196094c70a7 Author: Davide Caratti Date: Tue Feb 11 19:33:40 2020 +0100 net/sched: flower: add missing validation of TCA_FLOWER_FLAGS unlike other classifiers that can be offloaded (i.e. users can set flags like 'skip_hw' and 'skip_sw'), 'cls_flower' doesn't validate the size of netlink attribute 'TCA_FLOWER_FLAGS' provided by user: add a proper entry to fl_policy. Fixes: 5b33f48842fa ("net/flower: Introduce hardware offload support") Signed-off-by: Davide Caratti Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 1afa3cc90f8fb745c777884d79eaa1001d6927a6 Author: Davide Caratti Date: Tue Feb 11 19:33:39 2020 +0100 net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS unlike other classifiers that can be offloaded (i.e. users can set flags like 'skip_hw' and 'skip_sw'), 'cls_matchall' doesn't validate the size of netlink attribute 'TCA_MATCHALL_FLAGS' provided by user: add a proper entry to mall_policy. Fixes: b87f7936a932 ("net/sched: Add match-all classifier hw offloading.") Signed-off-by: Davide Caratti Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 6ee2deb6fbed6ed343040215d10f3c73d00304df Author: Hangbin Liu Date: Tue Feb 11 18:31:54 2020 +0800 net/flow_dissector: remove unexist field description @thoff has moved to struct flow_dissector_key_control. Fixes: 42aecaa9bb2b ("net: Get skb hash over flow_keys structure") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 304db6cb7610eb9104e1f911b235d87dc4802558 Author: Li RongQing Date: Tue Feb 11 10:13:44 2020 +0800 page_pool: refill page when alloc.count of pool is zero "do {} while" in page_pool_refill_alloc_cache will always refill page once whether refill is true or false, and whether alloc.count of pool is less than PP_ALLOC_CACHE_REFILL or not this is wrong, and will cause overflow of pool->alloc.cache the caller of __page_pool_get_cached should provide guarantee that pool->alloc.cache is safe to access, so in_serving_softirq should be removed as suggested by Jesper Dangaard Brouer in https://patchwork.ozlabs.org/patch/1233713/ so fix this issue by calling page_pool_refill_alloc_cache() only when pool->alloc.count is zero Fixes: 44768decb7c0 ("page_pool: handle page recycle for NUMA_NO_NODE condition") Signed-off-by: Li RongQing Suggested-by: Jesper Dangaard Brouer Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 89e960b5a99511f21d07da50eb34aeeb46cfba0f Merge: b9287f2ac321 4ee656bba801 Author: David S. Miller Date: Thu Feb 13 14:10:11 2020 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2020-02-12 This series contains fixes to only the ice driver. Dave fixes logic flaws in the DCB rebuild function which is used after a reset. Also fixed a configuration issue when switching between firmware and software LLDP mode where the number of TLV's configured was getting out of sync with what lldpad thinks is configured. Paul fixes how the driver displayed all the supported and advertised link modes by basing it on the PHY capabilities, and in the process cleaned up a lot of code. Brett fixes duplicate receive tail bumps by comparing the value we are writing to tail with the previously written tail value. Also cleaned up workarounds that are no longer needed with the latest NVM images. Anirudh cleaned up unnecessary CONFIG_PCI_IOV wrappers. Updated the driver to use ice_pf_to_dev() instead of &pf->pdev->dev or &vsi->back->pdev->dev. Cleaned up the string format in print function calls to remove newlines where applicable. Akeem updates the link message logging to include "Full Duplex" and "Negotiated", to help distinguish from "Requested" for FEC. Bruce fixes and consolidates the logging of firmware/NVM information during driver load, since the information is duplicate of what is available via ethtool. Fixed the checking of the Unit Load Status bits after reset to ensure they are 0x7FF before continuing, by updating the mask. Cleanup up possible NULL dereferences that were created by a previous commit. Ben fixes the driver to use the correct netif_msg_tx/rx_error() to determine whether to print the MDD event type. Tony provides several trivial fixes, which include whitespace, typos, function header comments, reverse Christmas tree issues. ==================== Signed-off-by: David S. Miller commit 8fc7036ee652207ca992fbb9abb64090c355a9e0 Author: Rob Clark Date: Thu Feb 13 12:01:35 2020 -0800 drm/msm/dpu: fix BGR565 vs RGB565 confusion The component order between the two was swapped, resulting in incorrect color when games with 565 visual hit the overlay path instead of GPU composition. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Rob Clark Reviewed-by: Sean Paul Signed-off-by: Rob Clark commit c6659785dfb3f8d75f1fe637e4222ff8178f5280 Author: Harigovindan P Date: Thu Feb 6 14:42:01 2020 +0530 drm/msm/dsi/pll: call vco set rate explicitly For a given byte clock, if VCO recalc value is exactly same as vco set rate value, vco_set_rate does not get called assuming VCO is already set to required value. But Due to GDSC toggle, VCO values are erased in the HW. To make sure VCO is programmed correctly, we forcefully call set_rate from vco_prepare. Signed-off-by: Harigovindan P Reviewed-by: Jeffrey Hugo Signed-off-by: Rob Clark commit a1028dcfd0dd97884072288d0c8ed7f30399b528 Author: Harigovindan P Date: Thu Feb 6 14:26:15 2020 +0530 drm/msm/dsi: save pll state before dsi host is powered off Save pll state before dsi host is powered off. Without this change some register values gets resetted. Signed-off-by: Harigovindan P Signed-off-by: Rob Clark commit 5d63944f8206a80636ae8cb4b9107d3b49f43d37 Author: Trond Myklebust Date: Thu Feb 13 14:51:07 2020 -0500 NFSv4: Ensure the delegation cred is pinned when we call delegreturn Ensure we don't release the delegation cred during the call to nfs4_proc_delegreturn(). Fixes: ee05f456772d ("NFSv4: Fix races between open and delegreturn") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 8c75593c6eee0f661ddf25dfde0e6ad2a84be7a9 Author: Trond Myklebust Date: Thu Feb 13 14:51:06 2020 -0500 NFSv4: Ensure the delegation is pinned in nfs_do_return_delegation() The call to nfs_do_return_delegation() needs to be taken without any RCU locks. Add a refcount to make sure the delegation remains pinned in memory until we're done. Fixes: ee05f456772d ("NFSv4: Fix races between open and delegreturn") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit cd1b659d8ce7697ee9799b64f887528315b9097b Author: Olga Kornievskaia Date: Wed Feb 12 17:32:12 2020 -0500 NFSv4.1 make cachethis=no for writes Turning caching off for writes on the server should improve performance. Fixes: fba83f34119a ("NFS: Pass "privileged" value to nfs4_init_sequence()") Signed-off-by: Olga Kornievskaia Reviewed-by: Trond Myklebust Signed-off-by: Anna Schumaker commit ca1c671302825182629d3c1a60363cee6f5455bb Author: Chuck Lever Date: Wed Feb 12 11:12:30 2020 -0500 xprtrdma: Fix DMA scatter-gather list mapping imbalance The @nents value that was passed to ib_dma_map_sg() has to be passed to the matching ib_dma_unmap_sg() call. If ib_dma_map_sg() choses to concatenate sg entries, it will return a different nents value than it was passed. The bug was exposed by recent changes to the AMD IOMMU driver, which enabled sg entry concatenation. Looking all the way back to commit 4143f34e01e9 ("xprtrdma: Port to new memory registration API") and reviewing other kernel ULPs, it's not clear that the frwr_map() logic was ever correct for this case. Reported-by: Andre Tomt Suggested-by: Robin Murphy Signed-off-by: Chuck Lever Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Signed-off-by: Anna Schumaker commit 9a0584f05687947d5a0b87f046bcd2592a55e67c Author: Aleksa Sarai Date: Thu Feb 13 18:26:56 2020 +1100 selftests: openat2: fix build error on newer glibc It appears that newer glibcs check that openat(O_CREAT) was provided a fourth argument (rather than passing garbage), resulting in the following build error: > In file included from /usr/include/fcntl.h:301, > from helpers.c:9: > In function 'openat', > inlined from 'touchat' at helpers.c:49:11: > /usr/include/x86_64-linux-gnu/bits/fcntl2.h:126:4: error: call to > '__openat_missing_mode' declared with attribute error: openat with O_CREAT > or O_TMPFILE in third argument needs 4 arguments > 126 | __openat_missing_mode (); > | ^~~~~~~~~~~~~~~~~~~~~~~~ Reported-by: Shuah Khan Signed-off-by: Aleksa Sarai Tested-by: Shuah Khan Signed-off-by: Shuah Khan commit 3e8393630e928767aeb23f4744518de4ea5cc35a Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Wed Feb 12 14:00:40 2020 +0000 selftests: use LDLIBS for libraries instead of LDFLAGS While building selftests, the following errors were observed: > tools/testing/selftests/timens' > gcc -Wall -Werror -pthread -lrt -ldl timens.c -o tools/testing/selftests/timens/timens > /usr/bin/ld: /tmp/ccGy5CST.o: in function `check_config_posix_timers': > timens.c:(.text+0x65a): undefined reference to `timer_create' > collect2: error: ld returned 1 exit status Quoting commit 870f193d48c2 ("selftests: net: use LDLIBS instead of LDFLAGS"): The default Makefile rule looks like: $(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS) When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with. More detail: https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html LDFLAGS Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead. LDLIBS Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable. While at here, correct other selftests, not only timens ones. Reported-by: Shuah Khan Signed-off-by: Dmitry Safonov Tested-by: Shuah Khan Signed-off-by: Shuah Khan commit 07e6124a1a46b4b5a9b3cacc0c306b50da87abf5 Author: Jiri Slaby Date: Mon Feb 10 09:11:31 2020 +0100 vt: selection, close sel_buffer race syzkaller reported this UAF: BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741 Read of size 1 at addr ffff8880089e40e9 by task syz-executor.1/13184 CPU: 0 PID: 13184 Comm: syz-executor.1 Not tainted 5.4.7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: ... kasan_report+0xe/0x20 mm/kasan/common.c:634 n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741 tty_ldisc_receive_buf+0xac/0x190 drivers/tty/tty_buffer.c:461 paste_selection+0x297/0x400 drivers/tty/vt/selection.c:372 tioclinux+0x20d/0x4e0 drivers/tty/vt/vt.c:3044 vt_ioctl+0x1bcf/0x28d0 drivers/tty/vt/vt_ioctl.c:364 tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657 vfs_ioctl fs/ioctl.c:47 [inline] It is due to a race between parallel paste_selection (TIOCL_PASTESEL) and set_selection_user (TIOCL_SETSEL) invocations. One uses sel_buffer, while the other frees it and reallocates a new one for another selection. Add a mutex to close this race. The mutex takes care properly of sel_buffer and sel_buffer_lth only. The other selection global variables (like sel_start, sel_end, and sel_cons) are protected only in set_selection_user. The other functions need quite some more work to close the races of the variables there. This is going to happen later. This likely fixes (I am unsure as there is no reproducer provided) bug 206361 too. It was marked as CVE-2020-8648. Signed-off-by: Jiri Slaby Reported-by: syzbot+59997e8d5cbdc486e6f6@syzkaller.appspotmail.com References: https://bugzilla.kernel.org/show_bug.cgi?id=206361 Cc: stable Link: https://lore.kernel.org/r/20200210081131.23572-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 687bff0cd08f790d540cfb7b2349f0d876cdddec Author: Jiri Slaby Date: Mon Feb 10 09:11:30 2020 +0100 vt: selection, handle pending signals in paste_selection When pasting a selection to a vt, the task is set as INTERRUPTIBLE while waiting for a tty to unthrottle. But signals are not handled at all. Normally, this is not a problem as tty_ldisc_receive_buf receives all the goods and a user has no reason to interrupt the task. There are two scenarios where this matters: 1) when the tty is throttled and a signal is sent to the process, it spins on a CPU until the tty is unthrottled. schedule() does not really echedule, but returns immediately, of course. 2) when the sel_buffer becomes invalid, KASAN prevents any reads from it and the loop simply does not proceed and spins forever (causing the tty to throttle, but the code never sleeps, the same as above). This sometimes happens as there is a race in the sel_buffer handling code. So add signal handling to this ioctl (TIOCL_PASTESEL) and return -EINTR in case a signal is pending. Signed-off-by: Jiri Slaby Cc: stable Link: https://lore.kernel.org/r/20200210081131.23572-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 4508cf76b1ecdf20a456b6b161acbe78f3b23358 Author: Rasmus Villemoes Date: Thu Feb 13 12:43:42 2020 +0100 serial: cpm_uart: call cpm_muram_init before registering console Christophe reports that powerpc 8xx silently fails to 5.6-rc1. It turns out I was wrong about nobody relying on the lazy initialization of the cpm/qe muram in commit b6231ea2b3c6 (soc: fsl: qe: drop broken lazy call of cpm_muram_init()). Rather than reinstating the somewhat dubious lazy call (initializing a currently held spinlock, and implicitly doing a GFP_KERNEL under that spinlock), make sure that cpm_muram_init() is called early enough - I thought the calls from the subsys_initcalls were good enough, but when used by console drivers, that's obviously not the case. cpm_muram_init() is safe to call twice (there's an early return if it is already initialized), so keep the call from cpm_init() - in case SERIAL_CPM_CONSOLE=n. Fixes: b6231ea2b3c6 (soc: fsl: qe: drop broken lazy call of cpm_muram_init()) Reported-by: Christophe Leroy Signed-off-by: Rasmus Villemoes Tested-by: Christophe Leroy Link: https://lore.kernel.org/r/20200213114342.21712-1-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman commit 6e5cf31fbe651bed7ba1df768f2e123531132417 Author: Borislav Petkov Date: Tue Feb 4 13:28:41 2020 +0100 x86/mce/amd: Publish the bank pointer only after setup has succeeded threshold_create_bank() creates a bank descriptor per MCA error thresholding counter which can be controlled over sysfs. It publishes the pointer to that bank in a per-CPU variable and then goes on to create additional thresholding blocks if the bank has such. However, that creation of additional blocks in allocate_threshold_blocks() can fail, leading to a use-after-free through the per-CPU pointer. Therefore, publish that pointer only after all blocks have been setup successfully. Fixes: 019f34fccfd5 ("x86, MCE, AMD: Move shared bank to node descriptor") Reported-by: Saar Amar Reported-by: Dan Carpenter Signed-off-by: Borislav Petkov Cc: Link: http://lkml.kernel.org/r/20200128140846.phctkvx5btiexvbx@kili.mountain commit c96dceeabf765d0b1b1f29c3bf50a5c01315b820 Author: zhangyi (F) Date: Thu Feb 13 14:38:21 2020 +0800 jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer Commit 904cdbd41d74 ("jbd2: clear dirty flag when revoking a buffer from an older transaction") set the BH_Freed flag when forgetting a metadata buffer which belongs to the committing transaction, it indicate the committing process clear dirty bits when it is done with the buffer. But it also clear the BH_Mapped flag at the same time, which may trigger below NULL pointer oops when block_size < PAGE_SIZE. rmdir 1 kjournald2 mkdir 2 jbd2_journal_commit_transaction commit transaction N jbd2_journal_forget set_buffer_freed(bh1) jbd2_journal_commit_transaction commit transaction N+1 ... clear_buffer_mapped(bh1) ext4_getblk(bh2 ummapped) ... grow_dev_page init_page_buffers bh1->b_private=NULL bh2->b_private=NULL jbd2_journal_put_journal_head(jh1) __journal_remove_journal_head(hb1) jh1 is NULL and trigger oops *) Dir entry block bh1 and bh2 belongs to one page, and the bh2 has already been unmapped. For the metadata buffer we forgetting, we should always keep the mapped flag and clear the dirty flags is enough, so this patch pick out the these buffers and keep their BH_Mapped flag. Link: https://lore.kernel.org/r/20200213063821.30455-3-yi.zhang@huawei.com Fixes: 904cdbd41d74 ("jbd2: clear dirty flag when revoking a buffer from an older transaction") Reviewed-by: Jan Kara Signed-off-by: zhangyi (F) Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 6a66a7ded12baa6ebbb2e3e82f8cb91382814839 Author: zhangyi (F) Date: Thu Feb 13 14:38:20 2020 +0800 jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() There is no need to delay the clearing of b_modified flag to the transaction committing time when unmapping the journalled buffer, so just move it to the journal_unmap_buffer(). Link: https://lore.kernel.org/r/20200213063821.30455-2-yi.zhang@huawei.com Reviewed-by: Jan Kara Signed-off-by: zhangyi (F) Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit af133ade9a40794a37104ecbcc2827c0ea373a3c Author: Shijie Luo Date: Mon Feb 10 20:17:52 2020 -0500 ext4: add cond_resched() to ext4_protect_reserved_inode When journal size is set too big by "mkfs.ext4 -J size=", or when we mount a crafted image to make journal inode->i_size too big, the loop, "while (i < num)", holds cpu too long. This could cause soft lockup. [ 529.357541] Call trace: [ 529.357551] dump_backtrace+0x0/0x198 [ 529.357555] show_stack+0x24/0x30 [ 529.357562] dump_stack+0xa4/0xcc [ 529.357568] watchdog_timer_fn+0x300/0x3e8 [ 529.357574] __hrtimer_run_queues+0x114/0x358 [ 529.357576] hrtimer_interrupt+0x104/0x2d8 [ 529.357580] arch_timer_handler_virt+0x38/0x58 [ 529.357584] handle_percpu_devid_irq+0x90/0x248 [ 529.357588] generic_handle_irq+0x34/0x50 [ 529.357590] __handle_domain_irq+0x68/0xc0 [ 529.357593] gic_handle_irq+0x6c/0x150 [ 529.357595] el1_irq+0xb8/0x140 [ 529.357599] __ll_sc_atomic_add_return_acquire+0x14/0x20 [ 529.357668] ext4_map_blocks+0x64/0x5c0 [ext4] [ 529.357693] ext4_setup_system_zone+0x330/0x458 [ext4] [ 529.357717] ext4_fill_super+0x2170/0x2ba8 [ext4] [ 529.357722] mount_bdev+0x1a8/0x1e8 [ 529.357746] ext4_mount+0x44/0x58 [ext4] [ 529.357748] mount_fs+0x50/0x170 [ 529.357752] vfs_kern_mount.part.9+0x54/0x188 [ 529.357755] do_mount+0x5ac/0xd78 [ 529.357758] ksys_mount+0x9c/0x118 [ 529.357760] __arm64_sys_mount+0x28/0x38 [ 529.357764] el0_svc_common+0x78/0x130 [ 529.357766] el0_svc_handler+0x38/0x78 [ 529.357769] el0_svc+0x8/0xc [ 541.356516] watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [mount:18674] Link: https://lore.kernel.org/r/20200211011752.29242-1-luoshijie1@huawei.com Reviewed-by: Jan Kara Signed-off-by: Shijie Luo Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 48a34311953d921235f4d7bbd2111690d2e469cf Author: Jan Kara Date: Mon Feb 10 15:43:16 2020 +0100 ext4: fix checksum errors with indexed dirs DIR_INDEX has been introduced as a compat ext4 feature. That means that even kernels / tools that don't understand the feature may modify the filesystem. This works because for kernels not understanding indexed dir format, internal htree nodes appear just as empty directory entries. Index dir aware kernels then check the htree structure is still consistent before using the data. This all worked reasonably well until metadata checksums were introduced. The problem is that these effectively made DIR_INDEX only ro-compatible because internal htree nodes store checksums in a different place than normal directory blocks. Thus any modification ignorant to DIR_INDEX (or just clearing EXT4_INDEX_FL from the inode) will effectively cause checksum mismatch and trigger kernel errors. So we have to be more careful when dealing with indexed directories on filesystems with checksumming enabled. 1) We just disallow loading any directory inodes with EXT4_INDEX_FL when DIR_INDEX is not enabled. This is harsh but it should be very rare (it means someone disabled DIR_INDEX on existing filesystem and didn't run e2fsck), e2fsck can fix the problem, and we don't want to answer the difficult question: "Should we rather corrupt the directory more or should we ignore that DIR_INDEX feature is not set?" 2) When we find out htree structure is corrupted (but the filesystem and the directory should in support htrees), we continue just ignoring htree information for reading but we refuse to add new entries to the directory to avoid corrupting it more. Link: https://lore.kernel.org/r/20200210144316.22081-1-jack@suse.cz Fixes: dbe89444042a ("ext4: Calculate and verify checksums for htree nodes") Reviewed-by: Andreas Dilger Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 4f97a68192bd33b9963b400759cef0ca5963af00 Author: Theodore Ts'o Date: Thu Feb 6 17:35:01 2020 -0500 ext4: fix support for inode sizes > 1024 bytes A recent commit, 9803387c55f7 ("ext4: validate the debug_want_extra_isize mount option at parse time"), moved mount-time checks around. One of those changes moved the inode size check before the blocksize variable was set to the blocksize of the file system. After 9803387c55f7 was set to the minimum allowable blocksize, which in practice on most systems would be 1024 bytes. This cuased file systems with inode sizes larger than 1024 bytes to be rejected with a message: EXT4-fs (sdXX): unsupported inode size: 4096 Fixes: 9803387c55f7 ("ext4: validate the debug_want_extra_isize mount option at parse time") Link: https://lore.kernel.org/r/20200206225252.GA3673@mit.edu Reported-by: Herbert Poetzl Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit c7ff8573ad21dcdcbcffd66fbfca3b53cd67d2b1 Author: Harald Freudenberger Date: Wed Jan 22 14:43:23 2020 +0100 crypto/testmgr: enable selftests for paes-s390 ciphers This patch enables the selftests for the s390 specific protected key AES (PAES) cipher implementations: * cbc-paes-s390 * ctr-paes-s390 * ecb-paes-s390 * xts-paes-s390 PAES is an AES cipher but with encrypted ('protected') key material. However, the paes ciphers are able to derive an protected key from clear key material with the help of the pkey kernel module. So this patch now enables the generic AES tests for the paes ciphers. Under the hood the setkey() functions rearrange the clear key values as clear key token and so the pkey kernel module is able to provide protected key blobs from the given clear key values. The derived protected key blobs are then used within the paes cipers and should produce the very same results as the generic AES implementation with the clear key values. The s390-paes cipher testlist entries are surrounded by #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) because they don't make any sense on non s390 platforms or without the PAES cipher implementation. Link: http://lkml.kernel.org/r/20200213083946.zicarnnt3wizl5ty@gondor.apana.org.au Acked-by: Herbert Xu Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 46d36880d1c6f9b9a0cbaf90235355ea1f4cab96 Author: Jan Kara Date: Thu Jan 30 12:11:48 2020 +0100 ext4: simplify checking quota limits in ext4_statfs() Coverity reports that conditions checking quota limits in ext4_statfs() contain dead code. Indeed it is right and current conditions can be simplified. Link: https://lore.kernel.org/r/20200130111148.10766-1-jack@suse.cz Reported-by: Coverity Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 14c9ca0583eee8df285d68a0e6ec71053efd2228 Author: Andreas Dilger Date: Sun Jan 26 15:03:34 2020 -0700 ext4: don't assume that mmp_nodename/bdevname have NUL Don't assume that the mmp_nodename and mmp_bdevname strings are NUL terminated, since they are filled in by snprintf(), which is not guaranteed to do so. Link: https://lore.kernel.org/r/1580076215-1048-1-git-send-email-adilger@dilger.ca Signed-off-by: Andreas Dilger Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 1dd017882e01d2fcd9c5dbbf1eb376211111c393 Author: Leon Romanovsky Date: Wed Feb 12 10:06:51 2020 +0200 RDMA/core: Fix protection fault in get_pkey_idx_qp_list We don't need to set pkey as valid in case that user set only one of pkey index or port number, otherwise it will be resulted in NULL pointer dereference while accessing to uninitialized pkey list. The following crash from Syzkaller revealed it. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN PTI CPU: 1 PID: 14753 Comm: syz-executor.2 Not tainted 5.5.0-rc5 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 RIP: 0010:get_pkey_idx_qp_list+0x161/0x2d0 Code: 01 00 00 49 8b 5e 20 4c 39 e3 0f 84 b9 00 00 00 e8 e4 42 6e fe 48 8d 7b 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 01 0f 8e d0 00 00 00 48 8d 7d 04 48 b8 RSP: 0018:ffffc9000bc6f950 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82c8bdec RDX: 0000000000000002 RSI: ffffc900030a8000 RDI: 0000000000000010 RBP: ffff888112c8ce80 R08: 0000000000000004 R09: fffff5200178df1f R10: 0000000000000001 R11: fffff5200178df1f R12: ffff888115dc4430 R13: ffff888115da8498 R14: ffff888115dc4410 R15: ffff888115da8000 FS: 00007f20777de700(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f721000 CR3: 00000001173ca002 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: port_pkey_list_insert+0xd7/0x7c0 ib_security_modify_qp+0x6fa/0xfc0 _ib_modify_qp+0x8c4/0xbf0 modify_qp+0x10da/0x16d0 ib_uverbs_modify_qp+0x9a/0x100 ib_uverbs_write+0xaa5/0xdf0 __vfs_write+0x7c/0x100 vfs_write+0x168/0x4a0 ksys_write+0xc8/0x200 do_syscall_64+0x9c/0x390 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs") Link: https://lore.kernel.org/r/20200212080651.GB679970@unreal Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Message-Id: <20200212080651.GB679970@unreal> commit 450c52c7847b5aea1eeba85391252c87198a5099 Merge: 03cd45d2e219 42cd5ffe46c1 Author: Greg Kroah-Hartman Date: Thu Feb 13 08:31:21 2020 -0800 Merge tag 'fixes-for-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: USB: fixes for v5.6-rc1 DWC3 learned that we can't always depend on Event Status bits. A problem was solved which would only surface with scatter list on IN endpoints. DWC2 got a fix for feature requests (both set and clear) and GetStatus request. The serial gadget got a fix for a TX stall bug. Composite framework now works better for SSP devices. * tag 'fixes-for-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: dwc3: debug: fix string position formatting mixup with ret and len usb: gadget: serial: fix Tx stall after buffer overflow usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows usb: dwc2: Fix in ISOC request length checking usb: gadget: composite: Support more than 500mA MaxPower usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus usb: gadget: u_audio: Fix high-speed max packet size usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields commit 4ec31cb6241d95879aac337cc6b50c45dd10cfcb Author: Coly Li Date: Thu Feb 13 22:12:07 2020 +0800 bcache: remove macro nr_to_fifo_front() Macro nr_to_fifo_front() is only used once in btree_flush_write(), it is unncessary indeed. This patch removes this macro and does calculation directly in place. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 309cc719a2c869b71a7388209a0a80d4284d98fd Author: Coly Li Date: Thu Feb 13 22:12:06 2020 +0800 bcache: Revert "bcache: shrink btree node cache after bch_btree_check()" This reverts commit 1df3877ff6a4810054237c3259d900ded4468969. In my testing, sometimes even all the cached btree nodes are freed, creating gc and allocator kernel threads may still fail. Finally it turns out that kthread_run() may fail if there is pending signal for current task. And the pending signal is sent from OOM killer which is triggered by memory consuption in bch_btree_check(). Therefore explicitly shrinking bcache btree node here does not help, and after the shrinker callback is improved, as well as pending signals are ignored before creating kernel threads, now such operation is unncessary anymore. This patch reverts the commit 1df3877ff6a4 ("bcache: shrink btree node cache after bch_btree_check()") because we have better improvement now. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 0b96da639a4874311e9b5156405f69ef9fc3bef8 Author: Coly Li Date: Thu Feb 13 22:12:05 2020 +0800 bcache: ignore pending signals when creating gc and allocator thread When run a cache set, all the bcache btree node of this cache set will be checked by bch_btree_check(). If the bcache btree is very large, iterating all the btree nodes will occupy too much system memory and the bcache registering process might be selected and killed by system OOM killer. kthread_run() will fail if current process has pending signal, therefore the kthread creating in run_cache_set() for gc and allocator kernel threads are very probably failed for a very large bcache btree. Indeed such OOM is safe and the registering process will exit after the registration done. Therefore this patch flushes pending signals during the cache set start up, specificly in bch_cache_allocator_start() and bch_gc_thread_start(), to make sure run_cache_set() won't fail for large cahced data set. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 0fbb027b44e79700da80e4b8bd1c1914d4796af6 Author: Takashi Iwai Date: Thu Feb 13 07:03:49 2020 +0100 ALSA: pcm: Fix double hw_free calls The commit 66f2d19f8116 ("ALSA: pcm: Fix memory leak at closing a stream without hw_free") tried to fix the regression wrt the missing hw_free call at closing without SNDRV_PCM_IOCTL_HW_FREE ioctl. However, the code change dropped mistakenly the state check, resulting in calling hw_free twice when SNDRV_PCM_IOCTL_HW_FRE got called beforehand. For most drivers, this is almost harmless, but the drivers like SOF show another regression now. This patch adds the state condition check before calling do_hw_free() at releasing the stream for avoiding the double hw_free calls. Fixes: 66f2d19f8116 ("ALSA: pcm: Fix memory leak at closing a stream without hw_free") Reported-by: Bard Liao Reported-by: Pierre-Louis Bossart Tested-by: Pierre-Louis Bossart Cc: Link: https://lore.kernel.org/r/s5hd0ajyprg.wl-tiwai@suse.de Signed-off-by: Takashi Iwai commit 2227ab4216cd4d56619733bcfaee7e6943cdc9aa Author: Dan Carpenter Date: Wed Feb 5 15:32:48 2020 +0300 dmaengine: idxd: Fix error handling in idxd_wq_cdev_dev_setup() We can't call kfree(dev) after calling device_register(dev). The "dev" pointer has to be freed using put_device(). Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland") Signed-off-by: Dan Carpenter Acked-by: Dave Jiang Link: https://lore.kernel.org/r/20200205123248.hmtog7qa2eiqaagh@kili.mountain Signed-off-by: Vinod Koul commit 83c49f734463980802d6dba376f69e787fb07a8e Author: Changbin Du Date: Tue Feb 4 20:51:15 2020 +0800 dmaengine: doc: fix warnings/issues of client.rst This fixed some warnings/issues of client.rst. o Need a blank line for enumerated lists. o Do not create section in enumerated list. o Remove suffix ':' from section title. Signed-off-by: Changbin Du Link: https://lore.kernel.org/r/20200204125115.12128-1-changbin.du@gmail.com Signed-off-by: Vinod Koul commit 8ac0e6641c7ca14833a2a8c6f13d8e0a435e535c Author: Zhu Yanjun Date: Wed Feb 12 09:26:33 2020 +0200 RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq When run stress tests with RXE, the following Call Traces often occur watchdog: BUG: soft lockup - CPU#2 stuck for 22s! [swapper/2:0] ... Call Trace: create_object+0x3f/0x3b0 kmem_cache_alloc_node_trace+0x129/0x2d0 __kmalloc_reserve.isra.52+0x2e/0x80 __alloc_skb+0x83/0x270 rxe_init_packet+0x99/0x150 [rdma_rxe] rxe_requester+0x34e/0x11a0 [rdma_rxe] rxe_do_task+0x85/0xf0 [rdma_rxe] tasklet_action_common.isra.21+0xeb/0x100 __do_softirq+0xd0/0x298 irq_exit+0xc5/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 ... The root cause is that tasklet is actually a softirq. In a tasklet handler, another softirq handler is triggered. Usually these softirq handlers run on the same cpu core. So this will cause "soft lockup Bug". Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20200212072635.682689-8-leon@kernel.org Signed-off-by: Zhu Yanjun Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 61b5865d56bbb09dd5887b197dd324d1d4333d47 Author: Dave Jiang Date: Tue Feb 11 10:42:47 2020 -0700 dmaengine: idxd: fix runaway module ref count on device driver bind idxd_config_bus_probe() calls try_module_get() but never calls module_put() when it fails. Thus with every failed attempt, the ref count goes up. Add module_put() in failure paths. Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver") Reported-by: Jerry Chen Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/158144296730.41381.12134210685456322434.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 9b6d3bbc1335404b331f4f11dc896066bdf1c752 Author: Leon Romanovsky Date: Wed Feb 12 09:26:35 2020 +0200 RDMA/mlx5: Prevent overflow in mmap offset calculations The cmd and index variables declared as u16 and the result is supposed to be stored in u64. The C arithmetic rules doesn't promote "(index >> 8) << 16" to be u64 and leaves the end result to be u16. Fixes: 7be76bef320b ("IB/mlx5: Introduce VAR object and its alloc/destroy methods") Link: https://lore.kernel.org/r/20200212072635.682689-10-leon@kernel.org Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 9ea04d0df6e6541c6736b43bff45f1e54875a1db Author: Yonatan Cohen Date: Wed Feb 12 09:26:34 2020 +0200 IB/umad: Fix kernel crash while unloading ib_umad When disassociating a device from umad we must ensure that the sysfs access is prevented before blocking the fops, otherwise assumptions in syfs don't hold: CPU0 CPU1 ib_umad_kill_port() ibdev_show() port->ib_dev = NULL dev_name(port->ib_dev) The prior patch made an error in moving the device_destroy(), it should have been split into device_del() (above) and put_device() (below). At this point we already have the split, so move the device_del() back to its original place. kernel stack PF: error_code(0x0000) - not-present page Oops: 0000 [#1] SMP DEBUG_PAGEALLOC PTI RIP: 0010:ibdev_show+0x18/0x50 [ib_umad] RSP: 0018:ffffc9000097fe40 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa0441120 RCX: ffff8881df514000 RDX: ffff8881df514000 RSI: ffffffffa0441120 RDI: ffff8881df1e8870 RBP: ffffffff81caf000 R08: ffff8881df1e8870 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000003 R12: ffff88822f550b40 R13: 0000000000000001 R14: ffffc9000097ff08 R15: ffff8882238bad58 FS: 00007f1437ff3740(0000) GS:ffff888236940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000004e8 CR3: 00000001e0dfc001 CR4: 00000000001606e0 Call Trace: dev_attr_show+0x15/0x50 sysfs_kf_seq_show+0xb8/0x1a0 seq_read+0x12d/0x350 vfs_read+0x89/0x140 ksys_read+0x55/0xd0 do_syscall_64+0x55/0x1b0 entry_SYSCALL_64_after_hwframe+0x44/0xa9: Fixes: cf7ad3030271 ("IB/umad: Avoid destroying device while it is accessed") Link: https://lore.kernel.org/r/20200212072635.682689-9-leon@kernel.org Signed-off-by: Yonatan Cohen Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 9051db381fabe75079ef38135ab73c5dd3a7c3e5 Author: Stephen Boyd Date: Thu Feb 6 08:21:24 2020 -0800 mmc: sdhci-msm: Mark sdhci_msm_cqe_disable static This function is not exported and only used in this file. Mark it static. Cc: Ritesh Harjani Cc: Veerabhadrarao Badiganti Fixes: 87a8df0dce6a ("mmc: sdhci-msm: Add CQHCI support for sdhci-msm") Signed-off-by: Stephen Boyd Reviewed-by: Douglas Anderson Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20200206162124.201195-1-swboyd@chromium.org Signed-off-by: Ulf Hansson commit a8af8694a5e8ddaaef4bd7b6426c12b7759c846c Author: Yishai Hadas Date: Wed Feb 12 09:26:32 2020 +0200 RDMA/mlx5: Fix async events cleanup flows As in the prior patch, the devx code is not fully cleaning up its event_lists before finishing driver_destroy allowing a later read to trigger user after free conditions. Re-arrange things so that the event_list is always empty after destroy and ensure it remains empty until the file is closed. Fixes: f7c8416ccea5 ("RDMA/core: Simplify destruction of FD uobjects") Link: https://lore.kernel.org/r/20200212072635.682689-7-leon@kernel.org Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit a0767da7774d91a668f9c223cec3e76172cd833b Author: Michael Guralnik Date: Wed Feb 12 09:26:31 2020 +0200 RDMA/core: Add missing list deletion on freeing event queue When the uobject file scheme was revised to allow device disassociation from the file it became possible for read() to still happen the driver destroys the uobject. The old clode code was not tolerant to concurrent read, and when it was moved to the driver destroy it creates a bug. Ensure the event_list is empty after driver destroy by adding the missing list_del(). Otherwise read() can trigger a use after free and double kfree. Fixes: f7c8416ccea5 ("RDMA/core: Simplify destruction of FD uobjects") Link: https://lore.kernel.org/r/20200212072635.682689-6-leon@kernel.org Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 512a928affd51c2dc631401e56ad5ee5d5dd68b6 Author: Ahmad Fatoum Date: Thu Jan 16 15:18:49 2020 +0100 ARM: imx: build v7_cpu_resume() unconditionally This function is not only needed by the platform suspend code, but is also reused as the CPU resume function when the ARM cores can be powered down completely in deep idle, which is the case on i.MX6SX and i.MX6UL(L). Providing the static inline stub whenever CONFIG_SUSPEND is disabled means that those platforms will hang on resume from cpuidle if suspend is disabled. So there are two problems: - The static inline stub masks the linker error - The function is not available where needed Fix both by just building the function unconditionally, when CONFIG_SOC_IMX6 is enabled. The actual code is three instructions long, so it's arguably ok to just leave it in for all i.MX6 kernel configurations. Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx") Signed-off-by: Lucas Stach Signed-off-by: Ahmad Fatoum Signed-off-by: Rouven Czerwinski Signed-off-by: Shawn Guo commit b6570fdb96edf45bcf71884bd2644bd73d348d1a Author: Samuel Holland Date: Thu Feb 13 00:11:44 2020 -0600 ASoC: codec2codec: avoid invalid/double-free of pcm runtime The PCM runtime was freed during PMU in the case that the event hook encountered an error. However, it is also unconditionally freed during PMD. Avoid a double-free by dropping the call to kfree in the PMU hook. Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") Cc: stable@vger.kernel.org Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20200213061147.29386-2-samuel@sholland.org Signed-off-by: Mark Brown commit 03cd45d2e219301880cabc357e3cf478a500080f Author: Mika Westerberg Date: Thu Feb 13 12:56:04 2020 +0300 thunderbolt: Prevent crash if non-active NVMem file is read The driver does not populate .reg_read callback for the non-active NVMem because the file is supposed to be write-only. However, it turns out NVMem subsystem does not yet support this and expects that the .reg_read callback is provided. If user reads the binary attribute it triggers NULL pointer dereference like this one: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: bin_attr_nvmem_read+0x64/0x80 kernfs_fop_read+0xa7/0x180 vfs_read+0xbd/0x170 ksys_read+0x5a/0xd0 do_syscall_64+0x43/0x150 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this in the driver by providing .reg_read callback that always returns an error. Reported-by: Nicholas Johnson Fixes: e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade") Signed-off-by: Mika Westerberg Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200213095604.1074-1-mika.westerberg@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit eb0bbba7636b9fc81939d6087a5fe575e150c95a Author: Marco Felsch Date: Thu Jan 16 15:01:08 2020 +0100 ARM: dts: imx6: phycore-som: fix emmc supply Currently the vmmc is supplied by the 1.8V pmic rail but this is wrong. The default module behaviour is to power VCCQ and VCC by the 3.3V power rail. Optional the user can connect the VCCQ to the pmic 1.8V emmc power rail using a solder jumper. Fixes: ddec5d1c0047 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM") Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit d593126a96b5764116e689e77a66dd1a7823f429 Merge: 57d7713196cc 7c3d02285ad5 Author: Greg Kroah-Hartman Date: Thu Feb 13 04:53:29 2020 -0800 Merge tag 'usb-serial-5.6-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.6-rc2 Here's a fix for a ch341 regression in 5.5 which people have started to hit, and a fix for a logic error in an ir-usb error path. Both have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-5.6-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: ch341: fix receiver regression USB: serial: ir-usb: Silence harmless uninitialized variable warning commit 4d59588c09f2a2daedad2a544d4d1b602ab3a8af Author: Robert Richter Date: Wed Feb 12 13:03:39 2020 +0100 EDAC/sysfs: Remove csrow objects on errors All created csrow objects must be removed in the error path of edac_create_csrow_objects(). The objects have been added as devices. They need to be removed by doing a device_del() *and* put_device() call to also free their memory. The missing put_device() leaves a memory leak. Use device_unregister() instead of device_del() which properly unregisters the device doing both. Fixes: 7adc05d2dc3a ("EDAC/sysfs: Drop device references properly") Signed-off-by: Robert Richter Signed-off-by: Borislav Petkov Tested-by: John Garry Cc: Link: https://lkml.kernel.org/r/20200212120340.4764-4-rrichter@marvell.com commit 216aa145aaf379a50b17afc812db71d893bd6683 Author: Robert Richter Date: Wed Feb 12 18:25:18 2020 +0100 EDAC/mc: Fix use-after-free and memleaks during device removal A test kernel with the options DEBUG_TEST_DRIVER_REMOVE, KASAN and DEBUG_KMEMLEAK set, revealed several issues when removing an mci device: 1) Use-after-free: On 27.11.19 17:07:33, John Garry wrote: > [ 22.104498] BUG: KASAN: use-after-free in > edac_remove_sysfs_mci_device+0x148/0x180 The use-after-free is caused by the mci_for_each_dimm() macro called in edac_remove_sysfs_mci_device(). The iterator was introduced with c498afaf7df8 ("EDAC: Introduce an mci_for_each_dimm() iterator"). The iterator loop calls device_unregister(&dimm->dev), which removes the sysfs entry of the device, but also frees the dimm struct in dimm_attr_release(). When incrementing the loop in mci_for_each_dimm(), the dimm struct is accessed again, after having been freed already. The fix is to free all the mci device's subsequent dimm and csrow objects at a later point, in _edac_mc_free(), when the mci device itself is being freed. This keeps the data structures intact and the mci device can be fully used until its removal. The change allows the safe usage of mci_for_each_dimm() to release dimm devices from sysfs. 2) Memory leaks: Following memory leaks have been detected: # grep edac /sys/kernel/debug/kmemleak | sort | uniq -c 1 [<000000003c0f58f9>] edac_mc_alloc+0x3bc/0x9d0 # mci->csrows 16 [<00000000bb932dc0>] edac_mc_alloc+0x49c/0x9d0 # csr->channels 16 [<00000000e2734dba>] edac_mc_alloc+0x518/0x9d0 # csr->channels[chn] 1 [<00000000eb040168>] edac_mc_alloc+0x5c8/0x9d0 # mci->dimms 34 [<00000000ef737c29>] ghes_edac_register+0x1c8/0x3f8 # see edac_mc_alloc() All leaks are from memory allocated by edac_mc_alloc(). Note: The test above shows that edac_mc_alloc() was called here from ghes_edac_register(), thus both functions show up in the stack trace but the module causing the leaks is edac_mc. The comments with the data structures involved were made manually by analyzing the objdump. The data structures listed above and created by edac_mc_alloc() are not properly removed during device removal, which is done in edac_mc_free(). There are two paths implemented to remove the device depending on device registration, _edac_mc_free() is called if the device is not registered and edac_unregister_sysfs() otherwise. The implemenations differ. For the sysfs case, the mci device removal lacks the removal of subsequent data structures (csrows, channels, dimms). This causes the memory leaks (see mci_attr_release()). [ bp: Massage commit message. ] Fixes: c498afaf7df8 ("EDAC: Introduce an mci_for_each_dimm() iterator") Fixes: faa2ad09c01c ("edac_mc: edac_mc_free() cannot assume mem_ctl_info is registered in sysfs.") Fixes: 7a623c039075 ("edac: rewrite the sysfs code to use struct device") Reported-by: John Garry Signed-off-by: Robert Richter Signed-off-by: Borislav Petkov Tested-by: John Garry Cc: Link: https://lkml.kernel.org/r/20200212120340.4764-3-rrichter@marvell.com commit a9149d243f259ad8f02b1e23dfe8ba06128f15e1 Author: Dan Moulding Date: Tue Jan 28 02:31:07 2020 -0700 iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices The logic for checking required NVM sections was recently fixed in commit b3f20e098293 ("iwlwifi: mvm: fix NVM check for 3168 devices"). However, with that fixed the else is now taken for 3168 devices and within the else clause there is a mandatory check for the PHY_SKU section. This causes the parsing to fail for 3168 devices. The PHY_SKU section is really only mandatory for the IWL_NVM_EXT layout (the phy_sku parameter of iwl_parse_nvm_data is only used when the NVM type is IWL_NVM_EXT). So this changes the PHY_SKU section check so that it's only mandatory for IWL_NVM_EXT. Fixes: b3f20e098293 ("iwlwifi: mvm: fix NVM check for 3168 devices") Signed-off-by: Dan Moulding Signed-off-by: Kalle Valo commit 872d92dec353a8d30fa186892cd5ea3e17ca75d3 Author: Hongbo Yao Date: Wed Jan 22 17:12:38 2020 +0800 tee: amdtee: amdtee depends on CRYPTO_DEV_CCP_DD If CRYPTO_DEV_CCP_DD=m and AMDTEE=y, the following error is seen while building call.c or core.c drivers/tee/amdtee/call.o: In function `handle_unload_ta': call.c:(.text+0x35f): undefined reference to `psp_tee_process_cmd' drivers/tee/amdtee/core.o: In function `amdtee_driver_init': core.c:(.init.text+0xf): undefined reference to `psp_check_tee_status Fix the config dependency for AMDTEE here. Reported-by: Hulk Robot Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Signed-off-by: Hongbo Yao Reviewed-by: Rijo Thomas Acked-by: Jens Wiklander Signed-off-by: Herbert Xu commit 54498e8070e19e74498a72c7331348143e7e1f8c Author: Gustavo A. R. Silva Date: Tue Feb 11 08:47:04 2020 -0600 i2c: altera: Fix potential integer overflow Factor out 100 from the equation and do 32-bit arithmetic (3 * clk_mhz / 10) instead of 64-bit. Notice that clk_mhz is MHz, so the multiplication will never wrap 32 bits and there is no need for div_u64(). Addresses-Coverity: 1458369 ("Unintentional integer overflow") Fixes: 0560ad576268 ("i2c: altera: Add Altera I2C Controller driver") Suggested-by: David Laight Signed-off-by: Gustavo A. R. Silva Reviewed-by: Thor Thayer Signed-off-by: Wolfram Sang commit 9e661cedcc0a072d91a32cb88e0515ea26e35711 Author: Wolfram Sang Date: Wed Feb 12 10:35:30 2020 +0100 i2c: jz4780: silence log flood on txabrt The printout for txabrt is way too talkative and is highly annoying with scanning programs like 'i2cdetect'. Reduce it to the minimum, the rest can be gained by I2C core debugging and datasheet information. Also, make it a debug printout, it won't help the regular user. Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780") Reported-by: H. Nikolaus Schaller Tested-by: H. Nikolaus Schaller Signed-off-by: Wolfram Sang commit 3e8cb8b2eaeb22f540f1cbc00cbb594047b7ba89 Author: Miklos Szeredi Date: Thu Feb 13 09:16:07 2020 +0100 fuse: fix stack use after return Normal, synchronous requests will have their args allocated on the stack. After the FR_FINISHED bit is set by receiving the reply from the userspace fuse server, the originating task may return and reuse the stack frame, resulting in an Oops if the args structure is dereferenced. Fix by setting a flag in the request itself upon initializing, indicating whether it has an asynchronous ->end() callback. Reported-by: Kyle Sanderson Reported-by: Michael Stapelberg Fixes: 2b319d1f6f92 ("fuse: don't dereference req->args on finished request") Cc: # v5.4 Tested-by: Michael Stapelberg Signed-off-by: Miklos Szeredi commit 9f35a31283775e6f6af73fb2c95c686a4c0acac7 Author: Alexander Tsoy Date: Thu Feb 13 02:54:50 2020 +0300 ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000 It should be safe to ignore clock validity check result if the following conditions are met: - only one single sample rate is supported; - the terminal is directly connected to the clock source; - the clock type is internal. This is to deal with some Denon DJ controllers that always reports that clock is invalid. Tested-by: Tobias Oszlanyi Signed-off-by: Alexander Tsoy Cc: Link: https://lore.kernel.org/r/20200212235450.697348-1-alexander@tsoy.me Signed-off-by: Takashi Iwai commit f52aa79df43c4509146140de0241bc21a4a3b4c7 Author: Frank Sorenson Date: Wed Feb 12 15:31:48 2020 -0600 cifs: Fix mode output in debugging statements A number of the debug statements output file or directory mode in hex. Change these to print using octal. Signed-off-by: Frank Sorenson Signed-off-by: Steve French commit 7563439adfae153b20331f1567c8b5d0e5cbd8a7 Author: Jens Axboe Date: Tue Feb 11 06:30:06 2020 -0700 io-wq: don't call kXalloc_node() with non-online node Glauber reports a crash on init on a box he has: RIP: 0010:__alloc_pages_nodemask+0x132/0x340 Code: 18 01 75 04 41 80 ce 80 89 e8 48 8b 54 24 08 8b 74 24 1c c1 e8 0c 48 8b 3c 24 83 e0 01 88 44 24 20 48 85 d2 0f 85 74 01 00 00 <3b> 77 08 0f 82 6b 01 00 00 48 89 7c 24 10 89 ea 48 8b 07 b9 00 02 RSP: 0018:ffffb8be4d0b7c28 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000002080 RBP: 0000000000012cc0 R08: 0000000000000000 R09: 0000000000000002 R10: 0000000000000dc0 R11: ffff995c60400100 R12: 0000000000000000 R13: 0000000000012cc0 R14: 0000000000000001 R15: ffff995c60db00f0 FS: 00007f4d115ca900(0000) GS:ffff995c60d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000002088 CR3: 00000017cca66002 CR4: 00000000007606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: alloc_slab_page+0x46/0x320 new_slab+0x9d/0x4e0 ___slab_alloc+0x507/0x6a0 ? io_wq_create+0xb4/0x2a0 __slab_alloc+0x1c/0x30 kmem_cache_alloc_node_trace+0xa6/0x260 io_wq_create+0xb4/0x2a0 io_uring_setup+0x97f/0xaa0 ? io_remove_personalities+0x30/0x30 ? io_poll_trigger_evfd+0x30/0x30 do_syscall_64+0x5b/0x1c0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f4d116cb1ed which is due to the 'wqe' and 'worker' allocation being node affine. But it isn't valid to call the node affine allocation if the node isn't online. Setup structures for even offline nodes, as usual, but skip them in terms of thread setup to not waste resources. If the node isn't online, just alloc memory with NUMA_NO_NODE. Reported-by: Glauber Costa Tested-by: Glauber Costa Signed-off-by: Jens Axboe commit 0e99b2c625da181aebf1a3d13493e3f7a5057a9c Author: Tomas Henzl Date: Tue Feb 4 16:24:13 2020 +0100 scsi: megaraid_sas: silence a warning Add a flag to DMA memory allocation to silence a warning. This driver allocates DMA memory for IO frames. This allocation may exceed MAX_ORDER pages for few megaraid_sas controllers (controllers with very high queue depth). Consequently, the driver has logic to keep reducing the controller queue depth until the DMA memory allocation succeeds. On impacted megaraid_sas controllers there would be multiple DMA allocation failures until driver settled on an allocation that fit. These failed DMA allocation requests caused stack traces in system logs. These were not harmful and this patch silences those warnings/stack traces. [mkp: clarified commit desc] Link: https://lore.kernel.org/r/20200204152413.7107-1-thenzl@redhat.com Signed-off-by: Tomas Henzl Acked-by: Sumit Saxena Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen commit c14335ebb92a98646ddbf447e6cacc66de5269ad Author: Bart Van Assche Date: Sun Feb 9 21:12:02 2020 -0800 scsi: Revert "target/core: Inline transport_lun_remove_cmd()" Commit 83f85b8ec305 postponed the percpu_ref_put(&se_cmd->se_lun->lun_ref) call from command completion to the time when the final command reference is dropped. That approach is not compatible with the iSCSI target driver because the iSCSI target driver keeps the command with the highest stat_sn after it has completed until the next command is received (see also iscsit_ack_from_expstatsn()). Fix this regression by reverting commit 83f85b8ec305. Fixes: 83f85b8ec305 ("scsi: target/core: Inline transport_lun_remove_cmd()") Cc: Pavel Zakharov Cc: Mike Christie Cc: Link: https://lore.kernel.org/r/20200210051202.12934-1-bvanassche@acm.org Reported-by: Pavel Zakharov Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit efbd9129dfe87fdeaa3c44e8246b019a775c484b Author: Taniya Das Date: Tue Feb 11 17:43:56 2020 +0530 clk: qcom: dispcc: Remove support of disp_cc_mdss_rscc_ahb_clk The disp_cc_mdss_rscc_ahb_clk is default enabled from hardware and thus does not require to be marked CRITICAL. This which would allow the RCG to be turned OFF when the display turns OFF and not blocking XO. Signed-off-by: Taniya Das Link: https://lkml.kernel.org/r/1581423236-21341-2-git-send-email-tdas@codeaurora.org Fixes: dd3d06622138 ("clk: qcom: Add display clock controller driver for SC7180") Signed-off-by: Stephen Boyd commit 8de427d52da30d3bad06d416e486a6b1bd0f3850 Author: Taniya Das Date: Tue Feb 11 17:43:55 2020 +0530 clk: qcom: videocc: Update the clock flag for video_cc_vcodec0_core_clk The clock disable signal for video_cc_vcodec0_core_clk is tied to vcodec0_gdsc which is supported in the HW control mode. Thus turning off the clock would be taken care automatically when the GDSC turns OFF by hardware and clock driver does not require to poll on the CLK_OFF bit. Signed-off-by: Taniya Das Link: https://lkml.kernel.org/r/1581423235-21341-1-git-send-email-tdas@codeaurora.org Fixes: 253dc75a0bb8 ("clk: qcom: Add video clock controller driver for SC7180") Signed-off-by: Stephen Boyd commit 9c974c77246460fa6a92c18554c3311c8c83c160 Author: Michal Koutný Date: Fri Jan 24 12:40:15 2020 +0100 cgroup: Iterate tasks that did not finish do_exit() PF_EXITING is set earlier than actual removal from css_set when a task is exitting. This can confuse cgroup.procs readers who see no PF_EXITING tasks, however, rmdir is checking against css_set membership so it can transitionally fail with EBUSY. Fix this by listing tasks that weren't unlinked from css_set active lists. It may happen that other users of the task iterator (without CSS_TASK_ITER_PROCS) spot a PF_EXITING task before cgroup_exit(). This is equal to the state before commit c03cd7738a83 ("cgroup: Include dying leaders with live threads in PROCS iterations") but it may be reviewed later. Reported-by: Suren Baghdasaryan Fixes: c03cd7738a83 ("cgroup: Include dying leaders with live threads in PROCS iterations") Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit 2d4ecb030dcc90fb725ecbfc82ce5d6c37906e0e Author: Vasily Averin Date: Thu Jan 30 13:34:59 2020 +0300 cgroup: cgroup_procs_next should increase position index If seq_file .next fuction does not change position index, read after some lseek can generate unexpected output: 1) dd bs=1 skip output of each 2nd elements $ dd if=/sys/fs/cgroup/cgroup.procs bs=8 count=1 2 3 4 5 1+0 records in 1+0 records out 8 bytes copied, 0,000267297 s, 29,9 kB/s [test@localhost ~]$ dd if=/sys/fs/cgroup/cgroup.procs bs=1 count=8 2 4 <<< NB! 3 was skipped 6 <<< ... and 5 too 8 <<< ... and 7 8+0 records in 8+0 records out 8 bytes copied, 5,2123e-05 s, 153 kB/s This happen because __cgroup_procs_start() makes an extra extra cgroup_procs_next() call 2) read after lseek beyond end of file generates whole last line. 3) read after lseek into middle of last line generates expected rest of last line and unexpected whole line once again. Additionally patch removes an extra position index changes in __cgroup_procs_start() Cc: stable@vger.kernel.org https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Tejun Heo commit db8dd9697238be70a6b4f9d0284cd89f59c0e070 Author: Vasily Averin Date: Thu Jan 30 13:34:49 2020 +0300 cgroup-v1: cgroup_pidlist_next should update position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. # mount | grep cgroup # dd if=/mnt/cgroup.procs bs=1 # normal output ... 1294 1295 1296 1304 1382 584+0 records in 584+0 records out 584 bytes copied dd: /mnt/cgroup.procs: cannot skip to specified offset 83 <<< generates end of last line 1383 <<< ... and whole last line once again 0+1 records in 0+1 records out 8 bytes copied dd: /mnt/cgroup.procs: cannot skip to specified offset 1386 <<< generates last line anyway 0+1 records in 0+1 records out 5 bytes copied https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Tejun Heo commit dbb92f88648d6206bf22fcb764fb9fe2939d401a Author: Andrea Parri Date: Wed Jan 22 19:39:52 2020 +0100 workqueue: Document (some) memory-ordering properties of {queue,schedule}_work() It's desirable to be able to rely on the following property: All stores preceding (in program order) a call to a successful queue_work() will be visible from the CPU which will execute the queued work by the time such work executes, e.g., { x is initially 0 } CPU0 CPU1 WRITE_ONCE(x, 1); [ "work" is being executed ] r0 = queue_work(wq, work); r1 = READ_ONCE(x); Forbids: r0 == true && r1 == 0 The current implementation of queue_work() provides such memory-ordering property: - In __queue_work(), the ->lock spinlock is acquired. - On the other side, in worker_thread(), this same ->lock is held when dequeueing work. So the locking ordering makes things work out. Add this property to the DocBook headers of {queue,schedule}_work(). Suggested-by: Paul E. McKenney Signed-off-by: Andrea Parri Acked-by: Paul E. McKenney Signed-off-by: Tejun Heo commit 4a4472fdc098fb78f52a0848788faf46674a8423 Author: Geert Uytterhoeven Date: Wed Feb 12 10:43:17 2020 +0100 of: clk: Make of_clk_get_parent_{count,name}() parameter const of_clk_get_parent_count() and of_clk_get_parent_name() never modify the device nodes passed, so they can be const. Signed-off-by: Geert Uytterhoeven Link: https://lkml.kernel.org/r/20200212094317.1150-1-geert+renesas@glider.be Signed-off-by: Stephen Boyd commit 205447fa9e0a44cc42a74788eb2f6c96f91d5cd6 Author: Johan Hovold Date: Wed Feb 12 10:24:26 2020 +0100 hwmon: (pmbus/xdpe12284) fix typo in compatible strings Make sure that the driver compatible strings matches the binding by removing the space between the manufacturer and model. Fixes: aaafb7c8eb1c ("hwmon: (pmbus) Add support for Infineon Multi-phase xdpe122 family controllers") Cc: Vadim Pasternak Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200212092426.24012-1-johan@kernel.org Signed-off-by: Guenter Roeck commit dde2bb2da01e96c17f0a44b4a3cf72a30e66e3ef Author: Boris Brezillon Date: Thu Feb 6 15:13:27 2020 +0100 drm/panfrost: perfcnt: Reserve/use the AS attached to the perfcnt MMU context We need to use the AS attached to the opened FD when dumping counters. Reported-by: Antonio Caggiano Fixes: 7282f7645d06 ("drm/panfrost: Implement per FD address spaces") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Tested-by: Antonio Caggiano Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20200206141327.446127-1-boris.brezillon@collabora.com commit 679aac5ead2f18d223554a52b543e1195e181811 Author: satya priya Date: Tue Feb 11 15:43:02 2020 +0530 tty: serial: qcom_geni_serial: Fix RX cancel command failure RX cancel command fails when BT is switched on and off multiple times. To handle this, poll for the cancel bit in SE_GENI_S_IRQ_STATUS register instead of SE_GENI_S_CMD_CTRL_REG. As per the HPG update, handle the RX last bit after cancel command and flush out the RX FIFO buffer. Signed-off-by: satya priya Cc: stable Link: https://lore.kernel.org/r/1581415982-8793-1-git-send-email-skakit@codeaurora.org Signed-off-by: Greg Kroah-Hartman commit 7febbcbc48fc92e3f33863b32ed715ba4aff18c4 Author: Andy Shevchenko Date: Tue Feb 11 15:55:59 2020 +0200 serial: 8250: Check UPF_IRQ_SHARED in advance The commit 54e53b2e8081 ("tty: serial: 8250: pass IRQ shared flag to UART ports") nicely explained the problem: ---8<---8<--- On some systems IRQ lines between multiple UARTs might be shared. If so, the irqflags have to be configured accordingly. The reason is: The 8250 port startup code performs IRQ tests *before* the IRQ handler for that particular port is registered. This is performed in serial8250_do_startup(). This function checks whether IRQF_SHARED is configured and only then disables the IRQ line while testing. This test is performed upon each open() of the UART device. Imagine two UARTs share the same IRQ line: On is already opened and the IRQ is active. When the second UART is opened, the IRQ line has to be disabled while performing IRQ tests. Otherwise an IRQ might handler might be invoked, but the IRQ itself cannot be handled, because the corresponding handler isn't registered, yet. That's because the 8250 code uses a chain-handler and invokes the corresponding port's IRQ handling routines himself. Unfortunately this IRQF_SHARED flag isn't configured for UARTs probed via device tree even if the IRQs are shared. This way, the actual and shared IRQ line isn't disabled while performing tests and the kernel correctly detects a spurious IRQ. So, adding this flag to the DT probe solves the issue. Note: The UPF_SHARE_IRQ flag is configured unconditionally. Therefore, the IRQF_SHARED flag can be set unconditionally as well. Example stack trace by performing `echo 1 > /dev/ttyS2` on a non-patched system: |irq 85: nobody cared (try booting with the "irqpoll" option) | [...] |handlers: |[] irq_default_primary_handler threaded [] serial8250_interrupt |Disabling IRQ #85 ---8<---8<--- But unfortunately didn't fix the root cause. Let's try again here by moving IRQ flag assignment from serial_link_irq_chain() to serial8250_do_startup(). This should fix the similar issue reported for 8250_pnp case. Since this change we don't need to have custom solutions in 8250_aspeed_vuart and 8250_of drivers, thus, drop them. Fixes: 1c2f04937b3e ("serial: 8250: add IRQ trigger support") Reported-by: Li RongQing Cc: Kurt Kanzenbach Cc: Vikram Pandita Signed-off-by: Andy Shevchenko Cc: stable Acked-by: Kurt Kanzenbach Link: https://lore.kernel.org/r/20200211135559.85960-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f76707831829530ffdd3888bebc108aecefccaa0 Author: Fugang Duan Date: Tue Feb 11 14:16:01 2020 +0800 tty: serial: imx: setup the correct sg entry for tx dma There has oops as below happen on i.MX8MP EVK platform that has 6G bytes DDR memory. when (xmit->tail < xmit->head) && (xmit->head == 0), it setups one sg entry with sg->length is zero: sg_set_buf(sgl + 1, xmit->buf, xmit->head); if xmit->buf is allocated from >4G address space, and SDMA only support <4G address space, then dma_map_sg() will call swiotlb_map() to do bounce buffer copying and mapping. But swiotlb_map() don't allow sg entry's length is zero, otherwise report BUG_ON(). So the patch is to correct the tx DMA scatter list. Oops: [ 287.675715] kernel BUG at kernel/dma/swiotlb.c:497! [ 287.680592] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 287.686075] Modules linked in: [ 287.689133] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.3-00016-g3fdc4e0-dirty #10 [ 287.696872] Hardware name: FSL i.MX8MP EVK (DT) [ 287.701402] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 287.706199] pc : swiotlb_tbl_map_single+0x1fc/0x310 [ 287.711076] lr : swiotlb_map+0x60/0x148 [ 287.714909] sp : ffff800010003c00 [ 287.718221] x29: ffff800010003c00 x28: 0000000000000000 [ 287.723533] x27: 0000000000000040 x26: ffff800011ae0000 [ 287.728844] x25: ffff800011ae09f8 x24: 0000000000000000 [ 287.734155] x23: 00000001b7af9000 x22: 0000000000000000 [ 287.739465] x21: ffff000176409c10 x20: 00000000001f7ffe [ 287.744776] x19: ffff000176409c10 x18: 000000000000002e [ 287.750087] x17: 0000000000000000 x16: 0000000000000000 [ 287.755397] x15: 0000000000000000 x14: 0000000000000000 [ 287.760707] x13: ffff00017f334000 x12: 0000000000000001 [ 287.766018] x11: 00000000001fffff x10: 0000000000000000 [ 287.771328] x9 : 0000000000000003 x8 : 0000000000000000 [ 287.776638] x7 : 0000000000000000 x6 : 0000000000000000 [ 287.781949] x5 : 0000000000200000 x4 : 0000000000000000 [ 287.787259] x3 : 0000000000000001 x2 : 00000001b7af9000 [ 287.792570] x1 : 00000000fbfff000 x0 : 0000000000000000 [ 287.797881] Call trace: [ 287.800328] swiotlb_tbl_map_single+0x1fc/0x310 [ 287.804859] swiotlb_map+0x60/0x148 [ 287.808347] dma_direct_map_page+0xf0/0x130 [ 287.812530] dma_direct_map_sg+0x78/0xe0 [ 287.816453] imx_uart_dma_tx+0x134/0x2f8 [ 287.820374] imx_uart_dma_tx_callback+0xd8/0x168 [ 287.824992] vchan_complete+0x194/0x200 [ 287.828828] tasklet_action_common.isra.0+0x154/0x1a0 [ 287.833879] tasklet_action+0x24/0x30 [ 287.837540] __do_softirq+0x120/0x23c [ 287.841202] irq_exit+0xb8/0xd8 [ 287.844343] __handle_domain_irq+0x64/0xb8 [ 287.848438] gic_handle_irq+0x5c/0x148 [ 287.852185] el1_irq+0xb8/0x180 [ 287.855327] cpuidle_enter_state+0x84/0x360 [ 287.859508] cpuidle_enter+0x34/0x48 [ 287.863083] call_cpuidle+0x18/0x38 [ 287.866571] do_idle+0x1e0/0x280 [ 287.869798] cpu_startup_entry+0x20/0x40 [ 287.873721] rest_init+0xd4/0xe0 [ 287.876949] arch_call_rest_init+0xc/0x14 [ 287.880958] start_kernel+0x420/0x44c [ 287.884622] Code: 9124c021 9417aff8 a94363f7 17ffffd5 (d4210000) [ 287.890718] ---[ end trace 5bc44c4ab6b009ce ]--- [ 287.895334] Kernel panic - not syncing: Fatal exception in interrupt [ 287.901686] SMP: stopping secondary CPUs [ 288.905607] SMP: failed to stop secondary CPUs 0-1 [ 288.910395] Kernel Offset: disabled [ 288.913882] CPU features: 0x0002,2000200c [ 288.917888] Memory Limit: none [ 288.920944] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Reported-by: Eagle Zhou Tested-by: Eagle Zhou Signed-off-by: Fugang Duan Cc: stable Fixes: 7942f8577f2a ("serial: imx: TX DMA: clean up sg initialization") Reviewed-by: Uwe Kleine-König Link: https://lore.kernel.org/r/1581401761-6378-1-git-send-email-fugang.duan@nxp.com Signed-off-by: Greg Kroah-Hartman commit 0bf999f9c5e74c7ecf9dafb527146601e5c848b9 Author: Randy Dunlap Date: Sun Feb 9 19:36:14 2020 -0800 linux/pipe_fs_i.h: fix kernel-doc warnings after @wait was split Fix kernel-doc warnings in struct pipe_inode_info after @wait was split into @rd_wait and @wr_wait. include/linux/pipe_fs_i.h:66: warning: Function parameter or member 'rd_wait' not described in 'pipe_inode_info' include/linux/pipe_fs_i.h:66: warning: Function parameter or member 'wr_wait' not described in 'pipe_inode_info' Fixes: 0ddad21d3e99 ("pipe: use exclusive waits when reading or writing") Signed-off-by: Randy Dunlap Signed-off-by: Linus Torvalds commit 6cd1ed50efd88261298577cd92a14f2768eddeeb Author: Eric Dumazet Date: Mon Feb 10 11:07:21 2020 -0800 vt: vt_ioctl: fix race in VT_RESIZEX We need to make sure vc_cons[i].d is not NULL after grabbing console_lock(), or risk a crash. general protection fault, probably for non-canonical address 0xdffffc0000000068: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000340-0x0000000000000347] CPU: 1 PID: 19462 Comm: syz-executor.5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883 Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40 RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000 RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340 RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x123/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45b399 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f7d13c11c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7d13c126d4 RCX: 000000000045b399 RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000666 R14: 00000000004c7f04 R15: 000000000075bf2c Modules linked in: ---[ end trace 80970faf7a67eb77 ]--- RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883 Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40 RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000 RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340 RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Cc: stable Reported-by: syzbot Link: https://lore.kernel.org/r/20200210190721.200418-1-edumazet@google.com Signed-off-by: Greg Kroah-Hartman commit fe154a2422333c4cd87bb0d8a19fb2df066cc6ee Author: YueHaibing Date: Mon Feb 3 15:27:24 2020 +0000 drm/panfrost: Remove set but not used variable 'bo' Fixes gcc '-Wunused-but-set-variable' warning: drivers/gpu/drm/panfrost/panfrost_job.c: In function 'panfrost_job_cleanup': drivers/gpu/drm/panfrost/panfrost_job.c:278:31: warning: variable 'bo' set but not used [-Wunused-but-set-variable] commit bdefca2d8dc0 ("drm/panfrost: Add the panfrost_gem_mapping concept") involved this unused variable. Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Steven Price Reviewed-by: Alyssas Rosenzweig Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20200203152724.42611-1-yuehaibing@huawei.com commit 4ee656bba8013929bcc050bcebc39a47fe763ee9 Author: Tony Nguyen Date: Thu Feb 6 01:20:13 2020 -0800 ice: Trivial fixes This is a collection of trivial fixes including fixing whitespace, typos, function headers, reverse Christmas tree, etc. Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 1d8bd9927234081db15a1d42a7f99505244e3703 Author: Ben Shelton Date: Thu Feb 6 01:20:12 2020 -0800 ice: Use correct netif error function Use the correct netif_msg_[tx,rx]_error() function to determine whether to print the MDD event type. Signed-off-by: Ben Shelton Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 3306f79f428e858a80d5eadb974c80a1faa399f3 Author: Anirudh Venkataramanan Date: Thu Feb 6 01:20:11 2020 -0800 ice: Cleanup ice_vsi_alloc_q_vectors 1. Remove local variable num_q_vectors and use vsi->num_q_vectors instead 2. Remove local variable pf and pass vsi->back to ice_pf_to_dev Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 19cce2c6f6dc43dd9cd6ba8a9123857192990d50 Author: Anirudh Venkataramanan Date: Thu Feb 6 01:20:10 2020 -0800 ice: Make print statements more compact Formatting strings in print function calls (like dev_info, dev_err, etc.) can exceed 80 columns without making checkpatch unhappy. So remove newlines where applicable and make print statements more compact. Signed-off-by: Anirudh Venkataramanan Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 9a946843ba5c173e259fef7a035feac994a65b59 Author: Anirudh Venkataramanan Date: Thu Feb 6 01:20:09 2020 -0800 ice: Use ice_pf_to_dev Use ice_pf_to_dev(pf) instead of &pf->pdev->dev Use ice_pf_to_dev(vsi->back) instead of &vsi->back->pdev->dev When a pointer to the pf instance is available, use ice_pf_to_dev instead of ice_hw_to_dev Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 0a6ea04e3bbd20833d2b49296e5adc1c5bb86386 Author: Tony Nguyen Date: Thu Feb 6 01:20:08 2020 -0800 ice: Remove possible null dereference Commit 1f45ebe0d8fb ("ice: add extra check for null Rx descriptor") moved the call to ice_construct_skb() under a null check as Coverity reported a possible use of null skb. However, the original call was not deleted, do so now. Fixes: 1f45ebe0d8fb ("ice: add extra check for null Rx descriptor") Reported-by: Bruce Allan Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit cf8fc2a0863f9ff27ebd2efcdb1f7d378b9fb8a6 Author: Bruce Allan Date: Thu Feb 6 01:20:07 2020 -0800 ice: update Unit Load Status bitmask to check after reset After a reset the Unit Load Status bits in the GLNVM_ULD register to check for completion should be 0x7FF before continuing. Update the mask to check (minus the three reserved bits that are always set). Signed-off-by: Bruce Allan Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit fbf1e1f6988e70287b1bfcad4f655ca96b681929 Author: Bruce Allan Date: Thu Feb 6 01:20:06 2020 -0800 ice: fix and consolidate logging of NVM/firmware version information Logging the firmware/NVM information during driver load is redundant since that information is also available via ethtool. Move the functionality found in ice_nvm_version_str() directly into ice_get_drvinfo() and remove calling the former and logging that info during driver probe. This also gets rid of a bug in ice_nvm_version_str() where it returns a pointer to a buffer which is free'ed when that function exits. Signed-off-by: Bruce Allan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit b55e603252acdf229501d27f6ecb78107cbb1855 Author: Akeem G Abodunrin Date: Thu Feb 6 01:20:05 2020 -0800 ice: Modify link message logging This patch modifies link message logging to include "Full Duplex" and "Negotiated" for FEC, so as to distinguish it from "Requested" FEC. Signed-off-by: Akeem G Abodunrin Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit a8b72ce03a114239e95c9dd7e892c65452478183 Author: Anirudh Venkataramanan Date: Thu Feb 6 01:20:04 2020 -0800 ice: Remove CONFIG_PCI_IOV wrap in ice_set_pf_caps Remove unnecessary CONFIG_PCI_IOV wrapping in ice_set_pf_caps. None of the data structures accessed within the block are wrapped with this flag. When CONFIG_PCI_IOV is undefined, pf->num_vfs_supported will be 0 anyway. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 3d9f99908037a90ba9399e553b9beffcac26f068 Author: Brett Creeley Date: Thu Feb 6 01:20:03 2020 -0800 ice: Remove ice_dev_onetime_setup() ice_dev_onetime_setup contains driver workarounds needed for firmware limitations. These issues have now been resolved in newer NVMs so remove the function. Signed-off-by: Brett Creeley Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 168983a8e19b89efd175661e53faa6246be363a0 Author: Brett Creeley Date: Thu Feb 6 01:20:02 2020 -0800 ice: Don't allow same value for Rx tail to be written twice Currently we compare the value we are about to write to the Rx tail register with the previous value of next_to_use. The problem with this is we only write tail on 8 descriptor boundaries, but next_to_use is updated whenever we clean Rx descriptors. Fix this by comparing the value we are about to write to tail with the previously written tail value. This will prevent duplicate Rx tail bumps. Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ad9a87bec3d004ce80e9104e3a0aa6a204a15dbf Author: Paul Greenwalt Date: Thu Feb 6 01:20:01 2020 -0800 ice: display supported and advertised link modes Display all of the supported and advertised link modes based on the PHY capability with media. Displaying all supported modes is more informative then only displaying the current link mode. Signed-off-by: Paul Greenwalt Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 53977ee47410885e7d4eee87d2c811a48a275150 Author: Dave Ertman Date: Thu Feb 6 01:20:00 2020 -0800 ice: Fix switch between FW and SW LLDP When switching between FW and SW LLDP mode, the number of configured TLV apps in the driver's DCB configuration is getting out of synch with what lldpad thinks is configured. This is causing a problem when shutting down lldpad. The cleanup is trying to delete TLV apps that are not defined in the kernel. Since the driver is keeping an accurate account of the apps defined, use the drivers number of apps to determine if there is an app to delete. If the number of apps is <= 1, then do not attempt to delete. Signed-off-by: Dave Ertman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 242b5e068b25119d6f1d63dac076b79d89580b4b Author: Dave Ertman Date: Thu Feb 6 01:19:59 2020 -0800 ice: Fix DCB rebuild after reset The function ice_dcb_rebuild had some logic flaws in it, and also didn't differentiate between FW and SW modes needs. For FW flow, the willing setting was being forced to OFF and left that way. Unwilling in DCB FW mode is not a supported model. Leave the config alone and use the return value from the set command to determine if setting the config was successful. The SW DCB flow does not need to need to register for MIB change events (as they are not used in SW mode). Use !is_sw_lldp checks to only perform FW specific task while in FW mode. Also adding a reapplication of the current DCB config after a link event. Some NVMs are not maintaining their DCB configs across link events. Signed-off-by: Dave Ertman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ead68df94d248c80fdbae220ae5425eb5af2e753 Author: Paolo Bonzini Date: Wed Feb 12 20:15:29 2020 +0100 KVM: x86: enable -Werror Avoid more embarrassing mistakes. At least those that the compiler can catch. Signed-off-by: Paolo Bonzini commit 120881b9e888689cbdb90a1dd1689684d8bc95f3 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:06 2020 +0100 docs: virt: guest-halt-polling.txt convert to ReST Due to some merge conflict, this file ended being alone under Documentation/virtual. The file itself is almost at ReST format. Just minor adjustments are needed: - Adjust title markup; - Adjust a list identation; - add a literal block markup; - Add some blank lines. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 033741c6c997e60f9c2de280925519d3ccff5366 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:05 2020 +0100 docs: kvm: review-checklist.txt: rename to ReST This file is already in ReST compatible format. So, rename it and add to the kvm's index.rst. While here, use the standard conversion for document titles. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 6012d9a9fa693e608f4de3c5a13741794dc4b2c7 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:04 2020 +0100 docs: kvm: Convert timekeeping.txt to ReST format - Use document title and chapter markups; - Add markups for literal blocks; - Add markups for tables; - use :field: for field descriptions; - Add blank lines and adjust indentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit a9700af64e1bb28fc18fd362307bc787e10e340b Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:03 2020 +0100 docs: kvm: Convert s390-diag.txt to ReST format This file is almost in ReST format. Just one change was needed: - Add markups for a literal block and change its indentation. While here, use the standard markup for the document title. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit c849d8613991292d5f945956780bb8134cbce7ed Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:02 2020 +0100 docs: kvm: Convert ppc-pv.txt to ReST format - Use document title and chapter markups; - Add markups for tables; - Use list markups; - Add markups for literal blocks; - Add blank lines. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 320f3f74d9a1a4a193d515de0549eafc82369f47 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:01 2020 +0100 docs: kvm: Convert nested-vmx.txt to ReST format This file is almost in ReST format. Just a small set of changes were needed: - Add markups for lists; - Add markups for a literal block; - Adjust whitespaces. While here, use the standard markup for the document title. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 037d1f92eff908f794644d49435d8849a3c10461 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:03:00 2020 +0100 docs: kvm: Convert mmu.txt to ReST format - Use document title and chapter markups; - Add markups for tables; - Add markups for literal blocks; - Add blank lines and adjust indentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 75e7fcdb4a6f394a6644ee1cfe193284945003b5 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:59 2020 +0100 docs: kvm: Convert locking.txt to ReST format - Use document title and chapter markups; - Add markups for literal blocks; - use :field: for field descriptions; - Add blank lines and adjust indentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 5a0af4806c25aff4b2f8d2e24d635840ec58a87b Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:58 2020 +0100 docs: kvm: Convert hypercalls.txt to ReST format - Use document title and chapter markups; - Convert tables; - Add markups for literal blocks; - use :field: for field descriptions; - Add blank lines and adjust indentation Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit cec0e48be339f06879d971702f206e9683956ef1 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:57 2020 +0100 docs: kvm: arm/psci.txt: convert to ReST - Add a title for the document; - Adjust whitespaces for it to be properly formatted after parsed. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 69bf758bc8a4875a361d7c703995248d808fa24d Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:56 2020 +0100 docs: kvm: convert arm/hyp-abi.txt to ReST - Add proper markups for titles; - Adjust whitespaces and blank lines to match ReST needs; - Mark literal blocks as such. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 106ee47dc633a930bb61290713217803aee194e7 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:55 2020 +0100 docs: kvm: Convert api.txt to ReST format convert api.txt document to ReST format while trying to keep its format as close as possible with the authors intent, and avoid adding uneeded markups. - Use document title and chapter markups; - Convert tables; - Add markups for literal blocks; - use :field: for field descriptions; - Add blank lines and adjust indentation Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit d3b52e4976cec9c830bc14bd38f043e8ca00ba68 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:54 2020 +0100 docs: kvm: convert devices/xive.txt to ReST - Use title markups; - adjust indentation and add blank lines as needed; - adjust tables to match ReST accepted formats; - mark code blocks as such. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 5cccf3797435008b7cd8d9d98d37db3962368710 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:53 2020 +0100 docs: kvm: convert devices/xics.txt to ReST - Use title markups; - adjust indentation and add blank lines as needed; - adjust tables to match ReST accepted formats; - use :field: markups. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 6c972ba685d5849009e0747cf8799adc3b8d5f11 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:52 2020 +0100 docs: kvm: convert devices/vm.txt to ReST - Use title markups; - adjust indentation and add blank lines as needed; - use :field: markups; - Use cross-references; - mark code blocks as such. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit aff7aeea548312cacd146e80efb944bd8f2c0faa Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:51 2020 +0100 docs: kvm: convert devices/vfio.txt to ReST - Use standard title markup; - adjust lists; - mark code blocks as such. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit e777a5bd98c689f1ee15ebdbce739497e7d92f70 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:50 2020 +0100 docs: kvm: convert devices/vcpu.txt to ReST - Use title markups; - adjust indentation and add blank lines as needed; - adjust tables to match ReST accepted formats; - use :field: markups; - mark code blocks as such. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit e944743003617aeaebebc33adef5de093e701766 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:49 2020 +0100 docs: kvm: convert devices/s390_flic.txt to ReST - Use standard markup for document title; - Adjust indentation and add blank lines as needed; - use the notes markup; - mark code blocks as such. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 05c47036c62ea65a8f8aeaef5021c7220488a664 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:48 2020 +0100 docs: kvm: convert devices/mpic.txt to ReST This document is almost in ReST format. The only thing needed is to mark a list as such and to add an extra whitespace. Yet, let's also use the standard document title markup, as it makes easier if anyone wants later to add sessions to it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit bf6154dba0a7d4defd3e8c9c85d1933f442ef01b Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:47 2020 +0100 docs: kvm: convert devices/arm-vgit.txt to ReST - Use title markups; - change indent to match ReST syntax; - use proper table markups; - use literal block markups. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit c0d1c8a0af591c139fe7339bf6cdf0e766037cd4 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:46 2020 +0100 docs: kvm: devices/arm-vgit-v3.txt to ReST - Use title markups; - change indent to match ReST syntax; - use proper table markups; - use literal block markups. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit d371c011fc5e16bc50985bab94b7141204c52153 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:45 2020 +0100 docs: kvm: devices/arm-vgic-its.txt to ReST format - Fix document title to match ReST format - Convert the table to be properly recognized - use proper markups for literal blocks - Some indentation fixes to match ReST While here, add an index for kvm devices. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 263a19ff21c4a10f0a2d77c21feb3a641e5127f0 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:44 2020 +0100 docs: virt: Convert msr.txt to ReST format - Use document title markup; - Convert tables; - Add blank lines and adjust indentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 2756df60d09748b1ccdc568690f9c4112353c920 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:43 2020 +0100 docs: virt: convert halt-polling.txt to ReST format - Fix document title to match ReST format - Convert the table to be properly recognized - Some indentation fixes to match ReST syntax. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit c09708ccb4612890407c10a408624c229bf91b76 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:42 2020 +0100 docs: virt: user_mode_linux.rst: fix URL references Several URLs are pointing to outdated places. Update the references for the URLs whose contents still exists, removing the others. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 72f8a49dc8b9e97a7986b0e6eced00a1a2e28996 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:41 2020 +0100 docs: virt: user_mode_linux.rst: update compiling instructions Instead of pointing for a pre-2.4 and a seaparate patch, update it to match current upstream, as UML was merged a long time ago. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 3b00b042eeaaea43b8702b2dd4b9cb0916a2e052 Author: Geert Uytterhoeven Date: Wed Feb 12 11:00:47 2020 +0100 ARC: Replace by The ARC platform code is not a clock provider, and just needs to call of_clk_init(). Hence it can include instead of . Signed-off-by: Geert Uytterhoeven Reviewed-by: Stephen Boyd Signed-off-by: Vineet Gupta commit 7d94ab169b8f047ad61ff6ea8e3e7602d0516623 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:40 2020 +0100 docs: virt: convert UML documentation to ReST Despite being an old document, it contains lots of information that could still be useful. The document has a nice style with makes easy to convert to ReST. So, let's convert it to ReST. This patch does: - Use proper markups for titles; - Mark and proper indent literal blocks; - don't use an 'o' character for lists; - other minor changes required for the doc to be parsed. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 7bd460fc1dfa7d82d99493fc5d7b5f9c7b679af4 Author: Mauro Carvalho Chehab Date: Mon Feb 10 07:02:39 2020 +0100 docs: kvm: add arm/pvtime.rst to index.rst Add this file to a new kvm/arm index.rst, in order for it to be shown as part of the virt book. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Paolo Bonzini commit 9446e6fce0ab9dfd44b96f630b4e3a0a0ab879fd Author: Paolo Bonzini Date: Wed Feb 12 13:27:10 2020 +0100 KVM: x86: fix WARN_ON check of an unsigned less than zero The check cpu->hv_clock.system_time < 0 is redundant since system_time is a u64 and hence can never be less than zero. But what was actually meant is to check that the result is positive, since kernel_ns and v->kvm->arch.kvmclock_offset are both s64. Reported-by: Colin King Suggested-by: Sean Christopherson Addresses-Coverity: ("Macro compares unsigned to 0") Reviewed-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit ff479025349cef3106e165a761281851fd018282 Author: Eric Auger Date: Fri Feb 7 15:27:13 2020 +0100 selftests: KVM: Remove unused x86_register enum x86_register enum is not used, let's remove it. Signed-off-by: Eric Auger Suggested-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit f6ab0107a4942dbf9a5cf0cca3f37e184870a360 Author: Sean Christopherson Date: Fri Feb 7 09:37:42 2020 -0800 KVM: x86/mmu: Fix struct guest_walker arrays for 5-level paging Define PT_MAX_FULL_LEVELS as PT64_ROOT_MAX_LEVEL, i.e. 5, to fix shadow paging for 5-level guest page tables. PT_MAX_FULL_LEVELS is used to size the arrays that track guest pages table information, i.e. using a "max levels" of 4 causes KVM to access garbage beyond the end of an array when querying state for level 5 entries. E.g. FNAME(gpte_changed) will read garbage and most likely return %true for a level 5 entry, soft-hanging the guest because FNAME(fetch) will restart the guest instead of creating SPTEs because it thinks the guest PTE has changed. Note, KVM doesn't yet support 5-level nested EPT, so PT_MAX_FULL_LEVELS gets to stay "4" for the PTTYPE_EPT case. Fixes: 855feb673640 ("KVM: MMU: Add 5 level EPT & Shadow page table support.") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 148d735eb55d32848c3379e460ce365f2c1cbe4b Author: Sean Christopherson Date: Fri Feb 7 09:37:41 2020 -0800 KVM: nVMX: Use correct root level for nested EPT shadow page tables Hardcode the EPT page-walk level for L2 to be 4 levels, as KVM's MMU currently also hardcodes the page walk level for nested EPT to be 4 levels. The L2 guest is all but guaranteed to soft hang on its first instruction when L1 is using EPT, as KVM will construct 4-level page tables and then tell hardware to use 5-level page tables. Fixes: 855feb673640 ("KVM: MMU: Add 5 level EPT & Shadow page table support.") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit ffdbd50dca67b1f12d6f531a0eaf2028d793e54f Author: Miaohe Lin Date: Fri Feb 7 23:22:45 2020 +0800 KVM: nVMX: Fix some comment typos and coding style Fix some typos in the comments. Also fix coding style. [Sean Christopherson rewrites the comment of write_fault_to_shadow_pgtable field in struct kvm_vcpu_arch.] Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 7a02674d154d38da33517855b6d1d4cfc27a9a04 Author: Sean Christopherson Date: Thu Feb 6 14:14:34 2020 -0800 KVM: x86/mmu: Avoid retpoline on ->page_fault() with TDP Wrap calls to ->page_fault() with a small shim to directly invoke the TDP fault handler when the kernel is using retpolines and TDP is being used. Single out the TDP fault handler and annotate the TDP path as likely to coerce the compiler into preferring it over the indirect function call. Rename tdp_page_fault() to kvm_tdp_page_fault(), as it's exposed outside of mmu.c to allow inlining the shim. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 331ca0f89fc206f06b341f7fe037d7d8662b1b9f Author: Miaohe Lin Date: Fri Feb 7 23:22:07 2020 +0800 KVM: apic: reuse smp_wmb() in kvm_make_request() kvm_make_request() provides smp_wmb() so pending_events changes are guaranteed to be visible. Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 20796447a1abee9afd0c136d5c60651bfbaf46b8 Author: Miaohe Lin Date: Fri Feb 7 23:27:51 2020 +0800 KVM: x86: remove duplicated KVM_REQ_EVENT request The KVM_REQ_EVENT request is already made in kvm_set_rflags(). We should not make it again. Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 1ea2cc0cd7c676668841f63c915fb55244f0268c Author: Eric Auger Date: Thu Feb 6 11:47:10 2020 +0100 selftests: KVM: SVM: Add vmcall test L2 guest calls vmcall and L1 checks the exit status does correspond. Signed-off-by: Eric Auger Reviewed-by: Vitaly Kuznetsov Reviewed-by: Miaohe Lin Tested-by: Wei Huang Signed-off-by: Paolo Bonzini commit 20ba262f8631aadefa87921481fe569ecc387f20 Author: Eric Auger Date: Thu Feb 6 11:47:09 2020 +0100 selftests: KVM: AMD Nested test infrastructure Add the basic infrastructure needed to test AMD nested SVM. This is largely copied from the KVM unit test infrastructure. Signed-off-by: Eric Auger Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 1ecaabed4e4a0d1027eadd54eb0e179350a79f99 Author: Eric Auger Date: Thu Feb 6 11:47:08 2020 +0100 selftests: KVM: Replace get_{gdt,idt}_base() by get_{gdt,idt}() get_gdt_base() and get_idt_base() only return the base address of the descriptor tables. Soon we will need to get the size as well. Change the prototype of those functions so that they return the whole desc_ptr struct instead of the address field. Signed-off-by: Eric Auger Reviewed-by: Vitaly Kuznetsov Reviewed-by: Miaohe Lin Reviewed-by: Wei Huang Reviewed-by: Krish Sadhukhan Signed-off-by: Paolo Bonzini commit efeda80da38d0b4afd77a12bd4a44f657567d26c Author: Trond Myklebust Date: Wed Feb 5 09:01:54 2020 -0500 NFSv4: Fix revalidation of dentries with delegations If a dentry was not initially looked up while we were holding a delegation, then we do still need to revalidate that it still holds the same name. If there are multiple hard links to the same file, then all the hard links need validation. Reported-by: Benjamin Coddington Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Tested-by: Benjamin Coddington [Anna: Put nfs_unset_verifier_delegated() under CONFIG_NFS_V4] Signed-off-by: Anna Schumaker commit 57d7713196ccd83010fcaa82b9f02d740c9e6bb2 Author: Michal Simek Date: Wed Feb 12 11:59:47 2020 +0100 usb: gadget: udc-xilinx: Fix xudc_stop() kernel-doc format The patch removes "driver" parameter which has been removed without updating kernel-doc format. Fixes: 22835b807e7c ("usb: gadget: remove unnecessary 'driver' argument") Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/c753b529bdcdfdd40a3cf69121527ec8c63775cb.1581505183.git.michal.simek@xilinx.com Signed-off-by: Greg Kroah-Hartman commit f2850dd5ee015bd7b77043f731632888887689c7 Merge: 359c92c02bfa 083bc0e1ce91 Author: Linus Torvalds Date: Wed Feb 12 10:28:42 2020 -0800 Merge tag 'kbuild-fixes-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - fix memory corruption in scripts/kallsyms - fix the vmlinux link stage to correctly update compile.h * tag 'kbuild-fixes-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: fix mismatch between .version and include/generated/compile.h scripts/kallsyms: fix memory corruption caused by write over-run commit 1880b1f1d686b17387b5bf45654eb1d087ead918 Author: Ravulapati Vishnu vardhan rao Date: Tue Feb 11 18:42:28 2020 +0530 ASoC: amd: Buffer Size instead of MAX Buffer Because of MAX BUFFER size in register,when user/app give small buffer size produces noise of old data in buffer. This patch rectifies this noise when using different buffer sizes less than MAX BUFFER. Signed-off-by: Ravulapati Vishnu vardhan rao Link: https://lore.kernel.org/r/1581426768-8937-1-git-send-email-Vishnuvardhanrao.Ravulapati@amd.com Signed-off-by: Mark Brown commit b9287f2ac321ecac56eb51e6231f6579683dcdae Author: Kunihiko Hayashi Date: Wed Feb 12 19:55:34 2020 +0900 net: ethernet: ave: Add capability of rgmii-id mode This allows you to specify the type of rgmii-id that will enable phy internal delay in ethernet phy-mode. This adds all RGMII cases to all of get_pinmode() except LD11, because LD11 SoC doesn't support RGMII due to the constraint of the hardware. When RGMII phy mode is specified in the devicetree for LD11, the driver will abort with an error. Signed-off-by: Kunihiko Hayashi Signed-off-by: David S. Miller commit 5f6f8da2d7b5a431d3f391d0d73ace8edfb42af7 Author: Greg Kroah-Hartman Date: Tue Feb 11 20:04:22 2020 -0800 USB: misc: iowarrior: add support for the 28 and 28L devices Add new device ids for the 28 and 28L devices. These have 4 interfaces instead of 2, but the driver binds the same, so the driver changes are minimal. Cc: Christoph Jung Cc: stable Link: https://lore.kernel.org/r/20200212040422.2991-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 461d8deb26a7d70254bc0391feb4fd8a95e674e8 Author: Greg Kroah-Hartman Date: Tue Feb 11 20:04:21 2020 -0800 USB: misc: iowarrior: add support for 2 OEMed devices Add support for two OEM devices that are identical to existing IO-Warrior devices, except for the USB device id. Cc: Christoph Jung Cc: stable Link: https://lore.kernel.org/r/20200212040422.2991-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit b692056db8ecc7f452b934f016c17348282b7699 Author: Richard Dodd Date: Wed Feb 12 14:22:18 2020 +0000 USB: Fix novation SourceControl XL after suspend Currently, the SourceControl will stay in power-down mode after resuming from suspend. This patch resets the device after suspend to power it up. Signed-off-by: Richard Dodd Cc: stable Link: https://lore.kernel.org/r/20200212142220.36892-1-richard.o.dodd@gmail.com Signed-off-by: Greg Kroah-Hartman commit cf0ee7c60c89641f6e4d1d3c7867fe32b9e30300 Author: Mathias Nyman Date: Tue Feb 11 17:01:58 2020 +0200 xhci: Fix memory leak when caching protocol extended capability PSI tables - take 2 xhci driver assumed that xHC controllers have at most one custom supported speed table (PSI) for all usb 3.x ports. Memory was allocated for one PSI table under the xhci hub structure. Turns out this is not the case, some controllers have a separate "supported protocol capability" entry with a PSI table for each port. This means each usb3 roothub port can in theory support different custom speeds. To solve this, cache all supported protocol capabilities with their PSI tables in an array, and add pointers to the xhci port structure so that every port points to its capability entry in the array. When creating the SuperSpeedPlus USB Device Capability BOS descriptor for the xhci USB 3.1 roothub we for now will use only data from the first USB 3.1 capable protocol capability entry in the array. This could be improved later, this patch focuses resolving the memory leak. Reported-by: Paul Menzel Reported-by: Sajja Venkateswara Rao Fixes: 47189098f8be ("xhci: parse xhci protocol speed ID list for usb 3.1 usage") Cc: stable # v4.4+ Signed-off-by: Mathias Nyman Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20200211150158.14475-1-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 67f68f977a12657028e866c013d43dd87320d210 Author: Greg Kroah-Hartman Date: Wed Feb 12 09:48:57 2020 -0800 Revert "xhci: Fix memory leak when caching protocol extended capability PSI tables" This reverts commit fc57313d1017dd6b6f37a94e88daa8df54368ecc. Marek reports that it breaks things: This patch landed in today's linux-next (20200211) and causes NULL pointer dereference during second suspend/resume cycle on Samsung Exynos5422-based (arm 32bit) Odroid XU3lite board: A more complete fix will be added soon. Reported-by: Marek Szyprowski Fixes: fc57313d1017 ("xhci: Fix memory leak when caching protocol extended capability PSI tables") Cc: Paul Menzel Cc: Sajja Venkateswara Rao Cc: stable # v4.4+ Cc: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 0f90522591fd09dd201065c53ebefdfe3c6b55cb Author: Firo Yang Date: Wed Feb 12 06:09:17 2020 +0100 enic: prevent waking up stopped tx queues over watchdog reset Recent months, our customer reported several kernel crashes all preceding with following message: NETDEV WATCHDOG: eth2 (enic): transmit queue 0 timed out Error message of one of those crashes: BUG: unable to handle kernel paging request at ffffffffa007e090 After analyzing severl vmcores, I found that most of crashes are caused by memory corruption. And all the corrupted memory areas are overwritten by data of network packets. Moreover, I also found that the tx queues were enabled over watchdog reset. After going through the source code, I found that in enic_stop(), the tx queues stopped by netif_tx_disable() could be woken up over a small time window between netif_tx_disable() and the napi_disable() by the following code path: napi_poll-> enic_poll_msix_wq-> vnic_cq_service-> enic_wq_service-> netif_wake_subqueue(enic->netdev, q_number)-> test_and_clear_bit(__QUEUE_STATE_DRV_XOFF, &txq->state) In turn, upper netowrk stack could queue skb to ENIC NIC though enic_hard_start_xmit(). And this might introduce some race condition. Our customer comfirmed that this kind of kernel crash doesn't occur over 90 days since they applied this patch. Signed-off-by: Firo Yang Signed-off-by: David S. Miller commit 5c320b6ce7510653bce68cecf80cf5b2d67e907f Author: Stephan Gerhold Date: Fri Jan 17 16:34:29 2020 +0100 drm/modes: Allow DRM_MODE_ROTATE_0 when applying video mode parameters At the moment, only DRM_MODE_ROTATE_180 is allowed when we try to apply the rotation from the video mode parameters. It is also useful to allow DRM_MODE_ROTATE_0 in case there is only a reflect option in the video mode parameter (e.g. video=540x960,reflect_x). DRM_MODE_ROTATE_0 means "no rotation" and should therefore not require any special handling, so we can just add it to the if condition. Signed-off-by: Stephan Gerhold Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20200117153429.54700-3-stephan@gerhold.net commit e6980a727154b793adb218fbc7b4d6af52a7e364 Author: Stephan Gerhold Date: Fri Jan 17 16:34:28 2020 +0100 drm/modes: Make sure to parse valid rotation value from cmdline A rotation value should have exactly one rotation angle. At the moment there is no validation for this when parsing video= parameters from the command line. This causes problems later on when we try to combine the command line rotation with the panel orientation. To make sure that we generate a valid rotation value: - Set DRM_MODE_ROTATE_0 by default (if no rotate= option is set) - Validate that there is exactly one rotation angle set (i.e. specifying the rotate= option multiple times is invalid) Signed-off-by: Stephan Gerhold Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20200117153429.54700-2-stephan@gerhold.net commit b50f4f940b736b63df1d8a0ddcd28f0a580233eb Author: Maxime Ripard Date: Mon Feb 10 11:04:55 2020 +0100 dt-bindings: display: sunxi: Fix compatible Commit f5a98bfe7b37 ("dt-bindings: display: Convert Allwinner display pipeline to schemas") introduced a YAML schema for the Allwinner TCON DT binding, but the H6 TCON-TV compatible was mistakenly set to fallback on the A83t's, while the initial documentation and the DT are using R40's. Fix that. Fixes: f5a98bfe7b37 ("dt-bindings: display: Convert Allwinner display pipeline to schemas") Signed-off-by: Maxime Ripard Acked-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20200210100455.78695-1-maxime@cerno.tech commit 1b9867eb6120db85f8dca8ff42789d9ec9ee16a5 Author: Anand Jain Date: Wed Feb 12 17:28:11 2020 +0800 btrfs: sysfs, move device id directories to UUID/devinfo Originally it was planned to create device id directories under UUID/devinfo, but it got under UUID/devices by mistake. We really want it under definfo so the bare device node names are not mixed with device ids and are easy to enumerate. Fixes: 668e48af7a94 ("btrfs: sysfs, add devid/dev_state kobject and device attributes") Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit a013d141eceee0f7747385e900da2858141aa0f3 Author: Anand Jain Date: Wed Feb 12 17:28:10 2020 +0800 btrfs: sysfs, add UUID/devinfo kobject Create directory /sys/fs/btrfs/UUID/devinfo to hold devices directories by the id (unlike /devices). Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit d91771848f0ae2eec250a9345926a1a3558fa943 Author: Geert Uytterhoeven Date: Wed Feb 12 11:09:34 2020 +0100 arm64: time: Replace by The arm64 time code is not a clock provider, and just needs to call of_clk_init(). Hence it can include instead of . Reviewed-by: Stephen Boyd Signed-off-by: Geert Uytterhoeven Signed-off-by: Will Deacon commit eecd618b45166fdddea3b6366b18479c2be0e11c Author: Jakub Sitnicki Date: Wed Feb 12 10:32:08 2020 +0000 selftests/bpf: Mark SYN cookie test skipped for UDP sockets SYN cookie test with reuseport BPF doesn't make sense for UDP sockets. We don't run it but the test_progs test runner doesn't know about it. Mark the test as skipped so the test_progs can report correctly how many tests were skipped. Fixes: 7ee0d4e97b88 ("selftests/bpf: Switch reuseport tests for test_progs framework") Reported-by: Lorenz Bauer Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200212103208.438419-1-jakub@cloudflare.com commit 2fe77100553f3ac6b2105db8ae14b5ea4b43c108 Author: Martin KaFai Lau Date: Tue Feb 11 09:59:10 2020 -0800 selftests/bpf: Fix error checking on reading the tcp_fastopen sysctl There is a typo in checking the "saved_tcp_fo" and instead "saved_tcp_syncookie" is checked again. This patch fixes it and also breaks them into separate if statements such that the test will abort asap. Reported-by: David Binderman Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20200211175910.3235321-1-kafai@fb.com commit 28553fa992cb28be6a65566681aac6cafabb4f2d Author: Filipe Manana Date: Fri Feb 7 12:23:09 2020 +0000 Btrfs: fix race between shrinking truncate and fiemap When there is a fiemap executing in parallel with a shrinking truncate we can end up in a situation where we have extent maps for which we no longer have corresponding file extent items. This is generally harmless and at the moment the only consequences are missing file extent items representing holes after we expand the file size again after the truncate operation removed the prealloc extent items, and stale information for future fiemap calls (reporting extents that no longer exist or may have been reallocated to other files for example). Consider the following example: 1) Our inode has a size of 128KiB, one 128KiB extent at file offset 0 and a 1MiB prealloc extent at file offset 128KiB; 2) Task A starts doing a shrinking truncate of our inode to reduce it to a size of 64KiB. Before it searches the subvolume tree for file extent items to delete, it drops all the extent maps in the range from 64KiB to (u64)-1 by calling btrfs_drop_extent_cache(); 3) Task B starts doing a fiemap against our inode. When looking up for the inode's extent maps in the range from 128KiB to (u64)-1, it doesn't find any in the inode's extent map tree, since they were removed by task A. Because it didn't find any in the extent map tree, it scans the inode's subvolume tree for file extent items, and it finds the 1MiB prealloc extent at file offset 128KiB, then it creates an extent map based on that file extent item and adds it to inode's extent map tree (this ends up being done by btrfs_get_extent() <- btrfs_get_extent_fiemap() <- get_extent_skip_holes()); 4) Task A then drops the prealloc extent at file offset 128KiB and shrinks the 128KiB extent file offset 0 to a length of 64KiB. The truncation operation finishes and we end up with an extent map representing a 1MiB prealloc extent at file offset 128KiB, despite we don't have any more that extent; After this the two types of problems we have are: 1) Future calls to fiemap always report that a 1MiB prealloc extent exists at file offset 128KiB. This is stale information, no longer correct; 2) If the size of the file is increased, by a truncate operation that increases the file size or by a write into a file offset > 64KiB for example, we end up not inserting file extent items to represent holes for any range between 128KiB and 128KiB + 1MiB, since the hole expansion function, btrfs_cont_expand() will skip hole insertion for any range for which an extent map exists that represents a prealloc extent. This causes fsck to complain about missing file extent items when not using the NO_HOLES feature. The second issue could be often triggered by test case generic/561 from fstests, which runs fsstress and duperemove in parallel, and duperemove does frequent fiemap calls. Essentially the problems happens because fiemap does not acquire the inode's lock while truncate does, and fiemap locks the file range in the inode's iotree while truncate does not. So fix the issue by making btrfs_truncate_inode_items() lock the file range from the new file size to (u64)-1, so that it serializes with fiemap. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 10a3a3edc5b89a8cd095bc63495fb1e0f42047d9 Author: David Sterba Date: Wed Feb 5 17:12:28 2020 +0100 btrfs: log message when rw remount is attempted with unclean tree-log A remount to a read-write filesystem is not safe when there's tree-log to be replayed. Files that could be opened until now might be affected by the changes in the tree-log. A regular mount is needed to replay the log so the filesystem presents the consistent view with the pending changes included. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Anand Jain Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit e8294f2f6aa6208ed0923aa6d70cea3be178309a Author: David Sterba Date: Wed Feb 5 17:12:16 2020 +0100 btrfs: print message when tree-log replay starts There's no logged information about tree-log replay although this is something that points to previous unclean unmount. Other filesystems report that as well. Suggested-by: Chris Murphy CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Anand Jain Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit ac05ca913e9f3871126d61da275bfe8516ff01ca Author: Filipe Manana Date: Fri Jan 31 14:06:07 2020 +0000 Btrfs: fix race between using extent maps and merging them We have a few cases where we allow an extent map that is in an extent map tree to be merged with other extents in the tree. Such cases include the unpinning of an extent after the respective ordered extent completed or after logging an extent during a fast fsync. This can lead to subtle and dangerous problems because when doing the merge some other task might be using the same extent map and as consequence see an inconsistent state of the extent map - for example sees the new length but has seen the old start offset. With luck this triggers a BUG_ON(), and not some silent bug, such as the following one in __do_readpage(): $ cat -n fs/btrfs/extent_io.c 3061 static int __do_readpage(struct extent_io_tree *tree, 3062 struct page *page, (...) 3127 em = __get_extent_map(inode, page, pg_offset, cur, 3128 end - cur + 1, get_extent, em_cached); 3129 if (IS_ERR_OR_NULL(em)) { 3130 SetPageError(page); 3131 unlock_extent(tree, cur, end); 3132 break; 3133 } 3134 extent_offset = cur - em->start; 3135 BUG_ON(extent_map_end(em) <= cur); (...) Consider the following example scenario, where we end up hitting the BUG_ON() in __do_readpage(). We have an inode with a size of 8KiB and 2 extent maps: extent A: file offset 0, length 4KiB, disk_bytenr = X, persisted on disk by a previous transaction extent B: file offset 4KiB, length 4KiB, disk_bytenr = X + 4KiB, not yet persisted but writeback started for it already. The extent map is pinned since there's writeback and an ordered extent in progress, so it can not be merged with extent map A yet The following sequence of steps leads to the BUG_ON(): 1) The ordered extent for extent B completes, the respective page gets its writeback bit cleared and the extent map is unpinned, at that point it is not yet merged with extent map A because it's in the list of modified extents; 2) Due to memory pressure, or some other reason, the MM subsystem releases the page corresponding to extent B - btrfs_releasepage() is called and returns 1, meaning the page can be released as it's not dirty, not under writeback anymore and the extent range is not locked in the inode's iotree. However the extent map is not released, either because we are not in a context that allows memory allocations to block or because the inode's size is smaller than 16MiB - in this case our inode has a size of 8KiB; 3) Task B needs to read extent B and ends up __do_readpage() through the btrfs_readpage() callback. At __do_readpage() it gets a reference to extent map B; 4) Task A, doing a fast fsync, calls clear_em_loggin() against extent map B while holding the write lock on the inode's extent map tree - this results in try_merge_map() being called and since it's possible to merge extent map B with extent map A now (the extent map B was removed from the list of modified extents), the merging begins - it sets extent map B's start offset to 0 (was 4KiB), but before it increments the map's length to 8KiB (4kb + 4KiB), task A is at: BUG_ON(extent_map_end(em) <= cur); The call to extent_map_end() sees the extent map has a start of 0 and a length still at 4KiB, so it returns 4KiB and 'cur' is 4KiB, so the BUG_ON() is triggered. So it's dangerous to modify an extent map that is in the tree, because some other task might have got a reference to it before and still using it, and needs to see a consistent map while using it. Generally this is very rare since most paths that lookup and use extent maps also have the file range locked in the inode's iotree. The fsync path is pretty much the only exception where we don't do it to avoid serialization with concurrent reads. Fix this by not allowing an extent map do be merged if if it's being used by tasks other then the one attempting to merge the extent map (when the reference count of the extent map is greater than 2). Reported-by: ryusuke1925 Reported-by: Koki Mitani Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206211 CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit f311ade3a7adf31658ed882aaab9f9879fdccef7 Author: Wenwen Wang Date: Sat Feb 1 20:38:38 2020 +0000 btrfs: ref-verify: fix memory leaks In btrfs_ref_tree_mod(), 'ref' and 'ra' are allocated through kzalloc() and kmalloc(), respectively. In the following code, if an error occurs, the execution will be redirected to 'out' or 'out_unlock' and the function will be exited. However, on some of the paths, 'ref' and 'ra' are not deallocated, leading to memory leaks. For example, if 'action' is BTRFS_ADD_DELAYED_EXTENT, add_block_entry() will be invoked. If the return value indicates an error, the execution will be redirected to 'out'. But, 'ref' is not deallocated on this path, causing a memory leak. To fix the above issues, deallocate both 'ref' and 'ra' before exiting from the function when an error is encountered. CC: stable@vger.kernel.org # 4.15+ Signed-off-by: Wenwen Wang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2a8d017d46a3f48dad3319e569cd0aee61bab8fc Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 12:45:24 2020 -0300 tools headers kvm: Sync linux/kvm.h with the kernel sources To pick up the changes from: 7de3f1423ff9 ("KVM: s390: Add new reset vcpu API") So far we're ignoring those arch specific ioctls, we need to revisit this at some time to have arch specific tables, etc: $ grep S390 tools/perf/trace/beauty/kvm_ioctl.sh egrep -v " ((ARM|PPC|S390)_|[GS]ET_(DEBUGREGS|PIT2|XSAVE|TSC_KHZ)|CREATE_SPAPR_TCE_64)" | \ $ This addresses these tools/perf build warnings: Warning: Kernel ABI header at 'tools/arch/arm/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm/include/uapi/asm/kvm.h' diff -u tools/arch/arm/include/uapi/asm/kvm.h arch/arm/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Christian Borntraeger Cc: Janosch Frank Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 391df72fbd144878e2f905d86f1e9a85a059216a Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 12:41:20 2020 -0300 tools headers kvm: Sync kvm headers with the kernel sources To pick up the changes from: 290a6bb06de9 ("arm64: KVM: Add UAPI notes for swapped registers") No tools changes are caused by this. This addresses these tools/perf build warnings: Cc: Adrian Hunter Cc: Andrew Jones Cc: Jiri Olsa Cc: Marc Zyngier Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 71dd65289793df31e9f10c6b112e5e32dfd89c1d Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 12:33:34 2020 -0300 tools arch x86: Sync asm/cpufeatures.h with the kernel sources To pick up the changes from: 85c17291e2eb ("x86/cpufeatures: Add flag to track whether MSR IA32_FEAT_CTL is configured") f444a5ff95dc ("x86/cpufeatures: Add support for fast short REP; MOVSB") These don't cause any changes in tooling, just silences this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Jiri Olsa Cc: Namhyung Kim Cc: Sean Christopherson Cc: Tony Luck Signed-off-by: Arnaldo Carvalho de Melo commit 7636b586392fc57b84c089147b5e22e52d9650d5 Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 12:29:41 2020 -0300 tools headers x86: Sync disabled-features.h To silence the following tools/perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Picking up the changes in: 45fc24e89b7c ("x86/mpx: remove MPX from arch/x86") that didn't entail any functionality change in the tooling side. Cc: Adrian Hunter Cc: Dave Hansen Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 2aaaa5ee1c3d624a5bcad4ee25f954559c565bc2 Author: Chris Wilson Date: Wed Jan 22 14:02:43 2020 +0000 drm/i915: Mark the removal of the i915_request from the sched.link Keep the rq->fence.flags consistent with the status of the rq->sched.link, and clear the associated bits when decoupling the link on retirement (as we may wish to inspect those flags independent of other state). Fixes: c3f1ed90e6ff ("drm/i915/gt: Allow temporary suspension of inflight requests") References: https://gitlab.freedesktop.org/drm/intel/issues/997 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200122140243.495621-3-chris@chris-wilson.co.uk (cherry picked from commit b4a9a149f91ea345da76bcfe3f8a39715ac346a6) Signed-off-by: Jani Nikula commit a2f90f4ff3746c92896e2b7af8763d6fe5206dbc Author: Chris Wilson Date: Wed Jan 22 14:02:42 2020 +0000 drm/i915/execlists: Reclaim the hanging virtual request If we encounter a hang on a virtual engine, as we process the hang the request may already have been moved back to the virtual engine (we are processing the hang on the physical engine). We need to reclaim the request from the virtual engine so that the locking is consistent and local to the real engine on which we will hold the request for error state capturing. v2: Pull the reclamation into execlists_hold() and assert that cannot be called from outside of the reset (i.e. with the tasklet disabled). v3: Added selftest v4: Drop the reference owned by the virtual engine Fixes: ad18ba7b5eeb ("drm/i915/execlists: Offline error capture") Testcase: igt/gem_exec_balancer/hang Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200122140243.495621-2-chris@chris-wilson.co.uk (cherry picked from commit 989df3a7bd2abe566521e61d1aebf603eb013b7f) Signed-off-by: Jani Nikula commit 317e0395cc230736e474e499e01992bcdace5a73 Author: Chris Wilson Date: Wed Jan 22 14:02:41 2020 +0000 drm/i915/execlists: Take a reference while capturing the guilty request Thanks to preempt-to-busy, we leave the request on the HW as we submit the preemption request. This means that the request may complete at any moment as we process HW events, and in particular the request may be retired as we are planning to capture it for a preemption timeout. Be more careful while obtaining the request to capture after a preemption timeout, and check to see if it completed before we were able to put it on the on-hold list. If we do see it did complete just before we capture the request, proclaim the preemption-timeout a false positive and pardon the reset as we should hit an arbitration point momentarily and so be able to process the preemption. Note that even after we move the request to be on hold it may be retired (as the reset to stop the HW comes after), so we do require to hold our own reference as we work on the request for capture (and all of the peeking at state within the request needs to be carefully protected). Fixes: c3f1ed90e6ff ("drm/i915/gt: Allow temporary suspension of inflight requests") Closes: https://gitlab.freedesktop.org/drm/intel/issues/997 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200122140243.495621-1-chris@chris-wilson.co.uk (cherry picked from commit 4ba5c086a1d8e38d6927967ae1a3271a6ab7a927) Signed-off-by: Jani Nikula commit ad18ba7b5eebf58209a898de8519f6bb2280620b Author: Chris Wilson Date: Thu Jan 16 18:47:54 2020 +0000 drm/i915/execlists: Offline error capture Currently, we skip error capture upon forced preemption. We apply forced preemption when there is a higher priority request that should be running but is being blocked, and we skip inline error capture so that the preemption request is not further delayed by a user controlled capture -- extending the denial of service. However, preemption reset is also used for heartbeats and regular GPU hangs. By skipping the error capture, we remove the ability to debug GPU hangs. In order to capture the error without delaying the preemption request further, we can do an out-of-line capture by removing the guilty request from the execution queue and scheduling a worker to dump that request. When removing a request, we need to remove the entire context and all descendants from the execution queue, so that they do not jump past. Closes: https://gitlab.freedesktop.org/drm/intel/issues/738 Fixes: 3a7a92aba8fb ("drm/i915/execlists: Force preemption") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200116184754.2860848-3-chris@chris-wilson.co.uk (cherry picked from commit 748317386afb235e11616098d2c7772e49776b58) Signed-off-by: Jani Nikula commit c3f1ed90e6ffbf4e22010522351779f920e53d0d Author: Chris Wilson Date: Thu Jan 16 18:47:53 2020 +0000 drm/i915/gt: Allow temporary suspension of inflight requests In order to support out-of-line error capture, we need to remove the active request from HW and put it to one side while a worker compresses and stores all the details associated with that request. (As that compression may take an arbitrary user-controlled amount of time, we want to let the engine continue running on other workloads while the hanging request is dumped.) Not only do we need to remove the active request, but we also have to remove its context and all requests that were dependent on it (both in flight, queued and future submission). Finally once the capture is complete, we need to be able to resubmit the request and its dependents and allow them to execute. v2: Replace stack recursion with a simple list. v3: Check all the parents, not just the first, when searching for a stuck ancestor! References: https://gitlab.freedesktop.org/drm/intel/issues/738 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200116184754.2860848-2-chris@chris-wilson.co.uk (cherry picked from commit 32ff621fd74496f0c33644125fb69ff175859b1f) Signed-off-by: Jani Nikula commit 9e2750fc80b5cc606365201132d49fed00570dd1 Author: Chris Wilson Date: Thu Jan 16 18:47:52 2020 +0000 drm/i915: Keep track of request among the scheduling lists If we keep track of when the i915_request.sched.link is on the HW runlist, or in the priority queue we can simplify our interactions with the request (such as during rescheduling). This also simplifies the next patch where we introduce a new in-between list, for requests that are ready but neither on the run list or in the queue. v2: Update i915_sched_node.link explanation for current usage where it is a link on both the queue and on the runlists. Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200116184754.2860848-1-chris@chris-wilson.co.uk (cherry picked from commit 672c368f9398042b629740cc9816e8e939eff2db) Signed-off-by: Jani Nikula commit cc3251d8ef6abb5ae7f75a5062dc4b05830571d2 Merge: 2933803bdcd8 0e9d7bb293f3 Author: Jani Nikula Date: Wed Feb 12 16:50:04 2020 +0200 Merge tag 'gvt-fixes-2020-02-12' of https://github.com/intel/gvt-linux into drm-intel-next-fixes gvt-fixes-2020-02-12 - fix possible high-order allocation fail for late load (Igor) - fix one missed lock for ppgtt mm LRU list (Igor) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20200212065912.GB4997@zhen-hp.sh.intel.com commit 8d2e77b39b8fecb794e19cd006a12f90b14dd077 Author: Christophe JAILLET Date: Wed Dec 4 04:35:25 2019 +0100 HID: alps: Fix an error handling path in 'alps_input_configured()' They are issues: - if 'input_allocate_device()' fails and return NULL, there is no need to free anything and 'input_free_device()' call is a no-op. It can be axed. - 'ret' is known to be 0 at this point, so we must set it to a meaningful value before returning Fixes: 2562756dde55 ("HID: add Alps I2C HID Touchpad-Stick support") Signed-off-by: Christophe JAILLET Signed-off-by: Jiri Kosina commit 8c65582f82ee736b63b3c0cd9c7c5b4572f1f4d6 Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 11:04:23 2020 -0300 tools include UAPI: Sync sound/asound.h copy Picking the changes from: 46b770f720bd ("ALSA: uapi: Fix sparse warning") a103a3989993 ("ALSA: control: Fix incompatible protocol error") bd3eb4e87eb3 ("ALSA: ctl: bump protocol version up to v2.1.0") ff16351e3f30 ("ALSA: ctl: remove dimen member from elem_info structure") 542283566679 ("ALSA: ctl: remove unused macro for timestamping of elem_value") 7fd7d6c50451 ("ALSA: uapi: Fix typos and header inclusion in asound.h") 1cfaef961703 ("ALSA: bump uapi version numbers") 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control") 07094ae6f952 ("ALSA: Avoid using timespec for struct snd_timer_tread") d9e5582c4bb2 ("ALSA: Avoid using timespec for struct snd_rawmidi_status") 3ddee7f88aaf ("ALSA: Avoid using timespec for struct snd_pcm_status") a4e7dd35b9da ("ALSA: Avoid using timespec for struct snd_ctl_elem_value") a07804cc7472 ("ALSA: Avoid using timespec for struct snd_timer_status") Which entails no changes in the tooling side. To silence this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/sound/asound.h' differs from latest version at 'include/uapi/sound/asound.h' diff -u tools/include/uapi/sound/asound.h include/uapi/sound/asound.h Cc: Adrian Hunter Cc: Arnd Bergmann Cc: Baolin Wang Cc: Jiri Olsa Cc: Namhyung Kim Cc: Ranjani Sridharan Cc: Takashi Iwai Cc: Takashi Sakamoto Signed-off-by: Arnaldo Carvalho de Melo commit 47f8d94ac5241e30a5ab0b6b91b963b54765ec7c Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 10:53:06 2020 -0300 tools headers UAPI: Sync asm-generic/mman-common.h with the kernel To pick the changes from: d41938d2cbee ("mm: Reserve asm-generic prot flags 0x10 and 0x20 for arch use") No changes in tooling, just a rebuild as files needed got touched. This addresses the following perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/mman-common.h' differs from latest version at 'include/uapi/asm-generic/mman-common.h' diff -u tools/include/uapi/asm-generic/mman-common.h include/uapi/asm-generic/mman-common.h Cc: Adrian Hunter Cc: Dave Martin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 5c02c447eaeda29d3da121a2e17b97ccaf579b51 Author: dan.carpenter@oracle.com Date: Wed Jan 15 20:46:28 2020 +0300 HID: hiddev: Fix race in in hiddev_disconnect() Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect(). The hiddev_disconnect() function sets "hiddev->exist = 0;" so hiddev_release() can free it as soon as we drop the "existancelock" lock. This patch moves the mutex_unlock(&hiddev->existancelock) until after we have finished using it. Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free") Suggested-by: Alan Stern Signed-off-by: Dan Carpenter Signed-off-by: Jiri Kosina commit df5a5f3cf24608457bb5e57297dd9f0d528be58f Author: John Garry Date: Fri Dec 13 21:54:15 2019 +0800 perf tools: Add arm64 version of get_cpuid() Add an arm64 version of get_cpuid(), which is used for various annotation and headers - for example, I now get the CPUID in "perf report --header", as shown in this snippet: # hostname : ubuntu # os release : 5.5.0-rc1-dirty # perf version : 5.5.rc1.gbf8a13dc9851 # arch : aarch64 # nrcpus online : 96 # nrcpus avail : 96 # cpuid : 0x00000000480fd010 Since much of the code to read the MIDR is already in get_cpuid_str(), factor out this code. Tester notes: I tested this patch on my new ARM64 Kunpeng 920 server. [root@node1 zsk]# ./perf --version perf version 5.6.rc1.g2cdb955b7252 Both perf list and perf stat can work. Signed-off-by: John Garry Tested-by: Shaokun Zhang Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linuxarm@huawei.com Link: http://lore.kernel.org/lkml/1576245255-210926-1-git-send-email-john.garry@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 365f9cc195a7fae8ac541129cd2a31ad87e46221 Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 10:25:27 2020 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources To pick the change in: cc662126b413 ("drm/i915: Introduce DRM_I915_GEM_MMAP_OFFSET") That don't result in any changes in tooling, just silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Abdiel Janulgue Cc: Adrian Hunter Cc: Chris Wilson Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 84a4062632462c4320704fcdf8e99e89e94c0aba Author: Johan Korsnes Date: Fri Jan 17 13:08:36 2020 +0100 HID: core: increase HID report buffer size to 8KiB We have a HID touch device that reports its opens and shorts test results in HID buffers of size 8184 bytes. The maximum size of the HID buffer is currently set to 4096 bytes, causing probe of this device to fail. With this patch we increase the maximum size of the HID buffer to 8192 bytes, making device probe and acquisition of said buffers succeed. Signed-off-by: Johan Korsnes Cc: Alan Stern Cc: Armando Visconti Cc: Jiri Kosina Signed-off-by: Jiri Kosina commit 5ebdffd25098898aff1249ae2f7dbfddd76d8f8f Author: Johan Korsnes Date: Fri Jan 17 13:08:35 2020 +0100 HID: core: fix off-by-one memset in hid_report_raw_event() In case a report is greater than HID_MAX_BUFFER_SIZE, it is truncated, but the report-number byte is not correctly handled. This results in a off-by-one in the following memset, causing a kernel Oops and ensuing system crash. Note: With commit 8ec321e96e05 ("HID: Fix slab-out-of-bounds read in hid_field_extract") I no longer hit the kernel Oops as we instead fail "controlled" at probe if there is a report too long in the HID report-descriptor. hid_report_raw_event() is an exported symbol, so presumabely we cannot always rely on this being the case. Fixes: 966922f26c7f ("HID: fix a crash in hid_report_raw_event() function.") Signed-off-by: Johan Korsnes Cc: Armando Visconti Cc: Jiri Kosina Cc: Alan Stern Signed-off-by: Jiri Kosina commit e433be929e63265b7412478eb7ff271467aee2d7 Author: Mansour Behabadi Date: Wed Jan 29 17:26:31 2020 +1100 HID: apple: Add support for recent firmware on Magic Keyboards Magic Keyboards with more recent firmware (0x0100) report Fn key differently. Without this patch, Fn key may not behave as expected and may not be configurable via hid_apple fnmode module parameter. Signed-off-by: Mansour Behabadi Signed-off-by: Jiri Kosina commit f65b9dba5733de8e285cf9d7e8672b46dd0cb709 Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 10:13:25 2020 -0300 tools headers uapi: Sync linux/fscrypt.h with the kernel sources To pick the changes from: e933adde6f97 ("fscrypt: include in UAPI header") 93edd392cad7 ("fscrypt: support passing a keyring key to FS_IOC_ADD_ENCRYPTION_KEY") That don't trigger any changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fscrypt.h' differs from latest version at 'include/uapi/linux/fscrypt.h' diff -u tools/include/uapi/linux/fscrypt.h include/uapi/linux/fscrypt.h Cc: Adrian Hunter Cc: Eric Biggers Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 74c12ee02af109adcde36ec184fa59c0afb0edaa Merge: 48bc281e4bf0 bb6d3fb354c5 Author: Maarten Lankhorst Date: Wed Feb 12 14:08:59 2020 +0100 Merge v5.6-rc1 into drm-misc-fixes We're based on v5.6, need v5.6-rc1 at least. :) Signed-off-by: Maarten Lankhorst commit a06230b62b898e51cfb1de256b2042a09a691f58 Author: Oliver Upton Date: Fri Feb 7 02:36:06 2020 -0800 KVM: x86: Deliver exception payload on KVM_GET_VCPU_EVENTS KVM allows the deferral of exception payloads when a vCPU is in guest mode to allow the L1 hypervisor to intercept certain events (#PF, #DB) before register state has been modified. However, this behavior is incompatible with the KVM_{GET,SET}_VCPU_EVENTS ABI, as userspace expects register state to have been immediately modified. Userspace may opt-in for the payload deferral behavior with the KVM_CAP_EXCEPTION_PAYLOAD per-VM capability. As such, kvm_multiple_exception() will immediately manipulate guest registers if the capability hasn't been requested. Since the deferral is only necessary if a userspace ioctl were to be serviced at the same as a payload bearing exception is recognized, this behavior can be relaxed. Instead, opportunistically defer the payload from kvm_multiple_exception() and deliver the payload before completing a KVM_GET_VCPU_EVENTS ioctl. Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit 684c0422da71da0cd81319c90b8099b563b13da4 Author: Oliver Upton Date: Fri Feb 7 02:36:05 2020 -0800 KVM: nVMX: Handle pending #DB when injecting INIT VM-exit SDM 27.3.4 states that the 'pending debug exceptions' VMCS field will be populated if a VM-exit caused by an INIT signal takes priority over a debug-trap. Emulate this behavior when synthesizing an INIT signal VM-exit into L1. Fixes: 4b9852f4f389 ("KVM: x86: Fix INIT signal handling in various CPU states") Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit 307f1cfa269657c63cfe2c932386fcc24684d9dd Author: Oliver Upton Date: Fri Feb 7 02:36:04 2020 -0800 KVM: x86: Mask off reserved bit from #DB exception payload KVM defines the #DB payload as compatible with the 'pending debug exceptions' field under VMX, not DR6. Mask off bit 12 when applying the payload to DR6, as it is reserved on DR6 but not the 'pending debug exceptions' field. Fixes: f10c729ff965 ("kvm: vmx: Defer setting of DR6 until #DB delivery") Signed-off-by: Oliver Upton Signed-off-by: Paolo Bonzini commit 2933803bdcd8ac67c0b97a0bb158e0762d5ae236 Author: Chris Wilson Date: Thu Jan 30 14:39:31 2020 +0000 drm/i915/gem: Tighten checks and acquiring the mmap object Make sure we hold the rcu lock as we acquire the rcu protected reference of the object when looking it up from the associated mmap vma. Closes: https://gitlab.freedesktop.org/drm/intel/issues/1083 Fixes: cc662126b413 ("drm/i915: Introduce DRM_I915_GEM_MMAP_OFFSET") Signed-off-by: Chris Wilson Cc: Abdiel Janulgue Cc: Matthew Auld Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20200130143931.1906301-1-chris@chris-wilson.co.uk (cherry picked from commit 280d14a69da2e71f43408537c008f2775d5e5360) Signed-off-by: Jani Nikula commit 52144db1309897f279b53e8df8a0d17e1cda7960 Author: José Roberto de Souza Date: Wed Jan 29 15:23:45 2020 -0800 drm/i915: Fix preallocated barrier list append Only the first and the last nodes were being added to ref->preallocated_barriers. Renaming variables to make it more easy to read. Fixes: 841350223816 ("drm/i915/gt: Drop mutex serialisation between context pin/unpin") Cc: Chris Wilson Cc: Maarten Lankhorst Signed-off-by: José Roberto de Souza Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200129232345.84512-1-jose.souza@intel.com (cherry picked from commit d4c3c0b8221a72107eaf35c80c40716b81ca463e) Signed-off-by: Jani Nikula commit 5b92415e64e145e7da60420ead66b62aa41917bf Author: Chris Wilson Date: Mon Jan 27 15:28:29 2020 +0000 drm/i915/gt: Acquire ce->active before ce->pin_count/ce->pin_mutex Similar to commit ac0e331a628b ("drm/i915: Tighten atomicity of i915_active_acquire vs i915_active_release") we have the same race of trying to pin the context underneath a mutex while allowing the decrement to be atomic outside of that mutex. This leads to the problem where two threads may simultaneously try to pin the context and the second not notice that they needed to repin the context. <2> [198.669621] kernel BUG at drivers/gpu/drm/i915/gt/intel_timeline.c:387! <4> [198.669703] invalid opcode: 0000 [#1] PREEMPT SMP PTI <4> [198.669712] CPU: 0 PID: 1246 Comm: gem_exec_create Tainted: G U W 5.5.0-rc6-CI-CI_DRM_7755+ #1 <4> [198.669723] Hardware name: /NUC7i5BNB, BIOS BNKBL357.86A.0054.2017.1025.1822 10/25/2017 <4> [198.669776] RIP: 0010:timeline_advance+0x7b/0xe0 [i915] <4> [198.669785] Code: 00 48 c7 c2 10 f1 46 a0 48 c7 c7 70 1b 32 a0 e8 bb dd e7 e0 bf 01 00 00 00 e8 d1 af e7 e0 31 f6 bf 09 00 00 00 e8 35 ef d8 e0 <0f> 0b 48 c7 c1 48 fa 49 a0 ba 84 01 00 00 48 c7 c6 10 f1 46 a0 48 <4> [198.669803] RSP: 0018:ffffc900004c3a38 EFLAGS: 00010296 <4> [198.669810] RAX: ffff888270b35140 RBX: ffff88826f32ee00 RCX: 0000000000000006 <4> [198.669818] RDX: 00000000000017c5 RSI: 0000000000000000 RDI: 0000000000000009 <4> [198.669826] RBP: ffffc900004c3a64 R08: 0000000000000000 R09: 0000000000000000 <4> [198.669834] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88826f9b5980 <4> [198.669841] R13: 0000000000000cc0 R14: ffffc900004c3dc0 R15: ffff888253610068 <4> [198.669849] FS: 00007f63e663fe40(0000) GS:ffff888276c00000(0000) knlGS:0000000000000000 <4> [198.669857] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4> [198.669864] CR2: 00007f171f8e39a8 CR3: 000000026b1f6005 CR4: 00000000003606f0 <4> [198.669872] Call Trace: <4> [198.669924] intel_timeline_get_seqno+0x12/0x40 [i915] <4> [198.669977] __i915_request_create+0x76/0x5a0 [i915] <4> [198.670024] i915_request_create+0x86/0x1c0 [i915] <4> [198.670068] i915_gem_do_execbuffer+0xbf2/0x2500 [i915] <4> [198.670082] ? __lock_acquire+0x460/0x15d0 <4> [198.670128] i915_gem_execbuffer2_ioctl+0x11f/0x470 [i915] <4> [198.670171] ? i915_gem_execbuffer_ioctl+0x300/0x300 [i915] <4> [198.670181] drm_ioctl_kernel+0xa7/0xf0 <4> [198.670188] drm_ioctl+0x2e1/0x390 <4> [198.670233] ? i915_gem_execbuffer_ioctl+0x300/0x300 [i915] Fixes: 841350223816 ("drm/i915/gt: Drop mutex serialisation between context pin/unpin") References: ac0e331a628b ("drm/i915: Tighten atomicity of i915_active_acquire vs i915_active_release") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200127152829.2842149-1-chris@chris-wilson.co.uk (cherry picked from commit e5429340bfa2dc43a07c3329e0c30cdae4cc0b35) Signed-off-by: Jani Nikula commit 7c34bb03983e3c1e42ad2749514dec9e5a19c336 Author: Chris Wilson Date: Sun Jan 26 10:23:43 2020 +0000 drm/i915: Tighten atomicity of i915_active_acquire vs i915_active_release As we use a mutex to serialise the first acquire (as it may be a lengthy operation), but only an atomic decrement for the release, we have to be careful in case a second thread races and completes both acquire/release as the first finishes its acquire. Thread A Thread B i915_active_acquire i915_active_acquire atomic_read() == 0 atomic_read() == 0 mutex_lock() mutex_lock() atomic_read() == 0 ref->active(); atomic_inc() mutex_unlock() atomic_read() == 1 i915_active_release atomic_dec_and_test() -> 0 ref->retire() atomic_inc() -> 1 mutex_unlock() So thread A has acquired the ref->active_count but since the ref was still active at the time, it did not initialise it. By switching the check inside the mutex to an atomic increment only if already active, we close the race. Fixes: c9ad602feabe ("drm/i915: Split i915_active.mutex into an irq-safe spinlock for the rbtree") Signed-off-by: Chris Wilson Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200126102346.1877661-3-chris@chris-wilson.co.uk (cherry picked from commit ac0e331a628b5ded087eab09fad2ffb082ac61ba) Signed-off-by: Jani Nikula commit 9556e5c7c40e3d2e7c9417d1e766e3bd88b598e5 Author: Chris Wilson Date: Fri Jan 24 19:22:55 2020 +0000 drm/i915: Stub out i915_gpu_coredump_put i915_gpu_coreddump_put is currently only defined if CONFIG_DRM_I915_CAPTURE_ERROR is enabled, provide a stub otherwise. Reported-by: Mike Lothian Fixes: 742379c0c400 ("drm/i915: Start chopping up the GPU error capture") Signed-off-by: Chris Wilson Cc: Mike Lothian Cc: Andi Shyti Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20200124192255.541355-1-chris@chris-wilson.co.uk (cherry picked from commit 7e36505d0cf82f2920f2fd22ebb14a8b540396a3) Signed-off-by: Jani Nikula commit 1f03b2bcd0d7cad4af107339cdef80ed377fe2a8 Author: Marc Zyngier Date: Fri Feb 7 16:34:10 2020 +0000 KVM: Disable preemption in kvm_get_running_vcpu() Accessing a per-cpu variable only makes sense when preemption is disabled (and the kernel does check this when the right debug options are switched on). For kvm_get_running_vcpu(), it is fine to return the value after re-enabling preemption, as the preempt notifiers will make sure that this is kept consistent across task migration (the comment above the function hints at it, but lacks the crucial preemption management). While we're at it, move the comment from the ARM code, which explains why the whole thing works. Fixes: 7495e22bb165 ("KVM: Move running VCPU from ARM to common code"). Cc: Paolo Bonzini Reported-by: Zenghui Yu Tested-by: Zenghui Yu Reviewed-by: Peter Xu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/318984f6-bc36-33a3-abc6-bf2295974b06@huawei.com Message-id: <20200207163410.31276-1-maz@kernel.org> Signed-off-by: Paolo Bonzini commit a1a7e3a36e01ca6e67014f8cf673cb8e47be5550 Author: Xin Long Date: Sun Feb 9 21:16:38 2020 +0800 xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire Without doing verify_sec_ctx_len() check in xfrm_add_acquire(), it may be out-of-bounds to access uctx->ctx_str with uctx->ctx_len, as noticed by syz: BUG: KASAN: slab-out-of-bounds in selinux_xfrm_alloc_user+0x237/0x430 Read of size 768 at addr ffff8880123be9b4 by task syz-executor.1/11650 Call Trace: dump_stack+0xe8/0x16e print_address_description.cold.3+0x9/0x23b kasan_report.cold.4+0x64/0x95 memcpy+0x1f/0x50 selinux_xfrm_alloc_user+0x237/0x430 security_xfrm_policy_alloc+0x5c/0xb0 xfrm_policy_construct+0x2b1/0x650 xfrm_add_acquire+0x21d/0xa10 xfrm_user_rcv_msg+0x431/0x6f0 netlink_rcv_skb+0x15a/0x410 xfrm_netlink_rcv+0x6d/0x90 netlink_unicast+0x50e/0x6a0 netlink_sendmsg+0x8ae/0xd40 sock_sendmsg+0x133/0x170 ___sys_sendmsg+0x834/0x9a0 __sys_sendmsg+0x100/0x1e0 do_syscall_64+0xe5/0x660 entry_SYSCALL_64_after_hwframe+0x6a/0xdf So fix it by adding the missing verify_sec_ctx_len check there. Fixes: 980ebd25794f ("[IPSEC]: Sync series - acquire insert") Reported-by: Hangbin Liu Signed-off-by: Xin Long Signed-off-by: Steffen Klassert commit 171d449a028573b2f0acdc7f31ecbb045391b320 Author: Xin Long Date: Sun Feb 9 21:15:29 2020 +0800 xfrm: fix uctx len check in verify_sec_ctx_len It's not sufficient to do 'uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)' check only, as uctx->len may be greater than nla_len(rt), in which case it will cause slab-out-of-bounds when accessing uctx->ctx_str later. This patch is to fix it by return -EINVAL when uctx->len > nla_len(rt). Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.") Signed-off-by: Xin Long Signed-off-by: Steffen Klassert commit bab0c318ba3da32483da8aad37b9ef98fd8edafb Author: Paolo Bonzini Date: Tue Feb 11 18:40:58 2020 +0100 KVM: x86: do not reset microcode version on INIT or RESET Do not initialize the microcode version at RESET or INIT, only on vCPU creation. Microcode updates are not lost during INIT, and exact behavior across a warm RESET is not specified by the architecture. Since we do not support a microcode update directly from the hypervisor, but only as a result of userspace setting the microcode version MSR, it's simpler for userspace if we do nothing in KVM and let userspace emulate behavior for RESET as it sees fit. Userspace can tie the fix to the availability of MSR_IA32_UCODE_REV in the list of emulated MSRs. Reported-by: Alex Williamson Signed-off-by: Paolo Bonzini commit 7dafba3762d6c0083ded00a48f8c1a158bc86717 Author: Takashi Iwai Date: Wed Feb 12 09:10:47 2020 +0100 ALSA: hda/realtek - Fix silent output on MSI-GL73 MSI-GL73 laptop with ALC1220 codec requires a similar workaround for Clevo laptops to enforce the DAC/mixer connection path. Set up a quirk entry for that. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204159 Cc: Link: https://lore.kernel.org/r/20200212081047.27727-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 2b3b6497c38d123934de68ea82a247b557d95290 Author: Kailang Yang Date: Mon Feb 10 16:15:14 2020 +0800 ALSA: hda/realtek - Add more codec supported Headset Button Add supported Headset Button for ALC215/ALC285/ALC289. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/948f70b4488f4cc2b629a39ce4e4be33@realtek.com Signed-off-by: Takashi Iwai commit b44beb8ae5d50b055b3df16fd5688c92d32f3773 Merge: 457fed775c97 c207979f5ae1 Author: David S. Miller Date: Tue Feb 11 17:08:31 2020 -0800 Merge branch 'Bug-fixes-for-ENA-Ethernet-driver' Sameeh Jubran says: ==================== Bug fixes for ENA Ethernet driver Difference from V1: * Started using netdev_rss_key_fill() * Dropped superflous changes that are not related to bug fixes as requested by Jakub ==================== Signed-off-by: David S. Miller commit c207979f5ae10ed70aff1bb13f39f0736973de99 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:51 2020 +0000 net: ena: ena-com.c: prevent NULL pointer dereference comp_ctx can be NULL in a very rare case when an admin command is executed during the execution of ena_remove(). The bug scenario is as follows: * ena_destroy_device() sets the comp_ctx to be NULL * An admin command is executed before executing unregister_netdev(), this can still happen because our device can still receive callbacks from the netdev infrastructure such as ethtool commands. * When attempting to access the comp_ctx, the bug occurs since it's set to NULL Fix: Added a check that comp_ctx is not NULL Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 886d2089276e40d460731765083a741c5c762461 Author: Sameeh Jubran Date: Tue Feb 11 15:17:50 2020 +0000 net: ena: ethtool: use correct value for crc32 hash Up till kernel 4.11 there was no enum defined for crc32 hash in ethtool, thus the xor enum was used for supporting crc32. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: David S. Miller commit 470793a78ce344bd53d31e0c2d537f71ba957547 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:49 2020 +0000 net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE As the name suggests ETH_RSS_HASH_NO_CHANGE is received upon changing the key or indirection table using ethtool while keeping the same hash function. Also add a function for retrieving the current hash function from the ena-com layer. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Saeed Bshara Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit e3f89f91e98ce07dc0f121a3b70d21aca749ba39 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:48 2020 +0000 net: ena: fix corruption of dev_idx_to_host_tbl The function ena_com_ind_tbl_convert_from_device() has an overflow bug as explained below. Either way, this function is not needed at all since we don't retrieve the indirection table from the device at any point which means that this conversion is not needed. The bug: The for loop iterates over all io_sq_queues, when passing the actual number of used queues the io_sq_queues[i].idx equals 0 since they are uninitialized which results in the following code to be executed till the end of the loop: dev_idx_to_host_tbl[0] = i; This results dev_idx_to_host_tbl[0] in being equal to ENA_TOTAL_NUM_QUEUES - 1. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 92569fd27f5cb0ccbdf7c7d70044b690e89a0277 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:47 2020 +0000 net: ena: fix incorrectly saving queue numbers when setting RSS indirection table The indirection table has the indices of the Rx queues. When we store it during set indirection operation, we convert the indices to our internal representation of the indices. Our internal representation of the indices is: even indices for Tx and uneven indices for Rx, where every Tx/Rx pair are in a consecutive order starting from 0. For example if the driver has 3 queues (3 for Tx and 3 for Rx) then the indices are as follows: 0 1 2 3 4 5 Tx Rx Tx Rx Tx Rx The BUG: The issue is that when we satisfy a get request for the indirection table, we don't convert the indices back to the original representation. The FIX: Simply apply the inverse function for the indices of the indirection table after we set it. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 4844470d472d660c26149ad764da2406adb13423 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:46 2020 +0000 net: ena: rss: store hash function as values and not bits The device receives, stores and retrieves the hash function value as bits and not as their enum value. The bug: * In ena_com_set_hash_function() we set cmd.u.flow_hash_func.selected_func to the bit value of rss->hash_func. (1 << rss->hash_func) * In ena_com_get_hash_function() we retrieve the hash function and store it's bit value in rss->hash_func. (Now the bit value of rss->hash_func is stored in rss->hash_func instead of it's enum value) The fix: This commit fixes the issue by converting the retrieved hash function values from the device to the matching enum value of the set bit using ffs(). ffs() finds the first set bit's index in a word. Since the function returns 1 for the LSB's index, we need to subtract 1 from the returned value (note that BIT(0) is 1). Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 0c8923c0a64fb5d14bebb9a9065d2dc25ac5e600 Author: Sameeh Jubran Date: Tue Feb 11 15:17:45 2020 +0000 net: ena: rss: fix failure to get indirection table On old hardware, getting / setting the hash function is not supported while gettting / setting the indirection table is. This commit enables us to still show the indirection table on older hardwares by setting the hash function and key to NULL. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: David S. Miller commit 6a4f7dc82d1e3abd3feb0c60b5041056fcd9880c Author: Sameeh Jubran Date: Tue Feb 11 15:17:44 2020 +0000 net: ena: rss: do not allocate key when not supported Currently we allocate the key whether the device supports setting the key or not. This commit adds a check to the allocation function and handles the error accordingly. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: David S. Miller commit 0d1c3de7b8c78a5e44b74b62ede4a63629f5d811 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:43 2020 +0000 net: ena: fix incorrect default RSS key Bug description: When running "ethtool -x " the key shows up as all zeros. When we use "ethtool -X hfunc toeplitz hkey " to set the key and then try to retrieve it using "ethtool -x " then we return the correct key because we return the one we saved. Bug cause: We don't fetch the key from the device but instead return the key that we have saved internally which is by default set to zero upon allocation. Fix: This commit fixes the issue by initializing the key to a random value using netdev_rss_key_fill(). Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit cf6d17fde93bdda23c9b02dd5906a12bf8c55209 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:42 2020 +0000 net: ena: add missing ethtool TX timestamping indication Current implementation of the driver calls skb_tx_timestamp()to add a software tx timestamp to the skb, however the software-transmit capability is not reported in ethtool -T. This commit updates the ethtool structure to report the software-transmit capability in ethtool -T using the standard ethtool_op_get_ts_info(). This function reports all software timestamping capabilities (tx and rx), as well as setting phc_index = -1. phc_index is the index of the PTP hardware clock device that will be used for hardware timestamps. Since we don't have such a device in ENA, using the default -1 value is the correct setting. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Ezequiel Lara Gomez Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 2a6e5fa2f4c25b66c763428a3e65363214946931 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:41 2020 +0000 net: ena: fix uses of round_jiffies() >From the documentation of round_jiffies(): "Rounds a time delta in the future (in jiffies) up or down to (approximately) full seconds. This is useful for timers for which the exact time they fire does not matter too much, as long as they fire approximately every X seconds. By rounding these timers to whole seconds, all such timers will fire at the same time, rather than at various times spread out. The goal of this is to have the CPU wake up less, which saves power." There are 2 parts to this patch: ================================ Part 1: ------- In our case we need timer_service to be called approximately every X=1 seconds, and the exact time does not matter, so using round_jiffies() is the right way to go. Therefore we add round_jiffies() to the mod_timer() in ena_timer_service(). Part 2: ------- round_jiffies() is used in check_for_missing_keep_alive() when getting the jiffies of the expiration of the keep_alive timeout. Here it is actually a mistake to use round_jiffies() because we want the exact time when keep_alive should expire and not an approximate rounded time, which can cause early, false positive, timeouts. Therefore we remove round_jiffies() in the calculation of keep_alive_expired() in check_for_missing_keep_alive(). Fixes: 82ef30f13be0 ("net: ena: add hardware hints capability to the driver") Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 91a65b7d3ed8450f31ab717a65dcb5f9ceb5ab02 Author: Arthur Kiyanovski Date: Tue Feb 11 15:17:40 2020 +0000 net: ena: fix potential crash when rxfh key is NULL When ethtool -X is called without an hkey, ena_com_fill_hash_function() is called with key=NULL, which is passed to memcpy causing a crash. This commit fixes this issue by checking key is not NULL. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 457fed775c97ac2c0cd1672aaf2ff2c8a6235e87 Author: Eric Dumazet Date: Mon Feb 10 11:36:13 2020 -0800 net/smc: fix leak of kernel memory to user space As nlmsg_put() does not clear the memory that is reserved, it this the caller responsability to make sure all of this memory will be written, in order to not reveal prior content. While we are at it, we can provide the socket cookie even if clsock is not set. syzbot reported : BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline] BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline] BUG: KMSAN: uninit-value in __swab32p include/uapi/linux/swab.h:179 [inline] BUG: KMSAN: uninit-value in __be32_to_cpup include/uapi/linux/byteorder/little_endian.h:82 [inline] BUG: KMSAN: uninit-value in get_unaligned_be32 include/linux/unaligned/access_ok.h:30 [inline] BUG: KMSAN: uninit-value in ____bpf_skb_load_helper_32 net/core/filter.c:240 [inline] BUG: KMSAN: uninit-value in ____bpf_skb_load_helper_32_no_cache net/core/filter.c:255 [inline] BUG: KMSAN: uninit-value in bpf_skb_load_helper_32_no_cache+0x14a/0x390 net/core/filter.c:252 CPU: 1 PID: 5262 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline] __fswab32 include/uapi/linux/swab.h:59 [inline] __swab32p include/uapi/linux/swab.h:179 [inline] __be32_to_cpup include/uapi/linux/byteorder/little_endian.h:82 [inline] get_unaligned_be32 include/linux/unaligned/access_ok.h:30 [inline] ____bpf_skb_load_helper_32 net/core/filter.c:240 [inline] ____bpf_skb_load_helper_32_no_cache net/core/filter.c:255 [inline] bpf_skb_load_helper_32_no_cache+0x14a/0x390 net/core/filter.c:252 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_kmalloc_large+0x73/0xc0 mm/kmsan/kmsan_hooks.c:128 kmalloc_large_node_hook mm/slub.c:1406 [inline] kmalloc_large_node+0x282/0x2c0 mm/slub.c:3841 __kmalloc_node_track_caller+0x44b/0x1200 mm/slub.c:4368 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_dump+0x44b/0x1ab0 net/netlink/af_netlink.c:2224 __netlink_dump_start+0xbb2/0xcf0 net/netlink/af_netlink.c:2352 netlink_dump_start include/linux/netlink.h:233 [inline] smc_diag_handler_dump+0x2ba/0x300 net/smc/smc_diag.c:242 sock_diag_rcv_msg+0x211/0x610 net/core/sock_diag.c:256 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:275 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] kernel_sendmsg+0x433/0x440 net/socket.c:679 sock_no_sendpage+0x235/0x300 net/core/sock.c:2740 kernel_sendpage net/socket.c:3776 [inline] sock_sendpage+0x1e1/0x2c0 net/socket.c:937 pipe_to_sendpage+0x38c/0x4c0 fs/splice.c:458 splice_from_pipe_feed fs/splice.c:512 [inline] __splice_from_pipe+0x539/0xed0 fs/splice.c:636 splice_from_pipe fs/splice.c:671 [inline] generic_splice_sendpage+0x1d5/0x2d0 fs/splice.c:844 do_splice_from fs/splice.c:863 [inline] do_splice fs/splice.c:1170 [inline] __do_sys_splice fs/splice.c:1447 [inline] __se_sys_splice+0x2380/0x3350 fs/splice.c:1427 __x64_sys_splice+0x6e/0x90 fs/splice.c:1427 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: f16a7dd5cf27 ("smc: netlink interface for SMC sockets") Signed-off-by: Eric Dumazet Cc: Ursula Braun Signed-off-by: David S. Miller commit f27f37a04a69890ac85d9155f03ee2d23b678d8f Author: Brett Creeley Date: Mon Feb 10 10:59:18 2020 -0800 i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps Commit d9d6a9aed3f6 ("i40e: Fix virtchnl_queue_select bitmap validation") introduced a necessary change for verifying how queue bitmaps from the iavf driver get validated. Unfortunately, the conditional was reversed. Fix this. Fixes: d9d6a9aed3f6 ("i40e: Fix virtchnl_queue_select bitmap validation") Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit ad1e03b2b3d4430baaa109b77bc308dc73050de3 Author: Toke Høiland-Jørgensen Date: Mon Feb 10 17:10:46 2020 +0100 core: Don't skip generic XDP program execution for cloned SKBs The current generic XDP handler skips execution of XDP programs entirely if an SKB is marked as cloned. This leads to some surprising behaviour, as packets can end up being cloned in various ways, which will make an XDP program not see all the traffic on an interface. This was discovered by a simple test case where an XDP program that always returns XDP_DROP is installed on a veth device. When combining this with the Scapy packet sniffer (which uses an AF_PACKET) socket on the sending side, SKBs reliably end up in the cloned state, causing them to be passed through to the receiving interface instead of being dropped. A minimal reproducer script for this is included below. This patch fixed the issue by simply triggering the existing linearisation code for cloned SKBs instead of skipping the XDP program execution. This behaviour is in line with the behaviour of the native XDP implementation for the veth driver, which will reallocate and copy the SKB data if the SKB is marked as shared. Reproducer Python script (requires BCC and Scapy): from scapy.all import TCP, IP, Ether, sendp, sniff, AsyncSniffer, Raw, UDP from bcc import BPF import time, sys, subprocess, shlex SKB_MODE = (1 << 1) DRV_MODE = (1 << 2) PYTHON=sys.executable def client(): time.sleep(2) # Sniffing on the sender causes skb_cloned() to be set s = AsyncSniffer() s.start() for p in range(10): sendp(Ether(dst="aa:aa:aa:aa:aa:aa", src="cc:cc:cc:cc:cc:cc")/IP()/UDP()/Raw("Test"), verbose=False) time.sleep(0.1) s.stop() return 0 def server(mode): prog = BPF(text="int dummy_drop(struct xdp_md *ctx) {return XDP_DROP;}") func = prog.load_func("dummy_drop", BPF.XDP) prog.attach_xdp("a_to_b", func, mode) time.sleep(1) s = sniff(iface="a_to_b", count=10, timeout=15) if len(s): print(f"Got {len(s)} packets - should have gotten 0") return 1 else: print("Got no packets - as expected") return 0 if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} ") sys.exit(1) if sys.argv[1] == "client": sys.exit(client()) elif sys.argv[1] == "server": mode = SKB_MODE if sys.argv[2] == 'skb' else DRV_MODE sys.exit(server(mode)) else: try: mode = sys.argv[1] if mode not in ('skb', 'drv'): print(f"Usage: {sys.argv[0]} ") sys.exit(1) print(f"Running in {mode} mode") for cmd in [ 'ip netns add netns_a', 'ip netns add netns_b', 'ip -n netns_a link add a_to_b type veth peer name b_to_a netns netns_b', # Disable ipv6 to make sure there's no address autoconf traffic 'ip netns exec netns_a sysctl -qw net.ipv6.conf.a_to_b.disable_ipv6=1', 'ip netns exec netns_b sysctl -qw net.ipv6.conf.b_to_a.disable_ipv6=1', 'ip -n netns_a link set dev a_to_b address aa:aa:aa:aa:aa:aa', 'ip -n netns_b link set dev b_to_a address cc:cc:cc:cc:cc:cc', 'ip -n netns_a link set dev a_to_b up', 'ip -n netns_b link set dev b_to_a up']: subprocess.check_call(shlex.split(cmd)) server = subprocess.Popen(shlex.split(f"ip netns exec netns_a {PYTHON} {sys.argv[0]} server {mode}")) client = subprocess.Popen(shlex.split(f"ip netns exec netns_b {PYTHON} {sys.argv[0]} client")) client.wait() server.wait() sys.exit(server.returncode) finally: subprocess.run(shlex.split("ip netns delete netns_a")) subprocess.run(shlex.split("ip netns delete netns_b")) Fixes: d445516966dc ("net: xdp: support xdp generic on virtual devices") Reported-by: Stepan Horacek Suggested-by: Paolo Abeni Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller commit 359c92c02bfae1a6f1e8e37c298e518fd256642c Merge: 61a75954034f 96222d53842d Author: Linus Torvalds Date: Tue Feb 11 16:52:08 2020 -0800 Merge tag 'dax-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax fixes from Dan Williams: "A fix for an xfstest failure and some and an update that removes an fsdax dependency on block devices. Summary: - Fix RWF_NOWAIT writes to properly return -EAGAIN - Clean up an unused helper - Update dax_writeback_mapping_range to not need a block_device argument" * tag 'dax-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: pass NOWAIT flag to iomap_apply dax: Get rid of fs_dax_get_by_host() helper dax: Pass dax_dev instead of bdev to dax_writeback_mapping_range() commit 61a75954034f951a77d58b1cfb9186c62e6abcf8 Merge: 0a679e13ea30 7276531d4036 Author: Linus Torvalds Date: Tue Feb 11 16:39:18 2020 -0800 Merge tag 'trace-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Various fixes: - Fix an uninitialized variable - Fix compile bug to bootconfig userspace tool (in tools directory) - Suppress some error messages of bootconfig userspace tool - Remove unneded CONFIG_LIBXBC from bootconfig - Allocate bootconfig xbc_nodes dynamically. To ease complaints about taking up static memory at boot up - Use of parse_args() to parse bootconfig instead of strstr() usage Prevents issues of double quotes containing the interested string - Fix missing ring_buffer_nest_end() on synthetic event error path - Return zero not -EINVAL on soft disabled synthetic event (soft disabling must be the same as hard disabling, which returns zero) - Consolidate synthetic event code (remove duplicate code)" * tag 'trace-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Consolidate trace() functions tracing: Don't return -EINVAL when tracing soft disabled synth events tracing: Add missing nest end to synth_event_trace_start() error case tools/bootconfig: Suppress non-error messages bootconfig: Allocate xbc_nodes array dynamically bootconfig: Use parse_args() to find bootconfig and '--' tracing/kprobe: Fix uninitialized variable bug bootconfig: Remove unneeded CONFIG_LIBXBC tools/bootconfig: Fix wrong __VA_ARGS__ usage commit 6f4ecbe284df5f22e386a640d9a4b32cede62030 Author: Thierry Reding Date: Mon Feb 3 15:31:14 2020 +0100 soc/tegra: fuse: Fix build with Tegra194 configuration If only Tegra194 support is enabled, the tegra30_fuse_read() and tegra30_fuse_init() function are not declared and cause a build failure. Add Tegra194 to the preprocessor guard to make sure these functions are available for Tegra194-only builds as well. Link: https://lore.kernel.org/r/20200203143114.3967295-1-thierry.reding@gmail.com Reported-by: kbuild test robot Signed-off-by: Thierry Reding Signed-off-by: Olof Johansson commit d7a9c595118ad377b1c68524578271eb16f81a00 Merge: a9541fb7ed8e f166795871be Author: Olof Johansson Date: Tue Feb 11 14:49:37 2020 -0800 Merge tag 'arm-soc/for-5.6/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains ARM64 defconfig changes for v5.6, please pull the following: - Nicolas enables the BCM2835 DMA engine controller as built-in since the bcm2835 SD host controller depends on the DMA engine to be available. * tag 'arm-soc/for-5.6/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: defconfig: Set bcm2835-dma as built-in Link: https://lore.kernel.org/r/20200210145621.22599-1-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit a9541fb7ed8eb112a32772d3c2dad57b355d66b0 Merge: 0eaa9fc1d7f4 415ae604d4ac Author: Olof Johansson Date: Tue Feb 11 14:49:14 2020 -0800 Merge tag 'sunxi-config-for-5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes One patch to enable the new thermal sensor driver found on newer Allwinner SoCs. * tag 'sunxi-config-for-5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: sunxi: Enable CONFIG_SUN8I_THERMAL Link: https://lore.kernel.org/r/9d9805ea-cfe3-4eed-b977-1933a670ba7b.lettre@localhost Signed-off-by: Olof Johansson commit 0eaa9fc1d7f4d36fdf5e32808a412a55d08e7ace Merge: 1b32b72b2734 03c6bf464428 Author: Olof Johansson Date: Tue Feb 11 14:49:06 2020 -0800 Merge tag 'sunxi-config64-for-5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Two patches to enable the new thermal sensor driver found on newer Allwinner SoCs and to enable the MIPI-DSI controller. * tag 'sunxi-config64-for-5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: defconfig: Enable DRM_SUN6I_DSI arm64: defconfig: Enable CONFIG_SUN8I_THERMAL Link: https://lore.kernel.org/r/283eb531-890f-4ab2-95b5-898301af9807.lettre@localhost Signed-off-by: Olof Johansson commit 1b32b72b27341cafe5f1c8e3ebd26387a8faf664 Merge: 9c87d747cad7 bb6d3fb354c5 Author: Olof Johansson Date: Tue Feb 11 14:48:22 2020 -0800 Merge tag 'v5.6-rc1' into arm/fixes Linux 5.6-rc1 Merging in to avoid fixes pull request diffstats being noisy due to being based on -rc1. Signed-off-by: Olof Johansson commit 9c87d747cad7413a8bb0201fc457fb8eda8b3959 Merge: 3508aae9b561 3543d7ddd55f Author: Olof Johansson Date: Tue Feb 11 14:47:07 2020 -0800 Merge tag 'juno-fix-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes ARMv8 Juno/Fast Models fix for v5.6 A single fix for PCI interrupt-mapping on FVP Rev C model. This is present since the platform was added. This fix is needed to get VFIO working correctly on this model. * tag 'juno-fix-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: fast models: Fix FVP PCI interrupt-map property Link: https://lore.kernel.org/r/20200205183423.GF38466@bogus Signed-off-by: Olof Johansson commit fdde0ff8590b4c1c41b3227f5ac4265fccccb96b Author: Rafael J. Wysocki Date: Tue Feb 11 17:53:52 2020 +0100 ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system If the platform triggers a spurious SCI even though the status bit is not set for any GPE when the system is suspended to idle, it will be treated as a genuine wakeup, so avoid that by checking if any GPEs are active at all before returning 'true' from acpi_s2idle_wake(). Link: https://bugzilla.kernel.org/show_bug.cgi?id=206413 Fixes: 56b991849009 ("PM: sleep: Simplify suspend-to-idle control flow") Reported-by: Tsuchiya Yuto Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit ea128834dd76f9a72a35d011c651fa96658f06a7 Author: Rafael J. Wysocki Date: Tue Feb 11 17:52:32 2020 +0100 ACPICA: Introduce acpi_any_gpe_status_set() Introduce a new helper function, acpi_any_gpe_status_set(), for checking the status bits of all enabled GPEs in one go. It is needed to distinguish spurious SCIs from genuine ones when deciding whether or not to wake up the system from suspend-to-idle. Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit e33a8cfda5198fc09554fdd77ba246de42c886bd Author: Alex Deucher Date: Thu Feb 6 14:53:06 2020 -0500 drm/amdgpu:/navi10: use the ODCAP enum to index the caps array Rather than the FEATURE_ID flags. Avoids a possible reading past the end of the array. Reviewed-by: Evan Quan Reported-by: Aleksandr Mezin Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.5.x commit c1d66bc2e531b4ed3a9464b8e87144cc6b2fd63f Author: Alex Deucher Date: Thu Feb 6 14:46:34 2020 -0500 drm/amdgpu: update smu_v11_0_pptable.h Update to the latest changes. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.5.x commit a934f9d866598ec777174d449a0dd903ea3db817 Author: Guchun Chen Date: Tue Feb 11 12:10:44 2020 +0800 drm/amdgpu: correct comment to clear up the confusion Former comment looks to be one intended behavior in code, actually it's not. So correct it. Suggested-by: Christian König Signed-off-by: Guchun Chen Acked-by: Christian König Signed-off-by: Alex Deucher commit 8fab6a2faa1eb388b5eaf1ead4394f380a6403be Author: Sung Lee Date: Tue Feb 4 15:49:54 2020 -0500 drm/amd/display: DCN2.x Do not program DPPCLK if same value [WHY] Programming DPPCLK to the same value currently set may cause underflow while playing video in certain conditions. [HOW] Only program DPPCLK if clock is not the same as the previous value programmed. Signed-off-by: Sung Lee Reviewed-by: Yongqiang Sun Acked-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 1094c34ec53bc147e53f52ed9fe50899ad075632 Author: Nicholas Kazlauskas Date: Mon Jan 20 14:56:31 2020 -0500 drm/amd/display: Don't map ATOM_ENABLE to ATOM_INIT [Why] In DCN hardware sequencer we do actually call ATOM_INIT correctly per pipe. The workaround is not necessary for command table offloading. [How] Drop the workaround since it's not needed. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Chris Park Acked-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit b5336bfd6fe512521539e3f0f1cf4a5a6a45d380 Author: James Zhu Date: Fri Feb 7 08:11:00 2020 -0500 drm/amdgpu/vcn2.5: fix warning Fix warning during switching to dpg pause mode for VCN firmware Version ENC: 1.1 DEC: 1 VEP: 0 Revision: 16 Signed-off-by: James Zhu Acked-by: Leo Liu Signed-off-by: Alex Deucher commit 2cabe0d4cd88f7386e9c5a82236ceda46080a80b Author: Guchun Chen Date: Sun Feb 9 16:21:09 2020 +0800 drm/amdgpu: limit GDS clearing workaround in cold boot sequence GDS clear workaround will cause gfx failure in suspend/resume case. [ 98.679559] [drm:amdgpu_device_ip_late_init [amdgpu]] *ERROR* late_init of IP block failed -110 [ 98.679561] PM: dpm_run_callback(): pci_pm_resume+0x0/0xa0 returns -110 [ 98.679562] PM: Device 0000:03:00.0 failed to resume async: error -110 As this workaround is specific to the HW bug of GDS's ECC error existing in cold boot up, so bypass this workaround in suspend/ resume case after booting up. Signed-off-by: Guchun Chen Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 46d1da733fbc867cd3c3aabec21aeaacd9a41771 Author: Jonathan Kim Date: Thu Feb 6 11:57:11 2020 -0500 drm/amdgpu: fix amdgpu pmu to use hwc->config instead of hwc->conf hwc->conf was designated specifically for AMD APU IOMMU purposes. This could cause problems in performance and/or function since APU IOMMU implementation is elsewhere. Also hwc->conf and hwc->config are different members of an anonymous union so hwc->conf aliases as hw->last_tag. Signed-off-by: Jonathan Kim Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 416611d9b6eebaeae58ed26cc7d23131c69126b1 Author: Daniel Kolesa Date: Thu Feb 6 20:14:35 2020 +0100 amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags On PowerPC, the compiler will tag object files with whether they use hard or soft float FP ABI and whether they use 64 or 128-bit long double ABI. On systems with 64-bit long double ABI, a tag will get emitted whenever a double is used, as on those systems a long double is the same as a double. This will prevent linkage as other files are being compiled with hard-float. On ppc64, this code will never actually get used for the time being, as the only currently existing hardware using it are the Renoir APUs. Therefore, until this is testable and can be fixed properly, at least make sure the build will not fail. Signed-off-by: Daniel Kolesa Signed-off-by: Alex Deucher commit f4d0242b7b43977923f778b4cf787425ef05776e Author: James Zhu Date: Wed Feb 5 09:20:22 2020 -0500 drm/amdgpu/vcn2.5: fix DPG mode power off issue on instance 1 Support pause_state for multiple instance, and it will fix vcn2.5 DPG mode power off issue on instance 1. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit c134c3cabae46a56ab2e1f5e5fa49405e1758838 Author: Isabel Zhang Date: Mon Jan 27 10:57:16 2020 -0500 drm/amd/display: Add initialitions for PLL2 clock source [Why] Starting from 14nm, the PLL is built into the PHY and the PLL is mapped to PHY on 1 to 1 basis. In the code, the DP port is mapped to a PLL that was not initialized. This causes DP to HDMI dongle to not light up the display. [How] Initializations added for PLL2 when creating resources. Signed-off-by: Isabel Zhang Reviewed-by: Eric Yang Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 6c81917a0485ee2a1be0dc23321ac10ecfd9578b Author: Yongqiang Sun Date: Thu Jan 23 16:30:15 2020 -0500 drm/amd/display: Limit minimum DPPCLK to 100MHz. [Why] Underflow is observed when plug in a 4K@60 monitor with 1366x768 eDP due to DPPCLK is too low. [How] Limit minimum DPPCLK to 100MHz. Signed-off-by: Yongqiang Sun Reviewed-by: Eric Yang Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 2b63d0ec0daf79ba503fa8bfa25e07dc3da274f3 Author: Aric Cyr Date: Tue Jan 21 22:50:13 2020 -0500 drm/amd/display: Check engine is not NULL before acquiring [Why] Engine can be NULL in some cases, so we must not acquire it. [How] Check for NULL engine before acquiring. Signed-off-by: Aric Cyr Reviewed-by: Harry Wentland Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit ff5ac61ee83c13f516544d29847d28be093a40ee Author: Ard Biesheuvel Date: Sat Feb 1 09:32:21 2020 +0100 x86/ima: use correct identifier for SetupMode variable The IMA arch code attempts to inspect the "SetupMode" EFI variable by populating a variable called efi_SetupMode_name with the string "SecureBoot" and passing that to the EFI GetVariable service, which obviously does not yield the expected result. Given that the string is only referenced a single time, let's get rid of the intermediate variable, and pass the correct string as an immediate argument. While at it, do the same for "SecureBoot". Fixes: 399574c64eaf ("x86/ima: retry detecting secure boot mode") Fixes: 980ef4d22a95 ("x86/ima: check EFI SetupMode too") Cc: Matthew Garrett Signed-off-by: Ard Biesheuvel Cc: stable@vger.kernel.org # v5.3 Signed-off-by: Mimi Zohar commit d6d829d92c6e82b2627d3bb0058403ff15ee0592 Author: Arnaldo Carvalho de Melo Date: Tue Feb 11 16:03:47 2020 -0300 tools headers UAPI: Sync sched.h with the kernel To get the changes in: 769071ac9f20 ("ns: Introduce Time Namespace") Silencing this tools/perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/sched.h' differs from latest version at 'include/uapi/linux/sched.h' diff -u tools/include/uapi/linux/sched.h include/uapi/linux/sched.h Which enables 'perf trace' to decode the CLONE_NEWTIME bit in the 'flags' argument to the clone syscalls. Example of clone flags being decoded: [root@quaco ~]# perf trace -e clone* 0.000 qemu-system-x8/23923 clone(clone_flags: VM|FS|FILES|SIGHAND|THREAD|SYSVSEM|SETTLS|PARENT_SETTID|CHILD_CLEARTID, newsp: 0x7f0dad7f9870, parent_tidptr: 0x7f0dad7fa9d0, child_tidptr: 0x7f0dad7fa9d0, tls: 0x7f0dad7fa700) = 6806 (qemu-system-x86) ? qemu-system-x8/6806 ... [continued]: clone()) = 0 ^C[root@quaco ~]# At some point this should enable things like: # perf trace -e 'clone*/clone_flags&NEWTIME/' Cc: Adrian Hunter Cc: Andrei Vagin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit d7a07b293216e5561705303751bc0d213e9fb328 Author: Arnaldo Carvalho de Melo Date: Tue Feb 11 15:54:08 2020 -0300 perf trace: Resolve prctl's 'option' arg strings to numbers # perf trace -e syscalls:sys_enter_prctl --filter="option==SET_NAME" 0.000 Socket Thread/3860 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7fc50b9733e8) 0.053 SSL Cert #78/3860 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7fc50b9733e8) ^C # If one uses '-v' with 'perf trace', we can see the filter it puts in place: New filter for syscalls:sys_enter_prctl: (option==0xf) && (common_pid != 3859 && common_pid != 2757) We still need to allow using plain '-e prctl' and have this turn into creating a 'syscalls:sys_enter_prctl' event so that the filter can be applied only to it as right now '-e prctl' ends up using the 'raw_syscalls:sys_enter/sys_exit'. The end goal is to have something like: # perf trace -e prctl/option==SET_NAME/ And have that use tracepoint filters or eBPF ones. Cc: Adrian Hunter Cc: Christian Brauner Cc: Jiri Olsa Cc: Mike Christie Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit c0134b3366ba5f0aba41d56006b574d3be7f5ed3 Author: Arnaldo Carvalho de Melo Date: Tue Feb 11 15:46:10 2020 -0300 perf beauty prctl: Export the 'options' strarray So that we can use it with strtoul, allowing string to number conversions in filter expressions. Cc: Adrian Hunter Cc: Christian Brauner Cc: Jiri Olsa Cc: Mike Christie Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit fc9199d46e644e6a978f69195cb849b21d2f485c Author: Arnaldo Carvalho de Melo Date: Tue Feb 11 15:25:21 2020 -0300 tools headers UAPI: Sync prctl.h with the kernel sources To get the changes in: 8d19f1c8e193 ("prctl: PR_{G,S}ET_IO_FLUSHER to support controlling memory reclaim") Which ends up having this effect in tooling, i.e. the addition of the support to those prctl's options: $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/include/uapi/linux/prctl.h $ git diff diff --git a/tools/include/uapi/linux/prctl.h b/tools/include/uapi/linux/prctl.h index 7da1b37b27aa..07b4f8131e36 100644 --- a/tools/include/uapi/linux/prctl.h +++ b/tools/include/uapi/linux/prctl.h @@ -234,4 +234,8 @@ struct prctl_mm_map { #define PR_GET_TAGGED_ADDR_CTRL 56 # define PR_TAGGED_ADDR_ENABLE (1UL << 0) +/* Control reclaim behavior when allocating memory */ +#define PR_SET_IO_FLUSHER 57 +#define PR_GET_IO_FLUSHER 58 + #endif /* _LINUX_PRCTL_H */ $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after --- before 2020-02-11 15:24:35.339289912 -0300 +++ after 2020-02-11 15:24:56.319711315 -0300 @@ -51,6 +51,8 @@ [54] = "PAC_RESET_KEYS", [55] = "SET_TAGGED_ADDR_CTRL", [56] = "GET_TAGGED_ADDR_CTRL", + [57] = "SET_IO_FLUSHER", + [58] = "GET_IO_FLUSHER", }; static const char *prctl_set_mm_options[] = { [1] = "START_CODE", $ Cc: Adrian Hunter Cc: Christian Brauner Cc: Jiri Olsa Cc: Mike Christie Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit c75bec79fc080039e4575a0f239ea7b111aabe88 Author: Arnaldo Carvalho de Melo Date: Tue Feb 11 15:19:42 2020 -0300 tools headers UAPI: Sync copy of arm64's asm/unistd.h with the kernel sources To get the changes in: 3e3c8ca5a351 ("arm64: Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers") Silencing this tools/perf/ build warning: Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/unistd.h' differs from latest version at 'arch/arm64/include/uapi/asm/unistd.h' diff -u tools/arch/arm64/include/uapi/asm/unistd.h arch/arm64/include/uapi/asm/unistd.h Which will probably end up enabling the use of "clone3" in 'perf trace -e', haven't checked the build with this change on an arm64 system. Cc: Adrian Hunter Cc: Amanieu d'Antras Cc: Christian Brauner Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 484214f49bd0948d716832a94e4737ca4dd02c16 Author: Jiri Olsa Date: Mon Feb 10 15:32:18 2020 +0100 perf maps: Move kmap::kmaps setup to maps__insert() So the kmaps pointer setup is centralized and we do not need to update it in all those places (2 current places and few more missing) after calling maps__insert(). Reported-by: Ravi Bangoria Signed-off-by: Jiri Olsa Tested-by: Ravi Bangoria Tested-by: Kim Phillips Cc: Alexander Shishkin Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200210143218.24948-5-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7ce66139a99ce57caaf47b64afed5cb6ed02c5ed Author: Jiri Olsa Date: Mon Feb 10 15:32:17 2020 +0100 perf maps: Fix map__clone() for struct kmap The map__clone() function can be called on kernel maps as well, so it needs to duplicate the whole kmap data. Reported-by: Ravi Bangoria Signed-off-by: Jiri Olsa Tested-by: Ravi Bangoria Tested-by: Kim Phillips Cc: Alexander Shishkin Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200210143218.24948-4-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4a4eb6154d67f7766cc7eb74e9f1db424073e832 Author: Jiri Olsa Date: Mon Feb 10 21:08:47 2020 +0100 perf maps: Mark ksymbol DSOs with kernel type We add ksymbol map into machine->kmaps, so it needs to be created as 'struct kmap', which is dependent on its dso having kernel type. Reported-by: Ravi Bangoria Signed-off-by: Jiri Olsa Tested-by: Ravi Bangoria Tested-by: Kim Phillips Cc: Alexander Shishkin Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200210200847.GA36715@krava Signed-off-by: Arnaldo Carvalho de Melo commit 02213cec64bbef66d7ad9ddc3b7c47236da64343 Author: Jiri Olsa Date: Mon Feb 10 15:32:15 2020 +0100 perf maps: Mark module DSOs with kernel type We add kernel module map into machine->kmaps, so it needs to be created as 'struct kmap', which is dependent on its dso having kernel type. Reported-by: Ravi Bangoria Signed-off-by: Jiri Olsa Tested-by: Kim Phillips Tested-by: Ravi Bangoria Cc: Alexander Shishkin Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200210143218.24948-2-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c452833387624d1990c9bbb0ee1e98c10c147478 Author: Arnaldo Carvalho de Melo Date: Tue Feb 11 11:58:56 2020 -0300 tools include UAPI: Sync x86's syscalls_64.tbl, generic unistd.h and fcntl.h to pick up openat2 and pidfd_getfd fddb5d430ad9 ("open: introduce openat2(2) syscall") 9a2cef09c801 ("arch: wire up pidfd_getfd syscall") We also need to grab a copy of uapi/linux/openat2.h since it is now needed by fcntl.h, add it to tools/perf/check_headers.h. $ diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl --- tools/perf/arch/x86/entry/syscalls/syscall_64.tbl 2019-12-20 16:43:57.662429958 -0300 +++ arch/x86/entry/syscalls/syscall_64.tbl 2020-02-10 16:36:22.070012468 -0300 @@ -357,6 +357,8 @@ 433 common fspick __x64_sys_fspick 434 common pidfd_open __x64_sys_pidfd_open 435 common clone3 __x64_sys_clone3/ptregs +437 common openat2 __x64_sys_openat2 +438 common pidfd_getfd __x64_sys_pidfd_getfd # # x32-specific system call numbers start at 512 to avoid cache impact $ Update tools/'s copy of that file: $ cp arch/x86/entry/syscalls/syscall_64.tbl tools/perf/arch/x86/entry/syscalls/syscall_64.tbl See the result: $ diff -u /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c.before /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c --- /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c.before 2020-02-10 16:42:59.010636041 -0300 +++ /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c 2020-02-10 16:43:24.149958337 -0300 @@ -346,5 +346,7 @@ [433] = "fspick", [434] = "pidfd_open", [435] = "clone3", + [437] = "openat2", + [438] = "pidfd_getfd", }; -#define SYSCALLTBL_x86_64_MAX_ID 435 +#define SYSCALLTBL_x86_64_MAX_ID 438 $ Now one can use: perf trace -e openat2,pidfd_getfd To get just those syscalls or use in things like: perf trace -e open* To get all the open variant (open, openat, openat2, etc) or: perf trace pidfd* To get the pidfd syscalls. Cc: Adrian Hunter Cc: Aleksa Sarai Cc: Al Viro Cc: Christian Brauner Cc: Jiri Olsa Cc: Namhyung Kim Cc: Sargun Dhillon Signed-off-by: Arnaldo Carvalho de Melo commit 0f8a206df7c920150d2aa45574fba0ab7ff6be4f Author: Nathan Chancellor Date: Sat Feb 8 07:08:59 2020 -0700 s390/time: Fix clk type in get_tod_clock Clang warns: In file included from ../arch/s390/boot/startup.c:3: In file included from ../include/linux/elf.h:5: In file included from ../arch/s390/include/asm/elf.h:132: In file included from ../include/linux/compat.h:10: In file included from ../include/linux/time.h:74: In file included from ../include/linux/time32.h:13: In file included from ../include/linux/timex.h:65: ../arch/s390/include/asm/timex.h:160:20: warning: passing 'unsigned char [16]' to parameter of type 'char *' converts between pointers to integer types with different sign [-Wpointer-sign] get_tod_clock_ext(clk); ^~~ ../arch/s390/include/asm/timex.h:149:44: note: passing argument to parameter 'clk' here static inline void get_tod_clock_ext(char *clk) ^ Change clk's type to just be char so that it matches what happens in get_tod_clock_ext. Fixes: 57b28f66316d ("[S390] s390_hypfs: Add new attributes") Link: https://github.com/ClangBuiltLinux/linux/issues/861 Link: http://lkml.kernel.org/r/20200208140858.47970-1-natechancellor@gmail.com Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Vasily Gorbik commit 27dc0700c3be7c681cea03c5230b93d02f623492 Author: Christian Borntraeger Date: Mon Feb 10 11:27:37 2020 -0500 s390/uv: Fix handling of length extensions The query parameter block might contain additional information and can be extended in the future. If the size of the block does not suffice we get an error code of rc=0x100. The buffer will contain all information up to the specified size and the hypervisor/guest simply do not need the additional information as they do not know about the new data. That means that we can (and must) accept rc=0x100 as success. Cc: stable@vger.kernel.org Reviewed-by: Cornelia Huck Fixes: 5abb9351dfd9 ("s390/uv: introduce guest side ultravisor code") Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit 2c25b3f68e9236365d2beaa032cc6d2a160df084 Merge: 11f044653467 dbaf10027ae9 Author: Vasily Gorbik Date: Tue Feb 11 20:14:28 2020 +0100 Merge tag 'vfio-ccw-20200206' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into HEAD fix style of SPDX License Identifier * tag 'vfio-ccw-20200206' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw: vfio-ccw: Use the correct style for SPDX License Identifier Link: https://lkml.kernel.org/r/20200206170331.1032-1-cohuck@redhat.com Signed-off-by: Vasily Gorbik commit 11f0446534679e0a77441a19a65ed8b4a3d475f0 Author: Julian Wiedmann Date: Wed Feb 5 09:41:42 2020 +0100 s390/qdio: don't allocate *aob array with GFP_ATOMIC The only way to reach this allocation is via qdio_establish() qdio_detect_hsicq() qdio_enable_async_operation() and since qdio_establish() uses wait_event_*() just a few lines ealier, we can trust that it certainly is never called from atomic context. Signed-off-by: Julian Wiedmann Reviewed-by: Steffen Maier Signed-off-by: Vasily Gorbik commit 93f9d1a4ac5930654c17412e3911b46ece73755a Author: Arvind Sankar Date: Tue Feb 11 11:22:35 2020 -0500 ALSA: usb-audio: Apply sample rate quirk for Audioengine D1 The Audioengine D1 (0x2912:0x30c8) does support reading the sample rate, but it returns the rate in byte-reversed order. When setting sampling rate, the driver produces these warning messages: [168840.944226] usb 3-2.2: current rate 4500480 is different from the runtime rate 44100 [168854.930414] usb 3-2.2: current rate 8436480 is different from the runtime rate 48000 [168905.185825] usb 3-2.1.2: current rate 30465 is different from the runtime rate 96000 As can be seen from the hexadecimal conversion, the current rate read back is byte-reversed from the rate that was set. 44100 == 0x00ac44, 4500480 == 0x44ac00 48000 == 0x00bb80, 8436480 == 0x80bb00 96000 == 0x017700, 30465 == 0x007701 Rather than implementing a new quirk to reverse the order, just skip checking the rate to avoid spamming the log. Signed-off-by: Arvind Sankar Cc: Link: https://lore.kernel.org/r/20200211162235.1639889-1-nivedita@alum.mit.edu Signed-off-by: Takashi Iwai commit 663218a3e715fd9339d143a3e10088316b180f4f Author: Krishnamraju Eraparaju Date: Fri Feb 7 19:44:29 2020 +0530 RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready() Warnings like below can fill up the dmesg while disconnecting RDMA connections. Hence, remove the unwanted WARN_ON. WARNING: CPU: 6 PID: 0 at drivers/infiniband/sw/siw/siw_cm.c:1229 siw_cm_llp_data_ready+0xc1/0xd0 [siw] RIP: 0010:siw_cm_llp_data_ready+0xc1/0xd0 [siw] Call Trace: tcp_data_queue+0x226/0xb40 tcp_rcv_established+0x220/0x620 tcp_v4_do_rcv+0x12a/0x1e0 tcp_v4_rcv+0xb05/0xc00 ip_local_deliver_finish+0x69/0x210 ip_local_deliver+0x6b/0xe0 ip_rcv+0x273/0x362 __netif_receive_skb_core+0xb35/0xc30 netif_receive_skb_internal+0x3d/0xb0 napi_gro_frags+0x13b/0x200 t4_ethrx_handler+0x433/0x7d0 [cxgb4] process_responses+0x318/0x580 [cxgb4] napi_rx_handler+0x14/0x100 [cxgb4] net_rx_action+0x149/0x3b0 __do_softirq+0xe3/0x30a irq_exit+0x100/0x110 do_IRQ+0x7f/0xe0 common_interrupt+0xf/0xf Link: https://lore.kernel.org/r/20200207141429.27927-1-krishna2@chelsio.com Signed-off-by: Krishnamraju Eraparaju Signed-off-by: Jason Gunthorpe commit d219face9059f38ad187bde133451a2a308fdb7c Author: Krishnamraju Eraparaju Date: Tue Feb 4 14:42:30 2020 +0530 RDMA/iw_cxgb4: initiate CLOSE when entering TERM As per draft-hilland-iwarp-verbs-v1.0, sec 6.2.3, always initiate a CLOSE when entering into TERM state. In c4iw_modify_qp(), disconnect operation should only be performed when the modify_qp call is invoked from ib_core. And all other internal modify_qp calls(invoked within iw_cxgb4) that needs 'disconnect' should call c4iw_ep_disconnect() explicitly after modify_qp. Otherwise, deadlocks like below can occur: Call Trace: schedule+0x2f/0xa0 schedule_preempt_disabled+0xa/0x10 __mutex_lock.isra.5+0x2d0/0x4a0 c4iw_ep_disconnect+0x39/0x430 => tries to reacquire ep lock again c4iw_modify_qp+0x468/0x10d0 rx_data+0x218/0x570 => acquires ep lock process_work+0x5f/0x70 process_one_work+0x1a7/0x3b0 worker_thread+0x30/0x390 kthread+0x112/0x130 ret_from_fork+0x35/0x40 Fixes: d2c33370ae73 ("RDMA/iw_cxgb4: Always disconnect when QP is transitioning to TERMINATE state") Link: https://lore.kernel.org/r/20200204091230.7210-1-krishna2@chelsio.com Signed-off-by: Krishnamraju Eraparaju Signed-off-by: Jason Gunthorpe commit 10189e8e6fe8dcde13435f9354800429c4474fb1 Author: Mark Zhang Date: Sun Jan 26 19:17:08 2020 +0200 IB/mlx5: Return failure when rts2rts_qp_counters_set_id is not supported When binding a QP with a counter and the QP state is not RESET, return failure if the rts2rts_qp_counters_set_id is not supported by the device. This is to prevent cases like manual bind for Connect-IB devices from returning success when the feature is not supported. Fixes: d14133dd4161 ("IB/mlx5: Support set qp counter") Link: https://lore.kernel.org/r/20200126171708.5167-1-leon@kernel.org Signed-off-by: Mark Zhang Reviewed-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a72f4ac1d778f7bde93dfee69bfc23377ec3d74f Author: Avihai Horon Date: Sun Jan 26 19:15:00 2020 +0200 RDMA/core: Fix invalid memory access in spec_filter_size Add a check that the size specified in the flow spec header doesn't cause an overflow when calculating the filter size, and thus prevent access to invalid memory. The following crash from syzkaller revealed it. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN PTI CPU: 1 PID: 17834 Comm: syz-executor.3 Not tainted 5.5.0-rc5 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 RIP: 0010:memchr_inv+0xd3/0x330 Code: 89 f9 89 f5 83 e1 07 0f 85 f9 00 00 00 49 89 d5 49 c1 ed 03 45 85 ed 74 6f 48 89 d9 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 <80> 3c 01 00 0f 85 0d 02 00 00 44 0f b6 e5 48 b8 01 01 01 01 01 01 RSP: 0018:ffffc9000a13fa50 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 7fff88810de9d820 RCX: 0ffff11021bd3b04 RDX: 000000000000fff8 RSI: 0000000000000000 RDI: 7fff88810de9d820 RBP: 0000000000000000 R08: ffff888110d69018 R09: 0000000000000009 R10: 0000000000000001 R11: ffffed10236267cc R12: 0000000000000004 R13: 0000000000001fff R14: ffff88810de9d820 R15: 0000000000000040 FS: 00007f9ee0e51700(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000115ea0006 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: spec_filter_size.part.16+0x34/0x50 ib_uverbs_kern_spec_to_ib_spec_filter+0x691/0x770 ib_uverbs_ex_create_flow+0x9ea/0x1b40 ib_uverbs_write+0xaa5/0xdf0 __vfs_write+0x7c/0x100 vfs_write+0x168/0x4a0 ksys_write+0xc8/0x200 do_syscall_64+0x9c/0x390 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x465b49 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9ee0e50c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000465b49 RDX: 00000000000003a0 RSI: 00000000200007c0 RDI: 0000000000000004 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9ee0e516bc R13: 00000000004ca2da R14: 000000000070deb8 R15: 00000000ffffffff Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) Fixes: 94e03f11ad1f ("IB/uverbs: Add support for flow tag") Link: https://lore.kernel.org/r/20200126171500.4623-1-leon@kernel.org Signed-off-by: Avihai Horon Reviewed-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit aad927b5a863178a9d921044e52d66e0ccf0aff9 Author: Sung Lee Date: Mon Jan 20 18:58:45 2020 -0500 drm/amd/display: Use dcfclk to populate watermark ranges [WHY & HOW] Previously drain clk was unconstrained and fill clk was constrained on fclk. We want to change it to fill clk unconstrained and drain clock constrained to dcfclk. Signed-off-by: Sung Lee Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit df36f6cf23ada812930afa8ee76681d4ad307c61 Author: Sung Lee Date: Wed Jan 15 11:55:06 2020 -0500 drm/amd/display: Do not set optimized_require to false after plane disable [WHY] The optimized_require flag is needed to set watermarks and clocks lower in certain conditions. This flag is set to true and then set to false while programming front end in dcn20. [HOW] Do not set the flag to false while disabling plane. Signed-off-by: Sung Lee Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 7aa62404dfdefd759e6a5f8923a0b0704729295f Author: Roman Li Date: Tue Jan 14 13:56:08 2020 -0500 drm/amd/display: Fix psr static frames calculation [Why] Driver crash with psr feature enabled due to divide-by-zero error. This is a regression after rework to calculate static screen frame number entry time. [How] Correct order of operations to avoid divide-by-zero. Signed-off-by: Roman Li Reviewed-by: Zhan Liu Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit f24667779b5348279e5e4328312a141a730a1fc7 Author: Kuninori Morimoto Date: Mon Dec 16 11:08:47 2019 +0900 ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi frame-inversion is "flag" not "uint32". This patch fixup it. Signed-off-by: Kuninori Morimoto Reviewed-by: Patrice Chotard Signed-off-by: Patrice Chotard commit 9b9be9e6dcf444de08fc675c61ac8e541b458d56 Author: Patrice Chotard Date: Tue Jan 7 11:38:33 2020 +0100 ARM: dts: sti: Remove deprecated snps PHY properties for stih410-b2260 Remove "snps,phy-bus-name", "snps,phy-bus-id" and "snps,phy-addr" properties which are deprecated. Signed-off-by: Patrice Chotard commit d75a170fd848f037a1e28893ad10be7a4c51f8a6 Author: Takashi Iwai Date: Tue Feb 11 17:05:21 2020 +0100 ALSA: usb-audio: Fix UAC2/3 effect unit parsing We've got a regression report about M-Audio Fast Track C400 device, and the git bisection resulted in the commit e0ccdef92653 ("ALSA: usb-audio: Clean up check_input_term()"). This commit was about the rewrite of the input terminal parser, and it's not too obvious from the change what really broke. The answer is: it's the interpretation of UAC2/3 effect units. In the original code, UAC2 effect unit is as if through UAC1 processing unit because both UAC1 PU and UAC2/3 EU share the same number (0x07). The old code went through a complex switch-case fallthrough, finally bailing out in the middle: if (protocol == UAC_VERSION_2 && hdr[2] == UAC2_EFFECT_UNIT) { /* UAC2/UAC1 unit IDs overlap here in an * uncompatible way. Ignore this unit for now. */ return 0; } ... and this special handling was missing in the new code; the new code treats UAC2/3 effect unit as if it were equivalent with the processing unit. Actually, the old code was too confusing. The effect unit has an incompatible unit description with the processing unit, so we shouldn't have dealt with EU in the same way. This patch addresses the regression by changing the effect unit handling to the own parser function. The own parser function makes the clear distinct with PU, so it improves the readability, too. The EU parser just sets the type and the id like the old kernels. Once when the proper effect unit support is added, we can revisit this parser function, but for now, let's keep this simple setup as is. Fixes: e0ccdef92653 ("ALSA: usb-audio: Clean up check_input_term()") Cc: BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206147 Link: https://lore.kernel.org/r/20200211160521.31990-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 3b20bc2fe4c0cfd82d35838965dc7ff0b93415c6 Author: Xiubo Li Date: Tue Feb 11 01:53:16 2020 -0500 ceph: noacl mount option is effectively ignored For the old mount API, the module parameters parseing function will be called in ceph_mount() and also just after the default posix acl flag set, so we can control to enable/disable it via the mount option. But for the new mount API, it will call the module parameters parseing function before ceph_get_tree(), so the posix acl will always be enabled. Fixes: 82995cc6c5ae ("libceph, rbd, ceph: convert to use the new mount API") Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit b27a939e8376a3f1ed09b9c33ef44d20f18ec3d0 Author: Ilya Dryomov Date: Mon Feb 10 22:51:08 2020 +0100 ceph: canonicalize server path in place syzbot reported that 4fbc0c711b24 ("ceph: remove the extra slashes in the server path") had caused a regression where an allocation could be done under a spinlock -- compare_mount_options() is called by sget_fc() with sb_lock held. We don't really need the supplied server path, so canonicalize it in place and compare it directly. To make this work, the leading slash is kept around and the logic in ceph_real_mount() to skip it is restored. CEPH_MSG_CLIENT_SESSION now reports the same (i.e. canonicalized) path, with the leading slash of course. Fixes: 4fbc0c711b24 ("ceph: remove the extra slashes in the server path") Reported-by: syzbot+98704a51af8e3d9425a9@syzkaller.appspotmail.com Signed-off-by: Ilya Dryomov Reviewed-by: Jeff Layton commit 8e4473bb50a1796c9c32b244e5dbc5ee24ead937 Author: Xiubo Li Date: Mon Feb 3 21:28:25 2020 -0500 ceph: do not execute direct write in parallel if O_APPEND is specified In O_APPEND & O_DIRECT mode, the data from different writers will be possibly overlapping each other since they take the shared lock. For example, both Writer1 and Writer2 are in O_APPEND and O_DIRECT mode: Writer1 Writer2 shared_lock() shared_lock() getattr(CAP_SIZE) getattr(CAP_SIZE) iocb->ki_pos = EOF iocb->ki_pos = EOF write(data1) write(data2) shared_unlock() shared_unlock() The data2 will overlap the data1 from the same file offset, the old EOF. Switch to exclusive lock instead when O_APPEND is specified. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit f92e48718889b3d49cee41853402aa88cac84a6b Author: Kaike Wan Date: Mon Feb 10 08:10:40 2020 -0500 IB/rdmavt: Reset all QPs when the device is shut down When the hfi1 device is shut down during a system reboot, it is possible that some QPs might have not not freed by ULPs. More requests could be post sent and a lingering timer could be triggered to schedule more packet sends, leading to a crash: BUG: unable to handle kernel NULL pointer dereference at 0000000000000102 IP: [ffffffff810a65f2] __queue_work+0x32/0x3c0 PGD 0 Oops: 0000 1 SMP Modules linked in: nvmet_rdma(OE) nvmet(OE) nvme(OE) dm_round_robin nvme_rdma(OE) nvme_fabrics(OE) nvme_core(OE) pal_raw(POE) pal_pmt(POE) pal_cache(POE) pal_pile(POE) pal(POE) pal_compatible(OE) rpcrdma sunrpc ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm mlx4_ib sb_edac edac_core intel_powerclamp coretemp intel_rapl iosf_mbi kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd iTCO_wdt iTCO_vendor_support mxm_wmi ipmi_ssif pcspkr ses enclosure joydev scsi_transport_sas i2c_i801 sg mei_me lpc_ich mei ioatdma shpchp ipmi_si ipmi_devintf ipmi_msghandler wmi acpi_power_meter acpi_pad dm_multipath hangcheck_timer ip_tables ext4 mbcache jbd2 mlx4_en sd_mod crc_t10dif crct10dif_generic mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm mlx4_core crct10dif_pclmul crct10dif_common hfi1(OE) igb crc32c_intel rdmavt(OE) ahci ib_core libahci libata ptp megaraid_sas pps_core dca i2c_algo_bit i2c_core devlink dm_mirror dm_region_hash dm_log dm_mod CPU: 23 PID: 0 Comm: swapper/23 Tainted: P OE ------------ 3.10.0-693.el7.x86_64 #1 Hardware name: Intel Corporation S2600CWR/S2600CWR, BIOS SE5C610.86B.01.01.0028.121720182203 12/17/2018 task: ffff8808f4ec4f10 ti: ffff8808f4ed8000 task.ti: ffff8808f4ed8000 RIP: 0010:[ffffffff810a65f2] [ffffffff810a65f2] __queue_work+0x32/0x3c0 RSP: 0018:ffff88105df43d48 EFLAGS: 00010046 RAX: 0000000000000086 RBX: 0000000000000086 RCX: 0000000000000000 RDX: ffff880f74e758b0 RSI: 0000000000000000 RDI: 000000000000001f RBP: ffff88105df43d80 R08: ffff8808f3c583c8 R09: ffff8808f3c58000 R10: 0000000000000002 R11: ffff88105df43da8 R12: ffff880f74e758b0 R13: 000000000000001f R14: 0000000000000000 R15: ffff88105a300000 FS: 0000000000000000(0000) GS:ffff88105df40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000102 CR3: 00000000019f2000 CR4: 00000000001407e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffff88105b6dd708 0000001f00000286 0000000000000086 ffff88105a300000 ffff880f74e75800 0000000000000000 ffff88105a300000 ffff88105df43d98 ffffffff810a6b85 ffff88105a301e80 ffff88105df43dc8 ffffffffc0224cde Call Trace: IRQ [ffffffff810a6b85] queue_work_on+0x45/0x50 [ffffffffc0224cde] _hfi1_schedule_send+0x6e/0xc0 [hfi1] [ffffffffc0170570] ? get_map_page+0x60/0x60 [rdmavt] [ffffffffc0224d62] hfi1_schedule_send+0x32/0x70 [hfi1] [ffffffffc0170644] rvt_rc_timeout+0xd4/0x120 [rdmavt] [ffffffffc0170570] ? get_map_page+0x60/0x60 [rdmavt] [ffffffff81097316] call_timer_fn+0x36/0x110 [ffffffffc0170570] ? get_map_page+0x60/0x60 [rdmavt] [ffffffff8109982d] run_timer_softirq+0x22d/0x310 [ffffffff81090b3f] __do_softirq+0xef/0x280 [ffffffff816b6a5c] call_softirq+0x1c/0x30 [ffffffff8102d3c5] do_softirq+0x65/0xa0 [ffffffff81090ec5] irq_exit+0x105/0x110 [ffffffff816b76c2] smp_apic_timer_interrupt+0x42/0x50 [ffffffff816b5c1d] apic_timer_interrupt+0x6d/0x80 EOI [ffffffff81527a02] ? cpuidle_enter_state+0x52/0xc0 [ffffffff81527b48] cpuidle_idle_call+0xd8/0x210 [ffffffff81034fee] arch_cpu_idle+0xe/0x30 [ffffffff810e7bca] cpu_startup_entry+0x14a/0x1c0 [ffffffff81051af6] start_secondary+0x1b6/0x230 Code: 89 e5 41 57 41 56 49 89 f6 41 55 41 89 fd 41 54 49 89 d4 53 48 83 ec 10 89 7d d4 9c 58 0f 1f 44 00 00 f6 c4 02 0f 85 be 02 00 00 41 f6 86 02 01 00 00 01 0f 85 58 02 00 00 49 c7 c7 28 19 01 00 RIP [ffffffff810a65f2] __queue_work+0x32/0x3c0 RSP ffff88105df43d48 CR2: 0000000000000102 The solution is to reset the QPs before the device resources are freed. This reset will change the QP state to prevent post sends and delete timers to prevent callbacks. Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table") Link: https://lore.kernel.org/r/20200210131040.87408.38161.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit be8638344c70bf492963ace206a9896606b6922d Author: Mike Marciniszyn Date: Mon Feb 10 08:10:33 2020 -0500 IB/hfi1: Close window for pq and request coliding Cleaning up a pq can result in the following warning and panic: WARNING: CPU: 52 PID: 77418 at lib/list_debug.c:53 __list_del_entry+0x63/0xd0 list_del corruption, ffff88cb2c6ac068->next is LIST_POISON1 (dead000000000100) Modules linked in: mmfs26(OE) mmfslinux(OE) tracedev(OE) 8021q garp mrp ib_isert iscsi_target_mod target_core_mod crc_t10dif crct10dif_generic opa_vnic rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_ipoib(OE) bridge stp llc iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crct10dif_pclmul crct10dif_common crc32_pclmul ghash_clmulni_intel ast aesni_intel ttm lrw gf128mul glue_helper ablk_helper drm_kms_helper cryptd syscopyarea sysfillrect sysimgblt fb_sys_fops drm pcspkr joydev lpc_ich mei_me drm_panel_orientation_quirks i2c_i801 mei wmi ipmi_si ipmi_devintf ipmi_msghandler nfit libnvdimm acpi_power_meter acpi_pad hfi1(OE) rdmavt(OE) rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core binfmt_misc numatools(OE) xpmem(OE) ip_tables nfsv3 nfs_acl nfs lockd grace sunrpc fscache igb ahci i2c_algo_bit libahci dca ptp libata pps_core crc32c_intel [last unloaded: i2c_algo_bit] CPU: 52 PID: 77418 Comm: pvbatch Kdump: loaded Tainted: G OE ------------ 3.10.0-957.38.3.el7.x86_64 #1 Hardware name: HPE.COM HPE SGI 8600-XA730i Gen10/X11DPT-SB-SG007, BIOS SBED1229 01/22/2019 Call Trace: [] dump_stack+0x19/0x1b [] __warn+0xd8/0x100 [] warn_slowpath_fmt+0x5f/0x80 [] __list_del_entry+0x63/0xd0 [] list_del+0xd/0x30 [] kmem_cache_destroy+0x50/0x110 [] hfi1_user_sdma_free_queues+0xf0/0x200 [hfi1] [] hfi1_file_close+0x70/0x1e0 [hfi1] [] __fput+0xec/0x260 [] ____fput+0xe/0x10 [] task_work_run+0xbb/0xe0 [] do_notify_resume+0xa5/0xc0 [] int_signal+0x12/0x17 BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [] kmem_cache_close+0x7e/0x300 PGD 2cdab19067 PUD 2f7bfdb067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: mmfs26(OE) mmfslinux(OE) tracedev(OE) 8021q garp mrp ib_isert iscsi_target_mod target_core_mod crc_t10dif crct10dif_generic opa_vnic rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_ipoib(OE) bridge stp llc iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crct10dif_pclmul crct10dif_common crc32_pclmul ghash_clmulni_intel ast aesni_intel ttm lrw gf128mul glue_helper ablk_helper drm_kms_helper cryptd syscopyarea sysfillrect sysimgblt fb_sys_fops drm pcspkr joydev lpc_ich mei_me drm_panel_orientation_quirks i2c_i801 mei wmi ipmi_si ipmi_devintf ipmi_msghandler nfit libnvdimm acpi_power_meter acpi_pad hfi1(OE) rdmavt(OE) rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core binfmt_misc numatools(OE) xpmem(OE) ip_tables nfsv3 nfs_acl nfs lockd grace sunrpc fscache igb ahci i2c_algo_bit libahci dca ptp libata pps_core crc32c_intel [last unloaded: i2c_algo_bit] CPU: 52 PID: 77418 Comm: pvbatch Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.38.3.el7.x86_64 #1 Hardware name: HPE.COM HPE SGI 8600-XA730i Gen10/X11DPT-SB-SG007, BIOS SBED1229 01/22/2019 task: ffff88cc26db9040 ti: ffff88b5393a8000 task.ti: ffff88b5393a8000 RIP: 0010:[] [] kmem_cache_close+0x7e/0x300 RSP: 0018:ffff88b5393abd60 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffff88cb2c6ac000 RCX: 0000000000000003 RDX: 0000000000000400 RSI: 0000000000000400 RDI: ffffffff9095b800 RBP: ffff88b5393abdb0 R08: ffffffff9095b808 R09: ffffffff8ff77c19 R10: ffff88b73ce1f160 R11: ffffddecddde9800 R12: ffff88cb2c6ac000 R13: 000000000000000c R14: ffff88cf3fdca780 R15: 0000000000000000 FS: 00002aaaaab52500(0000) GS:ffff88b73ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000002d27664000 CR4: 00000000007607e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: [] __kmem_cache_shutdown+0x14/0x80 [] kmem_cache_destroy+0x58/0x110 [] hfi1_user_sdma_free_queues+0xf0/0x200 [hfi1] [] hfi1_file_close+0x70/0x1e0 [hfi1] [] __fput+0xec/0x260 [] ____fput+0xe/0x10 [] task_work_run+0xbb/0xe0 [] do_notify_resume+0xa5/0xc0 [] int_signal+0x12/0x17 Code: 00 00 ba 00 04 00 00 0f 4f c2 3d 00 04 00 00 89 45 bc 0f 84 e7 01 00 00 48 63 45 bc 49 8d 04 c4 48 89 45 b0 48 8b 80 c8 00 00 00 <48> 8b 78 10 48 89 45 c0 48 83 c0 10 48 89 45 d0 48 8b 17 48 39 RIP [] kmem_cache_close+0x7e/0x300 RSP CR2: 0000000000000010 The panic is the result of slab entries being freed during the destruction of the pq slab. The code attempts to quiesce the pq, but looking for n_req == 0 doesn't account for new requests. Fix the issue by using SRCU to get a pq pointer and adjust the pq free logic to NULL the fd pq pointer prior to the quiesce. Fixes: e87473bc1b6c ("IB/hfi1: Only set fd pointer when base context is completely initialized") Link: https://lore.kernel.org/r/20200210131033.87408.81174.stgit@awfm-01.aw.intel.com Reviewed-by: Kaike Wan Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit a70ed0f2e6262e723ae8d70accb984ba309eacc2 Author: Kaike Wan Date: Mon Feb 10 08:10:26 2020 -0500 IB/hfi1: Acquire lock to release TID entries when user file is closed Each user context is allocated a certain number of RcvArray (TID) entries and these entries are managed through TID groups. These groups are put into one of three lists in each user context: tid_group_list, tid_used_list, and tid_full_list, depending on the number of used TID entries within each group. When TID packets are expected, one or more TID groups will be allocated. After the packets are received, the TID groups will be freed. Since multiple user threads may access the TID groups simultaneously, a mutex exp_mutex is used to synchronize the access. However, when the user file is closed, it tries to release all TID groups without acquiring the mutex first, which risks a race condition with another thread that may be releasing its TID groups, leading to data corruption. This patch addresses the issue by acquiring the mutex first before releasing the TID groups when the file is closed. Fixes: 3abb33ac6521 ("staging/hfi1: Add TID cache receive init and free funcs") Link: https://lore.kernel.org/r/20200210131026.87408.86853.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 9cc68ee1d92e3ab5bd5c821e5c1f387b0e16a669 Author: Jordan Crouse Date: Wed Feb 5 13:48:17 2020 -0700 drm/msm: Fix a6xx GMU shutdown sequence Commit e812744c5f95 ("drm: msm: a6xx: Add support for A618") missed updating the VBIF flush in a6xx_gmu_shutdown and instead inserted the new sequence into a6xx_pm_suspend along with a redundant GMU idle. Move a6xx_bus_clear_pending_transactions to a6xx_gmu.c and use it in the appropriate place in the shutdown routine and remove the redundant idle call. v2: Remove newly unused variable that was triggering a warning Signed-off-by: Jordan Crouse Reviewed-by: Rob Clark Fixes: e812744c5f95 ("drm: msm: a6xx: Add support for A618") Tested-by: Douglas Anderson Signed-off-by: Rob Clark commit 1636295a9f6931e8524c416ae333cd9ff7ef4661 Author: Jordan Crouse Date: Wed Feb 5 10:01:21 2020 -0700 drm/msm/a6xx: Update the GMU bus tables for sc7180 Fixup the GMU bus table values for the sc7180 target. Signed-off-by: Jordan Crouse Reviewed-by: Rob Clark Fixes: e812744c5f95 ("drm: msm: a6xx: Add support for A618") Signed-off-by: Rob Clark commit 56d977d5610bc6a83cf5f2d69cec91f3a2b91f77 Author: Jordan Crouse Date: Tue Feb 4 10:42:28 2020 -0700 drm/msm/a6xx: Remove unneeded GBIF unhalt Commit e812744c5f95 ("drm: msm: a6xx: Add support for A618") added a universal GBIF un-halt into a6xx_start(). This can cause problems for a630 targets which do not use GBIF and might have access protection enabled on the region now occupied by the GBIF registers. But it turns out that we didn't need to unhalt the GBIF in this path since the stop function already takes care of that after executing a flush but before turning off the headswitch. We should be confident that the GBIF is open for business when we restart the hardware. Signed-off-by: Jordan Crouse Tested-by: John Stultz Reviewed-by: Rob Clark Fixes: e812744c5f95 ("drm: msm: a6xx: Add support for A618") Signed-off-by: Rob Clark commit 7fd2dfc3694922eb7ace4801b7208cf9f62ebc7d Author: John Stultz Date: Wed Jan 29 20:12:44 2020 +0000 drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI I was hitting kCFI crashes when building with clang, and after some digging finally narrowed it down to the dsi_mgr_connector_mode_valid() function being implemented as returning an int, instead of an enum drm_mode_status. This patch fixes it, and appeases the opaque word of the kCFI gods (seriously, clang inlining everything makes the kCFI backtraces only really rough estimates of where things went wrong). Thanks as always to Sami for his help narrowing this down. Cc: Rob Clark Cc: Sean Paul Cc: Sami Tolvanen Cc: Todd Kjos Cc: Alistair Delva Cc: Amit Pundir Cc: Sumit Semwal Cc: freedreno@lists.freedesktop.org Cc: clang-built-linux@googlegroups.com Signed-off-by: John Stultz Reviewed-by: Nick Desaulniers Tested-by: Amit Pundir Signed-off-by: Rob Clark commit e8e35c62ba517f73cca32bc9925d62f4c4981768 Author: Akhil P Oommen Date: Fri Jan 24 17:50:11 2020 +0530 drm/msm/a6xx: Correct the highestbank configuration Highest bank bit configuration is different for a618 gpu. Update it with the correct configuration which is the reset value incidentally. Signed-off-by: Akhil P Oommen Signed-off-by: Sharat Masetty Fixes: e812744c5f95 ("drm: msm: a6xx: Add support for A618") Reviewed-by: Rob Clark Signed-off-by: Rob Clark commit 8a4f300b978edbbaa73ef9eca660e45eb9f13873 Author: Kamal Heib Date: Wed Feb 5 13:05:30 2020 +0200 RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create Make sure to free the allocated cpumask_var_t's to avoid the following reported memory leak by kmemleak: $ cat /sys/kernel/debug/kmemleak unreferenced object 0xffff8897f812d6a8 (size 8): comm "kworker/1:1", pid 347, jiffies 4294751400 (age 101.703s) hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace: [<00000000bff49664>] alloc_cpumask_var_node+0x4c/0xb0 [<0000000075d3ca81>] hfi1_comp_vectors_set_up+0x20f/0x800 [hfi1] [<0000000098d420df>] hfi1_init_dd+0x3311/0x4960 [hfi1] [<0000000071be7e52>] init_one+0x25e/0xf10 [hfi1] [<000000005483d4c2>] local_pci_probe+0xd4/0x180 [<000000007c3cbc6e>] work_for_cpu_fn+0x51/0xa0 [<000000001d626905>] process_one_work+0x8f0/0x17b0 [<000000007e569e7e>] worker_thread+0x536/0xb50 [<00000000fd39a4a5>] kthread+0x30c/0x3d0 [<0000000056f2edb3>] ret_from_fork+0x3a/0x50 Fixes: 5d18ee67d4c1 ("IB/{hfi1, rdmavt, qib}: Implement CQ completion vector support") Link: https://lore.kernel.org/r/20200205110530.12129-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Reviewed-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit e4f9bbe9f8beab9a1ce460e7e194595b76868595 Author: Kalyan Thota Date: Thu Jan 23 15:47:55 2020 +0530 msm:disp:dpu1: add UBWC support for display on SC7180 Add UBWC global configuration for display on SC7180 target. Signed-off-by: Kalyan Thota Tested-by: Douglas Anderson Fixes: 73bfb790ac78 ("msm:disp:dpu1: setup display datapath for SC7180 target") Signed-off-by: Rob Clark commit ef8c9809acb0805c991bba8bdd4749fc46d44a98 Author: Brian Masney Date: Sat Jan 18 15:41:20 2020 -0500 drm/msm/mdp5: rate limit pp done timeout warnings Add rate limiting of the 'pp done time out' warnings since these warnings can quickly fill the dmesg buffer. Signed-off-by: Brian Masney Signed-off-by: Rob Clark commit 30744a68626db6a0029aca9c646831c869c16d83 Author: Magnus Karlsson Date: Mon Feb 10 16:27:12 2020 +0100 xsk: Publish global consumer pointers when NAPI is finished The commit 4b638f13bab4 ("xsk: Eliminate the RX batch size") introduced a much more lazy way of updating the global consumer pointers from the kernel side, by only doing so when running out of entries in the fill or Tx rings (the rings consumed by the kernel). This can result in a deadlock with the user application if the kernel requires more than one entry to proceed and the application cannot put these entries in the fill ring because the kernel has not updated the global consumer pointer since the ring is not empty. Fix this by publishing the local kernel side consumer pointer whenever we have completed Rx or Tx processing in the kernel. This way, user space will have an up-to-date view of the consumer pointers whenever it gets to execute in the one core case (application and driver on the same core), or after a certain number of packets have been processed in the two core case (application and driver on different cores). A side effect of this patch is that the one core case gets better performance, but the two core case gets worse. The reason that the one core case improves is that updating the global consumer pointer is relatively cheap since the application by definition is not running when the kernel is (they are on the same core) and it is beneficial for the application, once it gets to run, to have pointers that are as up to date as possible since it then can operate on more packets and buffers. In the two core case, the most important performance aspect is to minimize the number of accesses to the global pointers since they are shared between two cores and bounces between the caches of those cores. This patch results in more updates to global state, which means lower performance in the two core case. Fixes: 4b638f13bab4 ("xsk: Eliminate the RX batch size") Reported-by: Ryan Goodfellow Reported-by: Maxim Mikityanskiy Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Acked-by: Jonathan Lemon Acked-by: Maxim Mikityanskiy Link: https://lore.kernel.org/bpf/1581348432-6747-1-git-send-email-magnus.karlsson@intel.com commit da0f3e0201b87ee4bbd2175925dd57e1228c35fb Author: Andy Shevchenko Date: Mon Feb 10 17:23:02 2020 +0200 MAINTAINERS: Sort entries in database for THUNDERBOLT Run parse-maintainers.pl and choose THUNDERBOLT record. Fix it accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Mika Westerberg commit f861854e1b435b27197417f6f90d87188003cb24 Author: Kan Liang Date: Tue Jan 21 11:01:25 2020 -0800 perf/x86/intel: Fix inaccurate period in context switch for auto-reload Perf doesn't take the left period into account when auto-reload is enabled with fixed period sampling mode in context switch. Here is the MSR trace of the perf command as below. (The MSR trace is simplified from a ftrace log.) #perf record -e cycles:p -c 2000000 -- ./triad_loop //The MSR trace of task schedule out //perf disable all counters, disable PEBS, disable GP counter 0, //read GP counter 0, and re-enable all counters. //The counter 0 stops at 0xfffffff82840 write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value 0 write_msr: MSR_IA32_PEBS_ENABLE(3f1), value 0 write_msr: MSR_P6_EVNTSEL0(186), value 40003003c rdpmc: 0, value fffffff82840 write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value f000000ff //The MSR trace of the same task schedule in again //perf disable all counters, enable and set GP counter 0, //enable PEBS, and re-enable all counters. //0xffffffe17b80 (-2000000) is written to GP counter 0. write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value 0 write_msr: MSR_IA32_PMC0(4c1), value ffffffe17b80 write_msr: MSR_P6_EVNTSEL0(186), value 40043003c write_msr: MSR_IA32_PEBS_ENABLE(3f1), value 1 write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value f000000ff When the same task schedule in again, the counter should starts from previous left. However, it starts from the fixed period -2000000 again. A special variant of intel_pmu_save_and_restart() is used for auto-reload, which doesn't update the hwc->period_left. When the monitored task schedules in again, perf doesn't know the left period. The fixed period is used, which is inaccurate. With auto-reload, the counter always has a negative counter value. So the left period is -value. Update the period_left in intel_pmu_save_and_restart_reload(). With the patch: //The MSR trace of task schedule out write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value 0 write_msr: MSR_IA32_PEBS_ENABLE(3f1), value 0 write_msr: MSR_P6_EVNTSEL0(186), value 40003003c rdpmc: 0, value ffffffe25cbc write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value f000000ff //The MSR trace of the same task schedule in again write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value 0 write_msr: MSR_IA32_PMC0(4c1), value ffffffe25cbc write_msr: MSR_P6_EVNTSEL0(186), value 40043003c write_msr: MSR_IA32_PEBS_ENABLE(3f1), value 1 write_msr: MSR_CORE_PERF_GLOBAL_CTRL(38f), value f000000ff Fixes: d31fc13fdcb2 ("perf/x86/intel: Fix event update for auto-reload") Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20200121190125.3389-1-kan.liang@linux.intel.com commit 25d387287cf0330abf2aad761ce6eee67326a355 Author: Kim Phillips Date: Tue Jan 21 11:12:31 2020 -0600 perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map Commit 3fe3331bb285 ("perf/x86/amd: Add event map for AMD Family 17h"), claimed L2 misses were unsupported, due to them not being found in its referenced documentation, whose link has now moved [1]. That old documentation listed PMCx064 unit mask bit 3 as: "LsRdBlkC: LS Read Block C S L X Change to X Miss." and bit 0 as: "IcFillMiss: IC Fill Miss" We now have new public documentation [2] with improved descriptions, that clearly indicate what events those unit mask bits represent: Bit 3 now clearly states: "LsRdBlkC: Data Cache Req Miss in L2 (all types)" and bit 0 is: "IcFillMiss: Instruction Cache Req Miss in L2." So we can now add support for L2 misses in perf's genericised events as PMCx064 with both the above unit masks. [1] The commit's original documentation reference, "Processor Programming Reference (PPR) for AMD Family 17h Model 01h, Revision B1 Processors", originally available here: https://www.amd.com/system/files/TechDocs/54945_PPR_Family_17h_Models_00h-0Fh.pdf is now available here: https://developer.amd.com/wordpress/media/2017/11/54945_PPR_Family_17h_Models_00h-0Fh.pdf [2] "Processor Programming Reference (PPR) for Family 17h Model 31h, Revision B0 Processors", available here: https://developer.amd.com/wp-content/resources/55803_0.54-PUB.pdf Fixes: 3fe3331bb285 ("perf/x86/amd: Add event map for AMD Family 17h") Reported-by: Babu Moger Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Babu Moger Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200121171232.28839-1-kim.phillips@amd.com commit 0aa0e0d6b34b89649e6b5882a7e025a0eb9bd832 Author: Kan Liang Date: Tue Jan 28 10:31:19 2020 -0800 perf/x86/msr: Add Tremont support Tremont is Intel's successor to Goldmont Plus. SMI_COUNT MSR is also supported. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Andi Kleen Link: https://lkml.kernel.org/r/1580236279-35492-3-git-send-email-kan.liang@linux.intel.com commit ecf71fbccb9ac5cb964eb7de59bb9da3755b7885 Author: Kan Liang Date: Tue Jan 28 10:31:18 2020 -0800 perf/x86/cstate: Add Tremont support Tremont is Intel's successor to Goldmont Plus. From the perspective of Intel cstate residency counters, there is nothing changed compared with Goldmont Plus and Goldmont. Share glm_cstates with Goldmont Plus and Goldmont. Update the comments for Tremont. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Andi Kleen Link: https://lkml.kernel.org/r/1580236279-35492-2-git-send-email-kan.liang@linux.intel.com commit eda23b387f6c4bb2971ac7e874a09913f533b22c Author: Kan Liang Date: Tue Jan 28 10:31:17 2020 -0800 perf/x86/intel: Add Elkhart Lake support Elkhart Lake also uses Tremont CPU. From the perspective of Intel PMU, there is nothing changed compared with Jacobsville. Share the perf code with Jacobsville. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Andi Kleen Link: https://lkml.kernel.org/r/1580236279-35492-1-git-send-email-kan.liang@linux.intel.com commit e9f5490c3574b435ce7fe7a71724aa3866babc7f Author: Randy Dunlap Date: Sun Feb 9 19:29:12 2020 -0800 sched/fair: Fix kernel-doc warning in attach_entity_load_avg() Fix kernel-doc warning in kernel/sched/fair.c, caused by a recent function parameter removal: ../kernel/sched/fair.c:3526: warning: Excess function parameter 'flags' description in 'attach_entity_load_avg' Fixes: a4f9a0e51bbf ("sched/fair: Remove redundant call to cpufreq_update_util()") Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Vincent Guittot Link: https://lkml.kernel.org/r/cbe964e4-6879-fd08-41c9-ef1917414af4@infradead.org commit 4104a562e0ca62e971089db9d3c47794a0d7d4eb Author: Madhuparna Bhowmik Date: Sat Feb 1 18:28:03 2020 +0530 sched/core: Annotate curr pointer in rq with __rcu This patch fixes the following sparse warnings in sched/core.c and sched/membarrier.c: kernel/sched/core.c:2372:27: error: incompatible types in comparison expression kernel/sched/core.c:4061:17: error: incompatible types in comparison expression kernel/sched/core.c:6067:9: error: incompatible types in comparison expression kernel/sched/membarrier.c:108:21: error: incompatible types in comparison expression kernel/sched/membarrier.c:177:21: error: incompatible types in comparison expression kernel/sched/membarrier.c:243:21: error: incompatible types in comparison expression Signed-off-by: Madhuparna Bhowmik Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20200201125803.20245-1-madhuparnabhowmik10@gmail.com commit 6fcca0fa48118e6d63733eb4644c6cd880c15b8f Author: Suren Baghdasaryan Date: Mon Feb 3 13:22:16 2020 -0800 sched/psi: Fix OOB write when writing 0 bytes to PSI files Issuing write() with count parameter set to 0 on any file under /proc/pressure/ will cause an OOB write because of the access to buf[buf_size-1] when NUL-termination is performed. Fix this by checking for buf_size to be non-zero. Signed-off-by: Suren Baghdasaryan Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Johannes Weiner Link: https://lkml.kernel.org/r/20200203212216.7076-1-surenb@google.com commit 7a7a8f549ddd18126dfa3dedbe42d877614c7995 Author: Peter Zijlstra Date: Fri Feb 7 12:57:37 2020 +0100 arm/patch: Fix !MMU compile Now that patch.o is unconditionally selected for ftrace, it can also get compiled for !MMU kernels. These (obviously) lack {set,clear}_fixmap() support. Also remove the superfluous __acquire/__release nonsense. Fixes: 42e51f187f86 ("arm/ftrace: Use __patch_text()") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar commit be993e44badc448add6a18d6f12b20615692c4c3 Author: Peter Zijlstra Date: Fri Feb 7 12:57:36 2020 +0100 arm/ftrace: Fix BE text poking The __patch_text() function already applies __opcode_to_mem_*(), so when __opcode_to_mem_*() is not the identity (BE*), it is applied twice, wrecking the instruction. Fixes: 42e51f187f86 ("arm/ftrace: Use __patch_text()") Reported-by: Dmitry Osipenko Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Dmitry Osipenko commit 74f73476c3755664504b7d266b5e8f91050ffed9 Author: Takashi Iwai Date: Tue Feb 11 12:14:19 2020 +0100 ALSA: usb-audio: Apply 48kHz fixed rate playback for Jabra Evolve 65 headset Jabra Evolve 65 headset appears as if supporting lower rates than 48kHz, but it actually doesn't work but with 48kHz for playback. This patch applies a workaround to enforce the 48kHz like LINE6 devices already did. The workaround is put in a unified helper function, set_fixed_rate(), to be called from both places now. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206149 Link: https://lore.kernel.org/r/20200211111419.5895-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit bb89abe52bf426f1f40850c441efc77426cc31e1 Author: Florian Westphal Date: Mon Feb 3 17:37:06 2020 +0100 netfilter: conntrack: split resolve_clash function Followup patch will need a helper function with the 'clashing entries refer to the identical tuple in both directions' resolution logic. This patch will add another resolve_clash helper where loser_ct must not be added to the dying list because it will be inserted into the table. Therefore this also moves the stat counters and dying-list insertion of the losing ct. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b1b32552c1d81f0cf6a8e79043a2a47e769ff071 Author: Florian Westphal Date: Mon Feb 3 17:37:05 2020 +0100 netfilter: conntrack: place confirm-bit setting in a helper ... so it can be re-used from clash resolution in followup patch. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 3d1e0b406de16508de96f4a07fc3f94cfc678372 Author: Florian Westphal Date: Mon Feb 3 17:37:04 2020 +0100 netfilter: conntrack: remove two args from resolve_clash ctinfo is whats taken from the skb, i.e. ct = nf_ct_get(skb, &ctinfo). We do not pass 'ct' and instead re-fetch it from the skb. Just do the same for both netns and ctinfo. Also add a comment on what clash resolution is supposed to do. While at it, one indent level can be removed. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit e4edd4fcbf4daf9d4319bef0bfaf350cb672239a Author: Chris Wilson Date: Thu Jan 23 22:44:58 2020 +0000 drm/i915: Check activity on i915_vma after confirming pin_count==0 Only assert that the i915_vma is now idle if and only if no other pins are present. If another user has the i915_vma pinned, they may submit more work to the i915_vma skipping the vm->mutex used to serialise the unbind. We need to wait again, if we want to continue and unbind this vma. However, if we own the i915_vma (we hold the vm->mutex for the unbind and the pin_count is 0), we can assert that the vma remains idle as we unbind. Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") Closes: https://gitlab.freedesktop.org/drm/intel/issues/530 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200123224459.38128-1-chris@chris-wilson.co.uk (cherry picked from commit 60e94557fff1f5514c7fc4da7ddc2c7a13ffff26) Signed-off-by: Jani Nikula commit 051c89cf4ac487e795d87e6f3b9e0ff788da8fb4 Author: Chris Wilson Date: Thu Jan 23 12:59:34 2020 +0000 drm/i915/gem: Detect overflow in calculating dumb buffer size To multiply 2 u32 numbers to generate a u64 in C requires a bit of forewarning for the compiler. Signed-off-by: Chris Wilson Cc: Ramalingam C Cc: Joonas Lahtinen Cc: stable@vger.kernel.org Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20200123125934.1401755-1-chris@chris-wilson.co.uk (cherry picked from commit 0f8f8a64300092852b9361cd835395ee71e6a7d6) Signed-off-by: Jani Nikula commit 1a9629d189f57670afd31f1aea4e59b7270d2d89 Author: Chris Wilson Date: Tue Jan 21 13:21:07 2020 +0000 drm/i915: Don't show the blank process name for internal/simulated errors For a simulated preemption reset, we don't populate the request and so do not fill in the guilty context name. [ 79.991294] i915 0000:00:02.0: GPU HANG: ecode 9:1:e757fefe, in [0] Just don't mention the empty string in the logs! Fixes: 742379c0c400 ("drm/i915: Start chopping up the GPU error capture") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200121132107.267709-1-chris@chris-wilson.co.uk (cherry picked from commit 29baf3ae8daa4c673de58106ff41c7236dff57f4) Signed-off-by: Jani Nikula commit 07ccd6bdafa22aacc4f72b7eb14474d0b356e6c3 Author: Chris Wilson Date: Mon Jan 20 10:49:22 2020 +0000 drm/i915/gem: Store mmap_offsets in an rbtree rather than a plain list Currently we create a new mmap_offset for every call to mmap_offset_ioctl. This exposes ourselves to an abusive client that may simply create new mmap_offsets ad infinitum, which will exhaust physical memory and the virtual address space. In addition to the exhaustion, a very long linear list of mmap_offsets causes other clients using the object to incur long list walks -- these long lists can also be generated by simply having many clients generate their own mmap_offset. However, we can simply use the drm_vma_node itself to manage the file association (allow/revoke) dropping our need to keep an mmo per-file. Then if we keep a small rbtree of per-type mmap_offsets, we can lookup duplicate requests quickly. Fixes: cc662126b413 ("drm/i915: Introduce DRM_I915_GEM_MMAP_OFFSET") Signed-off-by: Chris Wilson Cc: Abdiel Janulgue Reviewed-by: Abdiel Janulgue Link: https://patchwork.freedesktop.org/patch/msgid/20200120104924.4000706-3-chris@chris-wilson.co.uk (cherry picked from commit 7865559872074a9ab169c87915504661d630addf) Signed-off-by: Jani Nikula commit a754012b9f2323a5d640da7eb7b095ac3b8cd012 Author: Chris Wilson Date: Wed Jan 15 17:58:29 2020 +0000 drm/i915/execlists: Leave resetting ring to intel_ring We need to allow concurrent intel_context_unpin, which means avoiding doing destructive operations like intel_ring_reset(). This was already fixed for intel_ring_unpin() in commit 0725d9a31869 ("drm/i915/gt: Make intel_ring_unpin() safe for concurrent pint"), but I overlooked that execlists_context_unpin() also made the same mistake. Reported-by: Matthew Brost Fixes: 841350223816 ("drm/i915/gt: Drop mutex serialisation between context pin/unpin") References: 0725d9a31869 ("drm/i915/gt: Make intel_ring_unpin() safe for concurrent pint") Signed-off-by: Chris Wilson Cc: Matthew Brost Cc: Matthew Auld Cc: Tvrtko Ursulin Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200115175829.2761329-1-chris@chris-wilson.co.uk (cherry picked from commit f3c0efc9fe7a4e61544034f525348a3aa86ac5aa) Signed-off-by: Jani Nikula commit 74a44bed8d93782affb707a33469bda7052b4207 Author: Robin Murphy Date: Mon Feb 10 19:21:01 2020 +0000 arm64: Fix CONFIG_ARCH_RANDOM=n build The entire asm/archrandom.h header is generically included via linux/archrandom.h only when CONFIG_ARCH_RANDOM is already set, so the stub definitions of __arm64_rndr() and __early_cpu_has_rndr() are only visible to KASLR if it explicitly includes the arch-internal header. Acked-by: Mark Brown Signed-off-by: Robin Murphy Signed-off-by: Will Deacon commit cf01514c5c6efa2d521d35e68dff2e0674d08e91 Author: Oded Gabbay Date: Thu Jan 23 00:43:06 2020 +0200 habanalabs: patched cb equals user cb in device memset During device memory memset, the driver allocates and use a CB (command buffer). To reuse existing code, it keeps a pointer to the CB in two variables, user_cb and patched_cb. Therefore, there is no need to "put" both the user_cb and patched_cb, as it will cause an underflow of the refcnt of the CB. Signed-off-by: Oded Gabbay commit a37e47192dfa98f79a0cd5ab991c224b5980c982 Author: Omer Shpigelman Date: Sun Jan 5 09:05:45 2020 +0000 habanalabs: do not halt CoreSight during hard reset During hard reset we must not write to the device. Hence avoid halting CoreSight during user context close if it is done during hard reset. In addition, we must not re-enable clock gating afterwards as it was deliberately disabled in the beginning of the hard reset flow. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 908087ffbe896c100ed73d5f0ce11a5b7264af4a Author: Oded Gabbay Date: Mon Dec 23 17:51:48 2019 +0200 habanalabs: halt the engines before hard-reset The driver must halt the engines before doing hard-reset, otherwise the device can go into undefined state. There is a place where the driver didn't do that and this patch fixes it. Reviewed-by: Tomer Tayar Signed-off-by: Oded Gabbay commit e3728b50cd9be7d4b1469447cdf1feb93e3b7adb Author: Rafael J. Wysocki Date: Tue Feb 11 10:11:02 2020 +0100 ACPI: PM: s2idle: Avoid possible race related to the EC GPE It is theoretically possible for the ACPI EC GPE to be set after the s2idle_ops->wake() called from s2idle_loop() has returned and before the subsequent pm_wakeup_pending() check is carried out. If that happens, the resulting wakeup event will cause the system to resume even though it may be a spurious one. To avoid that race, first make the ->wake() callback in struct platform_s2idle_ops return a bool value indicating whether or not to let the system resume and rearrange s2idle_loop() to use that value instad of the direct pm_wakeup_pending() call if ->wake() is present. Next, rework acpi_s2idle_wake() to process EC events and check pm_wakeup_pending() before re-arming the SCI for system wakeup to prevent it from triggering prematurely and add comments to that function to explain the rationale for the new code flow. Fixes: 56b991849009 ("PM: sleep: Simplify suspend-to-idle control flow") Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit f0ac20c3f6137910c8a927953e8a92f5b3716166 Author: Rafael J. Wysocki Date: Tue Feb 11 10:07:43 2020 +0100 ACPI: EC: Fix flushing of pending work Commit 016b87ca5c8c ("ACPI: EC: Rework flushing of pending work") introduced a subtle bug into the flushing of pending EC work while suspended to idle, which may cause the EC driver to fail to re-enable the EC GPE after handling a non-wakeup event (like a battery status change event, for example). The problem is that the work item flushed by flush_scheduled_work() in __acpi_ec_flush_work() may disable the EC GPE and schedule another work item expected to re-enable it, but that new work item is not flushed, so __acpi_ec_flush_work() returns with the EC GPE disabled and the CPU running it goes into an idle state subsequently. If all of the other CPUs are in idle states at that point, the EC GPE won't be re-enabled until at least one CPU is woken up by another interrupt source, so system wakeup events that would normally come from the EC then don't work. This is reproducible on a Dell XPS13 9360 in my office which sometimes stops reacting to power button and lid events (triggered by the EC on that machine) after switching from AC power to battery power or vice versa while suspended to idle (each of those switches causes the EC GPE to trigger for several times in a row, but they are not system wakeup events). To avoid this problem, it is necessary to drain the workqueue entirely in __acpi_ec_flush_work(), but that cannot be done with respect to system_wq, because work items may be added to it from other places while __acpi_ec_flush_work() is running. For this reason, make the EC driver use a dedicated workqueue for EC events processing (let that workqueue be ordered so that EC events are processed sequentially) and use drain_workqueue() on it in __acpi_ec_flush_work(). Fixes: 016b87ca5c8c ("ACPI: EC: Rework flushing of pending work") Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit 0cbb4f9c69827decf56519c2f63918f16904ede5 Author: Stephen Boyd Date: Mon Feb 3 09:46:19 2020 -0800 platform/chrome: wilco_ec: Include asm/unaligned instead of linux/ path It seems that we shouldn't try to include the include/linux/ path to unaligned functions. Just include asm/unaligned.h instead so that we don't run into compilation warnings like below. In file included from drivers/platform/chrome/wilco_ec/properties.c:8:0: include/linux/unaligned/le_memmove.h:7:19: error: redefinition of 'get_unaligned_le16' static inline u16 get_unaligned_le16(const void *p) ^~~~~~~~~~~~~~~~~~ In file included from arch/ia64/include/asm/unaligned.h:5:0, from arch/ia64/include/asm/io.h:23, from arch/ia64/include/asm/smp.h:21, from include/linux/smp.h:68, from include/linux/percpu.h:7, from include/linux/arch_topology.h:9, from include/linux/topology.h:30, from include/linux/gfp.h:9, from include/linux/xarray.h:14, from include/linux/radix-tree.h:18, from include/linux/idr.h:15, from include/linux/kernfs.h:13, from include/linux/sysfs.h:16, from include/linux/kobject.h:20, from include/linux/device.h:16, from include/linux/platform_data/wilco-ec.h:11, from drivers/platform/chrome/wilco_ec/properties.c:6: include/linux/unaligned/le_struct.h:7:19: note: previous definition of 'get_unaligned_le16' was here static inline u16 get_unaligned_le16(const void *p) ^~~~~~~~~~~~~~~~~~ Reported-by: kbuild test robot Fixes: 60fb8a8e93ca ("platform/chrome: wilco_ec: Allow wilco to be compiled in COMPILE_TEST") Signed-off-by: Stephen Boyd Signed-off-by: Enric Balletbo i Serra commit 42cd5ffe46c1037d5d9a253c72e71a024a7bfbef Author: Colin Ian King Date: Mon Feb 10 09:51:39 2020 +0000 usb: dwc3: debug: fix string position formatting mixup with ret and len Currently the string formatting is mixing up the offset of ret and len. Re-work the code to use just len, remove ret and use scnprintf instead of snprintf and len position accumulation where required. Remove the -ve return check since scnprintf never returns a failure -ve size. Also break overly long lines to clean up checkpatch warnings. Addresses-Coverity: ("Unused value") Fixes: 1381a5113caf ("usb: dwc3: debug: purge usage of strcat") Reviewed-by: Dan Carpenter Signed-off-by: Colin Ian King Signed-off-by: Felipe Balbi commit e4bfded56cf39b8d02733c1e6ef546b97961e18a Author: Sergey Organov Date: Wed Jan 29 14:21:46 2020 +0300 usb: gadget: serial: fix Tx stall after buffer overflow Symptom: application opens /dev/ttyGS0 and starts sending (writing) to it while either USB cable is not connected, or nobody listens on the other side of the cable. If driver circular buffer overflows before connection is established, no data will be written to the USB layer until/unless /dev/ttyGS0 is closed and re-opened again by the application (the latter besides having no means of being notified about the event of establishing of the connection.) Fix: on open and/or connect, kick Tx to flush circular buffer data to USB layer. Signed-off-by: Sergey Organov Reviewed-by: Michał Mirosław Signed-off-by: Felipe Balbi commit 43d565727a3a6fd24e37c7c2116475106af71806 Author: Lars-Peter Clausen Date: Thu Jan 16 15:29:01 2020 +0200 usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags ffs_aio_cancel() can be called from both interrupt and thread context. Make sure that the current IRQ state is saved and restored by using spin_{un,}lock_irq{save,restore}(). Otherwise undefined behavior might occur. Acked-by: Michal Nazarewicz Signed-off-by: Lars-Peter Clausen Signed-off-by: Alexandru Ardelean Signed-off-by: Felipe Balbi commit 9a0d6f7c0a83844baae1d6d85482863d2bf3b7a7 Author: Minas Harutyunyan Date: Tue Jan 21 14:17:07 2020 +0400 usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows SET/CLEAR_FEATURE for Remote Wakeup allowance not handled correctly. GET_STATUS handling provided not correct data on DATA Stage. Issue seen when gadget's dr_mode set to "otg" mode and connected to MacOS. Both are fixed and tested using USBCV Ch.9 tests. Signed-off-by: Minas Harutyunyan Fixes: fa389a6d7726 ("usb: dwc2: gadget: Add remote_wakeup_allowed flag") Tested-by: Jack Mitchell Cc: stable@vger.kernel.org Signed-off-by: Felipe Balbi commit 860ef6cd3f90b84a1832f8a6485c90c34d3b588b Author: Minas Harutyunyan Date: Tue Jan 21 14:24:04 2020 +0400 usb: dwc2: Fix in ISOC request length checking Moved ISOC request length checking from dwc2_hsotg_start_req() function to dwc2_hsotg_ep_queue(). Fixes: 4fca54aa58293 ("usb: gadget: s3c-hsotg: add multi count support") Signed-off-by: Minas Harutyunyan Signed-off-by: Felipe Balbi commit a2035411fa1d1206cea7d5dfe833e78481844a76 Author: Jack Pham Date: Thu Jan 30 19:10:36 2020 -0800 usb: gadget: composite: Support more than 500mA MaxPower USB 3.x SuperSpeed peripherals can draw up to 900mA of VBUS power when in configured state. However, if a configuration wanting to take advantage of this is added with MaxPower greater than 500 (currently possible if using a ConfigFS gadget) the composite driver fails to accommodate this for a couple reasons: - usb_gadget_vbus_draw() when called from set_config() and composite_resume() will be passed the MaxPower value without regard for the current connection speed, resulting in a violation for USB 2.0 since the max is 500mA. - the bMaxPower of the configuration descriptor would be incorrectly encoded, again if the connection speed is only at USB 2.0 or below, likely wrapping around U8_MAX since the 2mA multiplier corresponds to a maximum of 510mA. Fix these by adding checks against the current gadget->speed when the c->MaxPower value is used (set_config() and composite_resume()) and appropriately limit based on whether it is currently at a low-/full-/high- or super-speed connection. Because 900 is not divisible by 8, with the round-up division currently used in encode_bMaxPower() a MaxPower of 900mA will result in an encoded value of 0x71. When a host stack (including Linux and Windows) enumerates this on a single port root hub, it reads this value back and decodes (multiplies by 8) to get 904mA which is strictly greater than 900mA that is typically budgeted for that port, causing it to reject the configuration. Instead, we should be using the round-down behavior of normal integral division so that 900 / 8 -> 0x70 or 896mA to stay within range. And we might as well change it for the high/full/low case as well for consistency. N.B. USB 3.2 Gen N x 2 allows for up to 1500mA but there doesn't seem to be any any peripheral controller supported by Linux that does two lane operation, so for now keeping the clamp at 900 should be fine. Signed-off-by: Jack Pham Signed-off-by: Felipe Balbi commit c724417baf162bd3e035659e22cdf990cfb0d917 Author: Jack Pham Date: Thu Jan 30 19:10:35 2020 -0800 usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus SuperSpeedPlus peripherals must report their bMaxPower of the configuration descriptor in units of 8mA as per the USB 3.2 specification. The current switch statement in encode_bMaxPower() only checks for USB_SPEED_SUPER but not USB_SPEED_SUPER_PLUS so the latter falls back to USB 2.0 encoding which uses 2mA units. Replace the switch with a simple if/else. Fixes: eae5820b852f ("usb: gadget: composite: Write SuperSpeedPlus config descriptors") Signed-off-by: Jack Pham Signed-off-by: Felipe Balbi commit 904967c60d87393a3708fed2324b684cdb79b1ee Author: John Keeping Date: Fri Jan 17 10:40:22 2020 +0000 usb: gadget: u_audio: Fix high-speed max packet size Prior to commit eb9fecb9e69b ("usb: gadget: f_uac2: split out audio core") the maximum packet size was calculated only from the high-speed descriptor but now we use the largest of the full-speed and high-speed descriptors. This is correct, but the full-speed value is likely to be higher than that for high-speed and this leads to submitting requests for OUT transfers (received by the gadget) which are larger than the endpoint's maximum packet size. These are rightly rejected by the gadget core. config_ep_by_speed() already sets up the correct maximum packet size for the enumerated speed in the usb_ep structure, so we can simply use this instead of the overall value that has been used to allocate buffers for requests. Note that the minimum period for ALSA is still set from the largest value, and this is unavoidable because it's possible to open the audio device before the gadget has been enumerated. Tested-by: Pavel Hofman Signed-off-by: John Keeping Signed-off-by: Felipe Balbi commit 5ee858975b13a9b40db00f456989a689fdbb296c Author: Anurag Kumar Vulisha Date: Mon Jan 27 19:30:46 2020 +0000 usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields The current code in dwc3_gadget_ep_reclaim_completed_trb() will check for IOC/LST bit in the event->status and returns if IOC/LST bit is set. This logic doesn't work if multiple TRBs are queued per request and the IOC/LST bit is set on the last TRB of that request. Consider an example where a queued request has multiple queued TRBs and IOC/LST bit is set only for the last TRB. In this case, the core generates XferComplete/XferInProgress events only for the last TRB (since IOC/LST are set only for the last TRB). As per the logic in dwc3_gadget_ep_reclaim_completed_trb() event->status is checked for IOC/LST bit and returns on the first TRB. This leaves the remaining TRBs left unhandled. Similarly, if the gadget function enqueues an unaligned request with sglist already in it, it should fail the same way, since we will append another TRB to something that already uses more than one TRB. To aviod this, this patch changes the code to check for IOC/LST bits in TRB->ctrl instead. At a practical level, this patch resolves USB transfer stalls seen with adb on dwc3 based HiKey960 after functionfs gadget added scatter-gather support around v4.20. Cc: Felipe Balbi Cc: Yang Fei Cc: Thinh Nguyen Cc: Tejas Joglekar Cc: Andrzej Pietrasiewicz Cc: Jack Pham Cc: Todd Kjos Cc: Greg KH Cc: Linux USB List Cc: stable Tested-by: Tejas Joglekar Reviewed-by: Thinh Nguyen Signed-off-by: Anurag Kumar Vulisha [jstultz: forward ported to mainline, reworded commit log, reworked to only check trb->ctrl as suggested by Felipe] Signed-off-by: John Stultz Signed-off-by: Felipe Balbi commit 7276531d4036f5db2af15c8b6caa02e7741f5d80 Author: Tom Zanussi Date: Mon Feb 10 17:06:50 2020 -0600 tracing: Consolidate trace() functions Move the checking, buffer reserve and buffer commit code in synth_event_trace_start/end() into inline functions __synth_event_trace_start/end() so they can also be used by synth_event_trace() and synth_event_trace_array(), and then have all those functions use them. Also, change synth_event_trace_state.enabled to disabled so it only needs to be set if the event is disabled, which is not normally the case. Link: http://lkml.kernel.org/r/b1f3108d0f450e58192955a300e31d0405ab4149.1581374549.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 0c62f6cd9ed320cb0ca39e33addf3a3da51b7328 Author: Tom Zanussi Date: Mon Feb 10 17:06:49 2020 -0600 tracing: Don't return -EINVAL when tracing soft disabled synth events There's no reason to return -EINVAL when tracing a synthetic event if it's soft disabled - treat it the same as if it were hard disabled and return normally. Have synth_event_trace() and synth_event_trace_array() just return normally, and have synth_event_trace_start set the trace state to disabled and return. Link: http://lkml.kernel.org/r/df5d02a1625aff97c9866506c5bada6a069982ba.1581374549.git.zanussi@kernel.org Fixes: 8dcc53ad956d2 ("tracing: Add synth_event_trace() and related functions") Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit d090409abbdd1fcbdfd6ed66612390ba8c814749 Author: Tom Zanussi Date: Mon Feb 10 17:06:48 2020 -0600 tracing: Add missing nest end to synth_event_trace_start() error case If the ring_buffer reserve in synth_event_trace_start() fails, the matching ring_buffer_nest_end() should be called in the error code, since nothing else will ever call it in this case. Link: http://lkml.kernel.org/r/20abc444b3eeff76425f895815380abe7aa53ff8.1581374549.git.zanussi@kernel.org Fixes: 8dcc53ad956d2 ("tracing: Add synth_event_trace() and related functions") Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 26d696192aa5f4fe9119d6d23f90ed535053abca Author: Sean Paul Date: Thu Jan 30 14:24:55 2020 -0500 drm/mediatek: Ensure the cursor plane is on top of other overlays Currently the cursor is placed on the first overlay plane, which means it will be at the bottom of the stack when the hw does the compositing with anything other than primary plane. Since mtk doesn't support plane zpos, change the cursor location to the top-most plane. Signed-off-by: Sean Paul Signed-off-by: CK Hu commit 318caac7c81cdf5806df30c3d72385659a5f0f53 Author: Evan Benn Date: Fri Feb 7 15:23:51 2020 +1100 drm/mediatek: Find the cursor plane instead of hard coding it The cursor and primary planes were hard coded. Now search for them for passing to drm_crtc_init_with_planes Signed-off-by: Evan Benn Reviewed-by: Sean Paul Signed-off-by: CK Hu commit 0a679e13ea30f85a1aef0669ee0c5a9fd7860b34 Merge: a5650acb5f33 0cd9d33ace33 Author: Linus Torvalds Date: Mon Feb 10 17:07:05 2020 -0800 Merge branch 'for-5.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: "I made a mistake while removing cgroup task list lazy init optimization making the root cgroup.procs show entries for the init_tasks. The zero entries doesn't cause critical failures but does make systemd print out warning messages during boot. Fix it by omitting init_tasks as they should be" * 'for-5.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: init_tasks shouldn't be linked to the root cgroup commit c363eb48ada5cf732b3f489fab799fc881097842 Author: Jiri Benc Date: Thu Feb 6 09:40:52 2020 +0100 selftests: fix too long argument With some shells, the command construed for install of bpf selftests becomes too large due to long list of files: make[1]: execvp: /bin/sh: Argument list too long make[1]: *** [../lib.mk:73: install] Error 127 Currently, each of the file lists is replicated three times in the command: in the shell 'if' condition, in the 'echo' and in the 'rsync'. Reduce that by one instance by using make conditionals and separate the echo and rsync into two shell commands. (One would be inclined to just remove the '@' at the beginning of the rsync command and let 'make' echo it by itself; unfortunately, it appears that the '@' in the front of mkdir silences output also for the following commands.) Also, separate handling of each of the lists to its own shell command. The semantics of the makefile is unchanged before and after the patch. The ability of individual test directories to override INSTALL_RULE is retained. Reported-by: Yauheni Kaliuta Tested-by: Yauheni Kaliuta Signed-off-by: Jiri Benc Signed-off-by: Shuah Khan commit 9d235a558c689b0ecdd23bbd8beb2e0584f619ed Author: Jiri Benc Date: Thu Feb 6 09:40:00 2020 +0100 selftests: allow detection of build failures Commit 5f70bde26a48 ("selftests: fix build behaviour on targets' failures") added a logic to track failure of builds of individual targets. However, it does exactly the opposite of what a distro kernel needs: we create a RPM package with a selected set of selftests and we need the build to fail if build of any of the targets fail. Both use cases are valid. A distribution kernel is in control of what is included in the kernel and what is being built; any error needs to be flagged and acted upon. A CI system that tries to build as many tests as possible on the best effort basis is not really interested in a failure here and there. Support both use cases by introducing a FORCE_TARGETS variable. It is switched off by default to make life for CI systems easier, distributions can easily switch it on while building their packages. Reported-by: Yauheni Kaliuta Signed-off-by: Jiri Benc Reviewed-by: Cristian Marussi Tested-by: Cristian Marussi Signed-off-by: Shuah Khan commit b32694cd0724d4ceca2c62cc7c3d3a8d1ffa11fc Author: Nikita Sobolev Date: Fri Jan 31 18:25:23 2020 +0300 Kernel selftests: tpm2: check for tpm support tpm2 tests set fails if there is no /dev/tpm0 and /dev/tpmrm0 supported. Check if these files exist before run and mark test as skipped in case of absence. Signed-off-by: Nikita Sobolev Signed-off-by: Shuah Khan commit a098d9c82a0bb2f91e5cf6c780859bc00c15e1e4 Author: Steven Rostedt (VMware) Date: Thu Jan 30 21:45:27 2020 -0500 selftests/ftrace: Have pid filter test use instance flag While running the ftracetests, the pid filter test failed because the instance "foo" existed, and it was using it to rerun the test under a instance named foo. The collision caused the test to fail as the mkdir failed as the name already existed. As of commit b5b77be812de7 ("selftests: ftrace: Allow some tests to be run in a tracing instance") all a selftest needs to do to be tested in an instance is to set the "instance" flag. There's no reason a selftest needs to create an instance to run its test in an instance directly. Remove the open coded testing in an instance for the pid filter test and have it set the "instance" flag instead. Signed-off-by: Steven Rostedt (VMware) Acked-by: Masami Hiramatsu Signed-off-by: Shuah Khan commit 7714d469dcba572bbfb9cc47217fed7e7ddeb051 Author: Colin Ian King Date: Thu Jan 16 09:29:03 2020 +0000 selftests: fix spelling mistaked "chaigned" -> "chained" There is a spelling mistake in a literal string, fix it. Signed-off-by: Colin Ian King Reviewed-by: Aleksa Sarai Signed-off-by: Shuah Khan commit a5650acb5f33d8c7c26941136b2d3c46b8a243ea Merge: bb6d3fb354c5 39a706fbcf26 Author: Linus Torvalds Date: Mon Feb 10 16:51:35 2020 -0800 Merge tag 'selinux-pr-20200210' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux fixes from Paul Moore: "Two small fixes: one fixes a locking problem in the recently merged label translation code, the other fixes an embarrassing 'binderfs' / 'binder' filesystem name check" * tag 'selinux-pr-20200210' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix sidtab string cache locking selinux: fix typo in filesystem name commit e20d8e81a0e06c672e964c9f01100f07a64b1ce6 Author: Brendan Higgins Date: Fri Jan 31 16:01:02 2020 -0800 Documentation: kunit: fixed sphinx error in code block Fix a missing newline in a code block that was causing a warning: Documentation/dev-tools/kunit/usage.rst:553: WARNING: Error in "code-block" directive: maximum 1 argument(s) allowed, 3 supplied. .. code-block:: bash modprobe example-test Signed-off-by: Brendan Higgins Reviewed-by: Alan Maguire Signed-off-by: Shuah Khan commit 95ba79e89c107851bad4492ca23e9b9c399b8592 Author: Bartosz Golaszewski Date: Thu Jan 30 14:55:15 2020 +0100 MAINTAINERS: remove unnecessary ':' characters Commit e567cb3fef30 ("MAINTAINERS: add an entry for kfifo") added a new entry to MAINTAINERS. Following the example of the previous entry on the list I added a trailing ':' character at the end of the title line. This however results in rather strange looking output from scripts/get_maintainer.pl: $ ./scripts/get_maintainer.pl ./0001-kfifo.patch Stefani Seibold (maintainer:KFIFO:) linux-kernel@vger.kernel.org (open list) It turns out there are more entries like this. Fix the entire file by removing all trailing colons. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20200130135515.30359-1-brgl@bgdev.pl Signed-off-by: Greg Kroah-Hartman commit 2bf0eb9b3b0d099b20b2c4736436b666d78b94d5 Author: Hongbo Yao Date: Mon Feb 10 09:14:41 2020 +0800 bpf: Make btf_check_func_type_match() static Fix the following sparse warning: kernel/bpf/btf.c:4131:5: warning: symbol 'btf_check_func_type_match' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: Hongbo Yao Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200210011441.147102-1-yaohongbo@huawei.com commit f2e97dc126b712c0d21219ed0c42710006c1cf52 Author: John Fastabend Date: Sun Feb 9 21:44:37 2020 -0800 bpf: Selftests build error in sockmap_basic.c Fix following build error. We could push a tcp.h header into one of the include paths, but I think its easy enough to simply pull in the three defines we need here. If we end up using more of tcp.h at some point we can pull it in later. /home/john/git/bpf/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c: In function ‘connected_socket_v4’: /home/john/git/bpf/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c:20:11: error: ‘TCP_REPAIR_ON’ undeclared (first use in this function) repair = TCP_REPAIR_ON; ^ /home/john/git/bpf/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c:20:11: note: each undeclared identifier is reported only once for each function it appears in /home/john/git/bpf/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c:29:11: error: ‘TCP_REPAIR_OFF_NO_WP’ undeclared (first use in this function) repair = TCP_REPAIR_OFF_NO_WP; Then with fix, $ ./test_progs -n 44 #44/1 sockmap create_update_free:OK #44/2 sockhash create_update_free:OK #44 sockmap_basic:OK Fixes: 5d3919a953c3c ("selftests/bpf: Test freeing sockmap/sockhash with a socket in it") Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/158131347731.21414.12120493483848386652.stgit@john-Precision-5820-Tower commit 973780011106c534d69c4d25fe0749bd3a5f0b53 Author: Masami Hiramatsu Date: Sun Feb 9 22:05:13 2020 +0900 tools/bootconfig: Suppress non-error messages Suppress non-error messages when applying new bootconfig to initrd image. To enable it, replace printf for error message with pr_err() macro. This also adds a testcase for this fix. Link: http://lkml.kernel.org/r/158125351377.16911.13283712972275131160.stgit@devnote2 Reported-by: Michael Ellerman Tested-by: Michael Ellerman Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit a91e4f12ffc42fa019b5a66eaa8702f5e0f08a6a Author: Masami Hiramatsu Date: Fri Feb 7 23:28:17 2020 +0900 bootconfig: Allocate xbc_nodes array dynamically To reduce the large static array from kernel data, allocate xbc_nodes array dynamically only if the kernel loads a bootconfig. Note that this also add dummy memblock.h for user-spacae bootconfig tool. Link: http://lkml.kernel.org/r/158108569699.3187.6512834527603883707.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 3f4ef485be9d54040b695f32ec76d0f1ea50bbf3 Author: Nicolas Pitre Date: Tue Jan 28 12:50:33 2020 -0500 vt: fix scrollback flushing on background consoles Commit a6dbe4427559 ("vt: perform safe console erase in the right order") provided fixes to an earlier commit by gathering all console scrollback flushing operations in a function of its own. This includes the invocation of vc_sw->con_switch() as previously done through a update_screen() call. That commit failed to carry over the con_is_visible() conditional though, as well as cursor handling, which caused problems when "\e[3J" was written to a background console. One could argue for preserving the call to update_screen(). However this does far more than we need, and it is best to remove scrollback assumptions from it. Instead let's gather the minimum needed to actually perform scrollback flushing properly in that one place. While at it, let's document the vc_sw->con_switch() side effect being relied upon. Signed-off-by: Nicolas Pitre Reported-and-tested-by: Lukas Wunner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2001281205560.1655@knanqh.ubzr Signed-off-by: Greg Kroah-Hartman commit ea3d147a474cb522bfdfe68f1f2557750dcf41dd Author: Brendan Higgins Date: Fri Jan 31 14:18:32 2020 +1030 fsi: aspeed: add unspecified HAS_IOMEM dependency Currently CONFIG_FSI_MASTER_ASPEED=y implicitly depends on CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get the following build error: ld: drivers/fsi/fsi-master-aspeed.o: in function `fsi_master_aspeed_probe': drivers/fsi/fsi-master-aspeed.c:436: undefined reference to `devm_ioremap_resource' Fix the build error by adding the unspecified dependency. Fixes: 606397d67f41 ("fsi: Add ast2600 master driver") Cc: stable@vger.kernel.org Reported-by: Brendan Higgins Signed-off-by: Brendan Higgins Reviewed-by: Joel Stanley Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20200131034832.294268-1-joel@jms.id.au Signed-off-by: Greg Kroah-Hartman commit 74835c7db0322b6eddf091b8b062f127b8999a0a Author: Greg Kroah-Hartman Date: Thu Feb 6 16:48:00 2020 +0100 COPYING: state that all contributions really are covered by this file Explicitly state that all contributions to the kernel source tree really are covered under this COPYING file in case someone thought otherwise. Lawyers love to be pedantic, even more so than software engineers at times, and this sentence makes them sleep easier. Reviewed-by: Thomas Gleixner Acked-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200206154800.GA3754085@kroah.com Signed-off-by: Greg Kroah-Hartman commit 4bc4f8128c48511b93e7285979a46cf0682cbb2f Author: James Morris Date: Thu Feb 6 10:08:34 2020 +1100 Documentation/process: Change Microsoft contact for embargoed hardware issues Update Microsoft contact from Sasha to James. Cc: Sasha Levin Signed-off-by: James Morris Link: https://lore.kernel.org/r/alpine.LRH.2.21.2002061006350.22130@namei.org Signed-off-by: Greg Kroah-Hartman commit 485d5b75980dd6c62e02522a9e8c09b5d5529e76 Author: Greg Kroah-Hartman Date: Wed Feb 5 12:25:51 2020 +0000 embargoed-hardware-issues: drop Amazon contact as the email address now bounces Peter's email address bounces, so remove him as the contact for Amazon. Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20200205122551.GA1185549@kroah.com Signed-off-by: Greg Kroah-Hartman commit ae7fce069bd7c8a54d920692f93f1d4eff2bff04 Author: Grant Likely Date: Wed Feb 5 00:16:27 2020 +0000 Documentation/process: Add Arm contact for embargoed HW issues Adding myself to list after getting voluntold Cc: Catalin Marinas Signed-off-by: Grant Likely Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20200205001627.27356-1-grant.likely@arm.com Signed-off-by: Greg Kroah-Hartman commit ae91c92565494a37c30ce9a691c87890f800d826 Author: Greg Kroah-Hartman Date: Fri Nov 22 11:44:53 2019 +0100 debugfs: remove return value of debugfs_create_regset32() No one checks the return value of debugfs_create_regset32(), as it's not needed, so make the return value void, so that no one tries to do so in the future. Link: https://lore.kernel.org/r/20191122104453.GA2017837@kroah.com Signed-off-by: Greg Kroah-Hartman commit 1f69a1273b3f204a9c00dc3bbdcc4afcd0787428 Author: Dmitry Osipenko Date: Sun Feb 9 19:44:15 2020 +0300 tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started It is possible to get an instant RX timeout or end-of-transfer interrupt before RX DMA was started, if transaction is less than 16 bytes. Transfer should be handled in PIO mode in this case because DMA can't handle it. This patch brings back the original behaviour of the driver that was changed by accident by a previous commit, it fixes occasional Bluetooth HW initialization failures which I started to notice recently. Fixes: d5e3fadb7012 ("tty: serial: tegra: Activate RX DMA transfer by request") Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20200209164415.9632-1-digetx@gmail.com Signed-off-by: Greg Kroah-Hartman commit 04b5bfe3dc94e64d0590c54045815cb5183fb095 Author: Nicolas Ferre Date: Mon Feb 10 16:20:53 2020 +0100 tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode In atmel_shutdown() we call atmel_stop_rx() and atmel_stop_tx() functions. Prevent the rx restart that is implemented in RS485 or ISO7816 modes when calling atmel_stop_tx() by using the atomic information tasklet_shutdown that is already in place for this purpose. Fixes: 98f2082c3ac4 ("tty/serial: atmel: enforce tasklet init and termination sequences") Signed-off-by: Nicolas Ferre Cc: stable Link: https://lore.kernel.org/r/20200210152053.8289-1-nicolas.ferre@microchip.com Signed-off-by: Greg Kroah-Hartman commit 0c5aae59270fb1f827acce182786094c9ccf598e Author: Johan Hovold Date: Mon Feb 10 15:57:30 2020 +0100 serdev: ttyport: restore client ops on deregistration The serdev tty-port controller driver should reset the tty-port client operations also on deregistration to avoid a NULL-pointer dereference in case the port is later re-registered as a normal tty device. Note that this can only happen with tty drivers such as 8250 which have statically allocated port structures that can end up being reused and where a later registration would not register a serdev controller (e.g. due to registration errors or if the devicetree has been changed in between). Specifically, this can be an issue for any statically defined ports that would be registered by 8250 core when an 8250 driver is being unbound. Fixes: bed35c6dfa6a ("serdev: add a tty port controller driver") Cc: stable # 4.11 Reported-by: Loic Poulain Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200210145730.22762-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 87c5cbf71ecbb9e289d60a2df22eb686c70bf196 Author: Daniel Golle Date: Fri Feb 7 11:53:35 2020 +0200 serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE On AR934x this UART is usually not initialized by the bootloader as it is only used as a secondary serial port while the primary UART is a newly introduced NS16550-compatible. In order to make use of the ar933x-uart on AR934x without RTS/CTS hardware flow control, one needs to set the UART_CS_{RX,TX}_READY_ORIDE bits as other than on AR933x where this UART is used as primary/console, the bootloader on AR934x typically doesn't set those bits. Setting them explicitely on AR933x should not do any harm, so just set them unconditionally. Tested-by: Chuanhong Guo Signed-off-by: Daniel Golle Link: https://lore.kernel.org/r/20200207095335.GA179836@makrotopia.org Signed-off-by: Greg Kroah-Hartman commit 083bc0e1ce91e2a65a1aecdf8d2c5045e5d46c55 Author: Masahiro Yamada Date: Tue Feb 11 05:06:34 2020 +0900 kbuild: fix mismatch between .version and include/generated/compile.h Since commit 56d589361572 ("kbuild: do not create orphan built-in.a or obj-y objects"), scripts/link-vmlinux.sh does nothing when descending into init/. Once the version number becomes out of sync between .version and include/generated/compile.h, it is not self-healing. [How to reproduce] $ echo 100 > .version $ make You will see the number in the .version is always bigger than that in compile.h by one. After this, every time you run 'make', the vmlinux is re-linked even when none of source files is updated. Fixes: 56d589361572 ("kbuild: do not create orphan built-in.a or obj-y objects") Signed-off-by: Masahiro Yamada commit 9d1b38958b077f6c8d4bd196a115b643d7bd6717 Author: Masahiro Yamada Date: Tue Feb 11 01:18:52 2020 +0900 scripts/kallsyms: fix memory corruption caused by write over-run memcpy() writes one more byte than allocated. Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)") Reported-by: youling257 Reported-by: Pavel Machek Signed-off-by: Masahiro Yamada Tested-by: Pavel Machek commit bc5f15be2c814ca1ff6bb4e62d5b275a8c88cbb1 Author: Kim Phillips Date: Mon Feb 10 10:31:47 2020 -0600 perf symbols: Convert symbol__is_idle() to use strlist Use the more optimized strlist implementation to do the idle function lookup. Signed-off-by: Kim Phillips Acked-by: Song Liu Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Cong Wang Cc: Davidlohr Bueso Cc: Jin Yao Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200210163147.25358-1-kim.phillips@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 0e71459afcbbf69e92a65085c45515d3f3f02c31 Author: Kim Phillips Date: Fri Feb 7 17:06:12 2020 -0600 perf symbols: Update the list of kernel idle symbols The "acpi_idle_do_entry", "acpi_processor_ffh_cstate_enter", and "idle_cpu" symbols appear in 'perf top' output, at least on AMD systems. Add them to perf's idle_symbols list, so they don't dominate 'perf top' output. Signed-off-by: Kim Phillips Acked-by: Jiri Olsa Acked-by: Song Liu Cc: Alexander Shishkin Cc: Andi Kleen Cc: Cong Wang Cc: Davidlohr Bueso Cc: Jin Yao Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200207230613.26709-2-kim.phillips@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 80cc7bb6c104d733bff60ddda09f19139c61507c Author: Kim Phillips Date: Fri Feb 7 17:06:11 2020 -0600 perf stat: Don't report a null stalled cycles per insn metric For data collected on machines with front end stalled cycles supported, such as found on modern AMD CPU families, commit 146540fb545b ("perf stat: Always separate stalled cycles per insn") introduces a new line in CSV output with a leading comma that upsets some automated scripts. Scripts have to use "-e ex_ret_instr" to work around this issue, after upgrading to a version of perf with that commit. We could add "if (have_frontend_stalled && !config->csv_sep)" to the not (total && avg) else clause, to emphasize that CSV users are usually scripts, and are written to do only what is needed, i.e., they wouldn't typically invoke "perf stat" without specifying an explicit event list. But - let alone CSV output - why should users now tolerate a constant 0-reporting extra line in regular terminal output?: BEFORE: $ sudo perf stat --all-cpus -einstructions,cycles -- sleep 1 Performance counter stats for 'system wide': 181,110,981 instructions # 0.58 insn per cycle # 0.00 stalled cycles per insn 309,876,469 cycles 1.002202582 seconds time elapsed The user would not like to see the now permanent: "0.00 stalled cycles per insn" line fixture, as it gives no useful information. So this patch removes the printing of the zeroed stalled cycles line altogether, almost reverting the very original commit fb4605ba47e7 ("perf stat: Check for frontend stalled for metrics"), which seems like it was written to normalize --metric-only column output of common Intel machines at the time: modern Intel machines have ceased to support the genericised frontend stalled metrics AFAICT. AFTER: $ sudo perf stat --all-cpus -einstructions,cycles -- sleep 1 Performance counter stats for 'system wide': 244,071,432 instructions # 0.69 insn per cycle 355,353,490 cycles 1.001862516 seconds time elapsed Output behaviour when stalled cycles is indeed measured is not affected (BEFORE == AFTER): $ sudo perf stat --all-cpus -einstructions,cycles,stalled-cycles-frontend -- sleep 1 Performance counter stats for 'system wide': 247,227,799 instructions # 0.63 insn per cycle # 0.26 stalled cycles per insn 394,745,636 cycles 63,194,485 stalled-cycles-frontend # 16.01% frontend cycles idle 1.002079770 seconds time elapsed Fixes: 146540fb545b ("perf stat: Always separate stalled cycles per insn") Signed-off-by: Kim Phillips Acked-by: Andi Kleen Acked-by: Jiri Olsa Acked-by: Song Liu Cc: Alexander Shishkin Cc: Cong Wang Cc: Davidlohr Bueso Cc: Jin Yao Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200207230613.26709-1-kim.phillips@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 7f1b92a6a7f2b96a8647a488370b9a851433df77 Author: Johan Hovold Date: Mon Feb 3 16:38:30 2020 +0100 USB: core: clean up endpoint-descriptor parsing Use the new usb-device pointer instead of back-casting when accessing the struct usb_device when parsing endpoints. Note that this introduces two lines that are longer than 80 chars on purpose. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200203153830.26394-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit bdd1b147b8026df0e4260b387026b251d888ed01 Author: Johan Hovold Date: Mon Feb 3 16:38:29 2020 +0100 USB: quirks: blacklist duplicate ep on Sound Devices USBPre2 This device has a broken vendor-specific altsetting for interface 1, where endpoint 0x85 is declared as an isochronous endpoint despite being used by interface 2 for audio capture. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x0926 idProduct 0x0202 bcdDevice 1.00 iManufacturer 1 Sound Devices iProduct 2 USBPre2 iSerial 3 [...] bNumConfigurations 1 [...] Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 3 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x0126 1x 294 bytes bInterval 1 [...] Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 4 bDelay 1 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 26 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 2 bBitResolution 16 bSamFreqType 6 Discrete tSamFreq[ 0] 8000 tSamFreq[ 1] 16000 tSamFreq[ 2] 24000 tSamFreq[ 3] 32000 tSamFreq[ 4] 44100 tSamFreq[ 5] 48000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x0126 1x 294 bytes bInterval 4 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 2 Decoded PCM samples wLockDelay 0x0000 Since commit 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints") USB core ignores any duplicate endpoints found during descriptor parsing, but in this case we need to ignore the first instance in order to avoid breaking the audio capture interface. Fixes: 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints") Cc: stable Reported-by: edes Tested-by: edes Link: https://lore.kernel.org/r/20200201105829.5682c887@acme7.acmenet Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200203153830.26394-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 73f8bda9b5dc1c69df2bc55c0cbb24461a6391a9 Author: Johan Hovold Date: Mon Feb 3 16:38:28 2020 +0100 USB: core: add endpoint-blacklist quirk Add a new device quirk that can be used to blacklist endpoints. Since commit 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints") USB core ignores any duplicate endpoints found during descriptor parsing. In order to handle devices where the first interfaces with duplicate endpoints are the ones that should have their endpoints ignored, we need to add a blacklist. Tested-by: edes Cc: stable Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200203153830.26394-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit b32196e35bd7bbc8038db1aba1fbf022dc469b6a Author: Colin Ian King Date: Mon Feb 10 09:51:39 2020 +0000 usb: dwc3: debug: fix string position formatting mixup with ret and len Currently the string formatting is mixing up the offset of ret and len. Re-work the code to use just len, remove ret and use scnprintf instead of snprintf and len position accumulation where required. Remove the -ve return check since scnprintf never returns a failure -ve size. Also break overly long lines to clean up checkpatch warnings. Addresses-Coverity: ("Unused value") Fixes: 1381a5113caf ("usb: dwc3: debug: purge usage of strcat") Signed-off-by: Colin Ian King Reviewed-by: Dan Carpenter Cc: stable Link: https://lore.kernel.org/r/20200210095139.328711-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit a4a601948fc8d0a9661b83df03f5ee11e903efe6 Author: Dmitry Osipenko Date: Mon Feb 3 01:42:59 2020 +0300 usb: phy: tegra: Add clarifying comments about the shared registers Tools like Coccinelle may erroneously recommend to use the devm_platform_ioremap_resource() API for the registers mapping because these tools are not aware about the implementation details of the driver. Let's add a clarifying comments to the code, which should help to stop future attempts to break the driver. Signed-off-by: Dmitry Osipenko Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20200202224259.29187-1-digetx@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8099f58f1ecddf4f374f4828a3dff8397c7cbd74 Author: Alan Stern Date: Fri Jan 31 10:39:26 2020 -0500 USB: hub: Don't record a connect-change event during reset-resume Paul Zimmerman reports that his USB Bluetooth adapter sometimes crashes following system resume, when it receives a Get-Device-Descriptor request while it is busy doing something else. Such a request was added by commit a4f55d8b8c14 ("usb: hub: Check device descriptor before resusciation"). It gets sent when the hub driver's work thread checks whether a connect-change event on an enabled port really indicates a new device has been connected, as opposed to an old device momentarily disconnecting and then reconnecting (which can happen with xHCI host controllers, since they automatically enable connected ports). The same kind of thing occurs when a port's power session is lost during system suspend. When the system wakes up it sees a connect-change event on the port, and if the child device's persist_enabled flag was set then hub_activate() sets the device's reset_resume flag as well as the port's bit in hub->change_bits. The reset-resume code then takes responsibility for checking that the same device is still attached to the port, and it does this as part of the device's resume pathway. By the time the hub driver's work thread starts up again, the device has already been fully reinitialized and is busy doing its own thing. There's no need for the work thread to do the same check a second time, and in fact this unnecessary check is what caused the problem that Paul observed. Note that performing the unnecessary check is not actually a bug. Devices are supposed to be able to send descriptors back to the host even when they are busy doing something else. The underlying cause of Paul's problem lies in his Bluetooth adapter. Nevertheless, we shouldn't perform the same check twice in a row -- and as a nice side benefit, removing the extra check allows the Bluetooth adapter to work more reliably. The work thread performs its check when it sees that the port's bit is set in hub->change_bits. In this situation that bit is interpreted as though a connect-change event had occurred on the port _after_ the reset-resume, which is not what actually happened. One possible fix would be to make the reset-resume code clear the port's bit in hub->change_bits. But it seems simpler to just avoid setting the bit during hub_activate() in the first place. That's what this patch does. (Proving that the patch is correct when CONFIG_PM is disabled requires a little thought. In that setting hub_activate() will be called only for initialization and resets, since there won't be any resumes or reset-resumes. During initialization and hub resets the hub doesn't have any child devices, and so this code path never gets executed.) Reported-and-tested-by: Paul Zimmerman Signed-off-by: Alan Stern Link: https://marc.info/?t=157949360700001&r=1&w=2 CC: David Heinzelmann CC: Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2001311037460.1577-100000@iolanthe.rowland.org Signed-off-by: Greg Kroah-Hartman commit ca4b43c14cd88d28cfc6467d2fa075aad6818f1d Author: Peter Chen Date: Sat Feb 1 14:13:44 2020 +0800 usb: charger: assign specific number for enum value To work properly on every architectures and compilers, the enum value needs to be specific numbers. Suggested-by: Greg KH Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/1580537624-10179-1-git-send-email-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit 3e99862c05a9caa5a27969f41566b428696f5a9a Author: EJ Hsu Date: Thu Jan 30 01:25:06 2020 -0800 usb: uas: fix a plug & unplug racing When a uas disk is plugged into an external hub, uas_probe() will be called by the hub thread to do the probe. It will first create a SCSI host and then do the scan for this host. During the scan, it will probe the LUN using SCSI INQUERY command which will be packed in the URB and submitted to uas disk. There might be a chance that this external hub with uas disk attached is unplugged during the scan. In this case, uas driver will fail to submit the URB (due to the NOTATTACHED state of uas device) and try to put this SCSI command back to request queue waiting for next chance to run. In normal case, this cycle will terminate when hub thread gets disconnection event and calls into uas_disconnect() accordingly. But in this case, uas_disconnect() will not be called because hub thread of external hub gets stuck waiting for the completion of this SCSI command. A deadlock happened. In this fix, uas will call scsi_scan_host() asynchronously to avoid the blocking of hub thread. Signed-off-by: EJ Hsu Acked-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20200130092506.102760-1-ejh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit dddb40e83038ec72533b1b5721831caf90224a09 Author: Andy Shevchenko Date: Tue Jan 28 16:29:56 2020 +0200 MAINTAINERS: Sort entries in database for USB TYPEC Run parse-maintainers.pl and choose USB TYPEC records. Fix them accordingly. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20200128142956.39604-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1208f9e1d758c991b0a46a1bd60c616b906bbe27 Author: Hardik Gajjar Date: Thu Feb 6 12:49:23 2020 +0100 USB: hub: Fix the broken detection of USB3 device in SMSC hub Renesas R-Car H3ULCB + Kingfisher Infotainment Board is either not able to detect the USB3.0 mass storage devices or is detecting those as USB2.0 high speed devices. The explanation given by Renesas is that, due to a HW issue, the XHCI driver does not wake up after going to sleep on connecting a USB3.0 device. In order to mitigate that, disable the auto-suspend feature specifically for SMSC hubs from hub_probe() function, as a quirk. Renesas Kingfisher Infotainment Board has two USB3.0 ports (CN2) which are connected via USB5534B 4-port SuperSpeed/Hi-Speed, low-power, configurable hub controller. [1] SanDisk USB 3.0 device detected as USB-2.0 before the patch [ 74.036390] usb 5-1.1: new high-speed USB device number 4 using xhci-hcd [ 74.061598] usb 5-1.1: New USB device found, idVendor=0781, idProduct=5581, bcdDevice= 1.00 [ 74.069976] usb 5-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.077303] usb 5-1.1: Product: Ultra [ 74.080980] usb 5-1.1: Manufacturer: SanDisk [ 74.085263] usb 5-1.1: SerialNumber: 4C530001110208116550 [2] SanDisk USB 3.0 device detected as USB-3.0 after the patch [ 34.565078] usb 6-1.1: new SuperSpeed Gen 1 USB device number 3 using xhci-hcd [ 34.588719] usb 6-1.1: New USB device found, idVendor=0781, idProduct=5581, bcdDevice= 1.00 [ 34.597098] usb 6-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.604430] usb 6-1.1: Product: Ultra [ 34.608110] usb 6-1.1: Manufacturer: SanDisk [ 34.612397] usb 6-1.1: SerialNumber: 4C530001110208116550 Suggested-by: Alan Stern Signed-off-by: Hardik Gajjar Acked-by: Alan Stern Tested-by: Eugeniu Rosca Cc: stable Link: https://lore.kernel.org/r/1580989763-32291-1-git-send-email-hgajjar@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman commit 9a4556bd8f23209c29f152e6a930b6a893b0fc81 Author: Larry Finger Date: Mon Feb 10 12:02:35 2020 -0600 staging: rtl8723bs: Remove unneeded goto statements In routines rtw_hostapd_ioctl() and wpa_supplicant_ioctl(), several error conditions involve setting a variable indicating the error, followed by a goto. The code following the target of that goto merely returns the value. It is simpler, therefore to return the error value immediately, and eliminate the got target. Signed-off-by: Larry Finger Cc: Pietro Oliva Link: https://lore.kernel.org/r/20200210180235.21691-7-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit e40c6d0f8763fe67585227d4afc97171db861b3b Author: Larry Finger Date: Mon Feb 10 12:02:34 2020 -0600 staging: rtl8188eu: Remove some unneeded goto statements In routines rtw_hostapd_ioctl() and wpa_supplicant_ioctl(), several error conditions involve setting a variable indicating the error, followed by a goto. The code following the target of that goto merely returns the value. It is simpler, therefore to return the error value immediately, and eliminate the got target. Signed-off-by: Larry Finger Cc: Pietro Oliva Link: https://lore.kernel.org/r/20200210180235.21691-6-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 23954cb078febfc63a755301fe77e06bccdb4d2a Author: Larry Finger Date: Mon Feb 10 12:02:33 2020 -0600 staging: rtl8723bs: Fix potential overuse of kernel memory In routine wpa_supplicant_ioctl(), the user-controlled p->length is checked to be at least the size of struct ieee_param size, but the code does not detect the case where p->length is greater than the size of the struct, thus a malicious user could be wasting kernel memory. Fixes commit 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver"). Reported by: Pietro Oliva Cc: Pietro Oliva Cc: Stable Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver"). Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20200210180235.21691-5-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 4ddf8ab8d15ddbc52eefb44eb64e38466ce1f70f Author: Larry Finger Date: Mon Feb 10 12:02:32 2020 -0600 staging: rtl8188eu: Fix potential overuse of kernel memory In routine wpa_supplicant_ioctl(), the user-controlled p->length is checked to be at least the size of struct ieee_param size, but the code does not detect the case where p->length is greater than the size of the struct, thus a malicious user could be wasting kernel memory. Fixes commit a2c60d42d97c ("Add files for new driver - part 16"). Reported by: Pietro Oliva Cc: Pietro Oliva Cc: Stable Fixes commit a2c60d42d97c ("Add files for new driver - part 16"). Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20200210180235.21691-4-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit ac33597c0c0d1d819dccfe001bcd0acef7107e7c Author: Larry Finger Date: Mon Feb 10 12:02:31 2020 -0600 staging: rtl8723bs: Fix potential security hole In routine rtw_hostapd_ioctl(), the user-controlled p->length is assumed to be at least the size of struct ieee_param size, but this assumption is never checked. This could result in out-of-bounds read/write on kernel heap in case a p->length less than the size of struct ieee_param is specified by the user. If p->length is allowed to be greater than the size of the struct, then a malicious user could be wasting kernel memory. Fixes commit 554c0a3abf216 ("0taging: Add rtl8723bs sdio wifi driver"). Reported by: Pietro Oliva Cc: Pietro Oliva Cc: Stable Fixes 554c0a3abf216 ("0taging: Add rtl8723bs sdio wifi driver"). Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20200210180235.21691-3-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 499c405b2b80bb3a04425ba3541d20305e014d3e Author: Larry Finger Date: Mon Feb 10 12:02:30 2020 -0600 staging: rtl8188eu: Fix potential security hole In routine rtw_hostapd_ioctl(), the user-controlled p->length is assumed to be at least the size of struct ieee_param size, but this assumption is never checked. This could result in out-of-bounds read/write on kernel heap in case a p->length less than the size of struct ieee_param is specified by the user. If p->length is allowed to be greater than the size of the struct, then a malicious user could be wasting kernel memory. Fixes commit a2c60d42d97c ("Add files for new driver - part 16"). Reported by: Pietro Oliva Cc: Pietro Oliva Cc: Stable Fixes: a2c60d42d97c ("staging: r8188eu: Add files for new driver - part 16") Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20200210180235.21691-2-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 0ca2c0319a7bce0e152b51b866979d62dc261e48 Author: John Garry Date: Tue Feb 11 00:50:17 2020 +0800 perf/smmuv3: Use platform_get_irq_optional() for wired interrupt Even though a SMMUv3 PMCG implementation may use an MSI as the form of interrupt source, the kernel would still complain that it does not find the wired (GSIV) interrupt in this case: root@(none)$ dmesg | grep arm-smmu-v3-pmcg | grep "not found" [ 59.237219] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.8.auto: IRQ index 0 not found [ 59.322841] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.9.auto: IRQ index 0 not found [ 59.422155] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.10.auto: IRQ index 0 not found [ 59.539014] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.11.auto: IRQ index 0 not found [ 59.640329] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.12.auto: IRQ index 0 not found [ 59.743112] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.13.auto: IRQ index 0 not found [ 59.880577] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.14.auto: IRQ index 0 not found [ 60.017528] arm-smmu-v3-pmcg arm-smmu-v3-pmcg.15.auto: IRQ index 0 not found Use platform_get_irq_optional() to silence the warning. If neither interrupt source is found, then the driver will still warn that IRQ setup errored and the probe will fail. Reviewed-by: Robin Murphy Signed-off-by: John Garry Signed-off-by: Will Deacon commit 557d0841bc73fbd0da643b6647781bb1f790a84b Author: Wolfram Sang Date: Mon Feb 10 09:57:23 2020 -0800 Input: psmouse - switch to using i2c_new_scanned_device() Move from the deprecated i2c_new_probed_device() to the new i2c_new_scanned_device(). Make use of the new ERRPTR if suitable. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20200210165902.5250-1-wsa+renesas@sang-engineering.com Signed-off-by: Dmitry Torokhov commit d0c5e7d4f5e5b76eeb53d098157d5b1f62ebb407 Author: Luca Weiss Date: Sun Feb 9 14:43:30 2020 -0800 Input: ili210x - add ili2120 support This adds support for the Ilitek ili2120 touchscreen found in the Fairphone 2 smartphone. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20200209151904.661210-1-luca@z3ntu.xyz Signed-off-by: Dmitry Torokhov commit fbd1ec000213c8b457dd4fb15b6de9ba02ec5482 Author: Luca Weiss Date: Sun Feb 9 14:42:36 2020 -0800 Input: ili210x - fix return value of is_visible function The is_visible function expects the permissions associated with an attribute of the sysfs group or 0 if an attribute is not visible. Change the code to return the attribute permissions when the attribute should be visible which resolves the warning: Attribute calibrate: Invalid permissions 01 Fixes: cc12ba1872c6 ("Input: ili210x - optionally show calibrate sysfs attribute") Signed-off-by: Luca Weiss Reviewed-by: Sven Van Asbroeck Link: https://lore.kernel.org/r/20200209145628.649409-1-luca@z3ntu.xyz Signed-off-by: Dmitry Torokhov commit f61872bb58a1cd8f0422aab1940eeee8be579d38 Author: Steven Rostedt (VMware) Date: Fri Feb 7 19:07:37 2020 -0500 bootconfig: Use parse_args() to find bootconfig and '--' The current implementation does a naive search of "bootconfig" on the kernel command line. But this could find "bootconfig" that is part of another option in quotes (although highly unlikely). But it also needs to find '--' on the kernel command line to know if it should append a '--' or not when a bootconfig in the initrd file has an "init" section. The check uses the naive strstr() to find to see if it exists. But this can return a false positive if it exists in an option and then the "init" section in the initrd will not be appended properly. Using parse_args() to find both of these will solve both of these problems. Link: https://lore.kernel.org/r/202002070954.C18E7F58B@keescook Fixes: 7495e0926fdf3 ("bootconfig: Only load bootconfig if "bootconfig" is on the kernel cmdline") Fixes: 1319916209ce8 ("bootconfig: init: Allow admin to use bootconfig for init command line") Reported-by: Kees Cook Reviewed-by: Kees Cook Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 10f129cb59cf6b4aee419ce4b1325fc532d975fb Author: Gustavo A. R. Silva Date: Wed Feb 5 16:34:04 2020 -0600 tracing/kprobe: Fix uninitialized variable bug There is a potential execution path in which variable *ret* is returned without being properly initialized, previously. Fix this by initializing variable *ret* to 0. Link: http://lkml.kernel.org/r/20200205223404.GA3379@embeddedor Addresses-Coverity-ID: 1491142 ("Uninitialized scalar variable") Fixes: 2a588dd1d5d6 ("tracing: Add kprobe event command generation functions") Reviewed-by: Tom Zanussi Acked-by: Masami Hiramatsu Signed-off-by: Gustavo A. R. Silva Signed-off-by: Steven Rostedt (VMware) commit 26445f98ead38b90423a2deffce2caa3b97a3d78 Author: Masami Hiramatsu Date: Thu Feb 6 20:14:53 2020 +0900 bootconfig: Remove unneeded CONFIG_LIBXBC Since there is no user except CONFIG_BOOT_CONFIG and no plan to use it from other functions, CONFIG_LIBXBC can be removed and we can use CONFIG_BOOT_CONFIG directly. Link: http://lkml.kernel.org/r/158098769281.939.16293492056419481105.stgit@devnote2 Suggested-by: Geert Uytterhoeven Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 17d25ae7f10e247bcea1f66268f746576cf9c86d Author: Masami Hiramatsu Date: Fri Feb 7 22:55:01 2020 +0900 tools/bootconfig: Fix wrong __VA_ARGS__ usage Since printk() wrapper macro uses __VA_ARGS__ without "##" prefix, it causes a build error if there is no variable arguments (e.g. only fmt is specified.) To fix this error, use ##__VA_ARGS__ instead of __VAR_ARGS__. Link: http://lkml.kernel.org/r/158108370130.2758.10893830923800978011.stgit@devnote2 Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command") Reported-by: Michael Ellerman Tested-by: Michael Ellerman Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit b7db58105b80fa9232719c8329b995b3addfab55 Author: Dan Carpenter Date: Wed Feb 5 15:32:17 2020 +0300 staging: greybus: use after free in gb_audio_manager_remove_all() When we call kobject_put() and it's the last reference to the kobject then it calls gb_audio_module_release() and frees module. We dereference "module" on the next line which is a use after free. Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'") Signed-off-by: Dan Carpenter Acked-by: Viresh Kumar Reviewed-by: Vaibhav Agarwal Link: https://lore.kernel.org/r/20200205123217.jreendkyxulqsool@kili.mountain Signed-off-by: Greg Kroah-Hartman commit c3709b3285009e0c1448510b9460e96146cd5c9a Author: Alistair Delva Date: Sun Feb 2 20:22:54 2020 -0800 staging: android: Delete the 'vsoc' driver The 'vsoc' driver was required for an early iteration of the Android 'cuttlefish' virtual platform, but this platform has been wholly converted to use virtio drivers instead. Delete this old driver. Cc: Greg Kroah-Hartman Cc: Joel Fernandes Cc: Greg Hartman Cc: kernel-team@android.com Cc: devel@driverdev.osuosl.org Signed-off-by: Alistair Delva Reviewed-by: Joel Fernandes (Google) Link: https://lore.kernel.org/r/20200203042254.80360-1-adelva@google.com Signed-off-by: Greg Kroah-Hartman commit 8ae9a588ca35eb9c32dc03299c5e1f4a1e9a9617 Author: Colin Ian King Date: Sun Jan 26 22:05:49 2020 +0000 staging: rtl8723bs: fix copy of overlapping memory Currently the rtw_sprintf prints the contents of thread_name onto thread_name and this can lead to a potential copy of a string over itself. Avoid this by printing the literal string RTWHALXT instread of the contents of thread_name. Addresses-Coverity: ("copy of overlapping memory") Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Colin Ian King Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20200126220549.9849-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 6d67b0290b4b84c477e6a2fc6e005e174d3c7786 Author: Suren Baghdasaryan Date: Mon Jan 27 15:56:16 2020 -0800 staging: android: ashmem: Disallow ashmem memory from being remapped When ashmem file is mmapped, the resulting vma->vm_file points to the backing shmem file with the generic fops that do not check ashmem permissions like fops of ashmem do. If an mremap is done on the ashmem region, then the permission checks will be skipped. Fix that by disallowing mapping operation on the backing shmem file. Reported-by: Jann Horn Signed-off-by: Suren Baghdasaryan Cc: stable # 4.4,4.9,4.14,4.18,5.4 Signed-off-by: Todd Kjos Reviewed-by: Joel Fernandes (Google) Link: https://lore.kernel.org/r/20200127235616.48920-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman commit 93134df520f23f4e9998c425b8987edca7016817 Author: Malcolm Priestley Date: Tue Feb 4 19:34:02 2020 +0000 staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi. bb_pre_ed_rssi is an u8 rx_dm always returns negative signed values add minus operator to always yield positive. fixes issue where rx sensitivity is always set to maximum because the unsigned numbers were always greater then 100. Fixes: 63b9907f58f1 ("staging: vt6656: mac80211 conversion: create rx function.") Cc: stable Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/aceac98c-6e69-3ce1-dfec-2bf27b980221@gmail.com Signed-off-by: Greg Kroah-Hartman commit cf5b4059ba7197d6cef9c0e024979d178ed8c8ec Author: Trond Myklebust Date: Wed Feb 5 09:01:53 2020 -0500 NFSv4: Fix races between open and dentry revalidation We want to make sure that we revalidate the dentry if and only if we've done an OPEN by filename. In order to avoid races with remote changes to the directory on the server, we want to save the verifier before calling OPEN. The exception is if the server returned a delegation with our OPEN, as we then know that the filename can't have changed on the server. Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Tested-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit a1147b8281bda99bda99892233e1900329a9cbf1 Author: Trond Myklebust Date: Wed Feb 5 09:01:52 2020 -0500 NFS: Fix up directory verifier races In order to avoid having our dentry revalidation race with an update of the directory on the server, we need to store the verifier before the RPC calls to LOOKUP and READDIR. Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Tested-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit a3ae87dce3a5abe0b57c811bab02b2564b574106 Author: Mathias Nyman Date: Mon Feb 10 15:45:53 2020 +0200 xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms Intel Comet Lake based platform require the XHCI_PME_STUCK_QUIRK quirk as well. Without this xHC can not enter D3 in runtime suspend. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20200210134553.9144-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 024d411e9c5d49eb96c825af52a3ce2682895676 Author: Mathias Nyman Date: Mon Feb 10 15:45:52 2020 +0200 xhci: fix runtime pm enabling for quirky Intel hosts Intel hosts that need the XHCI_PME_STUCK_QUIRK flag should enable runtime pm by calling xhci_pme_acpi_rtd3_enable() before usb_hcd_pci_probe() calls pci_dev_run_wake(). Otherwise usage count for the device won't be decreased, and runtime suspend is prevented. usb_hcd_pci_probe() only decreases the usage count if device can generate run-time wake-up events, i.e. when pci_dev_run_wake() returns true. This issue was exposed by pci_dev_run_wake() change in commit 8feaec33b986 ("PCI / PM: Always check PME wakeup capability for runtime wakeup support") and should be backported to kernels with that change Cc: # 4.13+ Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20200210134553.9144-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit fc57313d1017dd6b6f37a94e88daa8df54368ecc Author: Mathias Nyman Date: Mon Feb 10 15:45:51 2020 +0200 xhci: Fix memory leak when caching protocol extended capability PSI tables xhci driver assumed that xHC controllers have at most one custom supported speed table (PSI) for all usb 3.x ports. Memory was allocated for one PSI table under the xhci hub structure. Turns out this is not the case, some controllers have a separate "supported protocol capability" entry with a PSI table for each port. This means each usb3 roothub port can in theory support different custom speeds. To solve this, cache all supported protocol capabilities with their PSI tables in an array, and add pointers to the xhci port structure so that every port points to its capability entry in the array. When creating the SuperSpeedPlus USB Device Capability BOS descriptor for the xhci USB 3.1 roothub we for now will use only data from the first USB 3.1 capable protocol capability entry in the array. This could be improved later, this patch focuses resolving the memory leak. Reported-by: Paul Menzel Reported-by: Sajja Venkateswara Rao Fixes: 47189098f8be ("xhci: parse xhci protocol speed ID list for usb 3.1 usage") Cc: stable # v4.4+ Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20200210134553.9144-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f148b9f402ef002b57bcff3964d45abc8ffb6c3f Author: Mathias Nyman Date: Mon Feb 10 15:45:50 2020 +0200 xhci: Force Maximum Packet size for Full-speed bulk devices to valid range. A Full-speed bulk USB audio device (DJ-Tech CTRL) with a invalid Maximum Packet Size of 4 causes a xHC "Parameter Error" at enumeration. This is because valid Maximum packet sizes for Full-speed bulk endpoints are 8, 16, 32 and 64 bytes. Hosts are not required to support other values than these. See usb 2 specs section 5.8.3 for details. The device starts working after forcing the maximum packet size to 8. This is most likely the case with other devices as well, so force the maximum packet size to a valid range. Cc: stable@vger.kernel.org Reported-by: Rene D Obermueller Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20200210134553.9144-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3f6166aaf19902f2f3124b5426405e292e8974dd Author: Petr Pavlu Date: Mon Feb 10 10:38:14 2020 +0100 cifs: fix mount option display for sec=krb5i Fix display for sec=krb5i which was wrongly interleaved by cruid, resulting in string "sec=krb5,cruid=<...>i" instead of "sec=krb5i,cruid=<...>". Fixes: 96281b9e46eb ("smb3: for kerberos mounts display the credential uid used") Signed-off-by: Petr Pavlu Signed-off-by: Steve French commit af7aae1b1f6306a1cda4da393e920a1334eaa3d4 Author: Kai Vehmanen Date: Thu Feb 6 22:02:23 2020 +0200 ASoC: SOF: Intel: hda: move i915 init earlier To be compliant with i915 display driver requirements, i915 power-up must be done before any HDA communication takes place, including parsing the bus capabilities. Otherwise the initial codec probe may fail. Move i915 initialization earlier in the SOF HDA sequence. This sequence is now aligned with the snd-hda-intel driver where the display_power() call is before snd_hdac_bus_parse_capabilities() and rest of the capability parsing. Also remove unnecessary ifdef around hda_codec_i915_init(). There's a dummy implementation provided if CONFIG_SND_SOC_SOF_HDA is not enabled. Signed-off-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20200206200223.7715-3-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 816938b272b0ac0203e25ce50483bd284ea4a2db Author: Kai Vehmanen Date: Thu Feb 6 22:02:22 2020 +0200 ASoC: SOF: Intel: hda: fix ordering bug in resume flow When HDA controller is resumed from suspend, i915 HDMI/DP codec requires that following order of actions is kept: - i915 display power up and configuration of link params - hda link reset and setup Current SOF HDA code delegates display codec power control to the codec driver. This works most of the time, but in runtime PM sequences, the above constraint may be violated. On platforms where BIOS values for HDA link parameters do not match hardware reset defaults, this may lead to errors in HDA verb transactions after resume. Fix the issue by explicitly powering the display codec in the HDA controller resume/suspend calls, thus ensuring correct ordering. Special handling is needed for the D0i3 flow, where display power must be turned off even though DSP is left powered. Now that we have more invocations of the display power helper functions, the conditional checks surrounding each call have been moved inside hda_codec_i915_display_power(). The two special cases of display powering at initial probe are handled separately. The intent is to avoid powering the display whenever no display codecs are used. Note that early powering of display was removed in commit 687ae9e287b3 ("ASoC: intel: skl: Fix display power regression"). This change was also copied to the SOF driver. No failures have resulted as hardware default values for link parameters have worked out of the box. However with recent i915 driver changes like done in commit 87c1694533c9 ("drm/i915: save AUD_FREQ_CNTRL state at audio domain suspend"), this does not hold anymore and errors are hit. Cc: Takashi Iwai Signed-off-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20200206200223.7715-2-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 43bcb1c0507858cdc95e425017dcc33f8105df39 Author: Kai Vehmanen Date: Thu Feb 6 22:02:21 2020 +0200 ALSA: hda: do not override bus codec_mask in link_get() snd_hdac_ext_bus_link_get() does not work correctly in case there are multiple codecs on the bus. It unconditionally resets the bus->codec_mask value. As per documentation in hdaudio.h and existing use in client code, this field should be used to store bit flag of detected codecs on the bus. By overwriting value of the codec_mask, information on all detected codecs is lost. No current user of hdac is impacted, but use of bus->codec_mask is planned in future patches for SOF. Signed-off-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20200206200223.7715-1-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 00516d13d4cfa56ce39da144db2dbf08b09b9357 Author: Bjørn Mork Date: Sat Feb 8 16:55:04 2020 +0100 qmi_wwan: unconditionally reject 2 ep interfaces We have been using the fact that the QMI and DIAG functions usually are the only ones with class/subclass/protocol being ff/ff/ff on Quectel modems. This has allowed us to match the QMI function without knowing the exact interface number, which can vary depending on firmware configuration. The ability to silently reject the DIAG function, which is usually handled by the option driver, is important for this method to work. This is done based on the knowledge that it has exactly 2 bulk endpoints. QMI function control interfaces will have either 3 or 1 endpoint. This rule is universal so the quirk condition can be removed. The fixed layouts known from the Gobi1k and Gobi2k modems have been gradually replaced by more dynamic layouts, and many vendors now use configurable layouts without changing device IDs. Renaming the class/subclass/protocol matching macro makes it more obvious that this is now not Quectel specific anymore. Cc: Kristian Evensen Cc: Aleksander Morgado Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller commit 5d1fbdf238b5175579a34ac1c21cd172b65e9ca7 Author: Andrew Lunn Date: Sat Feb 8 16:54:32 2020 +0100 net: dsa: mv88e6xxx: Prevent truncation of longer interrupt names When adding support for unique interrupt names, after testing on a few devices, it was assumed 32 characters would be sufficient. This assumption turned out to be incorrect, ZII RDU2 for example uses a device base name of mv88e6xxx-30be0000.ethernet-1:0, leaving no space for post fixes such as -g1-atu-prob and -watchdog. The names then become identical, defeating the point of the patch. Increase the length of the string to 64 charactoes. Reported-by: Chris Healy Fixes: 3095383a8ab4 ("net: dsa: mv88e6xxx: Unique IRQ name") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 88bf54603f6f2c137dfee1abf6436ceac3528d2d Author: Bjørn Mork Date: Sat Feb 8 15:50:36 2020 +0100 qmi_wwan: re-add DW5821e pre-production variant Commit f25e1392fdb5 removed the support for the pre-production variant of the Dell DW5821e to avoid probing another USB interface unnecessarily. However, the pre-production samples are found in the wild, and this lack of support is causing problems for users of such samples. It is therefore necessary to support both variants. Matching on both interfaces 0 and 1 is not expected to cause any problem with either variant, as only the QMI function will be probed successfully on either. Interface 1 will be rejected based on the HID class for the production variant: T: Bus=01 Lev=03 Prnt=04 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 2 P: Vendor=413c ProdID=81d7 Rev=03.18 S: Manufacturer=DELL S: Product=DW5821e Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option And interface 0 will be rejected based on too few endpoints for the pre-production variant: T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 2 P: Vendor=413c ProdID=81d7 Rev= 3.18 S: Manufacturer=DELL S: Product=DW5821e Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver= I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option Fixes: f25e1392fdb5 ("qmi_wwan: fix interface number for DW5821e production firmware") Link: https://whrl.pl/Rf0vNk Reported-by: Lars Melin Cc: Aleksander Morgado Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller commit a924eae75106258c0797706a0578c5af499c9ff5 Author: Yash Shah Date: Tue Jan 28 10:54:21 2020 +0530 gpio: sifive: fix static checker warning Typcasting "irq_state" leads to the below static checker warning: The fix is to declare "irq_state" as unsigned long instead of u32. drivers/gpio/gpio-sifive.c:97 sifive_gpio_irq_enable() warn: passing casted pointer '&chip->irq_state' to 'assign_bit()' 32 vs 64. Fixes: 96868dce644d ("gpio/sifive: Add GPIO driver for SiFive SoCs") Reported-by: Dan Carpenter Signed-off-by: Yash Shah Link: https://lore.kernel.org/r/1580189061-14091-1-git-send-email-yash.shah@sifive.com Reviewed-by: Marc Zyngier Signed-off-by: Linus Walleij commit 1b5af53781654706e1a4ee479274f8a3e3f74c01 Author: Chris Wilson Date: Wed Jan 15 12:25:09 2020 +0000 drm/i915/gt: Use the BIT when checking the flags, not the index In converting over to using set_bit()/test_bit(), when manually inspecting the rq->fence.flags, we need to use BIT(). Fixes: e1c31fb5dde3 ("drm/i915: Merge i915_request.flags with i915_request.fence.flags") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Matthew Auld Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200115122509.2673075-1-chris@chris-wilson.co.uk (cherry picked from commit 72ff2b8d5f2dcb09bfa37b902c23311eec426496) Signed-off-by: Jani Nikula commit 1fdea0cb0dba0d42ffcfb619b349c1a2afa2492e Author: Chris Wilson Date: Tue Jan 14 16:00:30 2020 +0000 drm/i915/selftests: Add a mock i915_vma to the mock_ring Add a i915_vma to the mock_engine/mock_ring so that the core code can always assume the presence of ring->vma. Fixes: 8ccfc20a7d56 ("drm/i915/gt: Mark ring->vma as active while pinned") Signed-off-by: Chris Wilson Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200114160030.2468927-1-chris@chris-wilson.co.uk (cherry picked from commit b63b4feaef7363d2cf46dd76bb6e87e060b2b0de) Signed-off-by: Jani Nikula commit c631cc8f11246f1a8075a203d55ff282ee9416db Author: Ville Syrjälä Date: Fri Jan 10 20:32:23 2020 +0200 drm/i915: Make a copy of the ggtt view for slave plane intel_prepare_plane_fb() will always pin plane_state->hw.fb whenever it is present. We copy that from the master plane to the slave plane, but we fail to copy the corresponding ggtt view. Thus when it comes time to pin the slave plane's fb we use some stale ggtt view left over from the last time the plane was used as a non-slave plane. If that previous use involved 90/270 degree rotation or remapping we'll try to shuffle the pages of the new fb around accordingingly. However the new fb may be backed by a bo with less pages than what the ggtt view rotation/remapped info requires, and so we we trip a GEM_BUG(). Steps to reproduce on icl: 1. plane 1: whatever plane 6: largish !NV12 fb + 90 degree rotation 2. plane 1: smallish NV12 fb plane 6: make invisible so it gets slaved to plane 1 3. GEM_BUG() Cc: Chris Wilson Cc: Maarten Lankhorst Closes: https://gitlab.freedesktop.org/drm/intel/issues/951 Fixes: 1f594b209fe1 ("drm/i915: Remove special case slave handling during hw programming, v3.") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20200110183228.8199-1-ville.syrjala@linux.intel.com Reviewed-by: Chris Wilson (cherry picked from commit 103605e0d1e77cfb5d0f5a9e8aba7d97f1b49339) Signed-off-by: Jani Nikula commit 01c1b2cbf05224495eec2cf54166934f123bad61 Author: Chris Wilson Date: Mon Jan 13 15:45:55 2020 +0000 drm/i915/gem: Take local vma references for the parser Take and hold a reference to each of the vma (and their objects) as we process them with the cmdparser. This stops them being freed during the work if the GEM execbuf is interrupted and the request we expected to keep the objects alive is incomplete. Fixes: 686c7c35abc2 ("drm/i915/gem: Asynchronous cmdparser") Closes: https://gitlab.freedesktop.org/drm/intel/issues/970 Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200113154555.1909639-1-chris@chris-wilson.co.uk (cherry picked from commit 36c8e356a76e147f0b631fd29838147c01b50d04) Signed-off-by: Jani Nikula commit 88a9c66d998b1d2dac412fcd458c5d17d70513c8 Author: Chris Wilson Date: Tue Jan 14 10:56:47 2020 +0000 drm/i915/pmu: Correct the rc6 offset upon enabling The rc6 residency starts ticking from 0 from BIOS POST, but the kernel starts measuring the time from its boot. If we start measuruing I915_PMU_RC6_RESIDENCY while the GT is idle, we start our sampling from 0 and then upon first activity (park/unpark) add in all the rc6 residency since boot. After the first park with the sampler engaged, the sleep/active counters are aligned. v2: With a wakeref to be sure Closes: https://gitlab.freedesktop.org/drm/intel/issues/973 Fixes: df6a42053513 ("drm/i915/pmu: Ensure monotonic rc6") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200114105648.2172026-1-chris@chris-wilson.co.uk (cherry picked from commit f4e9894b6952a2819937f363cd42e7cd7894a1e4) Signed-off-by: Jani Nikula commit 2d5a2f913b658a7ae984773a63318ed4daadf4af Author: Stephen Boyd Date: Tue Jan 21 10:37:48 2020 -0800 spmi: pmic-arb: Set lockdep class for hierarchical irq domains I see the following lockdep splat in the qcom pinctrl driver when attempting to suspend the device. WARNING: possible recursive locking detected 5.4.11 #3 Tainted: G W -------------------------------------------- cat/3074 is trying to acquire lock: ffffff81f49804c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94 but task is already holding lock: ffffff81f1cc10c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&irq_desc_lock_class); lock(&irq_desc_lock_class); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by cat/3074: #0: ffffff81f01d9420 (sb_writers#7){.+.+}, at: vfs_write+0xd0/0x1a4 #1: ffffff81bd7d2080 (&of->mutex){+.+.}, at: kernfs_fop_write+0x12c/0x1fc #2: ffffff81f4c322f0 (kn->count#337){.+.+}, at: kernfs_fop_write+0x134/0x1fc #3: ffffffe411a41d60 (system_transition_mutex){+.+.}, at: pm_suspend+0x108/0x348 #4: ffffff81f1c5e970 (&dev->mutex){....}, at: __device_suspend+0x168/0x41c #5: ffffff81f1cc10c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94 stack backtrace: CPU: 5 PID: 3074 Comm: cat Tainted: G W 5.4.11 #3 Hardware name: Google Cheza (rev3+) (DT) Call trace: dump_backtrace+0x0/0x174 show_stack+0x20/0x2c dump_stack+0xc8/0x124 __lock_acquire+0x460/0x2388 lock_acquire+0x1cc/0x210 _raw_spin_lock_irqsave+0x64/0x80 __irq_get_desc_lock+0x64/0x94 irq_set_irq_wake+0x40/0x144 qpnpint_irq_set_wake+0x28/0x34 set_irq_wake_real+0x40/0x5c irq_set_irq_wake+0x70/0x144 pm8941_pwrkey_suspend+0x34/0x44 platform_pm_suspend+0x34/0x60 dpm_run_callback+0x64/0xcc __device_suspend+0x310/0x41c dpm_suspend+0xf8/0x298 dpm_suspend_start+0x84/0xb4 suspend_devices_and_enter+0xbc/0x620 pm_suspend+0x210/0x348 state_store+0xb0/0x108 kobj_attr_store+0x14/0x24 sysfs_kf_write+0x4c/0x64 kernfs_fop_write+0x15c/0x1fc __vfs_write+0x54/0x18c vfs_write+0xe4/0x1a4 ksys_write+0x7c/0xe4 __arm64_sys_write+0x20/0x2c el0_svc_common+0xa8/0x160 el0_svc_handler+0x7c/0x98 el0_svc+0x8/0xc Set a lockdep class when we map the irq so that irq_set_wake() doesn't warn about a lockdep bug that doesn't exist. Fixes: 12a9eeaebba3 ("spmi: pmic-arb: convert to v2 irq interfaces to support hierarchical IRQ chips") Cc: Douglas Anderson Cc: Brian Masney Cc: Lina Iyer Cc: Maulik Shah Cc: Bjorn Andersson Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20200121183748.68662-1-swboyd@chromium.org Signed-off-by: Linus Walleij commit 9437bfda00f3b26eb5f475737ddaaf4dc07fee4f Author: Arnd Bergmann Date: Thu Jan 30 15:05:45 2020 +0200 ASoC: atmel: fix atmel_ssc_set_audio link failure The ssc audio driver can call into both pdc and dma backends. With the latest rework, the logic to do this in a safe way avoiding link errors was removed, bringing back link errors that were fixed long ago in commit 061981ff8cc8 ("ASoC: atmel: properly select dma driver state") such as sound/soc/atmel/atmel_ssc_dai.o: In function `atmel_ssc_set_audio': atmel_ssc_dai.c:(.text+0xac): undefined reference to `atmel_pcm_pdc_platform_register' Fix it this time using Makefile hacks and a comment to prevent this from accidentally getting removed again rather than Kconfig hacks. Fixes: 18291410557f ("ASoC: atmel: enable SOC_SSC_PDC and SOC_SSC_DMA in Kconfig") Signed-off-by: Arnd Bergmann Signed-off-by: Codrin Ciubotariu Link: https://lore.kernel.org/r/20200130130545.31148-1-codrin.ciubotariu@microchip.com Reviewed-by: Michał Mirosław Signed-off-by: Mark Brown commit c3afa804c58e5c30ac63858b527fffadc88bce82 Author: Paul Thomas Date: Sat Jan 25 17:14:10 2020 -0500 gpio: xilinx: Fix bug where the wrong GPIO register is written to Care is taken with "index", however with the current version the actual xgpio_writereg is using index for data but xgpio_regoffset(chip, i) for the offset. And since i is already incremented it is incorrect. This patch fixes it so that index is used for the offset too. Cc: stable@vger.kernel.org Signed-off-by: Paul Thomas Link: https://lore.kernel.org/r/20200125221410.8022-1-pthomas8589@gmail.com Signed-off-by: Linus Walleij commit 0b6f499022b6a87d04f56edd2bf863ea76923206 Author: Julian Wiedmann Date: Mon Nov 25 14:18:29 2019 +0100 s390/qdio: simplify ACK tracking Current code uses a 'polling' flag to keep track of whether an Input Queue has any ACKed SBALs. QEBSM devices might have multiple ACKed SBALs, and those are tracked separately with 'ack_count'. By also setting ack_count for non-QEBSM devices (to a fixed value of 1), we can use 'ack_count != 0' as replacement for the polling flag. Signed-off-by: Julian Wiedmann Signed-off-by: Vasily Gorbik commit fcd98d4002539f1e381916fc1b6648938c1eac76 Author: Harald Freudenberger Date: Fri Dec 20 16:02:54 2019 +0100 s390/zcrypt: fix card and queue total counter wrap The internal statistic counters for the total number of requests processed per card and per queue used integers. So they do wrap after a rather huge amount of crypto requests processed. This patch introduces uint64 counters which should hold much longer but still may wrap. The sysfs attributes request_count for card and queue also used only %ld and now display the counter value with %llu. This is not a security relevant fix. The int overflow which happened is not in any way exploitable as a security breach. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit aab73d278d49c718b722ff5052e16c9cddf144d4 Author: Harald Freudenberger Date: Fri Jan 31 12:08:31 2020 +0100 s390/pkey: fix missing length of protected key on return The pkey ioctl call PKEY_SEC2PROTK updates a struct pkey_protkey on return. The protected key is stored in, the protected key type is stored in but the len information was not updated. This patch now fixes this and so the len field gets an update to refrect the actual size of the protected key value returned. Fixes: efc598e6c8a9 ("s390/zcrypt: move cca misc functions to new code file") Cc: Stable Signed-off-by: Harald Freudenberger Reported-by: Christian Rund Suggested-by: Ingo Franzki Signed-off-by: Vasily Gorbik commit dee7c111a458115daecb74a6e3b707260e64e983 Merge: bb6d3fb354c5 8131b73b22c2 Author: Linus Walleij Date: Mon Feb 10 12:47:26 2020 +0100 Merge tag 'gpio-fixes-for-v5.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes gpio fixes for v5.6-rc2 - fix a regression introduced by gpio_do_set_config() - sort GPIO entries in MAINTAINERS - remove leftover defines in gpio-bd71828 - remove an redundant switch case in gpio_set_config() commit 345d52c184dc7de98cff63f1bfa6f90e9db19809 Author: Qian Cai Date: Thu Jan 23 15:20:51 2020 -0500 arm64/spinlock: fix a -Wunused-function warning The commit f5bfdc8e3947 ("locking/osq: Use optimized spinning loop for arm64") introduced a warning from Clang because vcpu_is_preempted() is compiled away, kernel/locking/osq_lock.c:25:19: warning: unused function 'node_cpu' [-Wunused-function] static inline int node_cpu(struct optimistic_spin_node *node) ^ 1 warning generated. Fix it by converting vcpu_is_preempted() to a static inline function. Fixes: f5bfdc8e3947 ("locking/osq: Use optimized spinning loop for arm64") Acked-by: Waiman Long Signed-off-by: Qian Cai Signed-off-by: Will Deacon commit fca3d33d8ad61eb53eca3ee4cac476d1e31b9008 Author: Will Deacon Date: Thu Feb 6 10:42:58 2020 +0000 arm64: ssbs: Fix context-switch when SSBS is present on all CPUs When all CPUs in the system implement the SSBS extension, the SSBS field in PSTATE is the definitive indication of the mitigation state. Further, when the CPUs implement the SSBS manipulation instructions (advertised to userspace via an HWCAP), EL0 can toggle the SSBS field directly and so we cannot rely on any shadow state such as TIF_SSBD at all. Avoid forcing the SSBS field in context-switch on such a system, and simply rely on the PSTATE register instead. Cc: Cc: Catalin Marinas Cc: Srinivas Ramana Fixes: cbdf8a189a66 ("arm64: Force SSBS on context switch") Reviewed-by: Marc Zyngier Signed-off-by: Will Deacon commit 2c614c1194f2803750c14b751871bd168dcc8054 Author: Matteo Croce Date: Fri Jan 24 16:51:27 2020 +0100 arm64: use shared sysctl constants Use shared sysctl variables for zero and one constants, as in commit eec4844fae7c ("proc/sysctl: add shared variables for range check") Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI") Signed-off-by: Matteo Croce Signed-off-by: Will Deacon commit 5cb7a1113f94cec20ff16d3981b94b7fdd8d73fa Author: Anshuman Khandual Date: Mon Jan 27 15:19:35 2020 +0530 arm64: Drop do_el0_ia_bp_hardening() & do_sp_pc_abort() declarations There is a redundant do_sp_pc_abort() declaration in exceptions.h which can be removed. Also do_el0_ia_bp_hardening() as been already been dropped with the commit bfe298745afc ("arm64: entry-common: don't touch daif before bp-hardening") and hence does not need a declaration any more. This should not introduce any functional change. Cc: Catalin Marinas Cc: Will Deacon Cc: James Morse Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Acked-by: Mark Rutland Signed-off-by: Anshuman Khandual Signed-off-by: Will Deacon commit 52262ee567ad14c9606be25f3caddcefa3c514e4 Author: Mel Gorman Date: Tue Jan 28 15:40:06 2020 +0000 sched/fair: Allow a per-CPU kthread waking a task to stack on the same CPU, to fix XFS performance regression The following XFS commit: 8ab39f11d974 ("xfs: prevent CIL push holdoff in log recovery") changed the logic from using bound workqueues to using unbound workqueues. Functionally this makes sense but it was observed at the time that the dbench performance dropped quite a lot and CPU migrations were increased. The current pattern of the task migration is straight-forward. With XFS, an IO issuer delegates work to xlog_cil_push_work ()on an unbound kworker. This runs on a nearby CPU and on completion, dbench wakes up on its old CPU as it is still idle and no migration occurs. dbench then queues the real IO on the blk_mq_requeue_work() work item which runs on a bound kworker which is forced to run on the same CPU as dbench. When IO completes, the bound kworker wakes dbench but as the kworker is a bound but, real task, the CPU is not considered idle and dbench gets migrated by select_idle_sibling() to a new CPU. dbench may ping-pong between two CPUs for a while but ultimately it starts a round-robin of all CPUs sharing the same LLC. High-frequency migration on each IO completion has poor performance overall. It has negative implications both in commication costs and power management. mpstat confirmed that at low thread counts that all CPUs sharing an LLC has low level of activity. Note that even if the CIL patch was reverted, there still would be migrations but the impact is less noticeable. It turns out that individually the scheduler, XFS, blk-mq and workqueues all made sensible decisions but in combination, the overall effect was sub-optimal. This patch special cases the IO issue/completion pattern and allows a bound kworker waker and a task wakee to stack on the same CPU if there is a strong chance they are directly related. The expectation is that the kworker is likely going back to sleep shortly. This is not guaranteed as the IO could be queued asynchronously but there is a very strong relationship between the task and kworker in this case that would justify stacking on the same CPU instead of migrating. There should be few concerns about kworker starvation given that the special casing is only when the kworker is the waker. DBench on XFS MMTests config: io-dbench4-async modified to run on a fresh XFS filesystem UMA machine with 8 cores sharing LLC 5.5.0-rc7 5.5.0-rc7 tipsched-20200124 kworkerstack Amean 1 22.63 ( 0.00%) 20.54 * 9.23%* Amean 2 25.56 ( 0.00%) 23.40 * 8.44%* Amean 4 28.63 ( 0.00%) 27.85 * 2.70%* Amean 8 37.66 ( 0.00%) 37.68 ( -0.05%) Amean 64 469.47 ( 0.00%) 468.26 ( 0.26%) Stddev 1 1.00 ( 0.00%) 0.72 ( 28.12%) Stddev 2 1.62 ( 0.00%) 1.97 ( -21.54%) Stddev 4 2.53 ( 0.00%) 3.58 ( -41.19%) Stddev 8 5.30 ( 0.00%) 5.20 ( 1.92%) Stddev 64 86.36 ( 0.00%) 94.53 ( -9.46%) NUMA machine, 48 CPUs total, 24 CPUs share cache 5.5.0-rc7 5.5.0-rc7 tipsched-20200124 kworkerstack-v1r2 Amean 1 58.69 ( 0.00%) 30.21 * 48.53%* Amean 2 60.90 ( 0.00%) 35.29 * 42.05%* Amean 4 66.77 ( 0.00%) 46.55 * 30.28%* Amean 8 81.41 ( 0.00%) 68.46 * 15.91%* Amean 16 113.29 ( 0.00%) 107.79 * 4.85%* Amean 32 199.10 ( 0.00%) 198.22 * 0.44%* Amean 64 478.99 ( 0.00%) 477.06 * 0.40%* Amean 128 1345.26 ( 0.00%) 1372.64 * -2.04%* Stddev 1 2.64 ( 0.00%) 4.17 ( -58.08%) Stddev 2 4.35 ( 0.00%) 5.38 ( -23.73%) Stddev 4 6.77 ( 0.00%) 6.56 ( 3.00%) Stddev 8 11.61 ( 0.00%) 10.91 ( 6.04%) Stddev 16 18.63 ( 0.00%) 19.19 ( -3.01%) Stddev 32 38.71 ( 0.00%) 38.30 ( 1.06%) Stddev 64 100.28 ( 0.00%) 91.24 ( 9.02%) Stddev 128 186.87 ( 0.00%) 160.34 ( 14.20%) Dbench has been modified to report the time to complete a single "load file". This is a more meaningful metric for dbench that a throughput metric as the benchmark makes many different system calls that are not throughput-related Patch shows a 9.23% and 48.53% reduction in the time to process a load file with the difference partially explained by the number of CPUs sharing a LLC. In a separate run, task migrations were almost eliminated by the patch for low client counts. In case people have issue with the metric used for the benchmark, this is a comparison of the throughputs as reported by dbench on the NUMA machine. dbench4 Throughput (misleading but traditional) 5.5.0-rc7 5.5.0-rc7 tipsched-20200124 kworkerstack-v1r2 Hmean 1 321.41 ( 0.00%) 617.82 * 92.22%* Hmean 2 622.87 ( 0.00%) 1066.80 * 71.27%* Hmean 4 1134.56 ( 0.00%) 1623.74 * 43.12%* Hmean 8 1869.96 ( 0.00%) 2212.67 * 18.33%* Hmean 16 2673.11 ( 0.00%) 2806.13 * 4.98%* Hmean 32 3032.74 ( 0.00%) 3039.54 ( 0.22%) Hmean 64 2514.25 ( 0.00%) 2498.96 * -0.61%* Hmean 128 1778.49 ( 0.00%) 1746.05 * -1.82%* Note that this is somewhat specific to XFS and ext4 shows no performance difference as it does not rely on kworkers in the same way. No major problem was observed running other workloads on different machines although not all tests have completed yet. Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20200128154006.GD3466@techsingularity.net Signed-off-by: Ingo Molnar commit b460e0a9e2404450a0cc4c5e6476483d6cda1b26 Author: Brendan Higgins Date: Mon Jan 27 15:53:54 2020 -0800 reset: intel: add unspecified HAS_IOMEM dependency Currently CONFIG_RESET_INTEL_GW=y implicitly depends on CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get the following build error: /usr/bin/ld: drivers/reset/reset-intel-gw.o: in function `intel_reset_probe': drivers/reset/reset-intel-gw.c:185: undefined reference to `devm_platform_ioremap_resource' Fix the build error by adding the unspecified dependency. Signed-off-by: Brendan Higgins Signed-off-by: Philipp Zabel commit 7fbcc53514c5e410dd598685c5fbbe1e6a5a87e1 Author: Brendan Higgins Date: Mon Jan 27 15:53:53 2020 -0800 reset: brcmstb-rescal: add unspecified HAS_IOMEM dependency Currently CONFIG_RESET_BRCMSTB_RESCAL=y implicitly depends on CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get the following build error: /usr/bin/ld: drivers/reset/reset-brcmstb-rescal.o: in function `brcm_rescal_reset_probe': drivers/reset/reset-brcmstb-rescal.c:76: undefined reference to `devm_ioremap_resource' Fix the build error by adding the unspecified dependency. Signed-off-by: Brendan Higgins Signed-off-by: Philipp Zabel commit 71483532a3e8ec1dffbfd9183a20320f59c4ed03 Author: Lukas Bulwahn Date: Thu Jan 16 19:48:36 2020 +0100 MAINTAINERS: fix style in RESET CONTROLLER FRAMEWORK Commit 37859277374d ("MAINTAINERS: add reset controller framework keywords") slips in some formatting with spaces instead of tabs, which ./scripts/checkpatch.pl -f MAINTAINERS complains about: WARNING: MAINTAINERS entries use one tab after TYPE: #14047: FILE: MAINTAINERS:14047: +K: \b(?:devm_|of_)?reset_control(?:ler_[a-z]+|_[a-z_]+)?\b Fixes: 37859277374d ("MAINTAINERS: add reset controller framework keywords") Signed-off-by: Lukas Bulwahn Signed-off-by: Philipp Zabel commit 68131a0b8fd0522c33fffb6c9d857dc88fbd43ee Author: Rob Herring Date: Mon Jan 13 15:45:15 2020 -0600 dt-bindings: reset: intel,rcu-gw: Fix intel,global-reset schema The intel,rcu-gw binding example has an error: Documentation/devicetree/bindings/reset/intel,rcu-gw.example.dt.yaml: reset-controller@e0000000: intel,global-reset: [[16, 30]] is too short The error isn't really correct as the problem is in how the data is encoded and the schema is not fixed up by the tooling correctly. However, array properties should describe the elements in the array, so lets do that which fixes the error in the process. Fixes: b7ab0cb00d08 ("dt-bindings: reset: Add YAML schemas for the Intel Reset controller") Cc: Dilip Kota Signed-off-by: Rob Herring Signed-off-by: Philipp Zabel commit 8131b73b22c25e57e926874bb284f61cc3f8ac5e Author: Kent Gibson Date: Mon Jan 20 18:46:26 2020 +0800 gpiolib: remove unnecessary argument from set_config call Remove unnecessary argument when setting PIN_CONFIG_BIAS_DISABLE. No argument is expected by pinctrl, so removing it should be harmless. Fixes: 2148ad7790ea ("gpiolib: add support for disabling line bias") Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit 4d0cabbb8b6a6cb010c19e8a3da2da5e0aaf5ef0 Author: Axel Lin Date: Wed Jan 29 20:30:21 2020 +0800 gpio: bd71828: Remove unneeded defines for GPIO_LINE_DIRECTION_IN/OUT They are defined in gpio/driver.h now. Signed-off-by: Axel Lin Signed-off-by: Bartosz Golaszewski commit e4f41de77f96e199151117646ac6df4f18301c79 Author: Andy Shevchenko Date: Tue Jan 28 18:03:25 2020 +0200 MAINTAINERS: Sort entries in database for GPIO Run parse-maintainers.pl and choose GPIO records. Fix them accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 62adc6f33d6f3c0f4831389dec0f82ea6e9a489f Author: Bartosz Golaszewski Date: Mon Feb 3 14:16:16 2020 +0100 gpiolib: fix gpio_do_set_config() Commit d90f36851d65 ("gpiolib: have a single place of calling set_config()") introduced a regression where we don't pass the right variable as argument to the set_config() callback of gpio driver from gpio_set_config(). After reverting two additional patches that came on top of it - this addresses the issue by changing the type of the last argument of gpio_do_set_config() to unsigned long and making sure the packed config variable is actually used in gpio_set_config(). Fixes: d90f36851d65 ("gpiolib: have a single place of calling set_config()") Signed-off-by: Bartosz Golaszewski Tested-by: Guenter Roeck commit 91b4ea5fc57c6a0a1beea7056dc2f83e2ec6968c Author: Bartosz Golaszewski Date: Mon Feb 3 14:03:47 2020 +0100 Revert "gpiolib: remove set but not used variable 'config'" This reverts commit e5e42ad224a040f93bf112e96f82b3a0ed97ffab. This patch came on top of another patch that introduced a regression. Revert it before addressing the culprit. Signed-off-by: Bartosz Golaszewski Tested-by: Guenter Roeck commit d99f88761ba0d135677afe546ffdd26c58e5644d Author: Bartosz Golaszewski Date: Mon Feb 3 14:03:37 2020 +0100 Revert "gpiolib: Remove duplicated function gpio_do_set_config()" This reverts commit d18fddff061d2796525e6d4a958cb3d30aed8efd. This patch came on top of another patch that introduced a regression. Revert it before addressing the culprit. Signed-off-by: Bartosz Golaszewski Tested-by: Guenter Roeck commit e7598fac323aad0e502415edeffd567315994dd6 Author: Joerg Roedel Date: Mon Feb 10 10:36:56 2020 +0100 iommu/vt-d: Fix compile warning from intel-svm.h The intel_svm_is_pasid_valid() needs to be marked inline, otherwise it causes the compile warning below: CC [M] drivers/dma/idxd/cdev.o In file included from drivers/dma/idxd/cdev.c:9:0: ./include/linux/intel-svm.h:125:12: warning: ‘intel_svm_is_pasid_valid’ defined but not used [-Wunused-function] static int intel_svm_is_pasid_valid(struct device *dev, int pasid) ^~~~~~~~~~~~~~~~~~~~~~~~ Reported-by: Borislav Petkov Fixes: 15060aba71711 ('iommu/vt-d: Helper function to query if a pasid has any active users') Signed-off-by: Joerg Roedel commit 5391a87751a164b3194864126f3b016038abc9fe Author: Tuong Lien Date: Mon Feb 10 15:35:44 2020 +0700 tipc: fix successful connect() but timed out In commit 9546a0b7ce00 ("tipc: fix wrong connect() return code"), we fixed the issue with the 'connect()' that returns zero even though the connecting has failed by waiting for the connection to be 'ESTABLISHED' really. However, the approach has one drawback in conjunction with our 'lightweight' connection setup mechanism that the following scenario can happen: (server) (client) +- accept()| | wait_for_conn() | | |connect() -------+ | |<-------[SYN]---------| > sleeping | | *CONNECTING | |--------->*ESTABLISHED | | |--------[ACK]-------->*ESTABLISHED > wakeup() send()|--------[DATA]------->|\ > wakeup() send()|--------[DATA]------->| | > wakeup() . . . . |-> recvq . . . . . | . send()|--------[DATA]------->|/ > wakeup() close()|--------[FIN]-------->*DISCONNECTING | *DISCONNECTING | | | ~~~~~~~~~~~~~~~~~~> schedule() | wait again . . | ETIMEDOUT Upon the receipt of the server 'ACK', the client becomes 'ESTABLISHED' and the 'wait_for_conn()' process is woken up but not run. Meanwhile, the server starts to send a number of data following by a 'close()' shortly without waiting any response from the client, which then forces the client socket to be 'DISCONNECTING' immediately. When the wait process is switched to be running, it continues to wait until the timer expires because of the unexpected socket state. The client 'connect()' will finally get ‘-ETIMEDOUT’ and force to release the socket whereas there remains the messages in its receive queue. Obviously the issue would not happen if the server had some delay prior to its 'close()' (or the number of 'DATA' messages is large enough), but any kind of delay would make the connection setup/shutdown "heavy". We solve this by simply allowing the 'connect()' returns zero in this particular case. The socket is already 'DISCONNECTING', so any further write will get '-EPIPE' but the socket is still able to read the messages existing in its receive queue. Note: This solution doesn't break the previous one as it deals with a different situation that the socket state is 'DISCONNECTING' but has no error (i.e. sk->sk_err = 0). Fixes: 9546a0b7ce00 ("tipc: fix wrong connect() return code") Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit 5609e2bbefed38df060c2472af9cf0c469b8997f Author: Chen Wandun Date: Mon Feb 10 16:27:59 2020 +0800 mptcp: make the symbol 'mptcp_sk_clone_lock' static Fix the following sparse warning: net/mptcp/protocol.c:646:13: warning: symbol 'mptcp_sk_clone_lock' was not declared. Should it be static? Fixes: b0519de8b3f1 ("mptcp: fix use-after-free for ipv6") Signed-off-by: Chen Wandun Signed-off-by: David S. Miller commit 2437fd7baf299c7b8a39fa3e727755e84ee7c4ea Author: Chen Wandun Date: Mon Feb 10 16:11:09 2020 +0800 tipc: make three functions static Fix the following sparse warning: net/tipc/node.c:281:6: warning: symbol 'tipc_node_free' was not declared. Should it be static? net/tipc/node.c:2801:5: warning: symbol '__tipc_nl_node_set_key' was not declared. Should it be static? net/tipc/node.c:2878:5: warning: symbol '__tipc_nl_node_flush_key' was not declared. Should it be static? Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Fixes: e1f32190cf7d ("tipc: add support for AEAD key setting via netlink") Signed-off-by: Chen Wandun Signed-off-by: David S. Miller commit 48bc281e4bf049abd3bb98371209315651bf4a14 Author: Geert Uytterhoeven Date: Wed Jan 15 13:56:53 2020 +0100 drm/bridge: ti-tfp410: Update drm_connector_init_with_ddc() error message The code was changed to call drm_connector_init_with_ddc() instead of drm_connector_init(), but the corresponding error message was not updated. Fixes: cfb444552926989f ("drm/bridge: ti-tfp410: Provide ddc symlink in connector sysfs directory") Signed-off-by: Geert Uytterhoeven Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20200115125653.5519-1-geert+renesas@glider.be commit 8a6483ac634acda3f599f50082c652d2d37199c7 Author: Tomi Valkeinen Date: Mon Dec 9 10:27:07 2019 +0200 drm/bridge: tc358767: fix poll timeouts Link training fails with: Link training timeout waiting for LT_LOOPDONE! main link enable error: -110 This is caused by too tight timeouts, which were changed recently in aa92213f388b ("drm/bridge: tc358767: Simplify polling in tc_link_training()"). With a quick glance, the commit does not change the timeouts. However, the method of delaying/sleeping is different, and as the timeout in the previous implementation was not explicit, the new version in practice has much tighter timeout. The same change was made to other parts in the driver, but the link training timeout is the only one I have seen causing issues. Nevertheless, 1 us sleep is not very sane, and the timeouts look pretty tight, so lets fix all the timeouts. One exception was the aux busy poll, where the poll sleep was much longer than necessary (or optimal). I measured the times on my setup, and now the sleep times are set to such values that they result in multiple loops, but not too many (say, 5-10 loops). The timeouts were all increased to 100ms, which should be more than enough for all of these, but in case of bad errors, shouldn't stop the driver as multi-second timeouts could do. Signed-off-by: Tomi Valkeinen Fixes: aa92213f388b ("drm/bridge: tc358767: Simplify polling in tc_link_training()") Tested-by: Andrey Smirnov Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20191209082707.24531-1-tomi.valkeinen@ti.com commit 7c3d02285ad558691f27fde760bcd841baa27eab Author: Johan Hovold Date: Thu Feb 6 12:18:19 2020 +0100 USB: serial: ch341: fix receiver regression While assumed not to make a difference, not using the factor-2 prescaler makes the receiver more susceptible to errors. Specifically, there have been reports of problems with devices that cannot generate a 115200 rate with a smaller error than 2.1% (e.g. 117647 bps). But this can also be reproduced with a low-speed RS232 tranceiver at 115200 when the input rate matches the nominal rate. So whenever possible, enable the factor-2 prescaler and halve the divisor in order to use settings closer to that of the previous algorithm. Fixes: 35714565089e ("USB: serial: ch341: reimplement line-speed handling") Cc: stable # 5.5 Reported-by: Jakub Nantl Tested-by: Jakub Nantl Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit c664a4fa8f69308b8f624cff4fa1294e9aef880d Author: Dan Carpenter Date: Wed Jan 29 20:30:37 2020 +0300 USB: serial: ir-usb: Silence harmless uninitialized variable warning The "actual_length" variable might be uninitialized on some failure paths. It's harmless but static analysis tools like Smatch complain and at runtime the UBSan tool will likely complain as well. Fixes: e7542bc382f8 ("USB: serial: ir-usb: make set_termios synchronous") Signed-off-by: Dan Carpenter Signed-off-by: Johan Hovold commit 03c6bf4644287601bf10d0ed9f6137c1854d3e23 Author: Jagan Teki Date: Tue Dec 31 12:25:08 2019 +0530 arm64: defconfig: Enable DRM_SUN6I_DSI Now, Allwiner MIPI-DSI support is available for ARM64 Allwinner SoC like A64. So, let's build it as a module. Signed-off-by: Jagan Teki Signed-off-by: Maxime Ripard commit 4a453ccf87d507e8c9f156f95e708cec0e70ffed Author: Yangtao Li Date: Sun Dec 29 11:17:06 2019 +0000 arm64: defconfig: Enable CONFIG_SUN8I_THERMAL Many sunxi based board needs CONFIG_SUN8I_THERMAL for thermal support. Signed-off-by: Yangtao Li Signed-off-by: Maxime Ripard commit 415ae604d4ac0c0f4e1ecd79f42891b9ca69cf70 Author: Yangtao Li Date: Sun Dec 29 11:17:07 2019 +0000 ARM: sunxi: Enable CONFIG_SUN8I_THERMAL Many sunxi based board needs CONFIG_SUN8I_THERMAL for thermal support. Signed-off-by: Yangtao Li Signed-off-by: Maxime Ripard commit bd8cac5fb8b8fb2bc80203cb444ecf5f5e2bd9e3 Author: Chen-Yu Tsai Date: Tue Jan 14 17:42:52 2020 +0800 ARM: dts: sun8i: a83t: Fix incorrect clk and reset macros for EMAC device When the raw numbers used for clk and reset indices in the EMAC device node were converted to the new macros, the order of the clk and reset properties was overlooked, and thus the incorrect macros were used. This results in the EMAC being non-responsive, as well as an oops due to incorrect usage of the reset control. Correct the macro types, and also reorder the clk and reset properties to match all the other device nodes. Fixes: 765866edb16a ("ARM: dts: sunxi: Use macros for references to CCU clocks") Signed-off-by: Chen-Yu Tsai Tested-by: Corentin Labbe Signed-off-by: Maxime Ripard commit 0acdf63d2296f9542437a4842ad94554d240eab6 Author: Vineet Gupta Date: Fri Feb 7 17:05:10 2020 -0800 ARC: fpu: fix randconfig build error reported by 0-day test service Reported-by: kbuild test robot Link: http://lists.infradead.org/pipermail/linux-snps-arc/2020-February/006845.html Signed-off-by: Vineet Gupta commit a5760db25c6e68bf8cd34e1642196826c08715ed Author: Randy Dunlap Date: Fri Jan 31 17:49:33 2020 -0800 ARC: fix some Kconfig typos Fix language typos in arch/arc/Kconfig. Cc: linux-snps-arc@lists.infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Vineet Gupta commit d560bb42814ca7ff6c9944310644d45eb53ca1ae Author: Krzysztof Kozlowski Date: Thu Jan 30 20:24:03 2020 +0100 ARC: Cleanup old Kconfig IO scheduler options CONFIG_IOSCHED_DEADLINE and CONFIG_IOSCHED_CFQ are gone since commit f382fb0bcef4 ("block: remove legacy IO schedulers"). The IOSCHED_DEADLINE was replaced by MQ_IOSCHED_DEADLINE and it will be now enabled by default (along with MQ_IOSCHED_KYBER). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Vineet Gupta commit f166795871be4a6a679a5f61ac7130b3c0b21cab Author: Nicolas Saenz Julienne Date: Fri Jan 24 22:08:33 2020 +0100 arm64: defconfig: Set bcm2835-dma as built-in With the introduction of 738987a1d6f1 ("mmc: bcm2835: Use dma_request_chan() instead dma_request_slave_channel()") sdhost-bcm2835 now waits for its DMA channel to be available when defined in the device-tree (it would previously default to PIO). Albeit the right behaviour, the MMC host is needed for booting. So this makes sure the DMA channel shows up in time. Fixes: 738987a1d6f1 ("mmc: bcm2835: Use dma_request_chan() instead dma_request_slave_channel()") Signed-off-by: Nicolas Saenz Julienne Signed-off-by: Florian Fainelli commit cf2b012c90e74e85d8aea7d67e48868069cfee0c Author: Mike Jones Date: Tue Jan 28 10:59:59 2020 -0700 hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions. Change 21537dc driver PMBus polling of MFR_COMMON from bits 5/4 to bits 6/5. This fixs a LTC297X family bug where polling always returns not busy even when the part is busy. This fixes a LTC388X and LTM467X bug where polling used PEND and NOT_IN_TRANS, and BUSY was not polled, which can lead to NACKing of commands. LTC388X and LTM467X modules now poll BUSY and PEND, increasing reliability by eliminating NACKing of commands. Signed-off-by: Mike Jones Link: https://lore.kernel.org/r/1580234400-2829-2-git-send-email-michael-a1.jones@analog.com Fixes: e04d1ce9bbb49 ("hwmon: (ltc2978) Add polling for chips requiring it") Signed-off-by: Guenter Roeck commit 0e9d7bb293f3f9c3ee376b126141407efb265f31 Author: Igor Druzhinin Date: Mon Feb 3 15:07:01 2020 +0000 drm/i915/gvt: more locking for ppgtt mm LRU list When the lock was introduced in commit 72aabfb862e40 ("drm/i915/gvt: Add mutual lock for ppgtt mm LRU list") one place got lost. Fixes: 72aabfb862e4 ("drm/i915/gvt: Add mutual lock for ppgtt mm LRU list") Signed-off-by: Igor Druzhinin Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/1580742421-25194-1-git-send-email-igor.druzhinin@citrix.com commit c216f12bed33f779b974cb2d69206d6202bde572 Author: Igor Druzhinin Date: Wed Jan 22 20:10:24 2020 +0000 drm/i915/gvt: fix high-order allocation failure on late load If the module happens to be loaded later at runtime there is a chance memory is already fragmented enough to fail allocation of firmware blob storage and consequently GVT init. Since it doesn't seem to be necessary to have the blob contiguous, use vmalloc() instead to avoid the issue. Reviewed-by: Zhenyu Wang Signed-off-by: Igor Druzhinin Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/1579723824-25711-1-git-send-email-igor.druzhinin@citrix.com commit 3f9e12e0df012c4a9a7fd7eb0d3ae69b459d6b2c Author: Jean Delvare Date: Thu Feb 6 16:58:45 2020 +0100 ACPI: watchdog: Allow disabling WDAT at boot In case the WDAT interface is broken, give the user an option to ignore it to let a native driver bind to the watchdog device instead. Signed-off-by: Jean Delvare Acked-by: Mika Westerberg Signed-off-by: Rafael J. Wysocki commit bb6d3fb354c5ee8d6bde2d576eb7220ea09862b9 Author: Linus Torvalds Date: Sun Feb 9 16:08:48 2020 -0800 Linux 5.6-rc1 commit 89a47dd1af8fdda667938ec190d9595d55d7ec6f Merge: 380a129eb2c2 f566e1fbadb6 Author: Linus Torvalds Date: Sun Feb 9 16:05:50 2020 -0800 Merge tag 'kbuild-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull more Kbuild updates from Masahiro Yamada: - fix randconfig to generate a sane .config - rename hostprogs-y / always to hostprogs / always-y, which are more natual syntax. - optimize scripts/kallsyms - fix yes2modconfig and mod2yesconfig - make multiple directory targets ('make foo/ bar/') work * tag 'kbuild-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: make multiple directory targets work kconfig: Invalidate all symbols after changing to y or m. kallsyms: fix type of kallsyms_token_table[] scripts/kallsyms: change table to store (strcut sym_entry *) scripts/kallsyms: rename local variables in read_symbol() kbuild: rename hostprogs-y/always to hostprogs/always-y kbuild: fix the document to use extra-y for vmlinux.lds kconfig: fix broken dependency in randconfig-generated .config commit 380a129eb2c20d4b7b5be744e80e2ec18b24220b Merge: 490d332ea427 fcb9c24bef3d Author: Linus Torvalds Date: Sun Feb 9 15:51:46 2020 -0800 Merge tag 'zonefs-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull new zonefs file system from Damien Le Moal: "Zonefs is a very simple file system exposing each zone of a zoned block device as a file. Unlike a regular file system with native zoned block device support (e.g. f2fs or the on-going btrfs effort), zonefs does not hide the sequential write constraint of zoned block devices to the user. As a result, zonefs is not a POSIX compliant file system. Its goal is to simplify the implementation of zoned block devices support in applications by replacing raw block device file accesses with a richer file based API, avoiding relying on direct block device file ioctls which may be more obscure to developers. One example of this approach is the implementation of LSM (log-structured merge) tree structures (such as used in RocksDB and LevelDB) on zoned block devices by allowing SSTables to be stored in a zone file similarly to a regular file system rather than as a range of sectors of a zoned device. The introduction of the higher level construct "one file is one zone" can help reducing the amount of changes needed in the application while at the same time allowing the use of zoned block devices with various programming languages other than C. Zonefs IO management implementation uses the new iomap generic code. Zonefs has been successfully tested using a functional test suite (available with zonefs userland format tool on github) and a prototype implementation of LevelDB on top of zonefs" * tag 'zonefs-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: Add documentation fs: New zonefs file system commit 490d332ea42780577f679f5d13598b195bff360c Author: Marc Zyngier Date: Sun Feb 9 22:48:50 2020 +0000 irqchip/gic-v4.1: Avoid 64bit division for the sake of 32bit ARM In order to allow the GICv4 code to link properly on 32bit ARM, make sure we don't use 64bit divisions when it isn't strictly necessary. Fixes: 4e6437f12d6e ("irqchip/gic-v4.1: Ensure L2 vPE table is allocated at RD level") Reported-by: Stephen Rothwell Cc: Zenghui Yu Signed-off-by: Marc Zyngier Signed-off-by: Linus Torvalds commit d1ea35f4cdd41ae6ac5a9e1ad6a55cc901681569 Merge: 5586c3c1e0eb 51d92d69f77b Author: Linus Torvalds Date: Sun Feb 9 13:27:17 2020 -0800 Merge tag '5.6-rc-smb3-plugfest-patches' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "13 cifs/smb3 patches, most from testing at the SMB3 plugfest this week: - Important fix for multichannel and for modefromsid mounts. - Two reconnect fixes - Addition of SMB3 change notify support - Backup tools fix - A few additional minor debug improvements (tracepoints and additional logging found useful during testing this week)" * tag '5.6-rc-smb3-plugfest-patches' of git://git.samba.org/sfrench/cifs-2.6: smb3: Add defines for new information level, FileIdInformation smb3: print warning once if posix context returned on open smb3: add one more dynamic tracepoint missing from strict fsync path cifs: fix mode bits from dir listing when mounted with modefromsid cifs: fix channel signing cifs: add SMB3 change notification support cifs: make multichannel warning more visible cifs: fix soft mounts hanging in the reconnect code cifs: Add tracepoints for errors on flush or fsync cifs: log warning message (once) if out of disk space cifs: fail i/o on soft mounts if sessionsetup errors out smb3: fix problem with null cifs super block with previous patch SMB3: Backup intent flag missing from some more ops commit 5586c3c1e0eb04cb8b16684aef779e019c8cc64e Merge: 1a2a76c2685a 0fd169576648 Author: Linus Torvalds Date: Sun Feb 9 12:41:00 2020 -0800 Merge branch 'work.vboxsf' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vboxfs from Al Viro: "This is the VirtualBox guest shared folder support by Hans de Goede, with fixups for fs_parse folded in to avoid bisection hazards from those API changes..." * 'work.vboxsf' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: Add VirtualBox guest shared folder (vboxsf) support commit 1a2a76c2685a29e46d7b37e752ccea7b15aa8e24 Merge: f41377609a72 0f378d73d429 Author: Linus Torvalds Date: Sun Feb 9 12:11:12 2020 -0800 Merge tag 'x86-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of fixes for X86: - Ensure that the PIT is set up when the local APIC is disable or configured in legacy mode. This is caused by an ordering issue introduced in the recent changes which skip PIT initialization when the TSC and APIC frequencies are already known. - Handle malformed SRAT tables during early ACPI parsing which caused an infinite loop anda boot hang. - Fix a long standing race in the affinity setting code which affects PCI devices with non-maskable MSI interrupts. The problem is caused by the non-atomic writes of the MSI address (destination APIC id) and data (vector) fields which the device uses to construct the MSI message. The non-atomic writes are mandated by PCI. If both fields change and the device raises an interrupt after writing address and before writing data, then the MSI block constructs a inconsistent message which causes interrupts to be lost and subsequent malfunction of the device. The fix is to redirect the interrupt to the new vector on the current CPU first and then switch it over to the new target CPU. This allows to observe an eventually raised interrupt in the transitional stage (old CPU, new vector) to be observed in the APIC IRR and retriggered on the new target CPU and the new vector. The potential spurious interrupts caused by this are harmless and can in the worst case expose a buggy driver (all handlers have to be able to deal with spurious interrupts as they can and do happen for various reasons). - Add the missing suspend/resume mechanism for the HYPERV hypercall page which prevents resume hibernation on HYPERV guests. This change got lost before the merge window. - Mask the IOAPIC before disabling the local APIC to prevent potentially stale IOAPIC remote IRR bits which cause stale interrupt lines after resume" * tag 'x86-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Mask IOAPIC entries when disabling the local APIC x86/hyperv: Suspend/resume the hypercall page for hibernation x86/apic/msi: Plug non-maskable MSI affinity race x86/boot: Handle malformed SRAT tables during early ACPI parsing x86/timer: Don't skip PIT setup when APIC is disabled or in legacy mode commit f41377609a722fec65f4b0df4e8dc5ea946fb866 Merge: ca21b9b37059 1e474b28e788 Author: Linus Torvalds Date: Sun Feb 9 12:09:43 2020 -0800 Merge tag 'smp-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP fixes from Thomas Gleixner: "Two fixes for the SMP related functionality: - Make the UP version of smp_call_function_single() match SMP semantics when called for a not available CPU. Instead of emitting a warning and assuming that the function call target is CPU0, return a proper error code like the SMP version does. - Remove a superfluous check in smp_call_function_many_cond()" * tag 'smp-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp/up: Make smp_call_function_single() match SMP semantics smp: Remove superfluous cond_func check in smp_call_function_many_cond() commit ca21b9b37059ee07176028de415cc4699db259cb Merge: 2fbc23c73835 45f035748b2a Author: Linus Torvalds Date: Sun Feb 9 12:04:09 2020 -0800 Merge tag 'perf-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A set of fixes and improvements for the perf subsystem: Kernel fixes: - Install cgroup events to the correct CPU context to prevent a potential list double add - Prevent an integer underflow in the perf mlock accounting - Add a missing prototype for arch_perf_update_userpage() Tooling: - Add a missing unlock in the error path of maps__insert() in perf maps. - Fix the build with the latest libbfd - Fix the perf parser so it does not delete parse event terms, which caused a regression for using perf with the ARM CoreSight as the sink configuration was missing due to the deletion. - Fix the double free in the perf CPU map merging test case - Add the missing ustring support for the perf probe command" * tag 'perf-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf maps: Add missing unlock to maps__insert() error case perf probe: Add ustring support for perf probe command perf: Make perf able to build with latest libbfd perf test: Fix test case Merge cpu map perf parse: Copy string to perf_evsel_config_term perf parse: Refactor 'struct perf_evsel_config_term' kernel/events: Add a missing prototype for arch_perf_update_userpage() perf/cgroups: Install cgroup events to correct cpuctx perf/core: Fix mlock accounting in perf_mmap() commit 2fbc23c738350f1a47007da7ad92ae2e4ea63951 Merge: f06bed87d7cd febac332a819 Author: Linus Torvalds Date: Sun Feb 9 12:00:12 2020 -0800 Merge tag 'timers-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Two small fixes for the time(r) subsystem: - Handle a subtle race between the clocksource watchdog and a concurrent clocksource watchdog stop/start sequence correctly to prevent a timer double add bug. - Fix the file path for the core time namespace file" * tag 'timers-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Prevent double add_timer_on() for watchdog_timer MAINTAINERS: Correct path to time namespace source file commit f06bed87d7cdfd51793cbb0111799f39ba75cfa3 Merge: 6ff90aa2cfdd 2f86e45a7f42 Author: Linus Torvalds Date: Sun Feb 9 11:56:41 2020 -0800 Merge tag 'irq-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull interrupt fixes from Thomas Gleixner: "A set of fixes for the interrupt subsystem: - Provision only ACPI enabled redistributors on GICv3 - Use the proper command colums when building the INVALL command for the GICv3-ITS - Ensure the allocation of the L2 vPE table for GICv4.1 - Correct the GICv4.1 VPROBASER programming so it uses the proper size - A set of small GICv4.1 tidy up patches - Configuration cleanup for C-SKY interrupt chip - Clarify the function documentation for irq_set_wake() to document that the wakeup functionality is orthogonal to the irq disable/enable mechanism" * tag 'irq-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Rename VPENDBASER/VPROPBASER accessors irqchip/gic-v3-its: Remove superfluous WARN_ON irqchip/gic-v4.1: Drop 'tmp' in inherit_vpe_l1_table_from_rd() irqchip/gic-v4.1: Ensure L2 vPE table is allocated at RD level irqchip/gic-v4.1: Set vpe_l1_base for all redistributors irqchip/gic-v4.1: Fix programming of GICR_VPROPBASER_4_1_SIZE genirq: Clarify that irq wake state is orthogonal to enable/disable irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL irqchip: Some Kconfig cleanup for C-SKY irqchip/gic-v3: Only provision redistributors that are enabled in ACPI commit 6ff90aa2cfddb1bce5450cb711069315ad17bd14 Merge: fdfa3a6778b1 59365cadfbcd Author: Linus Torvalds Date: Sun Feb 9 11:54:50 2020 -0800 Merge tag 'efi-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Thomas Gleixner: "A single fix for a EFI boot regression on X86 which was caused by the recent rework of the EFI memory map parsing. On systems with invalid memmap entries the cleanup function uses an value which cannot be relied on in this stage. Use the actual EFI memmap entry instead" * tag 'efi-urgent-2020-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/x86: Fix boot regression on systems with invalid memmap entries commit b537916ca5107c3a8714b8ab3099c0ec205aec12 Author: Jens Axboe Date: Sun Feb 9 11:29:15 2020 -0700 io_uring: retain sockaddr_storage across send/recvmsg async punt Jonas reports that he sometimes sees -97/-22 error returns from sendmsg, if it gets punted async. This is due to not retaining the sockaddr_storage between calls. Include that in the state we copy when going async. Cc: stable@vger.kernel.org # 5.3+ Reported-by: Jonas Bonn Tested-by: Jonas Bonn Signed-off-by: Jens Axboe commit c2cebbc4a593bd2ee72d46a8439dcbca512b5507 Author: Zhang Xiaoxu Date: Fri Jan 17 15:34:36 2020 +0800 drm/i915: Fix i915_error_state_store error defination Since commit 742379c0c4001 ("drm/i915: Start chopping up the GPU error capture"), function 'i915_error_state_store' was defined and used with only one parameter. But if no 'CONFIG_DRM_I915_CAPTURE_ERROR', this function was defined with two parameter. This may lead compile error. This patch fix it. Fixes: 742379c0c400 ("drm/i915: Start chopping up the GPU error capture") Reported-by: Hulk Robot Signed-off-by: Zhang Xiaoxu Reviewed-by: Andi Shyti Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200117073436.6507-1-zhangxiaoxu5@huawei.com (cherry picked from commit 04062c58faafddf62006c6f8e5077dc050e8207e) Signed-off-by: Jani Nikula commit 6ab231448fdc5e37c15a94a4700fca11e80007f7 Author: Jens Axboe Date: Sat Feb 8 20:23:59 2020 -0700 io_uring: cancel pending async work if task exits Normally we cancel all work we track, but for untracked work we could leave the async worker behind until that work completes. This is totally fine, but does leave resources pending after the task is gone until that work completes. Cancel work that this task queued up when it goes away. Signed-off-by: Jens Axboe commit 36282881a795cbf717aca79392ae9cdf0fef59c9 Author: Jens Axboe Date: Sat Feb 8 19:16:39 2020 -0700 io-wq: add io_wq_cancel_pid() to cancel based on a specific pid Add a helper that allows the caller to cancel work based on what mm it belongs to. This allows io_uring to cancel work from a given task or thread when it exits. Signed-off-by: Jens Axboe commit 00bcda13dcbf6bf7fa6f2a5886dd555362de8cfa Author: Jens Axboe Date: Sat Feb 8 19:13:32 2020 -0700 io-wq: make io_wqe_cancel_work() take a match handler We want to use the cancel functionality for canceling based on not just the work itself. Instead of matching on the work address manually, allow a match handler to tell us if we found the right work item or not. No functional changes in this patch. Signed-off-by: Jens Axboe commit e73c1486e4c867865fff1cfa0f0315a107ff4c21 Author: Vandita Kulkarni Date: Fri Jan 24 18:28:29 2020 +0530 drm/i915/bios: Fix the timing parameters Fix htotal and vtotal parameters derived from DTD block of VBT. The values miss the back porch. Fixes: 33ef6d4fd8df ("drm/i915/vbt: Handle generic DTD block") Signed-off-by: Vandita Kulkarni Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200124125829.16973-1-vandita.kulkarni@intel.com (cherry picked from commit ad278f358446707d03a1fe89f880e6ac80ca06cd) Signed-off-by: Jani Nikula commit 1788fdf14e518e363bae9d18345d93102f4ee5ad Author: Vivek Kasireddy Date: Fri Jan 17 16:58:48 2020 -0800 drm/i915/dsi: Ensure that the ACPI adapter lookup overrides the bus num Remove the i2c_bus_num >= 0 check from the adapter lookup function as this would prevent ACPI bus number override. This check was mainly there to return early if the bus number has already been found but we anyway return in the next line if the slave address does not match. Fixes: 8cbf89db2941 ("drm/i915/dsi: Parse the I2C element from the VBT MIPI sequence block (v3)") Cc: Hans de Goede Cc: Nabendu Maiti Cc: Matt Roper Cc: Bob Paauwe Cc: Jani Nikula Signed-off-by: Vivek Kasireddy Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200118005848.20382-1-vivek.kasireddy@intel.com (cherry picked from commit de409661c4c90d63cfc64579edbad0a6b10bd50d) Signed-off-by: Jani Nikula commit 0887aa8744aea22c10cd4c36746596d67fa8da98 Author: Ville Syrjälä Date: Wed Jan 15 21:08:09 2020 +0200 drm/i915: Fix post-fastset modeset check for port sync The post-fastset "does anyone still need a full modeset?" for port sync looks busted. The outer loop bails out of a full modeset is still needed by the current crtc, and then we skip forcing a full modeset on the related crtcs. That's totally the opposite of what we want. The MST path has the logic mostly the other way around so it looks correct. To fix the port sync case let's follow the MST logic for both. So, if the current crtc already needs a modeset we do nothing. otherwise we check if any of the related crtcs needs a modeset, and if so we force a full modeset for the current crtc. And while at let's change the else if to a plain if to so we don't have needless coupling between the MST and port sync checks. Cc: José Roberto de Souza Cc: Manasi Navare Fixes: 05a8e45136ca ("drm/i915/display: Use external dependency loop for port sync") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20200115190813.17971-1-ville.syrjala@linux.intel.com Reviewed-by: José Roberto de Souza (cherry picked from commit d0eed1545fe75f115a548691a008e94b0e7abc45) Signed-off-by: Jani Nikula commit 6f4261fa86dfe08c34ad99eba66368f43e9dd4c3 Author: Vivek Kasireddy Date: Tue Jan 14 17:23:05 2020 -0800 drm/i915/dsi: Lookup the i2c bus from ACPI NS only if CONFIG_ACPI=y (v2) Perform the i2c bus/adapter lookup from ACPI Namespace only if ACPI is enabled in the kernel config. If ACPI is not enabled or if the lookup fails, we'll fallback to using the VBT for identifying the i2c bus. v2: Add fixes tag (Jani) Fixes: 8cbf89db2941 ("drm/i915/dsi: Parse the I2C element from the VBT MIPI sequence block (v3)") Cc: Hans de Goede Cc: Nabendu Maiti Cc: Matt Roper Cc: Bob Paauwe Cc: Ville Syrjälä Cc: Jani Nikula Cc: Zhang Xiaoxu Reported-by: Hulk Robot Signed-off-by: Vivek Kasireddy Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20200115012305.27395-1-vivek.kasireddy@intel.com (cherry picked from commit 960287ca58fd549af9826ff1cb735fe17d031486) Signed-off-by: Jani Nikula commit 3508aae9b5618aca727f07c183e25d09033a5b66 Author: Krzysztof Kozlowski Date: Thu Jan 30 20:55:25 2020 +0100 ARM: configs: Cleanup old Kconfig options CONFIG_MMC_BLOCK_BOUNCE is gone since commit c3dccb74be28 ("mmc: core: Delete bounce buffer Kconfig option"). CONFIG_LBDAF is gone since commit 72deb455b5ec ("block: remove CONFIG_LBDAF"). CONFIG_IOSCHED_DEADLINE and CONFIG_IOSCHED_CFQ are gone since commit f382fb0bcef4 ("block: remove legacy IO schedulers"). The IOSCHED_DEADLINE was replaced by MQ_IOSCHED_DEADLINE and it will be now enabled by default (along with MQ_IOSCHED_KYBER). The IOSCHED_BFQ seems to replace IOSCHED_CFQ so select it in configs previously choosing the latter. CONFIG_CROSS_COMPILE is gone since commit f1089c92da79 ("kbuild: remove CONFIG_CROSS_COMPILE support"). Link: https://lore.kernel.org/r/20200130195525.4525-2-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson commit e383e871ab54f073c2a798a9e0bde7f1d0528de8 Author: Krzysztof Kozlowski Date: Thu Jan 30 20:55:24 2020 +0100 ARM: npcm: Bring back GPIOLIB support The CONFIG_ARCH_REQUIRE_GPIOLIB is gone since commit 65053e1a7743 ("gpio: delete ARCH_[WANTS_OPTIONAL|REQUIRE]_GPIOLIB") and all platforms should explicitly select GPIOLIB to have it. Link: https://lore.kernel.org/r/20200130195525.4525-1-krzk@kernel.org Cc: Fixes: 65053e1a7743 ("gpio: delete ARCH_[WANTS_OPTIONAL|REQUIRE]_GPIOLIB") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Olof Johansson commit fdfa3a6778b194974df77b384cc71eb2e503639a Merge: 291abfea4746 e0a514259378 Author: Linus Torvalds Date: Sat Feb 8 17:24:41 2020 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull misc SCSI fixes from James Bottomley: "Five small patches, all in drivers or doc, which missed the initial pull request. The qla2xxx and megaraid_sas are actual fixes and the rest are spelling and doc changes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: fix spelling mistake "initilized" -> "initialized" scsi: pm80xx: fix spelling mistake "to" -> "too" scsi: MAINTAINERS: ufs: remove pedrom.sousa@synopsys.com scsi: megaraid_sas: fixup MSIx interrupt setup during resume scsi: qla2xxx: Fix unbound NVME response length commit 291abfea4746897b821830e0189dc225abd401eb Merge: d4f309ca4118 29ca3b31756f Author: Linus Torvalds Date: Sat Feb 8 17:15:08 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Unbalanced locking in mwifiex_process_country_ie, from Brian Norris. 2) Fix thermal zone registration in iwlwifi, from Andrei Otcheretianski. 3) Fix double free_irq in sgi ioc3 eth, from Thomas Bogendoerfer. 4) Use after free in mptcp, from Florian Westphal. 5) Use after free in wireguard's root_remove_peer_lists, from Eric Dumazet. 6) Properly access packets heads in bonding alb code, from Eric Dumazet. 7) Fix data race in skb_queue_len(), from Qian Cai. 8) Fix regression in r8169 on some chips, from Heiner Kallweit. 9) Fix XDP program ref counting in hv_netvsc, from Haiyang Zhang. 10) Certain kinds of set link netlink operations can cause a NULL deref in the ipv6 addrconf code. Fix from Eric Dumazet. 11) Don't cancel uninitialized work queue in drop monitor, from Ido Schimmel. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (84 commits) net: thunderx: use proper interface type for RGMII mt76: mt7615: fix max_nss in mt7615_eeprom_parse_hw_cap bpf: Improve bucket_log calculation logic selftests/bpf: Test freeing sockmap/sockhash with a socket in it bpf, sockhash: Synchronize_rcu before free'ing map bpf, sockmap: Don't sleep while holding RCU lock on tear-down bpftool: Don't crash on missing xlated program instructions bpf, sockmap: Check update requirements after locking drop_monitor: Do not cancel uninitialized work item mlxsw: spectrum_dpipe: Add missing error path mlxsw: core: Add validation of hardware device types for MGPIR register mlxsw: spectrum_router: Clear offload indication from IPv6 nexthops on abort selftests: mlxsw: Add test cases for local table route replacement mlxsw: spectrum_router: Prevent incorrect replacement of local table routes net: dsa: microchip: enable module autoprobe ipv6/addrconf: fix potential NULL deref in inet6_set_link_af() dpaa_eth: support all modes with rate adapting PHYs net: stmmac: update pci platform data to use phy_interface net: stmmac: xgmac: fix missing IFF_MULTICAST checki in dwxgmac2_set_filter net: stmmac: fix missing IFF_MULTICAST check in dwmac4_set_filter ... commit 0fd169576648452725fa2949bf391d10883d3991 Author: Hans de Goede Date: Thu Dec 12 15:09:14 2019 +0100 fs: Add VirtualBox guest shared folder (vboxsf) support VirtualBox hosts can share folders with guests, this commit adds a VFS driver implementing the Linux-guest side of this, allowing folders exported by the host to be mounted under Linux. This driver depends on the guest <-> host IPC functions exported by the vboxguest driver. Acked-by: Christoph Hellwig Signed-off-by: Hans de Goede Signed-off-by: Al Viro commit d4f309ca411887cd61ea389c7abfb70c2eb1e532 Merge: b0ef7cda8d9b d4bf905307a1 Author: Linus Torvalds Date: Sat Feb 8 14:28:26 2020 -0800 Merge tag 'powerpc-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix an existing bug in our user access handling, exposed by one of the bug fixes we merged this cycle. - A fix for a boot hang on 32-bit with CONFIG_TRACE_IRQFLAGS and the recently added CONFIG_VMAP_STACK. Thanks to: Christophe Leroy, Guenter Roeck. * tag 'powerpc-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Fix CONFIG_TRACE_IRQFLAGS with CONFIG_VMAP_STACK powerpc/futex: Fix incorrect user access blocking commit b0ef7cda8d9be41ba198207c30a037bc470d9aef Author: Linus Torvalds Date: Sat Feb 8 14:19:39 2020 -0800 Fix up remaining devm_ioremap_nocache() in SGI IOC3 8250 UART driver This is a merge error on my part - the driver was merged into mainline by commit c5951e7c8ee5 ("Merge tag 'mips_5.6' of git://../mips/linux") over a week ago, but nobody apparently noticed that it didn't actually build due to still having a reference to the devm_ioremap_nocache() function, removed a few days earlier through commit 6a1000bd2703 ("Merge tag 'ioremap-5.6' of git://../ioremap"). Apparently this didn't get any build testing anywhere. Not perhaps all that surprising: it's restricted to 64-bit MIPS only, and only with the new SGI_MFD_IOC3 support enabled. I only noticed because the ioremap conflicts in the ARM SoC driver update made me check there weren't any others hiding, and I found this one. Signed-off-by: Linus Torvalds commit 4ef1a30c6bd2555d4177fc9286df32e9166d58ba Merge: 5939224ccdcc a832eb203ecd Author: Linus Torvalds Date: Sat Feb 8 14:17:27 2020 -0800 Merge tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC late updates from Olof Johansson: "This is some material that we picked up into our tree late, or that had more complex dependencies on more than one topic branch that makes sense to keep separately. - TI support for secure accelerators and hwrng on OMAP4/5 - TI camera changes for dra7 and am437x and SGX improvement due to better reset control support on am335x, am437x and dra7 - Davinci moves to proper clocksource on DM365, and regulator/audio improvements for DM365 and DM644x eval boards" * tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (32 commits) ARM: dts: omap4-droid4: Enable hdq for droid4 ds250x 1-wire battery nvmem ARM: dts: motorola-cpcap-mapphone: Configure calibration interrupt ARM: dts: Configure interconnect target module for am437x sgx ARM: dts: Configure sgx for dra7 ARM: dts: Configure rstctrl reset for am335x SGX ARM: dts: dra7: Add ti-sysc node for VPE ARM: dts: dra7: add vpe clkctrl node ARM: dts: am43x-epos-evm: Add VPFE and OV2659 entries ARM: dts: am437x-sk-evm: Add VPFE and OV2659 entries ARM: dts: am43xx: add support for clkout1 clock arm: dts: dra76-evm: Add CAL and OV5640 nodes arm: dtsi: dra76x: Add CAL dtsi node arm: dts: dra72-evm-common: Add entries for the CSI2 cameras ARM: dts: DRA72: Add CAL dtsi node ARM: dts: dra7-l4: Add ti-sysc node for CAM ARM: OMAP: DRA7xx: Make CAM clock domain SWSUP only ARM: dts: dra7: add cam clkctrl node ARM: OMAP2+: Drop legacy platform data for omap4 des ARM: OMAP2+: Drop legacy platform data for omap4 sham ARM: OMAP2+: Drop legacy platform data for omap4 aes ... commit 5939224ccdcc9244ab82cdbdc9d21eb019f7db6a Merge: eab3540562fb 1342a6aa4abf Author: Linus Torvalds Date: Sat Feb 8 14:15:41 2020 -0800 Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Olof Johansson: "We keep this in a separate branch to avoid cross-branch conflicts, but most of the material here is fairly boring -- some new drivers turned on for hardware since they were merged, and some refreshed files due to time having moved a lot of entries around" * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (38 commits) ARM: configs: at91: enable MMC_SDHCI_OF_AT91 and MICROCHIP_PIT64B arm64: defconfig: Enable Broadcom's GENET Ethernet controller ARM: multi_v7_defconfig: Enable devfreq thermal integration ARM: exynos_defconfig: Enable devfreq thermal integration ARM: multi_v7_defconfig: Enable NFS v4.1 and v4.2 ARM: exynos_defconfig: Enable NFS v4.1 and v4.2 arm64: defconfig: Enable Actions Semi specific drivers arm64: defconfig: Enable Broadcom's STB PCIe controller arm64: defconfig: Enable CONFIG_CLK_IMX8MP by default ARM: configs: at91: enable config flags for sam9x60 SoC ARM: configs: at91: use savedefconfig arm64: defconfig: Enable tegra XUDC support ARM: defconfig: gemini: Update defconfig arm64: defconfig: enable CONFIG_ARM_QCOM_CPUFREQ_NVMEM arm64: defconfig: enable CONFIG_QCOM_CPR arm64: defconfig: Enable HFPLL arm64: defconfig: Enable CRYPTO_DEV_FSL_CAAM ARM: imx_v6_v7_defconfig: Select the TFP410 driver ARM: imx_v6_v7_defconfig: Enable NFS_V4_1 and NFS_V4_2 support arm64: defconfig: Enable ATH10K_SNOC ... commit eab3540562fb44f830e09492374fcc69a283ce47 Merge: 1afa9c3b7c9b 88b4750151a2 Author: Linus Torvalds Date: Sat Feb 8 14:04:19 2020 -0800 Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC-related driver updates from Olof Johansson: "Various driver updates for platforms: - Nvidia: Fuse support for Tegra194, continued memory controller pieces for Tegra30 - NXP/FSL: Refactorings of QuickEngine drivers to support ARM/ARM64/PPC - NXP/FSL: i.MX8MP SoC driver pieces - TI Keystone: ring accelerator driver - Qualcomm: SCM driver cleanup/refactoring + support for new SoCs. - Xilinx ZynqMP: feature checking interface for firmware. Mailbox communication for power management - Overall support patch set for cpuidle on more complex hierarchies (PSCI-based) and misc cleanups, refactorings of Marvell, TI, other platforms" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (166 commits) drivers: soc: xilinx: Use mailbox IPI callback dt-bindings: power: reset: xilinx: Add bindings for ipi mailbox drivers: soc: ti: knav_qmss_queue: Pass lockdep expression to RCU lists MAINTAINERS: Add brcmstb PCIe controller entry soc/tegra: fuse: Unmap registers once they are not needed anymore soc/tegra: fuse: Correct straps' address for older Tegra124 device trees soc/tegra: fuse: Warn if straps are not ready soc/tegra: fuse: Cache values of straps and Chip ID registers memory: tegra30-emc: Correct error message for timed out auto calibration memory: tegra30-emc: Firm up hardware programming sequence memory: tegra30-emc: Firm up suspend/resume sequence soc/tegra: regulators: Do nothing if voltage is unchanged memory: tegra: Correct reset value of xusb_hostr soc/tegra: fuse: Add APB DMA dependency for Tegra20 bus: tegra-aconnect: Remove PM_CLK dependency dt-bindings: mediatek: add MT6765 power dt-bindings soc: mediatek: cmdq: delete not used define memory: tegra: Add support for the Tegra194 memory controller memory: tegra: Only include support for enabled SoCs memory: tegra: Support DVFS on Tegra186 and later ... commit 1afa9c3b7c9bdcb562e2afe9f58cc99d0b071cdc Merge: 469030d454bd d030a0dd0130 Author: Linus Torvalds Date: Sat Feb 8 13:58:44 2020 -0800 Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM Device-tree updates from Olof Johansson: "New SoCs: - Atmel/Microchip SAM9X60 (ARM926 SoC) - OMAP 37xx gets split into AM3703/AM3715/DM3725, who are all variants of it with different GPU/media IP configurations. - ST stm32mp15 SoCs (1-2 Cortex-A7, CAN, GPU depending on SKU) - ST Ericsson ab8505 (variant of ab8500) and db8520 (variant of db8500) - Unisoc SC9863A SoC (8x Cortex-A55 mobile chipset w/ GPU, modem) - Qualcomm SC7180 (8-core 64bit SoC, unnamed CPU class) New boards: - Allwinner: + Emlid Neutis SoM (H3 variant) + Libre Computer ALL-H3-IT + PineH64 Model B - Amlogic: + Libretech Amlogic GX PC (s905d and s912-based variants) - Atmel/Microchip: + Kizboxmini, sam9x60 EK, sama5d27 Wireless SOM (wlsom1) - Marvell: + Armada 385-based SolidRun Clearfog GTR - NXP: + Gateworks GW59xx boards based on i.MX6/6Q/6QDL + Tolino Shine 3 eBook reader (i.MX6sl) + Embedded Artists COM (i.MX7ULP) + SolidRun CLearfog CX/ITX and HoneyComb (LX2160A-based systems) + Google Coral Edge TPU (i.MX8MQ) - Rockchip: + Radxa Dalang Carrier (supports rk3288 and rk3399 SOMs) + Radxa Rock Pi N10 (RK3399Pro-based) + VMARC RK3399Pro SOM - ST: + Reference boards for stm32mp15 - ST Ericsson: + Samsung Galaxy S III mini (GT-I8190) + HREF520 reference board for DB8520 - TI OMAP: + Gen1 Amazon Echo (OMAP3630-based) - Qualcomm: + Inforce 6640 Single Board Computer (msm8996-based) + SC7180 IDP (SC7180-based)" * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (623 commits) dt-bindings: fix compilation error of the example in marvell,mmp3-hsic-phy.yaml arm64: dts: ti: k3-am654-base-board: Add CSI2 OV5640 camera arm64: dts: ti: k3-am65-main Add CAL node arm64: dts: ti: k3-j721e-main: Add McASP nodes arm64: dts: ti: k3-am654-main: Add McASP nodes arm64: dts: ti: k3-j721e: DMA support arm64: dts: ti: k3-j721e-main: Move secure proxy and smmu under main_navss arm64: dts: ti: k3-j721e-main: Correct main NAVSS representation arm64: dts: ti: k3-j721e: Correct the address for MAIN NAVSS arm64: dts: ti: k3-am65: DMA support arm64: dts: ti: k3-am65-main: Move secure proxy under cbass_main_navss arm64: dts: ti: k3-am65-main: Correct main NAVSS representation ARM: dts: aspeed: rainier: Add UCD90320 power sequencer ARM: dts: aspeed: rainier: Switch PSUs to unknown version arm64: dts: rockchip: Kill off "simple-panel" compatibles ARM: dts: rockchip: Kill off "simple-panel" compatibles arm64: dts: rockchip: rename dwmmc node names to mmc ARM: dts: rockchip: rename dwmmc node names to mmc arm64: dts: exynos: Rename Samsung and Exynos to lowercase arm64: dts: uniphier: add reset-names to NAND controller node ... commit 469030d454bd1620c7b2651d9ec8cdcbaa74deb9 Merge: b85080c106b1 d8430df17211 Author: Linus Torvalds Date: Sat Feb 8 13:55:25 2020 -0800 Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC platform updates from Olof Johansson: "Most of these are smaller fixes that have accrued, and some continued cleanup of OMAP platforms towards shared frameworks. One new SoC from Atmel/Microchip: sam9x60" * tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (35 commits) ARM: OMAP2+: Fix undefined reference to omap_secure_init ARM: s3c64xx: Drop unneeded select of TIMER_OF ARM: exynos: Drop unneeded select of MIGHT_HAVE_CACHE_L2X0 ARM: s3c24xx: Switch to atomic pwm API in rx1950 ARM: OMAP2+: sleep43xx: Call secure suspend/resume handlers ARM: OMAP2+: Use ARM SMC Calling Convention when OP-TEE is available ARM: OMAP2+: Introduce check for OP-TEE in omap_secure_init() ARM: OMAP2+: Add omap_secure_init callback hook for secure initialization ARM: at91: Documentation: add sam9x60 product and datasheet ARM: at91: pm: use of_device_id array to find the proper shdwc node ARM: at91: pm: use SAM9X60 PMC's compatible ARM: imx: only select ARM_ERRATA_814220 for ARMv7-A ARM: zynq: use physical cpuid in zynq_slcr_cpu_stop/start ARM: tegra: Use clk_m CPU on Tegra124 LP1 resume ARM: tegra: Modify reshift divider during LP1 ARM: tegra: Enable PLLP bypass during Tegra124 LP1 ARM: samsung: Rename Samsung and Exynos to lowercase ARM: exynos: Correct the help text for platform Kconfig option ARM: bcm: Select ARM_AMBA for ARCH_BRCMSTB ARM: brcmstb: Add debug UART entry for 7216 ... commit b85080c106b1290eaebf100ee97babef833047d8 Merge: c9d35ee049b4 0a061743af93 Author: Linus Torvalds Date: Sat Feb 8 13:44:41 2020 -0800 Merge tag 'compat-ioctl-fix' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground Pull compat-ioctl fix from Arnd Bergmann: "One patch in the compat-ioctl series broke 32-bit rootfs for multiple people testing on 64-bit kernels. Let's fix it in -rc1 before others run into the same issue" * tag 'compat-ioctl-fix' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: compat_ioctl: fix FIONREAD on devices commit c9d35ee049b40f1d73e890bf88dd55f83b1e9be8 Merge: 236f45329460 f35aa2bc809e Author: Linus Torvalds Date: Sat Feb 8 13:26:41 2020 -0800 Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs file system parameter updates from Al Viro: "Saner fs_parser.c guts and data structures. The system-wide registry of syntax types (string/enum/int32/oct32/.../etc.) is gone and so is the horror switch() in fs_parse() that would have to grow another case every time something got added to that system-wide registry. New syntax types can be added by filesystems easily now, and their namespace is that of functions - not of system-wide enum members. IOW, they can be shared or kept private and if some turn out to be widely useful, we can make them common library helpers, etc., without having to do anything whatsoever to fs_parse() itself. And we already get that kind of requests - the thing that finally pushed me into doing that was "oh, and let's add one for timeouts - things like 15s or 2h". If some filesystem really wants that, let them do it. Without somebody having to play gatekeeper for the variants blessed by direct support in fs_parse(), TYVM. Quite a bit of boilerplate is gone. And IMO the data structures make a lot more sense now. -200LoC, while we are at it" * 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (25 commits) tmpfs: switch to use of invalfc() cgroup1: switch to use of errorfc() et.al. procfs: switch to use of invalfc() hugetlbfs: switch to use of invalfc() cramfs: switch to use of errofc() et.al. gfs2: switch to use of errorfc() et.al. fuse: switch to use errorfc() et.al. ceph: use errorfc() and friends instead of spelling the prefix out prefix-handling analogues of errorf() and friends turn fs_param_is_... into functions fs_parse: handle optional arguments sanely fs_parse: fold fs_parameter_desc/fs_parameter_spec fs_parser: remove fs_parameter_description name field add prefix to fs_context->log ceph_parse_param(), ceph_parse_mon_ips(): switch to passing fc_log new primitive: __fs_parse() switch rbd and libceph to p_log-based primitives struct p_log, variants of warnf() et.al. taking that one instead teach logfc() to handle prefices, give it saner calling conventions get rid of cg_invalf() ... commit 236f45329460f76d058111de1a1cea12f5a8b734 Merge: 995933305e11 12efec560274 Author: Linus Torvalds Date: Sat Feb 8 13:04:49 2020 -0800 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: - bmap series from cmaiolino - getting rid of convolutions in copy_mount_options() (use a couple of copy_from_user() instead of the __get_user() crap) * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: saner copy_mount_options() fibmap: Reject negative block numbers fibmap: Use bmap instead of ->bmap method in ioctl_fibmap ecryptfs: drop direct calls to ->bmap cachefiles: drop direct usage of ->bmap method. fs: Enable bmap() function to properly return errors commit 0bdbdd08a8f991bdaee54465a168c0795ea5d28b Author: Pavel Begunkov Date: Sat Feb 8 13:28:03 2020 +0300 io_uring: fix openat/statx's filename leak As in the previous patch, make openat*_prep() and statx_prep() handle double preparation to avoid resource leakage. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 5f798beaf35d79355cbf18019c1993a84475a2c3 Author: Pavel Begunkov Date: Sat Feb 8 13:28:02 2020 +0300 io_uring: fix double prep iovec leak Requests may be prepared multiple times with ->io allocated (i.e. async prepared). Preparation functions don't handle it and forget about previously allocated resources. This may happen in case of: - spurious defer_check - non-head (i.e. async prepared) request executed in sync (via nxt). Make the handlers check, whether they already allocated resources, which is true IFF REQ_F_NEED_CLEANUP is set. Cc: stable@vger.kernel.org # 5.5 Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a93b33312f63ef6d5997f45d6fdf4de84c5396cc Author: Pavel Begunkov Date: Sat Feb 8 14:04:34 2020 +0300 io_uring: fix async close() with f_op->flush() First, io_close() misses filp_close() and io_cqring_add_event(), when f_op->flush is defined. That's because in this case it will io_queue_async_work() itself not grabbing files, so the corresponding chunk in io_close_finish() won't be executed. Second, when submitted through io_wq_submit_work(), it will do filp_close() and *_add_event() twice: first inline in io_close(), and the second one in call to io_close_finish() from io_close(). The second one will also fire, because it was submitted async through generic path, and so have grabbed files. And the last nice thing is to remove this weird pilgrimage with checking work/old_work and casting it to nxt. Just use a helper instead. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0b5faf6ba7fb78bb1fe7336d23ea1978386a6c3a Author: Jens Axboe Date: Thu Feb 6 21:42:51 2020 -0700 io_uring: allow AT_FDCWD for non-file openat/openat2/statx Don't just check for dirfd == -1, we should allow AT_FDCWD as well for relative lookups. Signed-off-by: Jens Axboe commit ff002b30181d30cdfbca316dadd099c3ca0d739c Author: Jens Axboe Date: Fri Feb 7 16:05:21 2020 -0700 io_uring: grab ->fs as part of async preparation This passes it in to io-wq, so it assumes the right fs_struct when executing async work that may need to do lookups. Cc: stable@vger.kernel.org # 5.3+ Signed-off-by: Jens Axboe commit 9392a27d88b9707145d713654eb26f0c29789e50 Author: Jens Axboe Date: Thu Feb 6 21:42:51 2020 -0700 io-wq: add support for inheriting ->fs Some work items need this for relative path lookup, make it available like the other inherited credentials/mm/etc. Cc: stable@vger.kernel.org # 5.3+ Signed-off-by: Jens Axboe commit faac996ccd5da95bc56b91aa80f2643c2d0a1c56 Author: Jens Axboe Date: Fri Feb 7 15:45:22 2020 -0700 io_uring: retry raw bdev writes if we hit -EOPNOTSUPP For non-blocking issue, we set IOCB_NOWAIT in the kiocb. However, on a raw block device, this yields an -EOPNOTSUPP return, as non-blocking writes aren't supported. Turn this -EOPNOTSUPP into -EAGAIN, so we retry from blocking context with IOCB_NOWAIT cleared. Cc: stable@vger.kernel.org # 5.5 Signed-off-by: Jens Axboe commit 8fef80bf56a49c60b457dedb99fd6c5279a5dbe1 Author: Pavel Begunkov Date: Fri Feb 7 23:59:53 2020 +0300 io_uring: add cleanup for openat()/statx() openat() and statx() may have allocated ->open.filename, which should be be put. Add cleanup handlers for them. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 99bc4c38537d774e667d043c520914082da19abf Author: Pavel Begunkov Date: Fri Feb 7 22:04:45 2020 +0300 io_uring: fix iovec leaks Allocated iovec is freed only in io_{read,write,send,recv)(), and just leaves it if an error occured. There are plenty of such cases: - cancellation of non-head requests - fail grabbing files in __io_queue_sqe() - set REQ_F_NOWAIT and returning in __io_queue_sqe() Add REQ_F_NEED_CLEANUP, which will force such requests with custom allocated resourses go through cleanup handlers on put. Cc: stable@vger.kernel.org # 5.5 Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e96e977992d0ea40b6e70cb63dede85c9078e744 Author: Pavel Begunkov Date: Fri Feb 7 19:21:25 2020 +0300 io_uring: remove unused struct io_async_open struct io_async_open is unused, remove it. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 63e5d81f72af1bf370bf8a6745b0a8d71a7bb37d Author: Stefano Garzarella Date: Fri Feb 7 13:18:28 2020 +0100 io_uring: flush overflowed CQ events in the io_uring_poll() In io_uring_poll() we must flush overflowed CQ events before to check if there are CQ events available, to avoid missing events. We call the io_cqring_events() that checks and flushes any overflow and returns the number of CQ events available. Signed-off-by: Stefano Garzarella Signed-off-by: Jens Axboe commit cf3040ca55f2085b0a372a620ee2cb93ae19b686 Author: Jens Axboe Date: Thu Feb 6 21:31:40 2020 -0700 io_uring: statx/openat/openat2 don't support fixed files All of these opcodes take a directory file descriptor. We can't easily support fixed files for these operations, and the use case for that probably isn't all that clear (or sensible) anyway. Disable IOSQE_FIXED_FILE for these operations. Reported-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit 995933305e11dc8698fdba249ca5f2d145b1d657 Merge: f757165705e9 0ddad21d3e99 Author: Linus Torvalds Date: Sat Feb 8 11:44:02 2020 -0800 Merge branch 'pipe-exclusive-wakeup' Merge thundering herd avoidance on pipe IO. This would have been applied for 5.5 already, but got delayed because of a user-space race condition in the GNU make jobserver code. Now that there's a new GNU make 4.3 release, and most distributions seem to have at least applied the (almost three year old) fix for the problem, let's see if people notice. And it might have been just bad random timing luck on my machine. If you do hit the race condition, things will still work, but the symptom is that you don't get nearly the expected parallelism when using "make -j". The jobserver bug can definitely happen without this patch too, but seems to be easier to trigger when we no longer wake up pipe waiters unnecessarily. * pipe-exclusive-wakeup: pipe: use exclusive waits when reading or writing commit 0ddad21d3e99c743a3aa473121dc5561679e26bb Author: Linus Torvalds Date: Mon Dec 9 09:48:27 2019 -0800 pipe: use exclusive waits when reading or writing This makes the pipe code use separate wait-queues and exclusive waiting for readers and writers, avoiding a nasty thundering herd problem when there are lots of readers waiting for data on a pipe (or, less commonly, lots of writers waiting for a pipe to have space). While this isn't a common occurrence in the traditional "use a pipe as a data transport" case, where you typically only have a single reader and a single writer process, there is one common special case: using a pipe as a source of "locking tokens" rather than for data communication. In particular, the GNU make jobserver code ends up using a pipe as a way to limit parallelism, where each job consumes a token by reading a byte from the jobserver pipe, and releases the token by writing a byte back to the pipe. This pattern is fairly traditional on Unix, and works very well, but will waste a lot of time waking up a lot of processes when only a single reader needs to be woken up when a writer releases a new token. A simplified test-case of just this pipe interaction is to create 64 processes, and then pass a single token around between them (this test-case also intentionally passes another token that gets ignored to test the "wake up next" logic too, in case anybody wonders about it): #include int main(int argc, char **argv) { int fd[2], counters[2]; pipe(fd); counters[0] = 0; counters[1] = -1; write(fd[1], counters, sizeof(counters)); /* 64 processes */ fork(); fork(); fork(); fork(); fork(); fork(); do { int i; read(fd[0], &i, sizeof(i)); if (i < 0) continue; counters[0] = i+1; write(fd[1], counters, (1+(i & 1)) *sizeof(int)); } while (counters[0] < 1000000); return 0; } and in a perfect world, passing that token around should only cause one context switch per transfer, when the writer of a token causes a directed wakeup of just a single reader. But with the "writer wakes all readers" model we traditionally had, on my test box the above case causes more than an order of magnitude more scheduling: instead of the expected ~1M context switches, "perf stat" shows 231,852.37 msec task-clock # 15.857 CPUs utilized 11,250,961 context-switches # 0.049 M/sec 616,304 cpu-migrations # 0.003 M/sec 1,648 page-faults # 0.007 K/sec 1,097,903,998,514 cycles # 4.735 GHz 120,781,778,352 instructions # 0.11 insn per cycle 27,997,056,043 branches # 120.754 M/sec 283,581,233 branch-misses # 1.01% of all branches 14.621273891 seconds time elapsed 0.018243000 seconds user 3.611468000 seconds sys before this commit. After this commit, I get 5,229.55 msec task-clock # 3.072 CPUs utilized 1,212,233 context-switches # 0.232 M/sec 103,951 cpu-migrations # 0.020 M/sec 1,328 page-faults # 0.254 K/sec 21,307,456,166 cycles # 4.074 GHz 12,947,819,999 instructions # 0.61 insn per cycle 2,881,985,678 branches # 551.096 M/sec 64,267,015 branch-misses # 2.23% of all branches 1.702148350 seconds time elapsed 0.004868000 seconds user 0.110786000 seconds sys instead. Much better. [ Note! This kernel improvement seems to be very good at triggering a race condition in the make jobserver (in GNU make 4.2.1) for me. It's a long known bug that was fixed back in June 2017 by GNU make commit b552b0525198 ("[SV 51159] Use a non-blocking read with pselect to avoid hangs."). But there wasn't a new release of GNU make until 4.3 on Jan 19 2020, so a number of distributions may still have the buggy version. Some have backported the fix to their 4.2.1 release, though, and even without the fix it's quite timing-dependent whether the bug actually is hit. ] Josh Triplett says: "I've been hammering on your pipe fix patch (switching to exclusive wait queues) for a month or so, on several different systems, and I've run into no issues with it. The patch *substantially* improves parallel build times on large (~100 CPU) systems, both with parallel make and with other things that use make's pipe-based jobserver. All current distributions (including stable and long-term stable distributions) have versions of GNU make that no longer have the jobserver bug" Tested-by: Josh Triplett Signed-off-by: Linus Torvalds commit 0a061743af93f472687b8c69b0d539d1f12f3fd2 Author: Arnd Bergmann Date: Fri Feb 7 17:55:48 2020 +0100 compat_ioctl: fix FIONREAD on devices My final cleanup patch for sys_compat_ioctl() introduced a regression on the FIONREAD ioctl command, which is used for both regular and special files, but only works on regular files after my patch, as I had missed the warning that Al Viro put into a comment right above it. Change it back so it can work on any file again by moving the implementation to do_vfs_ioctl() instead. Fixes: 77b9040195de ("compat_ioctl: simplify the implementation") Reported-and-tested-by: Christian Zigotzky Reported-and-tested-by: youling257 Signed-off-by: Arnd Bergmann commit 2f86e45a7f427d217f4b94603a9f43a14877e2cc Merge: f9f21cea3113 5186a6cc3ef5 Author: Thomas Gleixner Date: Sat Feb 8 15:54:03 2020 +0100 Merge tag 'irqchip-fixes-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes for 5.6, take #1 from Marc Zyngier: - Guarantee allocation of L2 vPE table for GICv4.1 - Fix GICv4.1 VPROPBASER programming - Numerous GICv4.1 tidy ups - Fix disabled GICv3 redistributor provisioning with ACPI - KConfig cleanup for C-SKY commit 29ca3b31756fb7cfbfc85f2d82a0475bf38cc1ed Author: Tim Harvey Date: Fri Feb 7 12:40:26 2020 -0800 net: thunderx: use proper interface type for RGMII The configuration of the OCTEONTX XCV_DLL_CTL register via xcv_init_hw() is such that the RGMII RX delay is bypassed leaving the RGMII TX delay enabled in the MAC: /* Configure DLL - enable or bypass * TX no bypass, RX bypass */ cfg = readq_relaxed(xcv->reg_base + XCV_DLL_CTL); cfg &= ~0xFF03; cfg |= CLKRX_BYP; writeq_relaxed(cfg, xcv->reg_base + XCV_DLL_CTL); This would coorespond to a interface type of PHY_INTERFACE_MODE_RGMII_RXID and not PHY_INTERFACE_MODE_RGMII. Fixing this allows RGMII PHY drivers to do the right thing (enable RX delay in the PHY) instead of erroneously enabling both delays in the PHY. Signed-off-by: Tim Harvey Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit c76b305c237d013d83e2e75e88b0b2bd427b4b69 Merge: 2696e1146d34 d08f3010f4a3 Author: David S. Miller Date: Sat Feb 8 15:03:11 2020 +0100 Merge tag 'wireless-drivers-2020-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.6 First set of fixes for v5.6. Buffer overflow fixes to mwifiex, quite a few functionality fixes to iwlwifi and smaller fixes to other drivers. mwifiex * fix an unlock from a previous security fix * fix two buffer overflows libertas * fix two bugs from previous security fixes iwlwifi * fix module removal with multiple NICs * don't treat IGTK removal failure as an error * avoid FW crashes due to DTS measurement races * fix a potential use after free in FTM code * prevent a NULL pointer dereference in iwl_mvm_cfg_he_sta() * fix TDLS discovery * check all CPUs when trying to detect an error during resume rtw88 * fix clang warning mt76 * fix reading of max_nss value from a register ==================== Signed-off-by: David S. Miller commit 2696e1146d3490f1af4b0080955bf1628bd8ab85 Merge: dfa7f709596b 88d6f130e563 Author: David S. Miller Date: Sat Feb 8 15:01:03 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2020-02-07 The following pull-request contains BPF updates for your *net* tree. We've added 15 non-merge commits during the last 10 day(s) which contain a total of 12 files changed, 114 insertions(+), 31 deletions(-). The main changes are: 1) Various BPF sockmap fixes related to RCU handling in the map's tear- down code, from Jakub Sitnicki. 2) Fix macro state explosion in BPF sk_storage map when calculating its bucket_log on allocation, from Martin KaFai Lau. 3) Fix potential BPF sockmap update race by rechecking socket's established state under lock, from Lorenz Bauer. 4) Fix crash in bpftool on missing xlated instructions when kptr_restrict sysctl is set, from Toke Høiland-Jørgensen. 5) Fix i40e's XSK wakeup code to return proper error in busy state and various misc fixes in xdpsock BPF sample code, from Maciej Fijalkowski. 6) Fix the way modifiers are skipped in BTF in the verifier while walking pointers to avoid program rejection, from Alexei Starovoitov. 7) Fix Makefile for runqslower BPF tool to i) rebuild on libbpf changes and ii) to fix undefined reference linker errors for older gcc version due to order of passed gcc parameters, from Yulia Kartseva and Song Liu. 8) Fix a trampoline_count BPF kselftest warning about missing braces around initializer, from Andrii Nakryiko. 9) Fix up redundant "HAVE" prefix from large INSN limit kernel probe in bpftool, from Michal Rostecki. ==================== Signed-off-by: David S. Miller commit d4bf905307a1c90a27714ff7a9fd29b0a2ceed98 Author: Christophe Leroy Date: Fri Feb 7 17:20:57 2020 +0000 powerpc: Fix CONFIG_TRACE_IRQFLAGS with CONFIG_VMAP_STACK When CONFIG_PROVE_LOCKING is selected together with (now default) CONFIG_VMAP_STACK, kernel enter deadlock during boot. At the point of checking whether interrupts are enabled or not, the value of MSR saved on stack is read using the physical address of the stack. But at this point, when using VMAP stack the DATA MMU translation has already been re-enabled, leading to deadlock. Don't use the physical address of the stack when CONFIG_VMAP_STACK is set. Signed-off-by: Christophe Leroy Reported-by: Guenter Roeck Fixes: 028474876f47 ("powerpc/32: prepare for CONFIG_VMAP_STACK") Tested-by: Guenter Roeck Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/daeacdc0dec0416d1c587cc9f9e7191ad3068dc0.1581095957.git.christophe.leroy@c-s.fr commit 9dc086f1e9ef39dd823bd27954b884b2062f9e70 Author: Michael Ellerman Date: Fri Feb 7 22:15:46 2020 +1100 powerpc/futex: Fix incorrect user access blocking The early versions of our kernel user access prevention (KUAP) were written by Russell and Christophe, and didn't have separate read/write access. At some point I picked up the series and added the read/write access, but I failed to update the usages in futex.h to correctly allow read and write. However we didn't notice because of another bug which was causing the low-level code to always enable read and write. That bug was fixed recently in commit 1d8f739b07bd ("powerpc/kuap: Fix set direction in allow/prevent_user_access()"). futex_atomic_cmpxchg_inatomic() is passed the user address as %3 and does: 1: lwarx %1, 0, %3 cmpw 0, %1, %4 bne- 3f 2: stwcx. %5, 0, %3 Which clearly loads and stores from/to %3. The logic in arch_futex_atomic_op_inuser() is similar, so fix both of them to use allow_read_write_user(). Without this fix, and with PPC_KUAP_DEBUG=y, we see eg: Bug: Read fault blocked by AMR! WARNING: CPU: 94 PID: 149215 at arch/powerpc/include/asm/book3s/64/kup-radix.h:126 __do_page_fault+0x600/0xf30 CPU: 94 PID: 149215 Comm: futex_requeue_p Tainted: G W 5.5.0-rc7-gcc9x-g4c25df5640ae #1 ... NIP [c000000000070680] __do_page_fault+0x600/0xf30 LR [c00000000007067c] __do_page_fault+0x5fc/0xf30 Call Trace: [c00020138e5637e0] [c00000000007067c] __do_page_fault+0x5fc/0xf30 (unreliable) [c00020138e5638c0] [c00000000000ada8] handle_page_fault+0x10/0x30 --- interrupt: 301 at cmpxchg_futex_value_locked+0x68/0xd0 LR = futex_lock_pi_atomic+0xe0/0x1f0 [c00020138e563bc0] [c000000000217b50] futex_lock_pi_atomic+0x80/0x1f0 (unreliable) [c00020138e563c30] [c00000000021b668] futex_requeue+0x438/0xb60 [c00020138e563d60] [c00000000021c6cc] do_futex+0x1ec/0x2b0 [c00020138e563d90] [c00000000021c8b8] sys_futex+0x128/0x200 [c00020138e563e20] [c00000000000b7ac] system_call+0x5c/0x68 Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection") Cc: stable@vger.kernel.org # v5.2+ Reported-by: syzbot+e808452bad7c375cbee6@syzkaller-ppc64.appspotmail.com Signed-off-by: Michael Ellerman Reviewed-by: Christophe Leroy Link: https://lore.kernel.org/r/20200207122145.11928-1-mpe@ellerman.id.au commit 5186a6cc3ef5a3fa327c258924ef098b0de77006 Author: Zenghui Yu Date: Thu Feb 6 15:57:11 2020 +0800 irqchip/gic-v3-its: Rename VPENDBASER/VPROPBASER accessors V{PEND,PROP}BASER registers are actually located in VLPI_base frame of the *redistributor*. Rename their accessors to reflect this fact. No functional changes. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200206075711.1275-7-yuzenghui@huawei.com commit b46353250ba3b4946adcbbabead23546fcb758b0 Author: Zenghui Yu Date: Thu Feb 6 15:57:10 2020 +0800 irqchip/gic-v3-its: Remove superfluous WARN_ON "ITS virtual pending table not cleaning" is already complained inside its_clear_vpend_valid(), there's no need to trigger a WARN_ON again. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200206075711.1275-6-yuzenghui@huawei.com commit 4bccf1d715fe8f5fe10bd6202c8caa0ae6104cd2 Author: Zenghui Yu Date: Thu Feb 6 15:57:09 2020 +0800 irqchip/gic-v4.1: Drop 'tmp' in inherit_vpe_l1_table_from_rd() The variable 'tmp' in inherit_vpe_l1_table_from_rd() is actually not needed, drop it. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200206075711.1275-5-yuzenghui@huawei.com commit 4e6437f12d6e929e802f5599a2d50dfcf92d0f50 Author: Zenghui Yu Date: Thu Feb 6 15:57:08 2020 +0800 irqchip/gic-v4.1: Ensure L2 vPE table is allocated at RD level In GICv4, we will ensure that level2 vPE table memory is allocated for the specified vpe_id on all v4 ITS, in its_alloc_vpe_table(). This still works well for the typical GICv4.1 implementation, where the new vPE table is shared between the ITSs and the RDs. To make it explicit, let us introduce allocate_vpe_l2_table() to make sure that the L2 tables are allocated on all v4.1 RDs. We're likely not need to allocate memory in it because the vPE table is shared and (L2 table is) already allocated at ITS level, except for the case where the ITS doesn't share anything (say SVPET == 0, practically unlikely but architecturally allowed). The implementation of allocate_vpe_l2_table() is mostly copied from its_alloc_table_entry(). Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200206075711.1275-4-yuzenghui@huawei.com commit 8b718d403c5cdc7f0ea492c33ec88169f3e76462 Author: Zenghui Yu Date: Thu Feb 6 15:57:07 2020 +0800 irqchip/gic-v4.1: Set vpe_l1_base for all redistributors Currently, we will not set vpe_l1_page for the current RD if we can inherit the vPE configuration table from another RD (or ITS), which results in an inconsistency between RDs within the same CommonLPIAff group. Let's rename it to vpe_l1_base to indicate the base address of the vPE configuration table of this RD, and set it properly for *all* v4.1 redistributors. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200206075711.1275-3-yuzenghui@huawei.com commit e88bd316e5971fe78884ad1f466b9fc576575e5f Author: Zenghui Yu Date: Thu Feb 6 15:57:06 2020 +0800 irqchip/gic-v4.1: Fix programming of GICR_VPROPBASER_4_1_SIZE The Size field of GICv4.1 VPROPBASER register indicates number of pages minus one and together Page_Size and Size control the vPEID width. Let's respect this requirement of the architecture. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200206075711.1275-2-yuzenghui@huawei.com commit d08f3010f4a32eec3c8aa771f03a1b342a1472fa Author: Lorenzo Bianconi Date: Fri Feb 7 11:29:51 2020 +0100 mt76: mt7615: fix max_nss in mt7615_eeprom_parse_hw_cap Fix u8 cast reading max_nss from MT_TOP_STRAP_STA register in mt7615_eeprom_parse_hw_cap routine Fixes: acf5457fd99db ("mt76: mt7615: read {tx,rx} mask from eeprom") Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo commit f757165705e92db62f85a1ad287e9251d1f2cd82 Merge: 175787e011ce cabdb4fa2f66 Author: Linus Torvalds Date: Fri Feb 7 17:59:07 2020 -0800 Merge tag 'fuse-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: - Fix a regression introduced in v5.1 that triggers WARNINGs for some fuse filesystems - Fix an xfstest failure - Allow overlayfs to be used on top of fuse/virtiofs - Code and documentation cleanups * tag 'fuse-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: use true,false for bool variable Documentation: filesystems: convert fuse to RST fuse: Support RENAME_WHITEOUT flag fuse: don't overflow LLONG_MAX with end offset fix up iter on short count in fuse_direct_io() commit 175787e011cec507d8e2a1dbf37beef418499bc0 Merge: 60ea27e936f2 6e5e41e2dc4e Author: Linus Torvalds Date: Fri Feb 7 17:54:46 2020 -0800 Merge tag 'gfs2-for-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fixes from Andreas Gruenbacher: - Fix a bug in Abhi Das's journal head lookup improvements that can cause a valid journal to be rejected. - Fix an O_SYNC write handling bug reported by Christoph Hellwig. * tag 'gfs2-for-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: fix O_SYNC write handling gfs2: move setting current->backing_dev_info gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0 commit 60ea27e936f2b9b7f011644a499c292f9cc11de3 Merge: 08dffcc7d94b 9f198a2ac543 Author: Linus Torvalds Date: Fri Feb 7 17:52:38 2020 -0800 Merge tag 'for-linus-5.6-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs fix from Mike Marshall: "Debugfs fix for orangefs. Vasliy Averin noticed that 'if seq_file .next function does not change position index, read after some lseek can generate unexpected output' and sent in this fix" * tag 'for-linus-5.6-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: help_next should increase position index commit 08dffcc7d94b7751663f1b0d66b45ff3a98375a2 Merge: f43574d0ac80 3d96208c30f8 Author: Linus Torvalds Date: Fri Feb 7 17:50:21 2020 -0800 Merge tag 'nfsd-5.6' of git://linux-nfs.org/~bfields/linux Pull nfsd updates from Bruce Fields: "Highlights: - Server-to-server copy code from Olga. To use it, client and both servers must have support, the target server must be able to access the source server over NFSv4.2, and the target server must have the inter_copy_offload_enable module parameter set. - Improvements and bugfixes for the new filehandle cache, especially in the container case, from Trond - Also from Trond, better reporting of write errors. - Y2038 work from Arnd" * tag 'nfsd-5.6' of git://linux-nfs.org/~bfields/linux: (55 commits) sunrpc: expiry_time should be seconds not timeval nfsd: make nfsd_filecache_wq variable static nfsd4: fix double free in nfsd4_do_async_copy() nfsd: convert file cache to use over/underflow safe refcount nfsd: Define the file access mode enum for tracing nfsd: Fix a perf warning nfsd: Ensure sampling of the write verifier is atomic with the write nfsd: Ensure sampling of the commit verifier is atomic with the commit sunrpc: clean up cache entry add/remove from hashtable sunrpc: Fix potential leaks in sunrpc_cache_unhash() nfsd: Ensure exclusion between CLONE and WRITE errors nfsd: Pass the nfsd_file as arguments to nfsd4_clone_file_range() nfsd: Update the boot verifier on stable writes too. nfsd: Fix stable writes nfsd: Allow nfsd_vfs_write() to take the nfsd_file as an argument nfsd: Fix a soft lockup race in nfsd_file_mark_find_or_create() nfsd: Reduce the number of calls to nfsd_file_gc() nfsd: Schedule the laundrette regularly irrespective of file errors nfsd: Remove unused constant NFSD_FILE_LRU_RESCAN nfsd: Containerise filecache laundrette ... commit f43574d0ac80d76537e265548a13b1bc46aa751b Merge: 41dcd67e8868 7dc2993a9e51 Author: Linus Torvalds Date: Fri Feb 7 17:39:56 2020 -0800 Merge tag 'nfs-for-5.6-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Puyll NFS client updates from Anna Schumaker: "Stable bugfixes: - Fix memory leaks and corruption in readdir # v2.6.37+ - Directory page cache needs to be locked when read # v2.6.37+ New features: - Convert NFS to use the new mount API - Add "softreval" mount option to let clients use cache if server goes down - Add a config option to compile without UDP support - Limit the number of inactive delegations the client can cache at once - Improved readdir concurrency using iterate_shared() Other bugfixes and cleanups: - More 64-bit time conversions - Add additional diagnostic tracepoints - Check for holes in swapfiles, and add dependency on CONFIG_SWAP - Various xprtrdma cleanups to prepare for 5.7's changes - Several fixes for NFS writeback and commit handling - Fix acls over krb5i/krb5p mounts - Recover from premature loss of openstateids - Fix NFS v3 chacl and chmod bug - Compare creds using cred_fscmp() - Use kmemdup_nul() in more places - Optimize readdir cache page invalidation - Lease renewal and recovery fixes" * tag 'nfs-for-5.6-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (93 commits) NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals NFSv4: try lease recovery on NFS4ERR_EXPIRED NFS: Fix memory leaks nfs: optimise readdir cache page invalidation NFS: Switch readdir to using iterate_shared() NFS: Use kmemdup_nul() in nfs_readdir_make_qstr() NFS: Directory page cache pages need to be locked when read NFS: Fix memory leaks and corruption in readdir SUNRPC: Use kmemdup_nul() in rpc_parse_scope_id() NFS: Replace various occurrences of kstrndup() with kmemdup_nul() NFSv4: Limit the total number of cached delegations NFSv4: Add accounting for the number of active delegations held NFSv4: Try to return the delegation immediately when marked for return on close NFS: Clear NFS_DELEGATION_RETURN_IF_CLOSED when the delegation is returned NFSv4: nfs_inode_evict_delegation() should set NFS_DELEGATION_RETURNING NFS: nfs_find_open_context() should use cred_fscmp() NFS: nfs_access_get_cached_rcu() should use cred_fscmp() NFSv4: pnfs_roc() must use cred_fscmp() to compare creds NFS: remove unused macros nfs: Return EINVAL rather than ERANGE for mount parse errors ... commit 88d6f130e5632bbf419a2e184ec7adcbe241260b Author: Martin KaFai Lau Date: Fri Feb 7 00:18:10 2020 -0800 bpf: Improve bucket_log calculation logic It was reported that the max_t, ilog2, and roundup_pow_of_two macros have exponential effects on the number of states in the sparse checker. This patch breaks them up by calculating the "nbuckets" first so that the "bucket_log" only needs to take ilog2(). In addition, Linus mentioned: Patch looks good, but I'd like to point out that it's not just sparse. You can see it with a simple make net/core/bpf_sk_storage.i grep 'smap->bucket_log = ' net/core/bpf_sk_storage.i | wc and see the end result: 1 365071 2686974 That's one line (the assignment line) that is 2,686,974 characters in length. Now, sparse does happen to react particularly badly to that (I didn't look to why, but I suspect it's just that evaluating all the types that don't actually ever end up getting used ends up being much more expensive than it should be), but I bet it's not good for gcc either. Fixes: 6ac99e8f23d4 ("bpf: Introduce bpf sk local storage") Reported-by: Randy Dunlap Reported-by: Luc Van Oostenryck Suggested-by: Linus Torvalds Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Reviewed-by: Luc Van Oostenryck Link: https://lore.kernel.org/bpf/20200207081810.3918919-1-kafai@fb.com commit 5d3919a953c3c96c02fc7a337f8376cde43ae31f Author: Jakub Sitnicki Date: Thu Feb 6 12:16:52 2020 +0100 selftests/bpf: Test freeing sockmap/sockhash with a socket in it Commit 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down") introduced sleeping issues inside RCU critical sections and while holding a spinlock on sockmap/sockhash tear-down. There has to be at least one socket in the map for the problem to surface. This adds a test that triggers the warnings for broken locking rules. Not a fix per se, but rather tooling to verify the accompanying fixes. Run on a VM with 1 vCPU to reproduce the warnings. Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down") Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200206111652.694507-4-jakub@cloudflare.com commit 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 Author: Jakub Sitnicki Date: Thu Feb 6 12:16:51 2020 +0100 bpf, sockhash: Synchronize_rcu before free'ing map We need to have a synchronize_rcu before free'ing the sockhash because any outstanding psock references will have a pointer to the map and when they use it, this could trigger a use after free. This is a sister fix for sockhash, following commit 2bb90e5cc90e ("bpf: sockmap, synchronize_rcu before free'ing map") which addressed sockmap, which comes from a manual audit. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200206111652.694507-3-jakub@cloudflare.com commit db6a5018b6e008c1d69c6628cdaa9541b8e70940 Author: Jakub Sitnicki Date: Thu Feb 6 12:16:50 2020 +0100 bpf, sockmap: Don't sleep while holding RCU lock on tear-down rcu_read_lock is needed to protect access to psock inside sock_map_unref when tearing down the map. However, we can't afford to sleep in lock_sock while in RCU read-side critical section. Grab the RCU lock only after we have locked the socket. This fixes RCU warnings triggerable on a VM with 1 vCPU when free'ing a sockmap/sockhash that contains at least one socket: | ============================= | WARNING: suspicious RCU usage | 5.5.0-04005-g8fc91b972b73 #450 Not tainted | ----------------------------- | include/linux/rcupdate.h:272 Illegal context switch in RCU read-side critical section! | | other info that might help us debug this: | | | rcu_scheduler_active = 2, debug_locks = 1 | 4 locks held by kworker/0:1/62: | #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0 | #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0 | #2: ffffffff82065d20 (rcu_read_lock){....}, at: sock_map_free+0x5/0x170 | #3: ffff8881368c5df8 (&stab->lock){+...}, at: sock_map_free+0x64/0x170 | | stack backtrace: | CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04005-g8fc91b972b73 #450 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 | Workqueue: events bpf_map_free_deferred | Call Trace: | dump_stack+0x71/0xa0 | ___might_sleep+0x105/0x190 | lock_sock_nested+0x28/0x90 | sock_map_free+0x95/0x170 | bpf_map_free_deferred+0x58/0x80 | process_one_work+0x260/0x5e0 | worker_thread+0x4d/0x3e0 | kthread+0x108/0x140 | ? process_one_work+0x5e0/0x5e0 | ? kthread_park+0x90/0x90 | ret_from_fork+0x3a/0x50 | ============================= | WARNING: suspicious RCU usage | 5.5.0-04005-g8fc91b972b73-dirty #452 Not tainted | ----------------------------- | include/linux/rcupdate.h:272 Illegal context switch in RCU read-side critical section! | | other info that might help us debug this: | | | rcu_scheduler_active = 2, debug_locks = 1 | 4 locks held by kworker/0:1/62: | #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0 | #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0 | #2: ffffffff82065d20 (rcu_read_lock){....}, at: sock_hash_free+0x5/0x1d0 | #3: ffff888139966e00 (&htab->buckets[i].lock){+...}, at: sock_hash_free+0x92/0x1d0 | | stack backtrace: | CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04005-g8fc91b972b73-dirty #452 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 | Workqueue: events bpf_map_free_deferred | Call Trace: | dump_stack+0x71/0xa0 | ___might_sleep+0x105/0x190 | lock_sock_nested+0x28/0x90 | sock_hash_free+0xec/0x1d0 | bpf_map_free_deferred+0x58/0x80 | process_one_work+0x260/0x5e0 | worker_thread+0x4d/0x3e0 | kthread+0x108/0x140 | ? process_one_work+0x5e0/0x5e0 | ? kthread_park+0x90/0x90 | ret_from_fork+0x3a/0x50 Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down") Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200206111652.694507-2-jakub@cloudflare.com commit d95f1e8b462c4372ac409886070bb8719d8a4d3a Author: Toke Høiland-Jørgensen Date: Thu Feb 6 11:29:06 2020 +0100 bpftool: Don't crash on missing xlated program instructions Turns out the xlated program instructions can also be missing if kptr_restrict sysctl is set. This means that the previous fix to check the jited_prog_insns pointer was insufficient; add another check of the xlated_prog_insns pointer as well. Fixes: 5b79bcdf0362 ("bpftool: Don't crash on missing jited insns or ksyms") Fixes: cae73f233923 ("bpftool: use bpf_program__get_prog_info_linear() in prog.c:do_dump()") Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Daniel Borkmann Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20200206102906.112551-1-toke@redhat.com commit 85b8ac01a421791d66c3a458a7f83cfd173fe3fa Author: Lorenz Bauer Date: Fri Feb 7 10:37:12 2020 +0000 bpf, sockmap: Check update requirements after locking It's currently possible to insert sockets in unexpected states into a sockmap, due to a TOCTTOU when updating the map from a syscall. sock_map_update_elem checks that sk->sk_state == TCP_ESTABLISHED, locks the socket and then calls sock_map_update_common. At this point, the socket may have transitioned into another state, and the earlier assumptions don't hold anymore. Crucially, it's conceivable (though very unlikely) that a socket has become unhashed. This breaks the sockmap's assumption that it will get a callback via sk->sk_prot->unhash. Fix this by checking the (fixed) sk_type and sk_protocol without the lock, followed by a locked check of sk_state. Unfortunately it's not possible to push the check down into sock_(map|hash)_update_common, since BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB run before the socket has transitioned from TCP_SYN_RECV into TCP_ESTABLISHED. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20200207103713.28175-1-lmb@cloudflare.com commit 41dcd67e88688afbeb3b2bd23960eed5daec74e7 Merge: 11777ee8b04a d1c9038ab5c1 Author: Linus Torvalds Date: Fri Feb 7 13:03:10 2020 -0800 Merge tag 'docs-5.6-2' of git://git.lwn.net/linux Pull Documentation fixes from Jonathan Corbet: "A handful of small documentation fixes that wandered in" * tag 'docs-5.6-2' of git://git.lwn.net/linux: Allow git builds of Sphinx Documentation: changes.rst: update several outdated project URLs Documentation: build warnings related to missing blank lines after explicit markups has been fixed mailmap: add entry for Tiezhu Yang Documentation/ko_KR/howto: Update a broken link Documentation/ko_KR/howto: Update broken web addresses docs/locking: Fix outdated section names commit 11777ee8b04acab07c96959e9c6ac6a1603d0958 Merge: ed39ba0ec115 b49f8e0e7bd1 Author: Linus Torvalds Date: Fri Feb 7 12:54:13 2020 -0800 Merge branch 'i2c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "i2c core: - huge improvements and refactorizations of the Linux I2C documentation (lots of thanks to Luca for doing it and Jean for the careful review) - subsystem wide API conversion to i2c_new_client_device() - remove obsolete parport-light driver - smaller core updates (removal of 'extern', enabling more compile testing, use more helper macros) - and quite a bunch of driver updates (new IDs, simplifications, better PM, support of atomic transfers and other improvements) i2c-mux: - The main feature is the idle-state rework of the pca954x driver from Biwen Li at24 driver: - minor maintenance: update the license tag, sort headers - move support for the write-protect pin into nvmem core - add a reference to the new wp-gpios property in nvmem to at25 bindings - add support for regulator and pm_runtime control" * 'i2c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (91 commits) i2c: cros-ec-tunnel: Fix ACPI identifier i2c: cros-ec-tunnel: Fix slave device enumeration i2c: stm32f7: add PM_SLEEP suspend/resume support i2c: cadence: Fix wording in i2c-cadence driver i2c: cadence: Fix power management order of operations i2c: cadence: Fix error printing in case of defer i2c: cadence: Handle transfer_size rollover i2c: i801: Add support for Intel Comet Lake PCH-V docs: i2c: writing-clients: properly name the stop condition docs: i2c: i2c-protocol: use same wording as smbus-protocol docs: i2c: rename sections so the overall picture is clearer docs: i2c: old-module-parameters: use monospace instead of "" docs: i2c: old-module-parameters: clarify this is for obsolete kernels docs: i2c: old-module-parameters: fix internal hyperlink docs: i2c: instantiating-devices: use monospace for sysfs attributes docs: i2c: instantiating-devices: rearrange static instatiation docs: i2c: instantiating-devices: fix internal hyperlink docs: i2c: smbus-protocol: improve I2C Block transactions description docs: i2c: smbus-protocol: fix punctuation docs: i2c: smbus-protocol: fix typo ... commit ed39ba0ec1156407040e7509cb19299b5dda3815 Merge: ba7dcfc7bada dec0a81a7814 Author: Linus Torvalds Date: Fri Feb 7 12:51:54 2020 -0800 Merge tag 'acpi-5.6-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "Add Hisilicon Hip08-Lite I2C controller clock frequency support to the ACPI driver for AMD SoCs (APD) and to the Designware I2C driver (Hanjun Guo)" * tag 'acpi-5.6-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: i2c: designware: Add ACPI HID for Hisilicon Hip08-Lite I2C controller ACPI / APD: Add clock frequency for Hisilicon Hip08-Lite I2C controller commit ba7dcfc7badad87e450e4aaec79662a038dbf9ed Merge: c16b99d6c5a3 332008256f1f Author: Linus Torvalds Date: Fri Feb 7 12:49:10 2020 -0800 Merge tag 'pm-5.6-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: - Update the recently merged CPR (Core Power Reduction) support in the AVS (Adaptive Voltage Scaling) subsystem (Brendan Higgins, Nathan Chancellor, Niklas Cassel) - Update the rockchip-io AVS driver (Heiko Stuebner) - Add two more module parameters to intel_idle on top of the recently merged material (Rafael Wysocki) - Clean up a piece of cpuidle documentation and consolidate system sleep states documentation (Rafael Wysocki) * tag 'pm-5.6-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: Documentation: Clean up PM QoS description Documentation: admin-guide: PM: Update sleep states documentation intel_idle: Introduce 'states_off' module parameter intel_idle: Introduce 'use_acpi' module parameter power: avs: qcom-cpr: Avoid clang -Wsometimes-uninitialized in cpr_scale power: avs: qcom-cpr: add unspecified HAS_IOMEM dependency PM / AVS: rockchip-io: fix the supply naming for the emmc supply on px30 power: avs: qcom-cpr: add a printout after the driver has been initialized commit c16b99d6c5a3f103ae45e33084055a2440d70544 Merge: 8bf5973a4ef0 9f880327160f Author: Linus Torvalds Date: Fri Feb 7 12:46:08 2020 -0800 Merge tag 'drm-next-2020-02-07' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Just some fixes for this merge window: the tegra changes fix some regressions in the merge, nouveau has a few modesetting fixes. The amdgpu fixes are bit bigger, but they contain a couple of weeks of fixes, and don't seem to contain anything that isn't really a fix. Summary: tegra: - merge window regression fixes nouveau: - couple of volta/turing modesetting fixes amdgpu: - EDC fixes for Arcturus - GDDR6 memory training fixe - Fix for reading gfx clockgating registers while in GFXOFF state - i2c freq fixes - Misc display fixes - TLB invalidation fix when using semaphores - VCN 2.5 instancing fixes - Switch raven1 gfxoff to a blacklist - Coreboot workaround for KV/KB - Root cause dongle fixes for display and revert workaround - Enable GPU reset for renoir and navi - Navi overclocking fixes - Fix up confusing warnings in display clock validation on raven amdkfd: - SDMA fix radeon: - Misc LUT fixes" * tag 'drm-next-2020-02-07' of git://anongit.freedesktop.org/drm/drm: (90 commits) gpu: host1x: Set DMA direction only for DMA-mapped buffer objects drm/tegra: Reuse IOVA mapping where possible drm/tegra: Relax IOMMU usage criteria on old Tegra drm/amd/dm/mst: Ignore payload update failures drm/amdgpu: update default voltage for boot od table for navi1x drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c (v2) drm/amdgpu: fetch default VDDC curve voltages (v2) drm/amdgpu/smu_v11_0: Correct behavior of restoring default tables (v2) drm/amdgpu/navi10: add OD_RANGE for navi overclocking drm/amdgpu/navi: fix index for OD MCLK drm/amd/display: Fix HW/SW state mismatch drm/amd/display: Fix a typo when computing dsc configuration drm/amd/powerplay: fix navi10 system intermittent reboot issue V2 drm/amdkfd: Fix a bug in SDMA RLC queue counting under HWS mode drm/amd/display: Only enable cursor on pipes that need it drm/nouveau/kms/gv100-: avoid sending a core update until the first modeset drm/nouveau/kms/gv100-: move window ownership setup into modesetting path drm/nouveau/disp/gv100-: halt NV_PDISP_FE_RM_INTR_STAT_CTRL_DISP_ERROR storms ... commit 8bf5973a4ef0c996d805dc70c2122f08155d14ef Merge: b34f01f76a10 5df867145f8a Author: Linus Torvalds Date: Fri Feb 7 12:40:50 2020 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A collection of fixes: - Make of_clk.h self contained - Fix new qcom DT bindings that just merged to match the DTS files - Fix qcom clk driver to properly detect DFS clk frequencies - Fix the ls1028a driver to not deref a pointer before assigning it" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: of: clk: Make self-contained clk: qcom: Use ARRAY_SIZE in videocc-sc7180 for parent clocks clk: qcom: Get rid of the test clock for videocc-sc7180 dt-bindings: clock: Cleanup qcom,videocc bindings for sdm845/sc7180 clk: qcom: Use ARRAY_SIZE in gpucc-sc7180 for parent clocks clk: qcom: Get rid of the test clock for gpucc-sc7180 dt-bindings: clock: Fix qcom,gpucc bindings for sdm845/sc7180/msm8998 clk: qcom: Use ARRAY_SIZE in dispcc-sc7180 for parent clocks clk: qcom: Get rid of the test clock for dispcc-sc7180 clk: qcom: Get rid of fallback global names for dispcc-sc7180 dt-bindings: clock: Fix qcom,dispcc bindings for sdm845/sc7180 clk: qcom: rcg2: Don't crash if our parent can't be found; return an error clk: ls1028a: fix a dereference of pointer 'parent' before a null check dt-bindings: clk: qcom: Fix self-validation, split, and clean cruft clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq() commit f9f21cea311340f38074ff93a8d89b4a9cae6bcc Author: Stephen Boyd Date: Thu Feb 6 11:15:21 2020 -0800 genirq: Clarify that irq wake state is orthogonal to enable/disable There's some confusion around if an irq that's disabled with disable_irq() can still wake the system from sleep states such as "suspend to RAM". Clarify this in the kernel documentation for irq_set_irq_wake() so that it's clear that an irq can be disabled and still wake the system if it has been marked for wakeup. Signed-off-by: Stephen Boyd Signed-off-by: Thomas Gleixner Reviewed-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200206191521.94559-1-swboyd@chromium.org commit b34f01f76a10386f1877181e4f0631fa2733ecdc Merge: e0f121c5cc2c 057b52b4b3d5 Author: Linus Torvalds Date: Fri Feb 7 12:30:16 2020 -0800 Merge tag 'linux-watchdog-5.6-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add IT8786 chipset ID - addition of sam9x60 compatible watchdog - da9062 improvements - fix UAF in reboot notifier handling in watchdog core code - other fixes and small improvements * tag 'linux-watchdog-5.6-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog: da9062: make restart handler atomic safe watchdog: mtk_wdt: mt2712: Add reset controller watchdog: mtk_wdt: mt8183: Add reset controller dt-bindings: mediatek: mt2712: Add #reset-cells dt-bindings: mediatek: mt8183: Add #reset-cells dt-bindings: watchdog: da9062: add suspend disable option watchdog: it87_wdt: add IT8786 ID watchdog: dw_wdt: ping watchdog to reset countdown before start watchdog: fix UAF in reboot notifier handling in watchdog core code watchdog: cadence: Skip printing pointer value watchdog: qcom: Use platform_get_irq_optional() for bark irq watchdog: da9062: add power management ops watchdog: make DesignWare watchdog allow users to set bigger timeout value drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe watchdog: sama5d4_wdt: addition of sam9x60 compatible watchdog commit e0f121c5cc2cf079d13ebe65b490ca88ba6abe12 Merge: 9b7fa2880fe7 1ad6f58ea936 Author: Linus Torvalds Date: Fri Feb 7 12:26:34 2020 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Some bug fixes/cleanups. The deprecated scsi passthrough for virtio_blk is removed" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_balloon: Fix memory leaks on errors in virtballoon_probe() virtio-balloon: Fix memory leak when unloading while hinting is in progress virtio_balloon: prevent pfn array overflow virtio-blk: remove VIRTIO_BLK_F_SCSI support virtio-pci: check name when counting MSI-X vectors virtio-balloon: initialize all vq callbacks virtio-mmio: convert to devm_platform_ioremap_resource commit 9b7fa2880fe716a30d2359d40d12ec4bc69ec7b5 Merge: 90568ecf5615 c74c0fd2282e Author: Linus Torvalds Date: Fri Feb 7 12:22:29 2020 -0800 Merge tag 'xtensa-20200206' of git://github.com/jcmvbkbc/linux-xtensa Pull xtensa updates from Max Filippov: - reorganize exception vectors placement - small cleanups (drop unused functions/headers/defconfig entries, spelling fixes) * tag 'xtensa-20200206' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: ISS: improve simcall assembly xtensa: reorganize vectors placement xtensa: separate SMP and XIP support xtensa: move fast exception handlers close to vectors arch/xtensa: fix Kconfig typos for HAVE_SMP xtensa: clean up optional XCHAL_* definitions xtensa: drop unused function fast_coprocessor_double xtensa: drop empty platform_* functions from platforms xtensa: clean up platform headers xtensa: drop set_except_vector declaration xtensa: configs: Cleanup old Kconfig IO scheduler options commit f35aa2bc809eacc44c3cee41b52cef1c451d4a89 Author: Al Viro Date: Sat Dec 21 21:35:55 2019 -0500 tmpfs: switch to use of invalfc() Signed-off-by: Al Viro commit 58c025f0e803a45453bb5ada957cbf98163d3048 Author: Al Viro Date: Sat Dec 21 21:35:27 2019 -0500 cgroup1: switch to use of errorfc() et.al. Signed-off-by: Al Viro commit bf45f7fcc4003a8347a172354e2b8b59a259822c Author: Al Viro Date: Sat Dec 21 21:34:41 2019 -0500 procfs: switch to use of invalfc() Signed-off-by: Al Viro commit b5db30cfb9793fca05f6448ad68430ac7374bbdd Author: Al Viro Date: Sat Dec 21 21:34:06 2019 -0500 hugetlbfs: switch to use of invalfc() Signed-off-by: Al Viro commit e1ee7d8511f1b9305545837aa31358de3389c72c Author: Al Viro Date: Sat Dec 21 21:33:45 2019 -0500 cramfs: switch to use of errofc() et.al. Signed-off-by: Al Viro commit 77cb271e6a5189613f55834f4fa448c004963bb6 Author: Al Viro Date: Sat Dec 21 21:33:17 2019 -0500 gfs2: switch to use of errorfc() et.al. Signed-off-by: Al Viro commit 2e28c49ea648d29c3d7b625ea6996addf28335ec Author: Al Viro Date: Sat Dec 21 21:32:51 2019 -0500 fuse: switch to use errorfc() et.al. Signed-off-by: Al Viro commit d53d0f7461a52b08b0146156d79c64c0842fd38d Author: Al Viro Date: Sat Dec 21 21:31:52 2019 -0500 ceph: use errorfc() and friends instead of spelling the prefix out Signed-off-by: Al Viro commit a3ff937b33d9dfd0923ac5279d87723048599057 Author: Al Viro Date: Sat Dec 21 21:30:50 2019 -0500 prefix-handling analogues of errorf() and friends called errorfc/infofc/warnfc/invalfc Signed-off-by: Al Viro commit 328de5287b10abc967c517461cf2948bd8a5b4e9 Author: Al Viro Date: Wed Dec 18 00:02:31 2019 -0500 turn fs_param_is_... into functions Signed-off-by: Al Viro commit 48ce73b1bef20331007b35de7ade8fe26cd55e84 Author: Al Viro Date: Tue Dec 17 20:03:59 2019 -0500 fs_parse: handle optional arguments sanely Don't bother with "mixed" options that would allow both the form with and without argument (i.e. both -o foo and -o foo=bar). Rather than trying to shove both into a single fs_parameter_spec, allow having with-argument and no-argument specs with the same name and teach fs_parse to handle that. There are very few options of that sort, and they are actually easier to handle that way - callers end up with less postprocessing. Signed-off-by: Al Viro commit d7167b149943e38ad610191ecbb0800c78bbced9 Author: Al Viro Date: Sat Sep 7 07:23:15 2019 -0400 fs_parse: fold fs_parameter_desc/fs_parameter_spec The former contains nothing but a pointer to an array of the latter... Signed-off-by: Al Viro commit 96cafb9ccb153f6a82ff2c9bde68916d9d65501e Author: Eric Sandeen Date: Fri Dec 6 10:45:01 2019 -0600 fs_parser: remove fs_parameter_description name field Unused now. Signed-off-by: Eric Sandeen Acked-by: David Howells Signed-off-by: Al Viro commit cc3c0b533ab9142eac2e291628fbfca3685f38cd Author: Al Viro Date: Sat Dec 21 00:16:49 2019 -0500 add prefix to fs_context->log ... turning it into struct p_log embedded into fs_context. Initialize the prefix with fs_type->name, turning fs_parse() into a trivial inline wrapper for __fs_parse(). This makes fs_parameter_description->name completely unused. Signed-off-by: Al Viro commit c80c98f0dc5dc709b04254b5f30145c6ab8800a4 Author: Al Viro Date: Sat Dec 21 00:06:01 2019 -0500 ceph_parse_param(), ceph_parse_mon_ips(): switch to passing fc_log ... and now errorf() et.al. are never called with NULL fs_context, so we can get rid of conditional in those. Signed-off-by: Al Viro commit 7f5d38141e309bb4ba995d9726928af85a299c50 Author: Al Viro Date: Fri Dec 20 23:52:55 2019 -0500 new primitive: __fs_parse() fs_parse() analogue taking p_log instead of fs_context. fs_parse() turned into a wrapper, callers in ceph_common and rbd switched to __fs_parse(). As the result, fs_parse() never gets NULL fs_context and neither do fs_context-based logging primitives Signed-off-by: Al Viro commit 2c3f3dc315565941262e980029c0f74ad118231a Author: Al Viro Date: Fri Dec 20 23:43:32 2019 -0500 switch rbd and libceph to p_log-based primitives Signed-off-by: Al Viro commit 3fbb8d5554a1481d9c5f54ee7dc59f416650efb1 Author: Al Viro Date: Fri Dec 20 23:43:32 2019 -0500 struct p_log, variants of warnf() et.al. taking that one instead primitives for prefixed logging Signed-off-by: Al Viro commit 9f09f649ca3350cdb49c81f7d5ac6e64a4d7e1a1 Author: Al Viro Date: Fri Dec 20 22:10:36 2019 -0500 teach logfc() to handle prefices, give it saner calling conventions Signed-off-by: Al Viro commit fbc2d1686dc5c2e403091f3c25ca2bc16f88cccb Author: Al Viro Date: Fri Dec 20 21:06:08 2019 -0500 get rid of cg_invalf() pointless alias for invalf()... Signed-off-by: Al Viro commit aa1918f9491442a007a0cbe41a31539233209777 Author: Al Viro Date: Tue Dec 17 20:09:08 2019 -0500 get rid of fs_value_is_filename_empty Its behaviour is identical to that of fs_value_is_filename. It makes no sense, anyway - LOOKUP_EMPTY affects nothing whatsoever once the pathname has been imported from userland. And both fs_value_is_filename and fs_value_is_filename_empty carry an already imported pathname. Signed-off-by: Al Viro commit 34264ae3fa22429ec4fd9151602342d1f21486eb Author: Al Viro Date: Mon Dec 16 13:45:41 2019 -0500 don't bother with explicit length argument for __lookup_constant() Have the arrays of constant_table self-terminated (by NULL ->name in the final entry). Simplifies lookup_constant() and allows to reuse the search for enum params as well. Signed-off-by: Al Viro commit 3d96208c30f84d6edf9ab4fac813306ac0d20c10 Author: Roberto Bergantinos Corpas Date: Tue Feb 4 11:32:56 2020 +0100 sunrpc: expiry_time should be seconds not timeval When upcalling gssproxy, cache_head.expiry_time is set as a timeval, not seconds since boot. As such, RPC cache expiry logic will not clean expired objects created under auth.rpcsec.context cache. This has proven to cause kernel memory leaks on field. Using 64 bit variants of getboottime/timespec Expiration times have worked this way since 2010's c5b29f885afe "sunrpc: use seconds since boot in expiry cache". The gssproxy code introduced in 2012 added gss_proxy_save_rsc and introduced the bug. That's a while for this to lurk, but it required a bit of an extreme case to make it obvious. Signed-off-by: Roberto Bergantinos Corpas Cc: stable@vger.kernel.org Fixes: 030d794bf498 "SUNRPC: Use gssproxy upcall for server..." Tested-By: Frank Sorenson Signed-off-by: J. Bruce Fields commit 50d0def966a5f1237ba647e827a945e8ece4c10b Author: Chen Zhou Date: Mon Feb 3 09:43:57 2020 +0800 nfsd: make nfsd_filecache_wq variable static Fix sparse warning: fs/nfsd/filecache.c:55:25: warning: symbol 'nfsd_filecache_wq' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: Chen Zhou Signed-off-by: J. Bruce Fields commit dfa7f709596be5ca46c070d4f8acbb344322056a Author: Ido Schimmel Date: Fri Feb 7 19:29:28 2020 +0200 drop_monitor: Do not cancel uninitialized work item Drop monitor uses a work item that takes care of constructing and sending netlink notifications to user space. In case drop monitor never started to monitor, then the work item is uninitialized and not associated with a function. Therefore, a stop command from user space results in canceling an uninitialized work item which leads to the following warning [1]. Fix this by not processing a stop command if drop monitor is not currently monitoring. [1] [ 31.735402] ------------[ cut here ]------------ [ 31.736470] WARNING: CPU: 0 PID: 143 at kernel/workqueue.c:3032 __flush_work+0x89f/0x9f0 ... [ 31.738120] CPU: 0 PID: 143 Comm: dwdump Not tainted 5.5.0-custom-09491-g16d4077796b8 #727 [ 31.741968] RIP: 0010:__flush_work+0x89f/0x9f0 ... [ 31.760526] Call Trace: [ 31.771689] __cancel_work_timer+0x2a6/0x3b0 [ 31.776809] net_dm_cmd_trace+0x300/0xef0 [ 31.777549] genl_rcv_msg+0x5c6/0xd50 [ 31.781005] netlink_rcv_skb+0x13b/0x3a0 [ 31.784114] genl_rcv+0x29/0x40 [ 31.784720] netlink_unicast+0x49f/0x6a0 [ 31.787148] netlink_sendmsg+0x7cf/0xc80 [ 31.790426] ____sys_sendmsg+0x620/0x770 [ 31.793458] ___sys_sendmsg+0xfd/0x170 [ 31.802216] __sys_sendmsg+0xdf/0x1a0 [ 31.806195] do_syscall_64+0xa0/0x540 [ 31.806885] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 8e94c3bc922e ("drop_monitor: Allow user to start monitoring hardware drops") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit e036c587cabe64264e27c489b155cb72f8e4b565 Merge: f8c2afa66d53 3a99cbb6fa7b Author: David S. Miller Date: Fri Feb 7 18:47:01 2020 +0100 Merge branch 'mlxsw-Various-fixes' Ido Schimmel says: ==================== mlxsw: Various fixes This patch set contains various fixes for the mlxsw driver. Patch #1 fixes an issue introduced in 5.6 in which a route in the main table can replace an identical route in the local table despite the local table having an higher precedence. Patch #2 contains a test case for the bug fixed in patch #1. Patch #3 also fixes an issue introduced in 5.6 in which the driver failed to clear the offload indication from IPv6 nexthops upon abort. Patch #4 fixes an issue that prevents the driver from loading on Spectrum-3 systems. The problem and solution are explained in detail in the commit message. Patch #5 adds a missing error path. Discovered using smatch. ==================== Signed-off-by: David S. Miller commit 3a99cbb6fa7bca1995586ec2dc21b0368aad4937 Author: Ido Schimmel Date: Fri Feb 7 19:26:28 2020 +0200 mlxsw: spectrum_dpipe: Add missing error path In case devlink_dpipe_entry_ctx_prepare() failed, release RTNL that was previously taken and free the memory allocated by mlxsw_sp_erif_entry_prepare(). Fixes: 2ba5999f009d ("mlxsw: spectrum: Add Support for erif table entries access") Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 36844c855b896f90bab51ccecf72940eb7e3cfe1 Author: Vadim Pasternak Date: Fri Feb 7 19:26:27 2020 +0200 mlxsw: core: Add validation of hardware device types for MGPIR register When reading the number of gearboxes from the hardware, the driver does not validate the returned 'device type' field. The driver can therefore wrongly assume that the queried devices are gearboxes. On Spectrum-3 systems that support different types of devices, this can prevent the driver from loading, as it will try to query the temperature sensors from devices which it assumes are gearboxes and in fact are not. For example: [ 218.129230] mlxsw_minimal 2-0048: Reg cmd access status failed (status=7(bad parameter)) [ 218.138282] mlxsw_minimal 2-0048: Reg cmd access failed (reg_id=900a(mtmp),type=write) [ 218.147131] mlxsw_minimal 2-0048: Failed to setup temp sensor number 256 [ 218.534480] mlxsw_minimal 2-0048: Fail to register core bus [ 218.540714] mlxsw_minimal: probe of 2-0048 failed with error -5 Fix this by validating the 'device type' field. Fixes: 2e265a8b6c094 ("mlxsw: core: Extend hwmon interface with inter-connect temperature attributes") Fixes: f14f4e621b1b4 ("mlxsw: core: Extend thermal core with per inter-connect device thermal zones") Signed-off-by: Vadim Pasternak Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 490f0542a7f75572c841afa92da83b549e7d47f9 Author: Ido Schimmel Date: Fri Feb 7 19:26:26 2020 +0200 mlxsw: spectrum_router: Clear offload indication from IPv6 nexthops on abort Unlike IPv4, in IPv6 there is no unique structure to represent the nexthop and both the route and nexthop information are squashed to the same structure ('struct fib6_info'). In order to improve resource utilization the driver consolidates identical nexthop groups to the same internal representation of a nexthop group. Therefore, when the offload indication of a nexthop changes, the driver needs to iterate over all the linked fib6_info and toggle their offload flag accordingly. During abort, all the routes are removed from the device and unlinked from their nexthop group. The offload indication is cleared just before the group is destroyed, but by that time no fib6_info is linked to the group and the offload indication remains set. Fix this by clearing the offload indication just before dropping the reference from the nexthop. Fixes: ee5a0448e72b ("mlxsw: spectrum_router: Set hardware flags for routes") Reported-by: Alex Kushnarov Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Tested-by: Alex Kushnarov Signed-off-by: David S. Miller commit 6c05ca26f1153b4346ffd03cf65910ecc9cabbbf Author: Ido Schimmel Date: Fri Feb 7 19:26:25 2020 +0200 selftests: mlxsw: Add test cases for local table route replacement Test that routes in the main table do not replace identical routes in the local table and that routes in the local table do replace identical routes in the main table. Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 0508ff8934f40b52a78313049b96eec29a46ba49 Author: Ido Schimmel Date: Fri Feb 7 19:26:24 2020 +0200 mlxsw: spectrum_router: Prevent incorrect replacement of local table routes The driver uses the same table to represent both the main and local routing tables. Prevent routes in the main table from replacing routes in the local table to reflect the fact that the local table is consulted first during lookup. Fixes: b6a1d871d37a ("mlxsw: spectrum_router: Start using new IPv4 route notifications") Fixes: dacad7b34b59 ("mlxsw: spectrum_router: Start using new IPv6 route notifications") Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit f8c2afa66d5397b0b9293c4347dac6dabb327685 Author: Razvan Stefanescu Date: Fri Feb 7 17:44:04 2020 +0200 net: dsa: microchip: enable module autoprobe This matches /sys/devices/.../spi1.0/modalias content. Fixes: 9b2d9f05cddf ("net: dsa: microchip: add ksz9567 to ksz9477 driver") Fixes: d9033ae95cf4 ("net: dsa: microchip: add KSZ8563 compatibility string") Fixes: 8c29bebb1f8a ("net: dsa: microchip: add KSZ9893 switch support") Fixes: 45316818371d ("net: dsa: add support for ksz9897 ethernet switch") Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") Signed-off-by: Razvan Stefanescu Signed-off-by: Codrin Ciubotariu Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit db3fa271022dacb9f741b96ea4714461a8911bb9 Author: Eric Dumazet Date: Fri Feb 7 07:16:37 2020 -0800 ipv6/addrconf: fix potential NULL deref in inet6_set_link_af() __in6_dev_get(dev) called from inet6_set_link_af() can return NULL. The needed check has been recently removed, let's add it back. While do_setlink() does call validate_linkmsg() : ... err = validate_linkmsg(dev, tb); /* OK at this point */ ... It is possible that the following call happening before the ->set_link_af() removes IPv6 if MTU is less than 1280 : if (tb[IFLA_MTU]) { err = dev_set_mtu_ext(dev, nla_get_u32(tb[IFLA_MTU]), extack); if (err < 0) goto errout; status |= DO_SETLINK_MODIFIED; } ... if (tb[IFLA_AF_SPEC]) { ... err = af_ops->set_link_af(dev, af); ->inet6_set_link_af() // CRASH because idev is NULL Please note that IPv4 is immune to the bug since inet_set_link_af() does : struct in_device *in_dev = __in_dev_get_rcu(dev); if (!in_dev) return -EAFNOSUPPORT; This problem has been mentioned in commit cf7afbfeb8ce ("rtnl: make link af-specific updates atomic") changelog : This method is not fail proof, while it is currently sufficient to make set_link_af() inerrable and thus 100% atomic, the validation function method will not be able to detect all error scenarios in the future, there will likely always be errors depending on states which are f.e. not protected by rtnl_mutex and thus may change between validation and setting. IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] CPU: 0 PID: 9698 Comm: syz-executor712 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:inet6_set_link_af+0x66e/0xae0 net/ipv6/addrconf.c:5733 Code: 38 d0 7f 08 84 c0 0f 85 20 03 00 00 48 8d bb b0 02 00 00 45 0f b6 64 24 04 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 44 89 a3 b0 02 00 RSP: 0018:ffffc90005b06d40 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86df39a6 RDX: 0000000000000056 RSI: ffffffff86df3e74 RDI: 00000000000002b0 RBP: ffffc90005b06e70 R08: ffff8880a2ac0380 R09: ffffc90005b06db0 R10: fffff52000b60dbe R11: ffffc90005b06df7 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8880a1fcc424 R15: dffffc0000000000 FS: 0000000000c46880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f0494ca0d0 CR3: 000000009e4ac000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_setlink+0x2a9f/0x3720 net/core/rtnetlink.c:2754 rtnl_group_changelink net/core/rtnetlink.c:3103 [inline] __rtnl_newlink+0xdd1/0x1790 net/core/rtnetlink.c:3257 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3377 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5438 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5456 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4402e9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffd62fbcf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402e9 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000008 R09: 00000000004002c8 R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000401b70 R13: 0000000000401c00 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace cfa7664b8fdcdff3 ]--- RIP: 0010:inet6_set_link_af+0x66e/0xae0 net/ipv6/addrconf.c:5733 Code: 38 d0 7f 08 84 c0 0f 85 20 03 00 00 48 8d bb b0 02 00 00 45 0f b6 64 24 04 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 44 89 a3 b0 02 00 RSP: 0018:ffffc90005b06d40 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86df39a6 RDX: 0000000000000056 RSI: ffffffff86df3e74 RDI: 00000000000002b0 RBP: ffffc90005b06e70 R08: ffff8880a2ac0380 R09: ffffc90005b06db0 R10: fffff52000b60dbe R11: ffffc90005b06df7 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8880a1fcc424 R15: dffffc0000000000 FS: 0000000000c46880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000004 CR3: 000000009e4ac000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 7dc2bccab0ee ("Validate required parameters in inet6_validate_link_af") Signed-off-by: Eric Dumazet Bisected-and-reported-by: syzbot Cc: Maxim Mikityanskiy Signed-off-by: David S. Miller commit a7da92c2c8a1faf253a3b3e292fda6910deba540 Author: Florian Westphal Date: Mon Feb 3 13:06:18 2020 +0100 netfilter: flowtable: skip offload setup if disabled nftables test case tests/shell/testcases/flowtable/0001flowtable_0 results in a crash. After the refactor, if we leave early via nf_flowtable_hw_offload(), then "struct flow_block_offload" is left in an uninitialized state, but later users assume its initialised. Fixes: a7965d58ddab02 ("netfilter: flowtable: add nf_flow_table_offload_cmd()") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8d0015a7ab76b8b1e89a3e5f5710a6e5103f2dd5 Author: Cong Wang Date: Sun Feb 2 20:30:53 2020 -0800 netfilter: xt_hashlimit: limit the max size of hashtable The user-specified hashtable size is unbound, this could easily lead to an OOM or a hung task as we hold the global mutex while allocating and initializing the new hashtable. Add a max value to cap both cfg->size and cfg->max, as suggested by Florian. Reported-and-tested-by: syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com Signed-off-by: Cong Wang Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c4a3922d2d20c710f827d3a115ee338e8d0467df Author: Cong Wang Date: Sun Feb 2 20:30:52 2020 -0800 netfilter: xt_hashlimit: reduce hashlimit_mutex scope for htable_put() It is unnecessary to hold hashlimit_mutex for htable_destroy() as it is already removed from the global hashtable and its refcount is already zero. Also, switch hinfo->use to refcount_t so that we don't have to hold the mutex until it reaches zero in htable_put(). Reported-and-tested-by: syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com Acked-by: Florian Westphal Signed-off-by: Cong Wang Signed-off-by: Pablo Neira Ayuso commit 1e474b28e78897d0d170fab3b28ba683149cb9ea Author: Paul E. McKenney Date: Wed Feb 5 06:34:09 2020 -0800 smp/up: Make smp_call_function_single() match SMP semantics In CONFIG_SMP=y kernels, smp_call_function_single() returns -ENXIO when invoked for a non-existent CPU. In contrast, in CONFIG_SMP=n kernels, a splat is emitted and smp_call_function_single() otherwise silently ignores its "cpu" argument, instead pretending that the caller intended to have something happen on CPU 0. Given that there is now code that expects smp_call_function_single() to return an error if a bad CPU was specified, this difference in semantics needs to be addressed. Bring the semantics of the CONFIG_SMP=n version of smp_call_function_single() into alignment with its CONFIG_SMP=y counterpart. Signed-off-by: Paul E. McKenney Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20200205143409.GA7021@paulmck-ThinkPad-P72 commit 0f378d73d429d5f73fe2f00be4c9a15dbe9779ee Author: Tony W Wang-oc Date: Wed Jan 15 16:22:19 2020 +0800 x86/apic: Mask IOAPIC entries when disabling the local APIC When a system suspends, the local APIC is disabled in the suspend sequence, but the IOAPIC is left in the current state. This means unmasked interrupt lines stay unmasked. This is usually the case for IOAPIC pin 9 to which the ACPI interrupt is connected. That means that in suspended state the IOAPIC can respond to an external interrupt, e.g. the wakeup via keyboard/RTC/ACPI, but the interrupt message cannot be handled by the disabled local APIC. As a consequence the Remote IRR bit is set, but the local APIC does not send an EOI to acknowledge it. This causes the affected interrupt line to become stale and the stale Remote IRR bit will cause a hang when __synchronize_hardirq() is invoked for that interrupt line. To prevent this, mask all IOAPIC entries before disabling the local APIC. The resume code already has the unmask operation inside. [ tglx: Massaged changelog ] Signed-off-by: Tony W Wang-oc Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/1579076539-7267-1-git-send-email-TonyWWang-oc@zhaoxin.com commit 73a21fa817f0cc8022dc6226250a86bca727a56d Author: Madalin Bucur Date: Tue Feb 4 12:08:58 2020 +0200 dpaa_eth: support all modes with rate adapting PHYs Stop removing modes that are not supported on the system interface when the connected PHY is capable of rate adaptation. This addresses an issue with the LS1046ARDB board 10G interface no longer working with an 1G link partner after autonegotiation support was added for the Aquantia PHY on board in commit 09c4c57f7bc4 ("net: phy: aquantia: add support for auto-negotiation configuration") Before this commit the values advertised by the PHY were not influenced by the dpaa_eth driver removal of system-side unsupported modes as the aqr_config_aneg() was basically a no-op. After this commit, the modes removed by the dpaa_eth driver were no longer advertised thus autonegotiation with 1G link partners failed. Reported-by: Mian Yousaf Kaukab Signed-off-by: Madalin Bucur Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit bfb7bac3a8f47100ebe7961bd14e924c96e21ca7 Author: Sergey Matyukevich Date: Mon Feb 3 10:56:50 2020 +0000 cfg80211: check wiphy driver existence for drvinfo report When preparing ethtool drvinfo, check if wiphy driver is defined before dereferencing it. Driver may not exist, e.g. if wiphy is attached to a virtual platform device. Signed-off-by: Sergey Matyukevich Link: https://lore.kernel.org/r/20200203105644.28875-1-sergey.matyukevich.os@quantenna.com Signed-off-by: Johannes Berg commit a04564c99bb4a92f805a58e56b2d22cc4978f152 Author: Johannes Berg Date: Fri Jan 31 13:12:58 2020 +0200 mac80211: consider more elements in parsing CRC We only use the parsing CRC for checking if a beacon changed, and elements with an ID > 63 cannot be represented in the filter. Thus, like we did before with WMM and Cisco vendor elements, just statically add these forgotten items to the CRC: - WLAN_EID_VHT_OPERATION - WLAN_EID_OPMODE_NOTIF I guess that in most cases when VHT/HE operation change, the HT operation also changed, and so the change was picked up, but we did notice that pure operating mode notification changes were ignored. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/20200131111300.891737-22-luca@coelho.fi [restrict to VHT for the mac80211 branch] Signed-off-by: Johannes Berg commit 2bf973ff9b9aeceb8acda629ae65341820d4b35b Author: Sara Sharon Date: Fri Jan 31 13:12:51 2020 +0200 mac80211: fix quiet mode activation in action frames Previously I intended to ignore quiet mode in probe response, however I ended up ignoring it instead for action frames. As a matter of fact, this path isn't invoked for probe responses to start with. Just revert this patch. Signed-off-by: Sara Sharon Fixes: 7976b1e9e3bf ("mac80211: ignore quiet mode in probe") Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/20200131111300.891737-15-luca@coelho.fi Signed-off-by: Johannes Berg commit 259039fa30457986929a324d769f543c1509987f Merge: 184367dce4f7 909c1dde67c4 Author: David S. Miller Date: Fri Feb 7 11:36:22 2020 +0100 Merge branch 'stmmac-fixes' Ong Boon Leong says: ==================== net: stmmac: general fixes for Ethernet functionality 1/5: It ensures that the previous value of GMAC_VLAN_TAG register is read first before for updating the register. 2/5: Similar to 2/6 patch but it is a fix for XGMAC_VLAN_TAG register as requested by Jose Abreu. 3/5: It ensures the GMAC IP v4.xx and above behaves correctly to:- ip link set multicast off|on 4/5: Added similar IFF_MULTICAST flag for xgmac2, similar to 4/6. 5/5: It ensures PCI platform data is using plat->phy_interface. Changes from v4:- patch 1/6 - this patch is dropped now and will take the input on handling return value from netif_set_real_num_rx| tx_queues() in future patch series. v3:- patch 1/6 - add rtnl_lock() and rtnl_unlock() for stmmac_hw_setup() called inside stmmac_resume() patch 3/6 - Added new patch to fix XGMAC_VLAN_TAG register writting v2:- patch 1/5 - added control for rtnl_lock() & rtnl_unlock() to ensure they are used forstmmac_resume() patch 4/5 - added IFF_MULTICAST flag check for xgmac to ensure multicast works correctly. v1:- - Drop v1 patches (1/7, 3/7 & 4/7) that are not valid. ==================== Signed-off-by: David S. Miller commit 909c1dde67c433f1e4122f2619cbd8ac370fcf0a Author: Voon Weifeng Date: Fri Feb 7 15:34:28 2020 +0800 net: stmmac: update pci platform data to use phy_interface The recent patch to support passive mode converter did not take care the phy interface configuration in PCI platform data. Hence, converting all the PCI platform data from plat->interface to plat->phy_interface as the default mode is meant for PHY. Fixes: 0060c8783330 ("net: stmmac: implement support for passive mode converters via dt") Signed-off-by: Voon Weifeng Tested-by: Tan, Tee Min Signed-off-by: Ong Boon Leong Signed-off-by: David S. Miller commit 2f633d5820e4ed870f408957322acb9263bce2f4 Author: Tan, Tee Min Date: Fri Feb 7 15:34:15 2020 +0800 net: stmmac: xgmac: fix missing IFF_MULTICAST checki in dwxgmac2_set_filter Without checking for IFF_MULTICAST flag, it is wrong to assume multicast filtering is always enabled. By checking against IFF_MULTICAST, now the driver behaves correctly when the multicast support is toggled by below command:- ip link set multicast off|on Fixes: 0efedbf11f07a ("net: stmmac: xgmac: Fix XGMAC selftests") Signed-off-by: Tan, Tee Min Signed-off-by: Ong Boon Leong Signed-off-by: David S. Miller commit 2ba31cd93784b61813226d259fd94a221ecd9d61 Author: Verma, Aashish Date: Fri Feb 7 15:33:54 2020 +0800 net: stmmac: fix missing IFF_MULTICAST check in dwmac4_set_filter Without checking for IFF_MULTICAST flag, it is wrong to assume multicast filtering is always enabled. By checking against IFF_MULTICAST, now the driver behaves correctly when the multicast support is toggled by below command:- ip link set multicast off|on Fixes: 477286b53f55 ("stmmac: add GMAC4 core support") Signed-off-by: Verma, Aashish Tested-by: Tan, Tee Min Signed-off-by: Ong Boon Leong Signed-off-by: David S. Miller commit 907a076881f171254219faad05f46ac5baabedfb Author: Ong Boon Leong Date: Fri Feb 7 15:33:40 2020 +0800 net: stmmac: xgmac: fix incorrect XGMAC_VLAN_TAG register writting We should always do a read of current value of XGMAC_VLAN_TAG instead of directly overwriting the register value. Fixes: 3cd1cfcba26e2 ("net: stmmac: Implement VLAN Hash Filtering in XGMAC") Signed-off-by: Ong Boon Leong Signed-off-by: David S. Miller commit 9eeeb3c9de4e3aeaa2bec097162f09305dd9f4c3 Author: Tan, Tee Min Date: Fri Feb 7 15:33:20 2020 +0800 net: stmmac: fix incorrect GMAC_VLAN_TAG register writting in GMAC4+ It should always do a read of current value of GMAC_VLAN_TAG instead of directly overwriting the register value. Fixes: c1be0022df0d ("net: stmmac: Add VLAN HASH filtering support in GMAC4+") Signed-off-by: Tan, Tee Min Signed-off-by: Ong Boon Leong Signed-off-by: David S. Miller commit 184367dce4f744bde54377203305ccc8889aa79f Author: Haiyang Zhang Date: Thu Feb 6 14:01:05 2020 -0800 hv_netvsc: Fix XDP refcnt for synthetic and VF NICs The caller of XDP_SETUP_PROG has already incremented refcnt in __bpf_prog_get(), so drivers should only increment refcnt by num_queues - 1. To fix the issue, update netvsc_xdp_set() to add the correct number to refcnt. Hold a refcnt in netvsc_xdp_set()’s other caller, netvsc_attach(). And, do the same in netvsc_vf_setxdp(). Otherwise, every time when VF is removed and added from the host side, the refcnt will be decreased by one, which may cause page fault when unloading xdp program. Fixes: 351e1581395f ("hv_netvsc: Add XDP support") Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit f2b18baca9539c6a3116d48b70972c7a2ba5d766 Author: Johannes Berg Date: Wed Jan 15 12:25:50 2020 +0100 mac80211: use more bits for ack_frame_id It turns out that this wasn't a good idea, I hit a test failure in hwsim due to this. That particular failure was easily worked around, but it raised questions: if an AP needs to, for example, send action frames to each connected station, the current limit is nowhere near enough (especially if those stations are sleeping and the frames are queued for a while.) Shuffle around some bits to make more room for ack_frame_id to allow up to 8192 queued up frames, that's enough for queueing 4 frames to each connected station, even at the maximum of 2007 stations on a single AP. We take the bits from band (which currently only 2 but I leave 3 in case we add another band) and from the hw_queue, which can only need 4 since it has a limit of 16 queues. Fixes: 6912daed05e1 ("mac80211: Shrink the size of ack_frame_id to make room for tx_time_est") Signed-off-by: Johannes Berg Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20200115122549.b9a4ef9f4980.Ied52ed90150220b83a280009c590b65d125d087c@changeid Signed-off-by: Johannes Berg commit 6910fe95c61880e75b1c3a20eb13a6fd01ca501a Merge: de34d7084edd bfabd41da341 Author: David S. Miller Date: Fri Feb 7 11:30:03 2020 +0100 Merge branch 'taprio-Some-fixes' Vinicius Costa Gomes says: ==================== taprio: Some fixes Changes from v3: - Replaced ENOTSUPP error code with EOPNOTSUPP (Jakub Kicinski); - Added the missing policy validation for the flags netlink argument (Jakub Kicinski); - Fixed the destroy() flow to also destroy the priority to traffic class mapping (David Miller); - Fixed dropping packets when taprio offloading is used together with ETF offloading (more on this below); Changes from v2: - Squashed commits 2/3 and 3/3 into a single one (I think a single commit is going to be easier to review); - Removed an "improvement" that was causing changes in user visible behavior; Changes from v1: - Fixed ignoring the 'flags' argument when adding a new instance (Vladimir Oltean); - Changed the order of commits; Updated cover letter: One bit that might need some attention is the fix for not dropping all packets when taprio and ETF offloading are used, patch 5/5. The behavior when the fix is applied is that packets that have a 'txtime' that would fall outside of their transmission window are now dropped by taprio. The question that might be raised is: should taprio be responsible for dropping these packets, or should it be handled lower in the stack? My opinion is: taprio has all the information, and it's able to give feeback to the user. Lower in the stack, those packets might go into the void, and the only feedback could be a hard to find counter increasing. Patch 1/5: Reported by Po Liu, is more of a improvement of usability for drivers implementing offloading features, now they can rely on the value of dev->num_tc, instead of going through some hops to get this value. Patch 2/5: Use 'q->flags' as the source of truth for the offloading flags. Tries to solidify the current behavior, while avoiding going into invalid states, one of which was causing a "rcu stall" (more information in the commit message). Patch 3/5: Adds the missing netlink attribute validation for TCA_TAPRIO_ATTR_FLAGS. Patch 4/5: Replaces the usage of netdev_set_num_tc() with netdev_reset_tc() in taprio_destroy(), taprio_destroy() is called when applying a configuration fails, making sure that the device traffic class configuration goes back to the default state. @Vladimir: If possible, I would appreciate your Ack on patch 2/5. I have been looking at this code for so long that I might have missed something obvious (and my growing dislike for the word 'flags' may be affecting my judgement :-). ==================== Signed-off-by: David S. Miller commit bfabd41da34180d05382312533a3adc2e012dee0 Author: Vinicius Costa Gomes Date: Thu Feb 6 13:46:10 2020 -0800 taprio: Fix dropping packets when using taprio + ETF offloading When using taprio offloading together with ETF offloading, configured like this, for example: $ tc qdisc replace dev $IFACE parent root handle 100 taprio \ num_tc 4 \ map 2 2 1 0 3 2 2 2 2 2 2 2 2 2 2 2 \ queues 1@0 1@1 1@2 1@3 \ base-time $BASE_TIME \ sched-entry S 01 1000000 \ sched-entry S 0e 1000000 \ flags 0x2 $ tc qdisc replace dev $IFACE parent 100:1 etf \ offload delta 300000 clockid CLOCK_TAI During enqueue, it works out that the verification added for the "txtime" assisted mode is run when using taprio + ETF offloading, the only thing missing is initializing the 'next_txtime' of all the cycle entries. (if we don't set 'next_txtime' all packets from SO_TXTIME sockets are dropped) Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Signed-off-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 7c16680a08ee1e444a67d232c679ccf5b30fad16 Author: Vinicius Costa Gomes Date: Thu Feb 6 13:46:09 2020 -0800 taprio: Use taprio_reset_tc() to reset Traffic Classes configuration When destroying the current taprio instance, which can happen when the creation of one fails, we should reset the traffic class configuration back to the default state. netdev_reset_tc() is a better way because in addition to setting the number of traffic classes to zero, it also resets the priority to traffic classes mapping to the default value. Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") Signed-off-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 49c684d79cfdc3032344bf6f3deeea81c4efedbf Author: Vinicius Costa Gomes Date: Thu Feb 6 13:46:08 2020 -0800 taprio: Add missing policy validation for flags netlink policy validation for the 'flags' argument was missing. Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Signed-off-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit a9d6227436f32142209f4428f2dc616761485112 Author: Vinicius Costa Gomes Date: Thu Feb 6 13:46:07 2020 -0800 taprio: Fix still allowing changing the flags during runtime Because 'q->flags' starts as zero, and zero is a valid value, we aren't able to detect the transition from zero to something else during "runtime". The solution is to initialize 'q->flags' with an invalid value, so we can detect if 'q->flags' was set by the user or not. To better solidify the behavior, 'flags' handling is moved to a separate function. The behavior is: - 'flags' if unspecified by the user, is assumed to be zero; - 'flags' cannot change during "runtime" (i.e. a change() request cannot modify it); With this new function we can remove taprio_flags, which should reduce the risk of future accidents. Allowing flags to be changed was causing the following RCU stall: [ 1730.558249] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1730.558258] rcu: 6-...0: (190 ticks this GP) idle=922/0/0x1 softirq=25580/25582 fqs=16250 [ 1730.558264] (detected by 2, t=65002 jiffies, g=33017, q=81) [ 1730.558269] Sending NMI from CPU 2 to CPUs 6: [ 1730.559277] NMI backtrace for cpu 6 [ 1730.559277] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 5.5.0-rc6+ #35 [ 1730.559278] Hardware name: Gigabyte Technology Co., Ltd. Z390 AORUS ULTRA/Z390 AORUS ULTRA-CF, BIOS F7 03/14/2019 [ 1730.559278] RIP: 0010:__hrtimer_run_queues+0xe2/0x440 [ 1730.559278] Code: 48 8b 43 28 4c 89 ff 48 8b 75 c0 48 89 45 c8 e8 f4 bb 7c 00 0f 1f 44 00 00 65 8b 05 40 31 f0 68 89 c0 48 0f a3 05 3e 5c 25 01 <0f> 82 fc 01 00 00 48 8b 45 c8 48 89 df ff d0 89 45 c8 0f 1f 44 00 [ 1730.559279] RSP: 0018:ffff9970802d8f10 EFLAGS: 00000083 [ 1730.559279] RAX: 0000000000000006 RBX: ffff8b31645bff38 RCX: 0000000000000000 [ 1730.559280] RDX: 0000000000000000 RSI: ffffffff9710f2ec RDI: ffffffff978daf0e [ 1730.559280] RBP: ffff9970802d8f68 R08: 0000000000000000 R09: 0000000000000000 [ 1730.559280] R10: 0000018336d7944e R11: 0000000000000001 R12: ffff8b316e39f9c0 [ 1730.559281] R13: ffff8b316e39f940 R14: ffff8b316e39f998 R15: ffff8b316e39f7c0 [ 1730.559281] FS: 0000000000000000(0000) GS:ffff8b316e380000(0000) knlGS:0000000000000000 [ 1730.559281] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1730.559281] CR2: 00007f1105303760 CR3: 0000000227210005 CR4: 00000000003606e0 [ 1730.559282] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1730.559282] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1730.559282] Call Trace: [ 1730.559282] [ 1730.559283] ? taprio_dequeue_soft+0x2d0/0x2d0 [sch_taprio] [ 1730.559283] hrtimer_interrupt+0x104/0x220 [ 1730.559283] ? irqtime_account_irq+0x34/0xa0 [ 1730.559283] smp_apic_timer_interrupt+0x6d/0x230 [ 1730.559284] apic_timer_interrupt+0xf/0x20 [ 1730.559284] [ 1730.559284] RIP: 0010:cpu_idle_poll+0x35/0x1a0 [ 1730.559285] Code: 88 82 ff 65 44 8b 25 12 7d 73 68 0f 1f 44 00 00 e8 90 c3 89 ff fb 65 48 8b 1c 25 c0 7e 01 00 48 8b 03 a8 08 74 0b eb 1c f3 90 <48> 8b 03 a8 08 75 13 8b 05 be a8 a8 00 85 c0 75 ed e8 75 48 84 ff [ 1730.559285] RSP: 0018:ffff997080137ea8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 [ 1730.559285] RAX: 0000000000000001 RBX: ffff8b316bc3c580 RCX: 0000000000000000 [ 1730.559286] RDX: 0000000000000001 RSI: 000000002819aad9 RDI: ffffffff978da730 [ 1730.559286] RBP: ffff997080137ec0 R08: 0000018324a6d387 R09: 0000000000000000 [ 1730.559286] R10: 0000000000000400 R11: 0000000000000001 R12: 0000000000000006 [ 1730.559286] R13: ffff8b316bc3c580 R14: 0000000000000000 R15: 0000000000000000 [ 1730.559287] ? cpu_idle_poll+0x20/0x1a0 [ 1730.559287] ? cpu_idle_poll+0x20/0x1a0 [ 1730.559287] do_idle+0x4d/0x1f0 [ 1730.559287] ? complete+0x44/0x50 [ 1730.559288] cpu_startup_entry+0x1b/0x20 [ 1730.559288] start_secondary+0x142/0x180 [ 1730.559288] secondary_startup_64+0xb6/0xc0 [ 1776.686313] nvme nvme0: I/O 96 QID 1 timeout, completion polled Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Signed-off-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 5652e63df3303c2a702bac25fbf710b9cb64dfba Author: Vinicius Costa Gomes Date: Thu Feb 6 13:46:06 2020 -0800 taprio: Fix enabling offload with wrong number of traffic classes If the driver implementing taprio offloading depends on the value of the network device number of traffic classes (dev->num_tc) for whatever reason, it was going to receive the value zero. The value was only set after the offloading function is called. So, moving setting the number of traffic classes to before the offloading function is called fixes this issue. This is safe because this only happens when taprio is instantiated (we don't allow this configuration to be changed without first removing taprio). Fixes: 9c66d1564676 ("taprio: Add support for hardware offloading") Reported-by: Po Liu Signed-off-by: Vinicius Costa Gomes Acked-by: Vladimir Oltean Signed-off-by: David S. Miller commit de34d7084edd069dac5aa010cfe32bd8c4619fa6 Author: Florian Fainelli Date: Thu Feb 6 11:23:52 2020 -0800 net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port The 7445 switch clocking profiles do not allow us to run the IMP port at 2Gb/sec in a way that it is reliable and consistent. Make sure that the setting is only applied to the 7278 family. Fixes: 8f1880cbe8d0 ("net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit df373702bc0f8f2d83980ea441e71639fc1efcf8 Author: Florian Fainelli Date: Thu Feb 6 11:07:45 2020 -0800 net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan() b53_configure_vlan() is called by the bcm_sf2 driver upon setup and indirectly through resume as well. During the initial setup, we are guaranteed that dev->vlan_enabled is false, so there is no change in behavior, however during suspend, we may have enabled VLANs before, so we do want to restore that setting. Fixes: dad8d7c6452b ("net: dsa: b53: Properly account for VLAN filtering") Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 7d10f0774f9e32aa2f2e012f7fcb312a2ce422b9 Author: Dejin Zheng Date: Thu Feb 6 23:29:17 2020 +0800 net: stmmac: fix a possible endless loop It forgot to reduce the value of the variable retry in a while loop in the ethqos_configure() function. It may cause an endless loop and without timeout. Fixes: a7c30e62d4b8 ("net: stmmac: Add driver for Qualcomm ethqos") Signed-off-by: Dejin Zheng Acked-by: Vinod Koul Signed-off-by: David S. Miller commit 963485d436ccc2810177a7b08af22336ec2af67b Author: David Howells Date: Thu Feb 6 13:57:40 2020 +0000 rxrpc: Fix call RCU cleanup using non-bh-safe locks rxrpc_rcu_destroy_call(), which is called as an RCU callback to clean up a put call, calls rxrpc_put_connection() which, deep in its bowels, takes a number of spinlocks in a non-BH-safe way, including rxrpc_conn_id_lock and local->client_conns_lock. RCU callbacks, however, are normally called from softirq context, which can cause lockdep to notice the locking inconsistency. To get lockdep to detect this, it's necessary to have the connection cleaned up on the put at the end of the last of its calls, though normally the clean up is deferred. This can be induced, however, by starting a call on an AF_RXRPC socket and then closing the socket without reading the reply. Fix this by having rxrpc_rcu_destroy_call() punt the destruction to a workqueue if in softirq-mode and defer the destruction to process context. Note that another way to fix this could be to add a bunch of bh-disable annotations to the spinlocks concerned - and there might be more than just those two - but that means spending more time with BHs disabled. Note also that some of these places were covered by bh-disable spinlocks belonging to the rxrpc_transport object, but these got removed without the _bh annotation being retained on the next lock in. Fixes: 999b69f89241 ("rxrpc: Kill the client connection bundle concept") Reported-by: syzbot+d82f3ac8d87e7ccbb2c9@syzkaller.appspotmail.com Reported-by: syzbot+3f1fd6b8cbf8702d134e@syzkaller.appspotmail.com Signed-off-by: David Howells cc: Hillf Danton Signed-off-by: David S. Miller commit b39a934ec72fa2b5a74123891f25273a38378b90 Author: David Howells Date: Thu Feb 6 13:55:01 2020 +0000 rxrpc: Fix service call disconnection The recent patch that substituted a flag on an rxrpc_call for the connection pointer being NULL as an indication that a call was disconnected puts the set_bit in the wrong place for service calls. This is only a problem if a call is implicitly terminated by a new call coming in on the same connection channel instead of a terminating ACK packet. In such a case, rxrpc_input_implicit_end_call() calls __rxrpc_disconnect_call(), which is now (incorrectly) setting the disconnection bit, meaning that when rxrpc_release_call() is later called, it doesn't call rxrpc_disconnect_call() and so the call isn't removed from the peer's error distribution list and the list gets corrupted. KASAN finds the issue as an access after release on a call, but the position at which it occurs is confusing as it appears to be related to a different call (the call site is where the latter call is being removed from the error distribution list and either the next or pprev pointer points to a previously released call). Fix this by moving the setting of the flag from __rxrpc_disconnect_call() to rxrpc_disconnect_call() in the same place that the connection pointer was being cleared. Fixes: 5273a191dca6 ("rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect") Signed-off-by: David Howells Signed-off-by: David S. Miller commit 332008256f1f7cd8294acd6e288fb821f685d1a9 Merge: c21502efdaed e093e53f4f70 f06572ef476d Author: Rafael J. Wysocki Date: Fri Feb 7 11:01:40 2020 +0100 Merge branches 'pm-avs' and 'pm-cpuidle' * pm-avs: power: avs: qcom-cpr: Avoid clang -Wsometimes-uninitialized in cpr_scale power: avs: qcom-cpr: add unspecified HAS_IOMEM dependency PM / AVS: rockchip-io: fix the supply naming for the emmc supply on px30 power: avs: qcom-cpr: add a printout after the driver has been initialized * pm-cpuidle: cpuidle: Documentation: Clean up PM QoS description intel_idle: Introduce 'states_off' module parameter intel_idle: Introduce 'use_acpi' module parameter commit fcb9c24bef3d1d0942c50fb25fbb8ab45c7c3753 Author: Damien Le Moal Date: Wed Dec 25 16:11:09 2019 +0900 zonefs: Add documentation Add the new file Documentation/filesystems/zonefs.txt to document zonefs principles and user-space tool usage. Signed-off-by: Damien Le Moal Reviewed-by: Dave Chinner commit 8dcc1a9d90c10fa4143e5c17821082e5e60e46a1 Author: Damien Le Moal Date: Wed Dec 25 16:07:44 2019 +0900 fs: New zonefs file system zonefs is a very simple file system exposing each zone of a zoned block device as a file. Unlike a regular file system with zoned block device support (e.g. f2fs), zonefs does not hide the sequential write constraint of zoned block devices to the user. Files representing sequential write zones of the device must be written sequentially starting from the end of the file (append only writes). As such, zonefs is in essence closer to a raw block device access interface than to a full featured POSIX file system. The goal of zonefs is to simplify the implementation of zoned block device support in applications by replacing raw block device file accesses with a richer file API, avoiding relying on direct block device file ioctls which may be more obscure to developers. One example of this approach is the implementation of LSM (log-structured merge) tree structures (such as used in RocksDB and LevelDB) on zoned block devices by allowing SSTables to be stored in a zone file similarly to a regular file system rather than as a range of sectors of a zoned device. The introduction of the higher level construct "one file is one zone" can help reducing the amount of changes needed in the application as well as introducing support for different application programming languages. Zonefs on-disk metadata is reduced to an immutable super block to persistently store a magic number and optional feature flags and values. On mount, zonefs uses blkdev_report_zones() to obtain the device zone configuration and populates the mount point with a static file tree solely based on this information. E.g. file sizes come from the device zone type and write pointer offset managed by the device itself. The zone files created on mount have the following characteristics. 1) Files representing zones of the same type are grouped together under a common sub-directory: * For conventional zones, the sub-directory "cnv" is used. * For sequential write zones, the sub-directory "seq" is used. These two directories are the only directories that exist in zonefs. Users cannot create other directories and cannot rename nor delete the "cnv" and "seq" sub-directories. 2) The name of zone files is the number of the file within the zone type sub-directory, in order of increasing zone start sector. 3) The size of conventional zone files is fixed to the device zone size. Conventional zone files cannot be truncated. 4) The size of sequential zone files represent the file's zone write pointer position relative to the zone start sector. Truncating these files is allowed only down to 0, in which case, the zone is reset to rewind the zone write pointer position to the start of the zone, or up to the zone size, in which case the file's zone is transitioned to the FULL state (finish zone operation). 5) All read and write operations to files are not allowed beyond the file zone size. Any access exceeding the zone size is failed with the -EFBIG error. 6) Creating, deleting, renaming or modifying any attribute of files and sub-directories is not allowed. 7) There are no restrictions on the type of read and write operations that can be issued to conventional zone files. Buffered, direct and mmap read & write operations are accepted. For sequential zone files, there are no restrictions on read operations, but all write operations must be direct IO append writes. mmap write of sequential files is not allowed. Several optional features of zonefs can be enabled at format time. * Conventional zone aggregation: ranges of contiguous conventional zones can be aggregated into a single larger file instead of the default one file per zone. * File ownership: The owner UID and GID of zone files is by default 0 (root) but can be changed to any valid UID/GID. * File access permissions: the default 640 access permissions can be changed. The mkzonefs tool is used to format zoned block devices for use with zonefs. This tool is available on Github at: git@github.com:damien-lemoal/zonefs-tools.git. zonefs-tools also includes a test suite which can be run against any zoned block device, including null_blk block device created with zoned mode. Example: the following formats a 15TB host-managed SMR HDD with 256 MB zones with the conventional zones aggregation feature enabled. $ sudo mkzonefs -o aggr_cnv /dev/sdX $ sudo mount -t zonefs /dev/sdX /mnt $ ls -l /mnt/ total 0 dr-xr-xr-x 2 root root 1 Nov 25 13:23 cnv dr-xr-xr-x 2 root root 55356 Nov 25 13:23 seq The size of the zone files sub-directories indicate the number of files existing for each type of zones. In this example, there is only one conventional zone file (all conventional zones are aggregated under a single file). $ ls -l /mnt/cnv total 137101312 -rw-r----- 1 root root 140391743488 Nov 25 13:23 0 This aggregated conventional zone file can be used as a regular file. $ sudo mkfs.ext4 /mnt/cnv/0 $ sudo mount -o loop /mnt/cnv/0 /data The "seq" sub-directory grouping files for sequential write zones has in this example 55356 zones. $ ls -lv /mnt/seq total 14511243264 -rw-r----- 1 root root 0 Nov 25 13:23 0 -rw-r----- 1 root root 0 Nov 25 13:23 1 -rw-r----- 1 root root 0 Nov 25 13:23 2 ... -rw-r----- 1 root root 0 Nov 25 13:23 55354 -rw-r----- 1 root root 0 Nov 25 13:23 55355 For sequential write zone files, the file size changes as data is appended at the end of the file, similarly to any regular file system. $ dd if=/dev/zero of=/mnt/seq/0 bs=4K count=1 conv=notrunc oflag=direct 1+0 records in 1+0 records out 4096 bytes (4.1 kB, 4.0 KiB) copied, 0.000452219 s, 9.1 MB/s $ ls -l /mnt/seq/0 -rw-r----- 1 root root 4096 Nov 25 13:23 /mnt/seq/0 The written file can be truncated to the zone size, preventing any further write operation. $ truncate -s 268435456 /mnt/seq/0 $ ls -l /mnt/seq/0 -rw-r----- 1 root root 268435456 Nov 25 13:49 /mnt/seq/0 Truncation to 0 size allows freeing the file zone storage space and restart append-writes to the file. $ truncate -s 0 /mnt/seq/0 $ ls -l /mnt/seq/0 -rw-r----- 1 root root 0 Nov 25 13:49 /mnt/seq/0 Since files are statically mapped to zones on the disk, the number of blocks of a file as reported by stat() and fstat() indicates the size of the file zone. $ stat /mnt/seq/0 File: /mnt/seq/0 Size: 0 Blocks: 524288 IO Block: 4096 regular empty file Device: 870h/2160d Inode: 50431 Links: 1 Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2019-11-25 13:23:57.048971997 +0900 Modify: 2019-11-25 13:52:25.553805765 +0900 Change: 2019-11-25 13:52:25.553805765 +0900 Birth: - The number of blocks of the file ("Blocks") in units of 512B blocks gives the maximum file size of 524288 * 512 B = 256 MB, corresponding to the device zone size in this example. Of note is that the "IO block" field always indicates the minimum IO size for writes and corresponds to the device physical sector size. This code contains contributions from: * Johannes Thumshirn , * Darrick J. Wong , * Christoph Hellwig , * Chaitanya Kulkarni and * Ting Yao . Signed-off-by: Damien Le Moal Reviewed-by: Dave Chinner commit 5eede625297f4d21dc12ea7a7418fd21672f131d Author: Al Viro Date: Mon Dec 16 13:33:32 2019 -0500 fold struct fs_parameter_enum into struct constant_table no real difference now Signed-off-by: Al Viro commit 2710c957a8ef4fb00f21acb306e3bd6bcf80c81f Author: Al Viro Date: Fri Sep 6 22:12:08 2019 -0400 fs_parse: get rid of ->enums Don't do a single array; attach them to fsparam_enum() entry instead. And don't bother trying to embed the names into those - it actually loses memory, with no real speedup worth mentioning. Simplifies validation as well. Signed-off-by: Al Viro commit 0f89589a8c6f1033cb847a606517998efb0da8ee Author: Al Viro Date: Tue Dec 17 14:15:04 2019 -0500 Pass consistent param->type to fs_parse() As it is, vfs_parse_fs_string() makes "foo" and "foo=" indistinguishable; both get fs_value_is_string for ->type and NULL for ->string. To make it even more unpleasant, that combination is impossible to produce with fsconfig(). Much saner rules would be "foo" => fs_value_is_flag, NULL "foo=" => fs_value_is_string, "" "foo=bar" => fs_value_is_string, "bar" All cases are distinguishable, all results are expressable by fsconfig(), ->has_value checks are much simpler that way (to the point of the field being useless) and quite a few regressions go away (gfs2 has no business accepting -o nodebug=, for example). Partially based upon patches from Miklos. Signed-off-by: Al Viro commit 9f880327160feb695de03caa29604883b0d00087 Merge: a345cc0d393e 58fe03d6dec9 Author: Dave Airlie Date: Fri Feb 7 12:29:35 2020 +1000 Merge tag 'amd-drm-next-5.6-2020-02-05' of git://people.freedesktop.org/~agd5f/linux into drm-next amd-drm-next-5.6-2020-02-05: amdgpu: - EDC fixes for Arcturus - GDDR6 memory training fixe - Fix for reading gfx clockgating registers while in GFXOFF state - i2c freq fixes - Misc display fixes - TLB invalidation fix when using semaphores - VCN 2.5 instancing fixes - Switch raven1 gfxoff to a blacklist - Coreboot workaround for KV/KB - Root cause dongle fixes for display and revert workaround - Enable GPU reset for renoir and navi - Navi overclocking fixes - Fix up confusing warnings in display clock validation on raven amdkfd: - SDMA fix radeon: - Misc LUT fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200206035458.3894-1-alexander.deucher@amd.com commit a345cc0d393edddde8e83aadf8be5223316442aa Merge: e139e8aed0d3 137c4ba7163a Author: Dave Airlie Date: Fri Feb 7 12:23:24 2020 +1000 Merge branch 'linux-5.6' of git://github.com/skeggsb/linux into drm-next Just a couple of fixes to Volta/Turing modesetting on some systems. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Fri Feb 7 12:22:23 2020 +1000 Merge tag 'drm/tegra/for-5.6-rc1-fixes' of git://anongit.freedesktop.org/tegra/linux into drm-next drm/tegra: Fixes for v5.6-rc1 These are a couple of quick fixes for regressions that were found during the first two weeks of the merge window. Signed-off-by: Dave Airlie From: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20200206172753.2185390-1-thierry.reding@gmail.com commit 51d92d69f77b121d8093af82eb3bd2e8e631be55 Author: Steve French Date: Thu Feb 6 12:32:03 2020 -0600 smb3: Add defines for new information level, FileIdInformation See MS-FSCC 2.4.43. Valid to be quried from most Windows servers (among others). Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit ab3459d8f0ef52c38119ed58c4c29139efc7022c Author: Steve French Date: Thu Feb 6 17:31:56 2020 -0600 smb3: print warning once if posix context returned on open SMB3.1.1 POSIX Context processing is not complete yet - so print warning (once) if server returns it on open. Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 2391ca41b476078da5cf72c2fe82ae9f03da8b38 Author: Steve French Date: Thu Feb 6 16:04:59 2020 -0600 smb3: add one more dynamic tracepoint missing from strict fsync path We didn't have a dynamic trace point for catching errors in file_write_and_wait_range error cases in cifs_strict_fsync. Since not all apps check for write behind errors, it can be important for debugging to be able to trace these error paths. Suggested-and-reviewed-by: Pavel Shilovsky Signed-off-by: Steve French commit e3e056c35108661e418c803adfc054bf683426e7 Author: Aurelien Aptel Date: Thu Feb 6 18:16:55 2020 +0100 cifs: fix mode bits from dir listing when mounted with modefromsid When mounting with -o modefromsid, the mode bits are stored in an ACE. Directory enumeration (e.g. ls -l /mnt) triggers an SMB Query Dir which does not include ACEs in its response. The mode bits in this case are silently set to a default value of 755 instead. This patch marks the dentry created during the directory enumeration as needing re-evaluation (i.e. additional Query Info with ACEs) so that the mode bits can be properly extracted. Quick repro: $ mount.cifs //win19.test/data /mnt -o ...,modefromsid $ touch /mnt/foo && chmod 751 /mnt/foo $ stat /mnt/foo # reports 751 (OK) $ sleep 2 # dentry older than 1s by default get invalidated $ ls -l /mnt # since dentry invalid, ls does a Query Dir # and reports foo as 755 (WRONG) Signed-off-by: Aurelien Aptel Signed-off-by: Steve French CC: Stable Reviewed-by: Pavel Shilovsky commit f798a5a0a60575f329ff29b13360bf4a14cc90d1 Merge: 263a425a482f 61c00cca41ae Author: David S. Miller Date: Thu Feb 6 23:26:18 2020 +0100 Merge tag 'mlx5-fixes-2020-02-06' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2020-02-06 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v4.19: ('net/mlx5: IPsec, Fix esp modify function attribute') ('net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx') For -stable v5.4: ('net/mlx5: Deprecate usage of generic TLS HW capability bit') ('net/mlx5: Fix deadlock in fs_core') For -stable v5.5: ('net/mlx5e: TX, Error completion is for last WQE in batch') ==================== Signed-off-by: David S. Miller commit 1e95081cb5b4cf77065d37866f57cf3c90a3df78 Author: Pavel Begunkov Date: Thu Feb 6 19:51:16 2020 +0300 io_uring: fix deferred req iovec leak After defer, a request will be prepared, that includes allocating iovec if needed, and then submitted through io_wq_submit_work() but not custom handler (e.g. io_rw_async()/io_sendrecv_async()). However, it'll leak iovec, as it's in io-wq and the code goes as follows: io_read() { if (!io_wq_current_is_worker()) kfree(iovec); } Put all deallocation logic in io_{read,write,send,recv}(), which will leave the memory, if going async with -EAGAIN. It also fixes a leak after failed io_alloc_async_ctx() in io_{recv,send}_msg(). Cc: stable@vger.kernel.org # 5.5 Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e1d85334d62386e9503e4a0d5d022e2d8e0011a0 Author: Randy Dunlap Date: Wed Feb 5 20:57:10 2020 -0800 io_uring: fix 1-bit bitfields to be unsigned Make bitfields of size 1 bit be unsigned (since there is no room for the sign bit). This clears up the sparse warnings: CHECK ../fs/io_uring.c ../fs/io_uring.c:207:50: error: dubious one-bit signed bitfield ../fs/io_uring.c:208:55: error: dubious one-bit signed bitfield ../fs/io_uring.c:209:63: error: dubious one-bit signed bitfield ../fs/io_uring.c:210:54: error: dubious one-bit signed bitfield ../fs/io_uring.c:211:57: error: dubious one-bit signed bitfield Found by sight and then verified with sparse. Fixes: 69b3e546139a ("io_uring: change io_ring_ctx bool fields into bit fields") Signed-off-by: Randy Dunlap Cc: Jens Axboe Cc: io-uring@vger.kernel.org Signed-off-by: Jens Axboe commit 61c00cca41aeeaa8e5263c2f81f28534bc1efafb Author: Tariq Toukan Date: Mon Jan 27 14:18:14 2020 +0200 net/mlx5: Deprecate usage of generic TLS HW capability bit Deprecate the generic TLS cap bit, use the new TX-specific TLS cap bit instead. Fixes: a12ff35e0fb7 ("net/mlx5: Introduce TLS TX offload hardware bits and structures") Signed-off-by: Tariq Toukan Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit b57e66ad42d051ed31319c28ed1b62b191299a29 Author: Tariq Toukan Date: Thu Jan 9 15:53:37 2020 +0200 net/mlx5e: TX, Error completion is for last WQE in batch For a cyclic work queue, when not requesting a completion per WQE, a single CQE might indicate the completion of several WQEs. However, in case some WQE in the batch causes an error, then an error completion is issued, breaking the batch, and pointing to the offending WQE in the wqe_counter field. Hence, WQE-specific error CQE handling (like printing, breaking, etc...) should be performed only for the last WQE in batch. Fixes: 130c7b46c93d ("net/mlx5e: TX, Dump WQs wqe descriptors on CQE with error events") Fixes: fd9b4be8002c ("net/mlx5e: RX, Support multiple outstanding UMR posts") Signed-off-by: Tariq Toukan Reviewed-by: Aya Levin Signed-off-by: Saeed Mahameed commit 08db2cf577487f5123aebcc2f913e0b8a2c14b43 Author: Raed Salem Date: Wed Oct 23 16:41:21 2019 +0300 net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx SA context is allocated at mlx5_fpga_ipsec_create_sa_ctx, however the counterpart mlx5_fpga_ipsec_delete_sa_ctx function nullifies sa_ctx pointer without freeing the memory allocated, hence the memory leak. Fix by free SA context when the SA is released. Fixes: d6c4f0298cec ("net/mlx5: Refactor accel IPSec code") Signed-off-by: Raed Salem Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit 0dc2c534f17c05bed0622b37a744bc38b48ca88a Author: Raed Salem Date: Tue Dec 24 09:54:45 2019 +0200 net/mlx5: IPsec, Fix esp modify function attribute The function mlx5_fpga_esp_validate_xfrm_attrs is wrongly used with negative negation as zero value indicates success but it used as failure return value instead. Fix by remove the unary not negation operator. Fixes: 05564d0ae075 ("net/mlx5: Add flow-steering commands for FPGA IPSec implementation") Signed-off-by: Raed Salem Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit c1948390d78b5183ee9b7dd831efd7f6ac496ab0 Author: Maor Gottlieb Date: Mon Jan 27 09:27:51 2020 +0200 net/mlx5: Fix deadlock in fs_core free_match_list could be called when the flow table is already locked. We need to pass this notation to tree_put_node. It fixes the following lockdep warnning: [ 1797.268537] ============================================ [ 1797.276837] WARNING: possible recursive locking detected [ 1797.285101] 5.5.0-rc5+ #10 Not tainted [ 1797.291641] -------------------------------------------- [ 1797.299917] handler10/9296 is trying to acquire lock: [ 1797.307885] ffff889ad399a0a0 (&node->lock){++++}, at: tree_put_node+0x1d5/0x210 [mlx5_core] [ 1797.319694] [ 1797.319694] but task is already holding lock: [ 1797.330904] ffff889ad399a0a0 (&node->lock){++++}, at: nested_down_write_ref_node.part.33+0x1a/0x60 [mlx5_core] [ 1797.344707] [ 1797.344707] other info that might help us debug this: [ 1797.356952] Possible unsafe locking scenario: [ 1797.356952] [ 1797.368333] CPU0 [ 1797.373357] ---- [ 1797.378364] lock(&node->lock); [ 1797.384222] lock(&node->lock); [ 1797.390031] [ 1797.390031] *** DEADLOCK *** [ 1797.390031] [ 1797.403003] May be due to missing lock nesting notation [ 1797.403003] [ 1797.414691] 3 locks held by handler10/9296: [ 1797.421465] #0: ffff889cf2c5a110 (&block->cb_lock){++++}, at: tc_setup_cb_add+0x70/0x250 [ 1797.432810] #1: ffff88a030081490 (&comp->sem){++++}, at: mlx5_devcom_get_peer_data+0x4c/0xb0 [mlx5_core] [ 1797.445829] #2: ffff889ad399a0a0 (&node->lock){++++}, at: nested_down_write_ref_node.part.33+0x1a/0x60 [mlx5_core] [ 1797.459913] [ 1797.459913] stack backtrace: [ 1797.469436] CPU: 1 PID: 9296 Comm: handler10 Kdump: loaded Not tainted 5.5.0-rc5+ #10 [ 1797.480643] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 [ 1797.491480] Call Trace: [ 1797.496701] dump_stack+0x96/0xe0 [ 1797.502864] __lock_acquire.cold.63+0xf8/0x212 [ 1797.510301] ? lockdep_hardirqs_on+0x250/0x250 [ 1797.517701] ? mark_held_locks+0x55/0xa0 [ 1797.524547] ? quarantine_put+0xb7/0x160 [ 1797.531422] ? lockdep_hardirqs_on+0x17d/0x250 [ 1797.538913] lock_acquire+0xd6/0x1f0 [ 1797.545529] ? tree_put_node+0x1d5/0x210 [mlx5_core] [ 1797.553701] down_write+0x94/0x140 [ 1797.560206] ? tree_put_node+0x1d5/0x210 [mlx5_core] [ 1797.568464] ? down_write_killable_nested+0x170/0x170 [ 1797.576925] ? del_hw_flow_group+0xde/0x1f0 [mlx5_core] [ 1797.585629] tree_put_node+0x1d5/0x210 [mlx5_core] [ 1797.593891] ? free_match_list.part.25+0x147/0x170 [mlx5_core] [ 1797.603389] free_match_list.part.25+0xe0/0x170 [mlx5_core] [ 1797.612654] _mlx5_add_flow_rules+0x17e2/0x20b0 [mlx5_core] [ 1797.621838] ? lock_acquire+0xd6/0x1f0 [ 1797.629028] ? esw_get_prio_table+0xb0/0x3e0 [mlx5_core] [ 1797.637981] ? alloc_insert_flow_group+0x420/0x420 [mlx5_core] [ 1797.647459] ? try_to_wake_up+0x4c7/0xc70 [ 1797.654881] ? lock_downgrade+0x350/0x350 [ 1797.662271] ? __mutex_unlock_slowpath+0xb1/0x3f0 [ 1797.670396] ? find_held_lock+0xac/0xd0 [ 1797.677540] ? mlx5_add_flow_rules+0xdc/0x360 [mlx5_core] [ 1797.686467] mlx5_add_flow_rules+0xdc/0x360 [mlx5_core] [ 1797.695134] ? _mlx5_add_flow_rules+0x20b0/0x20b0 [mlx5_core] [ 1797.704270] ? irq_exit+0xa5/0x170 [ 1797.710764] ? retint_kernel+0x10/0x10 [ 1797.717698] ? mlx5_eswitch_set_rule_source_port.isra.9+0x122/0x230 [mlx5_core] [ 1797.728708] mlx5_eswitch_add_offloaded_rule+0x465/0x6d0 [mlx5_core] [ 1797.738713] ? mlx5_eswitch_get_prio_range+0x30/0x30 [mlx5_core] [ 1797.748384] ? mlx5_fc_stats_work+0x670/0x670 [mlx5_core] [ 1797.757400] mlx5e_tc_offload_fdb_rules.isra.27+0x24/0x90 [mlx5_core] [ 1797.767665] mlx5e_tc_add_fdb_flow+0xaf8/0xd40 [mlx5_core] [ 1797.776886] ? mlx5e_encap_put+0xd0/0xd0 [mlx5_core] [ 1797.785562] ? mlx5e_alloc_flow.isra.43+0x18c/0x1c0 [mlx5_core] [ 1797.795353] __mlx5e_add_fdb_flow+0x2e2/0x440 [mlx5_core] [ 1797.804558] ? mlx5e_tc_update_neigh_used_value+0x8c0/0x8c0 [mlx5_core] [ 1797.815093] ? wait_for_completion+0x260/0x260 [ 1797.823272] mlx5e_configure_flower+0xe94/0x1620 [mlx5_core] [ 1797.832792] ? __mlx5e_add_fdb_flow+0x440/0x440 [mlx5_core] [ 1797.842096] ? down_read+0x11a/0x2e0 [ 1797.849090] ? down_write+0x140/0x140 [ 1797.856142] ? mlx5e_rep_indr_setup_block_cb+0xc0/0xc0 [mlx5_core] [ 1797.866027] tc_setup_cb_add+0x11a/0x250 [ 1797.873339] fl_hw_replace_filter+0x25e/0x320 [cls_flower] [ 1797.882385] ? fl_hw_destroy_filter+0x1c0/0x1c0 [cls_flower] [ 1797.891607] fl_change+0x1d54/0x1fb6 [cls_flower] [ 1797.899772] ? __rhashtable_insert_fast.constprop.50+0x9f0/0x9f0 [cls_flower] [ 1797.910728] ? lock_downgrade+0x350/0x350 [ 1797.918187] ? __radix_tree_lookup+0xa5/0x130 [ 1797.926046] ? fl_set_key+0x1590/0x1590 [cls_flower] [ 1797.934611] ? __rhashtable_insert_fast.constprop.50+0x9f0/0x9f0 [cls_flower] [ 1797.945673] tc_new_tfilter+0xcd1/0x1240 [ 1797.953138] ? tc_del_tfilter+0xb10/0xb10 [ 1797.960688] ? avc_has_perm_noaudit+0x92/0x320 [ 1797.968721] ? avc_has_perm_noaudit+0x1df/0x320 [ 1797.976816] ? avc_has_extended_perms+0x990/0x990 [ 1797.985090] ? mark_lock+0xaa/0x9e0 [ 1797.991988] ? match_held_lock+0x1b/0x240 [ 1797.999457] ? match_held_lock+0x1b/0x240 [ 1798.006859] ? find_held_lock+0xac/0xd0 [ 1798.014045] ? symbol_put_addr+0x40/0x40 [ 1798.021317] ? rcu_read_lock_sched_held+0xd0/0xd0 [ 1798.029460] ? tc_del_tfilter+0xb10/0xb10 [ 1798.036810] rtnetlink_rcv_msg+0x4d5/0x620 [ 1798.044236] ? rtnl_bridge_getlink+0x460/0x460 [ 1798.052034] ? lockdep_hardirqs_on+0x250/0x250 [ 1798.059837] ? match_held_lock+0x1b/0x240 [ 1798.067146] ? find_held_lock+0xac/0xd0 [ 1798.074246] netlink_rcv_skb+0xc6/0x1f0 [ 1798.081339] ? rtnl_bridge_getlink+0x460/0x460 [ 1798.089104] ? netlink_ack+0x440/0x440 [ 1798.096061] netlink_unicast+0x2d4/0x3b0 [ 1798.103189] ? netlink_attachskb+0x3f0/0x3f0 [ 1798.110724] ? _copy_from_iter_full+0xda/0x370 [ 1798.118415] netlink_sendmsg+0x3ba/0x6a0 [ 1798.125478] ? netlink_unicast+0x3b0/0x3b0 [ 1798.132705] ? netlink_unicast+0x3b0/0x3b0 [ 1798.139880] sock_sendmsg+0x94/0xa0 [ 1798.146332] ____sys_sendmsg+0x36c/0x3f0 [ 1798.153251] ? copy_msghdr_from_user+0x165/0x230 [ 1798.160941] ? kernel_sendmsg+0x30/0x30 [ 1798.167738] ___sys_sendmsg+0xeb/0x150 [ 1798.174411] ? sendmsg_copy_msghdr+0x30/0x30 [ 1798.181649] ? lock_downgrade+0x350/0x350 [ 1798.188559] ? rcu_read_lock_sched_held+0xd0/0xd0 [ 1798.196239] ? __fget+0x21d/0x320 [ 1798.202335] ? do_dup2+0x2a0/0x2a0 [ 1798.208499] ? lock_downgrade+0x350/0x350 [ 1798.215366] ? __fget_light+0xd6/0xf0 [ 1798.221808] ? syscall_trace_enter+0x369/0x5d0 [ 1798.229112] __sys_sendmsg+0xd3/0x160 [ 1798.235511] ? __sys_sendmsg_sock+0x60/0x60 [ 1798.242478] ? syscall_trace_enter+0x233/0x5d0 [ 1798.249721] ? syscall_slow_exit_work+0x280/0x280 [ 1798.257211] ? do_syscall_64+0x1e/0x2e0 [ 1798.263680] do_syscall_64+0x72/0x2e0 [ 1798.269950] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: bd71b08ec2ee ("net/mlx5: Support multiple updates of steering rules in parallel") Signed-off-by: Maor Gottlieb Signed-off-by: Alaa Hleihel Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit e1cf35b94c5fd122a8780587559fc6da9fc2dd12 Author: Mauro Rossi Date: Mon Feb 3 22:31:13 2020 +0100 drm/edid: fix building error Fixes the following building error: CC [M]  drivers/gpu/drm/drm_edid.o ~/pie-x86_kernel/kernel/drivers/gpu/drm/drm_edid.c: In function 'cea_mode_alternate_timings': ~/pie-x86_kernel/kernel/drivers/gpu/drm/drm_edid.c:3275:2: error: call to '__compiletime_assert_3282' declared with attribute error: BUILD_BUG_ON failed: cea_mode_for_vic(8)->vtotal != 262 || cea_mode_for_vic(9)->vtotal != 262 || cea_mode_for_vic(12)->vtotal != 262 || cea_mode_for_vic(13)->vtotal != 262 || cea_mode_for_vic(23)->vtotal != 312 || cea_mode_for_vic(24)->vtotal != 312 || cea_mode_for_vic(27)->vtotal != 312 || cea_mode_for_vic(28)->vtotal != 312 make[4]: *** [~/pie-x86_kernel/kernel/scripts/Makefile.build:265: drivers/gpu/drm/drm_edid.o] Error 1 Fixes: 7befe621ff81 ("drm/edid: Abstract away cea_edid_modes[]") Signed-off-by: Mauro Rossi Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20200203213113.28183-1-issor.oruam@gmail.com commit 1cb1edb2f5ba8a3e8d47ded391007c6fe3ac0ad7 Author: Pavel Begunkov Date: Thu Feb 6 21:16:09 2020 +0300 io_uring: get rid of delayed mm check Fail fast if can't grab mm, so past that requests always have an mm when required. This allows us to remove req->user altogether. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit cc95b6772790c476b2c2de09abec739120593d98 Author: Aurelien Aptel Date: Thu Feb 6 13:49:26 2020 +0100 cifs: fix channel signing The server var was accidentally used as an iterator over the global list of connections, thus overwritten the passed argument. This resulted in the wrong signing key being returned for extra channels. Fix this by using a separate var to iterate. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Pavel Shilovsky commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 Author: Daniel Vetter Date: Sun Feb 2 14:21:33 2020 +0100 drm/vgem: Close use-after-free race in vgem_gem_create There's two references floating around here (for the object reference, not the handle_count reference, that's a different thing): - The temporary reference held by vgem_gem_create, acquired by creating the object and released by calling drm_gem_object_put_unlocked. - The reference held by the object handle, created by drm_gem_handle_create. This one generally outlives the function, except if a 2nd thread races with a GEM_CLOSE ioctl call. So usually everything is correct, except in that race case, where the access to gem_object->size could be looking at freed data already. Which again isn't a real problem (userspace shot its feet off already with the race, we could return garbage), but maybe someone can exploit this as an information leak. Cc: Dan Carpenter Cc: Hillf Danton Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Emil Velikov Cc: Daniel Vetter Cc: Sean Paul Cc: Chris Wilson Cc: Eric Anholt Cc: Sam Ravnborg Cc: Rob Clark Reviewed-by: Chris Wilson Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch commit 6e5e41e2dc4e4413296d5a4af54ac92d7cd52317 Author: Andreas Gruenbacher Date: Tue Jan 14 17:12:18 2020 +0100 gfs2: fix O_SYNC write handling In gfs2_file_write_iter, for direct writes, the error checking in the buffered write fallback case is incomplete. This can cause inode write errors to go undetected. Fix and clean up gfs2_file_write_iter along the way. Based on a proposed fix by Christoph Hellwig . Fixes: 967bcc91b044 ("gfs2: iomap direct I/O support") Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Andreas Gruenbacher commit 98ae41adb252866158dd4e998551dfa85e612bed Author: Thierry Reding Date: Tue Feb 4 14:59:26 2020 +0100 gpu: host1x: Set DMA direction only for DMA-mapped buffer objects The DMA direction is only used by the DMA API, so there is no use in setting it when a buffer object isn't mapped with the DMA API. Signed-off-by: Thierry Reding Tested-by: Dmitry Osipenko Reviewed-by: Dmitry Osipenko commit 273da5a046965ccf0ec79eb63f2d5173467e20fa Author: Thierry Reding Date: Tue Feb 4 14:59:25 2020 +0100 drm/tegra: Reuse IOVA mapping where possible This partially reverts the DMA API support that was recently merged because it was causing performance regressions on older Tegra devices. Unfortunately, the cache maintenance performed by dma_map_sg() and dma_unmap_sg() causes performance to drop by a factor of 10. The right solution for this would be to cache mappings for buffers per consumer device, but that's a bit involved. Instead, we simply revert to the old behaviour of sharing IOVA mappings when we know that devices can do so (i.e. they share the same IOMMU domain). Cc: # v5.5 Reported-by: Dmitry Osipenko Signed-off-by: Thierry Reding Tested-by: Dmitry Osipenko Reviewed-by: Dmitry Osipenko commit 2d9384ff91770a71bd1ff24c25952ef1187a0e9c Author: Thierry Reding Date: Tue Feb 4 14:59:24 2020 +0100 drm/tegra: Relax IOMMU usage criteria on old Tegra Older Tegra devices only allow addressing 32 bits of memory, so whether or not the host1x is attached to an IOMMU doesn't matter. host1x IOMMU attachment is only needed on devices that can address memory beyond the 32-bit boundary and where the host1x doesn't support the wide GATHER opcode that allows it to access buffers at higher addresses. Cc: # v5.5 Signed-off-by: Thierry Reding Tested-by: Dmitry Osipenko Reviewed-by: Dmitry Osipenko commit 90568ecf561540fa330511e21fcd823b0c3829c6 Merge: d854b2d639fd a8be1ad01b79 Author: Linus Torvalds Date: Thu Feb 6 09:07:45 2020 -0800 Merge tag 'kvm-5.6-2' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more KVM updates from Paolo Bonzini: "s390: - fix register corruption - ENOTSUPP/EOPNOTSUPP mixed - reset cleanups/fixes - selftests x86: - Bug fixes and cleanups - AMD support for APIC virtualization even in combination with in-kernel PIT or IOAPIC. MIPS: - Compilation fix. Generic: - Fix refcount overflow for zero page" * tag 'kvm-5.6-2' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits) KVM: vmx: delete meaningless vmx_decache_cr0_guest_bits() declaration KVM: x86: Mark CR4.UMIP as reserved based on associated CPUID bit x86: vmxfeatures: rename features for consistency with KVM and manual KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses KVM: x86: Fix perfctr WRMSR for running counters x86/kvm/hyper-v: don't allow to turn on unsupported VMX controls for nested guests x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs() kvm: mmu: Separate generating and setting mmio ptes kvm: mmu: Replace unsigned with unsigned int for PTE access KVM: nVMX: Remove stale comment from nested_vmx_load_cr3() KVM: MIPS: Fold comparecount_func() into comparecount_wakeup() KVM: MIPS: Fix a build error due to referencing not-yet-defined function x86/kvm: do not setup pv tlb flush when not paravirtualized KVM: fix overflow of zero page refcount with ksm running KVM: x86: Take a u64 when checking for a valid dr7 value KVM: x86: use raw clock values consistently KVM: x86: reorganize pvclock_gtod_data members KVM: nVMX: delete meaningless nested_vmx_run() declaration KVM: SVM: allow AVIC without split irqchip kvm: ioapic: Lazy update IOAPIC EOI ... commit d854b2d639fd61ccdc184385ee4036658a52e57e Merge: 9e6c535c64ad fcf2736c82ca Author: Linus Torvalds Date: Thu Feb 6 09:05:42 2020 -0800 Merge tag 'kgdb-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb fix from Daniel Thompson: "One of the simplifications added for 5.6-rc1 has caused build regressions on some platforms (it was reported for sparc64). This fixes it with a revert" * tag 'kgdb-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: Revert "kdb: Get rid of confusing diag msg from "rd" if current task has no regs" commit 4c0e8dda608a51855225c611b5c6b442f95fbc56 Author: Christoph Hellwig Date: Wed Jan 15 16:38:29 2020 +0100 gfs2: move setting current->backing_dev_info Set current->backing_dev_info just around the buffered write calls to prepare for the next fix. Fixes: 967bcc91b044 ("gfs2: iomap direct I/O support") Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit 7582026f6f3588ecebd281965c8a71aff6fb6158 Author: Abhi Das Date: Tue Feb 4 14:14:56 2020 -0600 gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0 When the first log header in a journal happens to have a sequence number of 0, a bug in gfs2_find_jhead() causes it to prematurely exit, and return an uninitialized jhead with seq 0. This can cause failures in the caller. For instance, a mount fails in one test case. The correct behavior is for it to continue searching through the journal to find the correct journal head with the highest sequence number. Fixes: f4686c26ecc3 ("gfs2: read journal in large chunks") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Abhi Das Signed-off-by: Andreas Gruenbacher commit 91fd3c3edcd7f223c5340a8324f67b03a85a73aa Author: Dan Carpenter Date: Mon Jan 13 16:23:07 2020 +0300 nfsd4: fix double free in nfsd4_do_async_copy() This frees "copy->nf_src" before and again after the goto. Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy") Signed-off-by: Dan Carpenter Reviewed-by: Olga Kornievskaia Signed-off-by: J. Bruce Fields commit 689827cd5bfe89e4900db7e1c0c713083a76d04c Author: Trond Myklebust Date: Tue Jan 14 12:02:44 2020 -0500 nfsd: convert file cache to use over/underflow safe refcount Use the 'refcount_t' type instead of 'atomic_t' for improved refcounting safety. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit c19285596de699e4602f9c89785e6b8c29422286 Author: Trond Myklebust Date: Tue Jan 14 12:00:22 2020 -0500 nfsd: Define the file access mode enum for tracing Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit a9ceb060b3cf37987b6162223575eaf4f4e0fc36 Author: Trond Myklebust Date: Tue Jan 14 12:00:21 2020 -0500 nfsd: Fix a perf warning perf does not know how to deal with a __builtin_bswap32() call, and complains. All other functions just store the xid etc in host endian form, so let's do that in the tracepoint for nfsd_file_acquire too. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 32f2fc5dc3992b4b60cc6b1a6a31be605cc9c3a2 Author: Vignesh Raghavendra Date: Tue Feb 4 18:18:16 2020 +0530 spi: spi-omap2-mcspi: Support probe deferral for DMA channels dma_request_channel() can return -EPROBE_DEFER, if DMA driver is not ready. Currently driver just falls back to PIO mode on probe deferral. Fix this by requesting all required channels during probe and propagating EPROBE_DEFER error code. Signed-off-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20200204124816.16735-3-vigneshr@ti.com Signed-off-by: Mark Brown commit e4e8276a4f652be2c7bb783a0155d4adb85f5d7d Author: Vignesh Raghavendra Date: Tue Feb 4 18:18:15 2020 +0530 spi: spi-omap2-mcspi: Handle DMA size restriction on AM65x On AM654, McSPI can only support 4K - 1 bytes per transfer when DMA is enabled. Therefore populate master->max_transfer_size callback to inform client drivers of this restriction when DMA channels are available. Signed-off-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20200204124816.16735-2-vigneshr@ti.com Signed-off-by: Mark Brown commit d1520889782dff58610c0b6b54d4cf3211ceb690 Author: Oleksandr Suvorov Date: Wed Feb 5 18:04:36 2020 +0200 ASoC: fsl_sai: Fix exiting path on probing failure If the imx-sdma driver is built as a module, the fsl-sai device doesn't disable on probing failure, which causes the warning in the next probing: ================================================================== fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable! fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable! fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable! fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable! fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable! fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable! ================================================================== Disabling the device properly fixes the issue. Fixes: 812ad463e089 ("ASoC: fsl_sai: Add support for runtime pm") Signed-off-by: Oleksandr Suvorov Link: https://lore.kernel.org/r/20200205160436.3813642-1-oleksandr.suvorov@toradex.com Signed-off-by: Mark Brown commit cabdb4fa2f666fad21b21b04c84709204f60af21 Author: zhengbin Date: Tue Jan 14 20:39:45 2020 +0800 fuse: use true,false for bool variable Fixes coccicheck warning: fs/fuse/readdir.c:335:1-19: WARNING: Assignment of 0/1 to bool variable fs/fuse/file.c:1398:2-19: WARNING: Assignment of 0/1 to bool variable fs/fuse/file.c:1400:2-20: WARNING: Assignment of 0/1 to bool variable fs/fuse/cuse.c:454:1-20: WARNING: Assignment of 0/1 to bool variable fs/fuse/cuse.c:455:1-19: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:497:2-17: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:504:2-23: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:511:2-22: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:518:2-23: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:522:2-26: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:526:2-18: WARNING: Assignment of 0/1 to bool variable fs/fuse/inode.c:1000:1-20: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Miklos Szeredi commit 8ab13bca428bb98e98d1933eaeacc90e80cf6192 Author: Daniel W. S. Almeida Date: Wed Jan 29 02:06:21 2020 -0300 Documentation: filesystems: convert fuse to RST Converts fuse.txt to reStructuredText format, improving the presentation without changing much of the underlying content. Signed-off-by: Daniel W. S. Almeida Signed-off-by: Miklos Szeredi commit 519525fa47b5a8155f0b203e49a3a6a2319f75ae Author: Vivek Goyal Date: Wed Feb 5 08:15:46 2020 -0500 fuse: Support RENAME_WHITEOUT flag Allow fuse to pass RENAME_WHITEOUT to fuse server. Overlayfs on top of virtiofs uses RENAME_WHITEOUT. Without this patch renaming a directory in overlayfs (dir is on lower) fails with -EINVAL. With this patch it works. Signed-off-by: Vivek Goyal Signed-off-by: Miklos Szeredi commit 2f1398291bf35fe027914ae7a9610d8e601fbfde Author: Miklos Szeredi Date: Thu Feb 6 16:39:28 2020 +0100 fuse: don't overflow LLONG_MAX with end offset Handle the special case of fuse_readpages() wanting to read the last page of a hugest file possible and overflowing the end offset in the process. This is basically to unbreak xfstests:generic/525 and prevent filesystems from doing bad things with an overflowing offset. Reported-by: Xiao Yang Signed-off-by: Miklos Szeredi commit f658adeea45e430a24c7a157c3d5448925ac2038 Author: Miklos Szeredi Date: Thu Feb 6 16:39:28 2020 +0100 fix up iter on short count in fuse_direct_io() fuse_direct_io() can end up advancing the iterator by more than the amount of data read or written. This case is handled by the generic code if going through ->direct_IO(), but not in the FOPEN_DIRECT_IO case. Fix by reverting the extra bytes from the iterator in case of error or a short count. To test: install lxcfs, then the following testcase int fd = open("/var/lib/lxcfs/proc/uptime", O_RDONLY); sendfile(1, fd, NULL, 16777216); sendfile(1, fd, NULL, 16777216); will spew WARN_ON() in iov_iter_pipe(). Reported-by: Peter Geis Reported-by: Al Viro Fixes: 3c3db095b68c ("fuse: use iov_iter based generic splice helpers") Cc: # v5.1 Signed-off-by: Miklos Szeredi commit d26c2ddd33569667e3eeb577c4c1d966ca9192e2 Author: Steve French Date: Thu Feb 6 06:00:14 2020 -0600 cifs: add SMB3 change notification support A commonly used SMB3 feature is change notification, allowing an app to be notified about changes to a directory. The SMB3 Notify request blocks until the server detects a change to that directory or its contents that matches the completion flags that were passed in and the "watch_tree" flag (which indicates whether subdirectories under this directory should be also included). See MS-SMB2 2.2.35 for additional detail. To use this simply pass in the following structure to ioctl: struct __attribute__((__packed__)) smb3_notify { uint32_t completion_filter; bool watch_tree; } __packed; using CIFS_IOC_NOTIFY 0x4005cf09 or equivalently _IOW(CIFS_IOCTL_MAGIC, 9, struct smb3_notify) SMB3 change notification is supported by all major servers. The ioctl will block until the server detects a change to that directory or its subdirectories (if watch_tree is set). Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Acked-by: Paulo Alcantara (SUSE) commit 343a1b777a92af3022c95ab6c188bef4a6e9ff97 Author: Aurelien Aptel Date: Thu Feb 6 10:19:11 2020 +0100 cifs: make multichannel warning more visible When no interfaces are returned by the server we cannot open multiple channels. Make it more obvious by reporting that to the user at the VFS log level. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit 09c40b15351c1bb1af035f7f6df167366d552790 Author: Ronnie Sahlberg Date: Thu Feb 6 13:55:19 2020 +1000 cifs: fix soft mounts hanging in the reconnect code RHBZ: 1795423 This is the SMB1 version of a patch we already have for SMB2 In recent DFS updates we have a new variable controlling how many times we will retry to reconnect the share. If DFS is not used, then this variable is initialized to 0 in: static inline int dfs_cache_get_nr_tgts(const struct dfs_cache_tgt_list *tl) { return tl ? tl->tl_numtgts : 0; } This means that in the reconnect loop in smb2_reconnect() we will immediately wrap retries to -1 and never actually get to pass this conditional: if (--retries) continue; The effect is that we no longer reach the point where we fail the commands with -EHOSTDOWN and basically the kernel threads are virtually hung and unkillable. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Reviewed-by: Paulo Alcantara (SUSE) commit 9e6c535c64adf6155e4a11fe8d63b384fe3452f8 Merge: 750ce8ccd8a8 2e34673be0bd Author: Linus Torvalds Date: Thu Feb 6 14:17:38 2020 +0000 Merge tag 'pci-v5.6-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Define to_pci_sysdata() always to fix build breakage when !CONFIG_PCI (Jason A. Donenfeld) - Use PF PASID for VFs to fix VF IOMMU bind failures (Kuppuswamy Sathyanarayanan) * tag 'pci-v5.6-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI/ATS: Use PF PASID for VFs x86/PCI: Define to_pci_sysdata() even when !CONFIG_PCI commit 750ce8ccd8a875ed9410fab01a3f468dab692eb4 Merge: 4c46bef2e96a 6954b323a183 Author: Linus Torvalds Date: Thu Feb 6 14:15:01 2020 +0000 Merge tag 'sound-fix-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of pending small fixes: ALSA core: - PCM memory leak fix ASoC: - Lots of SOF and Intel driver fixes - Addition of COMMON_CLK for wcd934x - Regression fixes for AMD and Tegra platforms HD-audio: - DP-MST HDMI regression fix, Tegra workarounds, HP quirk fix Others: - A few fixes relevant with the recent uapi-updates - Sparse warnings and endianness fixes" * tag 'sound-fix-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits) ALSA: hda: Clear RIRB status before reading WP ALSA: hda/realtek - Fixed one of HP ALC671 platform Headset Mic supported ASoC: wcd934x: Add missing COMMON_CLK dependency to SND_SOC_ALL_CODECS ALSA: hda - Fix DP-MST support for NVIDIA codecs ASoC: wcd934x: Add missing COMMON_CLK dependency MAINTAINERS: Remove the Bard Liao from the MAINTAINERS of Realtek CODECs ASoC: tegra: Revert 24 and 32 bit support ASoC: SOF: Intel: add PCI ID for JasperLake ALSA: hdsp: Make the firmware loading ioctl a bit more readable ALSA: emu10k1: Fix annotation and cast for the recent uapi header change ALSA: dummy: Fix PCM format loop in proc output ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk ALSA: usb-audio: Fix endianess in descriptor validation ALSA: hda: Add JasperLake PCI ID and codec vid ALSA: pcm: Fix sparse warnings wrt snd_pcm_state_t ALSA: pcm: Fix memory leak at closing a stream without hw_free ALSA: uapi: Fix sparse warning ASoC: rt715: Add __maybe_unused to PM callbacks ASoC: rt711: Add __maybe_unused to PM callbacks ASoC: rt700: Add __maybe_unused to PM callbacks ... commit 263a425a482fc495d6d3f9a29b9103a664c38b69 Author: Florian Fainelli Date: Wed Feb 5 12:32:04 2020 -0800 net: systemport: Avoid RBUF stuck in Wake-on-LAN mode After a number of suspend and resume cycles, it is possible for the RBUF to be stuck in Wake-on-LAN mode, despite the MPD enable bit being cleared which instructed the RBUF to exit that mode. Avoid creating that problematic condition by clearing the RX_EN and TX_EN bits in the UniMAC prior to disable the Magic Packet Detector logic which is guaranteed to make the RBUF exit Wake-on-LAN mode. Fixes: 83e82f4c706b ("net: systemport: add Wake-on-LAN support") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 21b5f672fb2eb1366dedc4ac9d32431146b378d3 Author: Heiner Kallweit Date: Wed Feb 5 21:22:46 2020 +0100 r8169: fix performance regression related to PCIe max read request size It turned out that on low performance systems the original change can cause lower tx performance. On a N3450-based mini-PC tx performance in iperf3 was reduced from 950Mbps to ~900Mbps. Therefore effectively revert the original change, just use pcie_set_readrq() now instead of changing the PCIe capability register directly. Fixes: 2df49d365498 ("r8169: remove fiddling with the PCIe max read request size") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 7a02ea65027523386ab4ba4af0ab93497b3073df Author: Dan Carpenter Date: Wed Feb 5 14:53:30 2020 +0300 net: sched: prevent a use after free The bug is that we call kfree_skb(skb) and then pass "skb" to qdisc_pkt_len(skb) on the next line, which is a use after free. Also Cong Wang points out that it's better to delay the actual frees until we drop the rtnl lock so we should use rtnl_kfree_skbs() instead of kfree_skb(). Cc: Cong Wang Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler") Signed-off-by: Dan Carpenter Acked-by: Cong Wang Signed-off-by: David S. Miller commit 86b18aaa2b5b5bb48e609cd591b3d2d0fdbe0442 Author: Qian Cai Date: Tue Feb 4 13:40:29 2020 -0500 skbuff: fix a data race in skb_queue_len() sk_buff.qlen can be accessed concurrently as noticed by KCSAN, BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_dgram_sendmsg read to 0xffff8a1b1d8a81c0 of 4 bytes by task 5371 on cpu 96: unix_dgram_sendmsg+0x9a9/0xb70 include/linux/skbuff.h:1821 net/unix/af_unix.c:1761 ____sys_sendmsg+0x33e/0x370 ___sys_sendmsg+0xa6/0xf0 __sys_sendmsg+0x69/0xf0 __x64_sys_sendmsg+0x51/0x70 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe write to 0xffff8a1b1d8a81c0 of 4 bytes by task 1 on cpu 99: __skb_try_recv_from_queue+0x327/0x410 include/linux/skbuff.h:2029 __skb_try_recv_datagram+0xbe/0x220 unix_dgram_recvmsg+0xee/0x850 ____sys_recvmsg+0x1fb/0x210 ___sys_recvmsg+0xa2/0xf0 __sys_recvmsg+0x66/0xf0 __x64_sys_recvmsg+0x51/0x70 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe Since only the read is operating as lockless, it could introduce a logic bug in unix_recvq_full() due to the load tearing. Fix it by adding a lockless variant of skb_queue_len() and unix_recvq_full() where READ_ONCE() is on the read while WRITE_ONCE() is on the write similar to the commit d7d16a89350a ("net: add skb_queue_empty_lockless()"). Signed-off-by: Qian Cai Signed-off-by: David S. Miller commit f1ed10264ed6b66b9cd5e8461cffce69be482356 Author: Nicolas Dichtel Date: Tue Feb 4 17:00:27 2020 +0100 vti[6]: fix packet tx through bpf_redirect() in XinY cases I forgot the 4in6/6in4 cases in my previous patch. Let's fix them. Fixes: 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()") Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit 4c46bef2e96a92df0f40fc91848e56889ef7c15e Merge: 5b21115414f5 3325322f773b Author: Linus Torvalds Date: Thu Feb 6 12:21:01 2020 +0000 Merge tag 'ceph-for-5.6-rc1' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: - a set of patches that fixes various corner cases in mount and umount code (Xiubo Li). This has to do with choosing an MDS, distinguishing between laggy and down MDSes and parsing the server path. - inode initialization fixes (Jeff Layton). The one included here mostly concerns things like open_by_handle() and there is another one that will come through Al. - copy_file_range() now uses the new copy-from2 op (Luis Henriques). The existing copy-from op turned out to be infeasible for generic filesystem use; we disable the copy offload if OSDs don't support copy-from2. - a patch to link "rbd" and "block" devices together in sysfs (Hannes Reinecke) ... and a smattering of cleanups from Xiubo, Jeff and Chengguang. * tag 'ceph-for-5.6-rc1' of https://github.com/ceph/ceph-client: (25 commits) rbd: set the 'device' link in sysfs ceph: move net/ceph/ceph_fs.c to fs/ceph/util.c ceph: print name of xattr in __ceph_{get,set}xattr() douts ceph: print r_direct_hash in hex in __choose_mds() dout ceph: use copy-from2 op in copy_file_range ceph: close holes in structs ceph_mds_session and ceph_mds_request rbd: work around -Wuninitialized warning ceph: allocate the correct amount of extra bytes for the session features ceph: rename get_session and switch to use ceph_get_mds_session ceph: remove the extra slashes in the server path ceph: add possible_max_rank and make the code more readable ceph: print dentry offset in hex and fix xattr_version type ceph: only touch the caps which have the subset mask requested ceph: don't clear I_NEW until inode metadata is fully populated ceph: retry the same mds later after the new session is opened ceph: check availability of mds cluster on mount after wait timeout ceph: keep the session state until it is released ceph: add __send_request helper ceph: ensure we have a new cap before continuing in fill_inode ceph: drop unused ttl_from parameter from fill_inode ... commit fcf2736c82ca1908e3a0e74730c404baebd8ccdf Author: Daniel Thompson Date: Thu Feb 6 11:40:09 2020 +0000 Revert "kdb: Get rid of confusing diag msg from "rd" if current task has no regs" This reverts commit bbfceba15f8d1260c328a254efc2b3f2deae4904. When DBG_MAX_REG_NUM is zero then a number of symbols are conditionally defined. It is therefore not possible to check it using C expressions. Reported-by: Anatoly Pugachev Acked-by: Doug Anderson Signed-off-by: Daniel Thompson commit 6954b323a183dc18fa9bf2ad700e0ed344918c5f Merge: 6d011d5057ff 13426feaf46c Author: Takashi Iwai Date: Thu Feb 6 11:58:44 2020 +0100 Merge tag 'asoc-v5.6-3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fix for v5.6 An incremental fix for the Qualcomm COMMON_CLK issue. commit 6d011d5057ff88ee556c000ac6fe0be23bdfcd72 Author: Mohan Kumar Date: Thu Feb 6 15:40:53 2020 +0530 ALSA: hda: Clear RIRB status before reading WP RIRB interrupt status getting cleared after the write pointer is read causes a race condition, where last response(s) into RIRB may remain unserviced by IRQ, eventually causing azx_rirb_get_response to fall back to polling mode. Clearing the RIRB interrupt status ahead of write pointer access ensures that this condition is avoided. Signed-off-by: Mohan Kumar Signed-off-by: Viswanath L Link: https://lore.kernel.org/r/1580983853-351-1-git-send-email-viswanathl@nvidia.com Signed-off-by: Takashi Iwai commit c35947b8ff8acca33134ee39c31708233765c31a Author: Lorenzo Bianconi Date: Thu Feb 6 10:14:39 2020 +0100 net: mvneta: move rx_dropped and rx_errors in per-cpu stats Move rx_dropped and rx_errors counters in mvneta_pcpu_stats in order to avoid possible races updating statistics Fixes: 562e2f467e71 ("net: mvneta: Improve the buffer allocation method for SWBM") Fixes: dc35a10f68d3 ("net: mvneta: bm: add support for hardware buffer management") Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 45a8317ed2c6f0d33a89367ec5d36e4e3aa46576 Author: Devulapally Shiva Krishna Date: Thu Feb 6 14:04:43 2020 +0530 cxgb4: Added tls stats prints. Added debugfs entry to show the tls stats. Signed-off-by: Devulapally Shiva Krishna Signed-off-by: Vinay Kumar Yadav Signed-off-by: David S. Miller commit b0519de8b3f1caf10632aca55def999ec2d2f1bc Author: Florian Westphal Date: Thu Feb 6 00:39:37 2020 +0100 mptcp: fix use-after-free for ipv6 Turns out that when we accept a new subflow, the newly created inet_sk(tcp_sk)->pinet6 points at the ipv6_pinfo structure of the listener socket. This wasn't caught by the selftest because it closes the accepted fd before the listening one. adding a close(listenfd) after accept returns is enough: BUG: KASAN: use-after-free in inet6_getname+0x6ba/0x790 Read of size 1 at addr ffff88810e310866 by task mptcp_connect/2518 Call Trace: inet6_getname+0x6ba/0x790 __sys_getpeername+0x10b/0x250 __x64_sys_getpeername+0x6f/0xb0 also alter test program to exercise this. Reported-by: Christoph Paasch Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit 1ad6f58ea9364b0a5d8ae06249653ac9304a8578 Author: David Hildenbrand Date: Wed Feb 5 17:34:01 2020 +0100 virtio_balloon: Fix memory leaks on errors in virtballoon_probe() We forget to put the inode and unmount the kernfs used for compaction. Fixes: 71994620bb25 ("virtio_balloon: replace oom notifier with shrinker") Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Wei Wang Cc: Liang Li Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20200205163402.42627-3-david@redhat.com Signed-off-by: Michael S. Tsirkin commit 6c22dc61c76b7e7d355f1697ba0ecf26d1334ba6 Author: David Hildenbrand Date: Wed Feb 5 17:34:00 2020 +0100 virtio-balloon: Fix memory leak when unloading while hinting is in progress When unloading the driver while hinting is in progress, we will not release the free page blocks back to MM, resulting in a memory leak. Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Wei Wang Cc: Liang Li Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20200205163402.42627-2-david@redhat.com Signed-off-by: Michael S. Tsirkin commit 6e9826e77249355c09db6ba41cd3f84e89f4b614 Author: Michael S. Tsirkin Date: Thu Feb 6 02:40:58 2020 -0500 virtio_balloon: prevent pfn array overflow Make sure, at build time, that pfn array is big enough to hold a single page. It happens to be true since the PAGE_SHIFT value at the moment is 20, which is 1M - exactly 256 4K balloon pages. Signed-off-by: Michael S. Tsirkin Reviewed-by: David Hildenbrand commit 782e067dba52de989a445f1bfa4bb770abb34480 Author: Christoph Hellwig Date: Thu Dec 12 17:37:19 2019 +0100 virtio-blk: remove VIRTIO_BLK_F_SCSI support Since the need for a special flag to support SCSI passthrough on a block device was added in May 2017 the SCSI passthrough support in virtio-blk has been disabled. It has always been a bad idea (just ask the original author..) and we have virtio-scsi for proper passthrough. The feature also never made it into the virtio 1.0 or later specifications. Signed-off-by: Christoph Hellwig Signed-off-by: Michael S. Tsirkin Reviewed-by: Hannes Reinecke Reviewed-by: Stefan Hajnoczi commit 303090b513fd1ee45aa1536b71a3838dc054bc05 Author: Daniel Verkamp Date: Fri Jan 3 10:40:45 2020 -0800 virtio-pci: check name when counting MSI-X vectors VQs without a name specified are not valid; they are skipped in the later loop that assigns MSI-X vectors to queues, but the per_vq_vectors loop above that counts the required number of vectors previously still counted any queue with a non-NULL callback as needing a vector. Add a check to the per_vq_vectors loop so that vectors with no name are not counted to make the two loops consistent. This prevents over-counting unnecessary vectors (e.g. for features which were not negotiated with the device). Cc: stable@vger.kernel.org Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Reviewed-by: Cornelia Huck Signed-off-by: Daniel Verkamp Signed-off-by: Michael S. Tsirkin Reviewed-by: Wang, Wei W commit 5790b53390e18fdd21e70776e46d058c05eda2f2 Author: Daniel Verkamp Date: Fri Jan 3 10:40:43 2020 -0800 virtio-balloon: initialize all vq callbacks Ensure that elements of the callbacks array that correspond to unavailable features are set to NULL; previously, they would be left uninitialized. Since the corresponding names array elements were explicitly set to NULL, the uninitialized callback pointers would not actually be dereferenced; however, the uninitialized callbacks elements would still be read in vp_find_vqs_msix() and used to calculate the number of MSI-X vectors required. Cc: stable@vger.kernel.org Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Reviewed-by: Cornelia Huck Signed-off-by: Daniel Verkamp Signed-off-by: Michael S. Tsirkin commit c64eb62cfce242a57a7276ca8280ae0baab29d05 Author: Yangtao Li Date: Sun Dec 22 19:08:39 2019 +0000 virtio-mmio: convert to devm_platform_ioremap_resource Use devm_platform_ioremap_resource() to simplify code, which contains platform_get_resource, devm_request_mem_region and devm_ioremap. Signed-off-by: Yangtao Li Signed-off-by: Michael S. Tsirkin commit 5b21115414f5b5220e7ab3ca7f5d2c1396f11854 Merge: 85e5529625f0 8044aad70a1f Author: Linus Torvalds Date: Thu Feb 6 08:13:23 2020 +0000 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "A couple of changes: - remove old CONFIG options from the m68knommu defconfig files - fix a warning in the m68k non-MMU get_user() macro" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: fix memcpy() out of bounds warning in get_user() m68k: configs: Cleanup old Kconfig IO scheduler options commit 85e5529625f0e41beefe8939eb08baf33131f7d6 Merge: 99be3f60989b 87fbfffcc89b Author: Linus Torvalds Date: Thu Feb 6 08:08:59 2020 +0000 Merge tag 'Smack-for-5.6' of git://github.com/cschaufler/smack-next Pull smack fix from Casey Schaufler: "One fix for an obscure error found using an old version of ping(1) that did not use IPv6 sockets in the documented way" * tag 'Smack-for-5.6' of git://github.com/cschaufler/smack-next: broken ping to ipv6 linklocal addresses on debian buster commit 99be3f60989b4813f625b5421427fa9ab01e3a23 Merge: e310396bb8d7 cdbcf82b86ea Author: Linus Torvalds Date: Thu Feb 6 07:58:38 2020 +0000 Merge tag 'xfs-5.6-merge-8' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull moar xfs updates from Darrick Wong: "This contains the buffer error code refactoring I mentioned last week, now that it has had extra time to complete the full xfs fuzz testing suite to make sure there aren't any obvious new bugs" * tag 'xfs-5.6-merge-8' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix xfs_buf_ioerror_alert location reporting xfs: remove unnecessary null pointer checks from _read_agf callers xfs: make xfs_*read_agf return EAGAIN to ALLOC_FLAG_TRYLOCK callers xfs: remove the xfs_btree_get_buf[ls] functions xfs: make xfs_trans_get_buf return an error code xfs: make xfs_trans_get_buf_map return an error code xfs: make xfs_buf_read return an error code xfs: make xfs_buf_get_uncached return an error code xfs: make xfs_buf_get return an error code xfs: make xfs_buf_read_map return an error code xfs: make xfs_buf_get_map return an error code xfs: make xfs_buf_alloc return an error code commit e310396bb8d7db977a0e10ef7b5040e98b89c34c Merge: c1ef57a3a3f5 a00574036c26 Author: Linus Torvalds Date: Thu Feb 6 07:12:11 2020 +0000 Merge tag 'trace-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: - Added new "bootconfig". This looks for a file appended to initrd to add boot config options, and has been discussed thoroughly at Linux Plumbers. Very useful for adding kprobes at bootup. Only enabled if "bootconfig" is on the real kernel command line. - Created dynamic event creation. Merges common code between creating synthetic events and kprobe events. - Rename perf "ring_buffer" structure to "perf_buffer" - Rename ftrace "ring_buffer" structure to "trace_buffer" Had to rename existing "trace_buffer" to "array_buffer" - Allow trace_printk() to work withing (some) tracing code. - Sort of tracing configs to be a little better organized - Fixed bug where ftrace_graph hash was not being protected properly - Various other small fixes and clean ups * tag 'trace-v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (88 commits) bootconfig: Show the number of nodes on boot message tools/bootconfig: Show the number of bootconfig nodes bootconfig: Add more parse error messages bootconfig: Use bootconfig instead of boot config ftrace: Protect ftrace_graph_hash with ftrace_sync ftrace: Add comment to why rcu_dereference_sched() is open coded tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu tracing: Annotate ftrace_graph_hash pointer with __rcu bootconfig: Only load bootconfig if "bootconfig" is on the kernel cmdline tracing: Use seq_buf for building dynevent_cmd string tracing: Remove useless code in dynevent_arg_pair_add() tracing: Remove check_arg() callbacks from dynevent args tracing: Consolidate some synth_event_trace code tracing: Fix now invalid var_ref_vals assumption in trace action tracing: Change trace_boot to use synth_event interface tracing: Move tracing selftests to bottom of menu tracing: Move mmio tracer config up with the other tracers tracing: Move tracing test module configs together tracing: Move all function tracing configs together tracing: Documentation for in-kernel synthetic event API ... commit f2adbae0cb20c8eaf06914b2187043ea944b0aff Author: Kailang Yang Date: Wed Feb 5 15:40:01 2020 +0800 ALSA: hda/realtek - Fixed one of HP ALC671 platform Headset Mic supported HP want to keep BIOS verb table for release platform. So, it need to add 0x19 pin for quirk. Fixes: 5af29028fd6d ("ALSA: hda/realtek - Add Headset Mic supported for HP cPC") Signed-off-by: Kailang Yang Link: https://lore.kernel.org/r/74636ccb700a4cbda24c58a99dc430ce@realtek.com Signed-off-by: Takashi Iwai commit c1ef57a3a3f5e69e98baf89055b423da62791c13 Merge: ed535f2c9e00 2faf852d1be8 Author: Linus Torvalds Date: Thu Feb 6 06:33:17 2020 +0000 Merge tag 'io_uring-5.6-2020-02-05' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: "Some later fixes for io_uring: - Small cleanup series from Pavel - Belt and suspenders build time check of sqe size and layout (Stefan) - Addition of ->show_fdinfo() on request of Jann Horn, to aid in understanding mapped personalities - eventfd recursion/deadlock fix, for both io_uring and aio - Fixup for send/recv handling - Fixup for double deferral of read/write request - Fix for potential double completion event for close request - Adjust fadvise advice async/inline behavior - Fix for shutdown hang with SQPOLL thread - Fix for potential use-after-free of fixed file table" * tag 'io_uring-5.6-2020-02-05' of git://git.kernel.dk/linux-block: io_uring: cleanup fixed file data table references io_uring: spin for sq thread to idle on shutdown aio: prevent potential eventfd recursion on poll io_uring: put the flag changing code in the same spot io_uring: iterate req cache backwards io_uring: punt even fadvise() WILLNEED to async context io_uring: fix sporadic double CQE entry for close io_uring: remove extra ->file check io_uring: don't map read/write iovec potentially twice io_uring: use the proper helpers for io_send/recv io_uring: prevent potential eventfd recursion on poll eventfd: track eventfd_signal() recursion depth io_uring: add BUILD_BUG_ON() to assert the layout of struct io_uring_sqe io_uring: add ->show_fdinfo() for the io_uring file descriptor commit ed535f2c9e00eafdeb57d6310b7c8c5a009a9262 Merge: 0384066381ed b74e58cd472c Author: Linus Torvalds Date: Thu Feb 6 06:15:23 2020 +0000 Merge tag 'block-5.6-2020-02-05' of git://git.kernel.dk/linux-block Pull more block updates from Jens Axboe: "Some later arrivals, but all fixes at this point: - bcache fix series (Coly) - Series of BFQ fixes (Paolo) - NVMe pull request from Keith with a few minor NVMe fixes - Various little tweaks" * tag 'block-5.6-2020-02-05' of git://git.kernel.dk/linux-block: (23 commits) nvmet: update AEN list and array at one place nvmet: Fix controller use after free nvmet: Fix error print message at nvmet_install_queue function brd: check and limit max_part par nvme-pci: remove nvmeq->tags nvmet: fix dsm failure when payload does not match sgl descriptor nvmet: Pass lockdep expression to RCU lists block, bfq: clarify the goal of bfq_split_bfqq() block, bfq: get a ref to a group when adding it to a service tree block, bfq: remove ifdefs from around gets/puts of bfq groups block, bfq: extend incomplete name of field on_st block, bfq: get extra ref to prevent a queue from being freed during a group move block, bfq: do not insert oom queue into position tree block, bfq: do not plug I/O for bfq_queues with no proc refs bcache: check return value of prio_read() bcache: fix incorrect data type usage in btree_flush_write() bcache: add readahead cache policy options via sysfs interface bcache: explicity type cast in bset_bkey_last() bcache: fix memory corruption in bch_cache_accounting_clear() xen/blkfront: limit allocated memory size to actual use case ... commit 0384066381ed5572cf1f57f8d01eaccd3f6d4785 Merge: 4c7d00ccf40d 7991901082f0 Author: Linus Torvalds Date: Thu Feb 6 06:11:50 2020 +0000 Merge tag 'libata-5.6-2020-02-05' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: - Add a Sandisk CF card to supported pata_pcmcia list (Christian) - Move pata_arasan_cf away from legacy API (Peter) - Ensure ahci DMA/ints are shut down on shutdown (Prabhakar) * tag 'libata-5.6-2020-02-05' of git://git.kernel.dk/linux-block: ata: pata_arasan_cf: Use dma_request_chan() instead dma_request_slave_channel() ata: ahci: Add shutdown to freeze hardware resources of ahci pata_pcmia: add SanDisk High (>8G) CF card to supported list commit 96222d53842dfe54869ec4e1b9d4856daf9105a2 Author: Jeff Moyer Date: Wed Feb 5 14:15:58 2020 -0500 dax: pass NOWAIT flag to iomap_apply fstests generic/471 reports a failure when run with MOUNT_OPTIONS="-o dax". The reason is that the initial pwrite to an empty file with the RWF_NOWAIT flag set does not return -EAGAIN. It turns out that dax_iomap_rw doesn't pass that flag through to iomap_apply. With this patch applied, generic/471 passes for me. Signed-off-by: Jeff Moyer Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/x49r1z86e1d.fsf@segfault.boston.devel.redhat.com Signed-off-by: Dan Williams commit f2bf09e97b47c7b13e8a918f560f6082e9bc8f8a Author: Steve French Date: Wed Feb 5 18:22:37 2020 -0600 cifs: Add tracepoints for errors on flush or fsync Makes it easier to debug errors on writeback that happen later, and are being returned on flush or fsync For example: writetest-17829 [002] .... 13583.407859: cifs_flush_err: ino=90 rc=-28 Signed-off-by: Steve French commit d6fd41905ec577851734623fb905b1763801f5ef Author: Steve French Date: Wed Feb 5 16:52:11 2020 -0600 cifs: log warning message (once) if out of disk space We ran into a confusing problem where an application wasn't checking return code on close and so user didn't realize that the application ran out of disk space. log a warning message (once) in these cases. For example: [ 8407.391909] Out of space writing to \\oleg-server\small-share Signed-off-by: Steve French Reported-by: Oleg Kravtsov Reviewed-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky commit 39a706fbcf2694bfb651bed9041d44c3f4fa8078 Author: Ondrej Mosnacek Date: Mon Feb 3 09:50:23 2020 +0100 selinux: fix sidtab string cache locking Avoiding taking a lock in an IRQ context is not enough to prevent deadlocks, as discovered by syzbot: === WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 5.5.0-syzkaller #0 Not tainted ----------------------------------------------------- syz-executor.0/8927 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire: ffff888027c94098 (&(&s->cache_lock)->rlock){+.+.}, at: spin_lock include/linux/spinlock.h:338 [inline] ffff888027c94098 (&(&s->cache_lock)->rlock){+.+.}, at: sidtab_sid2str_put.part.0+0x36/0x880 security/selinux/ss/sidtab.c:533 and this task is already holding: ffffffff898639b0 (&(&nf_conntrack_locks[i])->rlock){+.-.}, at: spin_lock include/linux/spinlock.h:338 [inline] ffffffff898639b0 (&(&nf_conntrack_locks[i])->rlock){+.-.}, at: nf_conntrack_lock+0x17/0x70 net/netfilter/nf_conntrack_core.c:91 which would create a new lock dependency: (&(&nf_conntrack_locks[i])->rlock){+.-.} -> (&(&s->cache_lock)->rlock){+.+.} but this new dependency connects a SOFTIRQ-irq-safe lock: (&(&nf_conntrack_locks[i])->rlock){+.-.} [...] other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&s->cache_lock)->rlock); local_irq_disable(); lock(&(&nf_conntrack_locks[i])->rlock); lock(&(&s->cache_lock)->rlock); lock(&(&nf_conntrack_locks[i])->rlock); *** DEADLOCK *** [...] === Fix this by simply locking with irqsave/irqrestore and stop giving up on !in_task(). It makes the locking a bit slower, but it shouldn't make a big difference in real workloads. Under the scenario from [1] (only cache hits) it only increased the runtime overhead from the security_secid_to_secctx() function from ~2% to ~3% (it was ~5-65% before introducing the cache). [1] https://bugzilla.redhat.com/show_bug.cgi?id=1733259 Fixes: d97bd23c2d7d ("selinux: cache the SID -> context string translation") Reported-by: syzbot+61cba5033e2072d61806@syzkaller.appspotmail.com Signed-off-by: Ondrej Mosnacek Acked-by: Stephen Smalley Signed-off-by: Paul Moore commit a20456aef80fa6dda500b46c4bd04e39135097c6 Author: Hridya Valsaraju Date: Sat Feb 1 17:46:23 2020 -0800 selinux: fix typo in filesystem name Correct the filesystem name to "binder" to enable genfscon per-file labelling for binderfs. Fixes: 7a4b5194747 ("selinux: allow per-file labelling for binderfs") Signed-off-by: Hridya Valsaraju Acked-by: Stephen Smalley [PM: slight style changes to the subj/description] Signed-off-by: Paul Moore commit 5df867145f8adad9e5cdf9d67db1fbc0f71351e9 Author: Geert Uytterhoeven Date: Wed Feb 5 20:46:49 2020 +0100 of: clk: Make self-contained Depending on include order: include/linux/of_clk.h:11:45: warning: ‘struct device_node’ declared inside parameter list will not be visible outside of this definition or declaration unsigned int of_clk_get_parent_count(struct device_node *np); ^~~~~~~~~~~ include/linux/of_clk.h:12:43: warning: ‘struct device_node’ declared inside parameter list will not be visible outside of this definition or declaration const char *of_clk_get_parent_name(struct device_node *np, int index); ^~~~~~~~~~~ include/linux/of_clk.h:13:31: warning: ‘struct of_device_id’ declared inside parameter list will not be visible outside of this definition or declaration void of_clk_init(const struct of_device_id *matches); ^~~~~~~~~~~~ Fix this by adding forward declarations for struct device_node and struct of_device_id. Signed-off-by: Geert Uytterhoeven Link: https://lkml.kernel.org/r/20200205194649.31309-1-geert+renesas@glider.be Signed-off-by: Stephen Boyd commit a00574036c261421721fa770ccd21a1012e1fbbd Author: Masami Hiramatsu Date: Wed Feb 5 22:50:23 2020 +0900 bootconfig: Show the number of nodes on boot message Show the number of bootconfig nodes on boot message. Link: http://lkml.kernel.org/r/158091062297.27924.9051634676068550285.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 0f0d0a77ccbdc6bfe51c0d184f92d99ebcc2e809 Author: Masami Hiramatsu Date: Wed Feb 5 22:50:13 2020 +0900 tools/bootconfig: Show the number of bootconfig nodes Show the number of bootconfig nodes when applying new bootconfig to initrd. Since there are limitations of bootconfig not only in its filesize, but also the number of nodes, the number should be shown when applying so that user can get the feeling of scale of current bootconfig. Link: http://lkml.kernel.org/r/158091061337.27924.10886706631693823982.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 597c0e3b4540972580ab36bcc8aa34394bd88cfb Author: Masami Hiramatsu Date: Wed Feb 5 22:50:04 2020 +0900 bootconfig: Add more parse error messages Add more error messages for following cases. - Exceeding max number of nodes - Config tree data is empty (e.g. comment only) - Config data is empty or exceeding max size - bootconfig is already initialized Link: http://lkml.kernel.org/r/158091060401.27924.9024818742827122764.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit e241d14a82910ffa9060d81864760c93b7256195 Author: Masami Hiramatsu Date: Wed Feb 5 22:49:54 2020 +0900 bootconfig: Use bootconfig instead of boot config Use "bootconfig" (1 word) instead of "boot config" (2 words) in the boot message. Link: http://lkml.kernel.org/r/158091059459.27924.14414336187441539879.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 54a16ff6f2e50775145b210bcd94d62c3c2af117 Author: Steven Rostedt (VMware) Date: Wed Feb 5 09:20:32 2020 -0500 ftrace: Protect ftrace_graph_hash with ftrace_sync As function_graph tracer can run when RCU is not "watching", it can not be protected by synchronize_rcu() it requires running a task on each CPU before it can be freed. Calling schedule_on_each_cpu(ftrace_sync) needs to be used. Link: https://lore.kernel.org/r/20200205131110.GT2935@paulmck-ThinkPad-P72 Cc: stable@vger.kernel.org Fixes: b9b0c831bed26 ("ftrace: Convert graph filter to use hash tables") Reported-by: "Paul E. McKenney" Reviewed-by: Joel Fernandes (Google) Signed-off-by: Steven Rostedt (VMware) commit 87fbfffcc89b92a4281b0aa53bd06af714087889 Author: Casey Schaufler Date: Mon Feb 3 09:15:00 2020 -0800 broken ping to ipv6 linklocal addresses on debian buster I am seeing ping failures to IPv6 linklocal addresses with Debian buster. Easiest example to reproduce is: $ ping -c1 -w1 ff02::1%eth1 connect: Invalid argument $ ping -c1 -w1 ff02::1%eth1 PING ff02::01%eth1(ff02::1%eth1) 56 data bytes 64 bytes from fe80::e0:f9ff:fe0c:37%eth1: icmp_seq=1 ttl=64 time=0.059 ms git bisect traced the failure to commit b9ef5513c99b ("smack: Check address length before reading address family") Arguably ping is being stupid since the buster version is not setting the address family properly (ping on stretch for example does): $ strace -e connect ping6 -c1 -w1 ff02::1%eth1 connect(5, {sa_family=AF_UNSPEC, sa_data="\4\1\0\0\0\0\377\2\0\0\0\0\0\0\0\0\0\0\0\0\0\1\3\0\0\0"}, 28) = -1 EINVAL (Invalid argument) but the command works fine on kernels prior to this commit, so this is breakage which goes against the Linux paradigm of "don't break userspace" Cc: stable@vger.kernel.org Reported-by: David Ahern Suggested-by: Tetsuo Handa Signed-off-by: Casey Schaufler  security/smack/smack_lsm.c | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-) commit 16052dd5bdfa16dbe18d8c1d4cde2ddab9d23177 Author: Steven Rostedt (VMware) Date: Wed Feb 5 02:17:57 2020 -0500 ftrace: Add comment to why rcu_dereference_sched() is open coded Because the function graph tracer can execute in sections where RCU is not "watching", the rcu_dereference_sched() for the has needs to be open coded. This is fine because the RCU "flavor" of the ftrace hash is protected by its own RCU handling (it does its own little synchronization on every CPU and does not rely on RCU sched). Acked-by: Joel Fernandes (Google) Signed-off-by: Steven Rostedt (VMware) commit fd0e6852c407dd9aefc594f54ddcc21d84803d3b Author: Amol Grover Date: Wed Feb 5 11:27:02 2020 +0530 tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu Fix following instances of sparse error kernel/trace/ftrace.c:5667:29: error: incompatible types in comparison kernel/trace/ftrace.c:5813:21: error: incompatible types in comparison kernel/trace/ftrace.c:5868:36: error: incompatible types in comparison kernel/trace/ftrace.c:5870:25: error: incompatible types in comparison Use rcu_dereference_protected to dereference the newly annotated pointer. Link: http://lkml.kernel.org/r/20200205055701.30195-1-frextrite@gmail.com Signed-off-by: Amol Grover Signed-off-by: Steven Rostedt (VMware) commit 24a9729f831462b1d9d61dc85ecc91c59037243f Author: Amol Grover Date: Sat Feb 1 12:57:04 2020 +0530 tracing: Annotate ftrace_graph_hash pointer with __rcu Fix following instances of sparse error kernel/trace/ftrace.c:5664:29: error: incompatible types in comparison kernel/trace/ftrace.c:5785:21: error: incompatible types in comparison kernel/trace/ftrace.c:5864:36: error: incompatible types in comparison kernel/trace/ftrace.c:5866:25: error: incompatible types in comparison Use rcu_dereference_protected to access the __rcu annotated pointer. Link: http://lkml.kernel.org/r/20200201072703.17330-1-frextrite@gmail.com Reviewed-by: Joel Fernandes (Google) Signed-off-by: Amol Grover Signed-off-by: Steven Rostedt (VMware) commit f566e1fbadb686e28f1c307e356114b2865ef588 Author: Masahiro Yamada Date: Wed Feb 5 15:51:52 2020 +0900 kbuild: make multiple directory targets work Currently, the single-target build does not work when two or more sub-directories are given: $ make fs/ kernel/ lib/ CALL scripts/checksyscalls.sh CALL scripts/atomic/check-atomics.sh DESCEND objtool make[2]: Nothing to be done for 'kernel/'. make[2]: Nothing to be done for 'fs/'. make[2]: Nothing to be done for 'lib/'. Make it work properly. Reported-by: Linus Torvalds Signed-off-by: Masahiro Yamada commit b9e42724888527352604260abc6717cba21421de Merge: fc9e34f8de00 8ed47e140867 Author: Daniel Borkmann Date: Wed Feb 5 22:06:09 2020 +0100 Merge branch 'bpf-xsk-fixes' Maciej Fijalkowski says: ==================== Cameron reported [0] that on fresh bpf-next he could not run multiple xdpsock instances in Tx-only mode on single network interface with i40e driver. Turns out that Maxim's series [1] which was adding RCU protection around ndo_xsk_wakeup added check against the __I40E_CONFIG_BUSY being set on pf->state within i40e_xsk_wakeup() - if it's set, return -ENETDOWN. Since this bit is set per PF when UMEM is being enabled/disabled, the situation Cameron stumbled upon was that when he launched second xdpsock instance, second UMEM was being registered, hence set __I40E_CONFIG_BUSY which is now observed by first xdpsock and therefore xdpsock's kick_tx() gets -ENETDOWN as errno. -ENETDOWN currently is not allowed in kick_tx(), so we were exiting the first application. Such exit means also XDP program being unloaded and its dedicated resources, which caused an -ENXIO being return in the second xdpsock instance. Let's fix the issue from both sides - protect ourselves from future xdpsock crashes by allowing for -ENETDOWN errno being set in kick_tx() (patch 3) and from driver side, return -EAGAIN for the case where PF is busy (patch 1). Remove also doubled variable from xdpsock_user.c (patch 2). Note that ixgbe seems not to be affected since UMEM registration sets the busy/disable bit per ring, not per PF. [0]: https://www.spinics.net/lists/xdp-newbies/msg01558.html [1]: https://lore.kernel.org/netdev/20191217162023.16011-1-maximmi@mellanox.com/ ==================== Signed-off-by: Daniel Borkmann commit 8ed47e140867a6e7d56170f325c8d4fdee6d6b66 Author: Maciej Fijalkowski Date: Wed Feb 5 05:58:34 2020 +0100 samples: bpf: Allow for -ENETDOWN in xdpsock ndo_xsk_wakeup() can return -ENETDOWN and there's no particular reason to bail the whole application out on that case. Let's check in kick_tx() whether errno was set to mentioned value and basically allow application to further process frames. Fixes: 248c7f9c0e21 ("samples/bpf: convert xdpsock to use libbpf for AF_XDP access") Reported-by: Cameron Elliott Signed-off-by: Maciej Fijalkowski Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20200205045834.56795-4-maciej.fijalkowski@intel.com commit 32c92c15ad3dca6f7cca8643766ad79fa3ab3d17 Author: Maciej Fijalkowski Date: Wed Feb 5 05:58:33 2020 +0100 samples: bpf: Drop doubled variable declaration in xdpsock Seems that by accident there is a doubled declaration of global variable opt_xdp_bind_flags in xdpsock_user.c. The second one is uninitialized so compiler was simply ignoring it. To keep things clean, drop the doubled variable. Fixes: c543f5469822 ("samples/bpf: add unaligned chunks mode support to xdpsock") Signed-off-by: Maciej Fijalkowski Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20200205045834.56795-3-maciej.fijalkowski@intel.com commit c77e9f09143822623dd71a0fdc84331129e97c3a Author: Maciej Fijalkowski Date: Wed Feb 5 05:58:32 2020 +0100 i40e: Relax i40e_xsk_wakeup's return value when PF is busy Return -EAGAIN instead of -ENETDOWN to provide a slightly milder information to user space so that an application will know to retry the syscall when __I40E_CONFIG_BUSY bit is set on pf->state. Fixes: b3873a5be757 ("net/i40e: Fix concurrency issues between config flow and XSK") Signed-off-by: Maciej Fijalkowski Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20200205045834.56795-2-maciej.fijalkowski@intel.com commit fc9e34f8de001c92e6cfc6481bb30a34dbda4f5c Author: Song Liu Date: Tue Feb 4 13:50:37 2020 -0800 tools/bpf/runqslower: Rebuild libbpf.a on libbpf source change Add missing dependency of $(BPFOBJ) to $(LIBBPF_SRC), so that running make in runqslower/ will rebuild libbpf.a when there is change in libbpf/. Fixes: 9c01546d26d2 ("tools/bpf: Add runqslower tool to tools/bpf") Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20200204215037.2258698-1-songliubraving@fb.com commit 4c7d00ccf40db99bfb7bd1857bcbf007275704d8 Merge: 18ea671ba40b 9871abffc810 Author: Linus Torvalds Date: Wed Feb 5 18:11:51 2020 +0000 Merge tag 'pwm/for-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "Mostly cleanups and minor improvements with some new chip support for some drivers" * tag 'pwm/for-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (37 commits) pwm: Remove set but not set variable 'pwm' pwm: sun4i: Initialize variables before use pwm: stm32: Remove automatic output enable pwm: sun4i: Narrow scope of local variable pwm: bcm2835: Allow building for ARCH_BRCMSTB pwm: imx27: Eliminate error message for defer probe pwm: sun4i: Fix inconsistent IS_ERR and PTR_ERR pwm: sun4i: Move pwm_calculate() out of spin_lock() pwm: omap-dmtimer: Allow compiling with COMPILE_TEST pwm: omap-dmtimer: put_device() after of_find_device_by_node() pwm: omap-dmtimer: Simplify error handling pwm: omap-dmtimer: Remove PWM chip in .remove before making it unfunctional pwm: Implement tracing for .get_state() and .apply_state() pwm: rcar: Document inability to set duty_cycle = 0 pwm: rcar: Drop useless call to pwm_get_state() pwm: Fix minor Kconfig whitespace issues pwm: atmel: Implement .get_state() pwm: atmel: Use register accessors for channels pwm: atmel: Document known weaknesses of both hardware and software pwm: atmel: Replace loop in prescale calculation by ad-hoc calculation ... commit 18ea671ba40bcbb15c47118e20010240186da33b Merge: 4fc2ea6a8608 bad83565eafe Author: Linus Torvalds Date: Wed Feb 5 18:07:39 2020 +0000 Merge tag 'dmaengine-fix-5.6-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Fixes for: - Documentation build error fix - Fix dma_request_chan() error return - Remove unneeded conversion in idxd driver - Fix pointer check for dma_async_device_channel_register() - Fix slave-channel symlink cleanup" * tag 'dmaengine-fix-5.6-rc1' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: Cleanups for the slave <-> channel symlink support dmaengine: fix null ptr check for __dma_async_device_channel_register() dmaengine: idxd: fix boolconv.cocci warnings dmaengine: Fix return value for dma_request_chan() in case of failure dmaengine: doc: Properly indent metadata title commit 2e34673be0bd6bb0c6c496a861cbc3f7431e7ce3 Author: Kuppuswamy Sathyanarayanan Date: Wed Jan 29 11:14:00 2020 -0800 PCI/ATS: Use PF PASID for VFs Per PCIe r5.0, sec 9.3.7.14, if a PF implements the PASID Capability, the PF PASID configuration is shared by its VFs, and VFs must not implement their own PASID Capability. But commit 751035b8dc06 ("PCI/ATS: Cache PASID Capability offset") changed pci_max_pasids() and pci_pasid_features() to use the PASID Capability of the VF device instead of the associated PF device. This leads to IOMMU bind failures when pci_max_pasids() and pci_pasid_features() are called for VFs. In pci_max_pasids() and pci_pasid_features(), always use the PF PASID Capability. Fixes: 751035b8dc06 ("PCI/ATS: Cache PASID Capability offset") Link: https://lore.kernel.org/r/fe891f9755cb18349389609e7fed9940fc5b081a.1580325170.git.sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Bjorn Helgaas CC: stable@vger.kernel.org # v5.5+ commit 75467ee48a5e04cf3ae3cb39aea6adee73aeff91 Author: Christoph Hellwig Date: Mon Feb 3 14:54:50 2020 +0100 dma-direct: improve DMA mask overflow reporting Remove the unset dma_mask case as that won't get into mapping calls anymore, and also report the other errors unconditonally and with a slightly improved message. Remove the now pointless report_addr helper. Signed-off-by: Christoph Hellwig Reviewed-by: Konrad Rzeszutek Wilk commit 4a47cbae04844f0c5e2365aa6c217b61850bb832 Author: Christoph Hellwig Date: Mon Feb 3 14:44:38 2020 +0100 dma-direct: improve swiotlb error reporting Untangle the way how dma_direct_map_page calls into swiotlb to be able to properly report errors where the swiotlb DMA address overflows the mask separately from overflows in the !swiotlb case. This means that siotlb_map now has to do a little more work that duplicates dma_direct_map_page, but doing so greatly simplifies the calling convention. Signed-off-by: Christoph Hellwig Reviewed-by: Konrad Rzeszutek Wilk commit 91ef26f914171cf753330f13724fd9142b5b1640 Author: Christoph Hellwig Date: Mon Feb 3 18:11:10 2020 +0100 dma-direct: relax addressability checks in dma_direct_supported dma_direct_supported tries to find the minimum addressable bitmask based on the end pfn and optional magic that architectures can use to communicate the size of the magic ZONE_DMA that can be used for bounce buffering. But between the DMA offsets that can change per device (or sometimes even region), the fact the ZONE_DMA isn't even guaranteed to be the lowest addresses and failure of having proper interfaces to the MM code this fails at least for one arm subarchitecture. As all the legacy DMA implementations have supported 32-bit DMA masks, and 32-bit masks are guranteed to always work by the API contract (using bounce buffers if needed), we can short cut the complicated check and always return true without breaking existing assumptions. Hopefully we can properly clean up the interaction with the arch defined zones and the bootmem allocator eventually. Fixes: ad3c7b18c5b3 ("arm: use swiotlb for bounce buffering on LPAE configs") Reported-by: Peter Ujfalusi Signed-off-by: Christoph Hellwig Tested-by: Peter Ujfalusi commit 4fc2ea6a8608d9a649eff5e3c2ee477eb70f0fb6 Merge: d271ab29230b e3b5ee0cfb65 Author: Linus Torvalds Date: Wed Feb 5 17:49:54 2020 +0000 Merge tag 'iommu-updates-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - Allow compiling the ARM-SMMU drivers as modules. - Fixes and cleanups for the ARM-SMMU drivers and io-pgtable code collected by Will Deacon. The merge-commit (6855d1ba7537) has all the details. - Cleanup of the iommu_put_resv_regions() call-backs in various drivers. - AMD IOMMU driver cleanups. - Update for the x2APIC support in the AMD IOMMU driver. - Preparation patches for Intel VT-d nested mode support. - RMRR and identity domain handling fixes for the Intel VT-d driver. - More small fixes and cleanups. * tag 'iommu-updates-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (87 commits) iommu/amd: Remove the unnecessary assignment iommu/vt-d: Remove unnecessary WARN_ON_ONCE() iommu/vt-d: Unnecessary to handle default identity domain iommu/vt-d: Allow devices with RMRRs to use identity domain iommu/vt-d: Add RMRR base and end addresses sanity check iommu/vt-d: Mark firmware tainted if RMRR fails sanity check iommu/amd: Remove unused struct member iommu/amd: Replace two consecutive readl calls with one readq iommu/vt-d: Don't reject Host Bridge due to scope mismatch PCI/ATS: Add PASID stubs iommu/arm-smmu-v3: Return -EBUSY when trying to re-add a device iommu/arm-smmu-v3: Improve add_device() error handling iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE iommu/arm-smmu-v3: Add second level of context descriptor table iommu/arm-smmu-v3: Prepare for handling arm_smmu_write_ctx_desc() failure iommu/arm-smmu-v3: Propagate ssid_bits iommu/arm-smmu-v3: Add support for Substream IDs iommu/arm-smmu-v3: Add context descriptor tables allocators iommu/arm-smmu-v3: Prepare arm_smmu_s1_cfg for SSID support ACPI/IORT: Parse SSID property of named component node ... commit d271ab29230b1d0ceb426f374c221c4eb2c91c64 Merge: 2634744bf38a 8557bbe5156e Author: Linus Torvalds Date: Wed Feb 5 17:44:14 2020 +0000 Merge tag 'for-linus-5.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix a bug introduced in 5.5 in the Xen gntdev driver - fix the Xen balloon driver when running on ancient Xen versions - allow Xen stubdoms to control interrupt enable flags of passed-through PCI cards - release resources in Xen backends under memory pressure * tag 'for-linus-5.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/blkback: Consistently insert one empty line between functions xen/blkback: Remove unnecessary static variable name prefixes xen/blkback: Squeeze page pools if a memory pressure is detected xenbus/backend: Protect xenbus callback with lock xenbus/backend: Add memory pressure handler callback xen/gntdev: Do not use mm notifiers with autotranslating guests xen/balloon: Support xend-based toolstack take two xen-pciback: optionally allow interrupt enable flag writes commit 2634744bf38ab20d17fe8220f1f83b6f3801386f Merge: cfb4b571e8b5 04dbd86539fd Author: Linus Torvalds Date: Wed Feb 5 17:37:25 2020 +0000 Merge tag 'devicetree-fixes-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix incorrect $id paths in schemas - Two fixes for Intel LGM SoC binding schemas * tag 'devicetree-fixes-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: Fix paths in schema $id fields dt-bindings: PCI: intel: Fix dt_binding_check compilation failure dt-bindings: phy: Fix errors in intel,lgm-emmc-phy example commit d1c9038ab5c1c96c0fd9d13ec56f2d650fe4c59f Author: Stephen Kitt Date: Fri Jan 24 19:33:16 2020 +0100 Allow git builds of Sphinx When using a non-release version of Sphinx, from a local build (with improvements for kernel doc handling, why not), sphinx-build --version reports versions of the form sphinx-build 3.0.0+/4703d9119972 i.e. base version, a plus symbol, slash, and the start of the git hash of whatever repository the command is run in (no, not the hash that was used to build Sphinx!). This patch fixes the installation check in sphinx-pre-install to recognise such version output. Signed-off-by: Stephen Kitt Link: https://lore.kernel.org/r/20200124183316.1719218-1-steve@sk2.org Signed-off-by: Jonathan Corbet commit cfb4b571e8b56b65d1a893bda5153647fda823b9 Merge: 6992ca0dd017 55d0a513a0e2 Author: Linus Torvalds Date: Wed Feb 5 17:33:35 2020 +0000 Merge tag 's390-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Vasily Gorbik: "The second round of s390 fixes and features for 5.6: - Add KPROBES_ON_FTRACE support - Add EP11 AES secure keys support - PAES rework and prerequisites for paes-s390 ciphers selftests - Fix page table upgrade for hugetlbfs" * tag 's390-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pkey/zcrypt: Support EP11 AES secure keys s390/zcrypt: extend EP11 card and queue sysfs attributes s390/zcrypt: add new low level ep11 functions support file s390/zcrypt: ep11 structs rework, export zcrypt_send_ep11_cprb s390/zcrypt: enable card/domain autoselect on ep11 cprbs s390/crypto: enable clear key values for paes ciphers s390/pkey: Add support for key blob with clear key value s390/crypto: Rework on paes implementation s390: support KPROBES_ON_FTRACE s390/mm: fix dynamic pagetable upgrade for hugetlbfs commit 599e6f8d3d23ec79d31891cda11af6e79d591ead Author: Randy Dunlap Date: Wed Jan 29 15:15:15 2020 -0800 Documentation: changes.rst: update several outdated project URLs Update projects URLs in the changes.rst file. Signed-off-by: Randy Dunlap Reviewed-by: Darrick J. Wong Acked-by: Theodore Ts'o Link: https://lore.kernel.org/r/a9c3c509-8f30-fcc4-d9e0-b53aeaa89e4f@infradead.org Signed-off-by: Jonathan Corbet commit ff1e81a7e2239f61d0e9173f113a7de4dcaab661 Author: Sameer Rahmani Date: Mon Feb 3 20:15:43 2020 +0000 Documentation: build warnings related to missing blank lines after explicit markups has been fixed Fix for several documentation build warnings related to missing blank lines after explicit mark up. Exact warning message: WARNING: Explicit markup ends without a blank line; unexpected unindent. Signed-off-by: Sameer Rahmani Link: https://lore.kernel.org/r/20200203201543.24834-1-lxsameer@gnu.org Signed-off-by: Jonathan Corbet commit 36a375c6dfad502217898c4c2f0cf05810c30ceb Author: Tiezhu Yang Date: Mon Feb 3 17:10:45 2020 +0800 mailmap: add entry for Tiezhu Yang Add an entry to connect all my email addresses. Signed-off-by: Tiezhu Yang Link: https://lore.kernel.org/r/1580721045-4988-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Jonathan Corbet commit 95c472ffca38e4aaf6000722194612d188ce5ac7 Author: SeongJae Park Date: Fri Jan 31 21:52:36 2020 +0100 Documentation/ko_KR/howto: Update a broken link Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20200131205237.29535-5-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 5549c20232659a43797078d035736f1e01137c46 Author: SeongJae Park Date: Fri Jan 31 21:52:35 2020 +0100 Documentation/ko_KR/howto: Update broken web addresses Commit 0ea6e6112219 ("Documentation: update broken web addresses.") removed a link to 'http://patchwork.ozlabs.org' in howto, but the change has not applied to the Korean translation. This commit simply applies the change to the Korean translation. The link is restored now, though. Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20200131205237.29535-4-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 4bfdebd6202da4cbf723c53f475999b7537d4e48 Author: SeongJae Park Date: Fri Jan 31 21:52:33 2020 +0100 docs/locking: Fix outdated section names Commit 2e4f5382d12a ("locking/doc: Rename LOCK/UNLOCK to ACQUIRE/RELEASE") has not appied to 'spinlock.rst'. This commit updates the doc for the change. Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20200131205237.29535-2-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit a8be1ad01b795bd2a13297ddbaecdb956ab0efd0 Author: Miaohe Lin Date: Wed Feb 5 23:33:53 2020 +0800 KVM: vmx: delete meaningless vmx_decache_cr0_guest_bits() declaration The function vmx_decache_cr0_guest_bits() is only called below its implementation. So this is meaningless and should be removed. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit d76c7fbc01b29257359ed8b0d16d662e725b7bf9 Author: Sean Christopherson Date: Tue Jan 28 15:53:44 2020 -0800 KVM: x86: Mark CR4.UMIP as reserved based on associated CPUID bit Re-add code to mark CR4.UMIP as reserved if UMIP is not supported by the host. The UMIP handling was unintentionally dropped during a recent refactoring. Not flagging CR4.UMIP allows the guest to set its CR4.UMIP regardless of host support or userspace desires. On CPUs with UMIP support, including emulated UMIP, this allows the guest to enable UMIP against the wishes of the userspace VMM. On CPUs without any form of UMIP, this results in a failed VM-Enter due to invalid guest state. Fixes: 345599f9a2928 ("KVM: x86: Add macro to ensure reserved cr4 bits checks stay in sync") Signed-off-by: Sean Christopherson Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit bcfcff640c4d736933c5990d5a801d6a0c22c28b Author: Paolo Bonzini Date: Wed Feb 5 16:20:23 2020 +0100 x86: vmxfeatures: rename features for consistency with KVM and manual Three of the feature bits in vmxfeatures.h have names that are different from the Intel SDM. The names have been adjusted recently in KVM but they were using the old name in the tip tree's x86/cpu branch. Adjust for consistency. Signed-off-by: Paolo Bonzini commit ef09f4f463350ef4c174158648d91bb7ebfd10db Merge: df7e8818926e b2ff728bae9b Author: Paolo Bonzini Date: Wed Feb 5 16:15:05 2020 +0100 Merge tag 'kvm-s390-next-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fixes and cleanups for 5.6 - fix register corruption - ENOTSUPP/EOPNOTSUPP mixed - reset cleanups/fixes - selftests commit df7e8818926eb4712b67421442acf7d568fe2645 Author: Paolo Bonzini Date: Wed Feb 5 16:10:52 2020 +0100 KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses Userspace that does not know about the AMD_IBRS bit might still allow the guest to protect itself with MSR_IA32_SPEC_CTRL using the Intel SPEC_CTRL bit. However, svm.c disallows this and will cause a #GP in the guest when writing to the MSR. Fix this by loosening the test and allowing the Intel CPUID bit, and in fact allow the AMD_STIBP bit as well since it allows writing to MSR_IA32_SPEC_CTRL too. Reported-by: Zhiyi Guo Analyzed-by: Dr. David Alan Gilbert Analyzed-by: Laszlo Ersek Signed-off-by: Paolo Bonzini commit 4400cf546b4bb62d49198f6642add01bf6e9b34d Author: Eric Hankland Date: Mon Jan 27 13:22:56 2020 -0800 KVM: x86: Fix perfctr WRMSR for running counters Correct the logic in intel_pmu_set_msr() for fixed and general purpose counters. This was recently changed to set pmc->counter without taking in to account the value of pmc_read_counter() which will be incorrect if the counter is currently running and non-zero; this changes back to the old logic which accounted for the value of currently running counters. Signed-off-by: Eric Hankland Signed-off-by: Paolo Bonzini commit a83502314ce303c6341b249c41121759c7477ba1 Author: Vitaly Kuznetsov Date: Wed Feb 5 13:30:34 2020 +0100 x86/kvm/hyper-v: don't allow to turn on unsupported VMX controls for nested guests Sane L1 hypervisors are not supposed to turn any of the unsupported VMX controls on for its guests and nested_vmx_check_controls() checks for that. This is, however, not the case for the controls which are supported on the host but are missing in enlightened VMCS and when eVMCS is in use. It would certainly be possible to add these missing checks to nested_check_vm_execution_controls()/_vm_exit_controls()/.. but it seems preferable to keep eVMCS-specific stuff in eVMCS and reduce the impact on non-eVMCS guests by doing less unrelated checks. Create a separate nested_evmcs_check_controls() for this purpose. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 31de3d2500e49e9f44fdda1830a37f4d9735bcdd Author: Vitaly Kuznetsov Date: Wed Feb 5 13:30:33 2020 +0100 x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs() With fine grained VMX feature enablement QEMU>=4.2 tries to do KVM_SET_MSRS with default (matching CPU model) values and in case eVMCS is also enabled, fails. It would be possible to drop VMX feature filtering completely and make this a guest's responsibility: if it decides to use eVMCS it should know which fields are available and which are not. Hyper-V mostly complies to this, however, there are some problematic controls: SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES VM_{ENTRY,EXIT}_LOAD_IA32_PERF_GLOBAL_CTRL which Hyper-V enables. As there are no corresponding fields in eVMCS, we can't handle this properly in KVM. This is a Hyper-V issue. Move VMX controls sanitization from nested_enable_evmcs() to vmx_get_msr(), and do the bare minimum (only clear controls which are known to cause issues). This allows userspace to keep setting controls it wants and at the same time hides them from the guest. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 8f79b064959b1c858cddad1cecbf0511adca8209 Author: Ben Gardon Date: Mon Feb 3 15:09:10 2020 -0800 kvm: mmu: Separate generating and setting mmio ptes Separate the functions for generating MMIO page table entries from the function that inserts them into the paging structure. This refactoring will facilitate changes to the MMU sychronization model to use atomic compare / exchanges (which are not guaranteed to succeed) instead of a monolithic MMU lock. No functional change expected. Tested by running kvm-unit-tests on an Intel Haswell machine. This commit introduced no new failures. Signed-off-by: Ben Gardon Reviewed-by: Oliver Upton Reviewed-by: Peter Shier Signed-off-by: Paolo Bonzini commit 0a2b64c50db00196c85ec9e8e4c3d7506cd09db9 Author: Ben Gardon Date: Mon Feb 3 15:09:09 2020 -0800 kvm: mmu: Replace unsigned with unsigned int for PTE access There are several functions which pass an access permission mask for SPTEs as an unsigned. This works, but checkpatch complains about it. Switch the occurrences of unsigned to unsigned int to satisfy checkpatch. No functional change expected. Tested by running kvm-unit-tests on an Intel Haswell machine. This commit introduced no new failures. Signed-off-by: Ben Gardon Reviewed-by: Oliver Upton Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit ea79a750927e1835fa869c9136bfd6da28e605e6 Author: Sean Christopherson Date: Tue Feb 4 07:32:59 2020 -0800 KVM: nVMX: Remove stale comment from nested_vmx_load_cr3() The blurb pertaining to the return value of nested_vmx_load_cr3() no longer matches reality, remove it entirely as the behavior it is attempting to document is quite obvious when reading the actual code. Signed-off-by: Sean Christopherson Reviewed-by: Krish Sadhukhan Signed-off-by: Paolo Bonzini commit 879a37632b403eb8c0fe00e14f907759100c8071 Author: Sean Christopherson Date: Mon Feb 3 10:42:00 2020 -0800 KVM: MIPS: Fold comparecount_func() into comparecount_wakeup() Fold kvm_mips_comparecount_func() into kvm_mips_comparecount_wakeup() to eliminate the nondescript function name as well as its unnecessary cast of a vcpu to "unsigned long" and back to a vcpu. Presumably func() was used as a callback at some point during pre-upstream development, as wakeup() is the only user of func() and has been the only user since both with introduced by commit 669e846e6c4e ("KVM/MIPS32: MIPS arch specific APIs for KVM"). Cc: Davidlohr Bueso Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 09df6307125cec07ef9168f1db2ffdbbcb304b1a Author: Sean Christopherson Date: Mon Feb 3 10:41:59 2020 -0800 KVM: MIPS: Fix a build error due to referencing not-yet-defined function Hoist kvm_mips_comparecount_wakeup() above its only user, kvm_arch_vcpu_create() to fix a compilation error due to referencing an undefined function. Fixes: d11dfed5d700 ("KVM: MIPS: Move all vcpu init code into kvm_arch_vcpu_create()") Reported-by: kbuild test robot Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 64b38bd1906bb62a040b4e91815e56005db4784d Author: Thadeu Lima de Souza Cascardo Date: Fri Jan 31 12:56:55 2020 -0300 x86/kvm: do not setup pv tlb flush when not paravirtualized kvm_setup_pv_tlb_flush will waste memory and print a misguiding message when KVM paravirtualization is not available. Intel SDM says that the when cpuid is used with EAX higher than the maximum supported value for basic of extended function, the data for the highest supported basic function will be returned. So, in some systems, kvm_arch_para_features will return bogus data, causing kvm_setup_pv_tlb_flush to detect support for pv tlb flush. Testing for kvm_para_available will work as it checks for the hypervisor signature. Besides, when the "nopv" command line parameter is used, it should not continue as well, as kvm_guest_init will no be called in that case. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Paolo Bonzini commit 7df003c85218b5f5b10a7f6418208f31e813f38f Author: Zhuang Yanying Date: Sat Oct 12 11:37:31 2019 +0800 KVM: fix overflow of zero page refcount with ksm running We are testing Virtual Machine with KSM on v5.4-rc2 kernel, and found the zero_page refcount overflow. The cause of refcount overflow is increased in try_async_pf (get_user_page) without being decreased in mmu_set_spte() while handling ept violation. In kvm_release_pfn_clean(), only unreserved page will call put_page. However, zero page is reserved. So, as well as creating and destroy vm, the refcount of zero page will continue to increase until it overflows. step1: echo 10000 > /sys/kernel/pages_to_scan/pages_to_scan echo 1 > /sys/kernel/pages_to_scan/run echo 1 > /sys/kernel/pages_to_scan/use_zero_pages step2: just create several normal qemu kvm vms. And destroy it after 10s. Repeat this action all the time. After a long period of time, all domains hang because of the refcount of zero page overflow. Qemu print error log as follow: … error: kvm run failed Bad address EAX=00006cdc EBX=00000008 ECX=80202001 EDX=078bfbfd ESI=ffffffff EDI=00000000 EBP=00000008 ESP=00006cc4 EIP=000efd75 EFL=00010002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] CS =0008 00000000 ffffffff 00c09b00 DPL=0 CS32 [-RA] SS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] FS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] GS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy GDT= 000f7070 00000037 IDT= 000f70ae 00000000 CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000000 Code=00 01 00 00 00 e9 e8 00 00 00 c7 05 4c 55 0f 00 01 00 00 00 <8b> 35 00 00 01 00 8b 3d 04 00 01 00 b8 d8 d3 00 00 c1 e0 08 0c ea a3 00 00 01 00 c7 05 04 … Meanwhile, a kernel warning is departed. [40914.836375] WARNING: CPU: 3 PID: 82067 at ./include/linux/mm.h:987 try_get_page+0x1f/0x30 [40914.836412] CPU: 3 PID: 82067 Comm: CPU 0/KVM Kdump: loaded Tainted: G OE 5.2.0-rc2 #5 [40914.836415] RIP: 0010:try_get_page+0x1f/0x30 [40914.836417] Code: 40 00 c3 0f 1f 84 00 00 00 00 00 48 8b 47 08 a8 01 75 11 8b 47 34 85 c0 7e 10 f0 ff 47 34 b8 01 00 00 00 c3 48 8d 78 ff eb e9 <0f> 0b 31 c0 c3 66 90 66 2e 0f 1f 84 00 0 0 00 00 00 48 8b 47 08 a8 [40914.836418] RSP: 0018:ffffb4144e523988 EFLAGS: 00010286 [40914.836419] RAX: 0000000080000000 RBX: 0000000000000326 RCX: 0000000000000000 [40914.836420] RDX: 0000000000000000 RSI: 00004ffdeba10000 RDI: ffffdf07093f6440 [40914.836421] RBP: ffffdf07093f6440 R08: 800000424fd91225 R09: 0000000000000000 [40914.836421] R10: ffff9eb41bfeebb8 R11: 0000000000000000 R12: ffffdf06bbd1e8a8 [40914.836422] R13: 0000000000000080 R14: 800000424fd91225 R15: ffffdf07093f6440 [40914.836423] FS: 00007fb60ffff700(0000) GS:ffff9eb4802c0000(0000) knlGS:0000000000000000 [40914.836425] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40914.836426] CR2: 0000000000000000 CR3: 0000002f220e6002 CR4: 00000000003626e0 [40914.836427] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [40914.836427] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [40914.836428] Call Trace: [40914.836433] follow_page_pte+0x302/0x47b [40914.836437] __get_user_pages+0xf1/0x7d0 [40914.836441] ? irq_work_queue+0x9/0x70 [40914.836443] get_user_pages_unlocked+0x13f/0x1e0 [40914.836469] __gfn_to_pfn_memslot+0x10e/0x400 [kvm] [40914.836486] try_async_pf+0x87/0x240 [kvm] [40914.836503] tdp_page_fault+0x139/0x270 [kvm] [40914.836523] kvm_mmu_page_fault+0x76/0x5e0 [kvm] [40914.836588] vcpu_enter_guest+0xb45/0x1570 [kvm] [40914.836632] kvm_arch_vcpu_ioctl_run+0x35d/0x580 [kvm] [40914.836645] kvm_vcpu_ioctl+0x26e/0x5d0 [kvm] [40914.836650] do_vfs_ioctl+0xa9/0x620 [40914.836653] ksys_ioctl+0x60/0x90 [40914.836654] __x64_sys_ioctl+0x16/0x20 [40914.836658] do_syscall_64+0x5b/0x180 [40914.836664] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [40914.836666] RIP: 0033:0x7fb61cb6bfc7 Signed-off-by: LinFeng Signed-off-by: Zhuang Yanying Signed-off-by: Paolo Bonzini commit 51b2569402a38e206d26728b0099eb059ab315b5 Author: Jeremy Cline Date: Wed Feb 5 08:41:46 2020 -0500 KVM: arm/arm64: Fix up includes for trace.h Fedora kernel builds on armv7hl began failing recently because kvm_arm_exception_type and kvm_arm_exception_class were undeclared in trace.h. Add the missing include. Fixes: 0e20f5e25556 ("KVM: arm/arm64: Cleanup MMIO handling") Signed-off-by: Jeremy Cline Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200205134146.82678-1-jcline@redhat.com commit 0202d293c2faecba791ba4afc5aec086249c393d Author: Sudarsana Reddy Kalluru Date: Wed Feb 5 05:10:55 2020 -0800 qed: Fix timestamping issue for L2 unicast ptp packets. commit cedeac9df4b8 ("qed: Add support for Timestamping the unicast PTP packets.") handles the timestamping of L4 ptp packets only. This patch adds driver changes to detect/timestamp both L2/L4 unicast PTP packets. Fixes: cedeac9df4b8 ("qed: Add support for Timestamping the unicast PTP packets.") Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 9b5e85320fcc3af20ce0397b2c6363b6ee5815b6 Author: Sean Christopherson Date: Fri Jan 24 15:07:22 2020 -0800 KVM: x86: Take a u64 when checking for a valid dr7 value Take a u64 instead of an unsigned long in kvm_dr7_valid() to fix a build warning on i386 due to right-shifting a 32-bit value by 32 when checking for bits being set in dr7[63:32]. Alternatively, the warning could be resolved by rewriting the check to use an i386-friendly method, but taking a u64 fixes another oddity on 32-bit KVM. Beause KVM implements natural width VMCS fields as u64s to avoid layout issues between 32-bit and 64-bit, a devious guest can stuff vmcs12->guest_dr7 with a 64-bit value even when both the guest and host are 32-bit kernels. KVM eventually drops vmcs12->guest_dr7[63:32] when propagating vmcs12->guest_dr7 to vmcs02, but ideally KVM would not rely on that behavior for correctness. Cc: Jim Mattson Cc: Krish Sadhukhan Fixes: ecb697d10f70 ("KVM: nVMX: Check GUEST_DR7 on vmentry of nested guests") Reported-by: Randy Dunlap Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 8171cd68806bd2fc28ef688e32fb2a3b3deb04e5 Author: Paolo Bonzini Date: Wed Jan 22 14:36:09 2020 +0100 KVM: x86: use raw clock values consistently Commit 53fafdbb8b21f ("KVM: x86: switch KVMCLOCK base to monotonic raw clock") changed kvmclock to use tkr_raw instead of tkr_mono. However, the default kvmclock_offset for the VM was still based on the monotonic clock and, if the raw clock drifted enough from the monotonic clock, this could cause a negative system_time to be written to the guest's struct pvclock. RHEL5 does not like it and (if it boots fast enough to observe a negative time value) it hangs. There is another thing to be careful about: getboottime64 returns the host boot time with tkr_mono frequency, and subtracting the tkr_raw-based kvmclock value will cause the wallclock to be off if tkr_raw drifts from tkr_mono. To avoid this, compute the wallclock delta from the current time instead of being clever and using getboottime64. Fixes: 53fafdbb8b21f ("KVM: x86: switch KVMCLOCK base to monotonic raw clock") Cc: stable@vger.kernel.org Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 917f9475c0a8ab8958db7f22a5d495b9a1d51be6 Author: Paolo Bonzini Date: Wed Jan 22 14:32:20 2020 +0100 KVM: x86: reorganize pvclock_gtod_data members We will need a copy of tk->offs_boot in the next patch. Store it and cleanup the struct: instead of storing tk->tkr_xxx.base with the tk->offs_boot included, store the raw value in struct pvclock_clock and sum it in do_monotonic_raw and do_realtime. tk->tkr_xxx.xtime_nsec also moves to struct pvclock_clock. While at it, fix a (usually harmless) typo in do_monotonic_raw, which was using gtod->clock.shift instead of gtod->raw_clock.shift. Fixes: 53fafdbb8b21f ("KVM: x86: switch KVMCLOCK base to monotonic raw clock") Cc: stable@vger.kernel.org Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 33aabd029ffbafe314dad4763dadbc23d71296eb Author: Miaohe Lin Date: Thu Jan 23 10:08:20 2020 +0800 KVM: nVMX: delete meaningless nested_vmx_run() declaration The function nested_vmx_run() declaration is below its implementation. So this is meaningless and should be removed. Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit e8ef2a19a051b755b0b9973ef1b3f81e895e2bce Author: Paolo Bonzini Date: Wed Jan 22 17:02:36 2020 +0100 KVM: SVM: allow AVIC without split irqchip SVM is now able to disable AVIC dynamically whenever the in-kernel PIT sets up an ack notifier, so we can enable it even if in-kernel IOAPIC/PIC/PIT are in use. Signed-off-by: Paolo Bonzini commit f458d039db7e8518041db4169d657407e3217008 Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:19 2019 -0600 kvm: ioapic: Lazy update IOAPIC EOI In-kernel IOAPIC does not receive EOI with AMD SVM AVIC since the processor accelerate write to APIC EOI register and does not trap if the interrupt is edge-triggered. Workaround this by lazy check for pending APIC EOI at the time when setting new IOPIC irq, and update IOAPIC EOI if no pending APIC EOI. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 1ec2405c7cbf3afa7598c6b7546c81aa0cac78dc Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:18 2019 -0600 kvm: ioapic: Refactor kvm_ioapic_update_eoi() Refactor code for handling IOAPIC EOI for subsequent patch. There is no functional change. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit e2ed4078a6ef3ddf4063329298852e24c36d46c8 Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:16 2019 -0600 kvm: i8254: Deactivate APICv when using in-kernel PIT re-injection mode. AMD SVM AVIC accelerates EOI write and does not trap. This causes in-kernel PIT re-injection mode to fail since it relies on irq-ack notifier mechanism. So, APICv is activated only when in-kernel PIT is in discard mode e.g. w/ qemu option: -global kvm-pit.lost_tick_policy=discard Also, introduce APICV_INHIBIT_REASON_PIT_REINJ bit to be used for this reason. Suggested-by: Paolo Bonzini Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit f3515dc3bef81e96bdb2ac93ef8fd20b1c2aaae5 Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:15 2019 -0600 svm: Temporarily deactivate AVIC during ExtINT handling AMD AVIC does not support ExtINT. Therefore, AVIC must be temporary deactivated and fall back to using legacy interrupt injection via vINTR and interrupt window. Also, introduce APICV_INHIBIT_REASON_IRQWIN to be used for this reason. Signed-off-by: Suravee Suthikulpanit [Rename svm_request_update_avic to svm_toggle_avic_for_extint. - Paolo] Signed-off-by: Paolo Bonzini commit 9a0bf05430699dc94b7ced940f6270c7cf1d77ef Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:14 2019 -0600 svm: Deactivate AVIC when launching guest with nested SVM support Since AVIC does not currently work w/ nested virtualization, deactivate AVIC for the guest if setting CPUID Fn80000001_ECX[SVM] (i.e. indicate support for SVM, which is needed for nested virtualization). Also, introduce a new APICV_INHIBIT_REASON_NESTED bit to be used for this reason. Suggested-by: Alexander Graf Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit f4fdc0a2edf48f16f7b10cceaf4781fc56ab7fd9 Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:13 2019 -0600 kvm: x86: hyperv: Use APICv update request interface Since disabling APICv has to be done for all vcpus on AMD-based system, adopt the newly introduced kvm_request_apicv_update() interface, and introduce a new APICV_INHIBIT_REASON_HYPERV. Also, remove the kvm_vcpu_deactivate_apicv() since no longer used. Cc: Roman Kagan Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 6c3e4422dd201c107948adc1b7615610d7381bcb Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:12 2019 -0600 svm: Add support for dynamic APICv Add necessary logics to support (de)activate AVIC at runtime. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 2de9d0ccd0fea32fc6a684f3f22496967ed608bc Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:11 2019 -0600 kvm: x86: Introduce x86 ops hook for pre-update APICv AMD SVM AVIC needs to update APIC backing page mapping before changing APICv mode. Introduce struct kvm_x86_ops.pre_update_apicv_exec_ctrl function hook to be called prior KVM APICv update request to each vcpu. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit ef8efd7a15bb7147a4ffb09758a6bd25d744a14e Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:10 2019 -0600 kvm: x86: Introduce APICv x86 ops for checking APIC inhibit reasons Inibit reason bits are used to determine if APICv deactivation is applicable for a particular hardware virtualization architecture. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit dcbcfa287e964931f7051ff00ed33dbf33d39abd Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:09 2019 -0600 KVM: svm: avic: Add support for dynamic setup/teardown of virtual APIC backing page Re-factor avic_init_access_page() to avic_update_access_page() since activate/deactivate AVIC requires setting/unsetting the memory region used for virtual APIC backing page (APIC_ACCESS_PAGE_PRIVATE_MEMSLOT). Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 8937d762396d22bdb59f02732a66db6b58e746b1 Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:08 2019 -0600 kvm: x86: svm: Add support to (de)activate posted interrupts Introduce interface for (de)activate posted interrupts, and implement SVM hooks to toggle AMD IOMMU guest virtual APIC mode. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 24bbf74c0c36bfbaa276c9921b55b844018b241e Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:07 2019 -0600 kvm: x86: Add APICv (de)activate request trace points Add trace points when sending request to (de)activate APICv. Suggested-by: Alexander Graf Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 8df14af42f00a434c492c9964a8095bf59831a45 Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:06 2019 -0600 kvm: x86: Add support for dynamic APICv activation Certain runtime conditions require APICv to be temporary deactivated during runtime. The current implementation only support run-time deactivation of APICv when Hyper-V SynIC is enabled, which is not temporary. In addition, for AMD, when APICv is (de)activated at runtime, all vcpus in the VM have to operate in the same mode. Thus the requesting vcpu must notify the others. So, introduce the following: * A new KVM_REQ_APICV_UPDATE request bit * Interfaces to request all vcpus to update APICv status * A new interface to update APICV-related parameters for each vcpu Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 7e3e67a98701cbcb4378b4f69b28a43351ca27c2 Author: Paolo Bonzini Date: Wed Jan 22 16:54:37 2020 +0100 KVM: x86: remove get_enable_apicv from kvm_x86_ops It is unused now. Signed-off-by: Paolo Bonzini commit 4e19c36f2df8f84da22c7287de86729aaf3e352b Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:05 2019 -0600 kvm: x86: Introduce APICv inhibit reason bits There are several reasons in which a VM needs to deactivate APICv e.g. disable APICv via parameter during module loading, or when enable Hyper-V SynIC support. Additional inhibit reasons will be introduced later on when dynamic APICv is supported, Introduce KVM APICv inhibit reason bits along with a new variable, apicv_inhibit_reasons, to help keep track of APICv state for each VM, Initially, the APICV_INHIBIT_REASON_DISABLE bit is used to indicate the case where APICv is disabled during KVM module load. (e.g. insmod kvm_amd avic=0 or insmod kvm_intel enable_apicv=0). Signed-off-by: Suravee Suthikulpanit [Do not use get_enable_apicv; consider irqchip_split in svm.c. - Paolo] Signed-off-by: Paolo Bonzini commit b26a695a1d78cc415fe26d74d0463f5d887980de Author: Suravee Suthikulpanit Date: Thu Nov 14 14:15:04 2019 -0600 kvm: lapic: Introduce APICv update helper function Re-factor code into a helper function for setting lapic parameters when activate/deactivate APICv, and export the function for subsequent usage. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini commit 83576e32a71717d1912b7dcb247a0f15613272da Merge: 38f88c454042 f822e9c4ffa5 Author: David S. Miller Date: Wed Feb 5 14:46:04 2020 +0100 Merge branch 'macb-TSO-bug-fixes' Harini Katakam says: ==================== macb: TSO bug fixes An IP errata was recently discovered when testing TSO enabled versions with perf test tools where a false amba error is reported by the IP. Some ways to reproduce would be to use iperf or applications with payload descriptor sizes very close to 16K. Once the error is observed TXERR (or bit 6 of ISR) will be constantly triggered leading to a series of tx path error handling and clean up. Workaround the same by limiting this size to 0x3FC0 as recommended by Cadence. There was no performance impact on 1G system that I tested with. Note on patch 1: The alignment code may be unused but leaving it there in case anyone is using UFO. Added Fixes tag to patch 1. ==================== Signed-off-by: David S. Miller commit f822e9c4ffa511a5c681cf866287d9383a3b6f1b Author: Harini Katakam Date: Wed Feb 5 18:08:12 2020 +0530 net: macb: Limit maximum GEM TX length in TSO GEM_MAX_TX_LEN currently resolves to 0x3FF8 for any IP version supporting TSO with full 14bits of length field in payload descriptor. But an IP errata causes false amba_error (bit 6 of ISR) when length in payload descriptors is specified above 16387. The error occurs because the DMA falsely concludes that there is not enough space in SRAM for incoming payload. These errors were observed continuously under stress of large packets using iperf on a version where SRAM was 16K for each queue. This errata will be documented shortly and affects all versions since TSO functionality was added. Hence limit the max length to 0x3FC0 (rounded). Signed-off-by: Harini Katakam Signed-off-by: David S. Miller commit 41c1ef978c8d0259c6636e6d2d854777e92650eb Author: Harini Katakam Date: Wed Feb 5 18:08:11 2020 +0530 net: macb: Remove unnecessary alignment check for TSO The IP TSO implementation does NOT require the length to be a multiple of 8. That is only a requirement for UFO as per IP documentation. Hence, exit macb_features_check function in the beginning if the protocol is not UDP. Only when it is UDP, proceed further to the alignment checks. Update comments to reflect the same. Also remove dead code checking for protocol TCP when calculating header length. Fixes: 1629dd4f763c ("cadence: Add LSO support.") Signed-off-by: Harini Katakam Signed-off-by: David S. Miller commit 38f88c45404293bbc027b956def6c10cbd45c616 Author: Eric Dumazet Date: Tue Feb 4 19:26:05 2020 -0800 bonding/alb: properly access headers in bond_alb_xmit() syzbot managed to send an IPX packet through bond_alb_xmit() and af_packet and triggered a use-after-free. First, bond_alb_xmit() was using ipx_hdr() helper to reach the IPX header, but ipx_hdr() was using the transport offset instead of the network offset. In the particular syzbot report transport offset was 0xFFFF This patch removes ipx_hdr() since it was only (mis)used from bonding. Then we need to make sure IPv4/IPv6/IPX headers are pulled in skb->head before dereferencing anything. BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108 (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: [] __dump_stack lib/dump_stack.c:17 [inline] [] dump_stack+0x14d/0x20b lib/dump_stack.c:53 [] print_address_description+0x6f/0x20b mm/kasan/report.c:282 [] kasan_report_error mm/kasan/report.c:380 [inline] [] kasan_report mm/kasan/report.c:438 [inline] [] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422 [] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469 [] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 [] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline] [] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224 [] __netdev_start_xmit include/linux/netdevice.h:4525 [inline] [] netdev_start_xmit include/linux/netdevice.h:4539 [inline] [] xmit_one net/core/dev.c:3611 [inline] [] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627 [] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278 [] packet_snd net/packet/af_packet.c:3226 [inline] [] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252 [] sock_sendmsg_nosec net/socket.c:673 [inline] [] sock_sendmsg+0x12c/0x160 net/socket.c:684 [] __sys_sendto+0x262/0x380 net/socket.c:1996 [] SYSC_sendto net/socket.c:2008 [inline] [] SyS_sendto+0x40/0x60 net/socket.c:2004 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Signed-off-by: David S. Miller commit d5b90e99e1d51b7b5d2b74fbc4c2db236a510913 Author: Jacob Keller Date: Tue Feb 4 15:59:50 2020 -0800 devlink: report 0 after hitting end in region read commit fdd41ec21e15 ("devlink: Return right error code in case of errors for region read") modified the region read code to report errors properly in unexpected cases. In the case where the start_offset and ret_offset match, it unilaterally converted this into an error. This causes an issue for the "dump" version of the command. In this case, the devlink region dump will always report an invalid argument: 000000000000ffd0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 000000000000ffe0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff devlink answers: Invalid argument 000000000000fff0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff This occurs because the expected flow for the dump is to return 0 after there is no further data. The simplest fix would be to stop converting the error code to -EINVAL if start_offset == ret_offset. However, avoid unnecessary work by checking for when start_offset is larger than the region size and returning 0 upfront. Fixes: fdd41ec21e15 ("devlink: Return right error code in case of errors for region read") Signed-off-by: Jacob Keller Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 33e2b32b5df2b544ac5d43c4de2194bcc822b1b5 Author: Moritz Fischer Date: Tue Feb 4 15:01:18 2020 -0800 net: ethernet: dec: tulip: Fix length mask in receive length calculation The receive frame length calculation uses a wrong mask to calculate the length of the received frames. Per spec table 4-1 the length is contained in the FL (Frame Length) field in bits 30:16. This didn't show up as an issue so far since frames were limited to 1500 bytes which falls within the 11 bit window. Signed-off-by: Moritz Fischer Signed-off-by: David S. Miller commit 7bb77d4b8567b35aadd57f3154a08d873572ae20 Merge: 52b5ae501c04 88f404a9b1d7 Author: David S. Miller Date: Wed Feb 5 14:14:19 2020 +0100 Merge branch 'wg-fixes' Jason A. Donenfeld says: ==================== wireguard fixes for 5.6-rc1 Here are fixes for WireGuard before 5.6-rc1 is tagged. It includes: 1) A fix for a UaF (caused by kmalloc failing during a very small allocation) that syzkaller found, from Eric Dumazet. 2) A fix for a deadlock that syzkaller found, along with an additional selftest to ensure that the bug fix remains correct, from me. 3) Two little fixes/cleanups to the selftests from Krzysztof Kozlowski and me. ==================== Signed-off-by: David S. Miller commit 88f404a9b1d75388225b1c67b6dd327cb2182777 Author: Jason A. Donenfeld Date: Tue Feb 4 22:17:29 2020 +0100 wireguard: selftests: tie socket waiting to target pid Without this, we wind up proceeding too early sometimes when the previous process has just used the same listening port. So, we tie the listening socket query to the specific pid we're interested in. Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 4a2ef721e60f0d2babeb29dbcfe05904b53ea19e Author: Krzysztof Kozlowski Date: Tue Feb 4 22:17:28 2020 +0100 wireguard: selftests: cleanup CONFIG_ENABLE_WARN_DEPRECATED CONFIG_ENABLE_WARN_DEPRECATED is gone since commit 771c035372a0 ("deprecate the '__deprecated' attribute warnings entirely and for good"). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit f9398acba6a4ae9cb98bfe4d56414d376eff8d57 Author: Jason A. Donenfeld Date: Tue Feb 4 22:17:27 2020 +0100 wireguard: selftests: ensure non-addition of peers with failed precomputation Ensure that peers with low order points are ignored, both in the case where we already have a device private key and in the case where we do not. This adds points that naturally give a zero output. Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit ec31c2676a10e064878927b243fada8c2fb0c03c Author: Jason A. Donenfeld Date: Tue Feb 4 22:17:26 2020 +0100 wireguard: noise: reject peers with low order public keys Our static-static calculation returns a failure if the public key is of low order. We check for this when peers are added, and don't allow them to be added if they're low order, except in the case where we haven't yet been given a private key. In that case, we would defer the removal of the peer until we're given a private key, since at that point we're doing new static-static calculations which incur failures we can act on. This meant, however, that we wound up removing peers rather late in the configuration flow. Syzkaller points out that peer_remove calls flush_workqueue, which in turn might then wait for sending a handshake initiation to complete. Since handshake initiation needs the static identity lock, holding the static identity lock while calling peer_remove can result in a rare deadlock. We have precisely this case in this situation of late-stage peer removal based on an invalid public key. We can't drop the lock when removing, because then incoming handshakes might interact with a bogus static-static calculation. While the band-aid patch for this would involve breaking up the peer removal into two steps like wg_peer_remove_all does, in order to solve the locking issue, there's actually a much more elegant way of fixing this: If the static-static calculation succeeds with one private key, it *must* succeed with all others, because all 32-byte strings map to valid private keys, thanks to clamping. That means we can get rid of this silly dance and locking headaches of removing peers late in the configuration flow, and instead just reject them early on, regardless of whether the device has yet been assigned a private key. For the case where the device doesn't yet have a private key, we safely use zeros just for the purposes of checking for low order points by way of checking the output of the calculation. The following PoC will trigger the deadlock: ip link add wg0 type wireguard ip addr add 10.0.0.1/24 dev wg0 ip link set wg0 up ping -f 10.0.0.2 & while true; do wg set wg0 private-key /dev/null peer AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= allowed-ips 10.0.0.0/24 endpoint 10.0.0.3:1234 wg set wg0 private-key <(echo AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=) done [ 0.949105] ====================================================== [ 0.949550] WARNING: possible circular locking dependency detected [ 0.950143] 5.5.0-debug+ #18 Not tainted [ 0.950431] ------------------------------------------------------ [ 0.950959] wg/89 is trying to acquire lock: [ 0.951252] ffff8880333e2128 ((wq_completion)wg-kex-wg0){+.+.}, at: flush_workqueue+0xe3/0x12f0 [ 0.951865] [ 0.951865] but task is already holding lock: [ 0.952280] ffff888032819bc0 (&wg->static_identity.lock){++++}, at: wg_set_device+0x95d/0xcc0 [ 0.953011] [ 0.953011] which lock already depends on the new lock. [ 0.953011] [ 0.953651] [ 0.953651] the existing dependency chain (in reverse order) is: [ 0.954292] [ 0.954292] -> #2 (&wg->static_identity.lock){++++}: [ 0.954804] lock_acquire+0x127/0x350 [ 0.955133] down_read+0x83/0x410 [ 0.955428] wg_noise_handshake_create_initiation+0x97/0x700 [ 0.955885] wg_packet_send_handshake_initiation+0x13a/0x280 [ 0.956401] wg_packet_handshake_send_worker+0x10/0x20 [ 0.956841] process_one_work+0x806/0x1500 [ 0.957167] worker_thread+0x8c/0xcb0 [ 0.957549] kthread+0x2ee/0x3b0 [ 0.957792] ret_from_fork+0x24/0x30 [ 0.958234] [ 0.958234] -> #1 ((work_completion)(&peer->transmit_handshake_work)){+.+.}: [ 0.958808] lock_acquire+0x127/0x350 [ 0.959075] process_one_work+0x7ab/0x1500 [ 0.959369] worker_thread+0x8c/0xcb0 [ 0.959639] kthread+0x2ee/0x3b0 [ 0.959896] ret_from_fork+0x24/0x30 [ 0.960346] [ 0.960346] -> #0 ((wq_completion)wg-kex-wg0){+.+.}: [ 0.960945] check_prev_add+0x167/0x1e20 [ 0.961351] __lock_acquire+0x2012/0x3170 [ 0.961725] lock_acquire+0x127/0x350 [ 0.961990] flush_workqueue+0x106/0x12f0 [ 0.962280] peer_remove_after_dead+0x160/0x220 [ 0.962600] wg_set_device+0xa24/0xcc0 [ 0.962994] genl_rcv_msg+0x52f/0xe90 [ 0.963298] netlink_rcv_skb+0x111/0x320 [ 0.963618] genl_rcv+0x1f/0x30 [ 0.963853] netlink_unicast+0x3f6/0x610 [ 0.964245] netlink_sendmsg+0x700/0xb80 [ 0.964586] __sys_sendto+0x1dd/0x2c0 [ 0.964854] __x64_sys_sendto+0xd8/0x1b0 [ 0.965141] do_syscall_64+0x90/0xd9a [ 0.965408] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 0.965769] [ 0.965769] other info that might help us debug this: [ 0.965769] [ 0.966337] Chain exists of: [ 0.966337] (wq_completion)wg-kex-wg0 --> (work_completion)(&peer->transmit_handshake_work) --> &wg->static_identity.lock [ 0.966337] [ 0.967417] Possible unsafe locking scenario: [ 0.967417] [ 0.967836] CPU0 CPU1 [ 0.968155] ---- ---- [ 0.968497] lock(&wg->static_identity.lock); [ 0.968779] lock((work_completion)(&peer->transmit_handshake_work)); [ 0.969345] lock(&wg->static_identity.lock); [ 0.969809] lock((wq_completion)wg-kex-wg0); [ 0.970146] [ 0.970146] *** DEADLOCK *** [ 0.970146] [ 0.970531] 5 locks held by wg/89: [ 0.970908] #0: ffffffff827433c8 (cb_lock){++++}, at: genl_rcv+0x10/0x30 [ 0.971400] #1: ffffffff82743480 (genl_mutex){+.+.}, at: genl_rcv_msg+0x642/0xe90 [ 0.971924] #2: ffffffff827160c0 (rtnl_mutex){+.+.}, at: wg_set_device+0x9f/0xcc0 [ 0.972488] #3: ffff888032819de0 (&wg->device_update_lock){+.+.}, at: wg_set_device+0xb0/0xcc0 [ 0.973095] #4: ffff888032819bc0 (&wg->static_identity.lock){++++}, at: wg_set_device+0x95d/0xcc0 [ 0.973653] [ 0.973653] stack backtrace: [ 0.973932] CPU: 1 PID: 89 Comm: wg Not tainted 5.5.0-debug+ #18 [ 0.974476] Call Trace: [ 0.974638] dump_stack+0x97/0xe0 [ 0.974869] check_noncircular+0x312/0x3e0 [ 0.975132] ? print_circular_bug+0x1f0/0x1f0 [ 0.975410] ? __kernel_text_address+0x9/0x30 [ 0.975727] ? unwind_get_return_address+0x51/0x90 [ 0.976024] check_prev_add+0x167/0x1e20 [ 0.976367] ? graph_lock+0x70/0x160 [ 0.976682] __lock_acquire+0x2012/0x3170 [ 0.976998] ? register_lock_class+0x1140/0x1140 [ 0.977323] lock_acquire+0x127/0x350 [ 0.977627] ? flush_workqueue+0xe3/0x12f0 [ 0.977890] flush_workqueue+0x106/0x12f0 [ 0.978147] ? flush_workqueue+0xe3/0x12f0 [ 0.978410] ? find_held_lock+0x2c/0x110 [ 0.978662] ? lock_downgrade+0x6e0/0x6e0 [ 0.978919] ? queue_rcu_work+0x60/0x60 [ 0.979166] ? netif_napi_del+0x151/0x3b0 [ 0.979501] ? peer_remove_after_dead+0x160/0x220 [ 0.979871] peer_remove_after_dead+0x160/0x220 [ 0.980232] wg_set_device+0xa24/0xcc0 [ 0.980516] ? deref_stack_reg+0x8e/0xc0 [ 0.980801] ? set_peer+0xe10/0xe10 [ 0.981040] ? __ww_mutex_check_waiters+0x150/0x150 [ 0.981430] ? __nla_validate_parse+0x163/0x270 [ 0.981719] ? genl_family_rcv_msg_attrs_parse+0x13f/0x310 [ 0.982078] genl_rcv_msg+0x52f/0xe90 [ 0.982348] ? genl_family_rcv_msg_attrs_parse+0x310/0x310 [ 0.982690] ? register_lock_class+0x1140/0x1140 [ 0.983049] netlink_rcv_skb+0x111/0x320 [ 0.983298] ? genl_family_rcv_msg_attrs_parse+0x310/0x310 [ 0.983645] ? netlink_ack+0x880/0x880 [ 0.983888] genl_rcv+0x1f/0x30 [ 0.984168] netlink_unicast+0x3f6/0x610 [ 0.984443] ? netlink_detachskb+0x60/0x60 [ 0.984729] ? find_held_lock+0x2c/0x110 [ 0.984976] netlink_sendmsg+0x700/0xb80 [ 0.985220] ? netlink_broadcast_filtered+0xa60/0xa60 [ 0.985533] __sys_sendto+0x1dd/0x2c0 [ 0.985763] ? __x64_sys_getpeername+0xb0/0xb0 [ 0.986039] ? sockfd_lookup_light+0x17/0x160 [ 0.986397] ? __sys_recvmsg+0x8c/0xf0 [ 0.986711] ? __sys_recvmsg_sock+0xd0/0xd0 [ 0.987018] __x64_sys_sendto+0xd8/0x1b0 [ 0.987283] ? lockdep_hardirqs_on+0x39b/0x5a0 [ 0.987666] do_syscall_64+0x90/0xd9a [ 0.987903] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 0.988223] RIP: 0033:0x7fe77c12003e [ 0.988508] Code: c3 8b 07 85 c0 75 24 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 4 [ 0.989666] RSP: 002b:00007fffada2ed58 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 0.990137] RAX: ffffffffffffffda RBX: 00007fe77c159d48 RCX: 00007fe77c12003e [ 0.990583] RDX: 0000000000000040 RSI: 000055fd1d38e020 RDI: 0000000000000004 [ 0.991091] RBP: 000055fd1d38e020 R08: 000055fd1cb63358 R09: 000000000000000c [ 0.991568] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002c [ 0.992014] R13: 0000000000000004 R14: 000055fd1d38e020 R15: 0000000000000001 Signed-off-by: Jason A. Donenfeld Reported-by: syzbot Signed-off-by: David S. Miller commit 9981159fc3b677b357f84e069a11de5a5ec8a2a8 Author: Eric Dumazet Date: Tue Feb 4 22:17:25 2020 +0100 wireguard: allowedips: fix use-after-free in root_remove_peer_lists In the unlikely case a new node could not be allocated, we need to remove @newnode from @peer->allowedips_list before freeing it. syzbot reported: BUG: KASAN: use-after-free in __list_del_entry_valid+0xdc/0xf5 lib/list_debug.c:54 Read of size 8 at addr ffff88809881a538 by task syz-executor.4/30133 CPU: 0 PID: 30133 Comm: syz-executor.4 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 __list_del_entry_valid+0xdc/0xf5 lib/list_debug.c:54 __list_del_entry include/linux/list.h:132 [inline] list_del include/linux/list.h:146 [inline] root_remove_peer_lists+0x24f/0x4b0 drivers/net/wireguard/allowedips.c:65 wg_allowedips_free+0x232/0x390 drivers/net/wireguard/allowedips.c:300 wg_peer_remove_all+0xd5/0x620 drivers/net/wireguard/peer.c:187 wg_set_device+0xd01/0x1350 drivers/net/wireguard/netlink.c:542 genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] genl_family_rcv_msg net/netlink/genetlink.c:717 [inline] genl_rcv_msg+0x67d/0xea0 net/netlink/genetlink.c:734 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 genl_rcv+0x29/0x40 net/netlink/genetlink.c:745 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45b399 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f99a9bcdc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f99a9bce6d4 RCX: 000000000045b399 RDX: 0000000000000000 RSI: 0000000020001340 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: 00000000000009ba R14: 00000000004cb2b8 R15: 0000000000000009 Allocated by task 30103: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3551 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:670 [inline] add+0x70a/0x1970 drivers/net/wireguard/allowedips.c:236 wg_allowedips_insert_v4+0xf6/0x160 drivers/net/wireguard/allowedips.c:320 set_allowedip drivers/net/wireguard/netlink.c:343 [inline] set_peer+0xfb9/0x1150 drivers/net/wireguard/netlink.c:468 wg_set_device+0xbd4/0x1350 drivers/net/wireguard/netlink.c:591 genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] genl_family_rcv_msg net/netlink/genetlink.c:717 [inline] genl_rcv_msg+0x67d/0xea0 net/netlink/genetlink.c:734 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 genl_rcv+0x29/0x40 net/netlink/genetlink.c:745 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 30103: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:335 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474 kasan_slab_free+0xe/0x10 mm/kasan/common.c:483 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 add+0x12d2/0x1970 drivers/net/wireguard/allowedips.c:266 wg_allowedips_insert_v4+0xf6/0x160 drivers/net/wireguard/allowedips.c:320 set_allowedip drivers/net/wireguard/netlink.c:343 [inline] set_peer+0xfb9/0x1150 drivers/net/wireguard/netlink.c:468 wg_set_device+0xbd4/0x1350 drivers/net/wireguard/netlink.c:591 genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] genl_family_rcv_msg net/netlink/genetlink.c:717 [inline] genl_rcv_msg+0x67d/0xea0 net/netlink/genetlink.c:734 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 genl_rcv+0x29/0x40 net/netlink/genetlink.c:745 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88809881a500 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of 64-byte region [ffff88809881a500, ffff88809881a540) The buggy address belongs to the page: page:ffffea0002620680 refcount:1 mapcount:0 mapping:ffff8880aa400380 index:0x0 raw: 00fffe0000000200 ffffea000250b748 ffffea000254bac8 ffff8880aa400380 raw: 0000000000000000 ffff88809881a000 0000000100000020 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809881a400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88809881a480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88809881a500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88809881a580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88809881a600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Jason A. Donenfeld Cc: wireguard@lists.zx2c4.com Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 52b5ae501c045010aeeb1d5ac0373ff161a88291 Author: Cong Wang Date: Tue Feb 4 11:10:12 2020 -0800 net_sched: fix a resource leak in tcindex_set_parms() Jakub noticed there is a potential resource leak in tcindex_set_parms(): when tcindex_filter_result_init() fails and it jumps to 'errout1' which doesn't release the memory and resources allocated by tcindex_alloc_perfect_hash(). We should just jump to 'errout_alloc' which calls tcindex_free_perfect_hash(). Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()") Reported-by: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 2c22c06ce426a0d025a3dacd17cd8868f3dbe96b Author: Florian Westphal Date: Tue Feb 4 18:12:30 2020 +0100 mptcp: fix use-after-free on tcp fallback When an mptcp socket connects to a tcp peer or when a middlebox interferes with tcp options, mptcp needs to fall back to plain tcp. Problem is that mptcp is trying to be too clever in this case: It attempts to close the mptcp meta sk and transparently replace it with the (only) subflow tcp sk. Unfortunately, this is racy -- the socket is already exposed to userspace. Any parallel calls to send/recv/setsockopt etc. can cause use-after-free: BUG: KASAN: use-after-free in atomic_try_cmpxchg include/asm-generic/atomic-instrumented.h:693 [inline] CPU: 1 PID: 2083 Comm: syz-executor.1 Not tainted 5.5.0 #2 atomic_try_cmpxchg include/asm-generic/atomic-instrumented.h:693 [inline] queued_spin_lock include/asm-generic/qspinlock.h:78 [inline] do_raw_spin_lock include/linux/spinlock.h:181 [inline] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline] _raw_spin_lock_bh+0x71/0xd0 kernel/locking/spinlock.c:175 spin_lock_bh include/linux/spinlock.h:343 [inline] __lock_sock+0x105/0x190 net/core/sock.c:2414 lock_sock_nested+0x10f/0x140 net/core/sock.c:2938 lock_sock include/net/sock.h:1516 [inline] mptcp_setsockopt+0x2f/0x1f0 net/mptcp/protocol.c:800 __sys_setsockopt+0x152/0x240 net/socket.c:2130 __do_sys_setsockopt net/socket.c:2146 [inline] __se_sys_setsockopt net/socket.c:2143 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2143 do_syscall_64+0xb7/0x3d0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x44/0xa9 While the use-after-free can be resolved, there is another problem: sock->ops and sock->sk assignments are not atomic, i.e. we may get calls into mptcp functions with sock->sk already pointing at the subflow socket, or calls into tcp functions with a mptcp meta sk. Remove the fallback code and call the relevant functions for the (only) subflow in case the mptcp socket is connected to tcp peer. Reported-by: Christoph Paasch Diagnosed-by: Paolo Abeni Signed-off-by: Florian Westphal Reviewed-by: Mat Martineau Tested-by: Christoph Paasch Signed-off-by: David S. Miller commit 8b7a07c7d4420c7d684f661697c6a878040c8b65 Author: Andy Shevchenko Date: Wed Feb 5 11:29:03 2020 +0200 net: dsa: microchip: Platform data shan't include kernel.h Replace with appropriate types.h. Signed-off-by: Andy Shevchenko Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e22e0790595dad409d610651f4eb17742607e35d Author: Andy Shevchenko Date: Wed Feb 5 11:29:02 2020 +0200 net: dsa: b53: Platform data shan't include kernel.h Replace with appropriate types.h. Signed-off-by: Andy Shevchenko Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 34611e6996f331399ee26382fdbc2bd009f9cdd6 Author: kbuild test robot Date: Tue Feb 4 22:22:02 2020 +0800 netdevsim: fix ptr_ret.cocci warnings drivers/net/netdevsim/dev.c:937:1-3: WARNING: PTR_ERR_OR_ZERO can be used Use PTR_ERR_OR_ZERO rather than if(IS_ERR(...)) + PTR_ERR Generated by: scripts/coccinelle/api/ptr_ret.cocci Fixes: 6556ff32f12d ("netdevsim: use IS_ERR instead of IS_ERR_OR_NULL for debugfs") CC: Taehee Yoo Signed-off-by: kbuild test robot Signed-off-by: David S. Miller commit 9784e619f0a0ada7421ffd777872a199cdcb73cd Author: Thomas Bogendoerfer Date: Tue Feb 4 14:58:20 2020 +0100 net: sgi: ioc3-eth: Remove leftover free_irq() Commit 0ce5ebd24d25 ("mfd: ioc3: Add driver for SGI IOC3 chip") moved request_irq() from ioc3_open into probe function, but forgot to remove free_irq() from ioc3_close. Fixes: 0ce5ebd24d25 ("mfd: ioc3: Add driver for SGI IOC3 chip") Signed-off-by: Thomas Bogendoerfer Signed-off-by: David S. Miller commit b0dd940e582b6a60296b9847a54012a4b080dc72 Author: Ronnie Sahlberg Date: Wed Feb 5 11:08:01 2020 +1000 cifs: fail i/o on soft mounts if sessionsetup errors out RHBZ: 1579050 If we have a soft mount we should fail commands for session-setup failures (such as the password having changed/ account being deleted/ ...) and return an error back to the application. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French CC: Stable commit 87f93d82e0952da18af4d978e7d887b4c5326c0b Author: Steve French Date: Tue Feb 4 13:02:59 2020 -0600 smb3: fix problem with null cifs super block with previous patch Add check for null cifs_sb to create_options helper Signed-off-by: Steve French Reviewed-by: Amir Goldstein Reviewed-by: Aurelien Aptel commit 9db028827315550ea7e65898eebaf15d2456d830 Merge: c7e661a1c2ae 42b716359bec Author: Takashi Iwai Date: Wed Feb 5 12:33:45 2020 +0100 Merge tag 'asoc-v5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.6 A collection of updates for bugs fixed since the initial pull request, the most important one being the addition of COMMON_CLK for wcd934x which is needed for MFD to be merged. commit 13426feaf46c48fcddb591e89d35120fcc90527f Author: Geert Uytterhoeven Date: Tue Feb 4 14:18:57 2020 +0100 ASoC: wcd934x: Add missing COMMON_CLK dependency to SND_SOC_ALL_CODECS Just adding a dependency on COMMON_CLK to SND_SOC_WCD934X is not sufficient, as enabling SND_SOC_ALL_CODECS will still select it, breaking the build later: WARNING: unmet direct dependencies detected for SND_SOC_WCD934X Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && COMMON_CLK [=n] && MFD_WCD934X [=m] Selected by [m]: - SND_SOC_ALL_CODECS [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && COMPILE_TEST [=y] && MFD_WCD934X [=m] ... ERROR: "of_clk_add_provider" [sound/soc/codecs/snd-soc-wcd934x.ko] undefined! ERROR: "of_clk_src_simple_get" [sound/soc/codecs/snd-soc-wcd934x.ko] undefined! ERROR: "clk_hw_register" [sound/soc/codecs/snd-soc-wcd934x.ko] undefined! ERROR: "__clk_get_name" [sound/soc/codecs/snd-soc-wcd934x.ko] undefined! Fix this by adding the missing dependency to SND_SOC_ALL_CODECS Fixes: 42b716359beca106 ("ASoC: wcd934x: Add missing COMMON_CLK dependency") Signed-off-by: Geert Uytterhoeven Tested-by: Stephen Rothwell Link: https://lore.kernel.org/r/20200204131857.7634-1-geert@linux-m68k.org Signed-off-by: Mark Brown commit 7495e0926fdf302cb9e62a49f7c22198815624cd Author: Steven Rostedt (VMware) Date: Tue Feb 4 07:33:53 2020 -0500 bootconfig: Only load bootconfig if "bootconfig" is on the kernel cmdline As the bootconfig is appended to the initrd it is not as easy to modify as the kernel command line. If there's some issue with the kernel, and the developer wants to boot a pristine kernel, it should not be needed to modify the initrd to remove the bootconfig for a single boot. As bootconfig is silently added (if the admin does not know where to look they may not know it's being loaded). It should be explicitly added to the kernel cmdline. The loading of the bootconfig is only done if "bootconfig" is on the kernel command line. This will let admins know that the kernel command line is extended. Note, after adding printk()s for when the size is too great or the checksum is wrong, exposed that the current method always looked for the boot config, and if this size and checksum matched, it would parse it (as if either is wrong a printk has been added to show this). It's better to only check this if the boot config is asked to be looked for. Link: https://lore.kernel.org/r/CAHk-=wjfjO+h6bQzrTf=YCZA53Y3EDyAs3Z4gEsT7icA3u_Psw@mail.gmail.com Acked-by: Masami Hiramatsu Suggested-by: Linus Torvalds Signed-off-by: Steven Rostedt (VMware) commit 04dbd86539fd2f0a65fdd5a0416b7f6606f95e16 Author: Rob Herring Date: Fri Jan 31 09:27:12 2020 -0600 dt-bindings: Fix paths in schema $id fields The $id path checks were inadequately checking the path part of the $id value. With the check fixed, there's a number of errors that need to be fixed. Most of the errors are including 'bindings/' in the path which should not be as that is considered the root. Cc: Andy Gross Cc: Bjorn Andersson Cc: Manivannan Sadhasivam Cc: Michael Turquette Cc: Shawn Guo Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Fabio Estevam Cc: NXP Linux Team Cc: Maxime Coquelin Cc: Alexandre Torgue Cc: "Nuno Sá" Cc: Jean Delvare Cc: Stefan Popa Cc: Jonathan Cameron Cc: Hartmut Knaack Cc: Lars-Peter Clausen Cc: Peter Meerwald-Stadler Cc: Marcus Folkesson Cc: Kent Gustavsson Cc: Dmitry Torokhov Cc: linux-clk@vger.kernel.org Cc: linux-iio@vger.kernel.org Cc: linux-input@vger.kernel.org Reviewed-by: Guenter Roeck Reviewed-by: Stephen Boyd Signed-off-by: Rob Herring commit 2343d1529aff8b552589f622c23932035ed7a05d Author: Jason A. Donenfeld Date: Fri Jan 17 12:01:36 2020 +0100 crypto: Kconfig - allow tests to be disabled when manager is disabled The library code uses CRYPTO_MANAGER_DISABLE_TESTS to conditionalize its tests, but the library code can also exist without CRYPTO_MANAGER. That means on minimal configs, the test code winds up being built with no way to disable it. Signed-off-by: Jason A. Donenfeld Signed-off-by: Herbert Xu commit 45f035748b2aa29840fec6ba01cd8e44c63034c2 Merge: fdff7c21ea00 85fc95d75970 Author: Ingo Molnar Date: Wed Feb 5 08:44:40 2020 +0100 Merge tag 'perf-core-for-mingo-5.6-20200201' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf maps: Cengiz Can: - Add missing unlock to maps__insert() error case. srcline: Changbin Du: - Make perf able to build with latest libbfd. perf parse: Leo Yan: - Keep copy of string in perf_evsel_config_term() to fix sink terms processing in ARM CoreSight. perf test: Thomas Richter: - Fix test case Merge cpu map, removing extra reference count drop that causes a segfault on s/390. perf probe: Thomas Richter: - Add ustring support for perf probe command Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit fdff7c21ea00787e3f70a1a00b40b88eb998c6ad Merge: f1ec3a517b43 b3a608222336 Author: Ingo Molnar Date: Wed Feb 5 08:44:22 2020 +0100 Merge branch 'linus' into perf/urgent, to synchronize with upstream Signed-off-by: Ingo Molnar commit 6992ca0dd017ebaa2bf8e9dcc49f1c3b7033b082 Merge: 51a198e89a96 84669923e1ed Author: Linus Torvalds Date: Wed Feb 5 07:29:40 2020 +0000 Merge branch 'parisc-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "A page table initialization cleanup from Mike Rapoport and regenerated defconfig files from Helge Deller" * 'parisc-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Regenerate parisc defconfigs parisc: map_pages(): cleanup page table initialization commit c74c0fd2282e0e3ce891cb571f325b9412cbaa3f Author: Max Filippov Date: Tue Feb 4 12:51:21 2020 -0800 xtensa: ISS: improve simcall assembly Drop redundant result moving from inline assembly, use a1 and b1 values as return value and errno value respectively. Signed-off-by: Max Filippov commit 5e4417f921238b5acf101bfcd59a7b3463fb2dbd Author: Max Filippov Date: Fri Jan 31 20:11:24 2020 -0800 xtensa: reorganize vectors placement Allow vectors to be either merged into the kernel .text or put at a fixed virtual address independently of XIP option. Drop option that puts vectors at a fixed offset from the kernel text. Add choice to Kconfig. Vectors at fixed virtual address may be useful for XIP-aware MTD support and for noMMU configurations with available IRAM. Configurations without VECBASE register must put their vectors at specific locations regardless of the selected option. All other configurations should happily use merged vectors. Signed-off-by: Max Filippov commit 4f17664a4407004f71dc76de01c89fdb6efc0776 Author: Max Filippov Date: Fri Jan 31 21:25:03 2020 -0800 xtensa: separate SMP and XIP support There's no real dependency between SMP and XIP, allow them to be selected together. Always define 2- and 4-argument SECTION_VECTOR macros, always use 4-argument macro for the secondary reset vector and always define relocation entry for it. Signed-off-by: Max Filippov commit 50722f0bf631cfcbcce18dac6b3fb5c2b6432628 Author: Max Filippov Date: Fri Jan 31 18:48:43 2020 -0800 xtensa: move fast exception handlers close to vectors On XIP kernels it makes sense to have exception vectors and fast exception handlers together (in a fast memory). In addition, with MTD XIP support both vectors and fast exception handlers must be outside of the FLASH. Add section .exception.text and move fast exception handlers to it. Put it together with vectors when vectors are outside of the .text. Signed-off-by: Max Filippov commit 51a198e89a96c34b3944034b2ebda9002ff57827 Merge: 72f582ff8569 802a5017ffb2 Author: Linus Torvalds Date: Wed Feb 5 05:28:20 2020 +0000 Merge tag 'jfs-5.6' of git://github.com/kleikamp/linux-shaggy Pull jfs update from David Kleikamp: "Trivial cleanup for jfs" * tag 'jfs-5.6' of git://github.com/kleikamp/linux-shaggy: jfs: remove unused MAXL2PAGES commit 72f582ff8569900ccc4439b26bbe5e2fff509f08 Merge: bddea11b1b93 a3d1e7eb5abe Author: Linus Torvalds Date: Wed Feb 5 05:09:46 2020 +0000 Merge branch 'work.recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs recursive removal updates from Al Viro: "We have quite a few places where synthetic filesystems do an equivalent of 'rm -rf', with varying amounts of code duplication, wrong locking, etc. That really ought to be a library helper. Only debugfs (and very similar tracefs) are converted here - I have more conversions, but they'd never been in -next, so they'll have to wait" * 'work.recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: simple_recursive_removal(): kernel-side rm -rf for ramfs-style filesystems commit bddea11b1b9385f713006820f16a9fbe5efe6b47 Merge: 33b40134e5cf f0f3588f7a95 Author: Linus Torvalds Date: Wed Feb 5 05:02:42 2020 +0000 Merge branch 'imm.timestamp' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs timestamp updates from Al Viro: "More 64bit timestamp work" * 'imm.timestamp' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: kernfs: don't bother with timestamp truncation fs: Do not overload update_time fs: Delete timespec64_trunc() fs: ubifs: Eliminate timespec64_trunc() usage fs: ceph: Delete timespec64_trunc() usage fs: cifs: Delete usage of timespec64_trunc fs: fat: Eliminate timespec64_trunc() usage utimes: Clamp the timestamps in notify_change() commit 089b7d890f972f6b649fedc9259f6b93a18fb970 Author: Tetsuo Handa Date: Tue Feb 4 13:08:44 2020 +0900 kconfig: Invalidate all symbols after changing to y or m. Since commit 89b9060987d9 ("kconfig: Add yes2modconfig and mod2yesconfig targets.") forgot to clear SYMBOL_VALID bit after changing to y or m, these targets did not save the changes. Call sym_clear_all_valid() so that all symbols are revalidated. Fixes: 89b9060987d9 ("kconfig: Add yes2modconfig and mod2yesconfig targets.") Signed-off-by: Tetsuo Handa Signed-off-by: Masahiro Yamada commit cde26a6e17ec36f6f20102a7e5767c2a0096c95f Author: Masahiro Yamada Date: Sun Feb 2 14:09:22 2020 +0900 kallsyms: fix type of kallsyms_token_table[] kallsyms_token_table[] only contains ASCII characters. It should be char instead of u8. Signed-off-by: Masahiro Yamada Reviewed-by: Masami Hiramatsu commit 58fe03d6dec908a1bec07eea7e94907af5c07eec Author: Lyude Paul Date: Fri Jan 24 14:10:46 2020 -0500 drm/amd/dm/mst: Ignore payload update failures Disabling a display on MST can potentially happen after the entire MST topology has been removed, which means that we can't communicate with the topology at all in this scenario. Likewise, this also means that we can't properly update payloads on the topology and as such, it's a good idea to ignore payload update failures when disabling displays. Currently, amdgpu makes the mistake of halting the payload update process when any payload update failures occur, resulting in leaving DC's local copies of the payload tables out of date. This ends up causing problems with hotplugging MST topologies, and causes modesets on the second hotplug to fail like so: [drm] Failed to updateMST allocation table forpipe idx:1 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1511 at drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_link.c:2677 update_mst_stream_alloc_table+0x11e/0x130 [amdgpu] Modules linked in: cdc_ether usbnet fuse xt_conntrack nf_conntrack nf_defrag_ipv6 libcrc32c nf_defrag_ipv4 ipt_REJECT nf_reject_ipv4 nft_counter nft_compat nf_tables nfnetlink tun bridge stp llc sunrpc vfat fat wmi_bmof uvcvideo snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi videobuf2_vmalloc snd_hda_intel videobuf2_memops videobuf2_v4l2 snd_intel_dspcfg videobuf2_common crct10dif_pclmul snd_hda_codec videodev crc32_pclmul snd_hwdep snd_hda_core ghash_clmulni_intel snd_seq mc joydev pcspkr snd_seq_device snd_pcm sp5100_tco k10temp i2c_piix4 snd_timer thinkpad_acpi ledtrig_audio snd wmi soundcore video i2c_scmi acpi_cpufreq ip_tables amdgpu(O) rtsx_pci_sdmmc amd_iommu_v2 gpu_sched mmc_core i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm crc32c_intel serio_raw hid_multitouch r8152 mii nvme r8169 nvme_core rtsx_pci pinctrl_amd CPU: 5 PID: 1511 Comm: gnome-shell Tainted: G O 5.5.0-rc7Lyude-Test+ #4 Hardware name: LENOVO FA495SIT26/FA495SIT26, BIOS R12ET22W(0.22 ) 01/31/2019 RIP: 0010:update_mst_stream_alloc_table+0x11e/0x130 [amdgpu] Code: 28 00 00 00 75 2b 48 8d 65 e0 5b 41 5c 41 5d 41 5e 5d c3 0f b6 06 49 89 1c 24 41 88 44 24 08 0f b6 46 01 41 88 44 24 09 eb 93 <0f> 0b e9 2f ff ff ff e8 a6 82 a3 c2 66 0f 1f 44 00 00 0f 1f 44 00 RSP: 0018:ffffac428127f5b0 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff8d1e166eee80 RCX: 0000000000000000 RDX: ffffac428127f668 RSI: ffff8d1e166eee80 RDI: ffffac428127f610 RBP: ffffac428127f640 R08: ffffffffc03d94a8 R09: 0000000000000000 R10: ffff8d1e24b02000 R11: ffffac428127f5b0 R12: ffff8d1e1b83d000 R13: ffff8d1e1bea0b08 R14: 0000000000000002 R15: 0000000000000002 FS: 00007fab23ffcd80(0000) GS:ffff8d1e28b40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f151f1711e8 CR3: 00000005997c0000 CR4: 00000000003406e0 Call Trace: ? mutex_lock+0xe/0x30 dc_link_allocate_mst_payload+0x9a/0x210 [amdgpu] ? dm_read_reg_func+0x39/0xb0 [amdgpu] ? core_link_enable_stream+0x656/0x730 [amdgpu] core_link_enable_stream+0x656/0x730 [amdgpu] dce110_apply_ctx_to_hw+0x58e/0x5d0 [amdgpu] ? dcn10_verify_allow_pstate_change_high+0x1d/0x280 [amdgpu] ? dcn10_wait_for_mpcc_disconnect+0x3c/0x130 [amdgpu] dc_commit_state+0x292/0x770 [amdgpu] ? add_timer+0x101/0x1f0 ? ttm_bo_put+0x1a1/0x2f0 [ttm] amdgpu_dm_atomic_commit_tail+0xb59/0x1ff0 [amdgpu] ? amdgpu_move_blit.constprop.0+0xb8/0x1f0 [amdgpu] ? amdgpu_bo_move+0x16d/0x2b0 [amdgpu] ? ttm_bo_handle_move_mem+0x118/0x570 [ttm] ? ttm_bo_validate+0x134/0x150 [ttm] ? dm_plane_helper_prepare_fb+0x1b9/0x2a0 [amdgpu] ? _cond_resched+0x15/0x30 ? wait_for_completion_timeout+0x38/0x160 ? _cond_resched+0x15/0x30 ? wait_for_completion_interruptible+0x33/0x190 commit_tail+0x94/0x130 [drm_kms_helper] drm_atomic_helper_commit+0x113/0x140 [drm_kms_helper] drm_atomic_helper_set_config+0x70/0xb0 [drm_kms_helper] drm_mode_setcrtc+0x194/0x6a0 [drm] ? _cond_resched+0x15/0x30 ? mutex_lock+0xe/0x30 ? drm_mode_getcrtc+0x180/0x180 [drm] drm_ioctl_kernel+0xaa/0xf0 [drm] drm_ioctl+0x208/0x390 [drm] ? drm_mode_getcrtc+0x180/0x180 [drm] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] do_vfs_ioctl+0x458/0x6d0 ksys_ioctl+0x5e/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x55/0x1b0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fab2121f87b Code: 0f 1e fa 48 8b 05 0d 96 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 95 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd045f9068 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffd045f90a0 RCX: 00007fab2121f87b RDX: 00007ffd045f90a0 RSI: 00000000c06864a2 RDI: 000000000000000b RBP: 00007ffd045f90a0 R08: 0000000000000000 R09: 000055dbd2985d10 R10: 000055dbd2196280 R11: 0000000000000246 R12: 00000000c06864a2 R13: 000000000000000b R14: 0000000000000000 R15: 000055dbd2196280 ---[ end trace 6ea888c24d2059cd ]--- Note as well, I have only been able to reproduce this on setups with 2 MST displays. Changes since v1: * Don't return false when part 1 or part 2 of updating the payloads fails, we don't want to abort at any step of the process even if things fail Reviewed-by: Mikita Lipski Signed-off-by: Lyude Paul Acked-by: Harry Wentland Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher commit 7b913a76a6cdda87e538df50df496624407373bf Author: Alex Deucher Date: Tue Feb 4 09:07:19 2020 -0500 drm/amdgpu: update default voltage for boot od table for navi1x It needed to be updated as well so it will show the proper values if you reset to the defaults. Bug: https://gitlab.freedesktop.org/drm/amd/issues/1020 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 2faf852d1be8a4960d328492298da6448cca0279 Author: Jens Axboe Date: Tue Feb 4 19:54:55 2020 -0700 io_uring: cleanup fixed file data table references syzbot reports a use-after-free in io_ring_file_ref_switch() when it tries to switch back to percpu mode. When we put the final reference to the table by calling percpu_ref_kill_and_confirm(), we don't want the zero reference to queue async work for flushing the potentially queued up items. We currently do a few flush_work(), but they merely paper around the issue, since the work item may not have been queued yet depending on the when the percpu-ref callback gets run. Coming into the file unregister, we know we have the ring quiesced. io_ring_file_ref_switch() can check for whether or not the ref is dying or not, and not queue anything async at that point. Once the ref has been confirmed killed, flush any potential items manually. Reported-by: syzbot+7caeaea49c2c8a591e3d@syzkaller.appspotmail.com Fixes: 05f3fb3c5397 ("io_uring: avoid ring quiesce for fixed file set unregister and update") Signed-off-by: Jens Axboe commit f06572ef476d368a239f0238ecf7b00b9cdbf5bf Author: Rafael J. Wysocki Date: Wed Feb 5 02:08:31 2020 +0100 cpuidle: Documentation: Clean up PM QoS description Clean up the language in one paragraph in the PM QoS description in Documentation/admin-guide/pm/cpuidle.rst. Signed-off-by: Rafael J. Wysocki commit df069d80c8e38c19531c392322e9a16617475c44 Author: Jens Axboe Date: Tue Feb 4 16:48:34 2020 -0700 io_uring: spin for sq thread to idle on shutdown As part of io_uring shutdown, we cancel work that is pending and won't necessarily complete on its own. That includes requests like poll commands and timeouts. If we're using SQPOLL for kernel side submission and we shutdown the ring immediately after queueing such work, we can race with the sqthread doing the submission. This means we may miss cancelling some work, which results in the io_uring shutdown hanging forever. Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe commit 34129bb831cc27e5368270562d11d12f73db1e49 Author: Dilip Kota Date: Fri Dec 20 17:53:24 2019 +0800 dt-bindings: PCI: intel: Fix dt_binding_check compilation failure Remove dependency as it is not present in the mainline tree. Use numeric value instead of LGM_GCLK_PCIE10 macro. Signed-off-by: Dilip Kota [robh: Also drop interrupt-parent from example] Signed-off-by: Rob Herring commit 4ae87b17cc327f32335608f953681906cdcf69fc Author: Rob Herring Date: Fri Jan 31 09:25:29 2020 -0600 dt-bindings: phy: Fix errors in intel,lgm-emmc-phy example DT labels can't have '-' in them causing a compile failure in the example. Fixing that leads to more warnings: Documentation/devicetree/bindings/phy/intel,lgm-emmc-phy.example.dts:23.13-33: Warning (reg_format): /example-0/chiptop@e0200000/emmc-phy@a8:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1) Documentation/devicetree/bindings/phy/intel,lgm-emmc-phy.example.dt.yaml: Warning (pci_device_bus_num): Failed prerequisite 'reg_format' Documentation/devicetree/bindings/phy/intel,lgm-emmc-phy.example.dt.yaml: Warning (i2c_bus_reg): Failed prerequisite 'reg_format' Documentation/devicetree/bindings/phy/intel,lgm-emmc-phy.example.dt.yaml: Warning (spi_bus_reg): Failed prerequisite 'reg_format' Documentation/devicetree/bindings/phy/intel,lgm-emmc-phy.example.dts:21.33-26.13: Warning (avoid_default_addr_size): /example-0/chiptop@e0200000/emmc-phy@a8: Relying on default #address-cells value Documentation/devicetree/bindings/phy/intel,lgm-emmc-phy.example.dts:21.33-26.13: Warning (avoid_default_addr_size): /example-0/chiptop@e0200000/emmc-phy@a8: Relying on default #size-cells value Fixes: 5bc999108025 ("dt-bindings: phy: intel-emmc-phy: Add YAML schema for LGM eMMC PHY") Cc: Ramuthevar Vadivel Murugan Cc: Dafna Hirschfeld Cc: Kishon Vijay Abraham I Signed-off-by: Rob Herring commit 9f198a2ac543eaaf47be275531ad5cbd50db3edf Author: Vasily Averin Date: Fri Jan 24 09:10:47 2020 +0300 help_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Mike Marshall commit b74e58cd472cb782d34ecfad553c12c66eb02b6b Merge: c8ab422553c8 0f5be6a4ff7b Author: Jens Axboe Date: Tue Feb 4 11:29:36 2020 -0700 Merge branch 'nvme-5.6' of git://git.infradead.org/nvme into block-5.6 Pull NVMe fixes from Keith. * 'nvme-5.6' of git://git.infradead.org/nvme: nvmet: update AEN list and array at one place nvmet: Fix controller use after free nvmet: Fix error print message at nvmet_install_queue function nvme-pci: remove nvmeq->tags nvmet: fix dsm failure when payload does not match sgl descriptor nvmet: Pass lockdep expression to RCU lists commit 7dc2993a9e51dd2eee955944efec65bef90265b7 Author: Robert Milkowski Date: Thu Jan 30 09:43:25 2020 +0000 NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals Currently, each time nfs4_do_fsinfo() is called it will do an implicit NFS4 lease renewal, which is not compliant with the NFS4 specification. This can result in a lease being expired by an NFS server. Commit 83ca7f5ab31f ("NFS: Avoid PUTROOTFH when managing leases") introduced implicit client lease renewal in nfs4_do_fsinfo(), which can result in the NFSv4.0 lease to expire on a server side, and servers returning NFS4ERR_EXPIRED or NFS4ERR_STALE_CLIENTID. This can easily be reproduced by frequently unmounting a sub-mount, then stat'ing it to get it mounted again, which will delay or even completely prevent client from sending RENEW operations if no other NFS operations are issued. Eventually nfs server will expire client's lease and return an error on file access or next RENEW. This can also happen when a sub-mount is automatically unmounted due to inactivity (after nfs_mountpoint_expiry_timeout), then it is mounted again via stat(). This can result in a short window during which client's lease will expire on a server but not on a client. This specific case was observed on production systems. This patch removes the implicit lease renewal from nfs4_do_fsinfo(). Fixes: 83ca7f5ab31f ("NFS: Avoid PUTROOTFH when managing leases") Signed-off-by: Robert Milkowski Signed-off-by: Anna Schumaker commit 924491f2e476f7234d722b24171a4daff61bbe13 Author: Robert Milkowski Date: Tue Jan 28 08:37:47 2020 +0000 NFSv4: try lease recovery on NFS4ERR_EXPIRED Currently, if an nfs server returns NFS4ERR_EXPIRED to open(), we return EIO to applications without even trying to recover. Fixes: 272289a3df72 ("NFSv4: nfs4_do_handle_exception() handle revoke/expiry of a single stateid") Signed-off-by: Robert Milkowski Reviewed-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a Author: Daniel Wagner Date: Thu Jan 30 10:29:34 2020 -0800 nvmet: update AEN list and array at one place All async events are enqueued via nvmet_add_async_event() which updates the ctrl->async_event_cmds[] array and additionally an struct nvmet_async_event is added to the ctrl->async_events list. Under normal operations the nvmet_async_event_work() updates again the ctrl->async_event_cmds and removes the corresponding struct nvmet_async_event from the list again. Though nvmet_sq_destroy() could be called which calls nvmet_async_events_free() which only updates the ctrl->async_event_cmds[] array. Add new functions nvmet_async_events_process() and nvmet_async_events_free() to process async events, update an array and the list. When we destroy submission queue after clearing the aen present on the ctrl->async list we also loop over ctrl->async_event_cmds[] for any requests posted by the host for which we don't have the AEN in the ctrl->async_events list by calling nvmet_async_event_process() and nvmet_async_events_free(). Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner [chaitanya.kulkarni@wdc.com * Loop over and clear out outstanding requests * Update changelog ] Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit c7e661a1c2ae98a4754db6a85fc686b4a89322ad Author: Nikhil Mahale Date: Tue Feb 4 15:57:46 2020 +0530 ALSA: hda - Fix DP-MST support for NVIDIA codecs If dyn_pcm_assign is set, different jack objects are being created for pcm and pins. If dyn_pcm_assign is set, generic_hdmi_build_jack() calls into add_hdmi_jack_kctl() to create and track separate jack object for pcm. Like sync_eld_via_acomp(), hdmi_present_sense_via_verbs() also need to report status change of the pcm jack. Rename pin_idx_to_jack() to pin_idx_to_pcm_jack(). Update hdmi_present_sense_via_verbs() to report plug state of pcm jack object. Unlike sync_eld_via_acomp(), for !acomp drivers the pcm jack's plug state must be consistent with plug state of pin's jack. Fixes: 5398e94fb753 ("ALSA: hda - Add DP-MST support for NVIDIA codecs") Reported-and-tested-by: Martin Regner Signed-off-by: Nikhil Mahale Reviewed-by: Kai Vehmanen Cc: Link: https://lore.kernel.org/r/20200204102746.1356-1-nmahale@nvidia.com Signed-off-by: Takashi Iwai commit 1a3f540d63152b8db0a12de508bfa03776217d83 Author: Israel Rukshin Date: Tue Feb 4 14:38:10 2020 +0200 nvmet: Fix controller use after free After nvmet_install_queue() sets sq->ctrl calling to nvmet_sq_destroy() reduces the controller refcount. In case nvmet_install_queue() fails, calling to nvmet_ctrl_put() is done twice (at nvmet_sq_destroy and nvmet_execute_io_connect/nvmet_execute_admin_connect) instead of once for the queue which leads to use after free of the controller. Fix this by set NULL at sq->ctrl in case of a failure at nvmet_install_queue(). The bug leads to the following Call Trace: [65857.994862] refcount_t: underflow; use-after-free. [65858.108304] Workqueue: events nvmet_rdma_release_queue_work [nvmet_rdma] [65858.115557] RIP: 0010:refcount_warn_saturate+0xe5/0xf0 [65858.208141] Call Trace: [65858.211203] nvmet_sq_destroy+0xe1/0xf0 [nvmet] [65858.216383] nvmet_rdma_release_queue_work+0x37/0xf0 [nvmet_rdma] [65858.223117] process_one_work+0x167/0x370 [65858.227776] worker_thread+0x49/0x3e0 [65858.232089] kthread+0xf5/0x130 [65858.235895] ? max_active_store+0x80/0x80 [65858.240504] ? kthread_bind+0x10/0x10 [65858.244832] ret_from_fork+0x1f/0x30 [65858.249074] ---[ end trace f82d59250b54beb7 ]--- Fixes: bb1cc74790eb ("nvmet: implement valid sqhd values in completions") Fixes: 1672ddb8d691 ("nvmet: Add install_queue callout") Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 0b87a2b795d66be7b54779848ef0f3901c5e46fc Author: Israel Rukshin Date: Tue Feb 4 14:38:09 2020 +0200 nvmet: Fix error print message at nvmet_install_queue function Place the arguments in the correct order. Fixes: 1672ddb8d691 ("nvmet: Add install_queue callout") Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 123c23c6a7b7ecd2a3d6060bea1d94019f71fd66 Author: Wenwen Wang Date: Mon Feb 3 03:47:53 2020 +0000 NFS: Fix memory leaks In _nfs42_proc_copy(), 'res->commit_res.verf' is allocated through kzalloc() if 'args->sync' is true. In the following code, if 'res->synchronous' is false, handle_async_copy() will be invoked. If an error occurs during the invocation, the following code will not be executed and the error will be returned . However, the allocated 'res->commit_res.verf' is not deallocated, leading to a memory leak. This is also true if the invocation of process_copy_commit() returns an error. To fix the above leaks, redirect the execution to the 'out' label if an error is encountered. Signed-off-by: Wenwen Wang Signed-off-by: Anna Schumaker commit 227823d2074da0c138d2abc0074b2dd281bbf923 Author: Dai Ngo Date: Wed Jan 22 20:45:39 2020 -0500 nfs: optimise readdir cache page invalidation When the directory is large and it's being modified by one client while another client is doing the 'ls -l' on the same directory then the cache page invalidation from nfs_force_use_readdirplus causes the reading client to keep restarting READDIRPLUS from cookie 0 which causes the 'ls -l' to take a very long time to complete, possibly never completing. Currently when nfs_force_use_readdirplus is called to switch from READDIR to READDIRPLUS, it invalidates all the cached pages of the directory. This cache page invalidation causes the next nfs_readdir to re-read the directory content from cookie 0. This patch is to optimise the cache invalidation in nfs_force_use_readdirplus by only truncating the cached pages from last page index accessed to the end the file. It also marks the inode to delay invalidating all the cached page of the directory until the next initial nfs_readdir of the next 'ls' instance. Signed-off-by: Dai Ngo Reviewed-by: Trond Myklebust [Anna - Fix conflicts with Trond's readdir patches] [Anna - Remove redundant call to nfs_zap_mapping()] [Anna - Replace d_inode(file_dentry(desc->file)) with file_inode(desc->file)] Signed-off-by: Anna Schumaker commit 1064ad4aeef94f51ca230ac639a9e996fb7867a0 Author: Alex Deucher Date: Wed Jan 29 12:42:57 2020 -0500 drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage Cull out 0 clocks to avoid a warning in DC. Bug: https://gitlab.freedesktop.org/drm/amd/issues/963 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 4d0a72b66065dd7e274bad6aa450196d42fd8f84 Author: Alex Deucher Date: Tue Jan 28 13:19:51 2020 -0500 drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency Only send non-0 clocks to DC for validation. This mirrors what the windows driver does. Bug: https://gitlab.freedesktop.org/drm/amd/issues/963 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit c37243579d6c881c575dcfb54cf31c9ded88f946 Author: Alex Deucher Date: Tue Jan 28 14:39:45 2020 -0500 drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c (v2) We might get different numbers of clocks from powerplay depending on what the OEM has populated. v2: add assert for at least one level Bug: https://gitlab.freedesktop.org/drm/amd/issues/963 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit 0531aa6eb38bfa9514609e2727558a051da7365f Author: Alex Deucher Date: Sat Jan 25 13:30:45 2020 -0500 drm/amdgpu: fetch default VDDC curve voltages (v2) Ask the SMU for the default VDDC curve voltage values. This properly reports the VDDC values in the OD interface. v2: only update if the original values are 0 Bug: https://gitlab.freedesktop.org/drm/amd/issues/1020 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.5.x commit 93c5f1f66c6ad4a3b180c1644f74e1b3b4be7864 Author: Matt Coffin Date: Sat Jan 25 13:04:05 2020 -0500 drm/amdgpu/smu_v11_0: Correct behavior of restoring default tables (v2) Previously, the syfs functionality for restoring the default powerplay table was sourcing it's information from the currently-staged powerplay table. This patch adds a step to cache the first overdrive table that we see on boot, so that it can be used later to "restore" the powerplay table v2: sqaush my original with Matt's fix Bug: https://gitlab.freedesktop.org/drm/amd/issues/1020 Signed-off-by: Matt Coffin Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.5.x commit ee23a518fdc2c1dd1aaaf3a2c7ffdd6c83b396ec Author: Alex Deucher Date: Sat Jan 25 11:27:06 2020 -0500 drm/amdgpu/navi10: add OD_RANGE for navi overclocking So users can see the range of valid values. Bug: https://gitlab.freedesktop.org/drm/amd/issues/1020 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.5.x commit 45826e9c4e9e952db43053f4fbed58ec602a410f Author: Alex Deucher Date: Sat Jan 25 11:51:41 2020 -0500 drm/amdgpu/navi: fix index for OD MCLK You can only adjust the max mclk, not the min. Bug: https://gitlab.freedesktop.org/drm/amd/issues/1020 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.5.x commit a30a8c2f884c2835383cc5cce134fafbcaa62c1f Author: Bhawanpreet Lakha Date: Fri Dec 6 13:16:08 2019 -0500 drm/amd/display: Fix HW/SW state mismatch [Why] When we disable a connector we don't explicitly remove it from the module so the display is still cached(SW) in the hdcp_module. SST: no issues because we can only have 1 display per link MST: We have x displays per link, now if we disable 1 we don't remove it from the module so the module has x display cached(SW). If we try to enable HDCP, psp verification will fail because we are reporting x displays while the HW only has x-1 display enabled [How] Check the callback for when we disable stream and call remove display. Signed-off-by: Bhawanpreet Lakha Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 47eed65178e8fa626097648eb90cb6b31952efbc Author: Mikita Lipski Date: Fri Jan 31 09:51:23 2020 -0500 drm/amd/display: Fix a typo when computing dsc configuration [why] Remove a backslash symbol accidentally left in increase bpp function when computing mst dsc configuration. Signed-off-by: Mikita Lipski Reviewed-by: Zhan Liu Signed-off-by: Alex Deucher commit 1cf8c930b378016846c88ef0f1444248033326ec Author: Evan Quan Date: Thu Jan 30 16:46:38 2020 +0800 drm/amd/powerplay: fix navi10 system intermittent reboot issue V2 This workaround is needed only for Navi10 12 Gbps SKUs. V2: added SMU firmware version guard Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit f38abc15d157b7b31fa7f651dc8bf92858c963f8 Author: Yong Zhao Date: Wed Jan 29 19:55:47 2020 -0500 drm/amdkfd: Fix a bug in SDMA RLC queue counting under HWS mode The sdma_queue_count increment should be done before execute_queues_cpsch(), which calls pm_calc_rlib_size() where sdma_queue_count is used to calculate whether over_subscription is triggered. With the previous code, when a SDMA queue is created, compute_queue_count in pm_calc_rlib_size() is one more than the actual compute queue number, because the queue_count has been incremented while sdma_queue_count has not. This patch fixes that. Signed-off-by: Yong Zhao Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit c6a228be7f440ad5c341b3039f6033d4a8f070a4 Author: Nicholas Kazlauskas Date: Thu Jan 30 13:29:05 2020 -0500 drm/amd/display: Only enable cursor on pipes that need it [Why] In current code we're essentially drawing the cursor on every pipe that contains it. This only works when the planes have the same scaling for src to dest rect, otherwise we'll get "double cursor" where one cursor is incorrectly filtered and offset from the real position. [How] Without dedicated cursor planes on DCN we require at least one pipe that matches the scaling of the current timing. This is an optimization and workaround for the most common case where the top-most plane is not scaled but the bottom-most plane is scaled. Whenever a pipe has a parent pipe in the blending tree whose recout fully contains the current pipe we can disable the pipe. This only applies when the pipe is actually visible of course. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit b9303bb1990950bd2f49ec1c85c015b5b6aac24b Author: Jason A. Donenfeld Date: Mon Feb 3 22:53:06 2020 +0100 x86/PCI: Define to_pci_sysdata() even when !CONFIG_PCI Recently, the to_pci_sysdata() helper was added inside the CONFIG_PCI guard, but it is used inside a CONFIG_NUMA guard, which does not require CONFIG_PCI. This breaks builds on !CONFIG_PCI machines. Make to_pci_sysdata() available in all configurations. Fixes: aad6aa0cd674 ("x86/PCI: Add to_pci_sysdata() helper") Link: https://lore.kernel.org/r/20200203215306.172000-1-Jason@zx2c4.com Reported-by: Randy Dunlap Signed-off-by: Jason A. Donenfeld Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig Acked-by: Randy Dunlap # build-tested commit c8ab422553c81a0eb070329c63725df1cd1425bc Author: Zhiqiang Liu Date: Tue Feb 4 19:30:20 2020 +0800 brd: check and limit max_part par In brd_init func, rd_nr num of brd_device are firstly allocated and add in brd_devices, then brd_devices are traversed to add each brd_device by calling add_disk func. When allocating brd_device, the disk->first_minor is set to i * max_part, if rd_nr * max_part is larger than MINORMASK, two different brd_device may have the same devt, then only one of them can be successfully added. when rmmod brd.ko, it will cause oops when calling brd_exit. Follow those steps: # modprobe brd rd_nr=3 rd_size=102400 max_part=1048576 # rmmod brd then, the oops will appear. Oops log: [ 726.613722] Call trace: [ 726.614175] kernfs_find_ns+0x24/0x130 [ 726.614852] kernfs_find_and_get_ns+0x44/0x68 [ 726.615749] sysfs_remove_group+0x38/0xb0 [ 726.616520] blk_trace_remove_sysfs+0x1c/0x28 [ 726.617320] blk_unregister_queue+0x98/0x100 [ 726.618105] del_gendisk+0x144/0x2b8 [ 726.618759] brd_exit+0x68/0x560 [brd] [ 726.619501] __arm64_sys_delete_module+0x19c/0x2a0 [ 726.620384] el0_svc_common+0x78/0x130 [ 726.621057] el0_svc_handler+0x38/0x78 [ 726.621738] el0_svc+0x8/0xc [ 726.622259] Code: aa0203f6 aa0103f7 aa1e03e0 d503201f (7940e260) Here, we add brd_check_and_reset_par func to check and limit max_part par. -- V5->V6: - remove useless code V4->V5:(suggested by Ming Lei) - make sure max_part is not larger than DISK_MAX_PARTS V3->V4:(suggested by Ming Lei) - remove useless change - add one limit of max_part V2->V3: (suggested by Ming Lei) - clear .minors when running out of consecutive minor space in brd_alloc - remove limit of rd_nr V1->V2: - add more checks in brd_check_par_valid as suggested by Ming Lei. Signed-off-by: Zhiqiang Liu Reviewed-by: Bob Liu Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 33b40134e5cfbbccad7f3040d1919889537a3df7 Merge: d60ddd244215 bd5cd35b782a Author: Linus Torvalds Date: Tue Feb 4 13:32:20 2020 +0000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Use after free in rxrpc_put_local(), from David Howells. 2) Fix 64-bit division error in mlxsw, from Nathan Chancellor. 3) Make sure we clear various bits of TCP state in response to tcp_disconnect(). From Eric Dumazet. 4) Fix netlink attribute policy in cls_rsvp, from Eric Dumazet. 5) txtimer must be deleted in stmmac suspend(), from Nicolin Chen. 6) Fix TC queue mapping in bnxt_en driver, from Michael Chan. 7) Various netdevsim fixes from Taehee Yoo (use of uninitialized data, snapshot panics, stack out of bounds, etc.) 8) cls_tcindex changes hash table size after allocating the table, fix from Cong Wang. 9) Fix regression in the enforcement of session ID uniqueness in l2tp. We only have to enforce uniqueness for IP based tunnels not UDP ones. From Ridge Kennedy. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (46 commits) gtp: use __GFP_NOWARN to avoid memalloc warning l2tp: Allow duplicate session creation with UDP r8152: Add MAC passthrough support to new device net_sched: fix an OOB access in cls_tcindex qed: Remove set but not used variable 'p_link' tc-testing: add missing 'nsPlugin' to basic.json tc-testing: fix eBPF tests failure on linux fresh clones net: hsr: fix possible NULL deref in hsr_handle_frame() netdevsim: remove unused sdev code netdevsim: use __GFP_NOWARN to avoid memalloc warning netdevsim: use IS_ERR instead of IS_ERR_OR_NULL for debugfs netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init() netdevsim: fix panic in nsim_dev_take_snapshot_write() netdevsim: disable devlink reload when resources are being used netdevsim: fix using uninitialized resources bnxt_en: Fix TC queue mapping. bnxt_en: Fix logic that disables Bus Master during firmware reset. bnxt_en: Fix RDMA driver failure with SRIOV after firmware reset. bnxt_en: Refactor logic to re-enable SRIOV after firmware reset detected. net: stmmac: Delete txtimer in suspend() ... commit d60ddd244215da7c695cba858427094d8e366aa7 Merge: 71c3a888cbca 03a575a6a1d2 Author: Linus Torvalds Date: Tue Feb 4 13:12:19 2020 +0000 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - decompressor updates - prevention of out-of-bounds access while stacktracing - fix a section mismatch warning with free_memmap() - make kexec depend on MMU to avoid some build errors - remove swapops stubs * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8954/1: NOMMU: remove stubs for swapops ARM: 8952/1: Disable kmemleak on XIP kernels ARM: 8951/1: Fix Kexec compilation issue. ARM: 8949/1: mm: mark free_memmap as __init ARM: 8948/1: Prevent OOB access in stacktrace ARM: 8945/1: decompressor: use CONFIG option instead of cc-option ARM: 8942/1: Revert "8857/1: efi: enable CP15 DMB instructions before cleaning the cache" ARM: 8941/1: decompressor: enable CP15 barrier instructions in v7 cache setup code commit 71c3a888cbcaf453aecf8d2f8fb003271d28073f Merge: 153b5c566d30 4c25df5640ae Author: Linus Torvalds Date: Tue Feb 4 13:06:46 2020 +0000 Merge tag 'powerpc-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: "A pretty small batch for us, and apologies for it being a bit late, I wanted to sneak Christophe's user_access_begin() series in. Summary: - Implement user_access_begin() and friends for our platforms that support controlling kernel access to userspace. - Enable CONFIG_VMAP_STACK on 32-bit Book3S and 8xx. - Some tweaks to our pseries IOMMU code to allow SVMs ("secure" virtual machines) to use the IOMMU. - Add support for CLOCK_{REALTIME/MONOTONIC}_COARSE to the 32-bit VDSO, and some other improvements. - A series to use the PCI hotplug framework to control opencapi card's so that they can be reset and re-read after flashing a new FPGA image. As well as other minor fixes and improvements as usual. Thanks to: Alastair D'Silva, Alexandre Ghiti, Alexey Kardashevskiy, Andrew Donnellan, Aneesh Kumar K.V, Anju T Sudhakar, Bai Yingjie, Chen Zhou, Christophe Leroy, Frederic Barrat, Greg Kurz, Jason A. Donenfeld, Joel Stanley, Jordan Niethe, Julia Lawall, Krzysztof Kozlowski, Laurent Dufour, Laurentiu Tudor, Linus Walleij, Michael Bringmann, Nathan Chancellor, Nicholas Piggin, Nick Desaulniers, Oliver O'Halloran, Peter Ujfalusi, Pingfan Liu, Ram Pai, Randy Dunlap, Russell Currey, Sam Bobroff, Sebastian Andrzej Siewior, Shawn Anastasio, Stephen Rothwell, Steve Best, Sukadev Bhattiprolu, Thiago Jung Bauermann, Tyrel Datwyler, Vaibhav Jain" * tag 'powerpc-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (131 commits) powerpc: configs: Cleanup old Kconfig options powerpc/configs/skiroot: Enable some more hardening options powerpc/configs/skiroot: Disable xmon default & enable reboot on panic powerpc/configs/skiroot: Enable security features powerpc/configs/skiroot: Update for symbol movement only powerpc/configs/skiroot: Drop default n CONFIG_CRYPTO_ECHAINIV powerpc/configs/skiroot: Drop HID_LOGITECH powerpc/configs: Drop NET_VENDOR_HP which moved to staging powerpc/configs: NET_CADENCE became NET_VENDOR_CADENCE powerpc/configs: Drop CONFIG_QLGE which moved to staging powerpc: Do not consider weak unresolved symbol relocations as bad powerpc/32s: Fix kasan_early_hash_table() for CONFIG_VMAP_STACK powerpc: indent to improve Kconfig readability powerpc: Provide initial documentation for PAPR hcalls powerpc: Implement user_access_save() and user_access_restore() powerpc: Implement user_access_begin and friends powerpc/32s: Prepare prevent_user_access() for user_access_end() powerpc/32s: Drop NULL addr verification powerpc/kuap: Fix set direction in allow/prevent_user_access() powerpc/32s: Fix bad_kuap_fault() ... commit 153b5c566d30fb984827acb12fd93c3aa6c147d3 Merge: 7f879e1a94ac 6aa71ef9bcf9 Author: Linus Torvalds Date: Tue Feb 4 11:58:07 2020 +0000 Merge tag 'microblaze-v5.6-rc1' of git://git.monstr.eu/linux-2.6-microblaze Pull Microblaze update from Michal Simek: - enable CMA - add support for MB v11 - defconfig updates - minor fixes * tag 'microblaze-v5.6-rc1' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Add ID for Microblaze v11 microblaze: Prevent the overflow of the start microblaze: Wire CMA allocator asm-generic: Make dma-contiguous.h a mandatory include/asm header microblaze: Sync defconfig with latest Kconfig layout microblaze: defconfig: Disable EXT2 driver and Enable EXT3 & EXT4 drivers microblaze: Align comments with register usage commit 7f879e1a94ac99586abf0659c03f35c1e48279c4 Merge: a45ad71e8995 a4ac9d45c0cd Author: Linus Torvalds Date: Tue Feb 4 11:45:21 2020 +0000 Merge tag 'ovl-update-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs update from Miklos Szeredi: - Try to preserve holes in sparse files when copying up, thus saving disk space and improving performance. - Fix a performance regression introduced in v4.19 by preserving asynchronicity of IO when fowarding to underlying layers. Add VFS helpers to submit async iocbs. - Fix a regression in lseek(2) introduced in v4.19 that breaks >2G seeks on 32bit kernels. - Fix a corner case where st_ino/st_dev was not preserved across copy up. - Miscellaneous fixes and cleanups. * tag 'ovl-update-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: fix lseek overflow on 32bit ovl: add splice file read write helper ovl: implement async IO routines vfs: add vfs_iocb_iter_[read|write] helper functions ovl: layer is const ovl: fix corner case of non-constant st_dev;st_ino ovl: fix corner case of conflicting lower layer uuid ovl: generalize the lower_fs[] array ovl: simplify ovl_same_sb() helper ovl: generalize the lower_layers[] array ovl: improving copy-up efficiency for big sparse file ovl: use ovl_inode_lock in ovl_llseek() ovl: use pr_fmt auto generate prefix ovl: fix wrong WARN_ON() in ovl_cache_update_ino() commit 03891f820c2117b19e80b370281eb924a09cf79f Author: Raed Salem Date: Sun Feb 2 13:19:34 2020 +0200 xfrm: handle NETDEV_UNREGISTER for xfrm device This patch to handle the asynchronous unregister device event so the device IPsec offload resources could be cleanly released. Fixes: e4db5b61c572 ("xfrm: policy: remove pcpu policy cache") Signed-off-by: Raed Salem Reviewed-by: Boris Pismenny Reviewed-by: Saeed Mahameed Signed-off-by: Steffen Klassert commit bd5cd35b782abf5437fbd01dfaee12437d20e832 Author: Taehee Yoo Date: Tue Feb 4 03:24:59 2020 +0000 gtp: use __GFP_NOWARN to avoid memalloc warning gtp hashtable size is received by user-space. So, this hashtable size could be too large. If so, kmalloc will internally print a warning message. This warning message is actually not necessary for the gtp module. So, this patch adds __GFP_NOWARN to avoid this message. Splat looks like: [ 2171.200049][ T1860] WARNING: CPU: 1 PID: 1860 at mm/page_alloc.c:4713 __alloc_pages_nodemask+0x2f3/0x740 [ 2171.238885][ T1860] Modules linked in: gtp veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv] [ 2171.262680][ T1860] CPU: 1 PID: 1860 Comm: gtp-link Not tainted 5.5.0+ #321 [ 2171.263567][ T1860] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 2171.264681][ T1860] RIP: 0010:__alloc_pages_nodemask+0x2f3/0x740 [ 2171.265332][ T1860] Code: 64 fe ff ff 65 48 8b 04 25 c0 0f 02 00 48 05 f0 12 00 00 41 be 01 00 00 00 49 89 47 0 [ 2171.267301][ T1860] RSP: 0018:ffff8880b51af1f0 EFLAGS: 00010246 [ 2171.268320][ T1860] RAX: ffffed1016a35e43 RBX: 0000000000000000 RCX: 0000000000000000 [ 2171.269517][ T1860] RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000000 [ 2171.270305][ T1860] RBP: 0000000000040cc0 R08: ffffed1018893109 R09: dffffc0000000000 [ 2171.275973][ T1860] R10: 0000000000000001 R11: ffffed1018893108 R12: 1ffff11016a35e43 [ 2171.291039][ T1860] R13: 000000000000000b R14: 000000000000000b R15: 00000000000f4240 [ 2171.292328][ T1860] FS: 00007f53cbc83740(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000 [ 2171.293409][ T1860] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2171.294586][ T1860] CR2: 000055f540014508 CR3: 00000000b49f2004 CR4: 00000000000606e0 [ 2171.295424][ T1860] Call Trace: [ 2171.295756][ T1860] ? mark_held_locks+0xa5/0xe0 [ 2171.296659][ T1860] ? __alloc_pages_slowpath+0x21b0/0x21b0 [ 2171.298283][ T1860] ? gtp_encap_enable_socket+0x13e/0x400 [gtp] [ 2171.298962][ T1860] ? alloc_pages_current+0xc1/0x1a0 [ 2171.299475][ T1860] kmalloc_order+0x22/0x80 [ 2171.299936][ T1860] kmalloc_order_trace+0x1d/0x140 [ 2171.300437][ T1860] __kmalloc+0x302/0x3a0 [ 2171.300896][ T1860] gtp_newlink+0x293/0xba0 [gtp] [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 0d0d9a388a858e271bb70e71e99e7fe2a6fd6f64 Author: Ridge Kennedy Date: Tue Feb 4 12:24:00 2020 +1300 l2tp: Allow duplicate session creation with UDP In the past it was possible to create multiple L2TPv3 sessions with the same session id as long as the sessions belonged to different tunnels. The resulting sessions had issues when used with IP encapsulated tunnels, but worked fine with UDP encapsulated ones. Some applications began to rely on this behaviour to avoid having to negotiate unique session ids. Some time ago a change was made to require session ids to be unique across all tunnels, breaking the applications making use of this "feature". This change relaxes the duplicate session id check to allow duplicates if both of the colliding sessions belong to UDP encapsulated tunnels. Fixes: dbdbc73b4478 ("l2tp: fix duplicate session creation") Signed-off-by: Ridge Kennedy Acked-by: James Chapman Signed-off-by: David S. Miller commit 42b716359beca10684195fd6e93a74ecd8ca8003 Author: Srinivas Kandagatla Date: Tue Feb 4 11:12:41 2020 +0000 ASoC: wcd934x: Add missing COMMON_CLK dependency Looks like some platforms are not yet using COMMON CLK. PowerPC allyesconfig failed with below error in next ld: sound/soc/codecs/wcd934x.o:(.toc+0x0): undefined reference to `of_clk_src_simple_get' ld: sound/soc/codecs/wcd934x.o: in function `.wcd934x_codec_probe': wcd934x.c:(.text.wcd934x_codec_probe+0x3d4): undefined reference to `.__clk_get_name' ld: wcd934x.c:(.text.wcd934x_codec_probe+0x438): undefined reference to `.clk_hw_register' ld: wcd934x.c:(.text.wcd934x_codec_probe+0x474): undefined reference to `.of_clk_add_provider' Add the missing COMMON_CLK dependency to fix this errors. Reported-by: Stephen Rothwell Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20200204111241.6927-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit b4b771fd51fda70577dc980429347c41e807c64f Author: Kai-Heng Feng Date: Tue Feb 4 13:33:13 2020 +0800 r8152: Add MAC passthrough support to new device Device 0xa387 also supports MAC passthrough, therefore add it to the whitelst. BugLink: https://bugs.launchpad.net/bugs/1827961/comments/30 Signed-off-by: Kai-Heng Feng Signed-off-by: David S. Miller commit 599be01ee567b61f4471ee8078870847d0a11e8e Author: Cong Wang Date: Sun Feb 2 21:14:35 2020 -0800 net_sched: fix an OOB access in cls_tcindex As Eric noticed, tcindex_alloc_perfect_hash() uses cp->hash to compute the size of memory allocation, but cp->hash is set again after the allocation, this caused an out-of-bound access. So we have to move all cp->hash initialization and computation before the memory allocation. Move cp->mask and cp->shift together as cp->hash may need them for computation too. Reported-and-tested-by: syzbot+35d4dea36c387813ed31@syzkaller.appspotmail.com Fixes: 331b72922c5f ("net: sched: RCU cls_tcindex") Cc: Eric Dumazet Cc: John Fastabend Cc: Jamal Hadi Salim Cc: Jiri Pirko Cc: Jakub Kicinski Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 6aa71ef9bcf9d8688c777dfbff340348cb89a5b4 Author: Michal Simek Date: Tue Jan 14 14:42:51 2020 +0100 microblaze: Add ID for Microblaze v11 List Microblaze v11 from PVR. Signed-off-by: Michal Simek commit 061d2c1d593076424c910cb1b64ecdb5c9a6923f Author: Shubhrajyoti Datta Date: Sat Jan 11 18:44:34 2020 +0530 microblaze: Prevent the overflow of the start In case the start + cache size is more than the max int the start overflows. Prevent the same. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Michal Simek commit 2602276d3d3811b1a48c48113042cd75fcbfc27d Author: Michal Simek Date: Tue Jan 14 10:05:24 2020 +0100 microblaze: Wire CMA allocator Based on commit 04e3543e228f ("microblaze: use the generic dma coherent remap allocator") CMA can be easily enabled by calling dma_contiguous_reserve() at the end of mmu_init(). High limit is end of lowmem space which is completely unused at this point of time. Signed-off-by: Michal Simek Reviewed-by: Christoph Hellwig commit def3f7cefe4e81c296090e1722a76551142c227c Author: Michal Simek Date: Fri Jan 17 08:48:17 2020 +0100 asm-generic: Make dma-contiguous.h a mandatory include/asm header dma-continuguous.h is generic for all architectures except arm32 which has its own version. Similar change was done for msi.h by commit a1b39bae16a6 ("asm-generic: Make msi.h a mandatory include/asm header") Suggested-by: Christoph Hellwig Link: https://lore.kernel.org/linux-arm-kernel/20200117080446.GA8980@lst.de/T/#m92bb56b04161057635d4142e1b3b9b6b0a70122e Signed-off-by: Michal Simek Reviewed-by: Christoph Hellwig Acked-by: Thomas Gleixner Acked-by: Arnd Bergmann Acked-by: Paul Walmsley # for arch/riscv commit 5fefd796c8992a4441b64de29716f8f0cdaf6a79 Author: Michal Simek Date: Tue Jan 14 12:10:38 2020 +0100 microblaze: Sync defconfig with latest Kconfig layout Layout was changed by commit 6210b6402f58 ("kernel-hacking: group sysrq/kgdb/ubsan into 'Generic Kernel Debugging Instruments'") Signed-off-by: Michal Simek commit 6162cd2b408fbef550e5cb3b3742a91368ee439b Author: Manish Narani Date: Fri Aug 16 03:09:58 2019 -0600 microblaze: defconfig: Disable EXT2 driver and Enable EXT3 & EXT4 drivers As EXT4 filesystem driver is used for handling EXT2 file systems as well. There is no need to enable EXT2 driver. This patch disables EXT2 and enables EXT3/EXT4 drivers. Signed-off-by: Manish Narani Signed-off-by: Michal Simek commit 18ffa34b73fc4acd73fb2cd0750f09ff8433fa88 Author: Oder Chiou Date: Mon Feb 3 02:28:21 2020 +0000 MAINTAINERS: Remove the Bard Liao from the MAINTAINERS of Realtek CODECs Remove the maintainer "Bard Liao" since he had quitted from Realtek. Signed-off-by: Oder Chiou Link: https://lore.kernel.org/r/3ae27357f98a406a958304386a1457bc@realtek.com Signed-off-by: Mark Brown commit a45ad71e8995eed2b95c6ef0f4c442da0c4f6677 Merge: 685097986b5e 600c39b34369 Author: Linus Torvalds Date: Tue Feb 4 09:06:24 2020 +0000 Merge tag 'rproc-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc Pull remoteproc updates from Bjorn Andersson: "This adds support for the Mediatek MT8183 SCP, modem remoteproc on Qualcomm SC7180 platform, audio and sensor remoteprocs on Qualcomm MSM8998 and audio, compute, modem and sensor remoteprocs on Qualcomm SM8150. It adds votes for necessary power-domains for all Qualcomm TrustZone based remoteproc instances are held, fixes a bug related to remoteproc drivers registering before the core has been initialized and does clean up the Qualcomm modem remoteproc driver" * tag 'rproc-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc: (21 commits) remoteproc: qcom: q6v5-mss: Improve readability of reset_assert remoteproc: qcom: q6v5-mss: Use regmap_read_poll_timeout remoteproc: qcom: q6v5-mss: Rename boot status timeout remoteproc: qcom: q6v5-mss: Improve readability across clk handling remoteproc: use struct_size() helper remoteproc: Initialize rproc_class before use rpmsg: add rpmsg support for mt8183 SCP. remoteproc/mediatek: add SCP support for mt8183 dt-bindings: Add a binding for Mediatek SCP remoteproc: mss: q6v5-mss: Add modem support on SC7180 dt-bindings: remoteproc: qcom: Add Q6V5 Modem PIL binding for SC7180 remoteproc: qcom: pas: Add MSM8998 ADSP and SLPI support dt-bindings: remoteproc: qcom: Add ADSP and SLPI support for MSM8998 SoC remoteproc: q6v5-mss: Remove mem clk from the active pool remoteproc: qcom: Remove unneeded semicolon remoteproc: qcom: pas: Add auto_boot flag remoteproc: qcom: pas: Add SM8150 ADSP, CDSP, Modem and SLPI support dt-bindings: remoteproc: qcom: SM8150 Add ADSP, CDSP, MPSS and SLPI support remoteproc: qcom: pas: Vote for active/proxy power domains dt-bindings: remoteproc: qcom: Add power-domain bindings for Q6V5 PAS ... commit 685097986b5ef8b8c4b19dbb6a1d6069c3626ba2 Merge: cc12071ff390 cb36017a8b1b Author: Linus Torvalds Date: Tue Feb 4 09:04:37 2020 +0000 Merge tag 'hwlock-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc Pull hwspinlock updates from Bjorn Andersson: "This continues the transition of drivers to device managed resources and removal of unnecessary PM runtime integration, with cleanups to the SIRF, OMAP and Qualcomm hwspinlock drivers. It also adds Baolin as reviewer in MAINTAINERS" * tag 'hwlock-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc: hwspinlock: sirf: Use devm_hwspin_lock_register() to register hwlock controller hwspinlock: sirf: Remove redundant PM runtime functions hwspinlock: sirf: Change to use devm_platform_ioremap_resource() hwspinlock: omap: Use devm_kzalloc() to allocate memory hwspinlock: omap: Change to use devm_platform_ioremap_resource() hwspinlock: qcom: Use devm_hwspin_lock_register() to register hwlock controller hwspinlock: qcom: Remove redundant PM runtime functions hwspinlock: stm32: convert to devm_platform_ioremap_resource MAINTAINERS: Add myself as reviewer for the hwspinlock subsystem commit 83b43045308ea0600099830292955f18818f8d5e Author: YueHaibing Date: Tue Feb 4 02:24:41 2020 +0000 qed: Remove set but not used variable 'p_link' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/ethernet/qlogic/qed/qed_cxt.c: In function 'qed_qm_init_pf': drivers/net/ethernet/qlogic/qed/qed_cxt.c:1401:29: warning: variable 'p_link' set but not used [-Wunused-but-set-variable] commit 92fae6fb231f ("qed: FW 8.42.2.0 Queue Manager changes") leave behind this unused variable. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 9afe2322cb90a8fbc27e32bfc691100c653cab2a Merge: 2b5b8251bc9f e9ed4fa7b440 Author: David S. Miller Date: Tue Feb 4 09:30:00 2020 +0100 Merge branch 'unbreak-basic-and-bpf-tdc-testcases' Davide Caratti says: ==================== unbreak 'basic' and 'bpf' tdc testcases - patch 1/2 fixes tdc failures with 'bpf' action on fresch clones of the kernel tree - patch 2/2 allow running tdc for the 'basic' classifier without tweaking tdc_config.py ==================== Signed-off-by: David S. Miller commit e9ed4fa7b4400d7b2cf03108842a30e6c9bd0eb2 Author: Davide Caratti Date: Mon Feb 3 16:29:30 2020 +0100 tc-testing: add missing 'nsPlugin' to basic.json since tdc tests for cls_basic need $DEV1, use 'nsPlugin' so that the following command can be run without errors: [root@f31 tc-testing]# ./tdc.py -c basic Fixes: 4717b05328ba ("tc-testing: Introduced tdc tests for basic filter") Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit 7145fcfffef1fad4266aaf5ca96727696916edb7 Author: Davide Caratti Date: Mon Feb 3 16:29:29 2020 +0100 tc-testing: fix eBPF tests failure on linux fresh clones when the following command is done on a fresh clone of the kernel tree, [root@f31 tc-testing]# ./tdc.py -c bpf test cases that need to build the eBPF sample program fail systematically, because 'buildebpfPlugin' is unable to install the kernel headers (i.e, the 'khdr' target fails). Pass the correct environment to 'make', in place of ENVIR, to allow running these tests. Fixes: 4c2d39bd40c1 ("tc-testing: use a plugin to build eBPF program") Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit 2b5b8251bc9fe2f9118411f037862ee17cf81e97 Author: Eric Dumazet Date: Mon Feb 3 10:15:07 2020 -0800 net: hsr: fix possible NULL deref in hsr_handle_frame() hsr_port_get_rcu() can return NULL, so we need to be careful. general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 1 PID: 10249 Comm: syz-executor.5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline] RIP: 0010:hsr_addr_is_self+0x86/0x330 net/hsr/hsr_framereg.c:44 Code: 04 00 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 6b ff 94 f9 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 75 02 00 00 48 8b 43 30 49 39 c6 49 89 47 c0 0f RSP: 0018:ffffc90000da8a90 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87e0cc33 RDX: 0000000000000006 RSI: ffffffff87e035d5 RDI: 0000000000000000 RBP: ffffc90000da8b20 R08: ffff88808e7de040 R09: ffffed1015d2707c R10: ffffed1015d2707b R11: ffff8880ae9383db R12: ffff8880a689bc5e R13: 1ffff920001b5153 R14: 0000000000000030 R15: ffffc90000da8af8 FS: 00007fd7a42be700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32338000 CR3: 00000000a928c000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: hsr_handle_frame+0x1c5/0x630 net/hsr/hsr_slave.c:31 __netif_receive_skb_core+0xfbc/0x30b0 net/core/dev.c:5099 __netif_receive_skb_one_core+0xa8/0x1a0 net/core/dev.c:5196 __netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5312 process_backlog+0x206/0x750 net/core/dev.c:6144 napi_poll net/core/dev.c:6582 [inline] net_rx_action+0x508/0x1120 net/core/dev.c:6650 __do_softirq+0x262/0x98c kernel/softirq.c:292 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082 Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit cc12071ff39060fc2e47c58b43e249fe0d0061ee Merge: 9717c1cea16e f3cc4e1d44a8 Author: Linus Torvalds Date: Tue Feb 4 07:24:48 2020 +0000 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: "The rest of MM and the rest of everything else: hotfixes, ipc, misc, procfs, lib, cleanups, arm" * emailed patches from Andrew Morton : (67 commits) ARM: dma-api: fix max_pfn off-by-one error in __dma_supported() treewide: remove redundant IS_ERR() before error code check include/linux/cpumask.h: don't calculate length of the input string lib: new testcases for bitmap_parse{_user} lib: rework bitmap_parse() lib: make bitmap_parse_user a wrapper on bitmap_parse lib: add test for bitmap_parse() bitops: more BITS_TO_* macros lib/string: add strnchrnul() proc: convert everything to "struct proc_ops" proc: decouple proc from VFS with "struct proc_ops" asm-generic/tlb: provide MMU_GATHER_TABLE_FREE asm-generic/tlb: rename HAVE_MMU_GATHER_NO_GATHER asm-generic/tlb: rename HAVE_MMU_GATHER_PAGE_SIZE asm-generic/tlb: rename HAVE_RCU_TABLE_FREE asm-generic/tlb: add missing CONFIG symbol asm-gemeric/tlb: remove stray function declarations asm-generic/tlb: avoid potential double flush mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case ... commit 9717c1cea16e3eae81ca226f4c3670bb799b61ad Merge: 79703e014ba0 b45f1b3b585e Author: Linus Torvalds Date: Tue Feb 4 07:21:04 2020 +0000 Merge tag 'drm-next-2020-02-04' of git://anongit.freedesktop.org/drm/drm Pull drm ttm/mm updates from Dave Airlie: "Thomas Hellstrom has some more changes to the TTM layer that needed a patch to the mm subsystem. This adds a new mm API vmf_insert_mixed_prot to avoid an ugly hack that has limitations in the TTM layer" * tag 'drm-next-2020-02-04' of git://anongit.freedesktop.org/drm/drm: mm, drm/ttm: Fix vm page protection handling mm: Add a vmf_insert_mixed_prot() function commit 79703e014ba02ad86af4bcdf0c16e4b208cca406 Merge: eadc4e40e688 034dbec179e5 Author: Linus Torvalds Date: Tue Feb 4 07:17:41 2020 +0000 Merge tag 'tag-chrome-platform-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Benson Leung: "CrOS EC: - Refactoring of some of cros_ec's headers: include/linux/mfd/cros_ec.h now removed, new cros_ec.h added to drivers/platform/chrome which contains shared operations of cros_ec transport drivers. - Response tracing in cros_ec_proto Wilco EC: - Fix unregistration order. - Fix keyboard backlight probing on systems without keyboard backlight - Minor cleanup (newlines in printks, COMPILE_TEST) Misc: - chromeos_laptop converted to use i2c_new_scanned_device instead of i2c_new_probed_device" * tag 'tag-chrome-platform-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec: Match implementation with headers platform/chrome: cros_ec: Drop unaligned.h include platform/chrome: wilco_ec: Allow wilco to be compiled in COMPILE_TEST platform/chrome: wilco_ec: Add newlines to printks platform/chrome: wilco_ec: Fix unregistration order cros_ec: treewide: Remove 'include/linux/mfd/cros_ec.h' platform/chrome: cros_ec_ishtp: Make init_lock static platform/chrome: chromeos_laptop: Convert to i2c_new_scanned_device platform/chrome: cros_ec_lpc: Use platform_get_irq_optional() for optional IRQs platform/chrome: cros_ec_proto: Add response tracing platform/chrome: cros_ec_trace: Match trace commands with EC commands commit 563528b831746792cb8a4ab50a757e648c626b3e Author: Douglas Anderson Date: Mon Feb 3 10:31:46 2020 -0800 clk: qcom: Use ARRAY_SIZE in videocc-sc7180 for parent clocks It's nicer to use ARRAY_SIZE instead of hardcoding. Had we always been doing this it would have prevented a previous bug. See commit 74c31ff9c84a ("clk: qcom: gpu_cc_gmu_clk_src has 5 parents, not 6"). Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.13.If37e4b1b5553ac9db5ea51e84a6eec286cdf209e@changeid Signed-off-by: Stephen Boyd commit abc8f93f33e75e22ab293648edbeb51157e9b6c9 Author: Douglas Anderson Date: Mon Feb 3 10:31:45 2020 -0800 clk: qcom: Get rid of the test clock for videocc-sc7180 The test clock isn't in the bindings and apparently it's not used by anyone upstream. Remove it. Suggested-by: Stephen Boyd Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.12.Ifd19a2701a102ec9f04e61a09345198383a9e937@changeid Signed-off-by: Stephen Boyd commit 8cff43d46cfcdeb11ee1b48ad86692785a351e0b Author: Douglas Anderson Date: Mon Feb 3 10:31:44 2020 -0800 dt-bindings: clock: Cleanup qcom,videocc bindings for sdm845/sc7180 This makes the qcom,videocc bindings match the recent changes to the dispcc and gpucc. 1. Switched to using "bi_tcxo" instead of "xo". 2. Adds a description for the XO clock. Not terribly important but nice if it cleanly matches its cousins. 3. Updates the example to use the symbolic name for the RPMH clock and also show that the real devices are currently using 2 address cells / size cells and fixes the spacing on the closing brace. 4. Split into 2 files. In this case they could probably share one file, but let's be consistent. Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.11.I27bbd90045f38cd3218c259526409d52a48efb35@changeid Signed-off-by: Stephen Boyd commit 72de7a19ef5b1aff90ab406a2238c72d4dcf6df4 Author: Douglas Anderson Date: Mon Feb 3 10:31:43 2020 -0800 clk: qcom: Use ARRAY_SIZE in gpucc-sc7180 for parent clocks It's nicer to use ARRAY_SIZE instead of hardcoding. Had we always been doing this it would have prevented a previous bug. See commit 74c31ff9c84a ("clk: qcom: gpu_cc_gmu_clk_src has 5 parents, not 6"). Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.10.I3bf44e33f4dc7ecca10a50dbccb7dc082894fa59@changeid Signed-off-by: Stephen Boyd commit 39c064a0e6052276e9c7a6dc4ab153059496e2ab Author: Douglas Anderson Date: Mon Feb 3 10:31:42 2020 -0800 clk: qcom: Get rid of the test clock for gpucc-sc7180 The test clock isn't in the bindings and apparently it's not used by anyone upstream. Remove it. Suggested-by: Stephen Boyd Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.9.I6d5276b768f6593053be036a3e70cce298d39f0c@changeid Signed-off-by: Stephen Boyd commit e6747e24f15d9d25bcc771154825c582e970bfa9 Author: Douglas Anderson Date: Mon Feb 3 10:31:40 2020 -0800 dt-bindings: clock: Fix qcom,gpucc bindings for sdm845/sc7180/msm8998 The qcom,gpucc bindings had a few problems with them: 1. When things were converted to yaml the name of the "gpll0 main" clock got changed from "gpll0" to "gpll0_main". Change it back for msm8998. 2. Apparently there is a push not to use purist aliases for clocks but instead to just use the internal Qualcomm names. For sdm845 and sc7180 (where the drivers haven't already been changed) move in this direction. Things were also getting complicated harder to deal with by jamming several SoCs into one file. Splitting simplifies things. Fixes: 5c6f3a36b913 ("dt-bindings: clock: Add YAML schemas for the QCOM GPUCC clock bindings") Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.7.I513cd73b16665065ae6c22cf594d8b543745e28c@changeid Signed-off-by: Stephen Boyd commit 3696ebe4e1fc45ea391412ff1a82cec9ae4f6e8f Author: Douglas Anderson Date: Mon Feb 3 10:31:39 2020 -0800 clk: qcom: Use ARRAY_SIZE in dispcc-sc7180 for parent clocks It's nicer to use ARRAY_SIZE instead of hardcoding. Had we always been doing this it would have prevented a previous bug. See commit 74c31ff9c84a ("clk: qcom: gpu_cc_gmu_clk_src has 5 parents, not 6"). Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.6.If590c468722d2985cea63adf60c0d2b3098f37d9@changeid Signed-off-by: Stephen Boyd commit c1ef343612cd51a8c97ca3004bffc6db33f639c6 Author: Douglas Anderson Date: Mon Feb 3 10:31:38 2020 -0800 clk: qcom: Get rid of the test clock for dispcc-sc7180 The test clock isn't in the bindings and apparently it's not used by anyone upstream. Remove it. Suggested-by: Stephen Boyd Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.5.I28ac8f801456f1b950f7da10ed0f74a1344d4a35@changeid Signed-off-by: Stephen Boyd commit 0a97e8a5bf0a79c9f82f6c22d9845f7c179ea758 Author: Douglas Anderson Date: Mon Feb 3 10:31:37 2020 -0800 clk: qcom: Get rid of fallback global names for dispcc-sc7180 In the new world input clocks should be matched by ".fw_name". sc7180 is new enough that no backward compatibility use of global names should be needed. Remove it. With a proper device tree and downstream display patches I have verified booting a sc7180 up and seeing the display after this patch. Fixes: dd3d06622138 ("clk: qcom: Add display clock controller driver for SC7180") Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.4.Ia3706a5d5add72e88dbff60fd13ec06bf7a2fd48@changeid Signed-off-by: Stephen Boyd commit 48cabc221f0d914db3ba1af0924cf4f53ebaced5 Author: Douglas Anderson Date: Mon Feb 3 10:31:35 2020 -0800 dt-bindings: clock: Fix qcom,dispcc bindings for sdm845/sc7180 The qcom,dispcc bindings had a few problems with them: 1. They didn't specify all the clocks that dispcc is a client of. Specifically on sc7180 there are two clocks from the DSI PHY and two from the DP PHY. On sdm845 there are actually two DSI PHYs (each of which has two clocks) and an extra clock from the gcc. These all need to be specified. 2. The sdm845.dtsi has existed for quite some time without specifying the clocks. The Linux driver was relying on global names to match things up. While we should transition things, it should be noted in the bindings. 3. The names used the bindings for "xo" and "gpll0" didn't match the names that QC used for these clocks internally and this was causing confusion / difficulty with their code generation tools. Switched to the internal names to simplify everyone's lives. It's not quite as clean in a purist sense but it should avoid headaches. This officially changes the binding, but that seems OK in this case. Also note that I updated the example. Fixes: 5d28e44ba630 ("dt-bindings: clock: Add YAML schemas for the QCOM DISPCC clock bindings") Signed-off-by: Douglas Anderson Link: https://lkml.kernel.org/r/20200203103049.v4.2.I0c4bbb0f75a0880cd4bd90d8b267271e2375e0d0@changeid Signed-off-by: Stephen Boyd commit 908b050114d8fefdddc57ec9fbc213c3690e7f5f Author: Douglas Anderson Date: Mon Feb 3 10:31:34 2020 -0800 clk: qcom: rcg2: Don't crash if our parent can't be found; return an error When I got my clock parenting slightly wrong I ended up with a crash that looked like this: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... pc : clk_hw_get_rate+0x14/0x44 ... Call trace: clk_hw_get_rate+0x14/0x44 _freq_tbl_determine_rate+0x94/0xfc clk_rcg2_determine_rate+0x2c/0x38 clk_core_determine_round_nolock+0x4c/0x88 clk_core_round_rate_nolock+0x6c/0xa8 clk_core_round_rate_nolock+0x9c/0xa8 clk_core_set_rate_nolock+0x70/0x180 clk_set_rate+0x3c/0x6c of_clk_set_defaults+0x254/0x360 platform_drv_probe+0x28/0xb0 really_probe+0x120/0x2dc driver_probe_device+0x64/0xfc device_driver_attach+0x4c/0x6c __driver_attach+0xac/0xc0 bus_for_each_dev+0x84/0xcc driver_attach+0x2c/0x38 bus_add_driver+0xfc/0x1d0 driver_register+0x64/0xf8 __platform_driver_register+0x4c/0x58 msm_drm_register+0x5c/0x60 ... It turned out that clk_hw_get_parent_by_index() was returning NULL and we weren't checking. Let's check it so that we don't crash. Fixes: ac269395cdd8 ("clk: qcom: Convert to clk_hw based provider APIs") Signed-off-by: Douglas Anderson Reviewed-by: Matthias Kaehlcke Link: https://lkml.kernel.org/r/20200203103049.v4.1.I7487325fe8e701a68a07d3be8a6a4b571eca9cfa@changeid Signed-off-by: Stephen Boyd commit 73cb3106e883ac03cc4f15b20d525e6bde650526 Author: Colin Ian King Date: Mon Feb 3 22:37:36 2020 +0000 clk: ls1028a: fix a dereference of pointer 'parent' before a null check Currently the pointer 'parent' is being dereferenced before it is being null checked. Fix this by performing the null check before it is dereferenced. Addresses-Coverity: ("Dereference before null check") Fixes: d37010a3c162 ("clk: ls1028a: Add clock driver for Display output interface") Signed-off-by: Colin Ian King Link: https://lkml.kernel.org/r/20200203223736.99645-1-colin.king@canonical.com Signed-off-by: Stephen Boyd commit eadc4e40e68832fc61ae5e3ef2ef5cfcd9308b2c Merge: 322bf2d3446a f45719240700 Author: Linus Torvalds Date: Tue Feb 4 07:03:40 2020 +0000 Merge tag 'rtc-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "The VL_READ and VL_CLR ioctls have been reworked to be more useful. This will not break userspace as there are very few users and they are using the integer value as a boolean. Apart from that, two drivers were reworked and a few fixes here and there for a net reduction of number of lines. Summary: Subsystem: - the VL_READ and VL_CLR ioctls are now documented and their behavior is unified across all the drivers. - RTC_I2C_AND_SPI Kconfig option rework to avoid selecting both REGMAP_I2C and REGMAP_SPI unecessarily. Drivers: - at91rm9200: remove deprecated procfs, add sam9x60, sama5d4 and sama5d2 compatibles. - cmos: solve lost interrupts issue on MS Surface 3 - hym8563: return proper errno when time is invalid - rv3029: many fixes, nvram support" * tag 'rtc-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (63 commits) dt-bindings: rtc: at91rm9200: document clocks property rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed rtc: Kconfig: select REGMAP_I2C when necessary rtc: Kconfig: properly indent sd3078 entry rtc: cmos: Refactor code by using the new dmi_get_bios_year() helper rtc: cmos: Use predefined value for RTC IRQ on legacy x86 rtc: cmos: Stop using shared IRQ rtc: tps6586x: Use IRQ_NOAUTOEN flag rtc: at91rm9200: use FIELD_PREP/FIELD_GET rtc: at91rm9200: avoid time readout in at91_rtc_setalarm rtc: at91rm9200: move register definitions to C file rtc: at91rm9200: add sama5d4 and sama5d2 compatibles dt-bindings: rtc: at91rm9200: convert bindings to json-schema rtc: at91rm9200: remove procfs information dt-bindings: atmel, at91rm9200-rtc: add microchip, sam9x60-rtc rtc: pcf8563: Use BIT rtc: moxart: Convert to SPDX identifier rtc: ds1343: Remove unused struct spi_device in struct ds1343_priv rtc: rx8025: Remove struct i2c_client from struct rx8025_data rtc: hym8563: Read the valid flag directly instead of caching it ... commit f3cc4e1d44a813a0685f2e558b78ace3db559722 Author: Chen-Yu Tsai Date: Mon Feb 3 17:37:48 2020 -0800 ARM: dma-api: fix max_pfn off-by-one error in __dma_supported() max_pfn, as set in arch/arm/mm/init.c: static void __init find_limits(unsigned long *min, unsigned long *max_low, unsigned long *max_high) { *max_low = PFN_DOWN(memblock_get_current_limit()); *min = PFN_UP(memblock_start_of_DRAM()); *max_high = PFN_DOWN(memblock_end_of_DRAM()); } with memblock_end_of_DRAM() pointing to the next byte after DRAM. As such, max_pfn points to the PFN after the end of DRAM. Thus when using max_pfn to check DMA masks, we should subtract one when checking DMA ranges against it. Commit 8bf1268f48ad ("ARM: dma-api: fix off-by-one error in __dma_supported()") fixed the same issue, but missed this spot. This issue was found while working on the sun4i-csi v4l2 driver on the Allwinner R40 SoC. On Allwinner SoCs, DRAM is offset at 0x40000000, and we are starting to use of_dma_configure() with the "dma-ranges" property in the device tree to have the DMA API handle the offset. In this particular instance, dma-ranges was set to the same range as the actual available (2 GiB) DRAM. The following error appeared when the driver attempted to allocate a buffer: sun4i-csi 1c09000.csi: Coherent DMA mask 0x7fffffff (pfn 0x40000-0xc0000) covers a smaller range of system memory than the DMA zone pfn 0x0-0xc0001 sun4i-csi 1c09000.csi: dma_alloc_coherent of size 307200 failed Fixing the off-by-one error makes things work. Link: http://lkml.kernel.org/r/20191224030239.5656-1-wens@kernel.org Fixes: 11a5aa32562e ("ARM: dma-mapping: check DMA mask against available memory") Fixes: 9f28cde0bc64 ("ARM: another fix for the DMA mapping checks") Fixes: ab746573c405 ("ARM: dma-mapping: allow larger DMA mask than supported") Signed-off-by: Chen-Yu Tsai Reviewed-by: Christoph Hellwig Cc: Russell King Cc: Robin Murphy Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 45586c7078d42b932c5399953d21746800083691 Author: Masahiro Yamada Date: Mon Feb 3 17:37:45 2020 -0800 treewide: remove redundant IS_ERR() before error code check 'PTR_ERR(p) == -E*' is a stronger condition than IS_ERR(p). Hence, IS_ERR(p) is unneeded. The semantic patch that generates this commit is as follows: // @@ expression ptr; constant error_code; @@ -IS_ERR(ptr) && (PTR_ERR(ptr) == - error_code) +PTR_ERR(ptr) == - error_code // Link: http://lkml.kernel.org/r/20200106045833.1725-1-masahiroy@kernel.org Signed-off-by: Masahiro Yamada Cc: Julia Lawall Acked-by: Stephen Boyd [drivers/clk/clk.c] Acked-by: Bartosz Golaszewski [GPIO] Acked-by: Wolfram Sang [drivers/i2c] Acked-by: Rafael J. Wysocki [acpi/scan.c] Acked-by: Rob Herring Cc: Eric Biggers Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 190535f7cf50f2d6d6e603715201c58cd6ec696b Author: Yury Norov Date: Mon Feb 3 17:37:41 2020 -0800 include/linux/cpumask.h: don't calculate length of the input string New design of inner bitmap_parse() allows to avoid calculating the size of a null-terminated string. Link: http://lkml.kernel.org/r/20200102043031.30357-8-yury.norov@gmail.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Cc: Amritha Nambiar Cc: Arnaldo Carvalho de Melo Cc: Chris Wilson Cc: Kees Cook Cc: Matthew Wilcox Cc: Miklos Szeredi Cc: Rasmus Villemoes Cc: Steffen Klassert Cc: "Tobin C . Harding" Cc: Vineet Gupta Cc: Will Deacon Cc: Willem de Bruijn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 809e308f7f854933a792e4a14c4571320cd11f7e Author: Yury Norov Date: Mon Feb 3 17:37:38 2020 -0800 lib: new testcases for bitmap_parse{_user} New version of bitmap_parse() is unified with bitmap_parse_list(), and therefore: - weakens rules on whitespaces and commas between hex chunks; - in addition to - allows passing UINT_MAX or any other big number as the length of input string instead of actual string length. The patch covers the cases. Link: http://lkml.kernel.org/r/20200102043031.30357-7-yury.norov@gmail.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Cc: Amritha Nambiar Cc: Arnaldo Carvalho de Melo Cc: Chris Wilson Cc: Kees Cook Cc: Matthew Wilcox Cc: Miklos Szeredi Cc: Rasmus Villemoes Cc: Steffen Klassert Cc: "Tobin C . Harding" Cc: Vineet Gupta Cc: Will Deacon Cc: Willem de Bruijn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2d6261583be005a91e4933aa53bbd678ef98e4c4 Author: Yury Norov Date: Mon Feb 3 17:37:34 2020 -0800 lib: rework bitmap_parse() bitmap_parse() is ineffective and full of opaque variables and opencoded parts. It leads to hard understanding and usage of it. This rework includes: - remove bitmap_shift_left() call from the cycle. Now it makes the complexity of the algorithm as O(nbits^2). In the suggested approach the input string is parsed in reverse direction, so no shifts needed; - relax requirement on a single comma and no white spaces between chunks. It is considered useful in scripting, and it aligns with bitmap_parselist(); - split bitmap_parse() to small readable helpers; - make an explicit calculation of the end of input line at the beginning, so users of the bitmap_parse() won't bother doing this. Link: http://lkml.kernel.org/r/20200102043031.30357-6-yury.norov@gmail.com Signed-off-by: Yury Norov Cc: Amritha Nambiar Cc: Andy Shevchenko Cc: Arnaldo Carvalho de Melo Cc: Chris Wilson Cc: Kees Cook Cc: Matthew Wilcox Cc: Miklos Szeredi Cc: Rasmus Villemoes Cc: Steffen Klassert Cc: "Tobin C . Harding" Cc: Vineet Gupta Cc: Will Deacon Cc: Willem de Bruijn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e66eda0615c8767694150b3c595f3e9cf9ac4294 Author: Yury Norov Date: Mon Feb 3 17:37:31 2020 -0800 lib: make bitmap_parse_user a wrapper on bitmap_parse Currently we parse user data byte after byte which leads to overcomplicating of parsing algorithm. There are no performance critical users of bitmap_parse_user(), and so we can duplicate user data to kernel buffer and simply call bitmap_parselist(). This rework lets us unify and simplify bitmap_parse() and bitmap_parse_user(), which is done in the following patch. Link: http://lkml.kernel.org/r/20200102043031.30357-5-yury.norov@gmail.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Cc: Amritha Nambiar Cc: Arnaldo Carvalho de Melo Cc: Chris Wilson Cc: Kees Cook Cc: Matthew Wilcox Cc: Miklos Szeredi Cc: Rasmus Villemoes Cc: Steffen Klassert Cc: "Tobin C . Harding" Cc: Vineet Gupta Cc: Will Deacon Cc: Willem de Bruijn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7eb2e94e969435519cfd8e07dc654508b3a42d81 Author: Yury Norov Date: Mon Feb 3 17:37:27 2020 -0800 lib: add test for bitmap_parse() The test is derived from bitmap_parselist() NO_LEN is reserved for use in following patches. [yury.norov@gmail.com: fix rebase issue] Link: http://lkml.kernel.org/r/20200102182659.6685-1-yury.norov@gmail.com [andriy.shevchenko@linux.intel.com: fix address space when test user buffer] Link: http://lkml.kernel.org/r/20200109103601.45929-2-andriy.shevchenko@linux.intel.com Link: http://lkml.kernel.org/r/20200102043031.30357-4-yury.norov@gmail.com Signed-off-by: Yury Norov Signed-off-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Cc: Amritha Nambiar Cc: Arnaldo Carvalho de Melo Cc: Chris Wilson Cc: Kees Cook Cc: Matthew Wilcox Cc: Miklos Szeredi Cc: Rasmus Villemoes Cc: Steffen Klassert Cc: "Tobin C . Harding" Cc: Vineet Gupta Cc: Will Deacon Cc: Willem de Bruijn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0bddc1bd05d6973fee9303005abab6567f743ea7 Author: Yury Norov Date: Mon Feb 3 17:37:24 2020 -0800 bitops: more BITS_TO_* macros Introduce BITS_TO_U64, BITS_TO_U32 and BITS_TO_BYTES as they are handy in the following patches (BITS_TO_U32 specifically). Reimplement tools/ version of the macros according to the kernel implementation. Also fix indentation for BITS_PER_TYPE definition. Link: http://lkml.kernel.org/r/20200102043031.30357-3-yury.norov@gmail.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Cc: Amritha Nambiar Cc: Arnaldo Carvalho de Melo Cc: Chris Wilson Cc: Kees Cook Cc: Matthew Wilcox Cc: Miklos Szeredi Cc: Rasmus Villemoes Cc: Steffen Klassert Cc: "Tobin C . Harding" Cc: Vineet Gupta Cc: Will Deacon Cc: Willem de Bruijn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0bee0cece2a6a71ccc347fdc1d46cf638cd5fd1c Author: Yury Norov Date: Mon Feb 3 17:37:20 2020 -0800 lib/string: add strnchrnul() Patch series "lib: rework bitmap_parse", v5. Similarl to the recently revisited bitmap_parselist(), bitmap_parse() is ineffective and overcomplicated. This series reworks it, aligns its interface with bitmap_parselist() and makes it simpler to use. The series also adds a test for the function and fixes usage of it in cpumask_parse() according to the new design - drops the calculating of length of an input string. bitmap_parse() takes the array of numbers to be put into the map in the BE order which is reversed to the natural LE order for bitmaps. For example, to construct bitmap containing a bit on the position 42, we have to put a line '400,0'. Current implementation reads chunk one by one from the beginning ('400' before '0') and makes bitmap shift after each successful parse. It makes the complexity of the whole process as O(n^2). We can do it in reverse direction ('0' before '400') and avoid shifting, but it requires reverse parsing helpers. This patch (of 7): New function works like strchrnul() with a length limited string. Link: http://lkml.kernel.org/r/20200102043031.30357-2-yury.norov@gmail.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Cc: Rasmus Villemoes Cc: Amritha Nambiar Cc: Willem de Bruijn Cc: Kees Cook Cc: Matthew Wilcox Cc: "Tobin C . Harding" Cc: Will Deacon Cc: Miklos Szeredi Cc: Vineet Gupta Cc: Chris Wilson Cc: Arnaldo Carvalho de Melo Cc: Steffen Klassert Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 97a32539b9568bb653683349e5a76d02ff3c3e2c Author: Alexey Dobriyan Date: Mon Feb 3 17:37:17 2020 -0800 proc: convert everything to "struct proc_ops" The most notable change is DEFINE_SHOW_ATTRIBUTE macro split in seq_file.h. Conversion rule is: llseek => proc_lseek unlocked_ioctl => proc_ioctl xxx => proc_xxx delete ".owner = THIS_MODULE" line [akpm@linux-foundation.org: fix drivers/isdn/capi/kcapi_proc.c] [sfr@canb.auug.org.au: fix kernel/sched/psi.c] Link: http://lkml.kernel.org/r/20200122180545.36222f50@canb.auug.org.au Link: http://lkml.kernel.org/r/20191225172546.GB13378@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d56c0d45f0e27f814e87a1676b6bdccccbc252e9 Author: Alexey Dobriyan Date: Mon Feb 3 17:37:14 2020 -0800 proc: decouple proc from VFS with "struct proc_ops" Currently core /proc code uses "struct file_operations" for custom hooks, however, VFS doesn't directly call them. Every time VFS expands file_operations hook set, /proc code bloats for no reason. Introduce "struct proc_ops" which contains only those hooks which /proc allows to call into (open, release, read, write, ioctl, mmap, poll). It doesn't contain module pointer as well. Save ~184 bytes per usage: add/remove: 26/26 grow/shrink: 1/4 up/down: 1922/-6674 (-4752) Function old new delta sysvipc_proc_ops - 72 +72 ... config_gz_proc_ops - 72 +72 proc_get_inode 289 339 +50 proc_reg_get_unmapped_area 110 107 -3 close_pdeo 227 224 -3 proc_reg_open 289 284 -5 proc_create_data 60 53 -7 rt_cpu_seq_fops 256 - -256 ... default_affinity_proc_fops 256 - -256 Total: Before=5430095, After=5425343, chg -0.09% Link: http://lkml.kernel.org/r/20191225172228.GA13378@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0d6e24d430ef23280d8dea0ba1faeefc66c26a57 Author: Peter Zijlstra Date: Mon Feb 3 17:37:11 2020 -0800 asm-generic/tlb: provide MMU_GATHER_TABLE_FREE As described in the comment, the correct order for freeing pages is: 1) unhook page 2) TLB invalidate page 3) free page This order equally applies to page directories. Currently there are two correct options: - use tlb_remove_page(), when all page directores are full pages and there are no futher contraints placed by things like software walkers (HAVE_FAST_GUP). - use MMU_GATHER_RCU_TABLE_FREE and tlb_remove_table() when the architecture does not do IPI based TLB invalidate and has HAVE_FAST_GUP (or software TLB fill). This however leaves architectures that don't have page based directories but don't need RCU in a bind. For those, provide MMU_GATHER_TABLE_FREE, which provides the independent batching for directories without the additional RCU freeing. Link: http://lkml.kernel.org/r/20200116064531.483522-10-aneesh.kumar@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 580a586c409ab3040b7284a19cd9e281692c40c7 Author: Peter Zijlstra Date: Mon Feb 3 17:37:08 2020 -0800 asm-generic/tlb: rename HAVE_MMU_GATHER_NO_GATHER Towards a more consistent naming scheme. Link: http://lkml.kernel.org/r/20200116064531.483522-9-aneesh.kumar@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3af4bd033759c4dab4f0ff594f0aa1e8d182b9d7 Author: Peter Zijlstra Date: Mon Feb 3 17:37:05 2020 -0800 asm-generic/tlb: rename HAVE_MMU_GATHER_PAGE_SIZE Towards a more consistent naming scheme. Link: http://lkml.kernel.org/r/20200116064531.483522-8-aneesh.kumar@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ff2e6d7259f82ccc9a5aaa7f41194161d9262392 Author: Peter Zijlstra Date: Mon Feb 3 17:37:02 2020 -0800 asm-generic/tlb: rename HAVE_RCU_TABLE_FREE Towards a more consistent naming scheme. [akpm@linux-foundation.org: fix sparc64 Kconfig] Link: http://lkml.kernel.org/r/20200116064531.483522-7-aneesh.kumar@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 27796d03c9c4b2b937ed4cc2b10f21559ad5a8c9 Author: Peter Zijlstra Date: Mon Feb 3 17:36:59 2020 -0800 asm-generic/tlb: add missing CONFIG symbol Without this the symbol will not actually end up in .config files. Link: http://lkml.kernel.org/r/20200116064531.483522-6-aneesh.kumar@linux.ibm.com Fixes: a30e32bd79e9 ("asm-generic/tlb: Provide generic tlb_flush() based on flush_tlb_mm()") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 491a49ff14b2475ad84c97b93c0182ae6daf8b37 Author: Peter Zijlstra Date: Mon Feb 3 17:36:56 2020 -0800 asm-gemeric/tlb: remove stray function declarations We removed the actual functions a while ago. Link: http://lkml.kernel.org/r/20200116064531.483522-5-aneesh.kumar@linux.ibm.com Fixes: 1808d65b55e4 ("asm-generic/tlb: Remove arch_tlb*_mmu()") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0758cd8304942292e95a0f750c374533db378b32 Author: Peter Zijlstra Date: Mon Feb 3 17:36:53 2020 -0800 asm-generic/tlb: avoid potential double flush Aneesh reported that: tlb_flush_mmu() tlb_flush_mmu_tlbonly() tlb_flush() <-- #1 tlb_flush_mmu_free() tlb_table_flush() tlb_table_invalidate() tlb_flush_mmu_tlbonly() tlb_flush() <-- #2 does two TLBIs when tlb->fullmm, because __tlb_reset_range() will not clear tlb->end in that case. Observe that any caller to __tlb_adjust_range() also sets at least one of the tlb->freed_tables || tlb->cleared_p* bits, and those are unconditionally cleared by __tlb_reset_range(). Change the condition for actually issuing TLBI to having one of those bits set, as opposed to having tlb->end != 0. Link: http://lkml.kernel.org/r/20200116064531.483522-4-aneesh.kumar@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Aneesh Kumar K.V Reported-by: "Aneesh Kumar K.V" Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ed1325967ab5f7a4549a2641c6ebe115f76e228 Author: Peter Zijlstra Date: Mon Feb 3 17:36:49 2020 -0800 mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush Architectures for which we have hardware walkers of Linux page table should flush TLB on mmu gather batch allocation failures and batch flush. Some architectures like POWER supports multiple translation modes (hash and radix) and in the case of POWER only radix translation mode needs the above TLBI. This is because for hash translation mode kernel wants to avoid this extra flush since there are no hardware walkers of linux page table. With radix translation, the hardware also walks linux page table and with that, kernel needs to make sure to TLB invalidate page walk cache before page table pages are freed. More details in commit d86564a2f085 ("mm/tlb, x86/mm: Support invalidating TLB caches for RCU_TABLE_FREE") The changes to sparc are to make sure we keep the old behavior since we are now removing HAVE_RCU_TABLE_NO_INVALIDATE. The default value for tlb_needs_table_invalidate is to always force an invalidate and sparc can avoid the table invalidate. Hence we define tlb_needs_table_invalidate to false for sparc architecture. Link: http://lkml.kernel.org/r/20200116064531.483522-3-aneesh.kumar@linux.ibm.com Fixes: a46cc7a90fd8 ("powerpc/mm/radix: Improve TLB/PWC flushes") Signed-off-by: Peter Zijlstra (Intel) Acked-by: Michael Ellerman [powerpc] Cc: [4.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12e4d53f3f04e81f9e83d6fc10edc7314ab9f6b9 Author: Aneesh Kumar K.V Date: Mon Feb 3 17:36:46 2020 -0800 powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case Patch series "Fixup page directory freeing", v4. This is a repost of patch series from Peter with the arch specific changes except ppc64 dropped. ppc64 changes are added here because we are redoing the patch series on top of ppc64 changes. This makes it easy to backport these changes. Only the first 2 patches need to be backported to stable. The thing is, on anything SMP, freeing page directories should observe the exact same order as normal page freeing: 1) unhook page/directory 2) TLB invalidate 3) free page/directory Without this, any concurrent page-table walk could end up with a Use-after-Free. This is esp. trivial for anything that has software page-table walkers (HAVE_FAST_GUP / software TLB fill) or the hardware caches partial page-walks (ie. caches page directories). Even on UP this might give issues since mmu_gather is preemptible these days. An interrupt or preempted task accessing user pages might stumble into the free page if the hardware caches page directories. This patch series fixes ppc64 and add generic MMU_GATHER changes to support the conversion of other architectures. I haven't added patches w.r.t other architecture because they are yet to be acked. This patch (of 9): A followup patch is going to make sure we correctly invalidate page walk cache before we free page table pages. In order to keep things simple enable RCU_TABLE_FREE even for !SMP so that we don't have to fixup the !SMP case differently in the followup patch !SMP case is right now broken for radix translation w.r.t page walk cache flush. We can get interrupted in between page table free and that would imply we have page walk cache entries pointing to tables which got freed already. Michael said "both our platforms that run on Power9 force SMP on in Kconfig, so the !SMP case is unlikely to be a problem for anyone in practice, unless they've hacked their kernel to build it !SMP." Link: http://lkml.kernel.org/r/20200116064531.483522-2-aneesh.kumar@linux.ibm.com Signed-off-by: Aneesh Kumar K.V Acked-by: Peter Zijlstra (Intel) Acked-by: Michael Ellerman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e47690d756a760579141560ded06ec1020dd85e8 Author: Steven Price Date: Mon Feb 3 17:36:42 2020 -0800 x86: mm: avoid allocating struct mm_struct on the stack struct mm_struct is quite large (~1664 bytes) and so allocating on the stack may cause problems as the kernel stack size is small. Since ptdump_walk_pgd_level_core() was only allocating the structure so that it could modify the pgd argument we can instead introduce a pgd override in struct mm_walk and pass this down the call stack to where it is needed. Since the correct mm_struct is now being passed down, it is now also unnecessary to take the mmap_sem semaphore because ptdump_walk_pgd() will now take the semaphore on the real mm. [steven.price@arm.com: restore missed arm64 changes] Link: http://lkml.kernel.org/r/20200108145710.34314-1-steven.price@arm.com Link: http://lkml.kernel.org/r/20200108145710.34314-1-steven.price@arm.com Signed-off-by: Steven Price Reported-by: Stephen Rothwell Cc: Catalin Marinas Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f8f0d0b6fa203bfa363d30f34f6fecce9e5cc2f7 Author: Steven Price Date: Mon Feb 3 17:36:38 2020 -0800 mm: ptdump: reduce level numbers by 1 in note_page() Rather than having to increment the 'depth' number by 1 in ptdump_hole(), let's change the meaning of 'level' in note_page() since that makes the code simplier. Note that for x86, the level numbers were previously increased by 1 in commit 45dcd2091363 ("x86/mm/dump_pagetables: Fix printout of p4d level") and the comment "Bit 7 has a different meaning" was not updated, so this change also makes the code match the comment again. Link: http://lkml.kernel.org/r/20191218162402.45610-24-steven.price@arm.com Signed-off-by: Steven Price Reviewed-by: Catalin Marinas Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9c7869c7f1720855f90e5bf15539939738d18cb9 Author: Steven Price Date: Mon Feb 3 17:36:34 2020 -0800 arm64: mm: display non-present entries in ptdump Previously the /sys/kernel/debug/kernel_page_tables file would only show lines for entries present in the page tables. However it is useful to also show non-present entries as this makes the size and level of the holes more visible. This aligns the behaviour with x86 which also shows holes. Link: http://lkml.kernel.org/r/20191218162402.45610-23-steven.price@arm.com Signed-off-by: Steven Price Acked-by: Catalin Marinas Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 102f45fdbe420f7d31182a69f4b11e8a6ae998da Author: Steven Price Date: Mon Feb 3 17:36:29 2020 -0800 arm64: mm: convert mm/dump.c to use walk_page_range() Now walk_page_range() can walk kernel page tables, we can switch the arm64 ptdump code over to using it, simplifying the code. Link: http://lkml.kernel.org/r/20191218162402.45610-22-steven.price@arm.com Signed-off-by: Steven Price Reviewed-by: Catalin Marinas Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2ae27137b2db89365f623a7694786cf6d1acb6c7 Author: Steven Price Date: Mon Feb 3 17:36:24 2020 -0800 x86: mm: convert dump_pagetables to use walk_page_range Make use of the new functionality in walk_page_range to remove the arch page walking code and use the generic code to walk the page tables. The effective permissions are passed down the chain using new fields in struct pg_state. The KASAN optimisation is implemented by setting action=CONTINUE in the callbacks to skip an entire tree of entries. Link: http://lkml.kernel.org/r/20191218162402.45610-21-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30d621f6723b1c98a142861f7a52849d286bc7fa Author: Steven Price Date: Mon Feb 3 17:36:20 2020 -0800 mm: add generic ptdump Add a generic version of page table dumping that architectures can opt-in to. Link: http://lkml.kernel.org/r/20191218162402.45610-20-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c5cfae12fdd50809b16482c13a94fa6cf1e45b31 Author: Steven Price Date: Mon Feb 3 17:36:16 2020 -0800 x86: mm: convert ptdump_walk_pgd_level_debugfs() to take an mm_struct To enable x86 to use the generic walk_page_range() function, the callers of ptdump_walk_pgd_level_debugfs() need to pass in the mm_struct. This means that ptdump_walk_pgd_level_core() is now always passed a valid pgd, so drop the support for pgd==NULL. Link: http://lkml.kernel.org/r/20191218162402.45610-19-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e455248d5ee9c8a12469d21cfa92c8432be4a4fd Author: Steven Price Date: Mon Feb 3 17:36:11 2020 -0800 x86: mm+efi: convert ptdump_walk_pgd_level() to take a mm_struct To enable x86 to use the generic walk_page_range() function, the callers of ptdump_walk_pgd_level() need to pass an mm_struct rather than the raw pgd_t pointer. Luckily since commit 7e904a91bf60 ("efi: Use efi_mm in x86 as well as ARM") we now have an mm_struct for EFI on x86. Link: http://lkml.kernel.org/r/20191218162402.45610-18-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74d2aaa16f15254373ae53189c38eedc20a2df8e Author: Steven Price Date: Mon Feb 3 17:36:07 2020 -0800 x86: mm: point to struct seq_file from struct pg_state mm/dump_pagetables.c passes both struct seq_file and struct pg_state down the chain of walk_*_level() functions to be passed to note_page(). Instead place the struct seq_file in struct pg_state and access it from struct pg_state (which is private to this file) in note_page(). Link: http://lkml.kernel.org/r/20191218162402.45610-17-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b7a16c7ad790d0ecb44dcb08a6a75d0d0455ab5f Author: Steven Price Date: Mon Feb 3 17:36:03 2020 -0800 mm: pagewalk: add 'depth' parameter to pte_hole The pte_hole() callback is called at multiple levels of the page tables. Code dumping the kernel page tables needs to know what at what depth the missing entry is. Add this is an extra parameter to pte_hole(). When the depth isn't know (e.g. processing a vma) then -1 is passed. The depth that is reported is the actual level where the entry is missing (ignoring any folding that is in place), i.e. any levels where PTRS_PER_P?D is set to 1 are ignored. Note that depth starts at 0 for a PGD so that PUD/PMD/PTE retain their natural numbers as levels 2/3/4. Link: http://lkml.kernel.org/r/20191218162402.45610-16-steven.price@arm.com Signed-off-by: Steven Price Tested-by: Zong Li Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c02a98753e0a36ba65a05818626fa6adeb4e7c97 Author: Steven Price Date: Mon Feb 3 17:35:58 2020 -0800 mm: pagewalk: fix termination condition in walk_pte_range() If walk_pte_range() is called with a 'end' argument that is beyond the last page of memory (e.g. ~0UL) then the comparison between 'addr' and 'end' will always fail and the loop will be infinite. Instead change the comparison to >= while accounting for overflow. Link: http://lkml.kernel.org/r/20191218162402.45610-15-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fbf56346b855872db45af7c1274180f9d91f46cd Author: Steven Price Date: Mon Feb 3 17:35:54 2020 -0800 mm: pagewalk: don't lock PTEs for walk_page_range_novma() walk_page_range_novma() can be used to walk page tables or the kernel or for firmware. These page tables may contain entries that are not backed by a struct page and so it isn't (in general) possible to take the PTE lock for the pte_entry() callback. So update walk_pte_range() to only take the lock when no_vma==false by splitting out the inner loop to a separate function and add a comment explaining the difference to walk_page_range_novma(). Link: http://lkml.kernel.org/r/20191218162402.45610-14-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 488ae6a2b933cb538b5d91b1c0a3420188d28771 Author: Steven Price Date: Mon Feb 3 17:35:50 2020 -0800 mm: pagewalk: allow walking without vma Since 48684a65b4e3: "mm: pagewalk: fix misbehavior of walk_page_range for vma(VM_PFNMAP)", page_table_walk() will report any kernel area as a hole, because it lacks a vma. This means each arch has re-implemented page table walking when needed, for example in the per-arch ptdump walker. Remove the requirement to have a vma in the generic code and add a new function walk_page_range_novma() which ignores the VMAs and simply walks the page tables. Link: http://lkml.kernel.org/r/20191218162402.45610-13-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3afc423632a194d7d6afef34e4bb98f804cd071d Author: Steven Price Date: Mon Feb 3 17:35:45 2020 -0800 mm: pagewalk: add p4d_entry() and pgd_entry() pgd_entry() and pud_entry() were removed by commit 0b1fbfe50006c410 ("mm/pagewalk: remove pgd_entry() and pud_entry()") because there were no users. We're about to add users so reintroduce them, along with p4d_entry() as we now have 5 levels of tables. Note that commit a00cc7d9dd93d66a ("mm, x86: add support for PUD-sized transparent hugepages") already re-added pud_entry() but with different semantics to the other callbacks. This commit reverts the semantics back to match the other callbacks. To support hmm.c which now uses the new semantics of pud_entry() a new member ('action') of struct mm_walk is added which allows the callbacks to either descend (ACTION_SUBTREE, the default), skip (ACTION_CONTINUE) or repeat the callback (ACTION_AGAIN). hmm.c is then updated to call pud_trans_huge_lock() itself and make use of the splitting/retry logic of the core code. After this change pud_entry() is called for all entries, not just transparent huge pages. [arnd@arndb.de: fix unused variable warning] Link: http://lkml.kernel.org/r/20200107204607.1533842-1-arnd@arndb.de Link: http://lkml.kernel.org/r/20191218162402.45610-12-steven.price@arm.com Signed-off-by: Steven Price Signed-off-by: Arnd Bergmann Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 757b2a4ab560b84d1859cfdfb9c7489af4ef5fd6 Author: Steven Price Date: Mon Feb 3 17:35:41 2020 -0800 x86: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. For x86 we already have p?d_large() functions, so simply add macros to provide the generic p?d_leaf() names for the generic code. Link: http://lkml.kernel.org/r/20191218162402.45610-11-steven.price@arm.com Signed-off-by: Steven Price Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8094249358d6d79fdf9ac6f990d5fa3f56bfabaa Author: Steven Price Date: Mon Feb 3 17:35:36 2020 -0800 sparc: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. For sparc 64 bit, pmd_large() and pud_large() are already provided, so add macros to provide the p?d_leaf names required by the generic code. Link: http://lkml.kernel.org/r/20191218162402.45610-10-steven.price@arm.com Signed-off-by: Steven Price Acked-by: David S. Miller Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8d2109f2998288c6cca1be9402442170ac5eb61e Author: Steven Price Date: Mon Feb 3 17:35:32 2020 -0800 s390: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. For s390, pud_large() and pmd_large() are already implemented as static inline functions. Add a macro to provide the p?d_leaf names for the generic code to use. Link: http://lkml.kernel.org/r/20191218162402.45610-9-steven.price@arm.com Signed-off-by: Steven Price Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Dave Hansen Cc: David S. Miller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit af6513ead0462ce64dde48386d42098da682b882 Author: Steven Price Date: Mon Feb 3 17:35:28 2020 -0800 riscv: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. For riscv a page is a leaf page when it has a read, write or execute bit set on it. Link: http://lkml.kernel.org/r/20191218162402.45610-8-steven.price@arm.com Signed-off-by: Steven Price Reviewed-by: Alexandre Ghiti Reviewed-by: Zong Li Acked-by: Paul Walmsley [arch/riscv] Cc: Albert Ou Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 070434b13b6ef3d41fa5ebe25d73aa31b359b0c4 Author: Steven Price Date: Mon Feb 3 17:35:24 2020 -0800 powerpc: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. For powerpc p?d_is_leaf() functions already exist. Export them using the new p?d_leaf() name. Link: http://lkml.kernel.org/r/20191218162402.45610-7-steven.price@arm.com Signed-off-by: Steven Price Acked-by: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Paul Burton Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 501b81046701408a23bb11f75f1fb4e8521c64a6 Author: Steven Price Date: Mon Feb 3 17:35:19 2020 -0800 mips: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. If _PAGE_HUGE is defined we can simply look for it. When not defined we can be confident that there are no leaf pages in existence and fall back on the generic implementation (added in a later patch) which returns 0. Link: http://lkml.kernel.org/r/20191218162402.45610-6-steven.price@arm.com Signed-off-by: Steven Price Acked-by: Paul Burton Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8aa82df3c123129025a364d8f823929cc488b834 Author: Steven Price Date: Mon Feb 3 17:35:14 2020 -0800 arm64: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information will be provided by the p?d_leaf() functions/macros. For arm64, we already have p?d_sect() macros which we can reuse for p?d_leaf(). pud_sect() is defined as a dummy function when CONFIG_PGTABLE_LEVELS < 3 or CONFIG_ARM64_64K_PAGES is defined. However when the kernel is configured this way then architecturally it isn't allowed to have a large page at this level, and any code using these page walking macros is implicitly relying on the page size/number of levels being the same as the kernel. So it is safe to reuse this for p?d_leaf() as it is an architectural restriction. Link: http://lkml.kernel.org/r/20191218162402.45610-5-steven.price@arm.com Signed-off-by: Steven Price Acked-by: Catalin Marinas Cc: Catalin Marinas Cc: Will Deacon Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8a0af66b35f8c8df3c50b4153f5141be6d4d8158 Author: Steven Price Date: Mon Feb 3 17:35:10 2020 -0800 arm: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information is provided by the p?d_leaf() functions/macros. For arm pmd_large() already exists and does what we want. So simply provide the generic pmd_leaf() name. Link: http://lkml.kernel.org/r/20191218162402.45610-4-steven.price@arm.com Signed-off-by: Steven Price Cc: Russell King Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4f6b2c083c86c7b13cb7900e7d3a6f18e38ba724 Author: Steven Price Date: Mon Feb 3 17:35:06 2020 -0800 arc: mm: add p?d_leaf() definitions walk_page_range() is going to be allowed to walk page tables other than those of user space. For this it needs to know when it has reached a 'leaf' entry in the page tables. This information will be provided by the p?d_leaf() functions/macros. For arc, we only have two levels, so only pmd_leaf() is needed. Link: http://lkml.kernel.org/r/20191218162402.45610-3-steven.price@arm.com Signed-off-by: Steven Price Acked-by: Vineet Gupta Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Hogan Cc: James Morse Cc: Jerome Glisse Cc: "Liang, Kan" Cc: Mark Rutland Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Ralf Baechle Cc: Russell King Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Will Deacon Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 93fab1b22ef7c4abcbc760ce4432762b02e7f3d1 Author: Steven Price Date: Mon Feb 3 17:35:01 2020 -0800 mm: add generic p?d_leaf() macros Patch series "Generic page walk and ptdump", v17. Many architectures current have a debugfs file for dumping the kernel page tables. Currently each architecture has to implement custom functions for this because the details of walking the page tables used by the kernel are different between architectures. This series extends the capabilities of walk_page_range() so that it can deal with the page tables of the kernel (which have no VMAs and can contain larger huge pages than exist for user space). A generic PTDUMP implementation is the implemented making use of the new functionality of walk_page_range() and finally arm64 and x86 are switch to using it, removing the custom table walkers. To enable a generic page table walker to walk the unusual mappings of the kernel we need to implement a set of functions which let us know when the walker has reached the leaf entry. After a suggestion from Will Deacon I've chosen the name p?d_leaf() as this (hopefully) describes the purpose (and is a new name so has no historic baggage). Some architectures have p?d_large macros but this is easily confused with "large pages". This series ends with a generic PTDUMP implemention for arm64 and x86. Mostly this is a clean up and there should be very little functional change. The exceptions are: * arm64 PTDUMP debugfs now displays pages which aren't present (patch 22). * arm64 has the ability to efficiently process KASAN pages (which previously only x86 implemented). This means that the combination of KASAN and DEBUG_WX is now useable. This patch (of 23): Exposing the pud/pgd levels of the page tables to walk_page_range() means we may come across the exotic large mappings that come with large areas of contiguous memory (such as the kernel's linear map). For architectures that don't provide all p?d_leaf() macros, provide generic do nothing default that are suitable where there cannot be leaf pages at that level. Futher patches will add implementations for individual architectures. The name p?d_leaf() is chosen to minimize the confusion with existing uses of "large" pages and "huge" pages which do not necessary mean that the entry is a leaf (for example it may be a set of contiguous entries that only take 1 TLB slot). For the purpose of walking the page tables we don't need to know how it will be represented in the TLB, but we do need to know for sure if it is a leaf of the tree. Link: http://lkml.kernel.org/r/20191218162402.45610-2-steven.price@arm.com Signed-off-by: Steven Price Acked-by: Mark Rutland Cc: Andy Lutomirski Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Borislav Petkov Cc: Catalin Marinas Cc: Dave Hansen Cc: Ingo Molnar Cc: James Morse Cc: Jerome Glisse Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Cc: "H. Peter Anvin" Cc: "Liang, Kan" Cc: Albert Ou Cc: Alexandre Ghiti Cc: Benjamin Herrenschmidt Cc: Christian Borntraeger Cc: David S. Miller Cc: Heiko Carstens Cc: James Hogan Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Paul Walmsley Cc: Ralf Baechle Cc: Russell King Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Zong Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c948715a159d0d02c1e1c9228327ba3c408795c Author: Florian Westphal Date: Mon Feb 3 17:34:58 2020 -0800 mm: remove __krealloc Since 5.5-rc1 the last user of this function is gone, so remove the functionality. See commit 2ad9d7747c10 ("netfilter: conntrack: free extension area immediately") for details. Link: http://lkml.kernel.org/r/20191212223442.22141-1-fw@strlen.de Signed-off-by: Florian Westphal Acked-by: Andrew Morton Acked-by: David Rientjes Reviewed-by: David Hildenbrand Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9a8c8b431b21cddb31c43c090ad1678a999e18fa Author: Randy Dunlap Date: Mon Feb 3 17:34:55 2020 -0800 pinctrl: fix pxa2xx.c build warnings Add #include of to fix build warnings in pinctrl-pxa2xx.c. Fixes these warnings: In file included from ../drivers/pinctrl/pxa/pinctrl-pxa2xx.c:24:0: ../drivers/pinctrl/pxa/../pinctrl-utils.h:36:8: warning: `enum pinctrl_map_type' declared inside parameter list [enabled by default] enum pinctrl_map_type type); ^ ../drivers/pinctrl/pxa/../pinctrl-utils.h:36:8: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] Link: http://lkml.kernel.org/r/0024542e-cba9-8f13-6c18-32d0050a6007@infradead.org Signed-off-by: Randy Dunlap Cc: Robert Jarzmik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 046755a28f9ddc95fd153e76e62d4b3205ac79cd Author: Andrew Morton Date: Mon Feb 3 17:34:52 2020 -0800 drivers/block/null_blk_main.c: fix uninitialized var warnings With gcc-7.2, many instances of drivers/block/null_blk_main.c: In function ‘nullb_device_zone_nr_conv_store’: drivers/block/null_blk_main.c:291:12: warning: ‘new_value’ may be used uninitialized in this function [-Wmaybe-uninitialized] dev->NAME = new_value; \ ^ drivers/block/null_blk_main.c:279:7: note: ‘new_value’ was declared here TYPE new_value; \ ^ Presumably notabug, so use uninitialized_var() to suppress them. Cc: Shaohua Li Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ca0a95a6ac0c444d782abdcb44fd633a5c320d61 Author: Andrew Morton Date: Mon Feb 3 17:34:49 2020 -0800 drivers/block/null_blk_main.c: fix layout Each line here overflows 80 cols by exactly one character. Delete one tab per line to fix. Cc: Shaohua Li Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 889b331724c82c11e15ba0a60979cf7bded0a26c Author: Lu Shuaibing Date: Mon Feb 3 17:34:46 2020 -0800 ipc/msg.c: consolidate all xxxctl_down() functions A use of uninitialized memory in msgctl_down() because msqid64 in ksys_msgctl hasn't been initialized. The local | msqid64 | is created in ksys_msgctl() and then passed into msgctl_down(). Along the way msqid64 is never initialized before msgctl_down() checks msqid64->msg_qbytes. KUMSAN(KernelUninitializedMemorySantizer, a new error detection tool) reports: ================================================================== BUG: KUMSAN: use of uninitialized memory in msgctl_down+0x94/0x300 Read of size 8 at addr ffff88806bb97eb8 by task syz-executor707/2022 CPU: 0 PID: 2022 Comm: syz-executor707 Not tainted 5.2.0-rc4+ #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: dump_stack+0x75/0xae __kumsan_report+0x17c/0x3e6 kumsan_report+0xe/0x20 msgctl_down+0x94/0x300 ksys_msgctl.constprop.14+0xef/0x260 do_syscall_64+0x7e/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4400e9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffd869e0598 EFLAGS: 00000246 ORIG_RAX: 0000000000000047 RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004400e9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000401970 R13: 0000000000401a00 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the page: page:ffffea0001aee5c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x100000000000000() raw: 0100000000000000 0000000000000000 ffffffff01ae0101 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kumsan: bad access detected ================================================================== Syzkaller reproducer: msgctl$IPC_RMID(0x0, 0x0) C reproducer: // autogenerated by syzkaller (https://github.com/google/syzkaller) int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); syscall(__NR_msgctl, 0, 0, 0); return 0; } [natechancellor@gmail.com: adjust indentation in ksys_msgctl] Link: https://github.com/ClangBuiltLinux/linux/issues/829 Link: http://lkml.kernel.org/r/20191218032932.37479-1-natechancellor@gmail.com Link: http://lkml.kernel.org/r/20190613014044.24234-1-shuaibinglu@126.com Signed-off-by: Lu Shuaibing Signed-off-by: Nathan Chancellor Suggested-by: Arnd Bergmann Cc: Davidlohr Bueso Cc: Manfred Spraul Cc: NeilBrown From: Andrew Morton Subject: drivers/block/null_blk_main.c: fix layout Each line here overflows 80 cols by exactly one character. Delete one tab per line to fix. Cc: Shaohua Li Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8116b54e7e23ef948ecac0e0ab78d10888265cab Author: Manfred Spraul Date: Mon Feb 3 17:34:42 2020 -0800 ipc/sem.c: document and update memory barriers Document and update the memory barriers in ipc/sem.c: - Add smp_store_release() to wake_up_sem_queue_prepare() and document why it is needed. - Read q->status using READ_ONCE+smp_acquire__after_ctrl_dep(). as the pair for the barrier inside wake_up_sem_queue_prepare(). - Add comments to all barriers, and mention the rules in the block regarding locking. - Switch to using wake_q_add_safe(). Link: http://lkml.kernel.org/r/20191020123305.14715-6-manfred@colorfullife.com Signed-off-by: Manfred Spraul Cc: Waiman Long Cc: Davidlohr Bueso Cc: <1vier1@web.de> Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0d97a82ba830d89a1e541cc9cd11f1e38c28e416 Author: Manfred Spraul Date: Mon Feb 3 17:34:39 2020 -0800 ipc/msg.c: update and document memory barriers Transfer findings from ipc/mqueue.c: - A control barrier was missing for the lockless receive case So in theory, not yet initialized data may have been copied to user space - obviously only for architectures where control barriers are not NOP. - use smp_store_release(). In theory, the refount may have been decreased to 0 already when wake_q_add() tries to get a reference. Link: http://lkml.kernel.org/r/20191020123305.14715-5-manfred@colorfullife.com Signed-off-by: Manfred Spraul Cc: Waiman Long Cc: Davidlohr Bueso Cc: <1vier1@web.de> Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 Author: Manfred Spraul Date: Mon Feb 3 17:34:36 2020 -0800 ipc/mqueue.c: update/document memory barriers Update and document memory barriers for mqueue.c: - ewp->state is read without any locks, thus READ_ONCE is required. - add smp_aquire__after_ctrl_dep() after the READ_ONCE, we need acquire semantics if the value is STATE_READY. - use wake_q_add_safe() - document why __set_current_state() may be used: Reading task->state cannot happen before the wake_q_add() call, which happens while holding info->lock. Thus the spin_unlock() is the RELEASE, and the spin_lock() is the ACQUIRE. For completeness: there is also a 3 CPU scenario, if the to be woken up task is already on another wake_q. Then: - CPU1: spin_unlock() of the task that goes to sleep is the RELEASE - CPU2: the spin_lock() of the waker is the ACQUIRE - CPU2: smp_mb__before_atomic inside wake_q_add() is the RELEASE - CPU3: smp_mb__after_spinlock() inside try_to_wake_up() is the ACQUIRE Link: http://lkml.kernel.org/r/20191020123305.14715-4-manfred@colorfullife.com Signed-off-by: Manfred Spraul Reviewed-by: Davidlohr Bueso Cc: Waiman Long Cc: <1vier1@web.de> Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ed29f171518cbe11c81e8c20d393bb094a9e2ce7 Author: Davidlohr Bueso Date: Mon Feb 3 17:34:32 2020 -0800 ipc/mqueue.c: remove duplicated code pipelined_send() and pipelined_receive() are identical, so merge them. [manfred@colorfullife.com: add changelog] Link: http://lkml.kernel.org/r/20191020123305.14715-3-manfred@colorfullife.com Signed-off-by: Davidlohr Bueso Signed-off-by: Manfred Spraul Cc: <1vier1@web.de> Cc: Peter Zijlstra Cc: Waiman Long Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 39323c64b8a95d10ddc66dc815dd14efdddf6777 Author: Manfred Spraul Date: Mon Feb 3 17:34:29 2020 -0800 smp_mb__{before,after}_atomic(): update Documentation When adding the _{acquire|release|relaxed}() variants of some atomic operations, it was forgotten to update Documentation/memory_barrier.txt: smp_mb__{before,after}_atomic() is now intended for all RMW operations that do not imply a memory barrier. 1) smp_mb__before_atomic(); atomic_add(); 2) smp_mb__before_atomic(); atomic_xchg_relaxed(); 3) smp_mb__before_atomic(); atomic_fetch_add_relaxed(); Invalid would be: smp_mb__before_atomic(); atomic_set(); In addition, the patch splits the long sentence into multiple shorter sentences. Link: http://lkml.kernel.org/r/20191020123305.14715-2-manfred@colorfullife.com Fixes: 654672d4ba1a ("locking/atomics: Add _{acquire|release|relaxed}() variants of some atomic operations") Signed-off-by: Manfred Spraul Acked-by: Waiman Long Cc: Davidlohr Bueso Cc: Peter Zijlstra Cc: Will Deacon Cc: Peter Zijlstra Cc: <1vier1@web.de> Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 92917998849eea951707c8fea2dc3007bb2ad2cd Author: David Hildenbrand Date: Mon Feb 3 17:34:26 2020 -0800 mm/memory_hotplug: drop valid_start/valid_end from test_pages_in_a_zone() The callers are only interested in the actual zone, they don't care about boundaries. Return the zone instead to simplify. Link: http://lkml.kernel.org/r/20200110183308.11849-1-david@redhat.com Signed-off-by: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Michal Hocko Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 52fb87c81f11daa7027af25fc24ac7974eb8f45a Author: David Hildenbrand Date: Mon Feb 3 17:34:23 2020 -0800 mm/memory_hotplug: cleanup __remove_pages() Let's drop the basically unused section stuff and simplify. Also, let's use a shorter variant to calculate the number of pages to the next section boundary. Link: http://lkml.kernel.org/r/20191006085646.5768-11-david@redhat.com Signed-off-by: David Hildenbrand Cc: Oscar Salvador Cc: Michal Hocko Cc: "Matthew Wilcox (Oracle)" Cc: "Aneesh Kumar K.V" Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Dan Williams Cc: Logan Gunthorpe Cc: Pankaj Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5d12071c5de8621b911ac77dd1a3929f3aee7335 Author: David Hildenbrand Date: Mon Feb 3 17:34:19 2020 -0800 mm/memory_hotplug: drop local variables in shrink_zone_span() Get rid of the unnecessary local variables. Link: http://lkml.kernel.org/r/20191006085646.5768-10-david@redhat.com Signed-off-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Dan Williams Cc: Greg Kroah-Hartman Cc: Logan Gunthorpe Cc: "Matthew Wilcox (Oracle)" Cc: Michal Hocko Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 950b68d9178b6209e92461ec371eee81f0f20190 Author: David Hildenbrand Date: Mon Feb 3 17:34:16 2020 -0800 mm/memory_hotplug: don't check for "all holes" in shrink_zone_span() If we have holes, the holes will automatically get detected and removed once we remove the next bigger/smaller section. The extra checks can go. Link: http://lkml.kernel.org/r/20191006085646.5768-9-david@redhat.com Signed-off-by: David Hildenbrand Cc: Michal Hocko Cc: "Matthew Wilcox (Oracle)" Cc: "Aneesh Kumar K.V" Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Dan Williams Cc: Logan Gunthorpe Cc: Oscar Salvador Cc: Pankaj Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b05158f5d805e0cf373f6e5a43efb9306bcb6a2 Author: David Hildenbrand Date: Mon Feb 3 17:34:12 2020 -0800 mm/memory_hotplug: we always have a zone in find_(smallest|biggest)_section_pfn With shrink_pgdat_span() out of the way, we now always have a valid zone. Link: http://lkml.kernel.org/r/20191006085646.5768-8-david@redhat.com Signed-off-by: David Hildenbrand Cc: Michal Hocko Cc: "Matthew Wilcox (Oracle)" Cc: "Aneesh Kumar K.V" Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Dan Williams Cc: Logan Gunthorpe Cc: Oscar Salvador Cc: Pankaj Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d33695b16a9f0b5f62aefb0a4e073509690ee533 Author: David Hildenbrand Date: Mon Feb 3 17:34:09 2020 -0800 mm/memory_hotplug: poison memmap in remove_pfn_range_from_zone() Let's poison the pages similar to when adding new memory in sparse_add_section(). Also call remove_pfn_range_from_zone() from memunmap_pages(), so we can poison the memmap from there as well. Link: http://lkml.kernel.org/r/20191006085646.5768-7-david@redhat.com Signed-off-by: David Hildenbrand Cc: Michal Hocko Cc: "Matthew Wilcox (Oracle)" Cc: "Aneesh Kumar K.V" Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Dan Williams Cc: Logan Gunthorpe Cc: Oscar Salvador Cc: Pankaj Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f8d75c1b7dc62f017c542ca99e7da4a0839fb1e Author: Aneesh Kumar K.V Date: Mon Feb 3 17:34:06 2020 -0800 mm/memmap_init: update variable name in memmap_init_zone Patch series "mm/memory_hotplug: Shrink zones before removing memory", v6. This series fixes the access of uninitialized memmaps when shrinking zones/nodes and when removing memory. Also, it contains all fixes for crashes that can be triggered when removing certain namespace using memunmap_pages() - ZONE_DEVICE, reported by Aneesh. We stop trying to shrink ZONE_DEVICE, as it's buggy, fixing it would be more involved (we don't have SECTION_IS_ONLINE as an indicator), and shrinking is only of limited use (set_zone_contiguous() cannot detect the ZONE_DEVICE as contiguous). We continue shrinking !ZONE_DEVICE zones, however, I reduced the amount of code to a minimum. Shrinking is especially necessary to keep zone->contiguous set where possible, especially, on memory unplug of DIMMs at zone boundaries. -------------------------------------------------------------------------- Zones are now properly shrunk when offlining memory blocks or when onlining failed. This allows to properly shrink zones on memory unplug even if the separate memory blocks of a DIMM were onlined to different zones or re-onlined to a different zone after offlining. Example: :/# cat /proc/zoneinfo Node 1, zone Movable spanned 0 present 0 managed 0 :/# echo "online_movable" > /sys/devices/system/memory/memory41/state :/# echo "online_movable" > /sys/devices/system/memory/memory43/state :/# cat /proc/zoneinfo Node 1, zone Movable spanned 98304 present 65536 managed 65536 :/# echo 0 > /sys/devices/system/memory/memory43/online :/# cat /proc/zoneinfo Node 1, zone Movable spanned 32768 present 32768 managed 32768 :/# echo 0 > /sys/devices/system/memory/memory41/online :/# cat /proc/zoneinfo Node 1, zone Movable spanned 0 present 0 managed 0 This patch (of 6): The third argument is actually number of pages. Change the variable name from size to nr_pages to indicate this better. No functional change in this patch. Link: http://lkml.kernel.org/r/20191006085646.5768-3-david@redhat.com Signed-off-by: Aneesh Kumar K.V Signed-off-by: David Hildenbrand Reviewed-by: Pankaj Gupta Reviewed-by: David Hildenbrand Cc: Michal Hocko Cc: "Matthew Wilcox (Oracle)" Cc: "Aneesh Kumar K.V" Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Dan Williams Cc: Logan Gunthorpe Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4c6058814ec4460c25111e29452ef596acdcd61b Author: David Hildenbrand Date: Mon Feb 3 17:34:02 2020 -0800 mm: factor out next_present_section_nr() Let's move it to the header and use the shorter variant from mm/page_alloc.c (the original one will also check "__highest_present_section_nr + 1", which is not necessary). While at it, make the section_nr in next_pfn() const. In next_pfn(), we now return section_nr_to_pfn(-1) instead of -1 once we exceed __highest_present_section_nr, which doesn't make a difference in the caller as it is big enough (>= all sane end_pfn). Link: http://lkml.kernel.org/r/20200113144035.10848-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Kirill A. Shutemov Cc: Baoquan He Cc: Dan Williams Cc: "Jin, Zhi" Cc: "Kirill A. Shutemov" Cc: Mel Gorman Cc: Michal Hocko Cc: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 948c436e463d34e0d716aff0f333bb74471e5399 Author: David Hildenbrand Date: Mon Feb 3 17:33:59 2020 -0800 mm/page_alloc: fix and rework pfn handling in memmap_init_zone() Let's update the pfn manually whenever we continue the loop. This makes the code easier to read but also less error prone (and we can directly fix one issue). When overlap_memmap_init() returns true, pfn is updated to "memblock_region_memory_end_pfn(r)". So it already points at the *next* pfn to process. Incrementing the pfn another time is wrong, we might leave one uninitialized. I spotted this by inspecting the code, so I have no idea if this is relevant in practise (with kernelcore=mirror). Link: http://lkml.kernel.org/r/20200113144035.10848-2-david@redhat.com Fixes: a9a9e77fbf27 ("mm: move mirrored memory specific code outside of memmap_init_zone") Signed-off-by: David Hildenbrand Acked-by: Kirill A. Shutemov Reviewed-by: Alexander Duyck Cc: Pavel Tatashin Cc: Michal Hocko Cc: Oscar Salvador Cc: Kirill A. Shutemov Cc: Baoquan He Cc: Dan Williams Cc: Vlastimil Babka Cc: Mel Gorman Cc: "Jin, Zhi" Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b094b7851bf4bf551ad456195d3f26e1c03bd74 Author: David Hildenbrand Date: Mon Feb 3 17:33:55 2020 -0800 mm/page_alloc.c: initialize memmap of unavailable memory directly Let's make sure that all memory holes are actually marked PageReserved(), that page_to_pfn() produces reliable results, and that these pages are not detected as "mmap" pages due to the mapcount. E.g., booting a x86-64 QEMU guest with 4160 MB: [ 0.010585] Early memory node ranges [ 0.010586] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.010588] node 0: [mem 0x0000000000100000-0x00000000bffdefff] [ 0.010589] node 0: [mem 0x0000000100000000-0x0000000143ffffff] max_pfn is 0x144000. Before this change: [root@localhost ~]# ./page-types -r -a 0x144000, flags page-count MB symbolic-flags long-symbolic-flags 0x0000000000000800 16384 64 ___________M_______________________________ mmap total 16384 64 After this change: [root@localhost ~]# ./page-types -r -a 0x144000, flags page-count MB symbolic-flags long-symbolic-flags 0x0000000100000000 16384 64 ___________________________r_______________ reserved total 16384 64 IOW, especially the unavailable physical memory ("memory hole") in the last section would not get properly marked PageReserved() and is indicated to be "mmap" memory. Drop the trace of that function from include/linux/mm.h - nobody else needs it, and rename it accordingly. Note: The fake zone/node might not be covered by the zone/node span. This is not an urgent issue (for now, we had the same node/zone due to the zeroing). We'll need a clean way to mark memory holes (e.g., using a page type PageHole() if possible or a fake ZONE_INVALID) and eventually stop marking these memory holes PageReserved(). Link: http://lkml.kernel.org/r/20191211163201.17179-4-david@redhat.com Signed-off-by: David Hildenbrand Cc: Oscar Salvador Cc: Michal Hocko Cc: Dan Williams Cc: Alexey Dobriyan Cc: Bob Picco Cc: Daniel Jordan Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Pavel Tatashin Cc: Stephen Rothwell Cc: Steven Sistare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit abec749facfff7fece8732be2f8f0bf56d78950b Author: David Hildenbrand Date: Mon Feb 3 17:33:52 2020 -0800 fs/proc/page.c: allow inspection of last section and fix end detection If max_pfn does not fall onto a section boundary, it is possible to inspect PFNs up to max_pfn, and PFNs above max_pfn, however, max_pfn itself can't be inspected. We can have a valid (and online) memmap at and above max_pfn if max_pfn is not aligned to a section boundary. The whole early section has a memmap and is marked online. Being able to inspect the state of these PFNs is valuable for debugging, especially because max_pfn can change on memory hotplug and expose these memmaps. Also, querying page flags via "./page-types -r -a 0x144001," (tools/vm/page-types.c) inside a x86-64 guest with 4160MB under QEMU results in an (almost) endless loop in user space, because the end is not detected properly when starting after max_pfn. Instead, let's allow to inspect all pages in the highest section and return 0 directly if we try to access pages above that section. While at it, check the count before adjusting it, to avoid masking user errors. Link: http://lkml.kernel.org/r/20191211163201.17179-3-david@redhat.com Signed-off-by: David Hildenbrand Cc: Alexey Dobriyan Cc: Oscar Salvador Cc: Michal Hocko Cc: Stephen Rothwell Cc: Bob Picco Cc: Daniel Jordan Cc: Dan Williams Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Pavel Tatashin Cc: Steven Sistare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e822969cab48b786b64246aad1a3ba2a774f5d23 Author: David Hildenbrand Date: Mon Feb 3 17:33:48 2020 -0800 mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section Patch series "mm: fix max_pfn not falling on section boundary", v2. Playing with different memory sizes for a x86-64 guest, I discovered that some memmaps (highest section if max_mem does not fall on the section boundary) are marked as being valid and online, but contain garbage. We have to properly initialize these memmaps. Looking at /proc/kpageflags and friends, I found some more issues, partially related to this. This patch (of 3): If max_pfn is not aligned to a section boundary, we can easily run into BUGs. This can e.g., be triggered on x86-64 under QEMU by specifying a memory size that is not a multiple of 128MB (e.g., 4097MB, but also 4160MB). I was told that on real HW, we can easily have this scenario (esp., one of the main reasons sub-section hotadd of devmem was added). The issue is, that we have a valid memmap (pfn_valid()) for the whole section, and the whole section will be marked "online". pfn_to_online_page() will succeed, but the memmap contains garbage. E.g., doing a "./page-types -r -a 0x144001" when QEMU was started with "-m 4160M" - (see tools/vm/page-types.c): [ 200.476376] BUG: unable to handle page fault for address: fffffffffffffffe [ 200.477500] #PF: supervisor read access in kernel mode [ 200.478334] #PF: error_code(0x0000) - not-present page [ 200.479076] PGD 59614067 P4D 59614067 PUD 59616067 PMD 0 [ 200.479557] Oops: 0000 [#4] SMP NOPTI [ 200.479875] CPU: 0 PID: 603 Comm: page-types Tainted: G D W 5.5.0-rc1-next-20191209 #93 [ 200.480646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4 [ 200.481648] RIP: 0010:stable_page_flags+0x4d/0x410 [ 200.482061] Code: f3 ff 41 89 c0 48 b8 00 00 00 00 01 00 00 00 45 84 c0 0f 85 cd 02 00 00 48 8b 53 08 48 8b 2b 48f [ 200.483644] RSP: 0018:ffffb139401cbe60 EFLAGS: 00010202 [ 200.484091] RAX: fffffffffffffffe RBX: fffffbeec5100040 RCX: 0000000000000000 [ 200.484697] RDX: 0000000000000001 RSI: ffffffff9535c7cd RDI: 0000000000000246 [ 200.485313] RBP: ffffffffffffffff R08: 0000000000000000 R09: 0000000000000000 [ 200.485917] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000144001 [ 200.486523] R13: 00007ffd6ba55f48 R14: 00007ffd6ba55f40 R15: ffffb139401cbf08 [ 200.487130] FS: 00007f68df717580(0000) GS:ffff9ec77fa00000(0000) knlGS:0000000000000000 [ 200.487804] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.488295] CR2: fffffffffffffffe CR3: 0000000135d48000 CR4: 00000000000006f0 [ 200.488897] Call Trace: [ 200.489115] kpageflags_read+0xe9/0x140 [ 200.489447] proc_reg_read+0x3c/0x60 [ 200.489755] vfs_read+0xc2/0x170 [ 200.490037] ksys_pread64+0x65/0xa0 [ 200.490352] do_syscall_64+0x5c/0xa0 [ 200.490665] entry_SYSCALL_64_after_hwframe+0x49/0xbe But it can be triggered much easier via "cat /proc/kpageflags > /dev/null" after cold/hot plugging a DIMM to such a system: [root@localhost ~]# cat /proc/kpageflags > /dev/null [ 111.517275] BUG: unable to handle page fault for address: fffffffffffffffe [ 111.517907] #PF: supervisor read access in kernel mode [ 111.518333] #PF: error_code(0x0000) - not-present page [ 111.518771] PGD a240e067 P4D a240e067 PUD a2410067 PMD 0 This patch fixes that by at least zero-ing out that memmap (so e.g., page_to_pfn() will not crash). Commit 907ec5fca3dc ("mm: zero remaining unavailable struct pages") tried to fix a similar issue, but forgot to consider this special case. After this patch, there are still problems to solve. E.g., not all of these pages falling into a memory hole will actually get initialized later and set PageReserved - they are only zeroed out - but at least the immediate crashes are gone. A follow-up patch will take care of this. Link: http://lkml.kernel.org/r/20191211163201.17179-2-david@redhat.com Fixes: f7f99100d8d9 ("mm: stop zeroing memory during allocation in vmemmap") Signed-off-by: David Hildenbrand Tested-by: Daniel Jordan Cc: Naoya Horiguchi Cc: Pavel Tatashin Cc: Andrew Morton Cc: Steven Sistare Cc: Michal Hocko Cc: Daniel Jordan Cc: Bob Picco Cc: Oscar Salvador Cc: Alexey Dobriyan Cc: Dan Williams Cc: Michal Hocko Cc: Stephen Rothwell Cc: [4.15+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2d797e9ff95ecbcf0a83d657928ed20579444857 Author: Gang He Date: Mon Feb 3 17:33:45 2020 -0800 ocfs2: fix oops when writing cloned file Writing a cloned file triggers a kernel oops and the user-space command process is also killed by the system. The bug can be reproduced stably via: 1) create a file under ocfs2 file system directory. journalctl -b > aa.txt 2) create a cloned file for this file. reflink aa.txt bb.txt 3) write the cloned file with dd command. dd if=/dev/zero of=bb.txt bs=512 count=1 conv=notrunc The dd command is killed by the kernel, then you can see the oops message via dmesg command. [ 463.875404] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 463.875413] #PF: supervisor read access in kernel mode [ 463.875416] #PF: error_code(0x0000) - not-present page [ 463.875418] PGD 0 P4D 0 [ 463.875425] Oops: 0000 [#1] SMP PTI [ 463.875431] CPU: 1 PID: 2291 Comm: dd Tainted: G OE 5.3.16-2-default [ 463.875433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 463.875500] RIP: 0010:ocfs2_refcount_cow+0xa4/0x5d0 [ocfs2] [ 463.875505] Code: 06 89 6c 24 38 89 eb f6 44 24 3c 02 74 be 49 8b 47 28 [ 463.875508] RSP: 0018:ffffa2cb409dfce8 EFLAGS: 00010202 [ 463.875512] RAX: ffff8b1ebdca8000 RBX: 0000000000000001 RCX: ffff8b1eb73a9df0 [ 463.875515] RDX: 0000000000056a01 RSI: 0000000000000000 RDI: 0000000000000000 [ 463.875517] RBP: 0000000000000001 R08: ffff8b1eb73a9de0 R09: 0000000000000000 [ 463.875520] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 463.875522] R13: ffff8b1eb922f048 R14: 0000000000000000 R15: ffff8b1eb922f048 [ 463.875526] FS: 00007f8f44d15540(0000) GS:ffff8b1ebeb00000(0000) knlGS:0000000000000000 [ 463.875529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 463.875532] CR2: 0000000000000028 CR3: 000000003c17a000 CR4: 00000000000006e0 [ 463.875546] Call Trace: [ 463.875596] ? ocfs2_inode_lock_full_nested+0x18b/0x960 [ocfs2] [ 463.875648] ocfs2_file_write_iter+0xaf8/0xc70 [ocfs2] [ 463.875672] new_sync_write+0x12d/0x1d0 [ 463.875688] vfs_write+0xad/0x1a0 [ 463.875697] ksys_write+0xa1/0xe0 [ 463.875710] do_syscall_64+0x60/0x1f0 [ 463.875743] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 463.875758] RIP: 0033:0x7f8f4482ed44 [ 463.875762] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 80 00 00 00 [ 463.875765] RSP: 002b:00007fff300a79d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 463.875769] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8f4482ed44 [ 463.875771] RDX: 0000000000000200 RSI: 000055f771b5c000 RDI: 0000000000000001 [ 463.875774] RBP: 0000000000000200 R08: 00007f8f44af9c78 R09: 0000000000000003 [ 463.875776] R10: 000000000000089f R11: 0000000000000246 R12: 000055f771b5c000 [ 463.875779] R13: 0000000000000200 R14: 0000000000000000 R15: 000055f771b5c000 This regression problem was introduced by commit e74540b28556 ("ocfs2: protect extent tree in ocfs2_prepare_inode_for_write()"). Link: http://lkml.kernel.org/r/20200121050153.13290-1-ghe@suse.com Fixes: e74540b28556 ("ocfs2: protect extent tree in ocfs2_prepare_inode_for_write()"). Signed-off-by: Gang He Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12efec5602744c5a185049eb4fcfd9aebe01bd6f Author: Al Viro Date: Mon Jan 20 19:49:57 2020 -0500 saner copy_mount_options() don't bother with the byte-by-byte loops, etc. Signed-off-by: Al Viro commit 01d7a356872eec22ef34a33a5f9cfa917d145468 Author: Jens Axboe Date: Mon Feb 3 10:33:42 2020 -0700 aio: prevent potential eventfd recursion on poll If we have nested or circular eventfd wakeups, then we can deadlock if we run them inline from our poll waitqueue wakeup handler. It's also possible to have very long chains of notifications, to the extent where we could risk blowing the stack. Check the eventfd recursion count before calling eventfd_signal(). If it's non-zero, then punt the signaling to async context. This is always safe, as it takes us out-of-line in terms of stack and locking context. Cc: stable@vger.kernel.org # 4.19+ Reviewed-by: Jeff Moyer Signed-off-by: Jens Axboe commit 3e577dcd73a1fdc641bf45e5ea4a37869de221b5 Author: Pavel Begunkov Date: Sat Feb 1 03:58:42 2020 +0300 io_uring: put the flag changing code in the same spot Both iocb_flags() and kiocb_set_rw_flags() are inline and modify kiocb->ki_flags. Place them close, so they can be potentially better optimised. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6c8a31346925cbb373f84a18428ab3df59d3950e Author: Pavel Begunkov Date: Sat Feb 1 03:58:00 2020 +0300 io_uring: iterate req cache backwards Grab requests from cache-array from the end, so can get by only free_reqs. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 3e69426da2599677ebbe76e2d97a606c4797bd74 Author: Jens Axboe Date: Sat Feb 1 09:22:49 2020 -0700 io_uring: punt even fadvise() WILLNEED to async context Andres correctly points out that read-ahead can block, if it needs to read in meta data (or even just through the page cache page allocations). Play it safe for now and just ensure WILLNEED is also punted to async context. While in there, allow the file settings hints from non-blocking context. They don't need to start/do IO, and we can safely do them inline. Fixes: 4840e418c2fc ("io_uring: add IORING_OP_FADVISE") Reported-by: Andres Freund Signed-off-by: Jens Axboe commit 1a417f4e618e05fba29ba222f1e8555c302376ce Author: Jens Axboe Date: Fri Jan 31 17:16:48 2020 -0700 io_uring: fix sporadic double CQE entry for close We punt close to async for the final fput(), but we log the completion even before that even in that case. We rely on the request not having a files table assigned to detect what the final async close should do. However, if we punt the async queue to __io_queue_sqe(), we'll get ->files assigned and this makes io_close_finish() think it should both close the filp again (which does no harm) AND log a new CQE event for this request. This causes duplicate CQEs. Queue the request up for async manually so we don't grab files needlessly and trigger this condition. Signed-off-by: Jens Axboe commit 9250f9ee194dc3dcee28a42a1533fa2cc0edd215 Author: Pavel Begunkov Date: Sat Feb 1 01:22:08 2020 +0300 io_uring: remove extra ->file check It won't ever get into io_prep_rw() when req->file haven't been set in io_req_set_file(), hence remove the check. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 5d204bcfa09330972ad3428a8f81c23f371d3e6d Author: Jens Axboe Date: Fri Jan 31 12:06:52 2020 -0700 io_uring: don't map read/write iovec potentially twice If we have a read/write that is deferred, we already setup the async IO context for that request, and mapped it. When we later try and execute the request and we get -EAGAIN, we don't want to attempt to re-map it. If we do, we end up with garbage in the iovec, which typically leads to an -EFAULT or -EINVAL completion. Cc: stable@vger.kernel.org # 5.5 Reported-by: Dan Melnic Signed-off-by: Jens Axboe commit 0b7b21e42ba2d6ac9595a4358a9354249605a3af Author: Jens Axboe Date: Fri Jan 31 08:34:59 2020 -0700 io_uring: use the proper helpers for io_send/recv Don't use the recvmsg/sendmsg helpers, use the same helpers that the recv(2) and send(2) system calls use. Reported-by: 李通洲 Signed-off-by: Jens Axboe commit f0b493e6b9a8959356983f57112229e69c2f7b8c Author: Jens Axboe Date: Sat Feb 1 21:30:11 2020 -0700 io_uring: prevent potential eventfd recursion on poll If we have nested or circular eventfd wakeups, then we can deadlock if we run them inline from our poll waitqueue wakeup handler. It's also possible to have very long chains of notifications, to the extent where we could risk blowing the stack. Check the eventfd recursion count before calling eventfd_signal(). If it's non-zero, then punt the signaling to async context. This is always safe, as it takes us out-of-line in terms of stack and locking context. Cc: stable@vger.kernel.org # 5.1+ Signed-off-by: Jens Axboe commit b5e683d5cab8cd433b06ae178621f083cabd4f63 Author: Jens Axboe Date: Sun Feb 2 08:23:03 2020 -0700 eventfd: track eventfd_signal() recursion depth eventfd use cases from aio and io_uring can deadlock due to circular or resursive calling, when eventfd_signal() tries to grab the waitqueue lock. On top of that, it's also possible to construct notification chains that are deep enough that we could blow the stack. Add a percpu counter that tracks the percpu recursion depth, warn if we exceed it. The counter is also exposed so that users of eventfd_signal() can do the right thing if it's non-zero in the context where it is called. Cc: stable@vger.kernel.org # 4.19+ Signed-off-by: Jens Axboe commit a444ad1432c5a0fb3bd43fc9ac39fb88b1fb141e Merge: 2b5ea2947fbd 245311637fdd Author: Jakub Kicinski Date: Mon Feb 3 15:38:50 2020 -0800 Merge branch 'netdevsim-fix-several-bugs-in-netdevsim-module' Taehee Yoo says: ===================== netdevsim: fix several bugs in netdevsim module This patchset fixes several bugs in netdevsim module. 1. The first patch fixes using uninitialized resources This patch fixes two similar problems, which is to use uninitialized resources. a) In the current code, {new/del}_device_store() use resource, they are initialized by __init(). But, these functions could be called before __init() is finished. So, accessing uninitialized data could occur and it eventually makes panic. b) In the current code, {new/del}_port_store() uses resource, they are initialized by new_device_store(). But thes functions could be called before new_device_store() is finished. 2. The second patch fixes another race condition. The main problem is a race condition in {new/del}_port() and devlink reload function. These functions would allocate and remove resources. So these functions should not be executed concurrently. 3. The third patch fixes a panic in nsim_dev_take_snapshot_write(). nsim_dev_take_snapshot_write() uses nsim_dev and nsim_dev->dummy_region. But these data could be removed by both reload routine and del_device_store(). And these functions could be executed concurrently. 4. The fourth patch fixes stack-out-of-bound in nsim_dev_debugfs_init(). nsim_dev_debugfs_init() provides only 16bytes for name pointer. But, there are some case the name length is over 16bytes. So, stack-out-of-bound occurs. 5. The fifth patch uses IS_ERR instead of IS_ERR_OR_NULL. debugfs_create_{dir/file} doesn't return NULL. So, IS_ERR() is more correct. 6. The sixth patch avoids kmalloc warning. When too large memory allocation is requested by user-space, kmalloc internally prints warning message. That warning message is not necessary. In order to avoid that, it adds __GFP_NOWARN. 7. The last patch removes an unused sdev.c file Change log: v2 -> v3: - Use smp_load_acquire() and smp_store_release() for flag variables. - Change variable names. - Fix deadlock in second patch. - Update lock variable comment. - Add new patch for fixing panic in snapshot_write(). - Include Reviewed-by tags. - Update some log messages and comment. v1 -> v2: - Splits a fixing race condition patch into two patches. - Fix incorrect Fixes tags. - Update comments - Fix use-after-free - Add a new patch, which removes an unused sdev.c file. - Remove a patch, which tries to avoid debugfs warning. ===================== Signed-off-by: Jakub Kicinski commit 245311637fddeca96c1f0758a649eb1fb437978e Author: Taehee Yoo Date: Sat Feb 1 16:43:48 2020 +0000 netdevsim: remove unused sdev code sdev.c code is merged into dev.c and is not used anymore. it would be removed. Reviewed-by: Jakub Kicinski Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 83cf4213bafc4e3c747f0a25ad22cfbf55af7e84 Author: Taehee Yoo Date: Sat Feb 1 16:43:39 2020 +0000 netdevsim: use __GFP_NOWARN to avoid memalloc warning vfnum buffer size and binary_len buffer size is received by user-space. So, this buffer size could be too large. If so, kmalloc will internally print a warning message. This warning message is actually not necessary for the netdevsim module. So, this patch adds __GFP_NOWARN. Test commands: modprobe netdevsim echo 1 > /sys/bus/netdevsim/new_device echo 1000000000 > /sys/devices/netdevsim1/sriov_numvfs Splat looks like: [ 357.847266][ T1000] WARNING: CPU: 0 PID: 1000 at mm/page_alloc.c:4738 __alloc_pages_nodemask+0x2f3/0x740 [ 357.850273][ T1000] Modules linked in: netdevsim veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrx [ 357.852989][ T1000] CPU: 0 PID: 1000 Comm: bash Tainted: G B 5.5.0-rc5+ #270 [ 357.854334][ T1000] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 357.855703][ T1000] RIP: 0010:__alloc_pages_nodemask+0x2f3/0x740 [ 357.856669][ T1000] Code: 64 fe ff ff 65 48 8b 04 25 c0 0f 02 00 48 05 f0 12 00 00 41 be 01 00 00 00 49 89 47 0 [ 357.860272][ T1000] RSP: 0018:ffff8880b7f47bd8 EFLAGS: 00010246 [ 357.861009][ T1000] RAX: ffffed1016fe8f80 RBX: 1ffff11016fe8fae RCX: 0000000000000000 [ 357.861843][ T1000] RDX: 0000000000000000 RSI: 0000000000000017 RDI: 0000000000000000 [ 357.862661][ T1000] RBP: 0000000000040dc0 R08: 1ffff11016fe8f67 R09: dffffc0000000000 [ 357.863509][ T1000] R10: ffff8880b7f47d68 R11: fffffbfff2798180 R12: 1ffff11016fe8f80 [ 357.864355][ T1000] R13: 0000000000000017 R14: 0000000000000017 R15: ffff8880c2038d68 [ 357.865178][ T1000] FS: 00007fd9a5b8c740(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000 [ 357.866248][ T1000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 357.867531][ T1000] CR2: 000055ce01ba8100 CR3: 00000000b7dbe005 CR4: 00000000000606f0 [ 357.868972][ T1000] Call Trace: [ 357.869423][ T1000] ? lock_contended+0xcd0/0xcd0 [ 357.870001][ T1000] ? __alloc_pages_slowpath+0x21d0/0x21d0 [ 357.870673][ T1000] ? _kstrtoull+0x76/0x160 [ 357.871148][ T1000] ? alloc_pages_current+0xc1/0x1a0 [ 357.871704][ T1000] kmalloc_order+0x22/0x80 [ 357.872184][ T1000] kmalloc_order_trace+0x1d/0x140 [ 357.872733][ T1000] __kmalloc+0x302/0x3a0 [ 357.873204][ T1000] nsim_bus_dev_numvfs_store+0x1ab/0x260 [netdevsim] [ 357.873919][ T1000] ? kernfs_get_active+0x12c/0x180 [ 357.874459][ T1000] ? new_device_store+0x450/0x450 [netdevsim] [ 357.875111][ T1000] ? kernfs_get_parent+0x70/0x70 [ 357.875632][ T1000] ? sysfs_file_ops+0x160/0x160 [ 357.876152][ T1000] kernfs_fop_write+0x276/0x410 [ 357.876680][ T1000] ? __sb_start_write+0x1ba/0x2e0 [ 357.877225][ T1000] vfs_write+0x197/0x4a0 [ 357.877671][ T1000] ksys_write+0x141/0x1d0 [ ... ] Reviewed-by: Jakub Kicinski Fixes: 79579220566c ("netdevsim: add SR-IOV functionality") Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 6556ff32f12d0a5380dd2fa6bbaa01373925a7d1 Author: Taehee Yoo Date: Sat Feb 1 16:43:30 2020 +0000 netdevsim: use IS_ERR instead of IS_ERR_OR_NULL for debugfs Debugfs APIs return valid pointer or error pointer. it doesn't return NULL. So, using IS_ERR is enough, not using IS_ERR_OR_NULL. Reviewed-by: Jakub Kicinski Reported-by: kbuild test robot Reported-by: Dan Carpenter Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 6fb8852b1298200da39bd85788bc5755d1d56f32 Author: Taehee Yoo Date: Sat Feb 1 16:43:22 2020 +0000 netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init() When netdevsim dev is being created, a debugfs directory is created. The variable "dev_ddir_name" is 16bytes device name pointer and device name is "netdevsim". The maximum dev id length is 10. So, 16bytes for device name isn't enough. Test commands: modprobe netdevsim echo "1000000000 0" > /sys/bus/netdevsim/new_device Splat looks like: [ 249.622710][ T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880 [ 249.623658][ T900] Write of size 1 at addr ffff88804c527988 by task bash/900 [ 249.624521][ T900] [ 249.624830][ T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322 [ 249.625691][ T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 249.626712][ T900] Call Trace: [ 249.627103][ T900] dump_stack+0x96/0xdb [ 249.627639][ T900] ? number+0x824/0x880 [ 249.628173][ T900] print_address_description.constprop.5+0x1be/0x360 [ 249.629022][ T900] ? number+0x824/0x880 [ 249.629569][ T900] ? number+0x824/0x880 [ 249.630105][ T900] __kasan_report+0x12a/0x170 [ 249.630717][ T900] ? number+0x824/0x880 [ 249.631201][ T900] kasan_report+0xe/0x20 [ 249.631723][ T900] number+0x824/0x880 [ 249.632235][ T900] ? put_dec+0xa0/0xa0 [ 249.632716][ T900] ? rcu_read_lock_sched_held+0x90/0xc0 [ 249.633392][ T900] vsnprintf+0x63c/0x10b0 [ 249.633983][ T900] ? pointer+0x5b0/0x5b0 [ 249.634543][ T900] ? mark_lock+0x11d/0xc40 [ 249.635200][ T900] sprintf+0x9b/0xd0 [ 249.635750][ T900] ? scnprintf+0xe0/0xe0 [ 249.636370][ T900] nsim_dev_probe+0x63c/0xbf0 [netdevsim] [ ... ] Reviewed-by: Jakub Kicinski Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 8526ad9646b17c59b6d430d8baa8f152a14fe177 Author: Taehee Yoo Date: Sat Feb 1 16:43:13 2020 +0000 netdevsim: fix panic in nsim_dev_take_snapshot_write() nsim_dev_take_snapshot_write() uses nsim_dev and nsim_dev->dummy_region. So, during this function, these data shouldn't be removed. But there is no protecting stuff in this function. There are two similar cases. 1. reload case reload could be called during nsim_dev_take_snapshot_write(). When reload is being executed, nsim_dev_reload_down() is called and it calls nsim_dev_reload_destroy(). nsim_dev_reload_destroy() calls devlink_region_destroy() to destroy nsim_dev->dummy_region. So, during nsim_dev_take_snapshot_write(), nsim_dev->dummy_region() would be removed. At this point, snapshot_write() would access freed pointer. In order to fix this case, take_snapshot file will be removed before devlink_region_destroy(). The take_snapshot file will be re-created by ->reload_up(). 2. del_device_store case del_device_store() also could call nsim_dev_reload_destroy() during nsim_dev_take_snapshot_write(). If so, panic would occur. This problem is actually the same problem with the first case. So, this problem will be fixed by the first case's solution. Test commands: modprobe netdevsim while : do echo 1 > /sys/bus/netdevsim/new_device & echo 1 > /sys/bus/netdevsim/del_device & devlink dev reload netdevsim/netdevsim1 & echo 1 > /sys/kernel/debug/netdevsim/netdevsim1/take_snapshot & done Splat looks like: [ 45.564513][ T975] general protection fault, probably for non-canonical address 0xdffffc000000003a: 0000 [#1] SMP DEI [ 45.566131][ T975] KASAN: null-ptr-deref in range [0x00000000000001d0-0x00000000000001d7] [ 45.566135][ T975] CPU: 1 PID: 975 Comm: bash Not tainted 5.5.0+ #322 [ 45.569020][ T975] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 45.569026][ T975] RIP: 0010:__mutex_lock+0x10a/0x14b0 [ 45.570518][ T975] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f [ 45.570522][ T975] RSP: 0018:ffff888046ccfbf0 EFLAGS: 00010206 [ 45.572305][ T975] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 45.572308][ T975] RDX: 000000000000003a RSI: ffffffffac926440 RDI: 00000000000001d0 [ 45.576843][ T975] RBP: ffff888046ccfd70 R08: ffffffffab610645 R09: 0000000000000000 [ 45.576847][ T975] R10: ffff888046ccfd90 R11: ffffed100d6360ad R12: 0000000000000000 [ 45.578471][ T975] R13: dffffc0000000000 R14: ffffffffae1976c0 R15: 0000000000000168 [ 45.578475][ T975] FS: 00007f614d6e7740(0000) GS:ffff88806c400000(0000) knlGS:0000000000000000 [ 45.581492][ T975] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.582942][ T975] CR2: 00005618677d1cf0 CR3: 000000005fb9c002 CR4: 00000000000606e0 [ 45.584543][ T975] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.586633][ T975] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.589889][ T975] Call Trace: [ 45.591445][ T975] ? devlink_region_snapshot_create+0x55/0x4a0 [ 45.601250][ T975] ? mutex_lock_io_nested+0x1380/0x1380 [ 45.602817][ T975] ? mutex_lock_io_nested+0x1380/0x1380 [ 45.603875][ T975] ? mark_held_locks+0xa5/0xe0 [ 45.604769][ T975] ? _raw_spin_unlock_irqrestore+0x2d/0x50 [ 45.606147][ T975] ? __mutex_unlock_slowpath+0xd0/0x670 [ 45.607723][ T975] ? crng_backtrack_protect+0x80/0x80 [ 45.613530][ T975] ? wait_for_completion+0x390/0x390 [ 45.615152][ T975] ? devlink_region_snapshot_create+0x55/0x4a0 [ 45.616834][ T975] devlink_region_snapshot_create+0x55/0x4a0 [ ... ] Fixes: 4418f862d675 ("netdevsim: implement support for devlink region and snapshots") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 6ab63366e1ec4ec1900f253aa64727b4b5f4ee73 Author: Taehee Yoo Date: Sat Feb 1 16:43:04 2020 +0000 netdevsim: disable devlink reload when resources are being used devlink reload destroys resources and allocates resources again. So, when devices and ports resources are being used, devlink reload function should not be executed. In order to avoid this race, a new lock is added and new_port() and del_port() call devlink_reload_disable() and devlink_reload_enable(). Thread0 Thread1 {new/del}_port() {new/del}_port() devlink_reload_disable() devlink_reload_disable() devlink_reload_enable() //here devlink_reload_enable() Before Thread1's devlink_reload_enable(), the devlink is already allowed to execute reload because Thread0 allows it. devlink reload disable/enable variable type is bool. So the above case would exist. So, disable/enable should be executed atomically. In order to do that, a new lock is used. Test commands: modprobe netdevsim echo 1 > /sys/bus/netdevsim/new_device while : do echo 1 > /sys/devices/netdevsim1/new_port & echo 1 > /sys/devices/netdevsim1/del_port & devlink dev reload netdevsim/netdevsim1 & done Splat looks like: [ 23.342145][ T932] DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock)) [ 23.342159][ T932] WARNING: CPU: 0 PID: 932 at kernel/locking/mutex-debug.c:103 mutex_destroy+0xc7/0xf0 [ 23.344182][ T932] Modules linked in: netdevsim openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_dx [ 23.346485][ T932] CPU: 0 PID: 932 Comm: devlink Not tainted 5.5.0+ #322 [ 23.347696][ T932] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 23.348893][ T932] RIP: 0010:mutex_destroy+0xc7/0xf0 [ 23.349505][ T932] Code: e0 07 83 c0 03 38 d0 7c 04 84 d2 75 2e 8b 05 00 ac b0 02 85 c0 75 8b 48 c7 c6 00 5e 07 96 40 [ 23.351887][ T932] RSP: 0018:ffff88806208f810 EFLAGS: 00010286 [ 23.353963][ T932] RAX: dffffc0000000008 RBX: ffff888067f6f2c0 RCX: ffffffff942c4bd4 [ 23.355222][ T932] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff96dac5b4 [ 23.356169][ T932] RBP: ffff888067f6f000 R08: fffffbfff2d235a5 R09: fffffbfff2d235a5 [ 23.357160][ T932] R10: 0000000000000001 R11: fffffbfff2d235a4 R12: ffff888067f6f208 [ 23.358288][ T932] R13: ffff88806208fa70 R14: ffff888067f6f000 R15: ffff888069ce3800 [ 23.359307][ T932] FS: 00007fe2a3876740(0000) GS:ffff88806c000000(0000) knlGS:0000000000000000 [ 23.360473][ T932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.361319][ T932] CR2: 00005561357aa000 CR3: 000000005227a006 CR4: 00000000000606f0 [ 23.362323][ T932] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.363417][ T932] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.364414][ T932] Call Trace: [ 23.364828][ T932] nsim_dev_reload_destroy+0x77/0xb0 [netdevsim] [ 23.365655][ T932] nsim_dev_reload_down+0x84/0xb0 [netdevsim] [ 23.366433][ T932] devlink_reload+0xb1/0x350 [ 23.367010][ T932] genl_rcv_msg+0x580/0xe90 [ ...] [ 23.531729][ T1305] kernel BUG at lib/list_debug.c:53! [ 23.532523][ T1305] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 23.533467][ T1305] CPU: 2 PID: 1305 Comm: bash Tainted: G W 5.5.0+ #322 [ 23.534962][ T1305] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 23.536503][ T1305] RIP: 0010:__list_del_entry_valid+0xe6/0x150 [ 23.538346][ T1305] Code: 89 ea 48 c7 c7 00 73 1e 96 e8 df f7 4c ff 0f 0b 48 c7 c7 60 73 1e 96 e8 d1 f7 4c ff 0f 0b 44 [ 23.541068][ T1305] RSP: 0018:ffff888047c27b58 EFLAGS: 00010282 [ 23.542001][ T1305] RAX: 0000000000000054 RBX: ffff888067f6f318 RCX: 0000000000000000 [ 23.543051][ T1305] RDX: 0000000000000054 RSI: 0000000000000008 RDI: ffffed1008f84f61 [ 23.544072][ T1305] RBP: ffff88804aa0fca0 R08: ffffed100d940539 R09: ffffed100d940539 [ 23.545085][ T1305] R10: 0000000000000001 R11: ffffed100d940538 R12: ffff888047c27cb0 [ 23.546422][ T1305] R13: ffff88806208b840 R14: ffffffff981976c0 R15: ffff888067f6f2c0 [ 23.547406][ T1305] FS: 00007f76c0431740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 23.548527][ T1305] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.549389][ T1305] CR2: 00007f5048f1a2f8 CR3: 000000004b310006 CR4: 00000000000606e0 [ 23.550636][ T1305] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.551578][ T1305] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.552597][ T1305] Call Trace: [ 23.553004][ T1305] mutex_remove_waiter+0x101/0x520 [ 23.553646][ T1305] __mutex_lock+0xac7/0x14b0 [ 23.554218][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim] [ 23.554908][ T1305] ? mutex_lock_io_nested+0x1380/0x1380 [ 23.555570][ T1305] ? _parse_integer+0xf0/0xf0 [ 23.556043][ T1305] ? kstrtouint+0x86/0x110 [ 23.556504][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim] [ 23.557133][ T1305] nsim_dev_port_del+0x4e/0x140 [netdevsim] [ 23.558024][ T1305] del_port_store+0xcc/0xf0 [netdevsim] [ ... ] Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit f5cd21605ecd249e5fc715411df22cc1bc877b32 Author: Taehee Yoo Date: Sat Feb 1 16:42:54 2020 +0000 netdevsim: fix using uninitialized resources When module is being initialized, __init() calls bus_register() and driver_register(). These functions internally create various resources and sysfs files. The sysfs files are used for basic operations(add/del device). /sys/bus/netdevsim/new_device /sys/bus/netdevsim/del_device These sysfs files use netdevsim resources, they are mostly allocated and initialized in ->probe() function, which is nsim_dev_probe(). But, sysfs files could be executed before ->probe() is finished. So, accessing uninitialized data would occur. Another problem is very similar. /sys/bus/netdevsim/new_device internally creates sysfs files. /sys/devices/netdevsim/new_port /sys/devices/netdevsim/del_port These sysfs files also use netdevsim resources, they are mostly allocated and initialized in creating device routine, which is nsim_bus_dev_new(). But they also could be executed before nsim_bus_dev_new() is finished. So, accessing uninitialized data would occur. To fix these problems, this patch adds flags, which means whether the operation is finished or not. The flag variable 'nsim_bus_enable' means whether netdevsim bus was initialized or not. This is protected by nsim_bus_dev_list_lock. The flag variable 'nsim_bus_dev->init' means whether nsim_bus_dev was initialized or not. This could be used in {new/del}_port_store() with no lock. Test commands: #SHELL1 modprobe netdevsim while : do echo "1 1" > /sys/bus/netdevsim/new_device echo "1 1" > /sys/bus/netdevsim/del_device done #SHELL2 while : do echo 1 > /sys/devices/netdevsim1/new_port echo 1 > /sys/devices/netdevsim1/del_port done Splat looks like: [ 47.508954][ T1008] general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 I [ 47.510793][ T1008] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 47.511963][ T1008] CPU: 2 PID: 1008 Comm: bash Not tainted 5.5.0+ #322 [ 47.512823][ T1008] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 47.514041][ T1008] RIP: 0010:__mutex_lock+0x10a/0x14b0 [ 47.514699][ T1008] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f [ 47.517163][ T1008] RSP: 0018:ffff888059b4fbb0 EFLAGS: 00010206 [ 47.517802][ T1008] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 47.518941][ T1008] RDX: 0000000000000021 RSI: ffffffff85926440 RDI: 0000000000000108 [ 47.519732][ T1008] RBP: ffff888059b4fd30 R08: ffffffffc073fad0 R09: 0000000000000000 [ 47.520729][ T1008] R10: ffff888059b4fd50 R11: ffff88804bb38040 R12: 0000000000000000 [ 47.521702][ T1008] R13: dffffc0000000000 R14: ffffffff871976c0 R15: 00000000000000a0 [ 47.522760][ T1008] FS: 00007fd4be05a740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 [ 47.523877][ T1008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.524627][ T1008] CR2: 0000561c82b69cf0 CR3: 0000000065dd6004 CR4: 00000000000606e0 [ 47.527662][ T1008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.528604][ T1008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.529531][ T1008] Call Trace: [ 47.529874][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim] [ 47.530470][ T1008] ? mutex_lock_io_nested+0x1380/0x1380 [ 47.531018][ T1008] ? _kstrtoull+0x76/0x160 [ 47.531449][ T1008] ? _parse_integer+0xf0/0xf0 [ 47.531874][ T1008] ? kernfs_fop_write+0x1cf/0x410 [ 47.532330][ T1008] ? sysfs_file_ops+0x160/0x160 [ 47.532773][ T1008] ? kstrtouint+0x86/0x110 [ 47.533168][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim] [ 47.533721][ T1008] nsim_dev_port_add+0x50/0x150 [netdevsim] [ 47.534336][ T1008] ? sysfs_file_ops+0x160/0x160 [ 47.534858][ T1008] new_port_store+0x99/0xb0 [netdevsim] [ 47.535439][ T1008] ? del_port_store+0xb0/0xb0 [netdevsim] [ 47.536035][ T1008] ? sysfs_file_ops+0x112/0x160 [ 47.536544][ T1008] ? sysfs_kf_write+0x3b/0x180 [ 47.537029][ T1008] kernfs_fop_write+0x276/0x410 [ 47.537548][ T1008] ? __sb_start_write+0x215/0x2e0 [ 47.538110][ T1008] vfs_write+0x197/0x4a0 [ ... ] Fixes: f9d9db47d3ba ("netdevsim: add bus attributes to add new and delete devices") Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 8fc91b972b734a62a3f3ef45db06d06617f739ea Author: Andrii Nakryiko Date: Sat Feb 1 22:51:52 2020 -0800 selftests/bpf: Fix trampoline_count.c selftest compilation warning Fix missing braces compilation warning in trampoline_count test: .../prog_tests/trampoline_count.c: In function ‘test_trampoline_count’: .../prog_tests/trampoline_count.c:49:9: warning: missing braces around initializer [-Wmissing-braces] struct inst inst[MAX_TRAMP_PROGS] = { 0 }; ^ .../prog_tests/trampoline_count.c:49:9: warning: (near initialization for ‘inst[0]’) [-Wmissing-braces] Fixes: d633d57902a5 ("selftest/bpf: Add test for allowed trampolines count") Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200202065152.2718142-1-andriin@fb.com commit 2b5ea2947fbdf4e650169afd5ef30ce1c7d8cba8 Merge: 14b41a2959fb 18e4960c18f4 Author: Jakub Kicinski Date: Mon Feb 3 15:07:26 2020 -0800 Merge branch 'bnxt_en-Bug-fixes' Michael Chan says: ===================== bnxt_en: Bug fixes 3 patches that fix some issues in the firmware reset logic, starting with a small patch to refactor the code that re-enables SRIOV. The last patch fixes a TC queue mapping issue. ==================== Signed-off-by: Jakub Kicinski commit 18e4960c18f484ac288f41b43d0e6c4c88e6ea78 Author: Michael Chan Date: Sun Feb 2 02:41:38 2020 -0500 bnxt_en: Fix TC queue mapping. The driver currently only calls netdev_set_tc_queue when the number of TCs is greater than 1. Instead, the comparison should be greater than or equal to 1. Even with 1 TC, we need to set the queue mapping. This bug can cause warnings when the number of TCs is changed back to 1. Fixes: 7809592d3e2e ("bnxt_en: Enable MSIX early in bnxt_init_one().") Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit d407302895d3f3ca3a333c711744a95e0b1b0150 Author: Vasundhara Volam Date: Sun Feb 2 02:41:37 2020 -0500 bnxt_en: Fix logic that disables Bus Master during firmware reset. The current logic that calls pci_disable_device() in __bnxt_close_nic() during firmware reset is flawed. If firmware is still alive, we're disabling the device too early, causing some firmware commands to not reach the firmware. Fix it by moving the logic to bnxt_reset_close(). If firmware is in fatal condition, we call pci_disable_device() before we free any of the rings to prevent DMA corruption of the freed rings. If firmware is still alive, we call pci_disable_device() after the last firmware message has been sent. Fixes: 3bc7d4a352ef ("bnxt_en: Add BNXT_STATE_IN_FW_RESET state.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 12de2eadf87825c3990c1aa68b5e93101ca2f043 Author: Michael Chan Date: Sun Feb 2 02:41:36 2020 -0500 bnxt_en: Fix RDMA driver failure with SRIOV after firmware reset. bnxt_ulp_start() needs to be called before SRIOV is re-enabled after firmware reset. Re-enabling SRIOV may consume all the resources and may cause the RDMA driver to fail to get MSIX and other resources. Fix it by calling bnxt_ulp_start() first before calling bnxt_reenable_sriov(). We re-arrange the logic so that we call bnxt_ulp_start() and bnxt_reenable_sriov() in proper sequence in bnxt_fw_reset_task() and bnxt_open(). The former is the normal coordinated firmware reset sequence and the latter is firmware reset while the function is down. This new logic is now more straight forward and will now fix both scenarios. Fixes: f3a6d206c25a ("bnxt_en: Call bnxt_ulp_stop()/bnxt_ulp_start() during error recovery.") Reported-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit c16d4ee0e397163fe7ceac281eaa952e63fadec7 Author: Michael Chan Date: Sun Feb 2 02:41:35 2020 -0500 bnxt_en: Refactor logic to re-enable SRIOV after firmware reset detected. Put the current logic in bnxt_open() to re-enable SRIOV after detecting firmware reset into a new function bnxt_reenable_sriov(). This call needs to be invoked in the firmware reset path also in the next patch. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 257af63d7f84f0672aa6a24b5511871f00741f19 Author: Alexei Starovoitov Date: Fri Jan 31 16:03:14 2020 -0800 bpf: Fix modifier skipping logic Fix the way modifiers are skipped while walking pointers. Otherwise second level dereferences of 'const struct foo *' will be rejected by the verifier. Fixes: 9e15db66136a ("bpf: Implement accurate raw_tp context access via BTF") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200201000314.261392-1-ast@kernel.org commit a525b0881de7742617343f02df4073ddc1571237 Author: Michal Rostecki Date: Sun Feb 2 12:02:00 2020 +0100 bpftool: Remove redundant "HAVE" prefix from the large INSN limit check "HAVE" prefix is already applied by default to feature macros and before this change, the large INSN limit macro had the incorrect name with double "HAVE". Fixes: 2faef64aa6b3 ("bpftool: Add misc section and probe for large INSN limit") Signed-off-by: Michal Rostecki Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200202110200.31024-1-mrostecki@opensuse.org commit 14b41a2959fbaa50932699d32ceefd6643abacc6 Author: Nicolin Chen Date: Fri Jan 31 18:01:24 2020 -0800 net: stmmac: Delete txtimer in suspend() When running v5.5 with a rootfs on NFS, memory abort may happen in the system resume stage: Unable to handle kernel paging request at virtual address dead00000000012a [dead00000000012a] address between user and kernel address ranges pc : run_timer_softirq+0x334/0x3d8 lr : run_timer_softirq+0x244/0x3d8 x1 : ffff800011cafe80 x0 : dead000000000122 Call trace: run_timer_softirq+0x334/0x3d8 efi_header_end+0x114/0x234 irq_exit+0xd0/0xd8 __handle_domain_irq+0x60/0xb0 gic_handle_irq+0x58/0xa8 el1_irq+0xb8/0x180 arch_cpu_idle+0x10/0x18 do_idle+0x1d8/0x2b0 cpu_startup_entry+0x24/0x40 secondary_start_kernel+0x1b4/0x208 Code: f9000693 a9400660 f9000020 b4000040 (f9000401) ---[ end trace bb83ceeb4c482071 ]--- Kernel panic - not syncing: Fatal exception in interrupt SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 2-3 Kernel Offset: disabled CPU features: 0x00002,2300aa30 Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- It's found that stmmac_xmit() and stmmac_resume() sometimes might run concurrently, possibly resulting in a race condition between mod_timer() and setup_timer(), being called by stmmac_xmit() and stmmac_resume() respectively. Since the resume() runs setup_timer() every time, it'd be safer to have del_timer_sync() in the suspend() as the counterpart. Signed-off-by: Nicolin Chen Signed-off-by: Jakub Kicinski commit 322bf2d3446aabdaf5e8887775bd9ced80dbc0f0 Merge: 1716f536425f 264b0d2bee14 Author: Linus Torvalds Date: Mon Feb 3 22:27:33 2020 +0000 Merge branch 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu updates from Dennis Zhou: "Separate out variables that can be decrypted into their own page anytime encryption can be enabled and fix __percpu annotations in asm-generic for sparse" * 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: percpu: Separate decrypted varaibles anytime encryption can be enabled percpu: fix __percpu annotation in asm-generic commit 1716f536425f72cca4b0ff42c4be9466ed38dbd9 Merge: a6d5f9dca42e c08406033fe8 Author: Linus Torvalds Date: Mon Feb 3 22:25:27 2020 +0000 Merge branch 'stable/for-linus-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft Pull ibft update from Konrad Rzeszutek Wilk: "Adhere to the iBFT spec and extend the structure to handle more than two NICs" * 'stable/for-linus-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft: iscsi_ibft: Don't limits Targets and NICs to two commit a6d5f9dca42eab3526e2f73aa5b7df2a5fec2c9d Merge: f4a6365ae88d 7b5372ba04ca Author: Linus Torvalds Date: Mon Feb 3 22:22:05 2020 +0000 Merge tag 'vfio-v5.6-rc1' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Fix nvlink error path (Alexey Kardashevskiy) - Update nvlink and spapr to use mmgrab() (Julia Lawall) - Update static declaration (Ben Dooks) - Annotate __iomem to fix sparse warnings (Ben Dooks) * tag 'vfio-v5.6-rc1' of git://github.com/awilliam/linux-vfio: vfio: platform: fix __iomem in vfio_platform_amdxgbe.c vfio/mdev: make create attribute static vfio/spapr_tce: use mmgrab vfio: vfio_pci_nvlink2: use mmgrab vfio/spapr/nvlink2: Skip unpinning pages on error exit commit 0f060936e490c6279dfe773d75d526d3d3d77111 Author: Amir Goldstein Date: Mon Feb 3 21:46:43 2020 +0200 SMB3: Backup intent flag missing from some more ops When "backup intent" is requested on the mount (e.g. backupuid or backupgid mount options), the corresponding flag was missing from some of the operations. Change all operations to use the macro cifs_create_options() to set the backup intent flag if needed. Signed-off-by: Amir Goldstein Signed-off-by: Steve French commit f4a6365ae88d38528b4eec717326dab877b515ea Merge: fe70da5a325c fc6a15c85308 Author: Linus Torvalds Date: Mon Feb 3 22:10:18 2020 +0000 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "There are a few changes to the core framework this time around, in addition to the normal collection of driver updates to support new SoCs, fix incorrect data, and convert various drivers to clk_hw based APIs. In the core, we allow clk_ops::init() to return an error code now so that we can fail clk registration if the callback does something like fail to allocate memory. We also add a new "terminate" clk_op so that things done in clk_ops::init() can be undone, e.g. free memory. We also spit out a warning now when critical clks fail to enable and we support changing clk rates and enable/disable state through debugfs when developers compile the kernel themselves. On the driver front, we get support for what seems like a lot of Qualcomm and NXP SoCs given that those vendors dominate the diffstat. There are a couple new drivers for Xilinx and Amlogic SoCs too. The updates are all small things like fixing the way glitch free muxes switch parents, avoiding div-by-zero problems, or fixing data like parent names. See the updates section below for more details. Finally, the "basic" clk types have been converted to support specifying parents with clk_hw pointers. This work includes an overhaul of the fixed-rate clk type to be more modern by using clk_hw APIs. Core: - Let clk_ops::init() return an error code - Add a clk_ops::terminate() callback to undo clk_ops::init() - Warn about critical clks that fail to enable or prepare - Support dangerous debugfs actions on clks with dead code New Drivers: - Support for Xilinx Versal platform clks - Display clk controller on qcom sc7180 - Video clk controller on qcom sc7180 - Graphics clk controller on qcom sc7180 - CPU PLLs for qcom msm8916 - Move qcom msm8974 gfx3d clk to RPM control - Display port clk support on qcom sdm845 SoCs - Global clk controller on qcom ipq6018 - Add a driver for BCLK of Freescale SAI cores - Add cam, vpe and sgx clock support for TI dra7 - Add aess clock support for TI omap5 - Enable clks for CPUfreq on Allwinner A64 SoCs - Add Amlogic meson8b DDR clock controller - Add input clocks to Amlogic meson8b controllers - Add SPIBSC (SPI FLASH) clock on Renesas RZ/A2 - i.MX8MP clk driver support Updates: - Convert gpio, fixed-factor, mux, gate, divider basic clks to hw based APIs - Detect more PRMCU variants in ux500 driver - Adjust the composite clk type to new way of describing clk parents - Fixes for clk controllers on qcom msm8998 SoCs - Fix gmac main clock for TI dra7 - Move TI dra7-atl clock header to correct location - Fix hidden node name dependency on TI clkctrl clocks - Fix Amlogic meson8b mali clock update using the glitch free mux - Fix Amlogic pll driver division by zero at init - Prepare for split of Renesas R-Car H3 ES1.x and ES2.0+ config symbols - Switch more i.MX clk drivers to clk_hw based APIs - Disable non-functional divider between pll4_audio_div and pll4_post_div on imx6q - Fix watchdog2 clock name typo in imx7ulp clock driver - Set CLK_GET_RATE_NOCACHE flag for DRAM related clocks on i.MX8M SoCs - Suppress bind attrs for i.MX8M clock driver - Add a big comment in imx8qxp-lpcg driver to tell why devm_platform_ioremap_resource() shouldn't be used for the driver - A correction on i.MX8MN usb1_ctrl parent clock setting" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (140 commits) dt/bindings: clk: fsl,plldig: Drop 'bindings' from schema id clk: ls1028a: Fix warning on clamp() usage clk: qoriq: add ls1088a hwaccel clocks support clk: ls1028a: Add clock driver for Display output interface dt/bindings: clk: Add YAML schemas for LS1028A Display Clock bindings clk: fsl-sai: new driver dt-bindings: clock: document the fsl-sai driver clk: composite: add _register_composite_pdata() variants clk: qcom: rpmh: Sort OF match table dt-bindings: fix warnings in validation of qcom,gcc.yaml dt-binding: fix compilation error of the example in qcom,gcc.yaml clk: zynqmp: Add support for clock with CLK_DIVIDER_POWER_OF_TWO flag clk: zynqmp: Fix divider calculation clk: zynqmp: Add support for get max divider clk: zynqmp: Warn user if clock user are more than allowed clk: zynqmp: Extend driver for versal dt-bindings: clock: Add bindings for versal clock driver clk: ti: clkctrl: Fix hidden dependency to node name clk: ti: add clkctrl data dra7 sgx clk: ti: omap5: Add missing AESS clock ... commit fe70da5a325c1ac860d463ca802dae6a8bb05e21 Merge: d4e9056daedc b19efcabb587 Author: Linus Torvalds Date: Mon Feb 3 22:05:15 2020 +0000 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a driver for SGI IOC3 PS/2 controller - updates to driver for FocalTech FT5x06 series touch screen controllers - other assorted fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics-rmi4 - switch to reduced reporting mode dt-bindings: touchscreen: Convert Goodix touchscreen to json-schema dt-bindings: touchscreen: Add touchscreen schema Input: add IOC3 serio driver Input: axp20x-pek - enable wakeup for all AXP variants Input: axp20x-pek - respect userspace wakeup configuration Input: ads7846 - use new `delay` structure for SPI transfer delays Input: edt-ft5x06 - use pm core to enable/disable the wake irq Input: edt-ft5x06 - make wakeup-source switchable Input: edt-ft5x06 - document wakeup-source capability Input: edt-ft5x06 - alphabetical include reorder Input: edt-ft5x06 - work around first register access error Input: apbps2 - add __iomem to register struct Input: axp20x-pek - make device attributes static Input: elants_i2c - check Remark ID when attempting firmware update commit 84669923e1edf30f55e71fce9f831242502372c9 Author: Helge Deller Date: Mon Feb 3 22:31:22 2020 +0100 parisc: Regenerate parisc defconfigs Regenerate the 32- and 64-bit defconfigs and drop the outdated specific machine defconfigs for the 712, A500, B160, C3000 and C8000 workstations. Signed-off-by: Helge Deller commit 93a6ab7b691fe33d5a30e7fc8e85276de2815108 Author: Trond Myklebust Date: Sun Feb 2 17:53:56 2020 -0500 NFS: Switch readdir to using iterate_shared() Now that the page cache locking is repaired, we should be able to switch to using iterate_shared() for improved concurrency when doing readdir(). Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 3803d6721baff3d5dd6cd6b8c7294e54d124bc41 Author: Trond Myklebust Date: Sun Feb 2 17:53:55 2020 -0500 NFS: Use kmemdup_nul() in nfs_readdir_make_qstr() The directory strings stored in the readdir cache may be used with printk(), so it is better to ensure they are nul-terminated. Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 114de38225d9b300f027e2aec9afbb6e0def154b Author: Trond Myklebust Date: Sun Feb 2 17:53:54 2020 -0500 NFS: Directory page cache pages need to be locked when read When a NFS directory page cache page is removed from the page cache, its contents are freed through a call to nfs_readdir_clear_array(). To prevent the removal of the page cache entry until after we've finished reading it, we must take the page lock. Fixes: 11de3b11e08c ("NFS: Fix a memory leak in nfs_readdir") Cc: stable@vger.kernel.org # v2.6.37+ Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 4b310319c6a8ce708f1033d57145e2aa027a883c Author: Trond Myklebust Date: Sun Feb 2 17:53:53 2020 -0500 NFS: Fix memory leaks and corruption in readdir nfs_readdir_xdr_to_array() must not exit without having initialised the array, so that the page cache deletion routines can safely call nfs_readdir_clear_array(). Furthermore, we should ensure that if we exit nfs_readdir_filler() with an error, we free up any page contents to prevent a leak if we try to fill the page again. Fixes: 11de3b11e08c ("NFS: Fix a memory leak in nfs_readdir") Cc: stable@vger.kernel.org # v2.6.37+ Signed-off-by: Trond Myklebust Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 7ccbddbe3e67591a02ddd20078d1241bd8fe79f3 Author: Trond Myklebust Date: Sun Feb 2 17:57:08 2020 -0500 SUNRPC: Use kmemdup_nul() in rpc_parse_scope_id() Using kmemdup_nul() is more efficient when the length is known. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit a8bd9ddf397be8e0d812ce3da4e40440ac25f6d0 Author: Trond Myklebust Date: Sun Feb 2 17:57:07 2020 -0500 NFS: Replace various occurrences of kstrndup() with kmemdup_nul() When we already know the string length, it is more efficient to use kmemdup_nul(). Signed-off-by: Trond Myklebust [Anna - Changes to super.c were already made during fscontext conversion] Signed-off-by: Anna Schumaker commit 10717f45639f6c1bc27b56405252c3a027406d92 Author: Trond Myklebust Date: Mon Jan 27 09:58:19 2020 -0500 NFSv4: Limit the total number of cached delegations Delegations can be expensive to return, and can cause scalability issues for the server. Let's therefore try to limit the number of inactive delegations we hold. Once the number of delegations is above a certain threshold, start to return them on close. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit d2269ea14ebd2a73f291d6b3a7a7d320ec00270c Author: Trond Myklebust Date: Mon Jan 27 09:58:18 2020 -0500 NFSv4: Add accounting for the number of active delegations held In order to better manage our delegation caching, add a counter to track the number of active delegations. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit b7b7dac6843e483b6fe8e29cef99e3dbb7594a53 Author: Trond Myklebust Date: Mon Jan 27 09:58:17 2020 -0500 NFSv4: Try to return the delegation immediately when marked for return on close Add a routine to return the delegation immediately upon close of the file if it was marked for return-on-close. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 0d10416797c27b9e359d4bd94fb9db6f34f25d83 Author: Trond Myklebust Date: Mon Jan 27 09:58:16 2020 -0500 NFS: Clear NFS_DELEGATION_RETURN_IF_CLOSED when the delegation is returned If a delegation is marked as needing to be returned when the file is closed, then don't clear that marking until we're ready to return it. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit f885ea640d65d98c8f1a326efb3abe13f1865c89 Author: Trond Myklebust Date: Mon Jan 27 09:58:15 2020 -0500 NFSv4: nfs_inode_evict_delegation() should set NFS_DELEGATION_RETURNING In particular, the pnfs return-on-close code will check for that flag, so ensure we set it appropriately. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 65f5160376212094b477c7309ba9867e69ec69d5 Author: Trond Myklebust Date: Sun Jan 26 17:31:15 2020 -0500 NFS: nfs_find_open_context() should use cred_fscmp() We want to find open contexts that match our filesystem access properties. They don't have to exactly match the cred. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 9a206de2ea878f4502e86b81c0d7eb9b651bde82 Author: Trond Myklebust Date: Sun Jan 26 17:31:14 2020 -0500 NFS: nfs_access_get_cached_rcu() should use cred_fscmp() We do not need to have the rcu lookup method fail in the case where the fsuid/fsgid and supplemental groups match. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 387122478775be5d9816c34aa29de53d0b926835 Author: Trond Myklebust Date: Sun Jan 26 17:31:13 2020 -0500 NFSv4: pnfs_roc() must use cred_fscmp() to compare creds When comparing two 'struct cred' for equality w.r.t. behaviour under filesystem access, we need to use cred_fscmp(). Fixes: a52458b48af1 ("NFS/NFSD/SUNRPC: replace generic creds with 'struct cred'.") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 2a8aa18c113124434a32c1bd01054d67f799e4ee Author: Douglas Anderson Date: Mon Feb 3 09:49:43 2020 -0800 dt-bindings: clk: qcom: Fix self-validation, split, and clean cruft The 'qcom,gcc.yaml' file failed self-validation (dt_binding_check) because it required a property to be either (3 entries big), (3 entries big), or (7 entries big), but not more than one of those things. That didn't make a ton of sense. This patch splits all of the exceptional device trees (AKA those that would have needed if/then/else rules) from qcom,gcc.yaml. It also cleans up some cruft found while doing that. After this lands, this worked for me atop clk-next with just the known error about msm8998: for f in \ Documentation/devicetree/bindings/clock/qcom,gcc-apq8064.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-ipq8074.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-msm8996.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-msm8998.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-qcs404.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-sc7180.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc-sm8150.yaml \ Documentation/devicetree/bindings/clock/qcom,gcc.yaml; do \ ARCH=arm64 make dtbs_check DT_SCHEMA_FILES=$f; \ done I then picked this patch atop linux-next (next-20200129) and ran: # Delete broken yaml: rm Documentation/devicetree/bindings/pci/intel-gw-pcie.yaml ARCH=arm64 make dt_binding_check | grep 'clock/qcom' ...and that didn't seem to indicate problems. Arbitrary decisions made (yell if you want changed): - Left all the older devices (where clocks / clock-names weren't specified) in a single file. - Didn't make clocks "required" for msm8996 but left them as listed. This seems a little weird but it matches the old binding. Misc cleanups as part of this patch: - Fixed schema id to not have "bindings/" as per Rob [1]. - Listed include files as per Stephen. - sm8150 was claimed to be same set of clocks as sc7180, but driver and dts appear to say that "bi_tcxo_ao" doesn't exist. Fixed. - In "apq8064", "#thermal-sensor-cells" was missing the "#". - Got rid of "|" at the end of top description since spacing doesn't matter. - Changed indentation to consistently 2 spaces (it was 3 in some places). - Added period at the end of protected-clocks description. - No space before ":". - Updated sc7180/sm8150 example to use the 'qcom,rpmh.h' include. - Updated sc7180/sm8150 example to use larger address/size cells as per reality. - Updated sc7180/sm8150 example to point to the sleep_clk rather than <0>. - Made it so that gcc-ipq8074 didn't require #power-domain-cells since actual dts didn't have it and I got no hits from: git grep _GDSC include/dt-bindings/clock/qcom,gcc-ipq8074.h - Made it so that gcc-qcs404 didn't require #power-domain-cells since actual dts didn't have it and I got no hits from: git grep _GDSC include/dt-bindings/clock/qcom,gcc-qcs404.h Noticed, but not done in this patch (volunteers needed): - Add "aud_ref_clk" to sm8150 bindings / dts even though I found a reference to it in "gcc-sm8150.c". - Fix node name in actual ipq8074 to be "clock-controller" (it's gcc). - Since the example doesn't need phandes to exist, in msm8998 could just make up places providing some of the clocks currently bogused out with <0>. - On msm8998 clocks are listed as required but current dts doesn't have them. [1] https://lore.kernel.org/r/CAL_Jsq+_2E-bAbP9F6VYkWRp0crEyRGa5peuwP58-PZniVny7w@mail.gmail.com Fixes: ab91f72e018a ("clk: qcom: gcc-msm8996: Fix parent for CLKREF clocks") Signed-off-by: Douglas Anderson Reviewed-by: Rob Herring Reviewed-by: Jeffrey Hugo Link: https://lkml.kernel.org/r/20200203094843.v3.1.I4452dc951d7556ede422835268742b25a18b356b@changeid Signed-off-by: Stephen Boyd commit 21e157c62eeded8b1558a991b4820b761d48a730 Author: Stephen Boyd Date: Tue Jan 28 11:33:29 2020 -0800 clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq() The DFS frequency table logic overwrites 'cfg' while detecting the parent clk and then later on in clk_rcg2_dfs_populate_freq() we use that same variable to figure out the mode of the clk, either MND or not. Add a new variable to hold the parent clk bit so that 'cfg' is left untouched for use later. This fixes problems in detecting the supported frequencies for any clks in DFS mode. Fixes: cc4f6944d0e3 ("clk: qcom: Add support for RCG to register for DFS") Reported-by: Rajendra Nayak Signed-off-by: Stephen Boyd Link: https://lkml.kernel.org/r/20200128193329.45635-1-sboyd@kernel.org Tested-by: Rajendra Nayak commit fc6a15c853085f04c30e08bbba7d49cb611f7773 Author: Stephen Boyd Date: Sun Feb 2 21:25:07 2020 -0800 dt/bindings: clk: fsl,plldig: Drop 'bindings' from schema id Having 'bindings' in here causes a warning when checking the schema. Documentation/devicetree/bindings/clock/fsl,plldig.yaml: $id: relative path/filename doesn't match actual path or filename expected: http://devicetree.org/schemas/clock/fsl,plldig.yaml# Remove it. Cc: Rob Herring Cc: Wen He Signed-off-by: Stephen Boyd Link: https://lkml.kernel.org/r/20200203052507.93215-2-sboyd@kernel.org Acked-by: Rob Herring commit 0d152f2db535c207d1ea5bee62ff889f9d850a25 Author: Stephen Boyd Date: Sun Feb 2 21:25:06 2020 -0800 clk: ls1028a: Fix warning on clamp() usage These constants are used in clamp() with the value being clamped an unsigned long. Make them unsigned long defines so that clamp() doesn't complain about comparing different types. In file included from include/linux/list.h:9, from include/linux/kobject.h:19, from include/linux/of.h:17, from include/linux/clk-provider.h:9, from drivers/clk/clk-plldig.c:8: drivers/clk/clk-plldig.c: In function 'plldig_determine_rate': include/linux/kernel.h:835:29: warning: comparison of distinct pointer types lacks a cast 835 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | Reported-by: Stephen Rothwell Cc: Wen He Fixes: d37010a3c162 ("clk: ls1028a: Add clock driver for Display output interface") Signed-off-by: Stephen Boyd Link: https://lkml.kernel.org/r/20200203052507.93215-1-sboyd@kernel.org commit 3d80c653f99658af6af3ac1b74f70bf9a069e71f Merge: 83d0585f91da 5273a191dca6 Author: Jakub Kicinski Date: Mon Feb 3 10:26:23 2020 -0800 Merge tag 'rxrpc-fixes-20200203' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== RxRPC fixes Here are a number of fixes for AF_RXRPC: (1) Fix a potential use after free in rxrpc_put_local() where it was accessing the object just put to get tracing information. (2) Fix insufficient notifications being generated by the function that queues data packets on a call. This occasionally causes recvmsg() to stall indefinitely. (3) Fix a number of packet-transmitting work functions to hold an active count on the local endpoint so that the UDP socket doesn't get destroyed whilst they're calling kernel_sendmsg() on it. (4) Fix a NULL pointer deref that stemmed from a call's connection pointer being cleared when the call was disconnected. Changes: v2: Removed a couple of BUG() statements that got added. ==================== Signed-off-by: Jakub Kicinski commit ebe8e6116ac49d182b060f843904caf5eacf5b87 Author: Chin-Yen Lee Date: Mon Feb 3 14:01:57 2020 +0800 rtw88: Fix return value of rtw_wow_check_fw_status Clang warns that ret is used uninitialzed. And we found that actually the return type should be "int" instead of "bool". Fixes: 44bc17f7f5b3 ("rtw88: support wowlan feature for 8822c") Link: https://github.com/ClangBuiltLinux/linux/issues/850 Reported-by: Nathan Chancellor Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor # build Signed-off-by: Kalle Valo commit 577ddbee1f43a355cc733829da96c8ffb3b99cc5 Author: Mordechay Goodstein Date: Fri Jan 31 15:45:30 2020 +0200 iwlwifi: d3: read all FW CPUs error info Continue the wakeup flow only if no FW CPUs have an error If we don't check for error in all FW CPUs the driver can think based on one CPU that the FW is operational and try to access and send commands. Also, handle the error_id endianness correctly as le32 Signed-off-by: Mordechay Goodstein Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit b5b878e36c1836c0195575132cc7c199e5a34a7b Author: Emmanuel Grumbach Date: Fri Jan 31 15:45:29 2020 +0200 iwlwifi: mvm: fix TDLS discovery with the new firmware API I changed the API for asking for a session protection but I omitted the TDLS flows. Fix that now. Note that for the TDLS flow, we need to block until the session protection actually starts, so add this option to iwl_mvm_schedule_session_protection. This patch fixes a firmware assert in the TDLS flow since the old TIME_EVENT_CMD is not supported anymore by newer firwmare versions. Signed-off-by: Emmanuel Grumbach Fixes: fe959c7b2049 ("iwlwifi: mvm: use the new session protection command") Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 12d47f0ea5e0aa63f19ba618da55a7c67850ca10 Author: Andrei Otcheretianski Date: Fri Jan 31 15:45:28 2020 +0200 iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta() Fix a kernel panic by checking that the sta is not NULL. This could happen during a reconfig flow, as mac80211 moves the sta between all the states without really checking if the previous state was successfully set. So, if for some reason we failed to add back the station, subsequent calls to sta_state() callback will be done when the station is NULL. This would result in a following panic: BUG: unable to handle kernel NULL pointer dereference at 0000000000000040 IP: iwl_mvm_cfg_he_sta+0xfc/0x690 [iwlmvm] [..] Call Trace: iwl_mvm_mac_sta_state+0x629/0x6f0 [iwlmvm] drv_sta_state+0xf4/0x950 [mac80211] ieee80211_reconfig+0xa12/0x2180 [mac80211] ieee80211_restart_work+0xbb/0xe0 [mac80211] process_one_work+0x1e2/0x610 worker_thread+0x4d/0x3e0 [..] Signed-off-by: Andrei Otcheretianski Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit cc4255eff523f25187bb95561642941de0e57497 Author: Avraham Stern Date: Fri Jan 31 15:45:27 2020 +0200 iwlwifi: mvm: avoid use after free for pmsr request When a FTM request is aborted, the driver sends the abort command to the fw and waits for a response. When the response arrives, the driver calls cfg80211_pmsr_complete() for that request. However, cfg80211 frees the requested data immediately after sending the abort command, so this may lead to use after free. Fix it by clearing the request data in the driver when the abort command arrives and ignoring the fw notification that will come afterwards. Signed-off-by: Avraham Stern Fixes: fc36ffda3267 ("iwlwifi: mvm: support FTM initiator") Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 6bd5fa332a8c24c8b9079a70c44240b61858fab8 Author: Golan Ben Ami Date: Fri Jan 31 15:45:26 2020 +0200 iwlwifi: mvm: update the DTS measurement type Till now, the driver asked the fw for a DTS measurement in automatic mode. This triggered a flow in which the fw actively measured the temperature. This is not needed anymore, as the fw performs measurements by itself, without the driver triggering them, and the current cadence in which the fw performs such measurements is sufficient. In addition, in some time-sensitive scenarios, in which the driver asks the fw for an active measurement twice in a short time (<100ms), the fw asserts with code 0x20100801. Change the DTS measurement to _WITHOUT_MEASURE instead, so the fw will respond with the last measurement it has performed. Signed-off-by: Golan Ben Ami Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 197288d5ba8a5289f22d3aeb4fca3824bfd9b4af Author: Luca Coelho Date: Fri Jan 31 15:45:25 2020 +0200 iwlwifi: don't throw error when trying to remove IGTK The IGTK keys are only removed by mac80211 after it has already removed the AP station. This causes the driver to throw an error because mac80211 is trying to remove the IGTK when the station doesn't exist anymore. The firmware is aware that the station has been removed and can deal with it the next time we try to add an IGTK for a station, so we shouldn't try to remove the key if the station ID is IWL_MVM_INVALID_STA. Do this by removing the check for mvm_sta before calling iwl_mvm_send_sta_igtk() and check return from that function gracefully if the station ID is invalid. Cc: stable@vger.kernel.org # 4.12+ Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit baa6cf8450b72dcab11f37c47efce7c5b9b8ad0f Author: Andrei Otcheretianski Date: Fri Jan 31 15:45:24 2020 +0200 iwlwifi: mvm: Fix thermal zone registration Use a unique name when registering a thermal zone. Otherwise, with multiple NICS, we hit the following warning during the unregistration. WARNING: CPU: 2 PID: 3525 at fs/sysfs/group.c:255 RIP: 0010:sysfs_remove_group+0x80/0x90 Call Trace: dpm_sysfs_remove+0x57/0x60 device_del+0x5a/0x350 ? sscanf+0x4e/0x70 device_unregister+0x1a/0x60 hwmon_device_unregister+0x4a/0xa0 thermal_remove_hwmon_sysfs+0x175/0x1d0 thermal_zone_device_unregister+0x188/0x1e0 iwl_mvm_thermal_exit+0xe7/0x100 [iwlmvm] iwl_op_mode_mvm_stop+0x27/0x180 [iwlmvm] _iwl_op_mode_stop.isra.3+0x2b/0x50 [iwlwifi] iwl_opmode_deregister+0x90/0xa0 [iwlwifi] __exit_compat+0x10/0x2c7 [iwlmvm] __x64_sys_delete_module+0x13f/0x270 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Signed-off-by: Andrei Otcheretianski Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit cfa27356f835dc7755192e7b941d4f4851acbcc7 Author: Christoph Hellwig Date: Thu Jan 30 19:40:24 2020 +0100 nvme-pci: remove nvmeq->tags There is no real need to have a pointer to the tagset in struct nvme_queue, as we only need it in a single place, and that place can derive the used tagset from the device and qid trivially. This fixes a problem with stale pointer exposure when tagsets are reset, and also shrinks the nvme_queue structure. It also matches what most other transports have done since day 1. Reported-by: Edmund Nadolski Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch commit b716e6889c95f64ba32af492461f6cc9341f3f05 Author: Sagi Grimberg Date: Sun Jan 26 23:23:28 2020 -0800 nvmet: fix dsm failure when payload does not match sgl descriptor The host is allowed to pass the controller an sgl describing a buffer that is larger than the dsm payload itself, allow it when executing dsm. Reported-by: Dakshaja Uppalapati Reviewed-by: Christoph Hellwig , Reviewed-by: Max Gurtovoy Signed-off-by: Sagi Grimberg Signed-off-by: Keith Busch commit 4ac76436a6d07dec1c3c766f234aa787a16e8f65 Author: Amol Grover Date: Sat Jan 11 13:08:16 2020 +0530 nvmet: Pass lockdep expression to RCU lists ctrl->subsys->namespaces and subsys->namespaces are traversed with list_for_each_entry_rcu outside an RCU read-side critical section but under the protection of ctrl->subsys->lock and subsys->lock respectively. Hence, add the corresponding lockdep expression to the list traversal primitive to silence false-positive lockdep warnings, and harden RCU lists. Reported-by: kbuild test robot Reviewed-by: Joel Fernandes (Google) Signed-off-by: Amol Grover Signed-off-by: Keith Busch commit d4e9056daedca3891414fe3c91de3449a5dad0f2 Author: Masahiro Yamada Date: Tue Feb 4 01:47:08 2020 +0900 initramfs: do not show compression mode choice if INITRAMFS_SOURCE is empty Since commit ddd09bcc899f ("initramfs: make compression options not depend on INITRAMFS_SOURCE"), Kconfig asks the compression mode for the built-in initramfs regardless of INITRAMFS_SOURCE. It is technically simpler, but pointless from a UI perspective, Linus says [1]. When INITRAMFS_SOURCE is empty, usr/Makefile creates a tiny default cpio, which is so small that nobody cares about the compression. This commit hides the Kconfig choice in that case. The default cpio is embedded without compression, which was the original behavior. [1]: https://lkml.org/lkml/2020/2/1/160 Suggested-by: Linus Torvalds Signed-off-by: Masahiro Yamada Signed-off-by: Linus Torvalds commit ad801428366ebbd541a5b8a1bf4d8b57ee7a8200 Merge: e17ac02b18c6 d55966c4279b Author: Linus Torvalds Date: Mon Feb 3 17:03:42 2020 +0000 Merge tag 'for-5.6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull more btrfs updates from David Sterba: "Fixes that arrived after the merge window freeze, mostly stable material. - fix race in tree-mod-log element tracking - fix bio flushing inside extent writepages - fix assertion when in-memory tracking of discarded extents finds an empty tree (eg. after adding a new device) - update logic of temporary read-only block groups to take into account overcommit - fix some fixup worker corner cases: - page could not go through proper COW cycle and the dirty status is lost due to page migration - deadlock if delayed allocation is performed under page lock - fix send emitting invalid clones within the same file - fix statfs reporting 0 free space when global block reserve size is larger than remaining free space but there is still space for new chunks" * tag 'for-5.6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: do not zero f_bavail if we have available space Btrfs: send, fix emission of invalid clone operations within the same file btrfs: do not do delalloc reservation under page lock btrfs: drop the -EBUSY case in __extent_writepage_io Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker btrfs: take overcommit into account in inc_block_group_ro btrfs: fix force usage in inc_block_group_ro btrfs: Correctly handle empty trees in find_first_clear_extent_bit btrfs: flush write bio if we loop in extent_write_cache_pages Btrfs: fix race between adding and putting tree mod seq elements and nodes commit e17ac02b18c61f0d5f85c6ec9e49f3ff00b2b3cd Merge: 754beeec1d90 dc2c733e6584 Author: Linus Torvalds Date: Mon Feb 3 16:59:51 2020 +0000 Merge tag 'kgdb-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Everything for kgdb this time around is either simplifications or clean ups. In particular Douglas Anderson's modifications to the backtrace machine in the *last* dev cycle have enabled Doug to tidy up some MIPS specific backtrace code and stop sharing certain data structures across the kernel. Note that The MIPS folks were on Cc: for the MIPS patch and reacted positively (but without an explicit Acked-by). Doug also got rid of the implicit switching between tasks and register sets during some but not of kdb's backtrace actions (because the implicit switching was either confusing for users, pointless or both). Finally there is a coverity fix and patch to replace open coded console traversal with the proper helper function" * tag 'kgdb-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: Use for_each_console() helper kdb: remove redundant assignment to pointer bp kdb: Get rid of confusing diag msg from "rd" if current task has no regs kdb: Gid rid of implicit setting of the current task / regs kdb: kdb_current_task shouldn't be exported kdb: kdb_current_regs should be private MIPS: kdb: Remove old workaround for backtracing on other CPUs commit 8d60526999aace135de37220ec94ba40bc792234 Author: Masahiro Yamada Date: Sun Feb 2 14:09:21 2020 +0900 scripts/kallsyms: change table to store (strcut sym_entry *) The symbol table is extended every 10000 addition by using realloc(), where data copy might occur to the new buffer. To decrease the amount of possible data copy, let's change the table to store the pointer. The symbol type + symbol name part is appended at the end of (struct sym_entry), and allocated together with the struct body. Signed-off-by: Masahiro Yamada commit be9f6133f8770bb9c5f4a3cb3df6d30d7d3f7e5b Author: Masahiro Yamada Date: Sun Feb 2 14:09:20 2020 +0900 scripts/kallsyms: rename local variables in read_symbol() I will use 'sym' for the point to struce sym_entry in the next commit. Rename 'sym', 'stype' to 'name', 'type', which are more intuitive. Signed-off-by: Masahiro Yamada commit 5f2fb52fac15a8a8e10ce020dd532504a8abfc4e Author: Masahiro Yamada Date: Sun Feb 2 01:49:24 2020 +0900 kbuild: rename hostprogs-y/always to hostprogs/always-y In old days, the "host-progs" syntax was used for specifying host programs. It was renamed to the current "hostprogs-y" in 2004. It is typically useful in scripts/Makefile because it allows Kbuild to selectively compile host programs based on the kernel configuration. This commit renames like follows: always -> always-y hostprogs-y -> hostprogs So, scripts/Makefile will look like this: always-$(CONFIG_BUILD_BIN2C) += ... always-$(CONFIG_KALLSYMS) += ... ... hostprogs := $(always-y) $(always-m) I think this makes more sense because a host program is always a host program, irrespective of the kernel configuration. We want to specify which ones to compile by CONFIG options, so always-y will be handier. The "always", "hostprogs-y", "hostprogs-m" will be kept for backward compatibility for a while. Signed-off-by: Masahiro Yamada commit faa7bdd7e9e1441ed82819b8db8bb43d3d3fd818 Author: Masahiro Yamada Date: Sun Feb 2 01:49:23 2020 +0900 kbuild: fix the document to use extra-y for vmlinux.lds The difference between "always" and "extra-y" is that the targets listed in $(always) are always built, whereas the ones in $(extra-y) are built only when KBUILD_BUILTIN is set. So, "make modules" does not build the targets in $(extra-y). vmlinux.lds is only needed for linking vmlinux. So, adding it to extra-y is more correct. In fact, arch/x86/kernel/Makefile does this. Fix the example code. Signed-off-by: Masahiro Yamada commit c8fb7d7e48d11520ad24808cfce7afb7b9c9f798 Author: Masahiro Yamada Date: Sat Feb 1 14:03:11 2020 +0900 kconfig: fix broken dependency in randconfig-generated .config Running randconfig on arm64 using KCONFIG_SEED=0x40C5E904 (e.g. on v5.5) produces the .config with CONFIG_EFI=y and CONFIG_CPU_BIG_ENDIAN=y, which does not meet the !CONFIG_CPU_BIG_ENDIAN dependency. This is because the user choice for CONFIG_CPU_LITTLE_ENDIAN vs CONFIG_CPU_BIG_ENDIAN is set by randomize_choice_values() after the value of CONFIG_EFI is calculated. When this happens, the has_changed flag should be set. Currently, it takes the result from the last iteration. It should accumulate all the results of the loop. Fixes: 3b9a19e08960 ("kconfig: loop as long as we changed some symbols in randconfig") Reported-by: Vincenzo Frascino Signed-off-by: Masahiro Yamada commit 034dbec179e5d2820480f477c43acbc50245e56d Author: Enric Balletbo i Serra Date: Wed Jan 22 10:07:01 2020 +0100 platform/chrome: cros_ec: Match implementation with headers The 'cros_ec' core driver is the common interface for the cros_ec transport drivers to do the shared operations to register, unregister, suspend, resume and handle_event. The interface is provided by including the header 'include/linux/platform_data/cros_ec_proto.h', however, instead of have the implementation of these functions in cros_ec_proto.c, it is in 'cros_ec.c', which is a different kernel module. Apart from being a bad practice, this can induce confusions allowing the users of the cros_ec protocol to call these functions. The register, unregister, suspend, resume and handle_event functions *should* only be called by the different transport drivers (i2c, spi, lpc, etc.), so make this a bit less confusing by moving these functions from the public in-kernel space to a private include in platform/chrome, and then, the interface for cros_ec module and for the cros_ec_proto module is clean. Signed-off-by: Enric Balletbo i Serra Signed-off-by: Benson Leung commit 183edb20e60a73925bf3b60e2f4796898167262f Author: Yangtao Li Date: Mon Feb 3 15:45:17 2020 +0000 cpufreq: Make cpufreq_global_kobject static The cpufreq_global_kobject is only used internally by cpufreq.c after commit 2361be236662 ("cpufreq: Don't create empty /sys/devices/system/cpu/cpufreq directory"). Make it static. Signed-off-by: Yangtao Li [ rjw: Add empty line after cpufreq_global_kobject definition ] Signed-off-by: Rafael J. Wysocki commit c0399cf668a2a1b7310dbedd424f6a4b60aabffc Author: Alex Shi Date: Tue Jan 21 16:49:56 2020 +0800 NFS: remove unused macros MNT_fhs_status_sz/MNT_fhandle3_sz are never used after they were introduced. So better to remove them. Signed-off-by: Alex Shi Cc: Trond Myklebust Cc: Anna Schumaker Cc: linux-nfs@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Anna Schumaker commit 754beeec1d9024eef0db8dc4be2636331dd413c6 Merge: 2367da5b51cd 98c49f1746ac Author: Linus Torvalds Date: Mon Feb 3 14:57:33 2020 +0000 Merge tag 'char-misc-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fix from Greg KH: "Here is a single patch, that fixes up a commit that came in the previous char/misc merge. It fixes a bug in the hpet driver that everyone keeps tripping over in their automated testing. Good thing is, people are catching it. Bad thing it wasn't caught by anyone testing before this. Oh well... This has been in linux-next for a few days with no reported issues" * tag 'char-misc-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: char: hpet: Fix out-of-bounds read bug commit 2367da5b51cd2819d630432e6a8876f973b1bbc3 Merge: af32f3a414d3 7af43a76695d Author: Linus Torvalds Date: Mon Feb 3 14:55:08 2020 +0000 Merge tag 'backlight-next-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Fix-ups: - Remove superfluous code in ams369fg06 - Convert over to GPIO descriptor (gpiod) in bd6107 Bug Fixes: - Fix unsigned comparison to less than zero in qcom-wled" * tag 'backlight-next-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: qcom-wled: Fix unsigned comparison to zero backlight: bd6107: Convert to use GPIO descriptor backlight: ams369fg06: Drop GPIO include commit af32f3a414d340b0ab92e88ffb80a19632ff345e Merge: d0fa9250317f 5312f321a67c Author: Linus Torvalds Date: Mon Feb 3 14:51:57 2020 +0000 Merge tag 'mfd-next-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - Add support for ROHM BD71828 PMICs and GPIOs - Add support for Qualcomm Aqstic Audio Codecs WCD9340 and WCD9341 New Device Support: - Add support for BD71828 to BD70528 RTC driver - Add support for Intel's Jasper Lake to LPSS PCI New Functionality: - Add support for Power Key to ROHM BD71828 - Add support for Clocks to ROHM BD71828 - Add support for GPIOs to Dialog DA9062 - Add support for USB PD Notify to ChromiumOS EC - Allow callers to specify args when requesting regmap lookup; syscon Fix-ups: - Improve error handling and sanity checking; atmel-hlcdc, dln2 - Device Tree support/documentation; bd71828, da9062, xylon,logicvc, ab8500, max14577, atmel-usart - Match devices using platform IDs; bd7xxxx - Refactor BD718x7 regulator component; bd718x7-regulator - Use standard interfaces/helpers; syscon, sm501 - Trivial (whitespace, spelling, etc); ab8500-core, Kconfig - Remove unused code; db8500-prcmu, tqmx86 - Wait until boot has finished before accessing registers; madera-core - Provide missing register value defaults; cs47l15-tables - Allow more time for hardware to reset; madera-core Bug Fixes: - Fix erroneous register values; rohm-bd70528 - Fix register volatility; axp20x, rn5t618 - Fix Kconfig dependencies; MFD_MAX77650 - Fix incorrect compatible string; da9062-core - Fix syscon_regmap_lookup_by_phandle_args() stub; syscon" * tag 'mfd-next-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits) mfd: syscon: Fix syscon_regmap_lookup_by_phandle_args() dummy mfd: wcd934x: Add support to wcd9340/wcd9341 codec mfd: syscon: Add arguments support for syscon reference mfd: rn5t618: Mark ADC control register volatile dt-bindings: atmel-usart: Add microchip,sam9x60-{usart, dbgu} dt-bindings: atmel-usart: Remove wildcard mfd: cros_ec: Add cros-usbpd-notify subdevice mfd: da9062: Fix watchdog compatible string mfd: madera: Allow more time for hardware reset mfd: cs47l15: Add missing register default mfd: madera: Wait for boot done before accessing any other registers mfd: Kconfig: Rename Samsung to lowercase mfd: tqmx86: remove set but not used variable 'i2c_ien' mfd: dbx500-prcmu: Drop DSI pll clock functions mfd: dbx500-prcmu: Drop set_display_clocks() mfd: max77650: Select REGMAP_IRQ in Kconfig mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile mfd: ab8500: Fix ab8500-clk typo mfd: intel-lpss: Add Intel Jasper Lake PCI IDs dt-bindings: mfd: max14577: Add reference to max14040_battery.txt descriptions ... commit d0fa9250317ff6e92a1397ebf7cf4d83014f38a6 Merge: 46d6b7becb1d 54e19d34011f Author: Linus Torvalds Date: Mon Feb 3 14:42:03 2020 +0000 Merge tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V updates from Sasha Levin: - Most of the commits here are work to enable host-initiated hibernation support by Dexuan Cui. - Fix for a warning shown when host sends non-aligned balloon requests by Tianyu Lan. * tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: hv_utils: Add the support of hibernation hv_utils: Support host-initiated hibernation request hv_utils: Support host-initiated restart request Tools: hv: Reopen the devices if read() or write() returns errors video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs. Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) video: hyperv_fb: Fix hibernation for the deferred IO feature Input: hyperv-keyboard: Add the support of hibernation hv_balloon: Balloon up according to request page number commit beae56192a2570578ae45050e73c5ff9254f63e6 Author: Hans de Goede Date: Sat Feb 1 12:56:48 2020 +0100 HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock Commit 8f18eca9ebc5 ("HID: ite: Add USB id match for Acer SW5-012 keyboard dock") added the USB id for the Acer SW5-012's keyboard dock to the hid-ite driver to fix the rfkill driver not working. Most keyboard docks with an ITE 8595 keyboard/touchpad controller have the "Wireless Radio Control" bits which need the special hid-ite driver on the second USB interface (the mouse interface) and their touchpad only supports mouse emulation, so using generic hid-input handling for anything but the "Wireless Radio Control" bits is fine. On these devices we simply bind to all USB interfaces. But unlike other ITE8595 using keyboard docks, the Acer Aspire Switch 10 (SW5-012)'s touchpad not only does mouse emulation it also supports HID-multitouch and all the keys including the "Wireless Radio Control" bits have been moved to the first USB interface (the keyboard intf). So we need hid-ite to handle the first (keyboard) USB interface and have it NOT bind to the second (mouse) USB interface so that that can be handled by hid-multitouch.c and we get proper multi-touch support. This commit changes the hid_device_id for the SW5-012 keyboard dock to only match on hid devices from the HID_GROUP_GENERIC group, this way hid-ite will not bind the the mouse/multi-touch interface which has HID_GROUP_MULTITOUCH_WIN_8 as group. This fixes the regression to mouse-emulation mode introduced by adding the keyboard dock USB id. Cc: stable@vger.kernel.org Fixes: 8f18eca9ebc5 ("HID: ite: Add USB id match for Acer SW5-012 keyboard dock") Reported-by: Zdeněk Rampas Signed-off-by: Hans de Goede Signed-off-by: Benjamin Tissoires commit c92bddee77353a773f0df76115c1a01877ce1eae Author: Paolo Valente Date: Mon Feb 3 11:41:00 2020 +0100 block, bfq: clarify the goal of bfq_split_bfqq() The exact, general goal of the function bfq_split_bfqq() is not that apparent. Add a comment to make it clear. Tested-by: Oleksandr Natalenko Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit db37a34c563bf4692b36990ae89005c031385e52 Author: Paolo Valente Date: Mon Feb 3 11:40:59 2020 +0100 block, bfq: get a ref to a group when adding it to a service tree BFQ schedules generic entities, which may represent either bfq_queues or groups of bfq_queues. When an entity is inserted into a service tree, a reference must be taken, to make sure that the entity does not disappear while still referred in the tree. Unfortunately, such a reference is mistakenly taken only if the entity represents a bfq_queue. This commit takes a reference also in case the entity represents a group. Tested-by: Oleksandr Natalenko Tested-by: Chris Evich Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 4d8340d0d4d90e7ca367d18ec16c2fefa89a339c Author: Paolo Valente Date: Mon Feb 3 11:40:58 2020 +0100 block, bfq: remove ifdefs from around gets/puts of bfq groups ifdefs around gets and puts of bfq groups reduce readability, remove them. Tested-by: Oleksandr Natalenko Reported-by: Jens Axboe Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 33a16a9804688b2f4c4281ec31bc393ef2645ae4 Author: Paolo Valente Date: Mon Feb 3 11:40:57 2020 +0100 block, bfq: extend incomplete name of field on_st The flag on_st in the bfq_entity data structure is true if the entity is on a service tree or is in service. Yet the name of the field, confusingly, does not mention the second, very important case. Extend the name to mention the second case too. Tested-by: Oleksandr Natalenko Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit ecedd3d7e19911ab8fe42f17b77c0a30fe7f4db3 Author: Paolo Valente Date: Mon Feb 3 11:40:56 2020 +0100 block, bfq: get extra ref to prevent a queue from being freed during a group move In bfq_bfqq_move(), the bfq_queue, say Q, to be moved to a new group may happen to be deactivated in the scheduling data structures of the source group (and then activated in the destination group). If Q is referred only by the data structures in the source group when the deactivation happens, then Q is freed upon the deactivation. This commit addresses this issue by getting an extra reference before the possible deactivation, and releasing this extra reference after Q has been moved. Tested-by: Chris Evich Tested-by: Oleksandr Natalenko Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 32c59e3a9a5a0b180dd015755d6d18ca31e55935 Author: Paolo Valente Date: Mon Feb 3 11:40:55 2020 +0100 block, bfq: do not insert oom queue into position tree BFQ maintains an ordered list, implemented with an RB tree, of head-request positions of non-empty bfq_queues. This position tree, inherited from CFQ, is used to find bfq_queues that contain I/O close to each other. BFQ merges these bfq_queues into a single shared queue, if this boosts throughput on the device at hand. There is however a special-purpose bfq_queue that does not participate in queue merging, the oom bfq_queue. Yet, also this bfq_queue could be wrongly added to the position tree. So bfqq_find_close() could return the oom bfq_queue, which is a source of further troubles in an out-of-memory situation. This commit prevents the oom bfq_queue from being inserted into the position tree. Tested-by: Patrick Dung Tested-by: Oleksandr Natalenko Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit f718b093277df582fbf8775548a4f163e664d282 Author: Paolo Valente Date: Mon Feb 3 11:40:54 2020 +0100 block, bfq: do not plug I/O for bfq_queues with no proc refs Commit 478de3380c1c ("block, bfq: deschedule empty bfq_queues not referred by any process") fixed commit 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging") by descheduling an empty bfq_queue when it remains with not process reference. Yet, this still left a case uncovered: an empty bfq_queue with not process reference that remains in service. This happens for an in-service sync bfq_queue that is deemed to deserve I/O-dispatch plugging when it remains empty. Yet no new requests will arrive for such a bfq_queue if no process sends requests to it any longer. Even worse, the bfq_queue may happen to be prematurely freed while still in service (because there may remain no reference to it any longer). This commit solves this problem by preventing I/O dispatch from being plugged for the in-service bfq_queue, if the latter has no process reference (the bfq_queue is then prevented from remaining in service). Fixes: 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging") Tested-by: Oleksandr Natalenko Reported-by: Patrick Dung Tested-by: Patrick Dung Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 324282c0252a44a97d628813e30ea7258940d469 Author: Carlos Maiolino Date: Thu Jan 9 14:30:45 2020 +0100 fibmap: Reject negative block numbers FIBMAP receives an integer from userspace which is then implicitly converted into sector_t to be passed to bmap(). No check is made to ensure userspace didn't send a negative block number, which can end up in an underflow, and returning to userspace a corrupted block address. As a side-effect, the underflow caused by a negative block here, will trigger the WARN() in iomap_bmap_actor(), which is how this issue was first discovered. Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Al Viro commit 0d89fdae2afe833dd3025edd8c8287675d45c74e Author: Carlos Maiolino Date: Thu Jan 9 14:30:44 2020 +0100 fibmap: Use bmap instead of ->bmap method in ioctl_fibmap Now we have the possibility of proper error return in bmap, use bmap() function in ioctl_fibmap() instead of calling ->bmap method directly. Signed-off-by: Carlos Maiolino Signed-off-by: Al Viro commit 569d2056def7add85c0a9add03c19017e5525012 Author: Carlos Maiolino Date: Thu Jan 9 14:30:43 2020 +0100 ecryptfs: drop direct calls to ->bmap Replace direct ->bmap calls by bmap() method. Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Al Viro commit 10d83e11a582631a14579a087a55608075c6f539 Author: Carlos Maiolino Date: Thu Jan 9 14:30:42 2020 +0100 cachefiles: drop direct usage of ->bmap method. Replace the direct usage of ->bmap method by a bmap() call. Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Al Viro commit 30460e1ea3e62f8457e087db9a309ed1031630da Author: Carlos Maiolino Date: Thu Jan 9 14:30:41 2020 +0100 fs: Enable bmap() function to properly return errors By now, bmap() will either return the physical block number related to the requested file offset or 0 in case of error or the requested offset maps into a hole. This patch makes the needed changes to enable bmap() to proper return errors, using the return value as an error return, and now, a pointer must be passed to bmap() to be filled with the mapped physical block. It will change the behavior of bmap() on return: - negative value in case of error - zero on success or map fell into a hole In case of a hole, the *block will be zero too Since this is a prep patch, by now, the only error return is -EINVAL if ->bmap doesn't exist. Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Al Viro commit 137c4ba7163ad9d5696b9fde78b1c0898a9c115b Author: Ben Skeggs Date: Mon Feb 3 03:37:07 2020 -0500 drm/nouveau/kms/gv100-: avoid sending a core update until the first modeset The OR routing logic in NVKM does not expect to receive supervisor interrupts until the DD has provided consistent information on the ORs it's using and the EVO/NVD assembly state to match. The combination of changing window ownership + core channel update during display init triggered a situation where we'd disconnect an OR from the pad it was meant to still be driving on some systems. Signed-off-by: Ben Skeggs commit 5bb88d07948b6779cb783ec0f08b4c1474d592dd Author: Ben Skeggs Date: Mon Feb 3 03:36:30 2020 -0500 drm/nouveau/kms/gv100-: move window ownership setup into modesetting path For various complicated reasons, we need to avoid sending a core update method during display init. Something, which we've been required to do on GV100 and up because we've been assigning windows to heads there and the HW is rather picky about when that's allowed. This moves window assignment into the modesetting path at a point where it's much safer to send our first update methods to NVDisplay. Signed-off-by: Ben Skeggs commit 58ae5284f663f0856a13bc6caad93a0fe49d7cb4 Author: Ben Skeggs Date: Mon Feb 3 01:58:45 2020 -0500 drm/nouveau/disp/gv100-: halt NV_PDISP_FE_RM_INTR_STAT_CTRL_DISP_ERROR storms Signed-off-by: Ben Skeggs commit 7e0cf7e9936c4358b0863357b90aa12afe6489da Author: Boris Brezillon Date: Fri Nov 29 14:59:08 2019 +0100 drm/panfrost: Make sure the shrinker does not reclaim referenced BOs Userspace might tag a BO purgeable while it's still referenced by GPU jobs. We need to make sure the shrinker does not purge such BOs until all jobs referencing it are finished. Fixes: 013b65101315 ("drm/panfrost: Add madvise and shrinker support") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20191129135908.2439529-9-boris.brezillon@collabora.com commit dec0a81a7814c8a876e663e0627468e6b1a7d2fb Author: Hanjun Guo Date: Mon Feb 3 09:36:07 2020 +0800 i2c: designware: Add ACPI HID for Hisilicon Hip08-Lite I2C controller Add ACPI HID HISI02A3 for Hisilicon Hip08 Lite, which has different clock frequency from Hip08 for I2C controller. Tested-by: Sheng Feng Signed-off-by: Hanjun Guo Acked-by: Nikula Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit c01a4a136440cb9727a519bb10f5f2696a80e8de Author: Hanjun Guo Date: Mon Feb 3 09:36:06 2020 +0800 ACPI / APD: Add clock frequency for Hisilicon Hip08-Lite I2C controller I2C clock frequency of Designware ip for Hisilicon Hip08 Lite is 125M, use a new ACPI HID to enable it. Tested-by: Sheng Feng Signed-off-by: Hanjun Guo Reviewed-by: Jarkko Nikula Signed-off-by: Rafael J. Wysocki commit c21502efdaedfdf9fc71334883a164341881bc22 Author: Rafael J. Wysocki Date: Fri Jan 31 11:05:17 2020 +0100 Documentation: admin-guide: PM: Update sleep states documentation There is some information in Documentation/power/interface.rst that is still missing from Documentation/admin-guide/pm/sleep-states.rst and really should be present in there, so update the latter by adding that information to it and delete the former (as it becomes redundant after that and it is somewhat outdated). While at it, clean up some assorted pieces of sleep-states.rst a bit. Signed-off-by: Rafael J. Wysocki commit 4dcb78ee579cdf90e30c5a0223f6f160ea37182d Author: Rafael J. Wysocki Date: Mon Feb 3 11:57:18 2020 +0100 intel_idle: Introduce 'states_off' module parameter In certain system configurations it may not be desirable to use some C-states assumed to be available by intel_idle and the driver needs to be prevented from using them even before the cpuidle sysfs interface becomes accessible to user space. Currently, the only way to achieve that is by setting the 'max_cstate' module parameter to a value lower than the index of the shallowest of the C-states in question, but that may be overly intrusive, because it effectively makes all of the idle states deeper than the 'max_cstate' one go away (and the C-state to avoid may be in the middle of the range normally regarded as available). To allow that limitation to be overcome, introduce a new module parameter called 'states_off' to represent a list of idle states to be disabled by default in the form of a bitmask and update the documentation to cover it. Signed-off-by: Rafael J. Wysocki commit 3a5be9b8f43346a24f31c0017cb2566a6b2c72c5 Author: Rafael J. Wysocki Date: Mon Feb 3 11:57:08 2020 +0100 intel_idle: Introduce 'use_acpi' module parameter For diagnostics, it is generally useful to be able to make intel_idle take the system's ACPI tables into consideration even if that is not required for the processor model in there, so introduce a new module parameter, 'use_acpi', to make that happen and update the documentation to cover it. While at it, fix the 'no_acpi' module parameter name in the documentation. Signed-off-by: Rafael J. Wysocki commit a4ac9d45c0cd14a2adc872186431c79804b77dbf Author: Miklos Szeredi Date: Mon Feb 3 11:41:53 2020 +0100 ovl: fix lseek overflow on 32bit ovl_lseek() is using ssize_t to return the value from vfs_llseek(). On a 32-bit kernel ssize_t is a 32-bit signed int, which overflows above 2 GB. Assign the return value of vfs_llseek() to loff_t to fix this. Reported-by: Boris Gjenero Fixes: 9e46b840c705 ("ovl: support stacked SEEK_HOLE/SEEK_DATA") Cc: # v4.19 Signed-off-by: Miklos Szeredi commit 5273a191dca65a675dc0bcf3909e59c6933e2831 Author: David Howells Date: Thu Jan 30 21:50:36 2020 +0000 rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect When a call is disconnected, the connection pointer from the call is cleared to make sure it isn't used again and to prevent further attempted transmission for the call. Unfortunately, there might be a daemon trying to use it at the same time to transmit a packet. Fix this by keeping call->conn set, but setting a flag on the call to indicate disconnection instead. Remove also the bits in the transmission functions where the conn pointer is checked and a ref taken under spinlock as this is now redundant. Fixes: 8d94aa381dab ("rxrpc: Calls shouldn't hold socket refs") Signed-off-by: David Howells commit 107945227ac5d4c37911c7841b27c64b489ce9a9 Author: Zenghui Yu Date: Mon Dec 2 15:10:21 2019 +0800 irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL It looks like an obvious mistake to use its_mapc_cmd descriptor when building the INVALL command block. It so far worked by luck because both its_mapc_cmd.col and its_invall_cmd.col sit at the same offset of the ITS command descriptor, but we should not rely on it. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20191202071021.1251-1-yuzenghui@huawei.com commit 5312f321a67cfee1fe4de245bc558fa857dce33b Author: Geert Uytterhoeven Date: Thu Jan 30 13:55:29 2020 +0100 mfd: syscon: Fix syscon_regmap_lookup_by_phandle_args() dummy If CONFIG_MFD_SYSCON=n: include/linux/mfd/syscon.h:54:23: warning: ‘syscon_regmap_lookup_by_phandle_args’ defined but not used [-Wunused-function] Fix this by adding the missing inline keyword. Fixes: 6a24f567af4accef ("mfd: syscon: Add arguments support for syscon reference") Signed-off-by: Geert Uytterhoeven Signed-off-by: Lee Jones commit 8044aad70a1fbd66376cdb2a13e536db9dd6c132 Author: Greg Ungerer Date: Fri Jan 17 16:28:19 2020 +1000 m68knommu: fix memcpy() out of bounds warning in get_user() Newer versions of gcc are giving warnings in the non-MMU m68k version of the get_user() macro: ./arch/m68k/include/asm/string.h:72:25: warning: ‘__builtin_memcpy’ forming offset [3, 4] is out of the bounds [0, 2] of object ‘__gu_val’ with type ‘short unsigned int’ [-Warray-bounds] The warnings are generated when smaller sized variables are used as the result of user space pointers to larger values. For example a short/2-byte variable stores the result of a user space int (4-byte) pointer. The warning is in the 8-byte branch of get_user() - even though that branch is not the taken branch in the warning cases. Refactor the 8-byte branch of get_user() so that it uses a correctly formed union type to read and write the source and destination objects. Keep using the memcpy() just in case the user space pointer is not naturaly aligned (not required for ColdFire, but needed for early 68000). Signed-off-by: Greg Ungerer commit bad83565eafe8a00922ad4eed6920625a10a2126 Author: Peter Ujfalusi Date: Fri Jan 31 11:38:58 2020 +0200 dmaengine: Cleanups for the slave <-> channel symlink support No need to use goto to jump over the return chan ? chan : ERR_PTR(-EPROBE_DEFER); We can just revert the check and return right there. Do not fail the channel request if the chan->name allocation fails, but print a warning about it. Change the dev_err to dev_warn if sysfs_create_link() fails as it is not fatal. Only attempt to remove the DMA_SLAVE_NAME symlink if it is created - or it was attempted to be created. Signed-off-by: Peter Ujfalusi Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20200131093859.3311-2-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 5429b51f606cb82f315f68678b959112766f235e Author: Dave Jiang Date: Fri Jan 31 10:58:39 2020 -0700 dmaengine: fix null ptr check for __dma_async_device_channel_register() Add check to pointer after assignment before accessing members. Fixes: d2fb0a043838: ("dmaengine: break out channel registration") Reported-by: Dan Carpenter Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/158049351973.45445.3291586905226032744.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit a9113a90f5f0ff476a4ac2bf15861fa4358a3643 Author: kbuild test robot Date: Thu Jan 30 15:44:49 2020 +0100 dmaengine: idxd: fix boolconv.cocci warnings Remove unneeded conversion to bool Generated by: scripts/coccinelle/misc/boolconv.cocci CC: Dave Jiang Signed-off-by: kbuild test robot Signed-off-by: Julia Lawall Acked-by: Dave Jiang Link: https://lore.kernel.org/r/alpine.DEB.2.21.2001301543150.7476@hadrien Signed-off-by: Vinod Koul commit 83d0585f91da441a0b11bc5ff93f4cda56de6703 Merge: dff6bc1bfd46 af8c8a450bf4 Author: Jakub Kicinski Date: Sun Feb 2 13:39:11 2020 -0800 Merge branch 'Fix-reconnection-latency-caused-by-FIN-ACK-handling-race' SeongJae Park says: ==================== Fix reconnection latency caused by FIN/ACK handling race The first patch fixes the problem by adjusting the first resend delay of the SYN in the case. The second one adds a user space test to reproduce this problem. From v2 (https://lore.kernel.org/linux-kselftest/20200201071859.4231-1-sj38.park@gmail.com/) - Use TCP_TIMEOUT_MIN as reduced delay (Neal Cardwall) - Add Reviewed-by and Signed-off-by from Eric Dumazet From v1 (https://lore.kernel.org/linux-kselftest/20200131122421.23286-1-sjpark@amazon.com/) - Drop the trivial comment fix patch (Eric Dumazet) - Limit the delay adjustment to only the first SYN resend (Eric Dumazet) - selftest: Avoid use of hard-coded port number (Eric Dumazet) - Explain RST/ACK and FIN/ACK has no big difference (Neal Cardwell) ==================== Signed-off-by: Jakub Kicinski commit af8c8a450bf4698a8a6a7c68956ea5ccafe4cc88 Author: SeongJae Park Date: Sun Feb 2 03:38:27 2020 +0000 selftests: net: Add FIN_ACK processing order related latency spike test This commit adds a test for FIN_ACK process races related reconnection latency spike issues. The issue has described and solved by the previous commit ("tcp: Reduce SYN resend delay if a suspicous ACK is received"). The test program is configured with a server and a client process. The server creates and binds a socket to a port that dynamically allocated, listen on it, and start a infinite loop. Inside the loop, it accepts connection, reads 4 bytes from the socket, and closes the connection. The client is constructed as an infinite loop. Inside the loop, it creates a socket with LINGER and NODELAY option, connect to the server, send 4 bytes data, try read some data from server. After the read() returns, it measure the latency from the beginning of this loop to this point and if the latency is larger than 1 second (spike), print a message. Reviewed-by: Eric Dumazet Signed-off-by: SeongJae Park Signed-off-by: Jakub Kicinski commit 9603d47bad4642118fa19fd1562569663d9235f6 Author: SeongJae Park Date: Sun Feb 2 03:38:26 2020 +0000 tcp: Reduce SYN resend delay if a suspicous ACK is received When closing a connection, the two acks that required to change closing socket's status to FIN_WAIT_2 and then TIME_WAIT could be processed in reverse order. This is possible in RSS disabled environments such as a connection inside a host. For example, expected state transitions and required packets for the disconnection will be similar to below flow. 00 (Process A) (Process B) 01 ESTABLISHED ESTABLISHED 02 close() 03 FIN_WAIT_1 04 ---FIN--> 05 CLOSE_WAIT 06 <--ACK--- 07 FIN_WAIT_2 08 <--FIN/ACK--- 09 TIME_WAIT 10 ---ACK--> 11 LAST_ACK 12 CLOSED CLOSED In some cases such as LINGER option applied socket, the FIN and FIN/ACK will be substituted to RST and RST/ACK, but there is no difference in the main logic. The acks in lines 6 and 8 are the acks. If the line 8 packet is processed before the line 6 packet, it will be just ignored as it is not a expected packet, and the later process of the line 6 packet will change the status of Process A to FIN_WAIT_2, but as it has already handled line 8 packet, it will not go to TIME_WAIT and thus will not send the line 10 packet to Process B. Thus, Process B will left in CLOSE_WAIT status, as below. 00 (Process A) (Process B) 01 ESTABLISHED ESTABLISHED 02 close() 03 FIN_WAIT_1 04 ---FIN--> 05 CLOSE_WAIT 06 (<--ACK---) 07 (<--FIN/ACK---) 08 (fired in right order) 09 <--FIN/ACK--- 10 <--ACK--- 11 (processed in reverse order) 12 FIN_WAIT_2 Later, if the Process B sends SYN to Process A for reconnection using the same port, Process A will responds with an ACK for the last flow, which has no increased sequence number. Thus, Process A will send RST, wait for TIMEOUT_INIT (one second in default), and then try reconnection. If reconnections are frequent, the one second latency spikes can be a big problem. Below is a tcpdump results of the problem: 14.436259 IP 127.0.0.1.45150 > 127.0.0.1.4242: Flags [S], seq 2560603644 14.436266 IP 127.0.0.1.4242 > 127.0.0.1.45150: Flags [.], ack 5, win 512 14.436271 IP 127.0.0.1.45150 > 127.0.0.1.4242: Flags [R], seq 2541101298 /* ONE SECOND DELAY */ 15.464613 IP 127.0.0.1.45150 > 127.0.0.1.4242: Flags [S], seq 2560603644 This commit mitigates the problem by reducing the delay for the next SYN if the suspicous ACK is received while in SYN_SENT state. Following commit will add a selftest, which can be also helpful for understanding of this issue. Signed-off-by: Eric Dumazet Signed-off-by: SeongJae Park Signed-off-by: Jakub Kicinski commit dff6bc1bfd462b76dc13ec19dedc2c134a62ac59 Author: Lukas Bulwahn Date: Sat Feb 1 13:43:01 2020 +0100 MAINTAINERS: correct entries for ISDN/mISDN section Commit 6d97985072dc ("isdn: move capi drivers to staging") cleaned up the isdn drivers and split the MAINTAINERS section for ISDN, but missed to add the terminal slash for the two directories mISDN and hardware. Hence, all files in those directories were not part of the new ISDN/mISDN SUBSYSTEM, but were considered to be part of "THE REST". Rectify the situation, and while at it, also complete the section with two further build files that belong to that subsystem. This was identified with a small script that finds all files belonging to "THE REST" according to the current MAINTAINERS file, and I investigated upon its output. Fixes: 6d97985072dc ("isdn: move capi drivers to staging") Signed-off-by: Lukas Bulwahn Acked-by: Arnd Bergmann Signed-off-by: Jakub Kicinski commit 46d6b7becb1d5a8e697db786590c19e4067a975a Merge: 545ae66582f7 11648b8339f8 Author: Linus Torvalds Date: Sun Feb 2 11:50:58 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fix from David Miller: "adjtimex regression fix from Arnd" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: fix adjtimex regression commit 545ae66582f7627870b719d318954d0252902519 Merge: 15f8e73355df 260718b3a35d Author: Linus Torvalds Date: Sun Feb 2 11:48:46 2020 -0800 Merge tag 'leds-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: - New driver for TI TPS6105X - Add managed API to get a LED from a device driver - Misc fixes and updates * tag 'leds-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: (22 commits) leds: lm3692x: Disable chip on brightness 0 leds: lm3692x: Split out lm3692x_leds_disable leds: lm3692x: Move lm3692x_init and rename to lm3692x_leds_enable leds: lm3692x: Make sure we don't exceed the maximum LED current dt: bindings: lm3692x: Add led-max-microamp property leds: lm3692x: Allow to configure over voltage protection dt: bindings: lm3692x: Add ti,ovp-microvolt property leds: populate the device's of_node leds: Add managed API to get a LED from a device driver leds: Add of_led_get() and led_put() leds: lm3532: add pointer to documentation and fix typo leds: lm3532: use extended registration so that LED can be used for backlight leds: lm3642: remove warnings for bad strtol, cleanup gotos leds: rb532: cleanup whitespace ledtrig-pattern: fix email address quoting in MODULE_AUTHOR() dt-bindings: mfd: update TI tps6105x chip bindings leds: tps6105x: add driver for MFD chip LED mode led: max77650: add of_match table leds: bd2802: Convert to use GPIO descriptors leds: pca963x: Fix open-drain initialization ... commit 15f8e73355df9ec48902d128a0ef01a6b8bff453 Merge: 94f2630b1897 71705c611263 Author: Linus Torvalds Date: Sun Feb 2 11:31:52 2020 -0800 Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull pcmcia updates from Dominik Brodowski: "This is a series co-developed by Simon Geis and Lukas Panzer to clean up the i82092 PCMCIA device driver" * 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: PCMCIA/i82092: remove #if 0 block PCMCIA/i82092: delete enter/leave macro PCMCIA/i82092: include instead of PCMCIA/i82092: shorten the lines with over 80 characters PCMCIA/i82092: move assignment out of if condition PCMCIA/i82092: change code indentation PCMCIA/i82092: insert blank line after declarations PCMCIA/i82092: remove braces around single statement blocks PCMCIA/i82092: add/remove spaces to improve readability PCMCIA/i82092: use dev_ instead of printk commit d55966c4279bfc6a0cf0b32bf13f5df228a1eeb6 Author: Josef Bacik Date: Fri Jan 31 09:31:05 2020 -0500 btrfs: do not zero f_bavail if we have available space There was some logic added a while ago to clear out f_bavail in statfs() if we did not have enough free metadata space to satisfy our global reserve. This was incorrect at the time, however didn't really pose a problem for normal file systems because we would often allocate chunks if we got this low on free metadata space, and thus wouldn't really hit this case unless we were actually full. Fast forward to today and now we are much better about not allocating metadata chunks all of the time. Couple this with d792b0f19711 ("btrfs: always reserve our entire size for the global reserve") which now means we'll easily have a larger global reserve than our free space, we are now more likely to trip over this while still having plenty of space. Fix this by skipping this logic if the global rsv's space_info is not full. space_info->full is 0 unless we've attempted to allocate a chunk for that space_info and that has failed. If this happens then the space for the global reserve is definitely sacred and we need to report b_avail == 0, but before then we can just use our calculated b_avail. Reported-by: Martin Steigerwald Fixes: ca8a51b3a979 ("btrfs: statfs: report zero available if metadata are exhausted") CC: stable@vger.kernel.org # 4.5+ Reviewed-by: Qu Wenruo Tested-By: Martin Steigerwald Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit e19ac9d9a978f8238a85a28ed624094a497d5ae6 Author: Olivier Moysan Date: Tue Jan 21 12:02:56 2020 +0100 iio: adc: stm32-dfsdm: fix sleep in atomic context This commit fixes the error message: "BUG: sleeping function called from invalid context at kernel/irq/chip.c" Suppress the trigger irq handler. Make the buffer transfers directly in DMA callback, instead. Push buffers without timestamps, as timestamps are not supported in DFSDM driver. Fixes: 11646e81d775 ("iio: adc: stm32-dfsdm: add support for buffer modes") Signed-off-by: Olivier Moysan Cc: Signed-off-by: Jonathan Cameron commit 961b91a93ea27495022b2bdc3ca0f608f2c97b5f Author: Jon Hunter Date: Fri Jan 31 09:19:01 2020 +0000 ASoC: tegra: Revert 24 and 32 bit support Commit f3ee99087c8ca0ecfdd549ef5a94f557c42d5428 ("ASoC: tegra: Allow 24bit and 32bit samples") added 24-bit and 32-bit support for to the Tegra30 I2S driver. However, there are two additional commits that are also needed to get 24-bit and 32-bit support to work correctly. These commits are not yet applied because there are still some review comments that need to be addressed. With only this change applied, 24-bit and 32-bit support is advertised by the I2S driver, but it does not work and the audio is distorted. Therefore, revert this patch for now until the other changes are also ready. Furthermore, a clock issue with 24-bit support has been identified with this change and so if we revert this now, we can also fix that in the updated version. Reported-by: Dmitry Osipenko Signed-off-by: Jon Hunter Tested-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20200131091901.13014-1-jonathanh@nvidia.com Signed-off-by: Mark Brown Cc: stable@vger.kernel.org commit 6ba7fc99680b2250deba1a23f34d31fd25125d61 Author: Yong Zhi Date: Fri Jan 31 14:40:32 2020 -0600 ASoC: SOF: Intel: add PCI ID for JasperLake Mirror ID added for legacy HDaudio. Signed-off-by: Yong Zhi Signed-off-by: Divagar Mohandass Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200131204032.10213-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit a500f3bd787f8224341e44b238f318c407b10897 Author: Eugen Hristev Date: Tue Jan 28 12:57:39 2020 +0000 iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode The differential channels require writing the channel offset register (COR). Otherwise they do not work in differential mode. The configuration of COR is missing in triggered mode. Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") Signed-off-by: Eugen Hristev Cc: Signed-off-by: Jonathan Cameron commit 11648b8339f840d4b1f4c54a1abec8025d9e077d Author: Arnd Bergmann Date: Sat Feb 1 22:20:52 2020 +0100 sparc64: fix adjtimex regression Anatoly Pugachev reported one of the y2038 patches to introduce a fatal bug from a stupid typo: [ 96.384129] watchdog: BUG: soft lockup - CPU#8 stuck for 22s! ... [ 96.385624] [0000000000652ca4] handle_mm_fault+0x84/0x320 [ 96.385668] [0000000000b6f2bc] do_sparc64_fault+0x43c/0x820 [ 96.385720] [0000000000407754] sparc64_realfault_common+0x10/0x20 [ 96.385769] [000000000042fa28] __do_sys_sparc_clock_adjtime+0x28/0x80 [ 96.385819] [00000000004307f0] sys_sparc_clock_adjtime+0x10/0x20 [ 96.385866] [0000000000406294] linux_sparc_syscall+0x34/0x44 Fix the code to dereference the correct pointer again. Reported-by: Anatoly Pugachev Tested-by: Anatoly Pugachev Fixes: 251ec1c159e4 ("y2038: sparc: remove use of struct timex") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 59365cadfbcd299b8cdbe0c165faf15767c5f166 Author: Ard Biesheuvel Date: Sun Feb 2 00:33:04 2020 +0100 efi/x86: Fix boot regression on systems with invalid memmap entries In efi_clean_memmap(), we do a pass over the EFI memory map to remove bogus entries that may be returned on certain systems. This recent commit: 1db91035d01aa8bf ("efi: Add tracking for dynamically allocated memmaps") refactored this code to pass the input to efi_memmap_install() via a temporary struct on the stack, which is populated using an initializer which inadvertently defines the value of its size field in terms of its desc_size field, which value cannot be relied upon yet in the initializer itself. Fix this by using efi.memmap.desc_size instead, which is where we get the value for desc_size from in the first place. Reported-by: Jörg Otte Tested-by: Jörg Otte Tested-by: Dan Williams Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: linux-efi@vger.kernel.org Cc: jrg.otte@gmail.com Cc: torvalds@linux-foundation.org Cc: mingo@kernel.org Link: https://lore.kernel.org/r/20200201233304.18322-1-ardb@kernel.org commit 112e3f5ac505ea0f1e3c59cc757db3c45252c41d Author: Takashi Iwai Date: Sun Feb 2 10:07:24 2020 +0100 ALSA: hdsp: Make the firmware loading ioctl a bit more readable The firmware loading ioctl that is implemented for hdsp hwdep device takes the reference of the address pointer, hence the current code is rather confusing. Also, due to the recent change in uapi header, sparse also complains about the cast. This patch tries to improve the readability by converting the straightforward copy_from_user of the whole struct (which contains only the pointer). Fixes: d63e63d42107 ("ALSA: hdsp: Make uapi/hdsp.h compilable again") Link: https://lore.kernel.org/r/20200202090724.18232-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 81b450909bfb4b71b4ae1c07add4feada32892bd Author: Takashi Iwai Date: Sun Feb 2 10:07:23 2020 +0100 ALSA: emu10k1: Fix annotation and cast for the recent uapi header change The recent sound/emu10k1.h uapi header change by the commit 2e4688676392 ("ALSA: emu10k1: Make uapi/emu10k1.h compilable again") made sparse angry because of the inconsistency of __user annotation and the own ctl id struct that were changed in uapi header. This patch addresses those by adjusting the cast and annotations properly again. Fixes: 2e4688676392 ("ALSA: emu10k1: Make uapi/emu10k1.h compilable again") Link: https://lore.kernel.org/r/20200202090724.18232-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b7c3a17c6062701d97a0959890a2c882bfaac537 Merge: cb3c0e6bdf64 78e06cf43093 Author: Jakub Kicinski Date: Sat Feb 1 12:38:20 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix suspicious RCU usage in ipset, from Jozsef Kadlecsik. 2) Use kvcalloc, from Joe Perches. 3) Flush flowtable hardware workqueue after garbage collection run, from Paul Blakey. 4) Missing flowtable hardware workqueue flush from nf_flow_table_free(), also from Paul. 5) Restore NF_FLOW_HW_DEAD in flow_offload_work_del(), from Paul. 6) Flowtable documentation fixes, from Matteo Croce. ==================== Signed-off-by: Jakub Kicinski commit cb3c0e6bdf64d0d124e94ce43cbe4ccbb9b37f51 Author: Eric Dumazet Date: Fri Jan 31 15:27:04 2020 -0800 cls_rsvp: fix rsvp_policy NLA_BINARY can be confusing, since .len value represents the max size of the blob. cls_rsvp really wants user space to provide long enough data for TCA_RSVP_DST and TCA_RSVP_SRC attributes. BUG: KMSAN: uninit-value in rsvp_get net/sched/cls_rsvp.h:258 [inline] BUG: KMSAN: uninit-value in gen_handle net/sched/cls_rsvp.h:402 [inline] BUG: KMSAN: uninit-value in rsvp_change+0x1ae9/0x4220 net/sched/cls_rsvp.h:572 CPU: 1 PID: 13228 Comm: syz-executor.1 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 rsvp_get net/sched/cls_rsvp.h:258 [inline] gen_handle net/sched/cls_rsvp.h:402 [inline] rsvp_change+0x1ae9/0x4220 net/sched/cls_rsvp.h:572 tc_new_tfilter+0x31fe/0x5010 net/sched/cls_api.c:2104 rtnetlink_rcv_msg+0xcb7/0x1570 net/core/rtnetlink.c:5415 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45b349 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f269d43dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f269d43e6d4 RCX: 000000000045b349 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000009c2 R14: 00000000004cb338 R15: 000000000075bfd4 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2774 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4382 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] netlink_sendmsg+0x7d3/0x14d0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 6fa8c0144b77 ("[NET_SCHED]: Use nla_policy for attribute validation in classifiers") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Cong Wang Signed-off-by: Jakub Kicinski commit e8d5bb4dfaa7282e6e2672a8369bcbd38e885b4f Author: Sven Eckelmann Date: Fri Jan 31 09:59:19 2020 +0100 MAINTAINERS: Orphan HSR network protocol The current maintainer Arvid Brodin hasn't contributed to the kernel since 2015-02-27. His company mail address is also bouncing and the company confirmed (2020-01-31) that no Arvid Brodin is working for them: > Vi har dessvärre ingen Arvid Brodin som arbetar på ALTEN. A MIA person cannot be the maintainer. It is better to mark is as orphaned until some other person can jump in and take over the responsibility for HSR. Signed-off-by: Sven Eckelmann Signed-off-by: Jakub Kicinski commit d32a06f5434f5e0cdef8e88dc62d079d980088e1 Author: Dan Carpenter Date: Fri Jan 31 08:03:26 2020 +0300 qed: Fix a error code in qed_hw_init() If the qed_fw_overlay_mem_alloc() then we should return -ENOMEM instead of success. Fixes: 30d5f85895fa ("qed: FW 8.42.2.0 Add fw overlay feature") Signed-off-by: Dan Carpenter Signed-off-by: Jakub Kicinski commit 08ff78182fa170dbbe1ebf31e798e9340d6802a5 Author: Dan Carpenter Date: Fri Jan 31 08:02:41 2020 +0300 octeontx2-pf: Fix an IS_ERR() vs NULL bug The otx2_mbox_get_rsp() function never returns NULL, it returns error pointers on error. Fixes: 34bfe0ebedb7 ("octeontx2-pf: MTU, MAC and RX mode config support") Signed-off-by: Dan Carpenter Signed-off-by: Jakub Kicinski commit 94f2630b18975bb56eee5d1a36371db967643479 Merge: 6404674acd59 b581098482e6 Author: Linus Torvalds Date: Sat Feb 1 11:22:41 2020 -0800 Merge tag '5.6-rc-small-smb3-fix-for-stable' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fix from Steve French: "Small SMB3 fix for stable (fixes problem with soft mounts)" * tag '5.6-rc-small-smb3-fix-for-stable' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number cifs: fix soft mounts hanging in the reconnect code commit 6404674acd596de41fd3ad5f267b4525494a891a Author: Al Viro Date: Sat Feb 1 16:26:45 2020 +0000 vfs: fix do_last() regression Brown paperbag time: fetching ->i_uid/->i_mode really should've been done from nd->inode. I even suggested that, but the reason for that has slipped through the cracks and I went for dir->d_inode instead - made for more "obvious" patch. Analysis: - at the entry into do_last() and all the way to step_into(): dir (aka nd->path.dentry) is known not to have been freed; so's nd->inode and it's equal to dir->d_inode unless we are already doomed to -ECHILD. inode of the file to get opened is not known. - after step_into(): inode of the file to get opened is known; dir might be pointing to freed memory/be negative/etc. - at the call of may_create_in_sticky(): guaranteed to be out of RCU mode; inode of the file to get opened is known and pinned; dir might be garbage. The last was the reason for the original patch. Except that at the do_last() entry we can be in RCU mode and it is possible that nd->path.dentry->d_inode has already changed under us. In that case we are going to fail with -ECHILD, but we need to be careful; nd->inode is pointing to valid struct inode and it's the same as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we should use that. Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" Reported-by: syzbot+190005201ced78a74ad6@syzkaller.appspotmail.com Wearing-brown-paperbag: Al Viro Cc: stable@kernel.org Fixes: d0cb50185ae9 ("do_last(): fetch directory ->i_mode and ->i_uid before it's too late") Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 14cd0bd04907df79b36a31e55f18768172230987 Merge: 368d060bb497 2b5072b9dfab Author: Linus Torvalds Date: Sat Feb 1 10:25:55 2020 -0800 Merge tag 'kconfig-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kconfig updates from Masahiro Yamada: - add 'yes2modconfig' and 'mod2yesconfig' targets (useful mainly for turning syzbot configs into more modular ones as a step to minimizing the result) - sanitize help text - various code cleanups * tag 'kconfig-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: fix documentation typos kconfig: fix an "implicit declaration of function" warning kconfig: fix nesting of symbol help text kconfig: distinguish between dependencies and visibility in help text kconfig: list all definitions of a symbol in help text kconfig: Add yes2modconfig and mod2yesconfig targets. kconfig: use $(PERL) in Makefile kconfig: fix too deep indentation in Makefile kconfig: localmodconfig: fix indentation for closing brace kconfig: localmodconfig: remove unused $config kconfig: squash prop_alloc() into menu_add_prop() kconfig: remove sym from struct property kconfig: remove 'prompt' argument from menu_add_prop() kconfig: move prompt handling to menu_add_prompt() from menu_add_prop() kconfig: remove 'prompt' symbol kconfig: drop T_WORD from the RHS of 'prompt' symbol kconfig: use parent->dep as the parentdep of 'menu' kconfig: remove the rootmenu check in menu_add_prop() commit 2b90927c77c973771cc658d639724d5b247a83eb Author: Tom Zanussi Date: Fri Jan 31 15:55:34 2020 -0600 tracing: Use seq_buf for building dynevent_cmd string The dynevent_cmd commands that build up the command string don't need to do that themselves - there's a seq_buf facility that does pretty much the same thing those command are doing manually, so use it instead. Link: http://lkml.kernel.org/r/eb8a6e835c964d0ab8a38cbf5ffa60746b54a465.1580506712.git.zanussi@kernel.org Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit e9260f6257efa6a6293507696e875b6494ee3744 Author: Tom Zanussi Date: Fri Jan 31 15:55:33 2020 -0600 tracing: Remove useless code in dynevent_arg_pair_add() The final addition to q is unnecessary, since q isn't ever used afterwards. Link: http://lkml.kernel.org/r/7880a1268217886cdba7035526650195668da856.1580506712.git.zanussi@kernel.org Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 74403b6c50dd7a633d3f22f59f975d6081eae093 Author: Tom Zanussi Date: Fri Jan 31 15:55:32 2020 -0600 tracing: Remove check_arg() callbacks from dynevent args It's kind of strange to have check_arg() callbacks as part of the arg objects themselves; it makes more sense to just pass these in when the args are added instead. Remove the check_arg() callbacks from those objects which also means removing the check_arg() args from the init functions, adding them to the add functions and fixing up existing callers. Link: http://lkml.kernel.org/r/c7708d6f177fcbe1a36b6e4e8e150907df0fa5d2.1580506712.git.zanussi@kernel.org Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 368d060bb497775e42e323b9f676c45e2011da27 Merge: acd77500aa8a 451dff37f075 Author: Linus Torvalds Date: Sat Feb 1 10:01:52 2020 -0800 Merge tag 'kbuild-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - detect missing include guard in UAPI headers - do not create orphan built-in.a or obj-y objects - generate modules.builtin more simply, and drop tristate.conf - simplify built-in initramfs creation - make linux-headers deb package thinner - optimize the deb package build script - misc cleanups * tag 'kbuild-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (34 commits) builddeb: split libc headers deployment out into a function builddeb: split kernel headers deployment out into a function builddeb: remove redundant make for ARCH=um builddeb: avoid invoking sub-shells where possible builddeb: remove redundant $objtree/ builddeb: match temporary directory name to the package name builddeb: remove unneeded files in hdrobjfiles for headers package kbuild: use -S instead of -E for precise cc-option test in Kconfig builddeb: allow selection of .deb compressor kbuild: remove 'Building modules, stage 2.' log kbuild: remove *.tmp file when filechk fails kbuild: remove PYTHON2 variable modpost: assume STT_SPARC_REGISTER is defined gen_initramfs.sh: remove intermediate cpio_list on errors initramfs: refactor the initramfs build rules gen_initramfs.sh: always output cpio even without -o option initramfs: add default_cpio_list, and delete -d option support initramfs: generate dependency list and cpio at the same time initramfs: specify $(src)/gen_initramfs.sh as a prerequisite in Makefile initramfs: make initramfs compression choice non-optional ... commit acd77500aa8a337baa6d853568c4b55aca48e20f Merge: 26dca6dbd62d 4cb760b02419 Author: Linus Torvalds Date: Sat Feb 1 09:48:37 2020 -0800 Merge tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random Pull random changes from Ted Ts'o: "Change /dev/random so that it uses the CRNG and only blocking if the CRNG hasn't initialized, instead of the old blocking pool. Also clean up archrandom.h, and some other miscellaneous cleanups" * tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: (24 commits) s390x: Mark archrandom.h functions __must_check powerpc: Mark archrandom.h functions __must_check powerpc: Use bool in archrandom.h x86: Mark archrandom.h functions __must_check linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check linux/random.h: Use false with bool linux/random.h: Remove arch_has_random, arch_has_random_seed s390: Remove arch_has_random, arch_has_random_seed powerpc: Remove arch_has_random, arch_has_random_seed x86: Remove arch_has_random, arch_has_random_seed random: remove some dead code of poolinfo random: fix typo in add_timer_randomness() random: Add and use pr_fmt() random: convert to ENTROPY_BITS for better code readability random: remove unnecessary unlikely() random: remove kernel.random.read_wakeup_threshold random: delete code to pull data into pools random: remove the blocking pool random: make /dev/random be almost like /dev/urandom random: ignore GRND_RANDOM in getentropy(2) ... commit 49d08d596e85f39ded48e85df362827cbab1f5ae Author: Coly Li Date: Sat Feb 1 22:42:35 2020 +0800 bcache: check return value of prio_read() Now if prio_read() failed during starting a cache set, we can print out error message in run_cache_set() and handle the failure properly. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit d1c3cc34f5a78b38d2b809b289d912c3560545df Author: Coly Li Date: Sat Feb 1 22:42:34 2020 +0800 bcache: fix incorrect data type usage in btree_flush_write() Dan Carpenter points out that from commit 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()"), there is a incorrect data type usage which leads to the following static checker warning: drivers/md/bcache/journal.c:444 btree_flush_write() warn: 'ref_nr' unsigned <= 0 drivers/md/bcache/journal.c 422 static void btree_flush_write(struct cache_set *c) 423 { 424 struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR]; 425 unsigned int i, nr, ref_nr; ^^^^^^ 426 atomic_t *fifo_front_p, *now_fifo_front_p; 427 size_t mask; 428 429 if (c->journal.btree_flushing) 430 return; 431 432 spin_lock(&c->journal.flush_write_lock); 433 if (c->journal.btree_flushing) { 434 spin_unlock(&c->journal.flush_write_lock); 435 return; 436 } 437 c->journal.btree_flushing = true; 438 spin_unlock(&c->journal.flush_write_lock); 439 440 /* get the oldest journal entry and check its refcount */ 441 spin_lock(&c->journal.lock); 442 fifo_front_p = &fifo_front(&c->journal.pin); 443 ref_nr = atomic_read(fifo_front_p); 444 if (ref_nr <= 0) { ^^^^^^^^^^^ Unsigned can't be less than zero. 445 /* 446 * do nothing if no btree node references 447 * the oldest journal entry 448 */ 449 spin_unlock(&c->journal.lock); 450 goto out; 451 } 452 spin_unlock(&c->journal.lock); As the warning information indicates, local varaible ref_nr in unsigned int type is wrong, which does not matche atomic_read() and the "<= 0" checking. This patch fixes the above error by defining local variable ref_nr as int type. Fixes: 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()") Reported-by: Dan Carpenter Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 038ba8cc1bffc51250add4a9b9249d4331576d8f Author: Coly Li Date: Sat Feb 1 22:42:33 2020 +0800 bcache: add readahead cache policy options via sysfs interface In year 2007 high performance SSD was still expensive, in order to save more space for real workload or meta data, the readahead I/Os for non-meta data was bypassed and not cached on SSD. In now days, SSD price drops a lot and people can find larger size SSD with more comfortable price. It is unncessary to alway bypass normal readahead I/Os to save SSD space for now. This patch adds options for readahead data cache policies via sysfs file /sys/block/bcache/readahead_cache_policy, the options are, - "all": cache all readahead data I/Os. - "meta-only": only cache meta data, and bypass other regular I/Os. If users want to make bcache continue to only cache readahead request for metadata and bypass regular data readahead, please set "meta-only" to this sysfs file. By default, bcache will back to cache all read- ahead requests now. Cc: stable@vger.kernel.org Signed-off-by: Coly Li Acked-by: Eric Wheeler Cc: Michael Lyle Signed-off-by: Jens Axboe commit 7c02b0055f774ed9afb6e1c7724f33bf148ffdc0 Author: Coly Li Date: Sat Feb 1 22:42:32 2020 +0800 bcache: explicity type cast in bset_bkey_last() In bset.h, macro bset_bkey_last() is defined as, bkey_idx((struct bkey *) (i)->d, (i)->keys) Parameter i can be variable type of data structure, the macro always works once the type of struct i has member 'd' and 'keys'. bset_bkey_last() is also used in macro csum_set() to calculate the checksum of a on-disk data structure. When csum_set() is used to calculate checksum of on-disk bcache super block, the parameter 'i' data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in struct cache_sb) the member keys is __u16 type. But bkey_idx() expects unsigned int (a 32bit width), so there is problem when sending parameters via stack to call bkey_idx(). Sparse tool from Intel 0day kbuild system reports this incompatible problem. bkey_idx() is part of user space API, so the simplest fix is to cast the (i)->keys to unsigned int type in macro bset_bkey_last(). Reported-by: kbuild test robot Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 5bebf7486d4f4940b2a8e4009beb1dff5041853d Author: Coly Li Date: Sat Feb 1 22:42:31 2020 +0800 bcache: fix memory corruption in bch_cache_accounting_clear() Commit 83ff9318c44ba ("bcache: not use hard coded memset size in bch_cache_accounting_clear()") tries to make the code more easy to understand by removing the hard coded number with following change, void bch_cache_accounting_clear(...) { memset(&acc->total.cache_hits, 0, - sizeof(unsigned long) * 7); + sizeof(struct cache_stats)); } Unfortunately the change was wrong (it also tells us the original code was not easy to correctly understand). The hard coded number 7 is used because in struct cache_stats, 15 struct cache_stats { 16 struct kobject kobj; 17 18 unsigned long cache_hits; 19 unsigned long cache_misses; 20 unsigned long cache_bypass_hits; 21 unsigned long cache_bypass_misses; 22 unsigned long cache_readaheads; 23 unsigned long cache_miss_collisions; 24 unsigned long sectors_bypassed; 25 26 unsigned int rescale; 27 }; only members in LINE 18-24 want to be set to 0. It is wrong to use 'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the memory objects behind acc->total is staled by this change. Сорокин Артем Сергеевич reports that by the following steps, kernel panic will be triggered, 1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache 2. Run in /sys/fs/bcache/: echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits I can reproduce the panic and get following dmesg with KASAN enabled, [22613.172742] ================================================================== [22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230 [22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753 [22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11 [22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [22613.172873] Call Trace: [22613.172964] dump_stack+0x8b/0xbb [22613.172968] ? sysfs_kf_seq_show+0x117/0x230 [22613.172970] ? sysfs_kf_seq_show+0x117/0x230 [22613.173031] __kasan_report+0x176/0x192 [22613.173064] ? pr_cont_kernfs_name+0x40/0x60 [22613.173067] ? sysfs_kf_seq_show+0x117/0x230 [22613.173070] kasan_report+0xe/0x20 [22613.173072] sysfs_kf_seq_show+0x117/0x230 [22613.173105] seq_read+0x199/0x6d0 [22613.173110] vfs_read+0xa5/0x1a0 [22613.173113] ksys_read+0x110/0x160 [22613.173115] ? kernel_write+0xb0/0xb0 [22613.173177] do_syscall_64+0x77/0x290 [22613.173238] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [22613.173241] RIP: 0033:0x7fc2c886ac61 [22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 [22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 [22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 [22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 [22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 [22613.173255] ================================================================== [22613.173256] Disabling lock debugging due to kernel taint [22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000 [22613.178380] #PF: supervisor read access in kernel mode [22613.180959] #PF: error_code(0x0000) - not-present page [22613.183444] PGD 0 P4D 0 [22613.184867] Oops: 0000 [#1] SMP KASAN PTI [22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G B 5.5.0-rc7-lp151.28.16-default+ #11 [22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 [22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 [22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 [22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 [22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 [22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd [22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 [22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 [22613.226290] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 [22613.229637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 [22613.234909] Call Trace: [22613.235931] seq_read+0x199/0x6d0 [22613.237259] vfs_read+0xa5/0x1a0 [22613.239229] ksys_read+0x110/0x160 [22613.240590] ? kernel_write+0xb0/0xb0 [22613.242040] do_syscall_64+0x77/0x290 [22613.243625] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [22613.245450] RIP: 0033:0x7fc2c886ac61 [22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 [22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 [22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 [22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 [22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 [22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua [22613.292429] CR2: 0000000000000000 [22613.293563] ---[ end trace a074b26a8508f378 ]--- [22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 [22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 [22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 [22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 [22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 [22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd [22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 [22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 [22613.318116] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 [22613.320743] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 Here this patch fixes the following problem by explicity set all the 7 members to 0 in bch_cache_accounting_clear(). Reported-by: Сорокин Артем Сергеевич Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 4c25df5640ae6e4491ee2c50d3f70c1559ef037d Merge: 34b5a946a954 3d7dfd632f9b Author: Michael Ellerman Date: Sat Feb 1 21:47:17 2020 +1100 Merge branch 'topic/user-access-begin' into next Merge the user_access_begin() series from Christophe. This is based on a commit from Linus that went into v5.5-rc7. commit febac332a819f0e764aa4da62757ba21d18c182b Author: Konstantin Khlebnikov Date: Fri Jan 31 19:08:59 2020 +0300 clocksource: Prevent double add_timer_on() for watchdog_timer Kernel crashes inside QEMU/KVM are observed: kernel BUG at kernel/time/timer.c:1154! BUG_ON(timer_pending(timer) || !timer->function) in add_timer_on(). At the same time another cpu got: general protection fault: 0000 [#1] SMP PTI of poinson pointer 0xdead000000000200 in: __hlist_del at include/linux/list.h:681 (inlined by) detach_timer at kernel/time/timer.c:818 (inlined by) expire_timers at kernel/time/timer.c:1355 (inlined by) __run_timers at kernel/time/timer.c:1686 (inlined by) run_timer_softirq at kernel/time/timer.c:1699 Unfortunately kernel logs are badly scrambled, stacktraces are lost. Printing the timer->function before the BUG_ON() pointed to clocksource_watchdog(). The execution of clocksource_watchdog() can race with a sequence of clocksource_stop_watchdog() .. clocksource_start_watchdog(): expire_timers() detach_timer(timer, true); timer->entry.pprev = NULL; raw_spin_unlock_irq(&base->lock); call_timer_fn clocksource_watchdog() clocksource_watchdog_kthread() or clocksource_unbind() spin_lock_irqsave(&watchdog_lock, flags); clocksource_stop_watchdog(); del_timer(&watchdog_timer); watchdog_running = 0; spin_unlock_irqrestore(&watchdog_lock, flags); spin_lock_irqsave(&watchdog_lock, flags); clocksource_start_watchdog(); add_timer_on(&watchdog_timer, ...); watchdog_running = 1; spin_unlock_irqrestore(&watchdog_lock, flags); spin_lock(&watchdog_lock); add_timer_on(&watchdog_timer, ...); BUG_ON(timer_pending(timer) || !timer->function); timer_pending() -> true BUG() I.e. inside clocksource_watchdog() watchdog_timer could be already armed. Check timer_pending() before calling add_timer_on(). This is sufficient as all operations are synchronized by watchdog_lock. Fixes: 75c5158f70c0 ("timekeeping: Update clocksource with stop_machine") Signed-off-by: Konstantin Khlebnikov Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/158048693917.4378.13823603769948933793.stgit@buzz commit 58bc6c69afe51ed19d1294ab0bb319b7df1cf75a Author: Randy Dunlap Date: Fri Jan 31 17:59:26 2020 -0800 arch/xtensa: fix Kconfig typos for HAVE_SMP Fix typos in xtensa Kconfig help text for HAVE_SMP. Signed-off-by: Randy Dunlap Cc: Chris Zankel Cc: Max Filippov Cc: linux-xtensa@linux-xtensa.org Message-Id: <500b2132-ea3c-a385-1f37-05664de5f1dd@infradead.org> Signed-off-by: Max Filippov commit a922b1561137fc516e7c77c478779f7d198cc9cf Author: Max Filippov Date: Fri Jan 31 21:20:58 2020 -0800 xtensa: clean up optional XCHAL_* definitions Simplify users of XCHAL_HAVE_EXTERN_REGS and XCHAL_HAVE_VECBASE and always define them as 0 if they're not defined in the variant/core.h Signed-off-by: Max Filippov commit 5b787914408ed903d087ffc3281bd6d4e93f94b5 Author: Max Filippov Date: Fri Jan 31 18:15:36 2020 -0800 xtensa: drop unused function fast_coprocessor_double fast_coprocessor_double is not used since commit c658eac628aa ("[XTENSA] Add support for configurable registers and coprocessors"). Remove it. There should be no coprocessor exceptions generated in the exception handling paths while PS.EXCM is set. Signed-off-by: Max Filippov commit 05bd330a7fd8875c423fc07d8ddcad73c10e556e Author: Dexuan Cui Date: Mon Jan 6 14:42:39 2020 -0800 x86/hyperv: Suspend/resume the hypercall page for hibernation For hibernation the hypercall page must be disabled before the hibernation image is created so that subsequent hypercall operations fail safely. On resume the hypercall page has to be restored and reenabled to ensure proper operation of the resumed kernel. Implement the necessary suspend/resume callbacks. [ tglx: Decrypted changelog ] Signed-off-by: Dexuan Cui Signed-off-by: Thomas Gleixner Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1578350559-130275-1-git-send-email-decui@microsoft.com commit 6f1a4891a5928a5969c87fa5a584844c983ec823 Author: Thomas Gleixner Date: Fri Jan 31 15:26:52 2020 +0100 x86/apic/msi: Plug non-maskable MSI affinity race Evan tracked down a subtle race between the update of the MSI message and the device raising an interrupt internally on PCI devices which do not support MSI masking. The update of the MSI message is non-atomic and consists of either 2 or 3 sequential 32bit wide writes to the PCI config space. - Write address low 32bits - Write address high 32bits (If supported by device) - Write data When an interrupt is migrated then both address and data might change, so the kernel attempts to mask the MSI interrupt first. But for MSI masking is optional, so there exist devices which do not provide it. That means that if the device raises an interrupt internally between the writes then a MSI message is sent built from half updated state. On x86 this can lead to spurious interrupts on the wrong interrupt vector when the affinity setting changes both address and data. As a consequence the device interrupt can be lost causing the device to become stuck or malfunctioning. Evan tried to handle that by disabling MSI accross an MSI message update. That's not feasible because disabling MSI has issues on its own: If MSI is disabled the PCI device is routing an interrupt to the legacy INTx mechanism. The INTx delivery can be disabled, but the disablement is not working on all devices. Some devices lose interrupts when both MSI and INTx delivery are disabled. Another way to solve this would be to enforce the allocation of the same vector on all CPUs in the system for this kind of screwed devices. That could be done, but it would bring back the vector space exhaustion problems which got solved a few years ago. Fortunately the high address (if supported by the device) is only relevant when X2APIC is enabled which implies interrupt remapping. In the interrupt remapping case the affinity setting is happening at the interrupt remapping unit and the PCI MSI message is programmed only once when the PCI device is initialized. That makes it possible to solve it with a two step update: 1) Target the MSI msg to the new vector on the current target CPU 2) Target the MSI msg to the new vector on the new target CPU In both cases writing the MSI message is only changing a single 32bit word which prevents the issue of inconsistency. After writing the final destination it is necessary to check whether the device issued an interrupt while the intermediate state #1 (new vector, current CPU) was in effect. This is possible because the affinity change is always happening on the current target CPU. The code runs with interrupts disabled, so the interrupt can be detected by checking the IRR of the local APIC. If the vector is pending in the IRR then the interrupt is retriggered on the new target CPU by sending an IPI for the associated vector on the target CPU. This can cause spurious interrupts on both the local and the new target CPU. 1) If the new vector is not in use on the local CPU and the device affected by the affinity change raised an interrupt during the transitional state (step #1 above) then interrupt entry code will ignore that spurious interrupt. The vector is marked so that the 'No irq handler for vector' warning is supressed once. 2) If the new vector is in use already on the local CPU then the IRR check might see an pending interrupt from the device which is using this vector. The IPI to the new target CPU will then invoke the handler of the device, which got the affinity change, even if that device did not issue an interrupt 3) If the new vector is in use already on the local CPU and the device affected by the affinity change raised an interrupt during the transitional state (step #1 above) then the handler of the device which uses that vector on the local CPU will be invoked. expose issues in device driver interrupt handlers which are not prepared to handle a spurious interrupt correctly. This not a regression, it's just exposing something which was already broken as spurious interrupts can happen for a lot of reasons and all driver handlers need to be able to deal with them. Reported-by: Evan Green Debugged-by: Evan Green Signed-off-by: Thomas Gleixner Tested-by: Evan Green Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87imkr4s7n.fsf@nanos.tec.linutronix.de commit 2acf25f13ebe8beb40e97a1bbe76f36277c64f1e Author: Takashi Iwai Date: Sat Feb 1 09:05:30 2020 +0100 ALSA: dummy: Fix PCM format loop in proc output The loop termination for iterating over all formats should contain SNDRV_PCM_FORMAT_LAST, not less than it. Fixes: 9b151fec139d ("ALSA: dummy - Add debug proc file") Cc: Link: https://lore.kernel.org/r/20200201080530.22390-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit d8f489355cff55b30731354317739a00cf1238bd Author: Takashi Iwai Date: Sat Feb 1 09:05:29 2020 +0100 ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk The Scarlett gen2 mixer quirk code defines a few record types to communicate via USB hub, and those must be all little-endian. This patch changes the field types to LE to annotate endianess properly. It also fixes the incorrect usage of leXX_to_cpu() in a couple of places, which was caught by sparse after this change. Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") Cc: Link: https://lore.kernel.org/r/20200201080530.22390-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit f8e5f90b3a53bb75f05124ed19156388379a337d Author: Takashi Iwai Date: Sat Feb 1 09:05:28 2020 +0100 ALSA: usb-audio: Fix endianess in descriptor validation I overlooked that some fields are words and need the converts from LE in the recently added USB descriptor validation code. This patch fixes those with the proper macro usages. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Cc: Link: https://lore.kernel.org/r/20200201080530.22390-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 78be2228c15dd45865b102b29d72e721f0ace9b1 Author: Yong Zhi Date: Fri Jan 31 14:40:03 2020 -0600 ALSA: hda: Add JasperLake PCI ID and codec vid Add HD Audio Device PCI ID and codec vendor_id for the Intel JasperLake REV2/A0 silicon. Signed-off-by: Yong Zhi Signed-off-by: Pierre-Louis Bossart Cc: Link: https://lore.kernel.org/r/20200131204003.10153-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 784f8344de750a41344f4bbbebb8507a730fc99c Author: Eric Dumazet Date: Fri Jan 31 10:44:50 2020 -0800 tcp: clear tp->segs_{in|out} in tcp_disconnect() tp->segs_in and tp->segs_out need to be cleared in tcp_disconnect(). tcp_disconnect() is rarely used, but it is worth fixing it. Fixes: 2efd055c53c0 ("tcp: add tcpi_segs_in and tcpi_segs_out to tcp_info") Signed-off-by: Eric Dumazet Cc: Marcelo Ricardo Leitner Cc: Yuchung Cheng Cc: Neal Cardwell Acked-by: Neal Cardwell Signed-off-by: Jakub Kicinski commit db7ffee6f3eb3683cdcaeddecc0a630a14546fe3 Author: Eric Dumazet Date: Fri Jan 31 10:32:41 2020 -0800 tcp: clear tp->data_segs{in|out} in tcp_disconnect() tp->data_segs_in and tp->data_segs_out need to be cleared in tcp_disconnect(). tcp_disconnect() is rarely used, but it is worth fixing it. Fixes: a44d6eacdaf5 ("tcp: Add RFC4898 tcpEStatsPerfDataSegsOut/In") Signed-off-by: Eric Dumazet Cc: Martin KaFai Lau Cc: Yuchung Cheng Cc: Neal Cardwell Acked-by: Neal Cardwell Signed-off-by: Jakub Kicinski commit 2fbdd56251b5c62f96589f39eded277260de7267 Author: Eric Dumazet Date: Fri Jan 31 10:22:47 2020 -0800 tcp: clear tp->delivered in tcp_disconnect() tp->delivered needs to be cleared in tcp_disconnect(). tcp_disconnect() is rarely used, but it is worth fixing it. Fixes: ddf1af6fa00e ("tcp: new delivery accounting") Signed-off-by: Eric Dumazet Cc: Yuchung Cheng Cc: Neal Cardwell Acked-by: Yuchung Cheng Acked-by: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: Jakub Kicinski commit c13c48c00a6bc1febc73902505bdec0967bd7095 Author: Eric Dumazet Date: Fri Jan 31 09:14:47 2020 -0800 tcp: clear tp->total_retrans in tcp_disconnect() total_retrans needs to be cleared in tcp_disconnect(). tcp_disconnect() is rarely used, but it is worth fixing it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Cc: SeongJae Park Signed-off-by: Jakub Kicinski commit b19efcabb587e5470a423ef778905f47e5a47f1a Merge: 996d5d5f89a5 c5ccf2ad3d33 Author: Dmitry Torokhov Date: Fri Jan 31 17:42:33 2020 -0800 Merge branch 'next' into for-linus Prepare input updates for 5.6 merge window. commit c5ccf2ad3d33413fee06ae87d0b970d8cc540db6 Author: Lucas Stach Date: Fri Jan 31 17:38:19 2020 -0800 Input: synaptics-rmi4 - switch to reduced reporting mode When the distance thresholds are set the controller must be in reduced reporting mode for them to have any effect on the interrupt generation. This has a potentially large impact on the number of events the host needs to process. Signed-off-by: Lucas Stach Reviewed-by: Andrew Duggan Link: https://lore.kernel.org/r/20200120111628.18376-1-l.stach@pengutronix.de Signed-off-by: Dmitry Torokhov commit 249d7b2ef674cdae28c377cfe6f56696548305d5 Author: Tom Zanussi Date: Fri Jan 31 15:55:31 2020 -0600 tracing: Consolidate some synth_event_trace code The synth_event trace code contains some almost identical functions and some small functions that are called only once - consolidate the common code into single functions and fold in the small functions to simplify the code overall. Link: http://lkml.kernel.org/r/d1c8d8ad124a653b7543afe801d38c199ca5c20e.1580506712.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 26dca6dbd62d74a5012cafab6b2d6d65a01ea69c Merge: 846de71bedef 01b810ed7187 Author: Linus Torvalds Date: Fri Jan 31 14:48:54 2020 -0800 Merge tag 'pci-v5.6-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "Resource management: - Improve resource assignment for hot-added nested bridges, e.g., Thunderbolt (Nicholas Johnson) Power management: - Optionally print config space of devices before suspend (Chen Yu) - Increase D3 delay for AMD Ryzen5/7 XHCI controllers (Daniel Drake) Virtualization: - Generalize DMA alias quirks (James Sewart) - Add DMA alias quirk for PLX PEX NTB (James Sewart) - Fix IOV memory leak (Navid Emamdoost) AER: - Log which device prevents error recovery (Yicong Yang) Peer-to-peer DMA: - Whitelist Intel SkyLake-E (Armen Baloyan) Broadcom iProc host bridge driver: - Apply PAXC quirk whether driver is built-in or module (Wei Liu) Broadcom STB host bridge driver: - Add Broadcom STB PCIe host controller driver (Jim Quinlan) Intel Gateway SoC host bridge driver: - Add driver for Intel Gateway SoC (Dilip Kota) Intel VMD host bridge driver: - Add support for DMA aliases on other buses (Jon Derrick) - Remove dma_map_ops overrides (Jon Derrick) - Remove now-unused X86_DEV_DMA_OPS (Christoph Hellwig) NVIDIA Tegra host bridge driver: - Fix Tegra30 afi_pex2_ctrl register offset (Marcel Ziswiler) Panasonic UniPhier host bridge driver: - Remove module code since driver can't be built as a module (Masahiro Yamada) Qualcomm host bridge driver: - Add support for SDM845 PCIe controller (Bjorn Andersson) TI Keystone host bridge driver: - Fix "num-viewport" DT property error handling (Kishon Vijay Abraham I) - Fix link training retries initiation (Yurii Monakov) - Fix outbound region mapping (Yurii Monakov) Misc: - Add Switchtec Gen4 support (Kelvin Cao) - Add Switchtec Intercomm Notify and Upstream Error Containment support (Logan Gunthorpe) - Use dma_set_mask_and_coherent() since Switchtec supports 64-bit addressing (Wesley Sheng)" * tag 'pci-v5.6-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (60 commits) PCI: Allow adjust_bridge_window() to shrink resource if necessary PCI: Set resource size directly in adjust_bridge_window() PCI: Rename extend_bridge_window() to adjust_bridge_window() PCI: Rename extend_bridge_window() parameter PCI: Consider alignment of hot-added bridges when assigning resources PCI: Remove local variable usage in pci_bus_distribute_available_resources() PCI: Pass size + alignment to pci_bus_distribute_available_resources() PCI: Rename variables PCI: vmd: Add two VMD Device IDs PCI: Remove unnecessary braces PCI: brcmstb: Add MSI support PCI: brcmstb: Add Broadcom STB PCIe host controller driver x86/PCI: Remove X86_DEV_DMA_OPS PCI: vmd: Remove dma_map_ops overrides iommu/vt-d: Remove VMD child device sanity check iommu/vt-d: Use pci_real_dma_dev() for mapping PCI: Introduce pci_real_dma_dev() x86/PCI: Expose VMD's pci_dev in struct pci_sysdata x86/PCI: Add to_pci_sysdata() helper PCI/AER: Initialize aer_fifo ... commit 846de71bedefb530461ee70ec82f7c810ef14e59 Merge: 8fdd4019bcb2 1697d9812481 Author: Linus Torvalds Date: Fri Jan 31 14:43:23 2020 -0800 Merge tag 'media/v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - New staging driver for Rockship ISPv1 unit - New staging driver for Rockchip MIPI Synopsys DPHY RX0 - y2038 fixes at V4L2 API (backward-compatible) - A dvb core fix when receiving invalid EIT sections - Some clang-specific warnings got fixed - Added support for touch V4L2 interface at vivid - Several drivers were converted to use the new i2c_new_scanned_device() kAPI - Added sm1 support at meson's vdec driver - Several other driver cleanups, fixes and improvements * tag 'media/v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (207 commits) media: staging/intel-ipu3: remove TODO item about acronyms media: v4l2-fwnode: Print the node name while parsing endpoints media: Revert "media: staging/intel-ipu3: make imgu use fixed running mode" media: mt9v111: constify copied structure media: platform: VIDEO_MEDIATEK_JPEG can also depend on MTK_IOMMU media: uvcvideo: Add a quirk to force GEO GC6500 Camera bits-per-pixel value media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors media: hantro: fix post-processing NULL pointer dereference media: rcar-vin: Use correct pixel format when aligning format media: MAINTAINERS: add entry for Rockchip ISP1 driver media: staging: rkisp1: add TODO file for staging media: staging: rkisp1: add document for rkisp1 meta buffer format media: staging: rkisp1: add output device for parameters media: staging: rkisp1: add capture device for statistics media: staging: rkisp1: add user space ABI definitions media: staging: rkisp1: add streaming paths media: staging: rkisp1: add Rockchip ISP1 base driver media: staging: phy-rockchip-dphy-rx0: add Rockchip MIPI Synopsys DPHY RX0 driver media: staging: dt-bindings: add Rockchip MIPI RX D-PHY RX0 yaml bindings media: staging: dt-bindings: add Rockchip ISP1 yaml bindings ... commit 8fdd4019bcb2d824c5ab45c6fc340293cfed843f Merge: 68b62e5d965a 8889f6fa3588 Author: Linus Torvalds Date: Fri Jan 31 14:40:36 2020 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "A very quiet cycle with few notable changes. Mostly the usual list of one or two patches to drivers changing something that isn't quite rc worthy. The subsystem seems to be seeing a larger number of rework and cleanup style patches right now, I feel that several vendors are prepping their drivers for new silicon. Summary: - Driver updates and cleanup for qedr, bnxt_re, hns, siw, mlx5, mlx4, rxe, i40iw - Larger series doing cleanup and rework for hns and hfi1. - Some general reworking of the CM code to make it a little more understandable - Unify the different code paths connected to the uverbs FD scheme - New UAPI ioctls conversions for get context and get async fd - Trace points for CQ and CM portions of the RDMA stack - mlx5 driver support for virtio-net formatted rings as RDMA raw ethernet QPs - verbs support for setting the PCI-E relaxed ordering bit on DMA traffic connected to a MR - A couple of bug fixes that came too late to make rc7" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (108 commits) RDMA/core: Make the entire API tree static RDMA/efa: Mask access flags with the correct optional range RDMA/cma: Fix unbalanced cm_id reference count during address resolve RDMA/umem: Fix ib_umem_find_best_pgsz() IB/mlx4: Fix leak in id_map_find_del IB/opa_vnic: Spelling correction of 'erorr' to 'error' IB/hfi1: Fix logical condition in msix_request_irq RDMA/cm: Remove CM message structs RDMA/cm: Use IBA functions for complex structure members RDMA/cm: Use IBA functions for simple structure members RDMA/cm: Use IBA functions for swapping get/set acessors RDMA/cm: Use IBA functions for simple get/set acessors RDMA/cm: Add SET/GET implementations to hide IBA wire format RDMA/cm: Add accessors for CM_REQ transport_type IB/mlx5: Return the administrative GUID if exists RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence IB/mlx4: Fix memory leak in add_gid error flow IB/mlx5: Expose RoCE accelerator counters RDMA/mlx5: Set relaxed ordering when requested RDMA/core: Add the core support field to METHOD_GET_CONTEXT ... commit 68b62e5d965a8cbcfa287ee7754cf06e9b3775ab Merge: ffda81b69fce 8c173d5e044d Author: Linus Torvalds Date: Fri Jan 31 14:39:21 2020 -0800 Merge tag 'thermal-v5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal fixes from Daniel Lezcano: - Fix a severe docs build failure for cpu idle cooling device (Randy Dunlap) - Fix a spelling mistake in the error message for the stm32 (Colin Ian King) * tag 'thermal-v5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal: stm32: fix spelling mistake "preprare" -> "prepare" Documentation: cpu-idle-cooling: fix a SEVERE docs build failure commit ffda81b69fce50f2543be99ef2d7c77dffc1ebc1 Merge: cf3c8f84d140 d8639f0d6c23 Author: Linus Torvalds Date: Fri Jan 31 14:38:17 2020 -0800 Merge tag 'acpi-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "Fix up MAINTAINERS entires related to ACPI (Andy Shevchenko)" * tag 'acpi-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: MAINTAINERS: Sort entries in database for X-POWERS AXP288 MAINTAINERS: Sort entries in database for ACPICA MAINTAINERS: Sort entries in database for ACPI commit cf3c8f84d1401fed5010784034d104cc689061d5 Merge: a62aa6f7f50a 82b2c6ffd399 Author: Linus Torvalds Date: Fri Jan 31 14:36:35 2020 -0800 Merge tag 'pm-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power manadement updates from Rafael Wysocki: "Prevent cpufreq from creating excessively large stack frames and fix the handling of devices deleted during system-wide resume in the PM core (Rafael Wysocki), revert a problematic commit affecting the cpupower utility and correct its man page (Thomas Renninger, Brahadambal Srinivasan), and improve the intel_pstate_tracer utility (Doug Smythies)" * tag 'pm-5.6-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: tools/power/x86/intel_pstate_tracer: change several graphs to autoscale y-axis tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility Correction to manpage of cpupower cpufreq: Avoid creating excessively large stack frames PM: core: Fix handling of devices deleted during system-wide resume cpupower: Revert library ABI changes from commit ae2917093fb60bdc1ed3e commit db865ee447d46eccd641dc70c7f9acc231a3141e Merge: 6e7a9f0c4ea8 498e165274f3 660b94e0d8fe 34bbe0361707 185dfe32d7e2 9e0cda721d18 9cd10205227c a932872f1b76 Author: Stephen Boyd Date: Fri Jan 31 13:14:26 2020 -0800 Merge branches 'clk-imx', 'clk-ti', 'clk-xilinx', 'clk-nvidia', 'clk-qcom', 'clk-freescale' and 'clk-qoriq' into clk-next - Support for Xilinx Versal platform clks - Display clk controller on qcom sc7180 - Video clk controller on qcom sc7180 - Graphics clk controller on qcom sc7180 - CPU PLLs for qcom msm8916 - Fixes for clk controllers on qcom msm8998 SoCs - Move qcom msm8974 gfx3d clk to RPM control - Display port clk support on qcom sdm845 SoCs - Global clk controller on qcom ipq6018 - Adjust composite clk to new way of describing clk parents - Add a driver for BCLK of Freescale SAI cores * clk-imx: (32 commits) clk: imx: Add support for i.MX8MP clock driver dt-bindings: imx: Add clock binding doc for i.MX8MP clk: imx: gate4: Switch imx_clk_gate4_flags() to clk_hw based API clk: imx: imx8mq: Switch to clk_hw based API clk: imx: imx8mm: Switch to clk_hw based API clk: imx: imx8mn: Switch to clk_hw based API clk: imx: Remove __init for imx_obtain_fixed_clk_hw() API clk: imx: gate3: Switch to clk_hw based API clk: imx: add hw API imx_clk_hw_mux2_flags clk: imx: add imx_unregister_hw_clocks clk: imx: clk-composite-8m: Switch to clk_hw based API clk: imx: clk-pll14xx: Switch to clk_hw based API clk: imx7up: Rename the clks to hws clk: imx: Rename the imx_clk_divider_gate to imply it's clk_hw based clk: imx: Rename the imx_clk_pfdv2 to imply it's clk_hw based clk: imx: Rename the imx_clk_pllv4 to imply it's clk_hw based clk: imx: Rename sccg and frac pll register to suggest clk_hw clk: imx: imx7ulp composite: Rename to show is clk_hw based clk: imx: pllv2: Switch to clk_hw based API clk: imx: pllv1: Switch to clk_hw based API ... * clk-ti: clk: ti: clkctrl: Fix hidden dependency to node name clk: ti: add clkctrl data dra7 sgx clk: ti: omap5: Add missing AESS clock clk: ti: dra7: fix parent for gmac_clkctrl clk: ti: dra7: add vpe clkctrl data clk: ti: dra7: add cam clkctrl data dt-bindings: clock: Move ti-dra7-atl.h to dt-bindings/clock * clk-xilinx: clk: zynqmp: Add support for clock with CLK_DIVIDER_POWER_OF_TWO flag clk: zynqmp: Fix divider calculation clk: zynqmp: Add support for get max divider clk: zynqmp: Warn user if clock user are more than allowed clk: zynqmp: Extend driver for versal dt-bindings: clock: Add bindings for versal clock driver * clk-nvidia: clk: tegra20/30: Explicitly set parent clock for Video Decoder clk: tegra20/30: Don't pre-initialize displays parent clock clk: tegra: divider: Check UART's divider enable-bit state on rate's recalculation clk: tegra: clk-dfll: Remove call to pm_runtime_irq_safe() clk: tegra: Mark fuse clock as critical * clk-qcom: (35 commits) clk: qcom: rpmh: Sort OF match table dt-bindings: fix warnings in validation of qcom,gcc.yaml dt-binding: fix compilation error of the example in qcom,gcc.yaml clk: qcom: Add ipq6018 Global Clock Controller support clk: qcom: Add DT bindings for ipq6018 gcc clock controller clk: qcom: gcc-msm8996: Fix parent for CLKREF clocks clk: qcom: rpmh: Add IPA clock for SC7180 clk: qcom: rpmh: skip undefined clocks when registering clk: qcom: Add video clock controller driver for SC7180 dt-bindings: clock: Introduce SC7180 QCOM Video clock bindings dt-bindings: clock: Add YAML schemas for the QCOM VIDEOCC clock bindings clk: qcom: Add graphics clock controller driver for SC7180 dt-bindings: clock: Introduce SC7180 QCOM Graphics clock bindings dt-bindings: clock: Add YAML schemas for the QCOM GPUCC clock bindings clk: qcom: apcs-msm8916: use clk_parent_data to specify the parent clk: qcom: Add display clock controller driver for SC7180 dt-bindings: clock: Introduce QCOM sc7180 display clock bindings dt-bindings: clock: Add YAML schemas for the QCOM DISPCC clock bindings clk: qcom: clk-alpha-pll: Add support for Fabia PLL calibration clk: qcom: alpha-pll: Remove useless read from set rate ... * clk-freescale: clk: fsl-sai: new driver dt-bindings: clock: document the fsl-sai driver clk: composite: add _register_composite_pdata() variants * clk-qoriq: clk: qoriq: add ls1088a hwaccel clocks support clk: ls1028a: Add clock driver for Display output interface dt/bindings: clk: Add YAML schemas for LS1028A Display Clock bindings commit b581098482e6f177a4f64ea021fd5a9327ea08d5 Author: Steve French Date: Fri Jan 31 15:13:22 2020 -0600 cifs: update internal module version number To 2.25 Signed-off-by: Steve French commit 6e7a9f0c4ea83b570175c08e7af3ce4711b554f3 Merge: 36bf7a5bdd34 37215da5553e ff258817137a c1c95a46ed15 31ef091770da fa9ae3057d7a Author: Stephen Boyd Date: Fri Jan 31 13:12:14 2020 -0800 Merge branches 'clk-debugfs-danger', 'clk-basic-hw', 'clk-renesas', 'clk-amlogic' and 'clk-allwinner' into clk-next - Support dangerous debugfs actions on clks with dead code - Convert gpio, fixed-factor, mux, gate, divider basic clks to hw based APIs * clk-debugfs-danger: clk: Add support for setting clk_rate via debugfs * clk-basic-hw: clk: divider: Add support for specifying parents via DT/pointers clk: gate: Add support for specifying parents via DT/pointers clk: mux: Add support for specifying parents via DT/pointers clk: asm9260: Use parent accuracy in fixed rate clk clk: fixed-rate: Document that accuracy isn't a rate clk: fixed-rate: Add clk flags for parent accuracy clk: fixed-rate: Add support for specifying parents via DT/pointers clk: fixed-rate: Document accuracy member clk: fixed-rate: Move to_clk_fixed_rate() to C file clk: fixed-rate: Remove clk_register_fixed_rate_with_accuracy() clk: fixed-rate: Convert to clk_hw based APIs clk: gpio: Use DT way of specifying parents * clk-renesas: clk: renesas: Prepare for split of R-Car H3 config symbol dt-bindings: clock: renesas: cpg-mssr: Fix r8a774b1 typo clk: renesas: r7s9210: Add SPIBSC clock clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks clk: renesas: Remove use of ARCH_R8A7796 clk: renesas: rcar-gen2: Change multipliers and dividers to u8 * clk-amlogic: clk: clarify that clk_set_rate() does updates from top to bottom clk: meson: meson8b: make the CCF use the glitch-free mali mux clk: meson: pll: Fix by 0 division in __pll_params_to_rate() clk: meson: g12a: fix missing uart2 in regmap table clk: meson: meson8b: use of_clk_hw_register to register the clocks clk: meson: meson8b: don't register the XTAL clock when provided via OF clk: meson: meson8b: change references to the XTAL clock to use [fw_]name clk: meson: meson8b: use clk_hw_set_parent in the CPU clock notifier clk: meson: add a driver for the Meson8/8b/8m2 DDR clock controller dt-bindings: clock: meson8b: add the clock inputs dt-bindings: clock: add the Amlogic Meson8 DDR clock controller binding * clk-allwinner: clk: sunxi: a23/a33: Export the MIPI PLL clk: sunxi: a31: Export the MIPI PLL clk: sunxi-ng: a64: export CLK_CPUX clock for DVFS clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock clk: sunxi-ng: r40: Export MBUS clock clk: sunxi: use of_device_get_match_data commit 36bf7a5bdd349dd150b9c6bc8d5601bd1069ce9f Merge: 28db9a8c82a8 1ec09a2ec67a 2d2699926143 248fdcc77a35 333d2d19df09 66d9f5214c9b Author: Stephen Boyd Date: Fri Jan 31 13:12:00 2020 -0800 Merge branches 'clk-uniphier', 'clk-warn-critical', 'clk-ux500', 'clk-kconfig' and 'clk-at91' into clk-next - Warn about critical clks that fail to enable or prepare - Detect more PRMCU variants in ux500 driver * clk-uniphier: clk: uniphier: Add SCSSI clock gate for each channel * clk-warn-critical: clk: Warn about critical clks that fail to enable clk: Don't try to enable critical clocks if prepare failed clk: tegra: Fix double-free in tegra_clk_init() clk: samsung: exynos5420: Keep top G3D clocks enabled clk: qcom: Avoid SMMU/cx gdsc corner cases clk: qcom: gcc-sc7180: Fix setting flag for votable GDSCs clk: Move clk_core_reparent_orphans() under CONFIG_OF clk: at91: fix possible deadlock clk: walk orphan list on clock provider registration clk: imx: pll14xx: fix clk_pll14xx_wait_lock clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table clk: imx: clk-composite-8m: add lock to gate/mux * clk-ux500: clk: ux500: Fix up the SGA clock for some variants * clk-kconfig: clk: Fix Kconfig indentation * clk-at91: clk: at91: sam9x60: fix programmable clock prescaler clk: at91: sam9x60-pll: adapt PMC_PLL_ACR default value commit 28db9a8c82a81efb8c2548104a5416bb8d101176 Merge: f873744c2903 59ef4da4e408 9011f92622e5 Author: Stephen Boyd Date: Fri Jan 31 13:11:52 2020 -0800 Merge branches 'clk-init-allocation', 'clk-unused' and 'clk-register-dt-node-better' into clk-next - Let clk_ops::init() return an error code - Add a clk_ops::terminate() callback to undo clk_ops::init() * clk-init-allocation: clk: add terminate callback to clk_ops clk: let init callback return an error code clk: actually call the clock init before any other callback of the clock * clk-unused: clk: bm1800: Remove set but not used variable 'fref' * clk-register-dt-node-better: clk: Use parent node pointer during registration if necessary commit a62aa6f7f50a9a0af5e07d98774f8a7b439d390f Merge: 677b60dcb68a a31b4ec539e9 Author: Linus Torvalds Date: Fri Jan 31 13:07:16 2020 -0800 Merge tag 'gfs2-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Fix some corner cases on filesystems with a block size < page size. - Fix a corner case that could expose incorrect access times over nfs. - Revert an otherwise sensible revoke accounting cleanup that causes assertion failures. The revoke accounting is whacky and needs to be fixed properly before we can add back this cleanup. - Various other minor cleanups. In addition, please expect to see another pull request from Bob Peterson about his gfs2 recovery patch queue shortly. * tag 'gfs2-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: Revert "gfs2: eliminate tr_num_revoke_rm" gfs2: remove unused LBIT macros fs/gfs2: remove unused IS_DINODE and IS_LEAF macros gfs2: Remove GFS2_MIN_LVB_SIZE define gfs2: Fix incorrect variable name gfs2: Avoid access time thrashing in gfs2_inode_lookup gfs2: minor cleanup: remove unneeded variable ret in gfs2_jdata_writepage gfs2: eliminate ssize parameter from gfs2_struct2blk gfs2: Another gfs2_find_jhead fix commit 677b60dcb68a0c43822b5a8ad97733b4193386b9 Merge: 7eec11d3a784 243145bc4336 Author: Linus Torvalds Date: Fri Jan 31 12:58:12 2020 -0800 Merge tag 'iomap-5.6-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap fix from Darrick Wong: "A single patch fixing an off-by-one error when we're checking to see how far we're gotten into an EOF page" * tag 'iomap-5.6-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: fs: Fix page_mkwrite off-by-one errors commit c472a0b0a1fd1688157b4ad6efc1c3fb8e571a53 Author: Thierry Reding Date: Fri Jan 31 17:59:10 2020 +0100 drm/tegra: sor: Initialize runtime PM before use Commit fd67e9c6ed5a ("drm/tegra: Do not implement runtime PM") replaced the generic runtime PM usage by a host1x bus-specific implementation in order to work around some assumptions baked into runtime PM that are in conflict with the requirements in the Tegra DRM driver. Unfortunately the new runtime PM callbacks are not setup yet at the time when the SOR driver first needs to resume the device to register the SOR pad clock, and accesses to register will cause the system to hang. Note that this only happens on Tegra124 and Tegra210 because those are the only SoCs where the SOR pad clock is registered from the SOR driver. Later generations use a SOR pad clock provided by the BPMP. Fix this by moving the registration of the SOR pad clock after the host1x client has been registered. That's somewhat suboptimal because this could potentially, though it's very unlikely, cause the Tegra DRM to be probed if the SOR happens to be the last subdevice to register, only to be immediately removed again if the SOR pad output clock fails to register. That's just a minor annoyance, though, and doesn't justify implementing a workaround. Fixes: fd67e9c6ed5a ("drm/tegra: Do not implement runtime PM") Signed-off-by: Thierry Reding commit ad2139cb80a7a9afbfe428d0448d351a84e22ee6 Author: Thierry Reding Date: Fri Jan 31 17:59:09 2020 +0100 drm/tegra: sor: Disable runtime PM on probe failure If the driver fails to probe, make sure to disable runtime PM again. While at it, make the cleanup code in ->remove() symmetric. Signed-off-by: Thierry Reding commit a5127a2dbe95dd72b6a21c98dee0857511f30357 Author: Thierry Reding Date: Fri Jan 31 17:59:08 2020 +0100 drm/tegra: sor: Suspend on clock registration failure Make sure the SOR module is suspenden after we fail to register the SOR pad output clock. Signed-off-by: Thierry Reding commit 64716b9ec5ba3342d3a9f0464d2abb48de65b327 Author: Max Filippov Date: Sun Dec 15 02:48:51 2019 -0800 xtensa: drop empty platform_* functions from platforms Provide missing default implementation for platform_init and drop copies of default platform_init, platform_setup and platform_heartbeet from platforms/*/setup.c Signed-off-by: Max Filippov commit e725331354924b3f720c8bb7ca579d44cc63e574 Author: Max Filippov Date: Sun Dec 15 02:44:59 2019 -0800 xtensa: clean up platform headers Drop include directives for irrelevant headers in asm/platform.h and its users. Sort remaining headers. Signed-off-by: Max Filippov commit 7da04e48798461f6598d2c0ef8c1bac3e5ea1dee Author: Max Filippov Date: Sun Dec 15 02:55:58 2019 -0800 xtensa: drop set_except_vector declaration There's no implementation for set_except_vector function in the xtensa code. Drop its declaration. Signed-off-by: Max Filippov commit 7eec11d3a784a283f916590e5aa30b855c2ccfd7 Merge: ddaefe8947b4 43e76af85fa7 Author: Linus Torvalds Date: Fri Jan 31 12:16:36 2020 -0800 Merge branch 'akpm' (patches from Andrew) Pull updates from Andrew Morton: "Most of -mm and quite a number of other subsystems: hotfixes, scripts, ocfs2, misc, lib, binfmt, init, reiserfs, exec, dma-mapping, kcov. MM is fairly quiet this time. Holidays, I assume" * emailed patches from Andrew Morton : (118 commits) kcov: ignore fault-inject and stacktrace include/linux/io-mapping.h-mapping: use PHYS_PFN() macro in io_mapping_map_atomic_wc() execve: warn if process starts with executable stack reiserfs: prevent NULL pointer dereference in reiserfs_insert_item() init/main.c: fix misleading "This architecture does not have kernel memory protection" message init/main.c: fix quoted value handling in unknown_bootoption init/main.c: remove unnecessary repair_env_string in do_initcall_level init/main.c: log arguments and environment passed to init fs/binfmt_elf.c: coredump: allow process with empty address space to coredump fs/binfmt_elf.c: coredump: delete duplicated overflow check fs/binfmt_elf.c: coredump: allocate core ELF header on stack fs/binfmt_elf.c: make BAD_ADDR() unlikely fs/binfmt_elf.c: better codegen around current->mm fs/binfmt_elf.c: don't copy ELF header around fs/binfmt_elf.c: fix ->start_code calculation fs/binfmt_elf.c: smaller code generation around auxv vector fill lib/find_bit.c: uninline helper _find_next_bit() lib/find_bit.c: join _find_next_bit{_le} uapi: rename ext2_swab() to swab() and share globally in swab.h lib/scatterlist.c: adjust indentation in __sg_alloc_table ... commit ddaefe8947b48b638f726cf89730ecc1000ebcc3 Merge: c5951e7c8ee5 6080d608eeff Author: Linus Torvalds Date: Fri Jan 31 11:42:13 2020 -0800 Merge tag 'modules-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull module updates from Jessica Yu: "Summary of modules changes for the 5.6 merge window: - Add "MS" (SHF_MERGE|SHF_STRINGS) section flags to __ksymtab_strings to indicate to the linker that it can perform string deduplication (i.e., duplicate strings are reduced to a single copy in the string table). This means any repeated namespace string would be merged to just one entry in __ksymtab_strings. - Various code cleanups and small fixes (fix small memleak in error path, improve moduleparam docs, silence rcu warnings, improve error logging)" * tag 'modules-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: module.h: Annotate mod_kallsyms with __rcu module: avoid setting info->name early in case we can fall back to info->mod->name modsign: print module name along with error message kernel/module: Fix memleak in module_add_modinfo_attrs() export.h: reduce __ksymtab_strings string duplication by using "MS" section flags moduleparam: fix kerneldoc modules: lockdep: Suppress suspicious RCU usage warning commit c5951e7c8ee5cb04b8b41c32bf567b90117a2124 Merge: b7e573bb4a7a 2c4288719806 Author: Linus Torvalds Date: Fri Jan 31 11:28:31 2020 -0800 Merge tag 'mips_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS changes from Paul Burton: "Nothing too big or scary in here: - Support mremap() for the VDSO, primarily to allow CRIU to restore the VDSO to its checkpointed location. - Restore the MIPS32 cBPF JIT, after having reverted the enablement of the eBPF JIT for MIPS32 systems in the 5.5 cycle. - Improve cop0 counter synchronization behaviour whilst onlining CPUs by running with interrupts disabled. - Better match FPU behaviour when emulating multiply-accumulate instructions on pre-r6 systems that implement IEEE754-2008 style MACs. - Loongson64 kernels now build using the MIPS64r2 ISA, allowing them to take advantage of instructions introduced by r2. - Support for the Ingenic X1000 SoC & the really nice little CU Neo development board that's using it. - Support for WMAC on GARDENA Smart Gateway devices. - Lots of cleanup & refactoring of SGI IP27 (Origin 2*) support in preparation for introducing IP35 (Origin 3*) support. - Various Kconfig & Makefile cleanups" * tag 'mips_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (60 commits) MIPS: PCI: Add detection of IOC3 on IO7, IO8, IO9 and Fuel MIPS: Loongson64: Disable exec hazard MIPS: Loongson64: Bump ISA level to MIPSR2 MIPS: Make DIEI support as a config option MIPS: OCTEON: octeon-irq: fix spelling mistake "to" -> "too" MIPS: asm: local: add barriers for Loongson MIPS: Loongson64: Select mac2008 only feature MIPS: Add MAC2008 Support Revert "MIPS: Add custom serial.h with BASE_BAUD override for generic kernel" MIPS: sort MIPS and MIPS_GENERIC Kconfig selects alphabetically (again) MIPS: make CPU_HAS_LOAD_STORE_LR opt-out MIPS: generic: don't unconditionally select PINCTRL MIPS: don't explicitly select LIBFDT in Kconfig MIPS: sync-r4k: do slave counter synchronization with disabled HW interrupts MIPS: SGI-IP30: Check for valid pointer before using it MIPS: syscalls: fix indentation of the 'SYSNR' message MIPS: boot: fix typo in 'vmlinux.lzma.its' target MIPS: fix indentation of the 'RELOCS' message dt-bindings: Document loongson vendor-prefix MIPS: CU1000-Neo: Refresh defconfig to support HWMON and WiFi. ... commit b7e573bb4a7a511741f8942b1fb03cfe602ee57f Merge: a1084542a8e8 f45ba2bd6da0 Author: Linus Torvalds Date: Fri Jan 31 11:26:11 2020 -0800 Merge tag 'arc-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta: - Wire up clone3 syscall - ARCv2 FPU state save/restore across context switch - AXS10x platform and misc fixes * tag 'arc-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARCv2: fpu: preserve userspace fpu state ARC: fpu: declutter code, move bits out into fpu.h ARC: wireup clone3 syscall ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node ARC: update feature support for jump-labels commit a1084542a8e83b8eb5aaf7e8ccb81b461e7d4ce8 Merge: b70a2d6b29f7 61ffb9d27860 Author: Linus Torvalds Date: Fri Jan 31 11:23:29 2020 -0800 Merge tag 'riscv-for-linus-5.6-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: "This contains a handful of patches for this merge window: - Support for kasan - 32-bit physical addresses on rv32i-based systems - Support for CONFIG_DEBUG_VIRTUAL - DT entry for the FU540 GPIO controller, which has recently had a device driver merged These boot a buildroot-based system on QEMU's virt board for me" * tag 'riscv-for-linus-5.6-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: dts: Add DT support for SiFive FU540 GPIO driver riscv: mm: add support for CONFIG_DEBUG_VIRTUAL riscv: keep 32-bit kernel to 32-bit phys_addr_t kasan: Add riscv to KASAN documentation. riscv: Add KASAN support kasan: No KASAN's memmove check if archs don't have it. commit 264b0d2bee148073c117e7bbbde5be7125a53be1 Author: Erdem Aktas Date: Fri Dec 13 13:31:46 2019 -0800 percpu: Separate decrypted varaibles anytime encryption can be enabled CONFIG_VIRTUALIZATION may not be enabled for memory encrypted guests. If disabled, decrypted per-CPU variables may end up sharing the same page with variables that should be left encrypted. Always separate per-CPU variables that should be decrypted into their own page anytime memory encryption can be enabled in the guest rather than rely on any other config option that may not be enabled. Fixes: ac26963a1175 ("percpu: Introduce DEFINE_PER_CPU_DECRYPTED") Cc: stable@vger.kernel.org # 4.15+ Signed-off-by: Erdem Aktas Signed-off-by: David Rientjes Signed-off-by: Dennis Zhou commit becef184dfe9bfef522c80501d22a5e02efba8d8 Author: Luc Van Oostenryck Date: Wed Dec 4 02:06:23 2019 +0100 percpu: fix __percpu annotation in asm-generic The generic implementation of raw_cpu_generic_add_return() is: #define raw_cpu_generic_add_return(pcp, val) \ ({ \ typeof(&(pcp)) __p = raw_cpu_ptr(&(pcp)); \ \ *__p += val; \ *__p; \ }) where the 'pcp' argument is a __percpu lvalue. There, the variable '__p' is declared as a __percpu pointer the type of the address of 'pcp') but: 1) the value assigned to it, the return value of raw_cpu_ptr(), is a plain (__kernel) pointer, not a __percpu one. 2) this variable is dereferenced just after while a __percpu pointer is implicitly __noderef. So, fix the declaration of the 'pcp' variable to its correct type: the plain (non-percpu) pointer corresponding to pcp's address, using the fact that typeof() ignores the address space and the 'noderef' attribute of its agument. Same for raw_cpu_generic_xchg(), raw_cpu_generic_cmpxchg() & raw_cpu_generic_cmpxchg_double(). This removes 209 warnings on ARM, 525 on ARM64, 220 on x86 & more than 2600 on ppc64 (all of them with the default config). Cc: Tejun Heo Cc: Nicholas Piggin Reported-by: Ben Dooks Signed-off-by: Luc Van Oostenryck Acked-by: Christoph Lameter Signed-off-by: Dennis Zhou commit b70a2d6b29f7c5b621bf83f903f26fee5fe28efc Merge: e813e6503838 6bd3357b6181 Author: Linus Torvalds Date: Fri Jan 31 11:05:33 2020 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - three fixes and a cleanup for the resctrl code - a HyperV fix - a fix to /proc/kcore contents in live debugging sessions - a fix for the x86 decoder opcode map" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/decoder: Add TEST opcode to Group3-2 x86/resctrl: Clean up unused function parameter in mkdir path x86/resctrl: Fix a deadlock due to inaccurate reference x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup x86/resctrl: Fix use-after-free when deleting resource groups x86/hyper-v: Add "polling" bit to hv_synic_sint x86/crash: Define arch_crash_save_vmcoreinfo() if CONFIG_CRASH_CORE=y commit 2b73ea3796242608b4ccf019ff217156c92e92fe Author: Steven Clarkson Date: Thu Jan 30 16:48:16 2020 -0800 x86/boot: Handle malformed SRAT tables during early ACPI parsing Break an infinite loop when early parsing of the SRAT table is caused by a subtable with zero length. Known to affect the ASUS WS X299 SAGE motherboard with firmware version 1201 which has a large block of zeros in its SRAT table. The kernel could boot successfully on this board/firmware prior to the introduction of early parsing this table or after a BIOS update. [ bp: Fixup whitespace damage and commit message. Make it return 0 to denote that there are no immovable regions because who knows what else is broken in this BIOS. ] Fixes: 02a3e3cdb7f1 ("x86/boot: Parse SRAT table and count immovable memory regions") Signed-off-by: Steven Clarkson Signed-off-by: Borislav Petkov Cc: linux-acpi@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=206343 Link: https://lkml.kernel.org/r/CAHKq8taGzj0u1E_i=poHUam60Bko5BpiJ9jn0fAupFUYexvdUQ@mail.gmail.com commit 78e06cf430934fc3768c342cbebdd1013dcd6fa7 Author: Matteo Croce Date: Thu Jan 30 20:10:19 2020 +0100 netfilter: nf_flowtable: fix documentation In the flowtable documentation there is a missing semicolon, the command as is would give this error: nftables.conf:5:27-33: Error: syntax error, unexpected devices, expecting newline or semicolon hook ingress priority 0 devices = { br0, pppoe-data }; ^^^^^^^ nftables.conf:4:12-13: Error: invalid hook (null) flowtable ft { ^^ Fixes: 19b351f16fd9 ("netfilter: add flowtable documentation") Signed-off-by: Matteo Croce Signed-off-by: Pablo Neira Ayuso commit c22208b7ce3ef0c2c184ff0d9f6423614b1799d9 Author: Paul Blakey Date: Thu Jan 30 18:04:37 2020 +0200 netfilter: flowtable: Fix setting forgotten NF_FLOW_HW_DEAD flag During the refactor this was accidently removed. Fixes: ae29045018c8 ("netfilter: flowtable: add nf_flow_offload_tuple() helper") Signed-off-by: Paul Blakey Signed-off-by: Pablo Neira Ayuso commit 0f34f30a1be80f3f59efeaab596396bc698e7337 Author: Paul Blakey Date: Thu Jan 30 18:04:36 2020 +0200 netfilter: flowtable: Fix missing flush hardware on table free If entries exist when freeing a hardware offload enabled table, we queue work for hardware while running the gc iteration. Execute it (flush) after queueing. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Paul Blakey Signed-off-by: Pablo Neira Ayuso commit 91bfaa15a379e9af24f71fb4ee08d8019b6e8ec7 Author: Paul Blakey Date: Thu Jan 30 18:04:35 2020 +0200 netfilter: flowtable: Fix hardware flush order on nf_flow_table_cleanup On netdev down event, nf_flow_table_cleanup() is called for the relevant device and it cleans all the tables that are on that device. If one of those tables has hardware offload flag, nf_flow_table_iterate_cleanup flushes hardware and then runs the gc. But the gc can queue more hardware work, which will take time to execute. Instead first add the work, then flush it, to execute it now. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Paul Blakey Signed-off-by: Pablo Neira Ayuso commit b9e0102a57d768bdb99cbbfa01225f73d58e03bc Author: Joe Perches Date: Tue Jan 28 11:07:27 2020 -0800 netfilter: Use kvcalloc Convert the uses of kvmalloc_array with __GFP_ZERO to the equivalent kvcalloc. Signed-off-by: Joe Perches Signed-off-by: Pablo Neira Ayuso commit 43e76af85fa7e75ac9b71fc2fcc250abb1889bff Author: Dmitry Vyukov Date: Thu Jan 30 22:17:35 2020 -0800 kcov: ignore fault-inject and stacktrace Don't instrument 3 more files that contain debugging facilities and produce large amounts of uninteresting coverage for every syscall. The following snippets are sprinkled all over the place in kcov traces in a debugging kernel. We already try to disable instrumentation of stack unwinding code and of most debug facilities. I guess we did not use fault-inject.c at the time, and stacktrace.c was somehow missed (or something has changed in kernel/configs). This change both speeds up kcov (kernel doesn't need to store these PCs, user-space doesn't need to process them) and frees trace buffer capacity for more useful coverage. should_fail lib/fault-inject.c:149 fail_dump lib/fault-inject.c:45 stack_trace_save kernel/stacktrace.c:124 stack_trace_consume_entry kernel/stacktrace.c:86 stack_trace_consume_entry kernel/stacktrace.c:89 ... a hundred frames skipped ... stack_trace_consume_entry kernel/stacktrace.c:93 stack_trace_consume_entry kernel/stacktrace.c:86 Link: http://lkml.kernel.org/r/20200116111449.217744-1-dvyukov@gmail.com Signed-off-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2b755626cad6d9dcbad09d022ba7bdfc39ed773d Author: Andy Shevchenko Date: Thu Jan 30 22:17:32 2020 -0800 include/linux/io-mapping.h-mapping: use PHYS_PFN() macro in io_mapping_map_atomic_wc() Use PHYS_PFN() macro in io_mapping_map_atomic_wc() instead of open coded variant. Link: http://lkml.kernel.org/r/20191209165624.56351-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 47a2ebb7f5053387f5753b524f4920b9b829f922 Author: Alexey Dobriyan Date: Thu Jan 30 22:17:29 2020 -0800 execve: warn if process starts with executable stack There were few episodes of silent downgrade to an executable stack over years: 1) linking innocent looking assembly file will silently add executable stack if proper linker options is not given as well: $ cat f.S .intel_syntax noprefix .text .globl f f: ret $ cat main.c void f(void); int main(void) { f(); return 0; } $ gcc main.c f.S $ readelf -l ./a.out GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RWE 0x10 ^^^ 2) converting C99 nested function into a closure https://nullprogram.com/blog/2019/11/15/ void intsort2(int *base, size_t nmemb, _Bool invert) { int cmp(const void *a, const void *b) { int r = *(int *)a - *(int *)b; return invert ? -r : r; } qsort(base, nmemb, sizeof(*base), cmp); } will silently require stack trampolines while non-closure version will not. Without doubt this behaviour is documented somewhere, add a warning so that developers and users can at least notice. After so many years of x86_64 having proper executable stack support it should not cause too many problems. Link: http://lkml.kernel.org/r/20191208171918.GC19716@avx2 Signed-off-by: Alexey Dobriyan Cc: Dan Carpenter Cc: Will Deacon Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aacee5446a2a1aa35d0a49dab289552578657fb4 Author: Yunfeng Ye Date: Thu Jan 30 22:17:26 2020 -0800 reiserfs: prevent NULL pointer dereference in reiserfs_insert_item() The variable inode may be NULL in reiserfs_insert_item(), but there is no check before accessing the member of inode. Fix this by adding NULL pointer check before calling reiserfs_debug(). Link: http://lkml.kernel.org/r/79c5135d-ff25-1cc9-4e99-9f572b88cc00@huawei.com Signed-off-by: Yunfeng Ye Cc: zhengbin Cc: Hu Shiyuan Cc: Feilong Lin Cc: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f596ded1a044517afc4e9325f0dea449858450ac Author: Christophe Leroy Date: Thu Jan 30 22:17:23 2020 -0800 init/main.c: fix misleading "This architecture does not have kernel memory protection" message This message leads to thinking that memory protection is not implemented for the said architecture, whereas absence of CONFIG_STRICT_KERNEL_RWX only means that memory protection has not been selected at compile time. Don't print this message when CONFIG_ARCH_HAS_STRICT_KERNEL_RWX is selected by the architecture. Instead, print "Kernel memory protection not selected by kernel config." Link: http://lkml.kernel.org/r/62477e446d9685459d4f27d193af6ff1bd69d55f.1578557581.git.christophe.leroy@c-s.fr Signed-off-by: Christophe Leroy Acked-by: Kees Cook Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 283900e82847e10898650c66a249c10b213934fb Author: Arvind Sankar Date: Thu Jan 30 22:17:19 2020 -0800 init/main.c: fix quoted value handling in unknown_bootoption Patch series "init/main.c: minor cleanup/bugfix of envvar handling", v2. unknown_bootoption passes unrecognized command line arguments to init as either environment variables or arguments. Some of the logic in the function is broken for quoted command line arguments. When an argument of the form param="value" is processed by parse_args and passed to unknown_bootoption, the command line has param\0"value\0 with val pointing to the beginning of value. The helper function repair_env_string is then used to restore the '=' character that was removed by parse_args, and strip the quotes off fully. This results in param=value\0\0 and val ends up pointing to the 'a' instead of the 'v' in value. This bug was introduced when repair_env_string was refactored into a separate function, and the decrement of val in repair_env_string became dead code. This causes two problems in unknown_bootoption in the two places where the val pointer is used as a substitute for the length of param: 1. An argument of the form param=".value" is misinterpreted as a potential module parameter, with the result that it will not be placed in init's environment. 2. An argument of the form param="value" is checked to see if param is an existing environment variable that should be overwritten, but the comparison is off-by-one and compares 'param=v' instead of 'param=' against the existing environment. So passing, for example, TERM="vt100" on the command line results in init being passed both TERM=linux and TERM=vt100 in its environment. Patch 1 adds logging for the arguments and environment passed to init and is independent of the rest: it can be dropped if this is unnecessarily verbose. Patch 2 removes repair_env_string from initcall parameter parsing in do_initcall_level, as that uses a separate copy of the command line now and the repairing is no longer necessary. Patch 3 fixes the bug in unknown_bootoption by recording the length of param explicitly instead of implying it from val-param. This patch (of 3): Commit a99cd1125189 ("init: fix bug where environment vars can't be passed via boot args") introduced two minor bugs in unknown_bootoption by factoring out the quoted value handling into a separate function. When value is quoted, repair_env_string will move the value up 1 byte to strip the quotes, so val in unknown_bootoption no longer points to the actual location of the value. The result is that an argument of the form param=".value" is mistakenly treated as a potential module parameter and is not placed in init's environment, and an argument of the form param="value" can result in a duplicate environment variable: eg TERM="vt100" on the command line will result in both TERM=linux and TERM=vt100 being placed into init's environment. Fix this by recording the length of the param before calling repair_env_string instead of relying on val. Link: http://lkml.kernel.org/r/20191212180023.24339-4-nivedita@alum.mit.edu Signed-off-by: Arvind Sankar Cc: Chris Metcalf Cc: Krzysztof Mazur Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e2762e1d9f4b9cb67ed6c3b7aff2020c367d4ac Author: Arvind Sankar Date: Thu Jan 30 22:17:16 2020 -0800 init/main.c: remove unnecessary repair_env_string in do_initcall_level Since commit 08746a65c296 ("init: fix in-place parameter modification regression"), parse_args in do_initcall_level is called on a copy of saved_command_line. It is unnecessary to call repair_env_string during this parsing, as this copy is not used for anything later. Remove the now unnecessary arguments from repair_env_string as well. Link: http://lkml.kernel.org/r/20191212180023.24339-3-nivedita@alum.mit.edu Signed-off-by: Arvind Sankar Cc: Krzysztof Mazur Cc: Chris Metcalf Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b88c50ac304a14f14e70c4ad22577b6b84632d5e Author: Arvind Sankar Date: Thu Jan 30 22:17:13 2020 -0800 init/main.c: log arguments and environment passed to init Extend logging in `run_init_process` to also show the arguments and environment that we are passing to init. Link: http://lkml.kernel.org/r/20191212180023.24339-2-nivedita@alum.mit.edu Signed-off-by: Arvind Sankar Cc: Chris Metcalf Cc: Krzysztof Mazur Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1fbede6e6f3dc6c1c33e84b6989cf8079d899f89 Author: Alexey Dobriyan Date: Thu Jan 30 22:17:10 2020 -0800 fs/binfmt_elf.c: coredump: allow process with empty address space to coredump Unmapping whole address space at once with munmap(0, (1ULL<<47) - 4096) or equivalent will create empty coredump. It is silly way to exit, however registers content may still be useful. The right to coredump is fundamental right of a process! Link: http://lkml.kernel.org/r/20191222150137.GA1277@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28f46656ad18534f4488590b5447ec48b954420d Author: Alexey Dobriyan Date: Thu Jan 30 22:17:07 2020 -0800 fs/binfmt_elf.c: coredump: delete duplicated overflow check array_size() macro will do overflow check anyway. Link: http://lkml.kernel.org/r/20191222144009.GB24341@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 225a3f53e7fc7ae9e57d336d712cadae62c39516 Author: Alexey Dobriyan Date: Thu Jan 30 22:17:04 2020 -0800 fs/binfmt_elf.c: coredump: allocate core ELF header on stack Comment says ELF header is "too large to be on stack". 64 bytes on 64-bit is not large by any means. Link: http://lkml.kernel.org/r/20191222143850.GA24341@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 18676ffcee596079037b1767e4efe38b06f05eb8 Author: Alexey Dobriyan Date: Thu Jan 30 22:17:01 2020 -0800 fs/binfmt_elf.c: make BAD_ADDR() unlikely If some mapping goes past TASK_SIZE it will be rejected by kernel which means no such userspace binaries exist. Mark every such check as unlikely. Link: http://lkml.kernel.org/r/20191215124355.GA21124@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 03c6d723eeac2d7beaa6d9682768469659088d77 Author: Alexey Dobriyan Date: Thu Jan 30 22:16:58 2020 -0800 fs/binfmt_elf.c: better codegen around current->mm "current->mm" pointer is stable in general except few cases one of which execve(2). Compiler can't treat is as stable but it _is_ stable most of the time. During ELF loading process ->mm becomes stable right after flush_old_exec(). Help compiler by caching current->mm, otherwise it continues to refetch it. add/remove: 0/0 grow/shrink: 0/2 up/down: 0/-141 (-141) Function old new delta elf_core_dump 5062 5039 -23 load_elf_binary 5426 5308 -118 Note: other cases are left as is because it is either pessimisation or no change in binary size. Link: http://lkml.kernel.org/r/20191215124755.GB21124@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a62c5b1b6647ea069b8a23cb8edb7925dea89dd8 Author: Alexey Dobriyan Date: Thu Jan 30 22:16:55 2020 -0800 fs/binfmt_elf.c: don't copy ELF header around ELF header is read into bprm->buf[] by generic execve code. Save a memcpy and allocate just one header for the interpreter instead of two headers (64 bytes instead of 128 on 64-bit). Link: http://lkml.kernel.org/r/20191208171242.GA19716@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f67ef446291a09114f979a129fa42a859c5eb595 Author: Alexey Dobriyan Date: Thu Jan 30 22:16:52 2020 -0800 fs/binfmt_elf.c: fix ->start_code calculation Only executable segments should be accounted to ->start_code just like they do to ->end_code (correctly). Link: http://lkml.kernel.org/r/20191208171410.GB19716@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f83d80677a24ae737fe0ab4008e7c72b8a33b35 Author: Alexey Dobriyan Date: Thu Jan 30 22:16:50 2020 -0800 fs/binfmt_elf.c: smaller code generation around auxv vector fill Filling auxv vector as array with index (auxv[i++] = ...) generates terrible code. "saved_auxv" should be reworked because it is the worst member of mm_struct by size/usefullness ratio but do it later. Meanwhile help gcc a little with *auxv++ idiom. Space savings on x86_64: add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-127 (-127) Function old new delta load_elf_binary 5470 5343 -127 Link: http://lkml.kernel.org/r/20191208172301.GD19716@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7dfaa98f646bbc29c3575bc184f2b37aa2dd62c5 Author: Yury Norov Date: Thu Jan 30 22:16:47 2020 -0800 lib/find_bit.c: uninline helper _find_next_bit() It saves 25% of .text for arm64, and more for BE architectures. Before: $ size lib/find_bit.o text data bss dec hex filename 1012 56 0 1068 42c lib/find_bit.o After: $ size lib/find_bit.o text data bss dec hex filename 776 56 0 832 340 lib/find_bit.o Link: http://lkml.kernel.org/r/20200103202846.21616-3-yury.norov@gmail.com Signed-off-by: Yury Norov Cc: Thomas Gleixner Cc: Allison Randal Cc: William Breathitt Gray Cc: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b78c57135d470cfc5b461f2abde4eaeb07d100fb Author: Yury Norov Date: Thu Jan 30 22:16:43 2020 -0800 lib/find_bit.c: join _find_next_bit{_le} _find_next_bit and _find_next_bit_le are very similar functions. It's possible to join them by adding 1 parameter and a couple of simple checks. It's simplify maintenance and make possible to shrink the size of .text by un-inlining the unified function (in the following patch). Link: http://lkml.kernel.org/r/20200103202846.21616-2-yury.norov@gmail.com Signed-off-by: Yury Norov Cc: Allison Randal Cc: Joe Perches Cc: Thomas Gleixner Cc: William Breathitt Gray Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d5767057c9a76a29f073dad66b7fa12a90e8c748 Author: Yury Norov Date: Thu Jan 30 22:16:40 2020 -0800 uapi: rename ext2_swab() to swab() and share globally in swab.h ext2_swab() is defined locally in lib/find_bit.c However it is not specific to ext2, neither to bitmaps. There are many potential users of it, so rename it to just swab() and move to include/uapi/linux/swab.h ABI guarantees that size of unsigned long corresponds to BITS_PER_LONG, therefore drop unneeded cast. Link: http://lkml.kernel.org/r/20200103202846.21616-1-yury.norov@gmail.com Signed-off-by: Yury Norov Cc: Allison Randal Cc: Joe Perches Cc: Thomas Gleixner Cc: William Breathitt Gray Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e456fee215677584cafa7f67298a76917e89c64 Author: Nathan Chancellor Date: Thu Jan 30 22:16:37 2020 -0800 lib/scatterlist.c: adjust indentation in __sg_alloc_table Clang warns: ../lib/scatterlist.c:314:5: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] return -ENOMEM; ^ ../lib/scatterlist.c:311:4: note: previous statement is here if (prv) ^ 1 warning generated. This warning occurs because there is a space before the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns. Link: http://lkml.kernel.org/r/20191218033606.11942-1-natechancellor@gmail.com Link: https://github.com/ClangBuiltLinux/linux/issues/830 Fixes: edce6820a9fd ("scatterlist: prevent invalid free when alloc fails") Signed-off-by: Nathan Chancellor Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3fd396afc05fc90097276c6b7a70c406ad4df5bb Author: Mikhail Zaslonko Date: Thu Jan 30 22:16:33 2020 -0800 btrfs: use larger zlib buffer for s390 hardware compression In order to benefit from s390 zlib hardware compression support, increase the btrfs zlib workspace buffer size from 1 to 4 pages (if s390 zlib hardware support is enabled on the machine). This brings up to 60% better performance in hardware on s390 compared to the PAGE_SIZE buffer and much more compared to the software zlib processing in btrfs. In case of memory pressure, fall back to a single page buffer during workspace allocation. The data compressed with larger input buffers will still conform to zlib standard and thus can be decompressed also on a systems that uses only PAGE_SIZE buffer for btrfs zlib. Link: http://lkml.kernel.org/r/20200108105103.29028-1-zaslonko@linux.ibm.com Signed-off-by: Mikhail Zaslonko Reviewed-by: David Sterba Cc: Chris Mason Cc: Josef Bacik Cc: David Sterba Cc: Richard Purdie Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Eduard Shishkin Cc: Ilya Leoshkevich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 803521b149c8c71a712445a32bd9316e074df76a Author: Mikhail Zaslonko Date: Thu Jan 30 22:16:30 2020 -0800 lib/zlib: add zlib_deflate_dfltcc_enabled() function Add a new function to zlib.h checking if s390 Deflate-Conversion facility is installed and enabled. Link: http://lkml.kernel.org/r/20200103223334.20669-6-zaslonko@linux.ibm.com Signed-off-by: Mikhail Zaslonko Cc: Chris Mason Cc: Christian Borntraeger Cc: David Sterba Cc: Eduard Shishkin Cc: Heiko Carstens Cc: Ilya Leoshkevich Cc: Josef Bacik Cc: Richard Purdie Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c65e6815db1c2e28d5554bd99d3a6e522ab599d1 Author: Mikhail Zaslonko Date: Thu Jan 30 22:16:27 2020 -0800 s390/boot: add dfltcc= kernel command line parameter Add the new kernel command line parameter 'dfltcc=' to configure s390 zlib hardware support. Format: { on | off | def_only | inf_only | always } on: s390 zlib hardware support for compression on level 1 and decompression (default) off: No s390 zlib hardware support def_only: s390 zlib hardware support for deflate only (compression on level 1) inf_only: s390 zlib hardware support for inflate only (decompression) always: Same as 'on' but ignores the selected compression level always using hardware support (used for debugging) Link: http://lkml.kernel.org/r/20200103223334.20669-5-zaslonko@linux.ibm.com Signed-off-by: Mikhail Zaslonko Cc: Chris Mason Cc: Christian Borntraeger Cc: David Sterba Cc: Eduard Shishkin Cc: Heiko Carstens Cc: Ilya Leoshkevich Cc: Josef Bacik Cc: Richard Purdie Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12619610006371bfc30159937d4546e731d7b297 Author: Mikhail Zaslonko Date: Thu Jan 30 22:16:23 2020 -0800 lib/zlib: add s390 hardware support for kernel zlib_inflate Add decompression functions to zlib_dfltcc library. Update zlib_inflate functions with the hooks for s390 hardware support and adjust workspace structures with extra parameter lists required for hardware inflate decompression. Link: http://lkml.kernel.org/r/20200103223334.20669-4-zaslonko@linux.ibm.com Signed-off-by: Ilya Leoshkevich Signed-off-by: Mikhail Zaslonko Co-developed-by: Ilya Leoshkevich Cc: Chris Mason Cc: Christian Borntraeger Cc: David Sterba Cc: Eduard Shishkin Cc: Heiko Carstens Cc: Josef Bacik Cc: Richard Purdie Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1b3e3faf29d3acb7a2243c7e1bfb34184fdc6ece Author: Mikhail Zaslonko Date: Thu Jan 30 22:16:20 2020 -0800 s390/boot: rename HEAP_SIZE due to name collision Change the conflicting macro name in preparation for zlib_inflate hardware support. Link: http://lkml.kernel.org/r/20200103223334.20669-3-zaslonko@linux.ibm.com Signed-off-by: Mikhail Zaslonko Reviewed-by: Christian Borntraeger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa5b395b69b65450e008b95ec623b4fc4b175f9f Author: Mikhail Zaslonko Date: Thu Jan 30 22:16:17 2020 -0800 lib/zlib: add s390 hardware support for kernel zlib_deflate Patch series "S390 hardware support for kernel zlib", v3. With IBM z15 mainframe the new DFLTCC instruction is available. It implements deflate algorithm in hardware (Nest Acceleration Unit - NXU) with estimated compression and decompression performance orders of magnitude faster than the current zlib. This patchset adds s390 hardware compression support to kernel zlib. The code is based on the userspace zlib implementation: https://github.com/madler/zlib/pull/410 The coding style is also preserved for future maintainability. There is only limited set of userspace zlib functions represented in kernel. Apart from that, all the memory allocation should be performed in advance. Thus, the workarea structures are extended with the parameter lists required for the DEFLATE CONVENTION CALL instruction. Since kernel zlib itself does not support gzip headers, only Adler-32 checksum is processed (also can be produced by DFLTCC facility). Like it was implemented for userspace, kernel zlib will compress in hardware on level 1, and in software on all other levels. Decompression will always happen in hardware (when enabled). Two DFLTCC compression calls produce the same results only when they both are made on machines of the same generation, and when the respective buffers have the same offset relative to the start of the page. Therefore care should be taken when using hardware compression when reproducible results are desired. However it does always produce the standard conform output which can be inflated anyway. The new kernel command line parameter 'dfltcc' is introduced to configure s390 zlib hardware support: Format: { on | off | def_only | inf_only | always } on: s390 zlib hardware support for compression on level 1 and decompression (default) off: No s390 zlib hardware support def_only: s390 zlib hardware support for deflate only (compression on level 1) inf_only: s390 zlib hardware support for inflate only (decompression) always: Same as 'on' but ignores the selected compression level always using hardware support (used for debugging) The main purpose of the integration of the NXU support into the kernel zlib is the use of hardware deflate in btrfs filesystem with on-the-fly compression enabled. Apart from that, hardware support can also be used during boot for decompressing the kernel or the ramdisk image With the patch for btrfs expanding zlib buffer from 1 to 4 pages (patch 6) the following performance results have been achieved using the ramdisk with btrfs. These are relative numbers based on throughput rate and compression ratio for zlib level 1: Input data Deflate rate Inflate rate Compression ratio NXU/Software NXU/Software NXU/Software stream of zeroes 1.46 1.02 1.00 random ASCII data 10.44 3.00 0.96 ASCII text (dickens) 6,21 3.33 0.94 binary data (vmlinux) 8,37 3.90 1.02 This means that s390 hardware deflate can provide up to 10 times faster compression (on level 1) and up to 4 times faster decompression (refers to all compression levels) for btrfs zlib. Disclaimer: Performance results are based on IBM internal tests using DD command-line utility on btrfs on a Fedora 30 based internal driver in native LPAR on a z15 system. Results may vary based on individual workload, configuration and software levels. This patch (of 9): Create zlib_dfltcc library with the s390 DEFLATE CONVERSION CALL implementation and related compression functions. Update zlib_deflate functions with the hooks for s390 hardware support and adjust workspace structures with extra parameter lists required for hardware deflate. Link: http://lkml.kernel.org/r/20200103223334.20669-2-zaslonko@linux.ibm.com Signed-off-by: Ilya Leoshkevich Signed-off-by: Mikhail Zaslonko Co-developed-by: Ilya Leoshkevich Cc: Chris Mason Cc: Christian Borntraeger Cc: David Sterba Cc: Eduard Shishkin Cc: Heiko Carstens Cc: Josef Bacik Cc: Richard Purdie Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f88b4265450fc879f6db8a811e33068ae168c4a4 Author: Akinobu Mita Date: Thu Jan 30 22:16:13 2020 -0800 iio: adc: qcom-vadc-common: use helpers This switches the qcom-vadc-common to use milli_kelvin_to_millicelsius() in . Link: http://lkml.kernel.org/r/1576386975-7941-13-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Acked-by: Jonathan Cameron Reviewed-by: Andy Shevchenko Cc: Hartmut Knaack Cc: Lars-Peter Clausen Cc: Peter Meerwald-Stadler Cc: Amit Kucheria Cc: Andy Shevchenko Cc: Christoph Hellwig Cc: Daniel Lezcano Cc: Darren Hart Cc: Emmanuel Grumbach Cc: Guenter Roeck Cc: Jean Delvare Cc: Jens Axboe Cc: Johannes Berg Cc: Jonathan Cameron Cc: Kalle Valo Cc: Keith Busch Cc: Luca Coelho Cc: Sagi Grimberg Cc: Stanislaw Gruszka Cc: Sujith Thomas Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b741ffb4bf2cb8fa80a90c246cc36d9583c36701 Author: Akinobu Mita Date: Thu Jan 30 22:16:09 2020 -0800 thermal: armada: remove unused TO_MCELSIUS macro This removes unused TO_MCELSIUS() macro. Link: http://lkml.kernel.org/r/1576386975-7941-12-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Andy Shevchenko Cc: Christoph Hellwig Cc: Darren Hart Cc: Emmanuel Grumbach Cc: Guenter Roeck Cc: Hartmut Knaack Cc: Jean Delvare Cc: Jens Axboe Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Keith Busch Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Sagi Grimberg Cc: Stanislaw Gruszka Cc: Sujith Thomas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b1a79b2f31a661be3d4a90f3646e1464d65b37e0 Author: Akinobu Mita Date: Thu Jan 30 22:16:05 2020 -0800 iwlwifi: use helpers This switches the iwlwifi driver to use celsius_to_kelvin() and kelvin_to_celsius() in . Link: http://lkml.kernel.org/r/1576386975-7941-11-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Acked-by: Luca Coelho Cc: Kalle Valo Cc: Johannes Berg Cc: Emmanuel Grumbach Cc: Luca Coelho Cc: Amit Kucheria Cc: Andy Shevchenko Cc: Christoph Hellwig Cc: Daniel Lezcano Cc: Darren Hart Cc: Guenter Roeck Cc: Hartmut Knaack Cc: Jean Delvare Cc: Jens Axboe Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Keith Busch Cc: Lars-Peter Clausen Cc: Peter Meerwald-Stadler Cc: Sagi Grimberg Cc: Stanislaw Gruszka Cc: Sujith Thomas Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1410b2fc8d5c94c713c03ed95d01640154e2c287 Author: Akinobu Mita Date: Thu Jan 30 22:16:01 2020 -0800 iwlegacy: use helpers This switches the iwlegacy driver to use celsius_to_kelvin() and kelvin_to_celsius() in . [akinobu.mita@gmail.com: fix build warnings with format string] Link: http://lkml.kernel.org/r/1579014483-9226-1-git-send-email-akinobu.mita@gmail.com Link: https://lore.kernel.org/r/20200106171452.201c3b4c@canb.auug.org.au Link: http://lkml.kernel.org/r/1576386975-7941-10-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Acked-by: Kalle Valo Cc: Kalle Valo Cc: Stanislaw Gruszka Cc: Amit Kucheria Cc: Andy Shevchenko Cc: Christoph Hellwig Cc: Daniel Lezcano Cc: Darren Hart Cc: Emmanuel Grumbach Cc: Guenter Roeck Cc: Hartmut Knaack Cc: Jean Delvare Cc: Jens Axboe Cc: Johannes Berg Cc: Jonathan Cameron Cc: Keith Busch Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Sagi Grimberg Cc: Sujith Thomas Cc: Zhang Rui Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cdf309fb38ad419aadb8f5856a088864688fad90 Author: Akinobu Mita Date: Thu Jan 30 22:15:57 2020 -0800 thermal: remove kelvin to/from Celsius conversion helpers from This removes the kelvin to/from Celsius conversion helper macros in which were switched to the inline helper functions in . Link: http://lkml.kernel.org/r/1576386975-7941-9-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7724cd2bff55d29206d6f6d236ec222d155b2e41 Author: Akinobu Mita Date: Thu Jan 30 22:15:53 2020 -0800 nvme: hwmon: switch to use helpers This switches the nvme driver to use kelvin_to_millicelsius() and millicelsius_to_kelvin() in . Link: http://lkml.kernel.org/r/1576386975-7941-8-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Christoph Hellwig Reviewed-by: Guenter Roeck Reviewed-by: Keith Busch Reviewed-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 97a0a49d55ebd859509712c44b071140fd838d3e Author: Akinobu Mita Date: Thu Jan 30 22:15:48 2020 -0800 thermal: intel_pch: switch to use helpers This switches the intel pch thermal driver to use deci_kelvin_to_millicelsius() in instead of helpers in . This is preparation for centralizing the kelvin to/from Celsius conversion helpers in . Link: http://lkml.kernel.org/r/1576386975-7941-7-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 006a6021789c916a0697c98c116f02e5967a2a13 Author: Akinobu Mita Date: Thu Jan 30 22:15:44 2020 -0800 thermal: int340x: switch to use helpers This switches the int340x thermal zone driver to use deci_kelvin_to_millicelsius() and millicelsius_to_deci_kelvin() in instead of helpers in . This is preparation for centralizing the kelvin to/from Celsius conversion helpers in . Link: http://lkml.kernel.org/r/1576386975-7941-6-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dccad6f78cd9020844b7ef3f6366d2b77be1ca69 Author: Akinobu Mita Date: Thu Jan 30 22:15:40 2020 -0800 platform/x86: intel_menlow: switch to use helpers This switches the intel_menlow driver to use deci_kelvin_to_celsius() and celsius_to_deci_kelvin() in instead of helpers in . This is preparation for centralizing the kelvin to/from Celsius conversion helpers in . This also removes a trailing space, while we're at it. Link: http://lkml.kernel.org/r/1576386975-7941-5-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f07b9fdf000e7fee2d8fa7143fd0b736a674cb5d Author: Akinobu Mita Date: Thu Jan 30 22:15:37 2020 -0800 platform/x86: asus-wmi: switch to use helpers The asus-wmi driver doesn't implement the thermal device functionality directly, so including just for DECI_KELVIN_TO_CELSIUS() is a bit odd. This switches the asus-wmi driver to use deci_kelvin_to_millicelsius() in . The format string is changed from %d to %ld due to function returned type. Link: http://lkml.kernel.org/r/1576386975-7941-4-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Acked-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7f49a5cb94e68a0aae4ccd619798daf5a92c0533 Author: Akinobu Mita Date: Thu Jan 30 22:15:33 2020 -0800 ACPI: thermal: switch to use helpers This switches the ACPI thermal zone driver to use celsius_to_deci_kelvin(), deci_kelvin_to_celsius(), and deci_kelvin_to_millicelsius_with_offset() in instead of helpers in . This is preparation for centralizing the kelvin to/from Celsius conversion helpers in . Link: http://lkml.kernel.org/r/1576386975-7941-3-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Cc: Sujith Thomas Cc: Darren Hart Cc: Andy Shevchenko Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Andy Shevchenko Cc: Emmanuel Grumbach Cc: Hartmut Knaack Cc: Johannes Berg Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kalle Valo Cc: Lars-Peter Clausen Cc: Luca Coelho Cc: Peter Meerwald-Stadler Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 23331e4893614deb555c65cdf115c8a28ed32471 Author: Akinobu Mita Date: Thu Jan 30 22:15:28 2020 -0800 include/linux/units.h: add helpers for kelvin to/from Celsius conversion Patch series "add header file for kelvin to/from Celsius conversion helpers", v4. There are several helper macros to convert kelvin to/from Celsius in for thermal drivers. These are useful for any other drivers or subsystems, but it's odd to include just for the helpers. This adds a new that provides the equivalent inline functions for any drivers or subsystems, and switches all the users of conversion helpers in to use helpers. This patch (of 12): There are several helper macros to convert kelvin to/from Celsius in for thermal drivers. These are useful for any other drivers or subsystems, but it's odd to include just for the helpers. This adds a new that provides the equivalent inline functions for any drivers or subsystems. It is intended to replace the helpers in . Link: http://lkml.kernel.org/r/1576386975-7941-2-git-send-email-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andy Shevchenko Cc: Sujith Thomas Cc: Darren Hart Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: Jean Delvare Cc: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Kalle Valo Cc: Stanislaw Gruszka Cc: Johannes Berg Cc: Emmanuel Grumbach Cc: Luca Coelho Cc: Jonathan Cameron Cc: Hartmut Knaack Cc: Lars-Peter Clausen Cc: Peter Meerwald-Stadler Cc: Andy Shevchenko Cc: Jonathan Cameron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3b82a051c10143639a378dcd12019f2353cc9054 Author: Colin Ian King Date: Thu Jan 30 22:15:25 2020 -0800 drivers/block/zram/zram_drv.c: fix error return codes not being returned in writeback_store Currently when an error code -EIO or -ENOSPC in the for-loop of writeback_store the error code is being overwritten by a ret = len assignment at the end of the function and the error codes are being lost. Fix this by assigning ret = len at the start of the function and remove the assignment from the end, hence allowing ret to be preserved when error codes are assigned to it. Addresses Coverity ("Unused value") Link: http://lkml.kernel.org/r/20191128122958.178290-1-colin.king@canonical.com Fixes: a939888ec38b ("zram: support idle/huge page writeback") Signed-off-by: Colin Ian King Acked-by: Minchan Kim Cc: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 90f82cbfe502e96e602614ebbaf7725470c5208a Author: Taejoon Song Date: Thu Jan 30 22:15:22 2020 -0800 zram: try to avoid worst-case scenario on same element pages The worst-case scenario on finding same element pages is that almost all elements are same at the first glance but only last few elements are different. Since the same element tends to be grouped from the beginning of the pages, if we check the first element with the last element before looping through all elements, we might have some chances to quickly detect non-same element pages. 1. Test is done under LG webOS TV (64-bit arch) 2. Dump the swap-out pages (~819200 pages) 3. Analyze the pages with simple test script which counts the iteration number and measures the speed at off-line Under 64-bit arch, the worst iteration count is PAGE_SIZE / 8 bytes = 512. The speed is based on the time to consume page_same_filled() function only. The result, on average, is listed as below: Num of Iter Speed(MB/s) Looping-Forward (Orig) 38 99265 Looping-Backward 36 102725 Last-element-check (This Patch) 33 125072 The result shows that the average iteration count decreases by 13% and the speed increases by 25% with this patch. This patch does not increase the overall time complexity, though. I also ran simpler version which uses backward loop. Just looping backward also makes some improvement, but less than this patch. [taejoon.song@lge.com: fix off-by-one] Link: http://lkml.kernel.org/r/1578642001-11765-1-git-send-email-taejoon.song@lge.com Link: http://lkml.kernel.org/r/1575424418-16119-1-git-send-email-taejoon.song@lge.com Signed-off-by: Taejoon Song Acked-by: Minchan Kim Cc: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0a3c57729768e08de690ba872dd52ee9c3c11e8b Author: Hao Lee Date: Thu Jan 30 22:15:19 2020 -0800 mm: fix comments related to node reclaim As zone reclaim has been replaced by node reclaim, this patch fixes related comments. Link: http://lkml.kernel.org/r/20191126141346.GA22665@haolee.github.io Signed-off-by: Hao Lee Reviewed-by: Andrew Morton Cc: Anshuman Khandual Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 068964541db6dbacce26e75b390e87e63ad1c100 Author: Anshuman Khandual Date: Thu Jan 30 22:15:16 2020 -0800 include/linux/memory.h: drop fields 'hw' and 'phys_callback' from struct memory_block memory_block structure elements 'hw' and 'phys_callback' are not getting used. This was originally added with commit 3947be1969a9 ("[PATCH] memory hotplug: sysfs and add/remove functions") but never seem to have been used. Just drop them now. Link: http://lkml.kernel.org/r/1576728650-13867-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Reviewed-by: Dan Williams Reviewed-by: David Hildenbrand Cc: Michal Hocko Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ca023a92c8f753a78c37cc8290bd8e3c54f1a936 Author: Wei Yang Date: Thu Jan 30 22:15:13 2020 -0800 include/linux/mm.h: remove dead code totalram_pages_set() totalram_pages_set() was introduced in commit ca79b0c211af ("mm: convert totalram_pages and totalhigh_pages variables to atomic"), but no one uses it. Link: http://lkml.kernel.org/r/20191218005543.24146-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 26b56e116a69e70cc13976a1b0b818036f539f53 Author: Yu Zhao Date: Thu Jan 30 22:15:10 2020 -0800 include/linux/mm.h: clean up obsolete check on space in page->flags The check was intended to make sure we don't overrun page flags. But it's obsolete because it doesn't include LAST_CPUPID_WIDTH nor KASAN_TAG_WIDTH. Just remove check since we already have it covered in linux/page-flags-layout.h (near the end of the file). Link: http://lkml.kernel.org/r/20191208183508.89177-1-yuzhao@google.com Signed-off-by: Yu Zhao Reviewed-by: David Hildenbrand Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38aeb071b3310866e0e75fec8e5d3c5f0f175cb9 Author: Dan Carpenter Date: Thu Jan 30 22:15:07 2020 -0800 zswap: potential NULL dereference on error in init_zswap() The "pool" pointer can be NULL at the end of the init_zswap(). (We would allocate a new pool later in that situation) So in the error handling then we need to make sure pool is a valid pointer before calling "zswap_pool_destroy(pool);" because that function dereferences the argument. Link: http://lkml.kernel.org/r/20200114050902.og32fkllkod5ycf5@kili.mountain Fixes: 93d4dfa9fbd0 ("mm/zswap.c: add allocation hysteresis if pool limit is hit") Signed-off-by: Dan Carpenter Cc: Vitaly Wool Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 45190f01dd402112d3d22c0ddc4152994f9e1e55 Author: Vitaly Wool Date: Thu Jan 30 22:15:04 2020 -0800 mm/zswap.c: add allocation hysteresis if pool limit is hit zswap will always try to shrink pool when zswap is full. If there is a high pressure on zswap it will result in flipping pages in and out zswap pool without any real benefit, and the overall system performance will drop. The previous discussion on this subject [1] ended up with a suggestion to implement a sort of hysteresis to refuse taking pages into zswap pool until it has sufficient space if the limit has been hit. This is my take on this. Hysteresis is controlled with a sysfs-configurable parameter (namely, /sys/kernel/debug/zswap/accept_threhsold_percent). It specifies the threshold at which zswap would start accepting pages again after it became full. Setting this parameter to 100 disables the hysteresis and sets the zswap behavior to pre-hysteresis state. [1] https://lkml.org/lkml/2019/11/8/949 Link: http://lkml.kernel.org/r/20200108200118.15563-1-vitaly.wool@konsulko.com Signed-off-by: Vitaly Wool Cc: Dan Streetman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d680bdf60a5bade3e8cbd049927e7f8b1d3fe97 Author: Qian Cai Date: Thu Jan 30 22:15:01 2020 -0800 mm/page_isolation: fix potential warning from user It makes sense to call the WARN_ON_ONCE(zone_idx(zone) == ZONE_MOVABLE) from start_isolate_page_range(), but should avoid triggering it from userspace, i.e, from is_mem_section_removable() because it could crash the system by a non-root user if warn_on_panic is set. While at it, simplify the code a bit by removing an unnecessary jump label. Link: http://lkml.kernel.org/r/20200120163915.1469-1-cai@lca.pw Signed-off-by: Qian Cai Suggested-by: Michal Hocko Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4a55c0474a92d5c418bcbbe122368de0910aeac2 Author: Qian Cai Date: Thu Jan 30 22:14:57 2020 -0800 mm/hotplug: silence a lockdep splat with printk() It is not that hard to trigger lockdep splats by calling printk from under zone->lock. Most of them are false positives caused by lock chains introduced early in the boot process and they do not cause any real problems (although most of the early boot lock dependencies could happen after boot as well). There are some console drivers which do allocate from the printk context as well and those should be fixed. In any case, false positives are not that trivial to workaround and it is far from optimal to lose lockdep functionality for something that is a non-issue. So change has_unmovable_pages() so that it no longer calls dump_page() itself - instead it returns a "struct page *" of the unmovable page back to the caller so that in the case of a has_unmovable_pages() failure, the caller can call dump_page() after releasing zone->lock. Also, make dump_page() is able to report a CMA page as well, so the reason string from has_unmovable_pages() can be removed. Even though has_unmovable_pages doesn't hold any reference to the returned page this should be reasonably safe for the purpose of reporting the page (dump_page) because it cannot be hotremoved in the context of memory unplug. The state of the page might change but that is the case even with the existing code as zone->lock only plays role for free pages. While at it, remove a similar but unnecessary debug-only printk() as well. A sample of one of those lockdep splats is, WARNING: possible circular locking dependency detected ------------------------------------------------------ test.sh/8653 is trying to acquire lock: ffffffff865a4460 (console_owner){-.-.}, at: console_unlock+0x207/0x750 but task is already holding lock: ffff88883fff3c58 (&(&zone->lock)->rlock){-.-.}, at: __offline_isolated_pages+0x179/0x3e0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&(&zone->lock)->rlock){-.-.}: __lock_acquire+0x5b3/0xb40 lock_acquire+0x126/0x280 _raw_spin_lock+0x2f/0x40 rmqueue_bulk.constprop.21+0xb6/0x1160 get_page_from_freelist+0x898/0x22c0 __alloc_pages_nodemask+0x2f3/0x1cd0 alloc_pages_current+0x9c/0x110 allocate_slab+0x4c6/0x19c0 new_slab+0x46/0x70 ___slab_alloc+0x58b/0x960 __slab_alloc+0x43/0x70 __kmalloc+0x3ad/0x4b0 __tty_buffer_request_room+0x100/0x250 tty_insert_flip_string_fixed_flag+0x67/0x110 pty_write+0xa2/0xf0 n_tty_write+0x36b/0x7b0 tty_write+0x284/0x4c0 __vfs_write+0x50/0xa0 vfs_write+0x105/0x290 redirected_tty_write+0x6a/0xc0 do_iter_write+0x248/0x2a0 vfs_writev+0x106/0x1e0 do_writev+0xd4/0x180 __x64_sys_writev+0x45/0x50 do_syscall_64+0xcc/0x76c entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #2 (&(&port->lock)->rlock){-.-.}: __lock_acquire+0x5b3/0xb40 lock_acquire+0x126/0x280 _raw_spin_lock_irqsave+0x3a/0x50 tty_port_tty_get+0x20/0x60 tty_port_default_wakeup+0xf/0x30 tty_port_tty_wakeup+0x39/0x40 uart_write_wakeup+0x2a/0x40 serial8250_tx_chars+0x22e/0x440 serial8250_handle_irq.part.8+0x14a/0x170 serial8250_default_handle_irq+0x5c/0x90 serial8250_interrupt+0xa6/0x130 __handle_irq_event_percpu+0x78/0x4f0 handle_irq_event_percpu+0x70/0x100 handle_irq_event+0x5a/0x8b handle_edge_irq+0x117/0x370 do_IRQ+0x9e/0x1e0 ret_from_intr+0x0/0x2a cpuidle_enter_state+0x156/0x8e0 cpuidle_enter+0x41/0x70 call_cpuidle+0x5e/0x90 do_idle+0x333/0x370 cpu_startup_entry+0x1d/0x1f start_secondary+0x290/0x330 secondary_startup_64+0xb6/0xc0 -> #1 (&port_lock_key){-.-.}: __lock_acquire+0x5b3/0xb40 lock_acquire+0x126/0x280 _raw_spin_lock_irqsave+0x3a/0x50 serial8250_console_write+0x3e4/0x450 univ8250_console_write+0x4b/0x60 console_unlock+0x501/0x750 vprintk_emit+0x10d/0x340 vprintk_default+0x1f/0x30 vprintk_func+0x44/0xd4 printk+0x9f/0xc5 -> #0 (console_owner){-.-.}: check_prev_add+0x107/0xea0 validate_chain+0x8fc/0x1200 __lock_acquire+0x5b3/0xb40 lock_acquire+0x126/0x280 console_unlock+0x269/0x750 vprintk_emit+0x10d/0x340 vprintk_default+0x1f/0x30 vprintk_func+0x44/0xd4 printk+0x9f/0xc5 __offline_isolated_pages.cold.52+0x2f/0x30a offline_isolated_pages_cb+0x17/0x30 walk_system_ram_range+0xda/0x160 __offline_pages+0x79c/0xa10 offline_pages+0x11/0x20 memory_subsys_offline+0x7e/0xc0 device_offline+0xd5/0x110 state_store+0xc6/0xe0 dev_attr_store+0x3f/0x60 sysfs_kf_write+0x89/0xb0 kernfs_fop_write+0x188/0x240 __vfs_write+0x50/0xa0 vfs_write+0x105/0x290 ksys_write+0xc6/0x160 __x64_sys_write+0x43/0x50 do_syscall_64+0xcc/0x76c entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: console_owner --> &(&port->lock)->rlock --> &(&zone->lock)->rlock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&zone->lock)->rlock); lock(&(&port->lock)->rlock); lock(&(&zone->lock)->rlock); lock(console_owner); *** DEADLOCK *** 9 locks held by test.sh/8653: #0: ffff88839ba7d408 (sb_writers#4){.+.+}, at: vfs_write+0x25f/0x290 #1: ffff888277618880 (&of->mutex){+.+.}, at: kernfs_fop_write+0x128/0x240 #2: ffff8898131fc218 (kn->count#115){.+.+}, at: kernfs_fop_write+0x138/0x240 #3: ffffffff86962a80 (device_hotplug_lock){+.+.}, at: lock_device_hotplug_sysfs+0x16/0x50 #4: ffff8884374f4990 (&dev->mutex){....}, at: device_offline+0x70/0x110 #5: ffffffff86515250 (cpu_hotplug_lock.rw_sem){++++}, at: __offline_pages+0xbf/0xa10 #6: ffffffff867405f0 (mem_hotplug_lock.rw_sem){++++}, at: percpu_down_write+0x87/0x2f0 #7: ffff88883fff3c58 (&(&zone->lock)->rlock){-.-.}, at: __offline_isolated_pages+0x179/0x3e0 #8: ffffffff865a4920 (console_lock){+.+.}, at: vprintk_emit+0x100/0x340 stack backtrace: Hardware name: HPE ProLiant DL560 Gen10/ProLiant DL560 Gen10, BIOS U34 05/21/2019 Call Trace: dump_stack+0x86/0xca print_circular_bug.cold.31+0x243/0x26e check_noncircular+0x29e/0x2e0 check_prev_add+0x107/0xea0 validate_chain+0x8fc/0x1200 __lock_acquire+0x5b3/0xb40 lock_acquire+0x126/0x280 console_unlock+0x269/0x750 vprintk_emit+0x10d/0x340 vprintk_default+0x1f/0x30 vprintk_func+0x44/0xd4 printk+0x9f/0xc5 __offline_isolated_pages.cold.52+0x2f/0x30a offline_isolated_pages_cb+0x17/0x30 walk_system_ram_range+0xda/0x160 __offline_pages+0x79c/0xa10 offline_pages+0x11/0x20 memory_subsys_offline+0x7e/0xc0 device_offline+0xd5/0x110 state_store+0xc6/0xe0 dev_attr_store+0x3f/0x60 sysfs_kf_write+0x89/0xb0 kernfs_fop_write+0x188/0x240 __vfs_write+0x50/0xa0 vfs_write+0x105/0x290 ksys_write+0xc6/0x160 __x64_sys_write+0x43/0x50 do_syscall_64+0xcc/0x76c entry_SYSCALL_64_after_hwframe+0x49/0xbe Link: http://lkml.kernel.org/r/20200117181200.20299-1-cai@lca.pw Signed-off-by: Qian Cai Reviewed-by: David Hildenbrand Cc: Michal Hocko Cc: Sergey Senozhatsky Cc: Petr Mladek Cc: Steven Rostedt (VMware) Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bd5c2344f9eb1ebf7ff2501ddb13d83151939780 Author: David Hildenbrand Date: Thu Jan 30 22:14:54 2020 -0800 mm/memory_hotplug: pass in nid to online_pages() Patch series "mm/memory_hotplug: pass in nid to online_pages()". Simplify onlining code and get rid of find_memory_block(). Pass in the nid from the memory block we are trying to online directly, instead of manually looking it up. This patch (of 2): No need to lookup the memory block, we can directly pass in the nid. Link: http://lkml.kernel.org/r/20200113113354.6341-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Michal Hocko Cc: Oscar Salvador Cc: Anshuman Khandual Cc: Dan Williams Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a67c8caae98f165d4b2caf73a5b32343524bc037 Author: Miaohe Lin Date: Thu Jan 30 22:14:51 2020 -0800 mm/mmap.c: get rid of odd jump labels in find_mergeable_anon_vma() The jump labels try_prev and none are not really needed in find_mergeable_anon_vma(), eliminate them to improve readability. Link: http://lkml.kernel.org/r/1574079844-17493-1-git-send-email-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: John Hubbard Reviewed-by: Wei Yang Acked-by: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f42f25526502d851d0e3ca1e46297da8aafce8a7 Author: David Rientjes Date: Thu Jan 30 22:14:48 2020 -0800 mm, thp: fix defrag setting if newline is not used If thp defrag setting "defer" is used and a newline is *not* used when writing to the sysfs file, this is interpreted as the "defer+madvise" option. This is because we do prefix matching and if five characters are written without a newline, the current code ends up comparing to the first five bytes of the "defer+madvise" option and using that instead. Use the more appropriate sysfs_streq() that handles the trailing newline for us. Since this doubles as a nice cleanup, do it in enabled_store() as well. The current implementation relies on prefix matching: the number of bytes compared is either the number of bytes written or the length of the option being compared. With a newline, "defer\n" does not match "defer+"madvise"; without a newline, however, "defer" is considered to match "defer+madvise" (prefix matching is only comparing the first five bytes). End result is that writing "defer" is broken unless it has an additional trailing character. This means that writing "madv" in the past would match and set "madvise". With strict checking, that no longer is the case but it is unlikely anybody is currently doing this. Link: http://lkml.kernel.org/r/alpine.DEB.2.21.2001171411020.56385@chino.kir.corp.google.com Fixes: 21440d7eb904 ("mm, thp: add new defer+madvise defrag option") Signed-off-by: David Rientjes Suggested-by: Andrew Morton Acked-by: Vlastimil Babka Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 34290e2c6419d3a61391416b5ab6ceb37f857fde Author: Ralph Campbell Date: Thu Jan 30 22:14:44 2020 -0800 mm/migrate: add stable check in migrate_vma_insert_page() migrate_vma_insert_page() closely follows the code in: __handle_mm_fault() handle_pte_fault() do_anonymous_page() Add a call to check_stable_address_space() after locking the page table entry before inserting a ZONE_DEVICE private zero page mapping similar to page faulting a new anonymous page. Link: http://lkml.kernel.org/r/20200107211208.24595-4-rcampbell@nvidia.com Signed-off-by: Ralph Campbell Reviewed-by: Christoph Hellwig Cc: Jerome Glisse Cc: John Hubbard Cc: Jason Gunthorpe Cc: Bharata B Rao Cc: Michal Hocko Cc: Chris Down Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c23a0c99793fb7e2daac0f8fc7ff3bd7d77c9250 Author: Ralph Campbell Date: Thu Jan 30 22:14:41 2020 -0800 mm/migrate: clean up some minor coding style Fix some comment typos and coding style clean up in preparation for the next patch. No functional changes. Link: http://lkml.kernel.org/r/20200107211208.24595-3-rcampbell@nvidia.com Signed-off-by: Ralph Campbell Acked-by: Chris Down Reviewed-by: Christoph Hellwig Cc: Jerome Glisse Cc: John Hubbard Cc: Jason Gunthorpe Cc: Bharata B Rao Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 872ea707511ad43afe202f401ccb8de01e2b2a3b Author: Ralph Campbell Date: Thu Jan 30 22:14:38 2020 -0800 mm/migrate: remove useless mask of start address Addresses passed to walk_page_range() callback functions are already page aligned and don't need to be masked with PAGE_MASK. Link: http://lkml.kernel.org/r/20200107211208.24595-2-rcampbell@nvidia.com Signed-off-by: Ralph Campbell Reviewed-by: Christoph Hellwig Cc: Jerome Glisse Cc: John Hubbard Cc: Jason Gunthorpe Cc: Bharata B Rao Cc: Michal Hocko Cc: Chris Down Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit afb971729a0bca7676606013e913025bc5619301 Author: Wei Yang Date: Thu Jan 30 22:14:35 2020 -0800 mm/huge_memory.c: reduce critical section protected by split_queue_lock split_queue_lock protects data in struct deferred_split. We can release the lock after delete the page from deferred_split_queue. This patch moves the THP accounting out of the lock protection, which is introduced in commit 65c453778aea ("mm, rmap: account shmem thp pages"). Link: http://lkml.kernel.org/r/20200110025516.23996-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Acked-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a8803e6c177f490fe5624397b07f4eb05a15f532 Author: Wei Yang Date: Thu Jan 30 22:14:32 2020 -0800 mm/huge_memory.c: use head to emphasize the purpose of page During split huge page, it checks the property of the page. Currently we do the check on page and head without emphasizing the check is on the compound page. In case the page passed to split_huge_page_to_list is a tail page, audience would take some time to think about whether the check is on compound page or tail page itself. To make it explicit, use head instead of page for those checks. After this, audience would be more clear about the checks are on compound page and the page is used to do the split and dump error message if failed. Link: http://lkml.kernel.org/r/20200110032610.26499-2-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Acked-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb829624867b5ab10bc6a7036d183b1b82bfe9f8 Author: Wei Yang Date: Thu Jan 30 22:14:29 2020 -0800 mm/huge_memory.c: use head to check huge zero page The page could be a tail page, if this is the case, this BUG_ON will never be triggered. Link: http://lkml.kernel.org/r/20200110032610.26499-1-richardw.yang@linux.intel.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Wei Yang Acked-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8a7ff02acabbd877669fecb0a2e75d0930b62c85 Author: David Rientjes Date: Thu Jan 30 22:14:26 2020 -0800 mm, oom: dump stack of victim when reaping failed When a process cannot be oom reaped, for whatever reason, currently the list of locks that are held is currently dumped to the kernel log. Much more interesting is the stack trace of the victim that cannot be reaped. If the stack trace is dumped, we have the ability to find related occurrences in the same kernel code and hopefully solve the issue that is making it wedged. Dump the stack trace when a process fails to be oom reaped. Link: http://lkml.kernel.org/r/alpine.DEB.2.21.2001141519280.200484@chino.kir.corp.google.com Signed-off-by: David Rientjes Acked-by: Michal Hocko Cc: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a090d711dd2ebd7e445bf09f98a4feba6c22f2ff Author: Anshuman Khandual Date: Thu Jan 30 22:14:23 2020 -0800 memblock: Use __func__ in remaining memblock_dbg() call sites Replace open function name strings with %s (__func__) in all remaining memblock_dbg() call sites. Link: http://lkml.kernel.org/r/1578285510-28261-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Reviewed-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 02634a44b8aba2d4f16ea09d3c17400d9320327e Author: Anshuman Khandual Date: Thu Jan 30 22:14:20 2020 -0800 mm/memblock: define memblock_physmem_add() On the s390 platform memblock.physmem array is being built by directly calling into memblock_add_range() which is a low level function not intended to be used outside of memblock. Hence lets conditionally add helper functions for physmem array when HAVE_MEMBLOCK_PHYS_MAP is enabled. Also use MAX_NUMNODES instead of 0 as node ID similar to memblock_add() and memblock_reserve(). Make memblock_add_range() a static function as it is no longer getting used outside of memblock. Link: http://lkml.kernel.org/r/1578283835-21969-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Reviewed-by: Mike Rapoport Acked-by: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Martin Schwidefsky Cc: Collin Walling Cc: Gerald Schaefer Cc: Philipp Rudo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e25974aa72a0303a20e9b6a3f3cb32e1873889a8 Author: Daniel Wagner Date: Thu Jan 30 22:14:17 2020 -0800 tools/vm/slabinfo: fix sanity checks enabling The sysfs file name for enabling sanity checking is called 'sanity_checks' and not 'sanity'. The name of the file has never changed since the introduction of the slub allocator. Obviously, most people turn the checks on via the command line option and not during runtime using slabinfo. Link: http://lkml.kernel.org/r/20200116131642.642-1-dwagner@suse.de Signed-off-by: Daniel Wagner Reviewed-by: Andrew Morton Cc: "Tobin C. Harding" Cc: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 648b5cf368e06c783d3cd13776645a60317cca13 Author: Alex Shi Date: Thu Jan 30 22:14:14 2020 -0800 mm/vmscan: remove unused RECLAIM_OFF/RECLAIM_ZONE Commit 1b2ffb7896ad ("[PATCH] Zone reclaim: Allow modification of zone reclaim behavior")' defined RECLAIM_OFF/RECLAIM_ZONE, but never use them, so better to remove them. [dwagner@suse.de: fix sanity checks enabling] Link: http://lkml.kernel.org/r/20200116131642.642-1-dwagner@suse.de [akpm@linux-foundation.org: renumber the bits for neatness] Link: http://lkml.kernel.org/r/1579005573-58923-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Signed-off-by: Daniel Wagner Reviewed-by: Andrew Morton Cc: "Tobin C. Harding" Cc: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fffbacc1ec28f07e6f26df00b9eff012c3141048 Author: Alex Shi Date: Thu Jan 30 22:14:10 2020 -0800 mm/vmscan: remove prefetch_prev_lru_page This macro was never used in git history. So better to remove. Link: http://lkml.kernel.org/r/1579006500-127143-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Reviewed-by: Andrew Morton Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c9e0907fc8bc978e97bb78bbbc6e9bc8fc51cb3 Author: Liu Song Date: Thu Jan 30 22:14:08 2020 -0800 mm/vmscan.c: remove unused return value of shrink_node The return value of shrink_node is not used, so remove unnecessary operations. Link: http://lkml.kernel.org/r/20191128143524.3223-1-fishland@aliyun.com Signed-off-by: Liu Song Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fe4c86c916d9151113372369f322e7436167e6f3 Author: David Hildenbrand Date: Thu Jan 30 22:14:04 2020 -0800 mm: remove "count" parameter from has_unmovable_pages() Now that the memory isolate notifier is gone, the parameter is always 0. Drop it and cleanup has_unmovable_pages(). Link: http://lkml.kernel.org/r/20191114131911.11783-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Anshuman Khandual Cc: Qian Cai Cc: Pingfan Liu Cc: Stephen Rothwell Cc: Dan Williams Cc: Pavel Tatashin Cc: Vlastimil Babka Cc: Mel Gorman Cc: Mike Rapoport Cc: Wei Yang Cc: Alexander Duyck Cc: Alexander Potapenko Cc: Arun KS Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f9903b9ca5e981b5862d7b10086d0e8caa20298 Author: David Hildenbrand Date: Thu Jan 30 22:14:01 2020 -0800 mm: remove the memory isolate notifier Luckily, we have no users left, so we can get rid of it. Cleanup set_migratetype_isolate() a little bit. Link: http://lkml.kernel.org/r/20191114131911.11783-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Greg Kroah-Hartman Acked-by: Michal Hocko Cc: "Rafael J. Wysocki" Cc: Pavel Tatashin Cc: Dan Williams Cc: Oscar Salvador Cc: Qian Cai Cc: Anshuman Khandual Cc: Pingfan Liu Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f1353552e256cb3bf0f23334c48f50476044673 Author: Kirill A. Shutemov Date: Thu Jan 30 22:13:57 2020 -0800 mm/page_alloc: skip non present sections on zone initialization memmap_init_zone() can be called on the ranges with holes during the boot. It will skip any non-valid PFNs one-by-one. It works fine as long as holes are not too big. But huge holes in the memory map causes a problem. It takes over 20 seconds to walk 32TiB hole. x86-64 with 5-level paging allows for much larger holes in the memory map which would practically hang the system. Deferred struct page init doesn't help here. It only works on the present ranges. Skipping non-present sections would fix the issue. Link: http://lkml.kernel.org/r/20191230093828.24613-1-kirill.shutemov@linux.intel.com Signed-off-by: Kirill A. Shutemov Reviewed-by: Baoquan He Acked-by: Michal Hocko Cc: Dan Williams Cc: Vlastimil Babka Cc: Mel Gorman Cc: "Jin, Zhi" Cc: David Hildenbrand Cc: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b69d79f94d42ac26a5397a07b9d78b066c400aa Author: Andy Shevchenko Date: Thu Jan 30 22:13:54 2020 -0800 mm/early_ioremap.c: use %pa to print resource_size_t variables %pa takes into consideration the special types such as resource_size_t. Use this specifier %instead of explicit casting. Link: http://lkml.kernel.org/r/20191209165413.56263-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: David Hildenbrand Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3e21d9a501bf99aee2e5835d7f34d8c823f115b5 Author: Gustavo A. R. Silva Date: Thu Jan 30 22:13:51 2020 -0800 lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more() In case memory resources for _ptr2_ were allocated, release them before return. Notice that in case _ptr1_ happens to be NULL, krealloc() behaves exactly like kmalloc(). Addresses-Coverity-ID: 1490594 ("Resource leak") Link: http://lkml.kernel.org/r/20200123160115.GA4202@embeddedor Fixes: 3f15801cdc23 ("lib: add kasan test module") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Dmitry Vyukov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e168b9babab254c3f9a6c7ed100faee73d493f8 Author: Junyong Sun Date: Thu Jan 30 22:13:48 2020 -0800 mm, tracing: print symbol name for kmem_alloc_node call_site events Print the call_site ip of kmem_alloc_node using '%pS' to improve the readability of raw slab trace points. Link: http://lkml.kernel.org/r/1577949568-4518-1-git-send-email-sunjunyong@xiaomi.com Signed-off-by: Junyong Sun Acked-by: Steven Rostedt (VMware) Cc: Ingo Molnar Cc: Joel Fernandes (Google) Cc: Changbin Du Cc: Tim Murray Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b8d6e37b519e455661cd847654c2e6ad20b4b1d Author: Li Xinhai Date: Thu Jan 30 22:13:45 2020 -0800 mm/page_vma_mapped.c: explicitly compare pfn for normal, hugetlbfs and THP page When check_pte, pfn of normal, hugetlbfs and THP page need be compared. The current implementation apply comparison as - normal 4K page: page_pfn <= pfn < page_pfn + 1 - hugetlbfs page: page_pfn <= pfn < page_pfn + HPAGE_PMD_NR - THP page: page_pfn <= pfn < page_pfn + HPAGE_PMD_NR in pfn_in_hpage. For hugetlbfs page, it should be page_pfn == pfn Now, change pfn_in_hpage to pfn_is_match to highlight that comparison is not only for THP and explicitly compare for these cases. No impact upon current behavior, just make the code clear. I think it is important to make the code clear - comparing hugetlbfs page in range page_pfn <= pfn < page_pfn + HPAGE_PMD_NR is confusing. Link: http://lkml.kernel.org/r/1578737885-8890-1-git-send-email-lixinhai.lxh@gmail.com Signed-off-by: Li Xinhai Acked-by: Kirill A. Shutemov Acked-by: Mike Kravetz Cc: Kirill A. Shutemov Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 92855270ff0827865109447b59e7e5df9c2bef68 Author: Kaitao Cheng Date: Thu Jan 30 22:13:42 2020 -0800 mm/memcontrol.c: cleanup some useless code Compound pages handling in mem_cgroup_migrate is more convoluted than necessary. The state is duplicated in compound variable and the same could be achieved by PageTransHuge check which is trivial and hpage_nr_pages is already PageTransHuge aware. It is much simpler to just use hpage_nr_pages for nr_pages and replace the local variable by PageTransHuge check directly Link: http://lkml.kernel.org/r/20191210160450.3395-1-pilgrimtao@gmail.com Signed-off-by: Kaitao Cheng Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 10c8d69f314d557d94d74ec492575ae6a4f1eb1c Author: Vasily Averin Date: Thu Jan 30 22:13:39 2020 -0800 mm/swapfile.c: swap_next should increase position index If seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. In Aug 2018 NeilBrown noticed commit 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface") "Some ->next functions do not increment *pos when they return NULL... Note that such ->next functions are buggy and should be fixed. A simple demonstration is dd if=/proc/swaps bs=1000 skip=1 Choose any block size larger than the size of /proc/swaps. This will always show the whole last line of /proc/swaps" Described problem is still actual. If you make lseek into middle of last output line following read will output end of last line and whole last line once again. $ dd if=/proc/swaps bs=1 # usual output Filename Type Size Used Priority /dev/dm-0 partition 4194812 97536 -2 104+0 records in 104+0 records out 104 bytes copied $ dd if=/proc/swaps bs=40 skip=1 # last line was generated twice dd: /proc/swaps: cannot skip to specified offset v/dm-0 partition 4194812 97536 -2 /dev/dm-0 partition 4194812 97536 -2 3+1 records in 3+1 records out 131 bytes copied https://bugzilla.kernel.org/show_bug.cgi?id=206283 Link: http://lkml.kernel.org/r/bd8cfd7b-ac95-9b91-f9e7-e8438bd5047d@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Andrew Morton Cc: Jann Horn Cc: Alexander Viro Cc: Kees Cook Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1f6a7dd9b53aafd81b696b9017036e7b08e57ea Author: John Hubbard Date: Thu Jan 30 22:13:35 2020 -0800 mm, tree-wide: rename put_user_page*() to unpin_user_page*() In order to provide a clearer, more symmetric API for pinning and unpinning DMA pages. This way, pin_user_pages*() calls match up with unpin_user_pages*() calls, and the API is a lot closer to being self-explanatory. Link: http://lkml.kernel.org/r/20200107224558.2362728-23-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jan Kara Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bdffe23eee672fcaa732198c3661f7c1302c6bfa Author: John Hubbard Date: Thu Jan 30 22:13:32 2020 -0800 mm/gup_benchmark: use proper FOLL_WRITE flags instead of hard-coding "1" Fix the gup benchmark flags to use the symbolic FOLL_WRITE, instead of a hard-coded "1" value. Also, clean up the filtering of gup flags a little, by just doing it once before issuing any of the get_user_pages*() calls. This makes it harder to overlook, instead of having little "gup_flags & 1" phrases in the function calls. Link: http://lkml.kernel.org/r/20200107224558.2362728-22-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa4b87fe9ea34a1816dcb99c537d5726b80ed452 Author: John Hubbard Date: Thu Jan 30 22:13:28 2020 -0800 powerpc: book3s64: convert to pin_user_pages() and put_user_page() 1. Convert from get_user_pages() to pin_user_pages(). 2. As required by pin_user_pages(), release these pages via put_user_page(). Link: http://lkml.kernel.org/r/20200107224558.2362728-21-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jan Kara Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19fed0dae94dbe66235c116a0e058712d8bc291c Author: John Hubbard Date: Thu Jan 30 22:13:24 2020 -0800 vfio, mm: pin_user_pages (FOLL_PIN) and put_user_page() conversion 1. Change vfio from get_user_pages_remote(), to pin_user_pages_remote(). 2. Because all FOLL_PIN-acquired pages must be released via put_user_page(), also convert the put_page() call over to put_user_pages_dirty_lock(). Note that this effectively changes the code's behavior in vfio_iommu_type1.c: put_pfn(): it now ultimately calls set_page_dirty_lock(), instead of set_page_dirty(). This is probably more accurate. As Christoph Hellwig put it, "set_page_dirty() is only safe if we are dealing with a file backed page where we have reference on the inode it hangs off." [1] [1] https://lore.kernel.org/r/20190723153640.GB720@lst.de Link: http://lkml.kernel.org/r/20200107224558.2362728-20-jhubbard@nvidia.com Signed-off-by: John Hubbard Tested-by: Alex Williamson Acked-by: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f815afcfca703f48143bf962cf7bdbcf4474df2 Author: John Hubbard Date: Thu Jan 30 22:13:20 2020 -0800 media/v4l2-core: pin_user_pages (FOLL_PIN) and put_user_page() conversion 1. Change v4l2 from get_user_pages() to pin_user_pages(). 2. Because all FOLL_PIN-acquired pages must be released via put_user_page(), also convert the put_page() call over to put_user_pages_dirty_lock(). Link: http://lkml.kernel.org/r/20200107224558.2362728-19-jhubbard@nvidia.com Signed-off-by: John Hubbard Acked-by: Hans Verkuil Cc: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fb48b4746a5d77f352b8c1f793e2a6f4211c8ec2 Author: John Hubbard Date: Thu Jan 30 22:13:17 2020 -0800 net/xdp: set FOLL_PIN via pin_user_pages() Convert net/xdp to use the new pin_longterm_pages() call, which sets FOLL_PIN. Setting FOLL_PIN is now required for code that requires tracking of pinned pages. In partial anticipation of this work, the net/xdp code was already calling put_user_page() instead of put_page(). Therefore, in order to convert from the get_user_pages()/put_page() model, to the pin_user_pages()/put_user_page() model, the only change required here is to change get_user_pages() to pin_user_pages(). Link: http://lkml.kernel.org/r/20200107224558.2362728-18-jhubbard@nvidia.com Signed-off-by: John Hubbard Acked-by: Björn Töpel Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2113b05d039e9213216ec647df58c5a43593631b Author: John Hubbard Date: Thu Jan 30 22:13:13 2020 -0800 fs/io_uring: set FOLL_PIN via pin_user_pages() Convert fs/io_uring to use the new pin_user_pages() call, which sets FOLL_PIN. Setting FOLL_PIN is now required for code that requires tracking of pinned pages, and therefore for any code that calls put_user_page(). In partial anticipation of this work, the io_uring code was already calling put_user_page() instead of put_page(). Therefore, in order to convert from the get_user_pages()/put_page() model, to the pin_user_pages()/put_user_page() model, the only change required here is to change get_user_pages() to pin_user_pages(). Link: http://lkml.kernel.org/r/20200107224558.2362728-17-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jens Axboe Reviewed-by: Jan Kara Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a5adf0a08b076f99a06e141d9884994ef8bd17cb Author: John Hubbard Date: Thu Jan 30 22:13:09 2020 -0800 drm/via: set FOLL_PIN via pin_user_pages_fast() Convert drm/via to use the new pin_user_pages_fast() call, which sets FOLL_PIN. Setting FOLL_PIN is now required for code that requires tracking of pinned pages, and therefore for any code that calls put_user_page(). In partial anticipation of this work, the drm/via driver was already calling put_user_page() instead of put_page(). Therefore, in order to convert from the get_user_pages()/put_page() model, to the pin_user_pages()/put_user_page() model, the only change required is to change get_user_pages() to pin_user_pages(). Link: http://lkml.kernel.org/r/20200107224558.2362728-16-jhubbard@nvidia.com Signed-off-by: John Hubbard Acked-by: Daniel Vetter Reviewed-by: Jérôme Glisse Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Dan Williams Cc: Hans Verkuil Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 803e4572d7c5db03cbc155e9dd0530f50ebba336 Author: John Hubbard Date: Thu Jan 30 22:13:05 2020 -0800 mm/process_vm_access: set FOLL_PIN via pin_user_pages_remote() Convert process_vm_access to use the new pin_user_pages_remote() call, which sets FOLL_PIN. Setting FOLL_PIN is now required for code that requires tracking of pinned pages. Also, release the pages via put_user_page*(). Also, rename "pages" to "pinned_pages", as this makes for easier reading of process_vm_rw_single_vec(). Link: http://lkml.kernel.org/r/20200107224558.2362728-15-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jan Kara Reviewed-by: Jérôme Glisse Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dfa0a4fff11b32740c67fb0baf219702b978fc51 Author: John Hubbard Date: Thu Jan 30 22:13:02 2020 -0800 IB/{core,hw,umem}: set FOLL_PIN via pin_user_pages*(), fix up ODP Convert infiniband to use the new pin_user_pages*() calls. Also, revert earlier changes to Infiniband ODP that had it using put_user_page(). ODP is "Case 3" in Documentation/core-api/pin_user_pages.rst, which is to say, normal get_user_pages() and put_page() is the API to use there. The new pin_user_pages*() calls replace corresponding get_user_pages*() calls, and set the FOLL_PIN flag. The FOLL_PIN flag requires that the caller must return the pages via put_user_page*() calls, but infiniband was already doing that as part of an earlier commit. Link: http://lkml.kernel.org/r/20200107224558.2362728-14-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jason Gunthorpe Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 57459435cff564cc4c3f863419b32839c2e431f3 Author: John Hubbard Date: Thu Jan 30 22:12:58 2020 -0800 goldish_pipe: convert to pin_user_pages() and put_user_page() 1. Call the new global pin_user_pages_fast(), from pin_goldfish_pages(). 2. As required by pin_user_pages(), release these pages via put_user_page(). In this case, do so via put_user_pages_dirty_lock(). That has the side effect of calling set_page_dirty_lock(), instead of set_page_dirty(). This is probably more accurate. As Christoph Hellwig put it, "set_page_dirty() is only safe if we are dealing with a file backed page where we have reference on the inode it hangs off." [1] Another side effect is that the release code is simplified because the page[] loop is now in gup.c instead of here, so just delete the local release_user_pages() entirely, and call put_user_pages_dirty_lock() directly, instead. [1] https://lore.kernel.org/r/20190723153640.GB720@lst.de Link: http://lkml.kernel.org/r/20200107224558.2362728-13-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jan Kara Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eddb1c228f7951d399240a0cc57455dccc7f8777 Author: John Hubbard Date: Thu Jan 30 22:12:54 2020 -0800 mm/gup: introduce pin_user_pages*() and FOLL_PIN Introduce pin_user_pages*() variations of get_user_pages*() calls, and also pin_longterm_pages*() variations. For now, these are placeholder calls, until the various call sites are converted to use the correct get_user_pages*() or pin_user_pages*() API. These variants will eventually all set FOLL_PIN, which is also introduced, and thoroughly documented. pin_user_pages() pin_user_pages_remote() pin_user_pages_fast() All pages that are pinned via the above calls, must be unpinned via put_user_page(). The underlying rules are: * FOLL_PIN is a gup-internal flag, so the call sites should not directly set it. That behavior is enforced with assertions. * Call sites that want to indicate that they are going to do DirectIO ("DIO") or something with similar characteristics, should call a get_user_pages()-like wrapper call that sets FOLL_PIN. These wrappers will: * Start with "pin_user_pages" instead of "get_user_pages". That makes it easy to find and audit the call sites. * Set FOLL_PIN * For pages that are received via FOLL_PIN, those pages must be returned via put_user_page(). Thanks to Jan Kara and Vlastimil Babka for explaining the 4 cases in this documentation. (I've reworded it and expanded upon it.) Link: http://lkml.kernel.org/r/20200107224558.2362728-12-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jan Kara Reviewed-by: Mike Rapoport [Documentation] Reviewed-by: Jérôme Glisse Cc: Jonathan Corbet Cc: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c7470b6f68434acae459482ab920d1e3fabd1c7 Author: John Hubbard Date: Thu Jan 30 22:12:50 2020 -0800 media/v4l2-core: set pages dirty upon releasing DMA buffers After DMA is complete, and the device and CPU caches are synchronized, it's still required to mark the CPU pages as dirty, if the data was coming from the device. However, this driver was just issuing a bare put_page() call, without any set_page_dirty*() call. Fix the problem, by calling set_page_dirty_lock() if the CPU pages were potentially receiving data from the device. Link: http://lkml.kernel.org/r/20200107224558.2362728-11-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Acked-by: Hans Verkuil Cc: Mauro Carvalho Chehab Cc: Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Daniel Vetter Cc: Dan Williams Cc: Ira Weiny Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4789fcdd14095281952b5dd19a928d5d8b279e90 Author: John Hubbard Date: Thu Jan 30 22:12:47 2020 -0800 IB/umem: use get_user_pages_fast() to pin DMA pages And get rid of the mmap_sem calls, as part of that. Note that get_user_pages_fast() will, if necessary, fall back to __gup_longterm_unlocked(), which takes the mmap_sem as needed. Link: http://lkml.kernel.org/r/20200107224558.2362728-10-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Leon Romanovsky Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: Jason Gunthorpe Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f4000fdf435b8301a11cf85237c561047f8c4c72 Author: John Hubbard Date: Thu Jan 30 22:12:43 2020 -0800 mm/gup: allow FOLL_FORCE for get_user_pages_fast() Commit 817be129e6f2 ("mm: validate get_user_pages_fast flags") allowed only FOLL_WRITE and FOLL_LONGTERM to be passed to get_user_pages_fast(). This, combined with the fact that get_user_pages_fast() falls back to "slow gup", which *does* accept FOLL_FORCE, leads to an odd situation: if you need FOLL_FORCE, you cannot call get_user_pages_fast(). There does not appear to be any reason for filtering out FOLL_FORCE. There is nothing in the _fast() implementation that requires that we avoid writing to the pages. So it appears to have been an oversight. Fix by allowing FOLL_FORCE to be set for get_user_pages_fast(). Link: http://lkml.kernel.org/r/20200107224558.2362728-9-jhubbard@nvidia.com Fixes: 817be129e6f2 ("mm: validate get_user_pages_fast flags") Signed-off-by: John Hubbard Reviewed-by: Leon Romanovsky Reviewed-by: Jan Kara Cc: Christoph Hellwig Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3567813eae5e9b4d02dc227e2060e85abc912045 Author: John Hubbard Date: Thu Jan 30 22:12:39 2020 -0800 vfio: fix FOLL_LONGTERM use, simplify get_user_pages_remote() call Update VFIO to take advantage of the recently loosened restriction on FOLL_LONGTERM with get_user_pages_remote(). Also, now it is possible to fix a bug: the VFIO caller is logically a FOLL_LONGTERM user, but it wasn't setting FOLL_LONGTERM. Also, remove an unnessary pair of calls that were releasing and reacquiring the mmap_sem. There is no need to avoid holding mmap_sem just in order to call page_to_pfn(). Also, now that the the DAX check ("if a VMA is DAX, don't allow long term pinning") is in the internals of get_user_pages_remote() and __gup_longterm_locked(), there's no need for it at the VFIO call site. So remove it. Link: http://lkml.kernel.org/r/20200107224558.2362728-8-jhubbard@nvidia.com Signed-off-by: John Hubbard Tested-by: Alex Williamson Acked-by: Alex Williamson Reviewed-by: Jason Gunthorpe Reviewed-by: Ira Weiny Suggested-by: Jason Gunthorpe Cc: Dan Williams Cc: Jerome Glisse Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Hans Verkuil Cc: Jan Kara Cc: Jens Axboe Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c4237f8b1f4f2857c3079c99f69d971f883dd69c Author: John Hubbard Date: Thu Jan 30 22:12:36 2020 -0800 mm: fix get_user_pages_remote()'s handling of FOLL_LONGTERM As it says in the updated comment in gup.c: current FOLL_LONGTERM behavior is incompatible with FAULT_FLAG_ALLOW_RETRY because of the FS DAX check requirement on vmas. However, the corresponding restriction in get_user_pages_remote() was slightly stricter than is actually required: it forbade all FOLL_LONGTERM callers, but we can actually allow FOLL_LONGTERM callers that do not set the "locked" arg. Update the code and comments to loosen the restriction, allowing FOLL_LONGTERM in some cases. Also, copy the DAX check ("if a VMA is DAX, don't allow long term pinning") from the VFIO call site, all the way into the internals of get_user_pages_remote() and __gup_longterm_locked(). That is: get_user_pages_remote() calls __gup_longterm_locked(), which in turn calls check_dax_vmas(). This check will then be removed from the VFIO call site in a subsequent patch. Thanks to Jason Gunthorpe for pointing out a clean way to fix this, and to Dan Williams for helping clarify the DAX refactoring. Link: http://lkml.kernel.org/r/20200107224558.2362728-7-jhubbard@nvidia.com Signed-off-by: John Hubbard Tested-by: Alex Williamson Acked-by: Alex Williamson Reviewed-by: Jason Gunthorpe Reviewed-by: Ira Weiny Suggested-by: Jason Gunthorpe Cc: Kirill A. Shutemov Cc: Dan Williams Cc: Jerome Glisse Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Hans Verkuil Cc: Jan Kara Cc: Jens Axboe Cc: Jonathan Corbet Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1023369c6e941f1099b54b5cd04c35788885426b Author: John Hubbard Date: Thu Jan 30 22:12:32 2020 -0800 goldish_pipe: rename local pin_user_pages() routine Avoid naming conflicts: rename local static function from "pin_user_pages()" to "goldfish_pin_pages()". An upcoming patch will introduce a global pin_user_pages() function. Link: http://lkml.kernel.org/r/20200107224558.2362728-6-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Jan Kara Reviewed-by: Jérôme Glisse Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 07d8026995287c2a2f03e28c69cdd8152fa69107 Author: John Hubbard Date: Thu Jan 30 22:12:28 2020 -0800 mm: devmap: refactor 1-based refcounting for ZONE_DEVICE pages An upcoming patch changes and complicates the refcounting and especially the "put page" aspects of it. In order to keep everything clean, refactor the devmap page release routines: * Rename put_devmap_managed_page() to page_is_devmap_managed(), and limit the functionality to "read only": return a bool, with no side effects. * Add a new routine, put_devmap_managed_page(), to handle decrementing the refcount for ZONE_DEVICE pages. * Change callers (just release_pages() and put_page()) to check page_is_devmap_managed() before calling the new put_devmap_managed_page() routine. This is a performance point: put_page() is a hot path, so we need to avoid non- inline function calls where possible. * Rename __put_devmap_managed_page() to free_devmap_managed_page(), and limit the functionality to unconditionally freeing a devmap page. This is originally based on a separate patch by Ira Weiny, which applied to an early version of the put_user_page() experiments. Since then, Jérôme Glisse suggested the refactoring described above. Link: http://lkml.kernel.org/r/20200107224558.2362728-5-jhubbard@nvidia.com Signed-off-by: Ira Weiny Signed-off-by: John Hubbard Suggested-by: Jérôme Glisse Reviewed-by: Dan Williams Reviewed-by: Jan Kara Cc: Christoph Hellwig Cc: Kirill A. Shutemov Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Daniel Vetter Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jonathan Corbet Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 429589d647c1adc80b32645fbb8852689525d9cd Author: Dan Williams Date: Thu Jan 30 22:12:24 2020 -0800 mm: Cleanup __put_devmap_managed_page() vs ->page_free() After the removal of the device-public infrastructure there are only 2 ->page_free() call backs in the kernel. One of those is a device-private callback in the nouveau driver, the other is a generic wakeup needed in the DAX case. In the hopes that all ->page_free() callbacks can be migrated to common core kernel functionality, move the device-private specific actions in __put_devmap_managed_page() under the is_device_private_page() conditional, including the ->page_free() callback. For the other page types just open-code the generic wakeup. Yes, the wakeup is only needed in the MEMORY_DEVICE_FSDAX case, but it does no harm in the MEMORY_DEVICE_DEVDAX and MEMORY_DEVICE_PCI_P2PDMA case. Link: http://lkml.kernel.org/r/20200107224558.2362728-4-jhubbard@nvidia.com Signed-off-by: Dan Williams Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Reviewed-by: Jérôme Glisse Cc: Jan Kara Cc: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Daniel Vetter Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a707cdd55f0f8bbf409214ab42028d89c3eddec6 Author: John Hubbard Date: Thu Jan 30 22:12:21 2020 -0800 mm/gup: move try_get_compound_head() to top, fix minor issues An upcoming patch uses try_get_compound_head() more widely, so move it to the top of gup.c. Also fix a tiny spelling error and a checkpatch.pl warning. Link: http://lkml.kernel.org/r/20200107224558.2362728-3-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: Ira Weiny Cc: Alex Williamson Cc: Aneesh Kumar K.V Cc: Björn Töpel Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jerome Glisse Cc: Jonathan Corbet Cc: Kirill A. Shutemov Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a43e982082c24c2f5c0b139daac9657ac352eed3 Author: John Hubbard Date: Thu Jan 30 22:12:17 2020 -0800 mm/gup: factor out duplicate code from four routines Patch series "mm/gup: prereqs to track dma-pinned pages: FOLL_PIN", v12. Overview: This is a prerequisite to solving the problem of proper interactions between file-backed pages, and [R]DMA activities, as discussed in [1], [2], [3], and in a remarkable number of email threads since about 2017. :) A new internal gup flag, FOLL_PIN is introduced, and thoroughly documented in the last patch's Documentation/vm/pin_user_pages.rst. I believe that this will provide a good starting point for doing the layout lease work that Ira Weiny has been working on. That's because these new wrapper functions provide a clean, constrained, systematically named set of functionality that, again, is required in order to even know if a page is "dma-pinned". In contrast to earlier approaches, the page tracking can be incrementally applied to the kernel call sites that, until now, have been simply calling get_user_pages() ("gup"). In other words, opt-in by changing from this: get_user_pages() (sets FOLL_GET) put_page() to this: pin_user_pages() (sets FOLL_PIN) unpin_user_page() Testing: * I've done some overall kernel testing (LTP, and a few other goodies), and some directed testing to exercise some of the changes. And as you can see, gup_benchmark is enhanced to exercise this. Basically, I've been able to runtime test the core get_user_pages() and pin_user_pages() and related routines, but not so much on several of the call sites--but those are generally just a couple of lines changed, each. Not much of the kernel is actually using this, which on one hand reduces risk quite a lot. But on the other hand, testing coverage is low. So I'd love it if, in particular, the Infiniband and PowerPC folks could do a smoke test of this series for me. Runtime testing for the call sites so far is pretty light: * io_uring: Some directed tests from liburing exercise this, and they pass. * process_vm_access.c: A small directed test passes. * gup_benchmark: the enhanced version hits the new gup.c code, and passes. * infiniband: Ran rdma-core tests: rdma-core/build/bin/run_tests.py * VFIO: compiles (I'm vowing to set up a run time test soon, but it's not ready just yet) * powerpc: it compiles... * drm/via: compiles... * goldfish: compiles... * net/xdp: compiles... * media/v4l2: compiles... [1] Some slow progress on get_user_pages() (Apr 2, 2019): https://lwn.net/Articles/784574/ [2] DMA and get_user_pages() (LPC: Dec 12, 2018): https://lwn.net/Articles/774411/ [3] The trouble with get_user_pages() (Apr 30, 2018): https://lwn.net/Articles/753027/ This patch (of 22): There are four locations in gup.c that have a fair amount of code duplication. This means that changing one requires making the same changes in four places, not to mention reading the same code four times, and wondering if there are subtle differences. Factor out the common code into static functions, thus reducing the overall line count and the code's complexity. Also, take the opportunity to slightly improve the efficiency of the error cases, by doing a mass subtraction of the refcount, surrounded by get_page()/put_page(). Also, further simplify (slightly), by waiting until the the successful end of each routine, to increment *nr. Link: http://lkml.kernel.org/r/20200107224558.2362728-2-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Reviewed-by: Jérôme Glisse Reviewed-by: Jan Kara Cc: Kirill A. Shutemov Cc: Ira Weiny Cc: Christoph Hellwig Cc: Aneesh Kumar K.V Cc: Alex Williamson Cc: Björn Töpel Cc: Daniel Vetter Cc: Dan Williams Cc: Hans Verkuil Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jonathan Corbet Cc: Leon Romanovsky Cc: Mauro Carvalho Chehab Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit be9d30458913f70bed1801abb5ee6f7b7d6f4b19 Author: Wei Yang Date: Thu Jan 30 22:12:14 2020 -0800 mm/gup.c: use is_vm_hugetlb_page() to check whether to follow huge No functional change, just leverage the helper function to improve readability as others. Link: http://lkml.kernel.org/r/20200113070322.26627-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Acked-by: Vlastimil Babka Acked-by: David Rientjes Reviewed-by: Ralph Campbell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 15494520b776aa2eadc3e2fefae524764cab9cea Author: Qiujun Huang Date: Thu Jan 30 22:12:10 2020 -0800 mm: fix gup_pud_range sorry for not processing for a long time. I met it again. patch v1 https://lkml.org/lkml/2019/9/20/656 do_machine_check() do_memory_failure() memory_failure() hw_poison_user_mappings() try_to_unmap() pteval = swp_entry_to_pte(make_hwpoison_entry(subpage)); ...and now we have a swap entry that indicates that the page entry refers to a bad (and poisoned) page of memory, but gup_fast() at this level of the page table was ignoring swap entries, and incorrectly assuming that "!pxd_none() == valid and present". And this was not just a poisoned page problem, but a generaly swap entry problem. So, any swap entry type (device memory migration, numa migration, or just regular swapping) could lead to the same problem. Fix this by checking for pxd_present(), instead of pxd_none(). Link: http://lkml.kernel.org/r/1578479084-15508-1-git-send-email-hqjagain@gmail.com Signed-off-by: Qiujun Huang Cc: John Hubbard Cc: Aneesh Kumar K.V Cc: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ddf8f376d137ba41ca67347a0b80ba0c357a1018 Author: Ira Weiny Date: Thu Jan 30 22:12:07 2020 -0800 mm/filemap.c: clean up filemap_write_and_wait() At some point filemap_write_and_wait() and filemap_write_and_wait_range() got the exact same implementation with the exception of the range being specified in *_range() Similar to other functions in fs.h which call *_range(..., 0, LLONG_MAX), change filemap_write_and_wait() to be a static inline which calls filemap_write_and_wait_range() Link: http://lkml.kernel.org/r/20191129160713.30892-1-ira.weiny@intel.com Signed-off-by: Ira Weiny Reviewed-by: Nikolay Borisov Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b57b8f22709f07c0ab5921c94fd66e8c59c3e11 Author: Vlastimil Babka Date: Thu Jan 30 22:12:03 2020 -0800 mm/debug.c: always print flags in dump_page() Commit 76a1850e4572 ("mm/debug.c: __dump_page() prints an extra line") inadvertently removed printing of page flags for pages that are neither anon nor ksm nor have a mapping. Fix that. Using pr_cont() again would be a solution, but the commit explicitly removed its use. Avoiding the danger of mixing up split lines from multiple CPUs might be beneficial for near-panic dumps like this, so fix this without reintroducing pr_cont(). Link: http://lkml.kernel.org/r/9f884d5c-ca60-dc7b-219c-c081c755fab6@suse.cz Fixes: 76a1850e4572 ("mm/debug.c: __dump_page() prints an extra line") Signed-off-by: Vlastimil Babka Reported-by: Anshuman Khandual Reported-by: Michal Hocko Acked-by: Michal Hocko Cc: David Hildenbrand Cc: Qian Cai Cc: Oscar Salvador Cc: Mel Gorman Cc: Mike Rapoport Cc: Dan Williams Cc: Pavel Tatashin Cc: Ralph Campbell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8c96f1bc6fc49c724c4cdd22d3e99260263b7384 Author: He Zhe Date: Thu Jan 30 22:12:00 2020 -0800 mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t kmemleak_lock as a rwlock on RT can possibly be acquired in atomic context which does work. Since the kmemleak operation is performed in atomic context make it a raw_spinlock_t so it can also be acquired on RT. This is used for debugging and is not enabled by default in a production like environment (where performance/latency matters) so it makes sense to make it a raw_spinlock_t instead trying to get rid of the atomic context. Turn also the kmemleak_object->lock into raw_spinlock_t which is acquired (nested) while the kmemleak_lock is held. The time spent in "echo scan > kmemleak" slightly improved on 64core box with this patch applied after boot. [bigeasy@linutronix.de: redo the description, update comments. Merge the individual bits: He Zhe did the kmemleak_lock, Liu Haitao the ->lock and Yongxin Liu forwarded Liu's patch.] Link: http://lkml.kernel.org/r/20191219170834.4tah3prf2gdothz4@linutronix.de Link: https://lkml.kernel.org/r/20181218150744.GB20197@arrakis.emea.arm.com Link: https://lkml.kernel.org/r/1542877459-144382-1-git-send-email-zhe.he@windriver.com Link: https://lkml.kernel.org/r/20190927082230.34152-1-yongxin.liu@windriver.com Signed-off-by: He Zhe Signed-off-by: Liu Haitao Signed-off-by: Yongxin Liu Signed-off-by: Sebastian Andrzej Siewior Acked-by: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 90e9f6a66c78fdf3c2e5884ffe97bfc2736863c2 Author: Yu Zhao Date: Thu Jan 30 22:11:57 2020 -0800 mm/slub.c: avoid slub allocation while holding list_lock If we are already under list_lock, don't call kmalloc(). Otherwise we will run into a deadlock because kmalloc() also tries to grab the same lock. Fix the problem by using a static bitmap instead. WARNING: possible recursive locking detected -------------------------------------------- mount-encrypted/4921 is trying to acquire lock: (&(&n->list_lock)->rlock){-.-.}, at: ___slab_alloc+0x104/0x437 but task is already holding lock: (&(&n->list_lock)->rlock){-.-.}, at: __kmem_cache_shutdown+0x81/0x3cb other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&n->list_lock)->rlock); lock(&(&n->list_lock)->rlock); *** DEADLOCK *** Link: http://lkml.kernel.org/r/20191108193958.205102-2-yuzhao@google.com Signed-off-by: Yu Zhao Acked-by: Kirill A. Shutemov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Tetsuo Handa Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 25b69918d9f16c729193cc7c6f48f0b8991813f9 Author: wangyan Date: Thu Jan 30 22:11:53 2020 -0800 ocfs2: use ocfs2_update_inode_fsync_trans() to access t_tid in handle->h_transaction For the uniform format, we use ocfs2_update_inode_fsync_trans() to access t_tid in handle->h_transaction Link: http://lkml.kernel.org/r/6ff9a312-5f7d-0e27-fb51-bc4e062fcd97@huawei.com Signed-off-by: Yan Wang Reviewed-by: Jun Piao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Gang He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9f16ca48fc818a17de8be1f75d08e7f4addc4497 Author: wangyan Date: Thu Jan 30 22:11:50 2020 -0800 ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans() I found a NULL pointer dereference in ocfs2_update_inode_fsync_trans(), handle->h_transaction may be NULL in this situation: ocfs2_file_write_iter ->__generic_file_write_iter ->generic_perform_write ->ocfs2_write_begin ->ocfs2_write_begin_nolock ->ocfs2_write_cluster_by_desc ->ocfs2_write_cluster ->ocfs2_mark_extent_written ->ocfs2_change_extent_flag ->ocfs2_split_extent ->ocfs2_try_to_merge_extent ->ocfs2_extend_rotate_transaction ->ocfs2_extend_trans ->jbd2_journal_restart ->jbd2__journal_restart // handle->h_transaction is NULL here ->handle->h_transaction = NULL; ->start_this_handle /* journal aborted due to storage network disconnection, return error */ ->return -EROFS; /* line 3806 in ocfs2_try_to_merge_extent (), it will ignore ret error. */ ->ret = 0; ->... ->ocfs2_write_end ->ocfs2_write_end_nolock ->ocfs2_update_inode_fsync_trans // NULL pointer dereference ->oi->i_sync_tid = handle->h_transaction->t_tid; The information of NULL pointer dereference as follows: JBD2: Detected IO errors while flushing file data on dm-11-45 Aborting journal on device dm-11-45. JBD2: Error -5 detected when updating journal superblock for dm-11-45. (dd,22081,3):ocfs2_extend_trans:474 ERROR: status = -30 (dd,22081,3):ocfs2_try_to_merge_extent:3877 ERROR: status = -30 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Mem abort info: ESR = 0x96000004 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e74e1338 [0000000000000008] pgd=0000000000000000 Internal error: Oops: 96000004 [#1] SMP Process dd (pid: 22081, stack limit = 0x00000000584f35a9) CPU: 3 PID: 22081 Comm: dd Kdump: loaded Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 0.98 08/25/2019 pstate: 60400009 (nZCv daif +PAN -UAO) pc : ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2] lr : ocfs2_write_end_nolock+0x2a0/0x550 [ocfs2] sp : ffff0000459fba70 x29: ffff0000459fba70 x28: 0000000000000000 x27: ffff807ccf7f1000 x26: 0000000000000001 x25: ffff807bdff57970 x24: ffff807caf1d4000 x23: ffff807cc79e9000 x22: 0000000000001000 x21: 000000006c6cd000 x20: ffff0000091d9000 x19: ffff807ccb239db0 x18: ffffffffffffffff x17: 000000000000000e x16: 0000000000000007 x15: ffff807c5e15bd78 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000228 x8 : 000000000000000c x7 : 0000000000000fff x6 : ffff807a308ed6b0 x5 : ffff7e01f10967c0 x4 : 0000000000000018 x3 : d0bc661572445600 x2 : 0000000000000000 x1 : 000000001b2e0200 x0 : 0000000000000000 Call trace: ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2] ocfs2_write_end+0x4c/0x80 [ocfs2] generic_perform_write+0x108/0x1a8 __generic_file_write_iter+0x158/0x1c8 ocfs2_file_write_iter+0x668/0x950 [ocfs2] __vfs_write+0x11c/0x190 vfs_write+0xac/0x1c0 ksys_write+0x6c/0xd8 __arm64_sys_write+0x24/0x30 el0_svc_common+0x78/0x130 el0_svc_handler+0x38/0x78 el0_svc+0x8/0xc To prevent NULL pointer dereference in this situation, we use is_handle_aborted() before using handle->h_transaction->t_tid. Link: http://lkml.kernel.org/r/03e750ab-9ade-83aa-b000-b9e81e34e539@huawei.com Signed-off-by: Yan Wang Reviewed-by: Jun Piao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Gang He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd3e7cba16274831f5a69f071ed3cf13ffb352ea Author: Andy Shevchenko Date: Thu Jan 30 22:11:47 2020 -0800 ocfs2/dlm: move BITS_TO_BYTES() to bitops.h for wider use There are users already and will be more of BITS_TO_BYTES() macro. Move it to bitops.h for wider use. In the case of ocfs2 the replacement is identical. As for bnx2x, there are two places where floor version is used. In the first case to calculate the amount of structures that can fit one memory page. In this case obviously the ceiling variant is correct and original code might have a potential bug, if amount of bits % 8 is not 0. In the second case the macro is used to calculate bytes transmitted in one microsecond. This will work for all speeds which is multiply of 1Gbps without any change, for the rest new code will give ceiling value, for instance 100Mbps will give 13 bytes, while old code gives 12 bytes and the arithmetically correct one is 12.5 bytes. Further the value is used to setup timer threshold which in any case has its own margins due to certain resolution. I don't see here an issue with slightly shifting thresholds for low speed connections, the card is supposed to utilize highest available rate, which is usually 10Gbps. Link: http://lkml.kernel.org/r/20200108121316.22411-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Joseph Qi Acked-by: Sudarsana Reddy Kalluru Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d8f18750690367b6a636878e8725f78398fe0748 Author: Colin Ian King Date: Thu Jan 30 22:11:43 2020 -0800 ocfs2/dlm: remove redundant assignment to ret The variable ret is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses Coverity ("Unused value") Link: http://lkml.kernel.org/r/20191202164833.62865-1-colin.king@canonical.com Signed-off-by: Colin Ian King Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ca322fb6030956c2337fbf1c1beeb08c5dd5c943 Author: Masahiro Yamada Date: Thu Jan 30 22:11:40 2020 -0800 ocfs2: make local header paths relative to C files Gang He reports the failure of building fs/ocfs2/ as an external module of the kernel installed on the system: $ cd fs/ocfs2 $ make -C /lib/modules/`uname -r`/build M=`pwd` modules If you want to make it work reliably, I'd recommend to remove ccflags-y from the Makefiles, and to make header paths relative to the C files. I think this is the correct usage of the #include "..." directive. Link: http://lkml.kernel.org/r/20191227022950.14804-1-ghe@suse.com Signed-off-by: Masahiro Yamada Signed-off-by: Gang He Reported-by: Gang He Reviewed-by: Gang He Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b43d6453a944c207e6b518044561dbab1250a7f Author: zhengbin Date: Thu Jan 30 22:11:36 2020 -0800 ocfs2: remove unneeded semicolons Fixes coccicheck warnings: fs/ocfs2/cluster/quorum.c:76:2-3: Unneeded semicolon fs/ocfs2/dlmglue.c:573:2-3: Unneeded semicolon Link: http://lkml.kernel.org/r/6ee3aa16-9078-30b1-df3f-22064950bd98@linux.alibaba.com Signed-off-by: zhengbin Reported-by: Hulk Robot Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 67e2d2eb542338145a2e0b2336c1cdabd2424fd3 Author: Aditya Pakki Date: Thu Jan 30 22:11:33 2020 -0800 fs: ocfs: remove unnecessary assertion in dlm_migrate_lockres In the only caller of dlm_migrate_lockres() - dlm_empty_lockres(), target is checked for O2NM_MAX_NODES. Thus, the assertion in dlm_migrate_lockres() is unnecessary and can be removed. The patch eliminates such a check. Link: http://lkml.kernel.org/r/20191218194111.26041-1-pakki001@umn.edu Signed-off-by: Aditya Pakki Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4efc61c798cd7725a47ec1e9c2a2f755891dcaa3 Author: Luca Ceresoli Date: Thu Jan 30 22:11:30 2020 -0800 scripts/spelling.txt: add "issus" typo Add "issus" and correct it as "issues". Link: http://lkml.kernel.org/r/20200105221950.8384-1-luca@lucaceresoli.net Signed-off-by: Luca Ceresoli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2ab1278fe401af3cbb52c4492068b3cae2375959 Author: Xiong Date: Thu Jan 30 22:11:27 2020 -0800 scripts/spelling.txt: add more spellings to spelling.txt Here are some of the common spelling mistakes and typos that I've found while fixing up spelling mistakes in the kernel. Most of them still exist in more than two source files. Link: http://lkml.kernel.org/r/20191229143626.51238-1-xndchn@gmail.com Signed-off-by: Xiong Cc: Colin Ian King Cc: Stephen Boyd Cc: Paul Walmsley Cc: Chris Paterson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5984fabb6e82d9ab4e6305cb99694c85d46de8ae Author: Yang Shi Date: Thu Jan 30 22:11:24 2020 -0800 mm: move_pages: report the number of non-attempted pages Since commit a49bd4d71637 ("mm, numa: rework do_pages_move"), the semantic of move_pages() has changed to return the number of non-migrated pages if they were result of a non-fatal reasons (usually a busy page). This was an unintentional change that hasn't been noticed except for LTP tests which checked for the documented behavior. There are two ways to go around this change. We can even get back to the original behavior and return -EAGAIN whenever migrate_pages is not able to migrate pages due to non-fatal reasons. Another option would be to simply continue with the changed semantic and extend move_pages documentation to clarify that -errno is returned on an invalid input or when migration simply cannot succeed (e.g. -ENOMEM, -EBUSY) or the number of pages that couldn't have been migrated due to ephemeral reasons (e.g. page is pinned or locked for other reasons). This patch implements the second option because this behavior is in place for some time without anybody complaining and possibly new users depending on it. Also it allows to have a slightly easier error handling as the caller knows that it is worth to retry when err > 0. But since the new semantic would be aborted immediately if migration is failed due to ephemeral reasons, need include the number of non-attempted pages in the return value too. Link: http://lkml.kernel.org/r/1580160527-109104-1-git-send-email-yang.shi@linux.alibaba.com Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move") Signed-off-by: Yang Shi Suggested-by: Michal Hocko Acked-by: Michal Hocko Reviewed-by: Wei Yang Cc: [4.17+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fac0516b5534897bf4c4a88daa06a8cfa5611b23 Author: Wei Yang Date: Thu Jan 30 22:11:20 2020 -0800 mm: thp: don't need care deferred split queue in memcg charge move path If compound is true, this means it is a PMD mapped THP. Which implies the page is not linked to any defer list. So the first code chunk will not be executed. Also with this reason, it would not be proper to add this page to a defer list. So the second code chunk is not correct. Based on this, we should remove the defer list related code. [yang.shi@linux.alibaba.com: better patch title] Link: http://lkml.kernel.org/r/20200117233836.3434-1-richardw.yang@linux.intel.com Fixes: 87eaceb3faa5 ("mm: thp: make deferred split shrinker memcg aware") Signed-off-by: Wei Yang Suggested-by: Kirill A. Shutemov Acked-by: Yang Shi Cc: David Rientjes Cc: Michal Hocko Cc: Kirill A. Shutemov Cc: Johannes Weiner Cc: Vladimir Davydov Cc: [5.4+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1037ec0cc8ac1a450974ad9754e991f72884f48 Author: Dan Williams Date: Thu Jan 30 22:11:17 2020 -0800 mm/memory_hotplug: fix remove_memory() lockdep splat The daxctl unit test for the dax_kmem driver currently triggers the (false positive) lockdep splat below. It results from the fact that remove_memory_block_devices() is invoked under the mem_hotplug_lock() causing lockdep entanglements with cpu_hotplug_lock() and sysfs (kernfs active state tracking). It is a false positive because the sysfs attribute path triggering the memory remove is not the same attribute path associated with memory-block device. sysfs_break_active_protection() is not applicable since there is no real deadlock conflict, instead move memory-block device removal outside the lock. The mem_hotplug_lock() is not needed to synchronize the memory-block device removal vs the page online state, that is already handled by lock_device_hotplug(). Specifically, lock_device_hotplug() is sufficient to allow try_remove_memory() to check the offline state of the memblocks and be assured that any in progress online attempts are flushed / blocked by kernfs_drain() / attribute removal. The add_memory() path safely creates memblock devices under the mem_hotplug_lock(). There is no kernfs active state synchronization in the memblock device_register() path, so nothing to fix there. This change is only possible thanks to the recent change that refactored memory block device removal out of arch_remove_memory() (commit 4c4b7f9ba948 "mm/memory_hotplug: remove memory block devices before arch_remove_memory()"), and David's due diligence tracking down the guarantees afforded by kernfs_drain(). Not flagged for -stable since this only impacts ongoing development and lockdep validation, not a runtime issue. ====================================================== WARNING: possible circular locking dependency detected 5.5.0-rc3+ #230 Tainted: G OE ------------------------------------------------------ lt-daxctl/6459 is trying to acquire lock: ffff99c7f0003510 (kn->count#241){++++}, at: kernfs_remove_by_name_ns+0x41/0x80 but task is already holding lock: ffffffffa76a5450 (mem_hotplug_lock.rw_sem){++++}, at: percpu_down_write+0x20/0xe0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (mem_hotplug_lock.rw_sem){++++}: __lock_acquire+0x39c/0x790 lock_acquire+0xa2/0x1b0 get_online_mems+0x3e/0xb0 kmem_cache_create_usercopy+0x2e/0x260 kmem_cache_create+0x12/0x20 ptlock_cache_init+0x20/0x28 start_kernel+0x243/0x547 secondary_startup_64+0xb6/0xc0 -> #1 (cpu_hotplug_lock.rw_sem){++++}: __lock_acquire+0x39c/0x790 lock_acquire+0xa2/0x1b0 cpus_read_lock+0x3e/0xb0 online_pages+0x37/0x300 memory_subsys_online+0x17d/0x1c0 device_online+0x60/0x80 state_store+0x65/0xd0 kernfs_fop_write+0xcf/0x1c0 vfs_write+0xdb/0x1d0 ksys_write+0x65/0xe0 do_syscall_64+0x5c/0xa0 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (kn->count#241){++++}: check_prev_add+0x98/0xa40 validate_chain+0x576/0x860 __lock_acquire+0x39c/0x790 lock_acquire+0xa2/0x1b0 __kernfs_remove+0x25f/0x2e0 kernfs_remove_by_name_ns+0x41/0x80 remove_files.isra.0+0x30/0x70 sysfs_remove_group+0x3d/0x80 sysfs_remove_groups+0x29/0x40 device_remove_attrs+0x39/0x70 device_del+0x16a/0x3f0 device_unregister+0x16/0x60 remove_memory_block_devices+0x82/0xb0 try_remove_memory+0xb5/0x130 remove_memory+0x26/0x40 dev_dax_kmem_remove+0x44/0x6a [kmem] device_release_driver_internal+0xe4/0x1c0 unbind_store+0xef/0x120 kernfs_fop_write+0xcf/0x1c0 vfs_write+0xdb/0x1d0 ksys_write+0x65/0xe0 do_syscall_64+0x5c/0xa0 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: kn->count#241 --> cpu_hotplug_lock.rw_sem --> mem_hotplug_lock.rw_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(mem_hotplug_lock.rw_sem); lock(cpu_hotplug_lock.rw_sem); lock(mem_hotplug_lock.rw_sem); lock(kn->count#241); *** DEADLOCK *** No fixes tag as this has been a long standing issue that predated the addition of kernfs lockdep annotations. Link: http://lkml.kernel.org/r/157991441887.2763922.4770790047389427325.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: Vishal Verma Cc: Pavel Tatashin Cc: Dave Hansen Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dfe9aa23cab7880a794db9eb2d176c00ed064eb6 Author: Wei Yang Date: Thu Jan 30 22:11:14 2020 -0800 mm/migrate.c: also overwrite error when it is bigger than zero If we get here after successfully adding page to list, err would be 1 to indicate the page is queued in the list. Current code has two problems: * on success, 0 is not returned * on error, if add_page_for_migratioin() return 1, and the following err1 from do_move_pages_to_node() is set, the err1 is not returned since err is 1 And these behaviors break the user interface. Link: http://lkml.kernel.org/r/20200119065753.21694-1-richardw.yang@linux.intel.com Fixes: e0153fc2c760 ("mm: move_pages: return valid node id in status if the page is already on the target node"). Signed-off-by: Wei Yang Acked-by: Yang Shi Cc: John Hubbard Cc: Vlastimil Babka Cc: Christoph Lameter Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f503443e7df8dc8366608b4d810ce2d6669827c Author: Pingfan Liu Date: Thu Jan 30 22:11:10 2020 -0800 mm/sparse.c: reset section's mem_map when fully deactivated After commit ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug"), when a mem section is fully deactivated, section_mem_map still records the section's start pfn, which is not used any more and will be reassigned during re-addition. In analogy with alloc/free pattern, it is better to clear all fields of section_mem_map. Beside this, it breaks the user space tool "makedumpfile" [1], which makes assumption that a hot-removed section has mem_map as NULL, instead of checking directly against SECTION_MARKED_PRESENT bit. (makedumpfile will be better to change the assumption, and need a patch) The bug can be reproduced on IBM POWERVM by "drmgr -c mem -r -q 5" , trigger a crash, and save vmcore by makedumpfile [1]: makedumpfile, commit e73016540293 ("[v1.6.7] Update version") Link: http://lkml.kernel.org/r/1579487594-28889-1-git-send-email-kernelfans@gmail.com Signed-off-by: Pingfan Liu Acked-by: Michal Hocko Acked-by: David Hildenbrand Cc: Dan Williams Cc: Oscar Salvador Cc: Baoquan He Cc: Qian Cai Cc: Kazuhito Hagio Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c7a91bc7c2e17e0a9c8b9745a2cb118891218fd1 Author: Dan Carpenter Date: Thu Jan 30 22:11:07 2020 -0800 mm/mempolicy.c: fix out of bounds write in mpol_parse_str() What we are trying to do is change the '=' character to a NUL terminator and then at the end of the function we restore it back to an '='. The problem is there are two error paths where we jump to the end of the function before we have replaced the '=' with NUL. We end up putting the '=' in the wrong place (possibly one element before the start of the buffer). Link: http://lkml.kernel.org/r/20200115055426.vdjwvry44nfug7yy@kili.mountain Reported-by: syzbot+e64a13c5369a194d67df@syzkaller.appspotmail.com Fixes: 095f1fc4ebf3 ("mempolicy: rework shmem mpol parsing and display") Signed-off-by: Dan Carpenter Acked-by: Vlastimil Babka Dmitry Vyukov Cc: Michal Hocko Cc: Dan Carpenter Cc: Lee Schermerhorn Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68f23b89067fdf187763e75a56087550624fdbee Author: Theodore Ts'o Date: Thu Jan 30 22:11:04 2020 -0800 memcg: fix a crash in wb_workfn when a device disappears Without memcg, there is a one-to-one mapping between the bdi and bdi_writeback structures. In this world, things are fairly straightforward; the first thing bdi_unregister() does is to shutdown the bdi_writeback structure (or wb), and part of that writeback ensures that no other work queued against the wb, and that the wb is fully drained. With memcg, however, there is a one-to-many relationship between the bdi and bdi_writeback structures; that is, there are multiple wb objects which can all point to a single bdi. There is a refcount which prevents the bdi object from being released (and hence, unregistered). So in theory, the bdi_unregister() *should* only get called once its refcount goes to zero (bdi_put will drop the refcount, and when it is zero, release_bdi gets called, which calls bdi_unregister). Unfortunately, del_gendisk() in block/gen_hd.c never got the memo about the Brave New memcg World, and calls bdi_unregister directly. It does this without informing the file system, or the memcg code, or anything else. This causes the root wb associated with the bdi to be unregistered, but none of the memcg-specific wb's are shutdown. So when one of these wb's are woken up to do delayed work, they try to dereference their wb->bdi->dev to fetch the device name, but unfortunately bdi->dev is now NULL, thanks to the bdi_unregister() called by del_gendisk(). As a result, *boom*. Fortunately, it looks like the rest of the writeback path is perfectly happy with bdi->dev and bdi->owner being NULL, so the simplest fix is to create a bdi_dev_name() function which can handle bdi->dev being NULL. This also allows us to bulletproof the writeback tracepoints to prevent them from dereferencing a NULL pointer and crashing the kernel if one is tracing with memcg's enabled, and an iSCSI device dies or a USB storage stick is pulled. The most common way of triggering this will be hotremoval of a device while writeback with memcg enabled is going on. It was triggering several times a day in a heavily loaded production environment. Google Bug Id: 145475544 Link: https://lore.kernel.org/r/20191227194829.150110-1-tytso@mit.edu Link: http://lkml.kernel.org/r/20191228005211.163952-1-tytso@mit.edu Signed-off-by: Theodore Ts'o Cc: Chris Mason Cc: Tejun Heo Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 69334ca530da80c1563ac6a3bd32afa40884ccd3 Author: Andy Shevchenko Date: Thu Jan 30 22:11:01 2020 -0800 lib/test_bitmap: correct test data offsets for 32-bit On 32-bit platform the size of long is only 32 bits which makes wrong offset in the array of 64 bit size. Calculate offset based on BITS_PER_LONG. Link: http://lkml.kernel.org/r/20200109103601.45929-1-andriy.shevchenko@linux.intel.com Fixes: 30544ed5de43 ("lib/bitmap: introduce bitmap_replace() helper") Signed-off-by: Andy Shevchenko Reported-by: Guenter Roeck Cc: Rasmus Villemoes Cc: Yury Norov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d380dcde9a07ca5de4805dee11f58a98ec0ad6ff Author: Tom Zanussi Date: Wed Jan 29 21:18:18 2020 -0500 tracing: Fix now invalid var_ref_vals assumption in trace action The patch 'tracing: Fix histogram code when expression has same var as value' added code to return an existing variable reference when creating a new variable reference, which resulted in var_ref_vals slots being reused instead of being duplicated. The implementation of the trace action assumes that the end of the var_ref_vals array starting at action_data.var_ref_idx corresponds to the values that will be assigned to the trace params. The patch mentioned above invalidates that assumption, which means that each param needs to explicitly specify its index into var_ref_vals. This fix changes action_data.var_ref_idx to an array of var ref indexes to account for that. Link: https://lore.kernel.org/r/1580335695.6220.8.camel@kernel.org Fixes: 8bcebc77e85f ("tracing: Fix histogram code when expression has same var as value") Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit fdeb1aca2861472b38779be44141757483300827 Author: Tom Zanussi Date: Wed Jan 29 12:59:26 2020 -0600 tracing: Change trace_boot to use synth_event interface Have trace_boot_add_synth_event() use the synth_event interface. Also, rename synth_event_run_cmd() to synth_event_run_command() now that trace_boot's version is gone. Link: http://lkml.kernel.org/r/94f1fa0e31846d0bddca916b8663404b20559e34.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit dc2c733e65848b1df8d55c83eea79fc4a868c800 Author: Andy Shevchenko Date: Fri Jan 24 18:14:40 2020 +0200 kdb: Use for_each_console() helper Replace open coded single-linked list iteration loop with for_each_console() helper in use. Signed-off-by: Andy Shevchenko Signed-off-by: Daniel Thompson commit a4f8a7fb1963bc02fbd40a0a28e128bb56d2fcc9 Author: Colin Ian King Date: Thu Nov 28 13:07:53 2019 +0000 kdb: remove redundant assignment to pointer bp The point bp is assigned a value that is never read, it is being re-assigned later to bp = &kdb_breakpoints[lowbp] in a for-loop. Remove the redundant assignment. Addresses-Coverity ("Unused value") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20191128130753.181246-1-colin.king@canonical.com Signed-off-by: Daniel Thompson commit bbfceba15f8d1260c328a254efc2b3f2deae4904 Author: Douglas Anderson Date: Sat Nov 9 11:16:44 2019 -0800 kdb: Get rid of confusing diag msg from "rd" if current task has no regs If you switch to a sleeping task with the "pid" command and then type "rd", kdb tells you this: No current kdb registers. You may need to select another task diag: -17: Invalid register name The first message makes sense, but not the second. Fix it by just returning 0 after commands accessing the current registers finish if we've already printed the "No current kdb registers" error. While fixing kdb_rd(), change the function to use "if" rather than "ifdef". It cleans the function up a bit and any modern compiler will have no trouble handling still producing good code. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20191109111624.5.I121f4c6f0c19266200bf6ef003de78841e5bfc3d@changeid Signed-off-by: Daniel Thompson commit 9441d5f6b77770ee388884f04b14a99b028a15e6 Author: Douglas Anderson Date: Sat Nov 9 11:16:43 2019 -0800 kdb: Gid rid of implicit setting of the current task / regs Some (but not all?) of the kdb backtrace paths would cause the kdb_current_task and kdb_current_regs to remain changed. As discussed in a review of a previous patch [1], this doesn't seem intuitive, so let's fix that. ...but, it turns out that there's actually no longer any reason to set the current task / current regs while backtracing anymore anyway. As of commit 2277b492582d ("kdb: Fix stack crawling on 'running' CPUs that aren't the master") if we're backtracing on a task running on a CPU we ask that CPU to do the backtrace itself. Linux can do that without anything fancy. If we're doing backtrace on a sleeping task we can also do that fine without updating globals. So this patch mostly just turns into deleting a bunch of code. [1] https://lore.kernel.org/r/20191010150735.dhrj3pbjgmjrdpwr@holly.lan Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20191109111624.4.Ibc3d982bbeb9e46872d43973ba808cd4c79537c7@changeid Signed-off-by: Daniel Thompson commit a8649fb0a8c1de9c842c9c492f189cabbc468272 Author: Douglas Anderson Date: Sat Nov 9 11:16:42 2019 -0800 kdb: kdb_current_task shouldn't be exported The kdb_current_task variable has been declared in "kernel/debug/kdb/kdb_private.h" since 2010 when kdb was added to the mainline kernel. This is not a public header. There should be no reason that kdb_current_task should be exported and there are no in-kernel users that need it. Remove the export. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20191109111623.3.I14b22b5eb15ca8f3812ab33e96621231304dc1f7@changeid Signed-off-by: Daniel Thompson commit c67c10a67f6b2edcc7804317947cbfdeab71048c Author: Douglas Anderson Date: Sat Nov 9 11:16:41 2019 -0800 kdb: kdb_current_regs should be private As of the patch ("MIPS: kdb: Remove old workaround for backtracing on other CPUs") there is no reason for kdb_current_regs to be in the public "kdb.h". Let's move it next to kdb_current_task. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20191109111623.2.Iadbfb484e90b557cc4b5ac9890bfca732cd99d77@changeid Signed-off-by: Daniel Thompson commit b356e89b89cc950dc142e906c1ad5c2d4eb1fa13 Author: Douglas Anderson Date: Sat Nov 9 11:16:40 2019 -0800 MIPS: kdb: Remove old workaround for backtracing on other CPUs As of commit 2277b492582d ("kdb: Fix stack crawling on 'running' CPUs that aren't the master") we no longer need any special case for doing stack dumps on CPUs that are not the kdb master. Let's remove. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20191109111623.1.I30a0cac4d9880040c8d41495bd9a567fe3e24989@changeid Signed-off-by: Daniel Thompson commit e813e65038389b66d2f8dd87588694caf8dc2923 Merge: ccaaaf6fe5a5 4cbc418a44d5 Author: Linus Torvalds Date: Fri Jan 31 09:30:41 2020 -0800 Merge tag 'kvm-5.6-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "This is the first batch of KVM changes. ARM: - cleanups and corner case fixes. PPC: - Bugfixes x86: - Support for mapping DAX areas with large nested page table entries. - Cleanups and bugfixes here too. A particularly important one is a fix for FPU load when the thread has TIF_NEED_FPU_LOAD. There is also a race condition which could be used in guest userspace to exploit the guest kernel, for which the embargo expired today. - Fast path for IPI delivery vmexits, shaving about 200 clock cycles from IPI latency. - Protect against "Spectre-v1/L1TF" (bring data in the cache via speculative out of bound accesses, use L1TF on the sibling hyperthread to read it), which unfortunately is an even bigger whack-a-mole game than SpectreV1. Sean continues his mission to rewrite KVM. In addition to a sizable number of x86 patches, this time he contributed a pretty large refactoring of vCPU creation that affects all architectures but should not have any visible effect. s390 will come next week together with some more x86 patches" * tag 'kvm-5.6-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (204 commits) x86/KVM: Clean up host's steal time structure x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed x86/kvm: Cache gfn to pfn translation x86/kvm: Introduce kvm_(un)map_gfn() x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit KVM: PPC: Book3S PR: Fix -Werror=return-type build failure KVM: PPC: Book3S HV: Release lock on page-out failure path KVM: arm64: Treat emulated TVAL TimerValue as a signed 32-bit integer KVM: arm64: pmu: Only handle supported event counters KVM: arm64: pmu: Fix chained SW_INCR counters KVM: arm64: pmu: Don't mark a counter as chained if the odd one is disabled KVM: arm64: pmu: Don't increment SW_INCR if PMCR.E is unset KVM: x86: Use a typedef for fastop functions KVM: X86: Add 'else' to unify fastop and execute call path KVM: x86: inline memslot_valid_for_gpte KVM: x86/mmu: Use huge pages for DAX-backed files KVM: x86/mmu: Remove lpage_is_disallowed() check from set_spte() KVM: x86/mmu: Fold max_mapping_level() into kvm_mmu_hugepage_adjust() KVM: x86/mmu: Zap any compound page when collapsing sptes KVM: x86/mmu: Remove obsolete gfn restoration in FNAME(fetch) ... commit 91a7d4bf3ee3794d4090cedd17b8e865645f5f79 Author: Nathan Chancellor Date: Thu Jan 30 18:51:23 2020 -0700 mlxsw: spectrum_qdisc: Fix 64-bit division error in mlxsw_sp_qdisc_tbf_rate_kbps When building arm32 allmodconfig: ERROR: "__aeabi_uldivmod" [drivers/net/ethernet/mellanox/mlxsw/mlxsw_spectrum.ko] undefined! rate_bytes_ps has type u64, we need to use a 64-bit division helper to avoid a build error. Fixes: a44f58c41bfb ("mlxsw: spectrum_qdisc: Support offloading of TBF Qdisc") Signed-off-by: Nathan Chancellor Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit b5ce31b5e11b768b7d685b2bab7db09ad5549493 Author: Shannon Nelson Date: Thu Jan 30 10:07:06 2020 -0800 ionic: fix rxq comp packet type mask Be sure to include all the packet type bits in the mask. Fixes: fbfb8031533c ("ionic: Add hardware init and device commands") Signed-off-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit 2318ca8aef3877da2b16b92edce47a497370a86e Author: Michael Walle Date: Thu Jan 30 18:54:02 2020 +0100 net: phy: at803x: disable vddio regulator The probe() might enable a VDDIO regulator, which needs to be disabled again before calling regulator_put(). Add a remove() function. Fixes: 2f664823a470 ("net: phy: at803x: add device tree binding") Signed-off-by: Michael Walle Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 2e1bf3a76576eebc787d8882c3f91fa4ec743efc Author: Michael Walle Date: Thu Jan 30 18:44:51 2020 +0100 net: mii_timestamper: fix static allocation by PHY driver If phydev->mii_ts is set by the PHY driver, it will always be overwritten in of_mdiobus_register_phy(). Fix it. Also make sure, that the unregister() doesn't do anything if the mii_timestamper was provided by the PHY driver. Fixes: 1dca22b18421 ("net: mdio: of: Register discovered MII time stampers.") Signed-off-by: Michael Walle Acked-by: Richard Cochran Signed-off-by: Jakub Kicinski commit 0e0daf6ac3be70608569262246f6dc33cb3f45fe Author: Michael Walle Date: Thu Jan 30 18:44:50 2020 +0100 net: mdio: of: fix potential NULL pointer derefernce of_find_mii_timestamper() returns NULL if no timestamper is found. Therefore, guard the unregister_mii_timestamper() calls. Fixes: 1dca22b18421 ("net: mdio: of: Register discovered MII time stampers.") Signed-off-by: Michael Walle Acked-by: Richard Cochran Signed-off-by: Jakub Kicinski commit cb639a420e2e74dba5432e8ebcfb3559ce925148 Author: Takashi Iwai Date: Fri Jan 31 16:22:14 2020 +0100 ALSA: pcm: Fix sparse warnings wrt snd_pcm_state_t Since we have a bitwise definition of snd_pcm_state_t and use it for certain struct fields, a few new (and years old) sparse warnings came up. This patch is an attempt to cover them. - The state fields in snd_pcm_mmap_status* and co are all defined as snd_pcm_state_t type now - The PCM action callbacks take snd_pcm_state_t argument as well; some actions taking special values got the explicit cast and comments - For the PCM action that doesn't need an extra argument receives ACTION_ARG_IGNORE instead of ambiguous 0 While we're at it, the boolean argument is also properly changed to bool and true/false, as well as a slight refactoring of PCM pause helper function to make easier to read. No functional changes, just shutting up chatty sparse. Fixes: 46b770f720bd ("ALSA: uapi: Fix sparse warning") Reported-by: kbuild test robot Link: https://lore.kernel.org/r/20200131152214.11698-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9722b10148504c4153a74a9c89725af271e490fc Author: Filipe Manana Date: Wed Jan 29 17:09:53 2020 +0000 Btrfs: send, fix emission of invalid clone operations within the same file When doing an incremental send and a file has extents shared with itself at different file offsets, it's possible for send to emit clone operations that will fail at the destination because the source range goes beyond the file's current size. This happens when the file size has increased in the send snapshot, there is a hole between the shared extents and both shared extents are at file offsets which are greater the file's size in the parent snapshot. Example: $ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt/sdb $ xfs_io -f -c "pwrite -S 0xf1 0 64K" /mnt/sdb/foobar $ btrfs subvolume snapshot -r /mnt/sdb /mnt/sdb/base $ btrfs send -f /tmp/1.snap /mnt/sdb/base # Create a 320K extent at file offset 512K. $ xfs_io -c "pwrite -S 0xab 512K 64K" /mnt/sdb/foobar $ xfs_io -c "pwrite -S 0xcd 576K 64K" /mnt/sdb/foobar $ xfs_io -c "pwrite -S 0xef 640K 64K" /mnt/sdb/foobar $ xfs_io -c "pwrite -S 0x64 704K 64K" /mnt/sdb/foobar $ xfs_io -c "pwrite -S 0x73 768K 64K" /mnt/sdb/foobar # Clone part of that 320K extent into a lower file offset (192K). # This file offset is greater than the file's size in the parent # snapshot (64K). Also the clone range is a bit behind the offset of # the 320K extent so that we leave a hole between the shared extents. $ xfs_io -c "reflink /mnt/sdb/foobar 448K 192K 192K" /mnt/sdb/foobar $ btrfs subvolume snapshot -r /mnt/sdb /mnt/sdb/incr $ btrfs send -p /mnt/sdb/base -f /tmp/2.snap /mnt/sdb/incr $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt/sdc $ btrfs receive -f /tmp/1.snap /mnt/sdc $ btrfs receive -f /tmp/2.snap /mnt/sdc ERROR: failed to clone extents to foobar: Invalid argument The problem is that after processing the extent at file offset 256K, which refers to the first 128K of the 320K extent created by the buffered write operations, we have 'cur_inode_next_write_offset' set to 384K, which corresponds to the end offset of the partially shared extent (256K + 128K) and to the current file size in the receiver. Then when we process the extent at offset 512K, we do extent backreference iteration to figure out if we can clone the extent from some other inode or from the same inode, and we consider the extent at offset 256K of the same inode as a valid source for a clone operation, which is not correct because at that point the current file size in the receiver is 384K, which corresponds to the end of last processed extent (at file offset 256K), so using a clone source range from 256K to 256K + 320K is invalid because that goes past the current size of the file (384K) - this makes the receiver get an -EINVAL error when attempting the clone operation. So fix this by excluding clone sources that have a range that goes beyond the current file size in the receiver when iterating extent backreferences. A test case for fstests follows soon. Fixes: 11f2069c113e02 ("Btrfs: send, allow clone operations within the same file") CC: stable@vger.kernel.org # 5.5+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit f4b1363cae43fef7c86c993b7ca7fe7d546b3c68 Author: Josef Bacik Date: Tue Jan 21 14:34:52 2020 -0500 btrfs: do not do delalloc reservation under page lock We ran into a deadlock in production with the fixup worker. The stack traces were as follows: Thread responsible for the writeout, waiting on the page lock [<0>] io_schedule+0x12/0x40 [<0>] __lock_page+0x109/0x1e0 [<0>] extent_write_cache_pages+0x206/0x360 [<0>] extent_writepages+0x40/0x60 [<0>] do_writepages+0x31/0xb0 [<0>] __writeback_single_inode+0x3d/0x350 [<0>] writeback_sb_inodes+0x19d/0x3c0 [<0>] __writeback_inodes_wb+0x5d/0xb0 [<0>] wb_writeback+0x231/0x2c0 [<0>] wb_workfn+0x308/0x3c0 [<0>] process_one_work+0x1e0/0x390 [<0>] worker_thread+0x2b/0x3c0 [<0>] kthread+0x113/0x130 [<0>] ret_from_fork+0x35/0x40 [<0>] 0xffffffffffffffff Thread of the fixup worker who is holding the page lock [<0>] start_delalloc_inodes+0x241/0x2d0 [<0>] btrfs_start_delalloc_roots+0x179/0x230 [<0>] btrfs_alloc_data_chunk_ondemand+0x11b/0x2e0 [<0>] btrfs_check_data_free_space+0x53/0xa0 [<0>] btrfs_delalloc_reserve_space+0x20/0x70 [<0>] btrfs_writepage_fixup_worker+0x1fc/0x2a0 [<0>] normal_work_helper+0x11c/0x360 [<0>] process_one_work+0x1e0/0x390 [<0>] worker_thread+0x2b/0x3c0 [<0>] kthread+0x113/0x130 [<0>] ret_from_fork+0x35/0x40 [<0>] 0xffffffffffffffff Thankfully the stars have to align just right to hit this. First you have to end up in the fixup worker, which is tricky by itself (my reproducer does DIO reads into a MMAP'ed region, so not a common operation). Then you have to have less than a page size of free data space and 0 unallocated space so you go down the "commit the transaction to free up pinned space" path. This was accomplished by a random balance that was running on the host. Then you get this deadlock. I'm still in the process of trying to force the deadlock to happen on demand, but I've hit other issues. I can still trigger the fixup worker path itself so this patch has been tested in that regard, so the normal case is fine. Fixes: 87826df0ec36 ("btrfs: delalloc for page dirtied out-of-band in fixup worker") Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5ab580556994eea3e3a95a07b79384a7a96320a0 Author: Josef Bacik Date: Tue Jan 21 11:51:43 2020 -0500 btrfs: drop the -EBUSY case in __extent_writepage_io Now that we only return 0 or -EAGAIN from btrfs_writepage_cow_fixup, we do not need this -EBUSY case. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 25f3c5021985e885292980d04a1423fd83c967bb Author: Chris Mason Date: Tue Jan 21 11:51:42 2020 -0500 Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker For COW, btrfs expects pages dirty pages to have been through a few setup steps. This includes reserving space for the new block allocations and marking the range in the state tree for delayed allocation. A few places outside btrfs will dirty pages directly, especially when unmapping mmap'd pages. In order for these to properly go through COW, we run them through a fixup worker to wait for stable pages, and do the delalloc prep. 87826df0ec36 added a window where the dirty pages were cleaned, but pending more action from the fixup worker. We clear_page_dirty_for_io() before we call into writepage, so the page is no longer dirty. The commit changed it so now we leave the page clean between unlocking it here and the fixup worker starting at some point in the future. During this window, page migration can jump in and relocate the page. Once our fixup work actually starts, it finds page->mapping is NULL and we end up freeing the page without ever writing it. This leads to crc errors and other exciting problems, since it screws up the whole statemachine for waiting for ordered extents. The fix here is to keep the page dirty while we're waiting for the fixup worker to get to work. This is accomplished by returning -EAGAIN from btrfs_writepage_cow_fixup if we queued the page up for fixup, which will cause the writepage function to redirty the page. Because we now expect the page to be dirty once it gets to the fixup worker we must adjust the error cases to call clear_page_dirty_for_io() on the page. That is the bulk of the patch, but it is not the fix, the fix is the -EAGAIN from btrfs_writepage_cow_fixup. We cannot separate these two changes out because the error conditions change with the new expectations. Signed-off-by: Chris Mason Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit a30a3d2067536cbcce26c055e70cc3a6ae4fd45c Author: Josef Bacik Date: Fri Jan 17 09:07:39 2020 -0500 btrfs: take overcommit into account in inc_block_group_ro inc_block_group_ro does a calculation to see if we have enough room left over if we mark this block group as read only in order to see if it's ok to mark the block group as read only. The problem is this calculation _only_ works for data, where our used is always less than our total. For metadata we will overcommit, so this will almost always fail for metadata. Fix this by exporting btrfs_can_overcommit, and then see if we have enough space to remove the remaining free space in the block group we are trying to mark read only. If we do then we can mark this block group as read only. Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit a7a63acc6575ded6f48ab293e275e8b903325e54 Author: Josef Bacik Date: Fri Jan 17 09:07:38 2020 -0500 btrfs: fix force usage in inc_block_group_ro For some reason we've translated the do_chunk_alloc that goes into btrfs_inc_block_group_ro to force in inc_block_group_ro, but these are two different things. force for inc_block_group_ro is used when we are forcing the block group read only no matter what, for example when the underlying chunk is marked read only. We need to not do the space check here as this block group needs to be read only. btrfs_inc_block_group_ro() has a do_chunk_alloc flag that indicates that we need to pre-allocate a chunk before marking the block group read only. This has nothing to do with forcing, and in fact we _always_ want to do the space check in this case, so unconditionally pass false for force in this case. Then fixup inc_block_group_ro to honor force as it's expected and documented to do. Reviewed-by: Nikolay Borisov Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5750c37523a2c8cbb450b9ef31e21c2ba876b05e Author: Nikolay Borisov Date: Mon Jan 27 11:59:26 2020 +0200 btrfs: Correctly handle empty trees in find_first_clear_extent_bit Raviu reported that running his regular fs_trim segfaulted with the following backtrace: [ 237.525947] assertion failed: prev, in ../fs/btrfs/extent_io.c:1595 [ 237.525984] ------------[ cut here ]------------ [ 237.525985] kernel BUG at ../fs/btrfs/ctree.h:3117! [ 237.525992] invalid opcode: 0000 [#1] SMP PTI [ 237.525998] CPU: 4 PID: 4423 Comm: fstrim Tainted: G U OE 5.4.14-8-vanilla #1 [ 237.526001] Hardware name: ASUSTeK COMPUTER INC. [ 237.526044] RIP: 0010:assfail.constprop.58+0x18/0x1a [btrfs] [ 237.526079] Call Trace: [ 237.526120] find_first_clear_extent_bit+0x13d/0x150 [btrfs] [ 237.526148] btrfs_trim_fs+0x211/0x3f0 [btrfs] [ 237.526184] btrfs_ioctl_fitrim+0x103/0x170 [btrfs] [ 237.526219] btrfs_ioctl+0x129a/0x2ed0 [btrfs] [ 237.526227] ? filemap_map_pages+0x190/0x3d0 [ 237.526232] ? do_filp_open+0xaf/0x110 [ 237.526238] ? _copy_to_user+0x22/0x30 [ 237.526242] ? cp_new_stat+0x150/0x180 [ 237.526247] ? do_vfs_ioctl+0xa4/0x640 [ 237.526278] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs] [ 237.526283] do_vfs_ioctl+0xa4/0x640 [ 237.526288] ? __do_sys_newfstat+0x3c/0x60 [ 237.526292] ksys_ioctl+0x70/0x80 [ 237.526297] __x64_sys_ioctl+0x16/0x20 [ 237.526303] do_syscall_64+0x5a/0x1c0 [ 237.526310] entry_SYSCALL_64_after_hwframe+0x49/0xbe That was due to btrfs_fs_device::aloc_tree being empty. Initially I thought this wasn't possible and as a percaution have put the assert in find_first_clear_extent_bit. Turns out this is indeed possible and could happen when a file system with SINGLE data/metadata profile has a 2nd device added. Until balance is run or a new chunk is allocated on this device it will be completely empty. In this case find_first_clear_extent_bit should return the full range [0, -1ULL] and let the caller handle this i.e for trim the end will be capped at the size of actual device. Link: https://lore.kernel.org/linux-btrfs/izW2WNyvy1dEDweBICizKnd2KDwDiDyY2EYQr4YCwk7pkuIpthx-JRn65MPBde00ND6V0_Lh8mW0kZwzDiLDv25pUYWxkskWNJnVP0kgdMA=@protonmail.com/ Fixes: 45bfcfc168f8 ("btrfs: Implement find_first_clear_extent_bit") CC: stable@vger.kernel.org # 5.2+ Signed-off-by: Nikolay Borisov Signed-off-by: David Sterba commit 42ffb0bf584ae5b6b38f72259af1e0ee417ac77f Author: Josef Bacik Date: Thu Jan 23 15:33:02 2020 -0500 btrfs: flush write bio if we loop in extent_write_cache_pages There exists a deadlock with range_cyclic that has existed forever. If we loop around with a bio already built we could deadlock with a writer who has the page locked that we're attempting to write but is waiting on a page in our bio to be written out. The task traces are as follows PID: 1329874 TASK: ffff889ebcdf3800 CPU: 33 COMMAND: "kworker/u113:5" #0 [ffffc900297bb658] __schedule at ffffffff81a4c33f #1 [ffffc900297bb6e0] schedule at ffffffff81a4c6e3 #2 [ffffc900297bb6f8] io_schedule at ffffffff81a4ca42 #3 [ffffc900297bb708] __lock_page at ffffffff811f145b #4 [ffffc900297bb798] __process_pages_contig at ffffffff814bc502 #5 [ffffc900297bb8c8] lock_delalloc_pages at ffffffff814bc684 #6 [ffffc900297bb900] find_lock_delalloc_range at ffffffff814be9ff #7 [ffffc900297bb9a0] writepage_delalloc at ffffffff814bebd0 #8 [ffffc900297bba18] __extent_writepage at ffffffff814bfbf2 #9 [ffffc900297bba98] extent_write_cache_pages at ffffffff814bffbd PID: 2167901 TASK: ffff889dc6a59c00 CPU: 14 COMMAND: "aio-dio-invalid" #0 [ffffc9003b50bb18] __schedule at ffffffff81a4c33f #1 [ffffc9003b50bba0] schedule at ffffffff81a4c6e3 #2 [ffffc9003b50bbb8] io_schedule at ffffffff81a4ca42 #3 [ffffc9003b50bbc8] wait_on_page_bit at ffffffff811f24d6 #4 [ffffc9003b50bc60] prepare_pages at ffffffff814b05a7 #5 [ffffc9003b50bcd8] btrfs_buffered_write at ffffffff814b1359 #6 [ffffc9003b50bdb0] btrfs_file_write_iter at ffffffff814b5933 #7 [ffffc9003b50be38] new_sync_write at ffffffff8128f6a8 #8 [ffffc9003b50bec8] vfs_write at ffffffff81292b9d #9 [ffffc9003b50bf00] ksys_pwrite64 at ffffffff81293032 I used drgn to find the respective pages we were stuck on page_entry.page 0xffffea00fbfc7500 index 8148 bit 15 pid 2167901 page_entry.page 0xffffea00f9bb7400 index 7680 bit 0 pid 1329874 As you can see the kworker is waiting for bit 0 (PG_locked) on index 7680, and aio-dio-invalid is waiting for bit 15 (PG_writeback) on index 8148. aio-dio-invalid has 7680, and the kworker epd looks like the following crash> struct extent_page_data ffffc900297bbbb0 struct extent_page_data { bio = 0xffff889f747ed830, tree = 0xffff889eed6ba448, extent_locked = 0, sync_io = 0 } Probably worth mentioning as well that it waits for writeback of the page to complete while holding a lock on it (at prepare_pages()). Using drgn I walked the bio pages looking for page 0xffffea00fbfc7500 which is the one we're waiting for writeback on bio = Object(prog, 'struct bio', address=0xffff889f747ed830) for i in range(0, bio.bi_vcnt.value_()): bv = bio.bi_io_vec[i] if bv.bv_page.value_() == 0xffffea00fbfc7500: print("FOUND IT") which validated what I suspected. The fix for this is simple, flush the epd before we loop back around to the beginning of the file during writeout. Fixes: b293f02e1423 ("Btrfs: Add writepages support") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 7227ff4de55d931bbdc156c8ef0ce4f100c78a5b Author: Filipe Manana Date: Wed Jan 22 12:23:20 2020 +0000 Btrfs: fix race between adding and putting tree mod seq elements and nodes There is a race between adding and removing elements to the tree mod log list and rbtree that can lead to use-after-free problems. Consider the following example that explains how/why the problems happens: 1) Task A has mod log element with sequence number 200. It currently is the only element in the mod log list; 2) Task A calls btrfs_put_tree_mod_seq() because it no longer needs to access the tree mod log. When it enters the function, it initializes 'min_seq' to (u64)-1. Then it acquires the lock 'tree_mod_seq_lock' before checking if there are other elements in the mod seq list. Since the list it empty, 'min_seq' remains set to (u64)-1. Then it unlocks the lock 'tree_mod_seq_lock'; 3) Before task A acquires the lock 'tree_mod_log_lock', task B adds itself to the mod seq list through btrfs_get_tree_mod_seq() and gets a sequence number of 201; 4) Some other task, name it task C, modifies a btree and because there elements in the mod seq list, it adds a tree mod elem to the tree mod log rbtree. That node added to the mod log rbtree is assigned a sequence number of 202; 5) Task B, which is doing fiemap and resolving indirect back references, calls btrfs get_old_root(), with 'time_seq' == 201, which in turn calls tree_mod_log_search() - the search returns the mod log node from the rbtree with sequence number 202, created by task C; 6) Task A now acquires the lock 'tree_mod_log_lock', starts iterating the mod log rbtree and finds the node with sequence number 202. Since 202 is less than the previously computed 'min_seq', (u64)-1, it removes the node and frees it; 7) Task B still has a pointer to the node with sequence number 202, and it dereferences the pointer itself and through the call to __tree_mod_log_rewind(), resulting in a use-after-free problem. This issue can be triggered sporadically with the test case generic/561 from fstests, and it happens more frequently with a higher number of duperemove processes. When it happens to me, it either freezes the VM or it produces a trace like the following before crashing: [ 1245.321140] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [ 1245.321200] CPU: 1 PID: 26997 Comm: pool Not tainted 5.5.0-rc6-btrfs-next-52 #1 [ 1245.321235] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 [ 1245.321287] RIP: 0010:rb_next+0x16/0x50 [ 1245.321307] Code: .... [ 1245.321372] RSP: 0018:ffffa151c4d039b0 EFLAGS: 00010202 [ 1245.321388] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8ae221363c80 RCX: 6b6b6b6b6b6b6b6b [ 1245.321409] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8ae221363c80 [ 1245.321439] RBP: ffff8ae20fcc4688 R08: 0000000000000002 R09: 0000000000000000 [ 1245.321475] R10: ffff8ae20b120910 R11: 00000000243f8bb1 R12: 0000000000000038 [ 1245.321506] R13: ffff8ae221363c80 R14: 000000000000075f R15: ffff8ae223f762b8 [ 1245.321539] FS: 00007fdee1ec7700(0000) GS:ffff8ae236c80000(0000) knlGS:0000000000000000 [ 1245.321591] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1245.321614] CR2: 00007fded4030c48 CR3: 000000021da16003 CR4: 00000000003606e0 [ 1245.321642] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1245.321668] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1245.321706] Call Trace: [ 1245.321798] __tree_mod_log_rewind+0xbf/0x280 [btrfs] [ 1245.321841] btrfs_search_old_slot+0x105/0xd00 [btrfs] [ 1245.321877] resolve_indirect_refs+0x1eb/0xc60 [btrfs] [ 1245.321912] find_parent_nodes+0x3dc/0x11b0 [btrfs] [ 1245.321947] btrfs_check_shared+0x115/0x1c0 [btrfs] [ 1245.321980] ? extent_fiemap+0x59d/0x6d0 [btrfs] [ 1245.322029] extent_fiemap+0x59d/0x6d0 [btrfs] [ 1245.322066] do_vfs_ioctl+0x45a/0x750 [ 1245.322081] ksys_ioctl+0x70/0x80 [ 1245.322092] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1245.322113] __x64_sys_ioctl+0x16/0x20 [ 1245.322126] do_syscall_64+0x5c/0x280 [ 1245.322139] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1245.322155] RIP: 0033:0x7fdee3942dd7 [ 1245.322177] Code: .... [ 1245.322258] RSP: 002b:00007fdee1ec6c88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1245.322294] RAX: ffffffffffffffda RBX: 00007fded40210d8 RCX: 00007fdee3942dd7 [ 1245.322314] RDX: 00007fded40210d8 RSI: 00000000c020660b RDI: 0000000000000004 [ 1245.322337] RBP: 0000562aa89e7510 R08: 0000000000000000 R09: 00007fdee1ec6d44 [ 1245.322369] R10: 0000000000000073 R11: 0000000000000246 R12: 00007fdee1ec6d48 [ 1245.322390] R13: 00007fdee1ec6d40 R14: 00007fded40210d0 R15: 00007fdee1ec6d50 [ 1245.322423] Modules linked in: .... [ 1245.323443] ---[ end trace 01de1e9ec5dff3cd ]--- Fix this by ensuring that btrfs_put_tree_mod_seq() computes the minimum sequence number and iterates the rbtree while holding the lock 'tree_mod_log_lock' in write mode. Also get rid of the 'tree_mod_seq_lock' lock, since it is now redundant. Fixes: bd989ba359f2ac ("Btrfs: add tree modification log functions") Fixes: 097b8a7c9e48e2 ("Btrfs: join tree mod log code with the code holding back delayed refs") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Reviewed-by: Nikolay Borisov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b2ff728bae9b04b533fbc8de66f1719c4dc889de Author: Pierre Morel Date: Fri Jan 31 05:02:05 2020 -0500 selftests: KVM: testing the local IRQs resets Local IRQs are reset by a normal cpu reset. The initial cpu reset and the clear cpu reset, as superset of the normal reset, both clear the IRQs too. Let's inject an interrupt to a vCPU before calling a reset and see if it is gone after the reset. We choose to inject only an emergency interrupt at this point and can extend the test to other types of IRQs later. Signed-off-by: Pierre Morel Signed-off-by: Janosch Frank [minor fixups] Reviewed-by: Cornelia Huck Reviewed-by: Thomas Huth Link: https://lore.kernel.org/r/20200131100205.74720-7-frankja@linux.ibm.com Signed-off-by: Christian Borntraeger commit b25d4cb43f31e31c176eb862db2ad3072b496d44 Author: Janosch Frank Date: Fri Jan 31 05:02:04 2020 -0500 selftests: KVM: s390x: Add reset tests Test if the registers end up having the correct values after a normal, initial and clear reset. Signed-off-by: Janosch Frank Reviewed-by: Thomas Huth Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20200131100205.74720-6-frankja@linux.ibm.com Signed-off-by: Christian Borntraeger commit ada0a50d7685e35c1b8ee1deb9a38203acda6683 Author: Janosch Frank Date: Fri Jan 31 05:02:03 2020 -0500 selftests: KVM: Add fpu and one reg set/get library functions Add library access to more registers. Signed-off-by: Janosch Frank Reviewed-by: Thomas Huth Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20200131100205.74720-5-frankja@linux.ibm.com Signed-off-by: Christian Borntraeger commit 7de3f1423ff9431f3bd5023bb78d1e062314e7f0 Author: Janosch Frank Date: Fri Jan 31 05:02:02 2020 -0500 KVM: s390: Add new reset vcpu API The architecture states that we need to reset local IRQs for all CPU resets. Because the old reset interface did not support the normal CPU reset we never did that on a normal reset. Let's implement an interface for the missing normal and clear resets and reset all local IRQs, registers and control structures as stated in the architecture. Userspace might already reset the registers via the vcpu run struct, but as we need the interface for the interrupt clearing part anyway, we implement the resets fully and don't rely on userspace to reset the rest. Signed-off-by: Janosch Frank Reviewed-by: Cornelia Huck Reviewed-by: Christian Borntraeger Reviewed-by: Thomas Huth Link: https://lore.kernel.org/r/20200131100205.74720-4-frankja@linux.ibm.com Signed-off-by: Christian Borntraeger commit cca00ebb8ad3b3a5eb6e60b1ac7e9211f66af477 Author: Janosch Frank Date: Fri Jan 31 05:02:01 2020 -0500 KVM: s390: Cleanup initial cpu reset The code seems to be quite old and uses lots of unneeded spaces for alignment, which doesn't really help with readability. Let's: * Get rid of the extra spaces * Remove the ULs as they are not needed on 0s * Define constants for the CR 0 and 14 initial values * Use the sizeof of the gcr array to memset it to 0 Signed-off-by: Janosch Frank Reviewed-by: David Hildenbrand Reviewed-by: Cornelia Huck Reviewed-by: Thomas Huth Link: https://lore.kernel.org/r/20200131100205.74720-3-frankja@linux.ibm.com Signed-off-by: Christian Borntraeger commit 55680890ea78be0df5e1384989f1be835043c084 Author: Christian Borntraeger Date: Fri Jan 31 05:02:00 2020 -0500 KVM: s390: do not clobber registers during guest reset/store status The initial CPU reset clobbers the userspace fpc and the store status ioctl clobbers the guest acrs + fpr. As these calls are only done via ioctl (and not via vcpu_run), no CPU context is loaded, so we can (and must) act directly on the sync regs, not on the thread context. Cc: stable@kernel.org Fixes: e1788bb995be ("KVM: s390: handle floating point registers in the run ioctl not in vcpu_put/load") Fixes: 31d8b8d41a7e ("KVM: s390: handle access registers in the run ioctl not in vcpu_put/load") Signed-off-by: Christian Borntraeger Reviewed-by: David Hildenbrand Reviewed-by: Cornelia Huck Signed-off-by: Janosch Frank Link: https://lore.kernel.org/r/20200131100205.74720-2-frankja@linux.ibm.com Signed-off-by: Christian Borntraeger commit c611990844c28c61ca4b35ff69d3a2ae95ccd486 Author: Christian Borntraeger Date: Thu Dec 5 07:40:43 2019 -0500 KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups There is no ENOTSUPP for userspace. Reported-by: Julian Wiedmann Fixes: 519783935451 ("KVM: s390: introduce ais mode modify function") Fixes: 2c1a48f2e5ed ("KVM: S390: add new group for flic") Reviewed-by: Cornelia Huck Reviewed-by: Thomas Huth Signed-off-by: Christian Borntraeger commit 34b5a946a9543ce38d8ad1aacc4362533a813db7 Author: Krzysztof Kozlowski Date: Thu Jan 30 20:52:23 2020 +0100 powerpc: configs: Cleanup old Kconfig options CONFIG_ENABLE_WARN_DEPRECATED is gone since commit 771c035372a0 ("deprecate the '__deprecated' attribute warnings entirely and for good"). CONFIG_IOSCHED_DEADLINE and CONFIG_IOSCHED_CFQ are gone since commit f382fb0bcef4 ("block: remove legacy IO schedulers"). The IOSCHED_DEADLINE was replaced by MQ_IOSCHED_DEADLINE and it will be now enabled by default (along with MQ_IOSCHED_KYBER). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200130195223.3843-1-krzk@kernel.org commit 5e84dd547bce965c203cae71418cacb8592a0d3f Author: Michael Ellerman Date: Tue Jan 21 15:29:59 2020 +1100 powerpc/configs/skiroot: Enable some more hardening options Enable more hardening options. Note BUG_ON_DATA_CORRUPTION selects DEBUG_LIST and is essentially just a synonym for it. DEBUG_SG, DEBUG_NOTIFIERS, DEBUG_LIST, DEBUG_CREDENTIALS and SCHED_STACK_END_CHECK should all be low overhead and just add a few extra checks. SLAB_FREELIST_RANDOM, and SLUB_DEBUG_ON will add some overhead to the SLAB allocator, but nothing that should be meaningful for skiroot. Unselecting SLAB_MERGE_DEFAULT causes the SLAB to use more memory, but the skiroot kernel shouldn't be memory constrained on any of our systems, all it does is run a small bootloader. Disabling merging has some security/robustness benefit as it means a user-after-free or overflow will be limited to the objects in that slab, rather than potentially affecting objects from unrelated slabs that have been merged. Note also that slab merging is disabled anyway by enabling SLUB_DEBUG_ON, because of the SLAB_NEVER_MERGE mask. Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-9-mpe@ellerman.id.au commit 3554c12d835d16824afb0abaa6689bd89d26a009 Author: Michael Ellerman Date: Tue Jan 21 15:29:58 2020 +1100 powerpc/configs/skiroot: Disable xmon default & enable reboot on panic If the skiroot kernel crashes we don't want it sitting at an xmon prompt forever. Instead it's more helpful to reboot and bring the boot loader back up, and if the crash was transient we can then boot successfully. Similarly if we panic we should reboot, with a short timeout in case someone is watching the console. Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-8-mpe@ellerman.id.au commit 579baeece66ef9360da7d815fd328faf271a3008 Author: Joel Stanley Date: Tue Jan 21 15:29:57 2020 +1100 powerpc/configs/skiroot: Enable security features This turns on HARDENED_USERCOPY with HARDENED_USERCOPY_PAGESPAN, and FORTIFY_SOURCE. It also enables SECURITY_LOCKDOWN_LSM with _EARLY and LOCK_DOWN_KERNEL_FORCE_INTEGRITY options enabled. This still allows xmon to be used in read-only mode. MODULE_SIG is selected by lockdown, so it is still enabled. Because we're setting LOCK_DOWN_KERNELFORCE_INTEGRITY=y we also need to enable KEXEC_FILE=y so that kexec continues to work. Signed-off-by: Joel Stanley [mpe: Switch to lockdown integrity mode per oohal, enable KEXEC_FILE as reported by jms] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200121043000.16212-7-mpe@ellerman.id.au commit cdc7b23f1e90983cb5fb0c9a0a5e6e08b5d71563 Author: Michael Ellerman Date: Tue Jan 21 15:29:56 2020 +1100 powerpc/configs/skiroot: Update for symbol movement only Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-6-mpe@ellerman.id.au commit 81881e0998bcdf4dd151fa7162ad9f9fd00e0fe3 Author: Michael Ellerman Date: Tue Jan 21 15:29:55 2020 +1100 powerpc/configs/skiroot: Drop default n CONFIG_CRYPTO_ECHAINIV It's default n so we don't need to disable it. Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-5-mpe@ellerman.id.au commit 028fb6ded72f89b090a455656bb2ce091fbf996f Author: Michael Ellerman Date: Tue Jan 21 15:29:54 2020 +1100 powerpc/configs/skiroot: Drop HID_LOGITECH Commit bdd08fff4915 ("HID: logitech: Add depends on LEDS_CLASS to Logitech Kconfig entry") made HID_LOGITECH depend on LEDS_CLASS which we do not enable, meaning we are not actually enabling those drivers any more. The Kconfig help text suggests USB HID compliant Logictech devices will continue to work without HID_LOGITECH, so just drop it. Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-4-mpe@ellerman.id.au commit 7115bf789c4b907e4b82dc0a2965b4ee668c545d Author: Michael Ellerman Date: Tue Jan 21 15:29:53 2020 +1100 powerpc/configs: Drop NET_VENDOR_HP which moved to staging The HP network driver moved to staging in commit 52340b82cf1a ("hp100: Move 100BaseVG AnyLAN driver to staging") meaning we don't need to disable it any more in our defconfigs. Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-3-mpe@ellerman.id.au commit f3e96a71aaa9aa84fd40f93c417d3da917b8f13d Author: Michael Ellerman Date: Tue Jan 21 15:29:52 2020 +1100 powerpc/configs: NET_CADENCE became NET_VENDOR_CADENCE The NET_CADENCE symbol was renamed to NET_VENDOR_CADENCE, so we don't need to disable the former, see commit 0df5f81c481e ("net: ethernet: Add missing VENDOR to Cadence and Packet Engines symbols"). Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-2-mpe@ellerman.id.au commit 76e4bd93369b87d97c2b1bcd6e754a89f422235b Author: Michael Ellerman Date: Tue Jan 21 15:29:51 2020 +1100 powerpc/configs: Drop CONFIG_QLGE which moved to staging The QLGE driver moved to staging in commit 955315b0dc8c ("qlge: Move drivers/net/ethernet/qlogic/qlge/ to drivers/staging/qlge/"), meaning our defconfigs that enable it have no effect as we don't enable CONFIG_STAGING. It sounds like the device is obsolete, so drop the driver. Signed-off-by: Michael Ellerman Acked-by: Joel Stanley Link: https://lore.kernel.org/r/20200121043000.16212-1-mpe@ellerman.id.au commit e093e53f4f70b126ff63bc422e5135e934e35a1b Author: Nathan Chancellor Date: Wed Jan 29 18:41:30 2020 -0700 power: avs: qcom-cpr: Avoid clang -Wsometimes-uninitialized in cpr_scale Clang warns (trimmed for brevity): ../drivers/power/avs/qcom-cpr.c:570:13: warning: variable 'reg_mask' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] ../drivers/power/avs/qcom-cpr.c:520:13: warning: variable 'new_uV' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] Due to the fact that Clang's static analysis happens before any optimization passes are taken into account, it cannot see that both branches in the if statement must be taken because dir cannot be something other than UP or DOWN due to the check at the top of this function. Change the else if condition to else to fix this false positive. Fixes: bf6910abf548 ("power: avs: Add support for CPR (Core Power Reduction)") Link: https://github.com/ClangBuiltLinux/linux/issues/840 Signed-off-by: Nathan Chancellor Acked-by: Kevin Hilman Signed-off-by: Rafael J. Wysocki commit db5a10c172ed0d41aa4139ef9f1abd8128568267 Author: Brendan Higgins Date: Mon Jan 27 15:53:56 2020 -0800 power: avs: qcom-cpr: add unspecified HAS_IOMEM dependency Currently CONFIG_QCOM_CPR=y implicitly depends on CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get the following build error: /usr/bin/ld: drivers/power/avs/qcom-cpr.o: in function `cpr_probe': drivers/power/avs/qcom-cpr.c:1690: undefined reference to `devm_ioremap_resource' Fix the build error by adding the unspecified dependency. Signed-off-by: Brendan Higgins Signed-off-by: Rafael J. Wysocki commit adef0cedeaaee0a1a9495adb599806d3c0a8b31e Author: Heiko Stuebner Date: Tue Jan 21 23:28:59 2020 +0100 PM / AVS: rockchip-io: fix the supply naming for the emmc supply on px30 The supply going to the emmc/flash is named vccio6, not vccio0 and while the code does this correctly already, the comments and error output do not. So just change these values to the correct ones. Signed-off-by: Heiko Stuebner Signed-off-by: Rafael J. Wysocki commit 03b10951e9f6e6297d967a903c8d743b245ae3b8 Author: Niklas Cassel Date: Mon Jan 13 21:02:58 2020 +0100 power: avs: qcom-cpr: add a printout after the driver has been initialized In order to easier inform the user that the driver has been initialized successfully, add a printout after the driver has been initialized. At the same time, remove a dev_dbg() that is now redundant. Signed-off-by: Niklas Cassel Reviewed-by: Bjorn Andersson Signed-off-by: Rafael J. Wysocki commit 8c173d5e044d7e7fc9f6070c0fc1c79c0f8256a6 Author: Colin Ian King Date: Thu Jan 30 10:05:37 2020 +0000 thermal: stm32: fix spelling mistake "preprare" -> "prepare" There is a spelling mistake in a dev_err error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200130100537.18069-1-colin.king@canonical.com commit fe27f13d677ccd826386094df6977cfbc13ccf5e Author: Randy Dunlap Date: Mon Jan 20 14:33:16 2020 -0800 Documentation: cpu-idle-cooling: fix a SEVERE docs build failure Sphinx ('make htmldocs') stops with a SEVERE error: Sphinx parallel build error: SystemMessage: /home/rdunlap/lnx/next/linux-next-20200120/Documentation/driver-api/thermal/cpu-idle-cooling.rst:69: (SEVERE/4) Unexpected section title. ^ | so fix the .rst file so that the SEVERE build error does not happen. Also fix another minor formatting warning (unexpected unindent). Signed-off-by: Randy Dunlap Cc: Zhang Rui Cc: Daniel Lezcano Cc: Amit Kucheria Cc: linux-pm@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/712c1152-56b5-307f-b3f3-ed03a30b804a@infradead.org commit 82b2c6ffd399c9fcd542fd681bb8c6d41f035c7e Merge: 709bd70d070e 1e4f63aecb53 0552e05fdfea Author: Rafael J. Wysocki Date: Fri Jan 31 10:28:23 2020 +0100 Merge branches 'pm-cpufreq' and 'pm-core' * pm-cpufreq: cpufreq: Avoid creating excessively large stack frames * pm-core: PM: core: Fix handling of devices deleted during system-wide resume commit 43e76cd368fbb67e767da5363ffeaa3989993c8c Author: Alexandre Ghiti Date: Sat Jan 18 12:03:35 2020 -0500 powerpc: Do not consider weak unresolved symbol relocations as bad Commit 8580ac9404f6 ("bpf: Process in-kernel BTF") introduced two weak symbols that may be unresolved at link time which result in an absolute relocation to 0. relocs_check.sh emits the following warning: "WARNING: 2 bad relocations c000000001a41478 R_PPC64_ADDR64 _binary__btf_vmlinux_bin_start c000000001a41480 R_PPC64_ADDR64 _binary__btf_vmlinux_bin_end" whereas those relocations are legitimate even for a relocatable kernel compiled with -pie option. relocs_check.sh already excluded some weak unresolved symbols explicitly: remove those hardcoded symbols and add some logic that parses the symbols using nm, retrieves all the weak unresolved symbols and excludes those from the list of the potential bad relocations. Reported-by: Stephen Rothwell Signed-off-by: Alexandre Ghiti Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200118170335.21440-1-alex@ghiti.fr commit 85fc95d75970ee7dd8e01904e7fb1197c275ba6b Author: Cengiz Can Date: Mon Jan 20 17:15:54 2020 +0300 perf maps: Add missing unlock to maps__insert() error case `tools/perf/util/map.c` has a function named `maps__insert` that acquires a write lock if its in multithread context. Even though this lock is released when function successfully completes, there's a branch that is executed when `maps_by_name == NULL` that returns from this function without releasing the write lock. Added an `up_write` to release the lock when this happens. Fixes: a7c2b572e217 ("perf map_groups: Auto sort maps by name, if needed") Signed-off-by: Cengiz Can Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20200120141553.23934-1-cengiz@kernel.wtf Signed-off-by: Arnaldo Carvalho de Melo commit 1873f1547dde65c687de143938581347a9312207 Author: Thomas Richter Date: Mon Jan 20 14:20:10 2020 +0100 perf probe: Add ustring support for perf probe command Kernel commit 88903c464321 ("tracing/probe: Add ustring type for user-space string") adds support for user-space strings when type 'ustring' is specified. Here is an example using sysfs command line interface for kprobes: Function to probe: struct filename * getname_flags(const char __user *filename, int flags, int *empty) Setup: # cd /sys/kernel/debug/tracing/ # echo 'p:tmr1 getname_flags +0(%r2):ustring' > kprobe_events # cat events/kprobes/tmr1/format | fgrep print print fmt: "(%lx) arg1=\"%s\"", REC->__probe_ip, REC->arg1 # echo 1 > events/kprobes/tmr1/enable # touch /tmp/111 # echo 0 > events/kprobes/tmr1/enable # cat trace|fgrep /tmp/111 touch-5846 [005] d..2 255520.717960: tmr1:\ (getname_flags+0x0/0x400) arg1="/tmp/111" Doing the same with the perf tool fails. Using type 'string' succeeds: # perf probe "vfs_getname=getname_flags:72 pathname=filename:string" Added new event: probe:vfs_getname (on getname_flags:72 with pathname=filename:string) .... # perf probe -d probe:vfs_getname Removed event: probe:vfs_getname However using type 'ustring' fails (output before): # perf probe "vfs_getname=getname_flags:72 pathname=filename:ustring" Failed to write event: Invalid argument Error: Failed to add events. # Fix this by adding type 'ustring' in function convert_variable_type(). Using ustring succeeds (output after): # ./perf probe "vfs_getname=getname_flags:72 pathname=filename:ustring" Added new event: probe:vfs_getname (on getname_flags:72 with pathname=filename:ustring) You can now use it in all perf tools, such as: perf record -e probe:vfs_getname -aR sleep 1 # Note: This issue also exists on x86, it is not s390 specific. Signed-off-by: Thomas Richter Cc: Heiko Carstens Cc: Vasily Gorbik Cc: sumanthk@linux.ibm.com Link: http://lore.kernel.org/lkml/20200120132011.64698-2-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit b49f8e0e7bd17b968129790e40f9e2566f4f95ec Author: Raul E Rangel Date: Thu Nov 21 14:10:51 2019 -0700 i2c: cros-ec-tunnel: Fix ACPI identifier The initial patch was using the incorrect identifier. Fixes: 9af1563a5486 ("i2c: cros-ec-tunnel: Make the device acpi compatible") Signed-off-by: Raul E Rangel Acked-by: Enric Balletbo i Serra Signed-off-by: Wolfram Sang commit 8ff2d7ca4a55dfabf12e876369835bd024eb4621 Author: Akshu Agrawal Date: Thu Nov 21 14:36:17 2019 +0530 i2c: cros-ec-tunnel: Fix slave device enumeration During adding of the adapter the slave device registration use to fail as the acpi companion field was not populated. Fixes: 9af1563a5486 ("i2c: cros-ec-tunnel: Make the device acpi compatible") Signed-off-by: Akshu Agrawal Acked-by: Raul E Rangel Reviewed-by: Enric Balletbo i Serra Signed-off-by: Wolfram Sang commit b45f1b3b585e195a7daead16d914e164310b1df6 Merge: d47c7f062680 5379e4dd3220 Author: Dave Airlie Date: Fri Jan 31 15:18:21 2020 +1000 Merge branch 'ttm-prot-fix' of git://people.freedesktop.org/~thomash/linux into drm-next A small fix for the long-standing ttm vm page protection hack. Sent as a separate PR as it touches mm, has all acks in place. Signed-off-by: Dave Airlie From: Thomas Hellström (VMware) Link: https://patchwork.freedesktop.org/patch/msgid/20200116102411.3056-1-thomas_os@shipmail.org commit d5fae240b9bdb2d374624e6aa9f99a4527f111ec Author: Krzysztof Kozlowski Date: Thu Jan 30 20:25:20 2020 +0100 m68k: configs: Cleanup old Kconfig IO scheduler options CONFIG_IOSCHED_DEADLINE and CONFIG_IOSCHED_CFQ are gone since commit f382fb0bcef4 ("block: remove legacy IO schedulers"). The IOSCHED_DEADLINE was replaced by MQ_IOSCHED_DEADLINE and it will be now enabled by default (along with MQ_IOSCHED_KYBER). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Greg Ungerer commit a932872f1b76f287497da2f4501f4ea26622ad9e Author: Yangbo Lu Date: Mon Dec 16 18:01:11 2019 +0800 clk: qoriq: add ls1088a hwaccel clocks support This patch is to add hwaccel clocks information for ls1088a. Signed-off-by: Yangbo Lu Link: https://lkml.kernel.org/r/20191216100111.17122-1-yangbo.lu@nxp.com Signed-off-by: Stephen Boyd commit d37010a3c162f23e47a11a8f5946dbd974999c42 Author: Wen He Date: Fri Dec 13 16:34:02 2019 +0800 clk: ls1028a: Add clock driver for Display output interface Add clock driver for QorIQ LS1028A Display output interfaces(LCD, DPHY), as implemented in TSMC CLN28HPM PLL, this PLL supports the programmable integer division and range of the display output pixel clock's 27-594MHz. Signed-off-by: Wen He Signed-off-by: Michael Walle Link: https://lkml.kernel.org/r/20191213083402.35678-2-wen.he_1@nxp.com Signed-off-by: Stephen Boyd commit 87a5ffb34b475263c3f3d187f776d77178be8eb9 Author: Wen He Date: Fri Dec 13 16:34:01 2019 +0800 dt/bindings: clk: Add YAML schemas for LS1028A Display Clock bindings LS1028A has a clock domain PXLCLK0 used for provide pixel clocks to Display output interface. Add a YAML schema for this. Signed-off-by: Wen He Signed-off-by: Michael Walle Reviewed-by: Rob Herring Link: https://lkml.kernel.org/r/20191213083402.35678-1-wen.he_1@nxp.com Signed-off-by: Stephen Boyd commit 2577e373bbc07f18680287b3958d3b2fdebe4b20 Author: Yulia Kartseva Date: Thu Jan 30 15:13:10 2020 -0800 runqslower: Fix Makefile Fix undefined reference linker errors when building runqslower with gcc 7.4.0 on Ubuntu 18.04. The issue is with misplaced -lelf, -lz options in Makefile: $(Q)$(CC) $(CFLAGS) -lelf -lz $^ -o $@ -lelf, -lz options should follow the list of target dependencies: $(Q)$(CC) $(CFLAGS) $^ -lelf -lz -o $@ or after substitution cc -g -Wall runqslower.o libbpf.a -lelf -lz -o runqslower The current order of gcc params causes failure in libelf symbols resolution, e.g. undefined reference to `elf_memory' Fixes: 9c01546d26d2 ("tools/bpf: Add runqslower tool to tools/bpf") Signed-off-by: Julia Kartseva Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/908498f794661c44dca54da9e09dc0c382df6fcb.1580425879.git.hex@fb.com commit ccaaaf6fe5a5e1fffca5cca0f3fc4ec84d7ae752 Merge: 35c222fd3236 45fc24e89b7c Author: Linus Torvalds Date: Thu Jan 30 16:11:50 2020 -0800 Merge tag 'mpx-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-mpx Pull x86 MPX removal from Dave Hansen: "MPX requires recompiling applications, which requires compiler support. Unfortunately, GCC 9.1 is expected to be be released without support for MPX. This means that there was only a relatively small window where folks could have ever used MPX. It failed to gain wide adoption in the industry, and Linux was the only mainstream OS to ever support it widely. Support for the feature may also disappear on future processors. This set completes the process that we started during the 5.4 merge window when the MPX prctl()s were removed. XSAVE support is left in place, which allows MPX-using KVM guests to continue to function" * tag 'mpx-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-mpx: x86/mpx: remove MPX from arch/x86 mm: remove arch_bprm_mm_init() hook x86/mpx: remove bounds exception code x86/mpx: remove build infrastructure x86/alternatives: add missing insn.h include commit 079a8834bb6596d74eca5356b0d0ea0529d4f60d Author: Krzysztof Kozlowski Date: Thu Jan 30 20:21:29 2020 +0100 xtensa: configs: Cleanup old Kconfig IO scheduler options CONFIG_IOSCHED_DEADLINE and CONFIG_IOSCHED_CFQ are gone since commit f382fb0bcef4 ("block: remove legacy IO schedulers"). The IOSCHED_DEADLINE was replaced by MQ_IOSCHED_DEADLINE and it will be now enabled by default (along with MQ_IOSCHED_KYBER). Signed-off-by: Krzysztof Kozlowski Message-Id: <20200130192129.2677-1-krzk@kernel.org> Signed-off-by: Max Filippov commit 35c222fd323629cf2e834eb8aff77058856ffdda Merge: e84bcd61f686 4575243c5c17 Author: Linus Torvalds Date: Thu Jan 30 15:46:02 2020 -0800 Merge tag 'mtd/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD core - block2mtd: page index should use pgoff_t - maps: physmap: minimal Runtime PM support - maps: pcmciamtd: avoid possible sleep-in-atomic-context bugs - concat: Fix a comment referring to an unknown symbol Raw NAND: - Macronix: Use match_string() helper - Atmel: switch to using devm_fwnode_gpiod_get() - Denali: rework the SKIP_BYTES feature and add reset controlling - Brcmnand: set appropriate DMA mask - Cadence: add unspecified HAS_IOMEM dependency - Various cleanup. Onenand: - Rename Samsung and Omap2 drivers to avoid possible build warnings - Enable compile testing - Various build issues - Kconfig cleanup SPI-NAND: - Support for Toshiba TC58CVG2S0HRAIJ SPI-NOR: - Add support for TB selection using SR bit 6, - Add support for few flashes" * tag 'mtd/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (41 commits) mtd: concat: Fix a comment referring to an unknown symbol mtd: rawnand: add unspecified HAS_IOMEM dependency mtd: block2mtd: page index should use pgoff_t mtd: maps: physmap: Add minimal Runtime PM support mtd: maps: pcmciamtd: fix possible sleep-in-atomic-context bugs in pcmciamtd_set_vpp() mtd: onenand: Rename omap2 driver to avoid a build warning mtd: onenand: Use a better name for samsung driver mtd: rawnand: atmel: switch to using devm_fwnode_gpiod_get() mtd: spinand: add support for Toshiba TC58CVG2S0HRAIJ mtd: rawnand: macronix: Use match_string() helper to simplify the code mtd: sharpslpart: Fix unsigned comparison to zero mtd: onenand: Enable compile testing of OMAP and Samsung drivers mtd: onenand: samsung: Fix printing format for size_t on 64-bit mtd: onenand: samsung: Fix pointer cast -Wpointer-to-int-cast warnings on 64 bit mtd: rawnand: denali: remove hard-coded DENALI_DEFAULT_OOB_SKIP_BYTES mtd: rawnand: denali_dt: add reset controlling dt-bindings: mtd: denali_dt: document reset property mtd: rawnand: denali_dt: Add support for configuring SPARE_AREA_SKIP_BYTES mtd: rawnand: denali_dt: error out if platform has no associated data mtd: rawnand: brcmnand: Set appropriate DMA mask ... commit e84bcd61f686d65956c9f54872778bb215059519 Merge: 6e135baed8e7 5d3805af279c Author: Linus Torvalds Date: Thu Jan 30 15:44:12 2020 -0800 Merge tag 'upstream-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI/UBIFS updates from Miquel Raynal: "This pull request contains mostly fixes for UBI and UBIFS: UBI: - Fixes for memory leaks in error paths - Fix for an logic error in a fastmap selfcheck UBIFS: - Fix for FS_IOC_SETFLAGS related to fscrypt flag - Support for FS_ENCRYPT_FL - Fix for a dead lock in bulk-read mode" Sent on behalf of Richard Weinberger who is traveling. * tag 'upstream-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubi: Fix an error pointer dereference in error handling code ubifs: Fix memory leak from c->sup_node ubifs: Fix ino_t format warnings in orphan_delete() ubifs: Fix deadlock in concurrent bulk-read and writepage ubifs: Fix wrong memory allocation ubi: Free the normal volumes in error paths of ubi_attach_mtd_dev() ubi: Check the presence of volume before call ubi_fastmap_destroy_checkmap() ubifs: Add support for FS_ENCRYPT_FL ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag ubi: wl: Remove set but not used variable 'prev_e' ubi: fastmap: Fix inverted logic in seen selfcheck commit 6e135baed8e70b00b88f7608f6b041461a5270bc Merge: 0196be12aab2 80f2388afa6e Author: Linus Torvalds Date: Thu Jan 30 15:39:24 2020 -0800 Merge tag 'f2fs-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this series, we've implemented transparent compression experimentally. It supports LZO and LZ4, but will add more later as we investigate in the field more. At this point, the feature doesn't expose compressed space to user directly in order to guarantee potential data updates later to the space. Instead, the main goal is to reduce data writes to flash disk as much as possible, resulting in extending disk life time as well as relaxing IO congestion. Alternatively, we're also considering to add ioctl() to reclaim compressed space and show it to user after putting the immutable bit. Enhancements: - add compression support - avoid unnecessary locks in quota ops - harden power-cut scenario for zoned block devices - use private bio_set to avoid IO congestion - replace GC mutex with rwsem to serialize callers Bug fixes: - fix dentry consistency and memory corruption in rename()'s error case - fix wrong swap extent reports - fix casefolding bugs - change lock coverage to avoid deadlock - avoid GFP_KERNEL under f2fs_lock_op And, we've cleaned up sysfs entries to prepare no debugfs" * tag 'f2fs-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (31 commits) f2fs: fix race conditions in ->d_compare() and ->d_hash() f2fs: fix dcache lookup of !casefolded directories f2fs: Add f2fs stats to sysfs f2fs: delete duplicate information on sysfs nodes f2fs: change to use rwsem for gc_mutex f2fs: update f2fs document regarding to fsync_mode f2fs: add a way to turn off ipu bio cache f2fs: code cleanup for f2fs_statfs_project() f2fs: fix miscounted block limit in f2fs_statfs_project() f2fs: show the CP_PAUSE reason in checkpoint traces f2fs: fix deadlock allocating bio_post_read_ctx from mempool f2fs: remove unneeded check for error allocating bio_post_read_ctx f2fs: convert inline_dir early before starting rename f2fs: fix memleak of kobject f2fs: fix to add swap extent correctly f2fs: run fsck when getting bad inode during GC f2fs: support data compression f2fs: free sysfs kobject f2fs: declare nested quota_sem and remove unnecessary sems f2fs: don't put new_page twice in f2fs_rename ... commit 0196be12aab2dc3a3e44824045229b0e539be8fd Merge: 91f1a9566f38 154a4dcfc95f Author: Linus Torvalds Date: Thu Jan 30 15:37:41 2020 -0800 Merge tag 'for_v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF, quota, reiserfs, ext2 fixes and cleanups from Jan Kara: "A few assorted fixes and cleanups for udf, quota, reiserfs, and ext2" * tag 'for_v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs/reiserfs: remove unused macros fs/quota: remove unused macro udf: Clarify meaning of f_files in udf_statfs udf: Allow writing to 'Rewritable' partitions udf: Disallow R/W mode for disk with Metadata partition udf: Fix meaning of ENTITYID_FLAGS_* macros to be really bitwise-or flags udf: Fix free space reporting for metadata and virtual partitions udf: Update header files to UDF 2.60 udf: Move OSTA Identifier Suffix macros from ecma_167.h to osta_udf.h udf: Fix spelling in EXT_NEXT_EXTENT_ALLOCDESCS ext2: Adjust indentation in ext2_fill_super quota: avoid time_t in v1_disk_dqblk definition reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling reiserfs: Fix memory leak of journal device string ext2: set proper errno in error case of ext2_fill_super() commit 91f1a9566f387137f2da1957792a8f9f07cd058f Merge: e5da4c933c50 b3531f5fc16d Author: Linus Torvalds Date: Thu Jan 30 15:24:24 2020 -0800 Merge tag 'xfs-5.6-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "In this release we clean out the last of the old 32-bit timestamp code, fix a number of bugs and memory corruptions on 32-bit platforms, and a refactoring of some of the extended attribute code. I think I'll be back next week with some refactoring of how the XFS buffer code returns error codes, however I prefer to hold onto that for another week to let it soak a while longer Summary: - Get rid of compat_time_t - Convert time_t to time64_t in quota code - Remove shadow variables - Prevent ATTR_ flag misuse in the attrmulti ioctls - Clean out strlen in the attr code - Remove some bogus asserts - Fix various file size limit calculation errors with 32-bit kernels - Pack xfs_dir2_sf_entry_t to fix build errors on arm oabi - Fix nowait inode locking calls for directio aio reads - Fix memory corruption bugs when invalidating remote xattr value buffers - Streamline remote attr value removal - Make the buffer log format size consistent across platforms - Strengthen buffer log format size checking - Fix messed up return types of xfs_inode_need_cow - Fix some unused variable warnings" * tag 'xfs-5.6-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (24 commits) xfs: remove unused variable 'done' xfs: fix uninitialized variable in xfs_attr3_leaf_inactive xfs: change return value of xfs_inode_need_cow to int xfs: check log iovec size to make sure it's plausibly a buffer log format xfs: make struct xfs_buf_log_format have a consistent size xfs: complain if anyone tries to create a too-large buffer log item xfs: clean up xfs_buf_item_get_format return value xfs: streamline xfs_attr3_leaf_inactive xfs: fix memory corruption during remote attr value buffer invalidation xfs: refactor remote attr value buffer invalidation xfs: fix IOCB_NOWAIT handling in xfs_file_dio_aio_read xfs: Add __packed to xfs_dir2_sf_entry_t definition xfs: fix s_maxbytes computation on 32-bit kernels xfs: truncate should remove all blocks, not just to the end of the page cache xfs: introduce XFS_MAX_FILEOFF xfs: remove bogus assertion when online repair isn't enabled xfs: Remove all strlen in all xfs_attr_* functions for attr names. xfs: fix misuse of the XFS_ATTR_INCOMPLETE flag xfs: also remove cached ACLs when removing the underlying attr xfs: reject invalid flags combinations in XFS_IOC_ATTRMULTI_BY_HANDLE ... commit e5da4c933c50d98d7990a7c1ca0bbf8946e80c4a Merge: 9f68e3655aae 7f6225e446cc Author: Linus Torvalds Date: Thu Jan 30 15:17:05 2020 -0800 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "This merge window, we've added some performance improvements in how we handle inode locking in the read/write paths, and improving the performance of Direct I/O overwrites. We also now record the error code which caused the first and most recent ext4_error() report in the superblock, to make it easier to root cause problems in production systems. There are also many of the usual cleanups and miscellaneous bug fixes" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (49 commits) jbd2: clean __jbd2_journal_abort_hard() and __journal_abort_soft() jbd2: make sure ESHUTDOWN to be recorded in the journal superblock ext4, jbd2: ensure panic when aborting with zero errno jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record jbd2_seq_info_next should increase position index jbd2: remove pointless assertion in __journal_remove_journal_head ext4,jbd2: fix comment and code style jbd2: delete the duplicated words in the comments ext4: fix extent_status trace points ext4: fix symbolic enum printing in trace output ext4: choose hardlimit when softlimit is larger than hardlimit in ext4_statfs_project() ext4: fix race conditions in ->d_compare() and ->d_hash() ext4: make dioread_nolock the default ext4: fix extent_status fragmentation for plain files jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal ext4: drop ext4_kvmalloc() ext4: Add EXT4_IOC_FSGETXATTR/EXT4_IOC_FSSETXATTR to compat_ioctl ext4: remove unused macro MPAGE_DA_EXTENT_TAIL ext4: add missing braces in ext4_ext_drop_refs() ext4: fix some nonstandard indentation in extents.c ... commit e0d5322c29ef9f19a445c4960e9f89b4a85571bc Author: Alex Deucher Date: Sat Jan 25 11:30:25 2020 -0500 drm/amdgpu/navi10: add mclk to navi10_get_clock_by_type_with_latency Doesn't seem to be used, but add it just in case. Reviewed-by: Matt Coffin Signed-off-by: Alex Deucher commit 968162204adf5f2292214356978357e9dcd35de1 Author: Nathan Chancellor Date: Wed Jan 29 18:24:35 2020 -0700 drm/amdgpu: Fix implicit enum conversion in gfx_v9_4_ras_error_inject Clang warns: ../drivers/gpu/drm/amd/amdgpu/gfx_v9_4.c:967:35: warning: implicit conversion from enumeration type 'enum amdgpu_ras_block' to different enumeration type 'enum ta_ras_block' [-Wenum-conversion] block_info.block_id = info->head.block; ~ ~~~~~~~~~~~^~~~~ 1 warning generated. Use the function added in commit 828cfa29093f ("drm/amdgpu: Fix amdgpu ras to ta enums conversion") that handles this conversion explicitly. Fixes: 4c461d89db4f ("drm/amdgpu: add RAS support for the gfx block of Arcturus") Link: https://github.com/ClangBuiltLinux/linux/issues/849 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit eca31a4ac89bd5af26eccc6c32acbee396950b30 Author: Daniel Vetter Date: Wed Jan 29 09:09:05 2020 +0100 radeon: completely remove lut leftovers This is an oversight from commit 42585395ebc1034a98937702849669f17eadb35f Author: Peter Rosin Date: Thu Jul 13 18:25:36 2017 +0200 drm: radeon: remove dead code and pointless local lut storage v2: Also remove leftover local variable. Cc: Peter Rosin Cc: Alex Deucher Cc: Michel Dänzer Reviewed-by: Michel Dänzer Signed-off-by: Daniel Vetter Signed-off-by: Alex Deucher commit ded58c7bbbf3b52c018db99fd4d530c3448a0c83 Author: Zhan Liu Date: Tue Jan 28 16:38:53 2020 -0500 drm/amd/display: Move drm_dp_mst_atomic_check() to the front of dc_validate_global_state() [Why] Need to do atomic check first, then validate global state. If not, when connecting both MST and HDMI displays and set a bad mode via xrandr, system will hang. [How] Move drm_dp_mst_atomic_check() to the front of dc_validate_global_state(). Signed-off-by: Zhan Liu Reviewed-by: Mikita Lipski Signed-off-by: Alex Deucher commit ec3d65082d7dabad6fa8f66a8ef166f2d522d6b2 Author: Daniel Vetter Date: Tue Jan 28 17:09:52 2020 +0100 radeon: insert 10ms sleep in dce5_crtc_load_lut Per at least one tester this is enough magic to recover the regression introduced for some people (but not all) in commit b8e2b0199cc377617dc238f5106352c06dcd3fa2 Author: Peter Rosin Date: Tue Jul 4 12:36:57 2017 +0200 drm/fb-helper: factor out pseudo-palette which for radeon had the side-effect of refactoring out a seemingly redudant writing of the color palette. 10ms in a fairly slow modeset path feels like an acceptable form of duct-tape, so maybe worth a shot and see what sticks. Cc: Alex Deucher Cc: Michel Dänzer References: https://bugzilla.kernel.org/show_bug.cgi?id=198123 Signed-off-by: Daniel Vetter Signed-off-by: Alex Deucher commit 2a239597dfc65fb097a3d7ddcd01066745fea069 Author: Colin Ian King Date: Tue Jan 28 11:28:27 2020 +0000 drm/amd/display: fix spelling mistake link_integiry_check -> link_integrity_check There is a spelling mistake on the struct field name link_integiry_check, fix this by renaming it. Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 7044cb6c20776a1d546f08c332601bb6005388a2 Author: Stephen Rothwell Date: Tue Jan 28 15:42:27 2020 +1100 amdgpu: using vmalloc requires includeing vmalloc.h Fixes: 240c811ccde4 ("drm/amdgpu: fix VRAM partially encroached issue in GDDR6 memory training(V2)") Signed-off-by: Stephen Rothwell Signed-off-by: Alex Deucher commit 977f7e1068be60f3cac7d80ab18692341f3b7fc5 Author: Nirmoy Das Date: Tue Jan 21 15:53:53 2020 +0100 drm/amdgpu: allocate entities on demand Currently we pre-allocate entities and fences for all the HW IPs on context creation and some of which are might never be used. This patch tries to resolve entity/fences wastage by creating entity only when needed. v2: allocate memory for entity and fences together Signed-off-by: Nirmoy Das Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 18c6b74e7cfc9a599917d9e98f9835de8208e19a Author: Joseph Greathouse Date: Mon Jan 27 16:08:11 2020 -0600 drm/amdgpu: Enable DISABLE_BARRIER_WAITCNT for Arcturus In previous gfx9 parts, S_BARRIER shader instructions are implicitly S_WAITCNT 0 instructions as well. This setting turns off that mechanism in Arcturus and beyond. With this, shaders must follow the ISA guide insofar as putting in explicit S_WAITCNT operations even after an S_BARRIER. v2: Fix patch title to list component Signed-off-by: Joseph Greathouse Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 8ccb5bf7619c6523e7a4384a84b72e7be804298c Author: José Roberto de Souza Date: Wed Jan 29 15:24:48 2020 -0800 drm/mst: Fix possible NULL pointer dereference in drm_dp_mst_process_up_req() According to DP specification, DP_SINK_EVENT_NOTIFY is also a broadcast message but as this function only handles DP_CONNECTION_STATUS_NOTIFY I will only make the static analyzer that caught this issue happy by not calling drm_dp_get_mst_branch_device_by_guid() with a NULL guid, causing drm_dp_mst_process_up_req() to return in the "if (!mstb)" right bellow. Fixes: 9408cc94eb04 ("drm/dp_mst: Handle UP requests asynchronously") Cc: Lyude Paul Cc: Sean Paul Cc: # v5.5+ Signed-off-by: José Roberto de Souza [added cc to stable] Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200129232448.84704-1-jose.souza@intel.com commit 04d36d748fac349b068ef621611f454010054c58 Author: David Howells Date: Thu Jan 30 21:50:36 2020 +0000 rxrpc: Fix missing active use pinning of rxrpc_local object The introduction of a split between the reference count on rxrpc_local objects and the usage count didn't quite go far enough. A number of kernel work items need to make use of the socket to perform transmission. These also need to get an active count on the local object to prevent the socket from being closed. Fix this by getting the active count in those places. Also split out the raw active count get/put functions as these places tend to hold refs on the rxrpc_local object already, so getting and putting an extra object ref is just a waste of time. The problem can lead to symptoms like: BUG: kernel NULL pointer dereference, address: 0000000000000018 .. CPU: 2 PID: 818 Comm: kworker/u9:0 Not tainted 5.5.0-fscache+ #51 ... RIP: 0010:selinux_socket_sendmsg+0x5/0x13 ... Call Trace: security_socket_sendmsg+0x2c/0x3e sock_sendmsg+0x1a/0x46 rxrpc_send_keepalive+0x131/0x1ae rxrpc_peer_keepalive_worker+0x219/0x34b process_one_work+0x18e/0x271 worker_thread+0x1a3/0x247 kthread+0xe6/0xeb ret_from_fork+0x1f/0x30 Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting") Signed-off-by: David Howells commit f71dbf2fb28489a79bde0dca1c8adfb9cdb20a6b Author: David Howells Date: Thu Jan 30 21:50:36 2020 +0000 rxrpc: Fix insufficient receive notification generation In rxrpc_input_data(), rxrpc_notify_socket() is called if the base sequence number of the packet is immediately following the hard-ack point at the end of the function. However, this isn't sufficient, since the recvmsg side may have been advancing the window and then overrun the position in which we're adding - at which point rx_hard_ack >= seq0 and no notification is generated. Fix this by always generating a notification at the end of the input function. Without this, a long call may stall, possibly indefinitely. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells commit fac20b9e738523fc884ee3ea5be360a321cd8bad Author: David Howells Date: Thu Jan 30 21:50:35 2020 +0000 rxrpc: Fix use-after-free in rxrpc_put_local() Fix rxrpc_put_local() to not access local->debug_id after calling atomic_dec_return() as, unless that returned n==0, we no longer have the right to access the object. Fixes: 06d9532fa6b3 ("rxrpc: Fix read-after-free in rxrpc_queue_local()") Signed-off-by: David Howells commit c54849ddd832ae0a45cab16bcd1ed2db7da090d7 Author: Ronnie Sahlberg Date: Fri Jan 31 05:52:51 2020 +1000 cifs: fix soft mounts hanging in the reconnect code RHBZ: 1795429 In recent DFS updates we have a new variable controlling how many times we will retry to reconnect the share. If DFS is not used, then this variable is initialized to 0 in: static inline int dfs_cache_get_nr_tgts(const struct dfs_cache_tgt_list *tl) { return tl ? tl->tl_numtgts : 0; } This means that in the reconnect loop in smb2_reconnect() we will immediately wrap retries to -1 and never actually get to pass this conditional: if (--retries) continue; The effect is that we no longer reach the point where we fail the commands with -EHOSTDOWN and basically the kernel threads are virtually hung and unkillable. Fixes: a3a53b7603798fd8 (cifs: Add support for failover in smb2_reconnect()) Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Paulo Alcantara (SUSE) CC: Stable commit 8889f6fa35884d09f24734e10fea0c9ddcbc6429 Author: Jason Gunthorpe Date: Thu Jan 30 11:21:21 2020 -0400 RDMA/core: Make the entire API tree static Compilation of mlx5 driver without CONFIG_INFINIBAND_USER_ACCESS generates the following error. on x86_64: ld: drivers/infiniband/hw/mlx5/main.o: in function `mlx5_ib_handler_MLX5_IB_METHOD_VAR_OBJ_ALLOC': main.c:(.text+0x186d): undefined reference to `ib_uverbs_get_ucontext_file' ld: drivers/infiniband/hw/mlx5/main.o:(.rodata+0x2480): undefined reference to `uverbs_idr_class' ld: drivers/infiniband/hw/mlx5/main.o:(.rodata+0x24d8): undefined reference to `uverbs_destroy_def_handler' This is happening because some parts of the UAPI description are not static. This is a hold over from earlier code that relied on struct pointers to refer to object types, now object types are referenced by number. Remove the unused globals and add statics to the remaining UAPI description elements. Remove the redundent #ifdefs around mlx5_ib_*defs and obsolete mlx5_ib_get_devx_tree(). The compiler now trims alot more unused code, including the above problematic definitions when !CONFIG_INFINIBAND_USER_ACCESS. Fixes: 7be76bef320b ("IB/mlx5: Introduce VAR object and its alloc/destroy methods") Reported-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Jason Gunthorpe commit d7f62e825fd19202a0749d10fb439714c51f67d2 Author: Stefan Metzmacher Date: Wed Jan 29 14:39:41 2020 +0100 io_uring: add BUILD_BUG_ON() to assert the layout of struct io_uring_sqe With nesting of anonymous unions and structs it's hard to review layout changes. It's better to ask the compiler for these things. Signed-off-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit 87ce955b24c9940cb2ca7e5173fcf175578d9fe9 Author: Jens Axboe Date: Thu Jan 30 08:25:34 2020 -0700 io_uring: add ->show_fdinfo() for the io_uring file descriptor It can be hard to know exactly what is registered with the ring. Especially for credentials, it'd be handy to be able to see which ones are registered, what personalities they have, and what the ID of each of them is. This adds support for showing information registered in the ring from the fdinfo of the io_uring fd. Here's an example from a test case that registers 4 files (two of them sparse), 4 buffers, and 2 personalities: pos: 0 flags: 02000002 mnt_id: 14 UserFiles: 4 0: file-no-1 1: file-no-2 2: 3: UserBufs: 4 0: 0x563817c46000/128 1: 0x563817c47000/256 2: 0x563817c48000/512 3: 0x563817c49000/1024 Personalities: 1 Uid: 0 0 0 0 Gid: 0 0 0 0 Groups: 0 CapEff: 0000003fffffffff 2 Uid: 0 0 0 0 Gid: 0 0 0 0 Groups: 0 CapEff: 0000003fffffffff Suggested-by: Jann Horn Signed-off-by: Jens Axboe commit 4cbc418a44d5067133271bb6eeac2382f2bf94f7 Merge: 1d5920c306f1 a6bd811f1209 Author: Paolo Bonzini Date: Thu Jan 30 18:47:38 2020 +0100 Merge branch 'cve-2019-3016' into kvm-next-5.6 From Boris Ostrovsky: The KVM hypervisor may provide a guest with ability to defer remote TLB flush when the remote VCPU is not running. When this feature is used, the TLB flush will happen only when the remote VPCU is scheduled to run again. This will avoid unnecessary (and expensive) IPIs. Under certain circumstances, when a guest initiates such deferred action, the hypervisor may miss the request. It is also possible that the guest may mistakenly assume that it has already marked remote VCPU as needing a flush when in fact that request had already been processed by the hypervisor. In both cases this will result in an invalid translation being present in a vCPU, potentially allowing accesses to memory locations in that guest's address space that should not be accessible. Note that only intra-guest memory is vulnerable. The five patches address both of these problems: 1. The first patch makes sure the hypervisor doesn't accidentally clear a guest's remote flush request 2. The rest of the patches prevent the race between hypervisor acknowledging a remote flush request and guest issuing a new one. Conflicts: arch/x86/kvm/x86.c [move from kvm_arch_vcpu_free to kvm_arch_vcpu_destroy] commit a6bd811f1209fe1c64c9f6fd578101d6436c6b6e Author: Boris Ostrovsky Date: Fri Dec 6 15:36:12 2019 +0000 x86/KVM: Clean up host's steal time structure Now that we are mapping kvm_steal_time from the guest directly we don't need keep a copy of it in kvm_vcpu_arch.st. The same is true for the stime field. This is part of CVE-2019-3016. Signed-off-by: Boris Ostrovsky Reviewed-by: Joao Martins Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit b043138246a41064527cf019a3d51d9f015e9796 Author: Boris Ostrovsky Date: Thu Dec 5 03:45:32 2019 +0000 x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed There is a potential race in record_steal_time() between setting host-local vcpu->arch.st.steal.preempted to zero (i.e. clearing KVM_VCPU_PREEMPTED) and propagating this value to the guest with kvm_write_guest_cached(). Between those two events the guest may still see KVM_VCPU_PREEMPTED in its copy of kvm_steal_time, set KVM_VCPU_FLUSH_TLB and assume that hypervisor will do the right thing. Which it won't. Instad of copying, we should map kvm_steal_time and that will guarantee atomicity of accesses to @preempted. This is part of CVE-2019-3016. Signed-off-by: Boris Ostrovsky Reviewed-by: Joao Martins Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 917248144db5d7320655dbb41d3af0b8a0f3d589 Author: Boris Ostrovsky Date: Thu Dec 5 01:30:51 2019 +0000 x86/kvm: Cache gfn to pfn translation __kvm_map_gfn()'s call to gfn_to_pfn_memslot() is * relatively expensive * in certain cases (such as when done from atomic context) cannot be called Stashing gfn-to-pfn mapping should help with both cases. This is part of CVE-2019-3016. Signed-off-by: Boris Ostrovsky Reviewed-by: Joao Martins Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 1eff70a9abd46f175defafd29bc17ad456f398a7 Author: Boris Ostrovsky Date: Tue Nov 12 16:35:06 2019 +0000 x86/kvm: Introduce kvm_(un)map_gfn() kvm_vcpu_(un)map operates on gfns from any current address space. In certain cases we want to make sure we are not mapping SMRAM and for that we can use kvm_(un)map_gfn() that we are introducing in this patch. This is part of CVE-2019-3016. Signed-off-by: Boris Ostrovsky Reviewed-by: Joao Martins Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 8c6de56a42e0c657955e12b882a81ef07d1d073e Author: Boris Ostrovsky Date: Wed Oct 30 19:01:31 2019 +0000 x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit kvm_steal_time_set_preempted() may accidentally clear KVM_VCPU_FLUSH_TLB bit if it is called more than once while VCPU is preempted. This is part of CVE-2019-3016. (This bug was also independently discovered by Jim Mattson ) Signed-off-by: Boris Ostrovsky Reviewed-by: Joao Martins Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 1d5920c306f11db2c9e517f12843216b58c15046 Merge: 621ab20c06e0 fd24a8624eb2 Author: Paolo Bonzini Date: Thu Jan 30 18:14:26 2020 +0100 Merge tag 'kvm-ppc-next-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD Second KVM PPC update for 5.6 * Fix compile warning on 32-bit machines * Fix locking error in secure VM support commit 621ab20c06e0c0b45eb2382c048a0426bbff9b0e Merge: 3009afc6e39e 4a267aa70795 Author: Paolo Bonzini Date: Thu Jan 30 18:13:14 2020 +0100 Merge tag 'kvmarm-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm updates for Linux 5.6 - Fix MMIO sign extension - Fix HYP VA tagging on tag space exhaustion - Fix PSTATE/CPSR handling when generating exception - Fix MMU notifier's advertizing of young pages - Fix poisoned page handling - Fix PMU SW event handling - Fix TVAL register access - Fix AArch32 external abort injection - Fix ITS unmapped collection handling - Various cleanups commit 0cd9d33ace336bc424fc30944aa3defd6786e4fe Author: Tejun Heo Date: Thu Jan 30 11:37:33 2020 -0500 cgroup: init_tasks shouldn't be linked to the root cgroup 5153faac18d2 ("cgroup: remove cgroup_enable_task_cg_lists() optimization") removed lazy initialization of css_sets so that new tasks are always lniked to its css_set. In the process, it incorrectly ended up adding init_tasks to root css_set. They show up as PID 0's in root's cgroup.procs triggering warnings in systemd and generally confusing people. Fix it by skip css_set linking for init_tasks. Signed-off-by: Tejun Heo Reported-by: https://github.com/joanbm Link: https://github.com/systemd/systemd/issues/14682 Fixes: 5153faac18d2 ("cgroup: remove cgroup_enable_task_cg_lists() optimization") Cc: stable@vger.kernel.org # v5.5+ commit 9f68e3655aae6d49d6ba05dd263f99f33c2567af Merge: 4cadc60d6bcf d47c7f062680 Author: Linus Torvalds Date: Thu Jan 30 08:04:01 2020 -0800 Merge tag 'drm-next-2020-01-30' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Davbe Airlie: "This is the main pull request for graphics for 5.6. Usual selection of changes all over. I've got one outstanding vmwgfx pull that touches mm so kept it separate until after all of this lands. I'll try and get it to you soon after this, but it might be early next week (nothing wrong with code, just my schedule is messy) This also hits a lot of fbdev drivers with some cleanups. Other notables: - vulkan timeline semaphore support added to syncobjs - nouveau turing secureboot/graphics support - Displayport MST display stream compression support Detailed summary: uapi: - dma-buf heaps added (and fixed) - command line add support for panel oreientation - command line allow overriding penguin count drm: - mipi dsi definition updates - lockdep annotations for dma_resv - remove dma-buf kmap/kunmap support - constify fb_ops in all fbdev drivers - MST fix for daisy chained hotplug- - CTA-861-G modes with VIC >= 193 added - fix drm_panel_of_backlight export - LVDS decoder support - more device based logging support - scanline alighment for dumb buffers - MST DSC helpers scheduler: - documentation fixes - job distribution improvements panel: - Logic PD type 28 panel support - Jimax8729d MIPI-DSI - igenic JZ4770 - generic DSI devicetree bindings - sony acx424AKP panel - Leadtek LTK500HD1829 - xinpeng XPP055C272 - AUO B116XAK01 - GiantPlus GPM940B0 - BOE NV140FHM-N49 - Satoz SAT050AT40H12R2 - Sharp LS020B1DD01D panels. ttm: - use blocking WW lock i915: - hw/uapi state separation - Lock annotation improvements - selftest improvements - ICL/TGL DSI VDSC support - VBT parsing improvments - Display refactoring - DSI updates + fixes - HDCP 2.2 for CFL - CML PCI ID fixes - GLK+ fbc fix - PSR fixes - GEN/GT refactor improvments - DP MST fixes - switch context id alloc to xarray - workaround updates - LMEM debugfs support - tiled monitor fixes - ICL+ clock gating programming removed - DP MST disable sequence fixed - LMEM discontiguous object maps - prefaulting for discontiguous objects - use LMEM for dumb buffers if possible - add LMEM mmap support amdgpu: - enable sync object timelines for vulkan - MST atomic routines - enable MST DSC support - add DMCUB display microengine support - DC OEM i2c support - Renoir DC fixes - Initial HDCP 2.x support - BACO support for Arcturus - Use BACO for runtime PM power save - gfxoff on navi10 - gfx10 golden updates and fixes - DCN support on POWER - GFXOFF for raven1 refresh - MM engine idle handlers cleanup - 10bpc EDP panel fixes - renoir watermark fixes - SR-IOV fixes - Arcturus VCN fixes - GDDR6 training fixes - freesync fixes - Pollock support amdkfd: - unify more codepath with amdgpu - use KIQ to setup HIQ rather than MMIO radeon: - fix vma fault handler race - PPC DMA fix - register check fixes for r100/r200 nouveau: - mmap_sem vs dma_resv fix - rewrite the ACR secure boot code for Turing - TU10x graphics engine support (TU11x pending) - Page kind mapping for turing - 10-bit LUT support - GP10B Tegra fixes - HD audio regression fix hisilicon/hibmc: - use generic fbdev code and helpers rockchip: - dsi/px30 support virtio: - fb damage support - static some functions vc4: - use dma_resv lock wrappers msm: - use dma_resv lock wrappers - sc7180 display + DSI support - a618 support - UBWC support improvements vmwgfx: - updates + new logging uapi exynos: - enable/disable callback cleanups etnaviv: - use dma_resv lock wrappers atmel-hlcdc: - clock fixes mediatek: - cmdq support - non-smooth cursor fixes - ctm property support sun4i: - suspend support - A64 mipi dsi support rcar-du: - Color management module support - LVDS encoder dual-link support - R8A77980 support analogic: - add support for an6345 ast: - atomic modeset support - primary plane garbage fix arcgpu: - fixes for fourcc handling tegra: - minor fixes and improvments mcde: - vblank support meson: - OSD1 plane AFBC commit gma500: - add pageflip support - reomve global drm_dev komeda: - tweak debugfs output - d32 support - runtime PM suppotr udl: - use generic shmem helpers - cleanup and fixes" * tag 'drm-next-2020-01-30' of git://anongit.freedesktop.org/drm/drm: (1998 commits) drm/nouveau/fb/gp102-: allow module to load even when scrubber binary is missing drm/nouveau/acr: return error when registering LSF if ACR not supported drm/nouveau/disp/gv100-: not all channel types support reporting error codes drm/nouveau/disp/nv50-: prevent oops when no channel method map provided drm/nouveau: support synchronous pushbuf submission drm/nouveau: signal pending fences when channel has been killed drm/nouveau: reject attempts to submit to dead channels drm/nouveau: zero vma pointer even if we only unreference it rather than free drm/nouveau: Add HD-audio component notifier support drm/nouveau: fix build error without CONFIG_IOMMU_API drm/nouveau/kms/nv04: remove set but not used variable 'width' drm/nouveau/kms/nv50: remove set but not unused variable 'nv_connector' drm/nouveau/mmu: fix comptag memory leak drm/nouveau/gr/gp10b: Use gp100_grctx and gp100_gr_zbc drm/nouveau/pmu/gm20b,gp10b: Fix Falcon bootstrapping drm/exynos: Rename Exynos to lowercase drm/exynos: change callback names drm/mst: Don't do atomic checks over disabled managers drm/amdgpu: add the lost mutex_init back drm/amd/display: skip opp blank or unblank if test pattern enabled ... commit 4cadc60d6bcfee9c626d4b55e9dc1475d21ad3bb Merge: 893e591b5903 3d32a8437c05 Author: Linus Torvalds Date: Thu Jan 30 07:51:24 2020 -0800 Merge tag 'for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Core: - Add battery internal resistance temperature table support Drivers: - sc27xx: Optimize the battery resistance with measuring temperature - max17042-battery: Add MAX17055 support - bq25890-charger: Add support of BQ25892 and BQ25896 chips - misc fixes" * tag 'for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (44 commits) power: supply: ipaq_micro_battery: remove unneeded semicolon power: supply: bq25890_charger: fix incorrect error return when bq25890_field_read fails power: supply: axp20x_usb_power: Only poll while offline power: supply: axp20x_usb_power: Add wakeup control power: supply: axp20x_usb_power: Allow offlining power: supply: axp20x_usb_power: Use a match structure power: suppy: ucs1002: Make the symbol 'ucs1002_regulator_enable' static power: reset: at91-poweroff: use proper master clock register offset power: reset: at91-poweroff: introduce struct shdwc_reg_config power: supply: bq25890_charger: Add DT and I2C ids for all supported chips dt-bindings: Add new chips to bq25890 binding documentation power: supply: bq25890_charger: Add support of BQ25892 and BQ25896 chips power: supply: core: Update sysfs-class-power ABI document power: supply: sbs-battery: Fix a signedness bug in sbs_get_battery_capacity() power: supply: ltc2941-battery-gauge: fix use-after-free power: supply: max17040: Correct IRQ wake handling power: supply: axp20x_usb_power: Remove unused device_node power: supply: axp20x_ac_power: Add wakeup control power: supply: axp20x_ac_power: Allow offlining power: supply: axp20x_ac_power: Fix reporting online status ... commit 893e591b59036f9bc629f55bce715d67bdd266a2 Merge: 1c715a659a16 e9a3bfe38e39 Author: Linus Torvalds Date: Thu Jan 30 07:47:58 2020 -0800 Merge tag 'devicetree-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: - Update dtc to upstream v1.5.1-22-gc40aeb60b47a (plus 1 revert) - Fix for DMA coherent devices on Power - Rework and simplify the DT phandle cache code - DT schema conversions for LEDS, gpio-leds, STM32 dfsdm, STM32 UART, STM32 ROMEM, STM32 watchdog, STM32 DMAs, STM32 mlahb, STM32 RTC, STM32 RCC, STM32 syscon, rs485, Renesas rCar CSI2, Faraday FTIDE010, DWC2, Arm idle-states, Allwinner legacy resets, PRCM and clocks, Allwinner H6 OPP, Allwinner AHCI, Allwinner MBUS, Allwinner A31 CSI, Allwinner h/w codec, Allwinner A10 system ctrl, Allwinner SRAM, Allwinner USB PHY, Renesas CEU, generic PCI host, Arm Versatile PCI - New binding schemas for SATA and PATA controllers, TI and Infineon VR controllers, MAX31730 - New compatible strings for i.MX8QM, WCN3991, renesas,r8a77961-wdt, renesas,etheravb-r8a77961 - Add USB 'super-speed-plus' as a documented speed - Vendor prefixes for broadmobi, calaosystems, kam, and mps - Clean-up the multiple flavors of ST-Ericsson vendor prefixes * tag 'devicetree-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (66 commits) scripts/dtc: Revert "yamltree: Ensure consistent bracketing of properties with phandles" of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc dt-bindings: leds: Convert gpio-leds to DT schema dt-bindings: leds: Convert common LED binding to schema dt-bindings: PCI: Convert generic host binding to DT schema dt-bindings: PCI: Convert Arm Versatile binding to DT schema dt-bindings: Be explicit about installing deps dt-bindings: stm32: convert dfsdm to json-schema dt-bindings: serial: Convert STM32 UART to json-schema dt-bindings: serial: Convert rs485 bindings to json-schema dt-bindings: timer: Use non-empty ranges in example dt-bindings: arm-boards: typo fix dt-bindings: Add TI and Infineon VR Controllers as trivial devices dt-binding: usb: add "super-speed-plus" dt-bindings: rcar-csi2: Convert bindings to json-schema dt-bindings: iio: adc: ad7606: Fix wrong maxItems value dt-bindings: Convert Faraday FTIDE010 to DT schema dt-bindings: Create DT bindings for PATA controllers dt-bindings: Create DT bindings for SATA controllers dt: bindings: add vendor prefix for Kamstrup A/S ... commit 1c715a659a16e193a23051ddff4becdad8e18ba1 Merge: 5e237e8c7727 9fbf082f5699 Author: Linus Torvalds Date: Thu Jan 30 07:42:00 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Various mptcp fixupes from Florian Westphal and Geery Uytterhoeven. 2) Don't clear the node/port GUIDs after we've assigned the correct values to them. From Leon Romanovsky. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: net/core: Do not clear VF index for node/port GUIDs query mptcp: Fix undefined mptcp_handle_ipv6_mapped for modular IPV6 net: drop_monitor: Use kstrdup udp: document udp_rcv_segment special case for looped packets mptcp: MPTCP_HMAC_TEST should depend on MPTCP mptcp: Fix incorrect IPV6 dependency check Revert "MAINTAINERS: mptcp@ mailing list is moderated" mptcp: handle tcp fallback when using syn cookies mptcp: avoid a lockdep splat when mcast group was joined mptcp: fix panic on user pointer access mptcp: defer freeing of cached ext until last moment net: mvneta: fix XDP support if sw bm is used as fallback sch_choke: Use kvcalloc mptcp: Fix build with PROC_FS disabled. MAINTAINERS: mptcp@ mailing list is moderated commit 5e237e8c77279a0873a5e9806a5459ebc840c9ce Merge: 9ca4c6429f92 2fd3c5c61793 Author: Linus Torvalds Date: Thu Jan 30 07:39:10 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide Pull IDE updates from David Miller: 1) Fix mem region name in tx4949ide driver, from Christophe JAILLET. 2) Make drive->dn read only, it should not be changeable by users. From Dan Carpenter. 3) Several cast fixups from Krzysztof Kozlowski. There is also going to be a removal of a now unused IDE driver, but that will come via the MIPS tree. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide: ide: make drive->dn read only ide: serverworks: potential overflow in svwks_set_pio_mode() cmd64x: potential buffer overflow in cmd64x_program_timings() ide: remove unneeded header include path to drivers/ide ide: qd65xx: Fix cast to pointer from integer of different size ide: ht6560b: Fix cast to pointer from integer of different size ide: remove set but not used variable 'hwif' ide: remove unnecessary touch_softlockup_watchdog ide: tx4939ide: Fix the name used in a 'devm_request_mem_region()' call ide: Use dev_get_drvdata where possible commit 9ca4c6429f92598a84e4c3292ea7d187c9d7b033 Merge: 11f2534bae8c d68712ee3506 Author: Linus Torvalds Date: Thu Jan 30 07:36:43 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc updates from David Miller: 1) Add a proper .exit.data section. 2) Fix ipc64_perm type definition, from Arnd Bergmann. 3) Support folded p4d page tables on sparc64, from Mike Rapport. 4) Remove uses of struct timex, also from Arnd Bergmann. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: y2038: sparc: remove use of struct timex sparc64: add support for folded p4d page tables sparc/console: kill off obsolete declarations sparc32: fix struct ipc64_perm type definition sparc32, leon: Stop adding vendor and device id to prom ambapp path components sparc: Add .exit.data section. sparc: remove unneeded uapi/asm/statfs.h commit 11f2534bae8c9dc6dace2018226733e4899a57c3 Merge: 39bed42de2e7 4942dc6638b0 Author: Linus Torvalds Date: Thu Jan 30 07:34:33 2020 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 KVM fix from Catalin Marinas: "Set the correct MDCR_EL2 register value on the first run of a vCPU" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE commit e0a514259378718e0deea1def03b7025a0daaf42 Author: Colin Ian King Date: Wed Jan 22 09:12:50 2020 +0000 scsi: ufs: fix spelling mistake "initilized" -> "initialized" There is a spelling mistake in a pr_err message. Fix it. Link: https://lore.kernel.org/r/20200122091250.2777221-1-colin.king@canonical.com Signed-off-by: Colin Ian King Reviewed-by: Bean Huo Signed-off-by: Martin K. Petersen commit 20bc1ad2e4da2e59e1b8481f19f022d78b43429e Author: Colin Ian King Date: Thu Jan 23 00:57:06 2020 +0000 scsi: pm80xx: fix spelling mistake "to" -> "too" There is a spelling mistake in a pm8001_printk message. Fix it. Link: https://lore.kernel.org/r/20200123005706.2834281-1-colin.king@canonical.com Signed-off-by: Colin Ian King Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit 0171c1c10d2684a6bbaf4d0a1a64fd4b40d69644 Author: Bean Huo Date: Wed Jan 22 11:27:51 2020 +0100 scsi: MAINTAINERS: ufs: remove pedrom.sousa@synopsys.com Pedro has left Synopsys and his email address doesn't work anymore. Everytime after sending email I will receive his undeliverable email. Remove his email address from MAINTAINERS. Signed-off-by: Bean Huo Signed-off-by: Martin K. Petersen commit 92b4f9d150593a7a78d9872c2d5dc05ffae4521b Author: Hannes Reinecke Date: Mon Jan 13 14:26:09 2020 +0100 scsi: megaraid_sas: fixup MSIx interrupt setup during resume Streamline resume workflow by using the same functions for enabling MSIx interrupts as used during initialisation. Without it the driver might crash during resume with: WARNING: CPU: 2 PID: 4306 at ../drivers/pci/msi.c:1303 pci_irq_get_affinity+0x3b/0x90 Link: https://lore.kernel.org/r/20200113132609.69536-1-hare@suse.de Signed-off-by: Hannes Reinecke Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit 00fe717ee1ea3c2979db4f94b1533c57aed8dea9 Author: Arun Easi Date: Thu Jan 23 20:50:14 2020 -0800 scsi: qla2xxx: Fix unbound NVME response length On certain cases when response length is less than 32, NVME response data is supplied inline in IOCB. This is indicated by some combination of state flags. There was an instance when a high, and incorrect, response length was indicated causing driver to overrun buffers. Fix this by checking and limiting the response payload length. Fixes: 7401bc18d1ee3 ("scsi: qla2xxx: Add FC-NVMe command handling") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200124045014.23554-1-hmadhani@marvell.com Signed-off-by: Arun Easi Signed-off-by: Himanshu Madhani Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen commit 1e837945a8854227f3f4e4d2d7abff64ed320830 Author: Steven Rostedt (VMware) Date: Wed Jan 29 16:30:30 2020 -0500 tracing: Move tracing selftests to bottom of menu Move all the tracing selftest configs to the bottom of the tracing menu. There's no reason for them to be interspersed throughout. Also, move the bootconfig menu to the top. Signed-off-by: Steven Rostedt (VMware) commit 21b3ce3063be8eb7150a717d7c5286fb56ba8cea Author: Steven Rostedt (VMware) Date: Wed Jan 29 16:26:45 2020 -0500 tracing: Move mmio tracer config up with the other tracers Move the config that enables the mmiotracer with the other tracers such that all the tracers are together. Signed-off-by: Steven Rostedt (VMware) commit a48fc4f5f1d24c70906359731d7080f9ad78a1cb Author: Steven Rostedt (VMware) Date: Wed Jan 29 16:23:04 2020 -0500 tracing: Move tracing test module configs together The MMIO test module was by itself, move it to the other test modules. Also, add the text "Test module" to PREEMPTIRQ_DELAY_TEST as that create a test module as well. Signed-off-by: Steven Rostedt (VMware) commit 61778cd70c1dcef082e5ee6781c7c0c4d7d5b576 Author: Steven Rostedt (VMware) Date: Wed Jan 29 16:19:10 2020 -0500 tracing: Move all function tracing configs together The features that depend on the function tracer were spread out through the tracing menu, pull them together as it is easier to manage. Signed-off-by: Steven Rostedt (VMware) commit 34ed63573b664f984a4b84df02a9ecdfaa3a6034 Author: Tom Zanussi Date: Wed Jan 29 12:59:32 2020 -0600 tracing: Documentation for in-kernel synthetic event API Add Documentation for creating and generating synthetic events from modules. Link: http://lkml.kernel.org/r/734bf8789ff8700000c9acde61a553427910ddb5.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 64836248dda20c8e7427b493f7e06d9bf8f58850 Author: Tom Zanussi Date: Wed Jan 29 12:59:31 2020 -0600 tracing: Add kprobe event command generation test module Add a test module that checks the basic functionality of the in-kernel kprobe event command generation API by creating kprobe events from a module. Link: http://lkml.kernel.org/r/97e502b204f9dba948e3fa3a4315448298218787.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 29a15481054681fa2d450b60a6feea8e6ca6f511 Author: Tom Zanussi Date: Wed Jan 29 12:59:30 2020 -0600 tracing: Change trace_boot to use kprobe_event interface Have trace_boot_add_kprobe_event() use the kprobe_event interface. Also, rename kprobe_event_run_cmd() to kprobe_event_run_command() now that trace_boot's version is gone. Link: http://lkml.kernel.org/r/af5429d11291ab1e9a85a0ff944af3b2bcf193c7.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 2a588dd1d5d649a183a2ff6fa1b80e870cf821d8 Author: Tom Zanussi Date: Wed Jan 29 12:59:29 2020 -0600 tracing: Add kprobe event command generation functions Add functions used to generate kprobe event commands, built on top of the dynevent_cmd interface. kprobe_event_gen_cmd_start() is used to create a kprobe event command using a variable arg list, and kretprobe_event_gen_cmd_start() does the same for kretprobe event commands. kprobe_event_add_fields() can be used to add single fields one by one or as a group. Once all desired fields are added, kprobe_event_gen_cmd_end() or kretprobe_event_gen_cmd_end() respectively are used to actually execute the command and create the event. Link: http://lkml.kernel.org/r/95cc4696502bb6017f9126f306a45ad19b4cc14f.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 9fe41efaca08416657efa8731c0d47ccb6a3f3eb Author: Tom Zanussi Date: Wed Jan 29 12:59:28 2020 -0600 tracing: Add synth event generation test module Add a test module that checks the basic functionality of the in-kernel synthetic event generation API by generating and tracing synthetic events from a module. Link: http://lkml.kernel.org/r/fcb4dd9eb9eefb70ab20538d3529d51642389664.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 8dcc53ad956d2caf4c5c2dda196e6801b71a3154 Author: Tom Zanussi Date: Wed Jan 29 12:59:27 2020 -0600 tracing: Add synth_event_trace() and related functions Add an exported function named synth_event_trace(), allowing modules or other kernel code to trace synthetic events. Also added are several functions that allow the same functionality to be broken out in a piecewise fashion, which are useful in situations where tracing an event from a full array of values would be cumbersome. Those functions are synth_event_trace_start/end() and synth_event_add_(next)_val(). Link: http://lkml.kernel.org/r/7a84de5f1854acf4144b57efe835ca645afa764f.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 35ca5207c2d111abb9e072f028945d5c12b20836 Author: Tom Zanussi Date: Wed Jan 29 12:59:25 2020 -0600 tracing: Add synthetic event command generation functions Add functions used to generate synthetic event commands, built on top of the dynevent_cmd interface. synth_event_gen_cmd_start() is used to create a synthetic event command using a variable arg list and synth_event_gen_cmd_array_start() does the same thing but using an array of field descriptors. synth_event_add_field(), synth_event_add_field_str() and synth_event_add_fields() can be used to add single fields one by one or as a group. Once all desired fields are added, synth_event_gen_cmd_end() is used to actually execute the command and create the event. synth_event_create() does everything, including creating the event, in a single call. Link: http://lkml.kernel.org/r/38fef702fad5ef208009f459552f34a94befd860.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 86c5426baddae9ff192e3159b9c2e7c14e3964c6 Author: Tom Zanussi Date: Wed Jan 29 12:59:24 2020 -0600 tracing: Add dynamic event command creation interface Add an interface used to build up dynamic event creation commands, such as synthetic and kprobe events. Interfaces specific to those particular types of events and others can be built on top of this interface. Command creation is started by first using the dynevent_cmd_init() function to initialize the dynevent_cmd object. Following that, args are appended and optionally checked by the dynevent_arg_add() and dynevent_arg_pair_add() functions, which use objects representing arguments and pairs of arguments, initialized respectively by dynevent_arg_init() and dynevent_arg_pair_init(). Finally, once all args have been successfully added, the command is finalized and actually created using dynevent_create(). The code here for actually printing into the dyn_event->cmd buffer using snprintf() etc was adapted from v4 of Masami's 'tracing/boot: Add synthetic event support' patch. Link: http://lkml.kernel.org/r/1f65fa44390b6f238f6036777c3784ced1dcc6a0.1580323897.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit f5f6b255a253e2c3132ca283e9090a6343bfb719 Author: Tom Zanussi Date: Wed Jan 29 12:59:23 2020 -0600 tracing: Add synth_event_delete() create_or_delete_synth_event() contains code to delete a synthetic event, which would be useful on its own - specifically, it would be useful to allow event-creating modules to call it separately. Separate out the delete code from that function and create an exported function named synth_event_delete(). Link: http://lkml.kernel.org/r/050db3b06df7f0a4b8a2922da602d1d879c7c1c2.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit e3e2a2cc9c96725457ad6f31712ea7681a55666e Author: Tom Zanussi Date: Wed Jan 29 12:59:22 2020 -0600 tracing: Add trace_get/put_event_file() Add a function to get an event file and prevent it from going away on module or instance removal. trace_get_event_file() will find an event file in a given instance (if instance is NULL, it assumes the top trace array) and return it, pinning the instance's trace array as well as the event's module, if applicable, so they won't go away while in use. trace_put_event_file() does the matching release. Link: http://lkml.kernel.org/r/bb31ac4bdda168d5ed3c4b5f5a4c8f633e8d9118.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi [ Moved trace_array_put() to end of trace_put_event_file() ] Signed-off-by: Steven Rostedt (VMware) commit 89c95fcef1942415e0f20d8c82e6e36ff8eeca9c Author: Tom Zanussi Date: Wed Jan 29 12:59:21 2020 -0600 tracing: Add trace_array_find/_get() to find instance trace arrays Add a new trace_array_find() function that can be used to find a trace array given the instance name, and replace existing code that does the same thing with it. Also add trace_array_find_get() which does the same but returns the trace array after upping its refcount. Also make both available for use outside of trace.c. Link: http://lkml.kernel.org/r/cb68528c975eba95bee4561ac67dd1499423b2e5.1580323897.git.zanussi@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 6722b23e7a2ace078344064a9735fb73e554e9ef Author: Vasily Averin Date: Fri Jan 24 10:03:06 2020 +0300 trigger_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. Without patch: # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist # Available triggers: # traceon traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist 6+1 records in 6+1 records out 206 bytes copied, 0.00027916 s, 738 kB/s Notice the printing of "# Available triggers:..." after the line. With the patch: # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist 2+1 records in 2+1 records out 88 bytes copied, 0.000526867 s, 167 kB/s It only prints the end of the file, and does not restart. Link: http://lkml.kernel.org/r/3c35ee24-dd3a-8119-9c19-552ed253388a@virtuozzo.com https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Steven Rostedt (VMware) commit 039958a5f7aad695d4d52683c7d48aa13fb18249 Author: Vasily Averin Date: Fri Jan 24 10:03:01 2020 +0300 tracing: eval_map_next() should always increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. Link: http://lkml.kernel.org/r/7ad85b22-1866-977c-db17-88ac438bc764@virtuozzo.com Signed-off-by: Vasily Averin [ This is not a bug fix, it just makes it "technically correct" which is why I applied it. NULL is only returned on an anomaly which triggers a WARN_ON ] Signed-off-by: Steven Rostedt (VMware) commit e4075e8bdffd93a9b6d6e1d52fabedceeca5a91b Author: Vasily Averin Date: Fri Jan 24 10:02:56 2020 +0300 ftrace: fpid_next() should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. Without patch: # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset id no pid 2+1 records in 2+1 records out 10 bytes copied, 0.000213285 s, 46.9 kB/s Notice the "id" followed by "no pid". With the patch: # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset id 0+1 records in 0+1 records out 3 bytes copied, 0.000202112 s, 14.8 kB/s Notice that it only prints "id" and not the "no pid" afterward. Link: http://lkml.kernel.org/r/4f87c6ad-f114-30bb-8506-c32274ce2992@virtuozzo.com https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Steven Rostedt (VMware) commit 64ae572bc7d0060429e40e1c8d803ce5eb31a0d6 Author: Mathieu Desnoyers Date: Sat Aug 17 10:12:08 2019 -0400 tracing: Fix sched switch start/stop refcount racy updates Reading the sched_cmdline_ref and sched_tgid_ref initial state within tracing_start_sched_switch without holding the sched_register_mutex is racy against concurrent updates, which can lead to tracepoint probes being registered more than once (and thus trigger warnings within tracepoint.c). [ May be the fix for this bug ] Link: https://lore.kernel.org/r/000000000000ab6f84056c786b93@google.com Link: http://lkml.kernel.org/r/20190817141208.15226-1-mathieu.desnoyers@efficios.com Cc: stable@vger.kernel.org CC: Steven Rostedt (VMware) CC: Joel Fernandes (Google) CC: Peter Zijlstra CC: Thomas Gleixner CC: Paul E. McKenney Reported-by: syzbot+774fddf07b7ab29a1e55@syzkaller.appspotmail.com Fixes: d914ba37d7145 ("tracing: Add support for recording tgid of tasks") Signed-off-by: Mathieu Desnoyers Signed-off-by: Steven Rostedt (VMware) commit 9fbf082f569980ddd7cab348e0a118678db0e47e Author: Leon Romanovsky Date: Thu Jan 30 14:59:49 2020 +0200 net/core: Do not clear VF index for node/port GUIDs query VF numbers were assigned to node_guid and port_guid, but cleared right before such query calls were issued. It caused to return node/port GUIDs of VF index 0 for all VFs. Fixes: 30aad41721e0 ("net/core: Add support for getting VF GUIDs") Reported-by: Adrian Chiris Signed-off-by: Leon Romanovsky Signed-off-by: David S. Miller commit 8c8c5a4994a306c217fd061cbfc5903399fd4c1c Author: Nicolas Saenz Julienne Date: Fri Jan 10 18:19:33 2020 +0100 dma-contiguous: CMA: give precedence to cmdline Although the device tree might contain a reserved-memory DT node dedicated as the default CMA pool, users might want to change CMA's parameters using the kernel command line for debugging purposes and whatnot. Honor this by bypassing the reserved memory CMA setup, which will ultimately end up freeing the memblock and allow the command line CMA configuration routine to run. Signed-off-by: Nicolas Saenz Julienne Reviewed-by: Phil Elwell Signed-off-by: Christoph Hellwig commit 41196224883a64e56e0ef237c19eb837058df071 Author: Christophe Leroy Date: Wed Jan 29 12:34:36 2020 +0000 powerpc/32s: Fix kasan_early_hash_table() for CONFIG_VMAP_STACK On book3s/32 CPUs that are handling MMU through a hash table, MMU_init_hw() function was adapted for VMAP_STACK in order to handle virtual addresses instead of physical addresses in the low level hash functions. When using KASAN, the same adaptations are required for the early hash table set up by kasan_early_hash_table() function. Fixes: cd08f109e262 ("powerpc/32s: Enable CONFIG_VMAP_STACK") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/fc8390a33c2a470105f01abbcbdc7916c30c0a54.1580301269.git.christophe.leroy@c-s.fr commit 55d0a513a0e202c68af2c8f4b1e923a345227bbb Author: Harald Freudenberger Date: Fri Dec 6 14:21:38 2019 +0100 s390/pkey/zcrypt: Support EP11 AES secure keys Extend the low level ep11 misc functions implementation by several functions to support EP11 key objects for paes and pkey: - EP11 AES secure key generation - EP11 AES secure key generation from given clear key value - EP11 AES secure key blob check - findcard function returns list of apqns based on given criterias - EP11 AES secure key derive to CPACF protected key Extend the pkey module to be able to generate and handle EP11 secure keys and also use them as base for deriving protected keys for CPACF usage. These ioctls are extended to support EP11 keys: PKEY_GENSECK2, PKEY_CLR2SECK2, PKEY_VERIFYKEY2, PKEY_APQNS4K, PKEY_APQNS4KT, PKEY_KBLOB2PROTK2. Additionally the 'clear key' token to protected key now uses an EP11 card if the other ways (via PCKMO, via CCA) fail. The PAES cipher implementation needed a new upper limit for the max key size, but is now also working with EP11 keys. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit a17becc112535b912f2165f80a98c21b59655119 Author: Harald Freudenberger Date: Fri Aug 30 16:17:47 2019 +0200 s390/zcrypt: extend EP11 card and queue sysfs attributes This patch introduces new sysfs attributes for EP11 cards and queues: An EP11 card gets four new sysfs attributes: /sys/devices/ap/cardxx/API_ordinalnr The EP11 card firmware API ordinal number. /sys/devices/ap/cardxx/FW_version The EP11 card firmware major and minor version. /sys/devices/ap/cardxx/serialnr Displays the serial number of the EP11 card. The serial number is a 16 character string unique for this EP11 card. /sys/devices/ap/cardxx/op_modes Displays operation modes for this EP11 card. Known operation modes are: FIPS2009, BSI2009, FIPS2011, BSI2011 and BSICC2017. The EP11 queues get two new sysfs attributes: /sys/devices/ap/cardxx/xx.yyyy/mkvps Displays information about the master key(s) states and verification patterns. Two lines are displayed: WK CUR: WK NEW: with : 'invalid' or 'valid' : 'empty' or 'uncommitted' or 'committed' and : '-' or a 32 byte hash pattern /sys/devices/ap/cardxx/xx.yyyy/op_modes Displays operation modes for this EP11 queue. Known operation modes are: FIPS2009, BSI2009, FIPS2011, BSI2011 and BSICC2017. The card information displayed with the sysfs attributes is fresh fetched from the card if the card is online, otherwise cached values are used. The queue information displayed with the sysfs attributes is always fetched on the fly and not cached. So each read of any of these sysfs attributes will cause an request/reply CPRB communication with the EP11 crypto card. The queue attributes address the corresponding EP11 domain within the EP11 card. The card attributes addresses any domain within the EP11 card (subject to the dispatch algorithm within the zcrypt device driver). If the addressed domain is offline or for card addressing all domains are offline the attributes will display '-' for state and verification patterns and an empty string for op mode, serial number, API_ordinalnr and FW_version. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 7384eb725e2d55649850331a560bac2d48ed5002 Author: Harald Freudenberger Date: Fri Aug 30 16:07:08 2019 +0200 s390/zcrypt: add new low level ep11 functions support file This patch introduces two new files which provide some low level functions to interact with EP11 crypto cards: ep11_get_card_info() sends an EP11 query module info CPRB to the addressed card, processes the returning reply and exposes some of the information returned in the new ep11_card_info struct. ep11_get_domain_info() sends an EP11 query domain info CPRB to the addressed card/queue, processes the returning reply and exposes some of the information returned in the new ep11_domain_info struct. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit a7367997abb64b5e5a4f6fe6091629440b10da40 Author: Harald Freudenberger Date: Fri Aug 30 15:57:17 2019 +0200 s390/zcrypt: ep11 structs rework, export zcrypt_send_ep11_cprb Minor rework for struct ep11_cprb and struct ep11_urb. Use of u8, u16, u32 instead of unsigned char. Declare pointers to mem from userspace with __user to give sparse a chance to check. Export zcrypt_send_ep11_cprb() function as this function will be called by code in progress which will build ep11 cprbs within the zcrypt device driver zoo and send them to EP11 crypto cards. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 8f291ebf327050822d4ebf3812e5cc033ee0a88a Author: Harald Freudenberger Date: Fri Aug 30 15:17:27 2019 +0200 s390/zcrypt: enable card/domain autoselect on ep11 cprbs For EP11 CPRBs there was only to choose between specify one or more ep11 targets or not give a target at all. Without any target the zcrypt code assumed AUTOSELECT. For EP11 this ended up in choosing any EP11 APQN with regards to the weight. However, CCA CPRBs can have a more fine granular target addressing. The caller can give 0xFFFF as AUTOSELECT for the card and/or the domain. So it's possible to address any card but domain given or any domain but card given. This patch now introduces the very same for EP11 CPRB handling. An EP11 target entry now may contain 0xFFFF as card and/or domain value with the meaning of ANY card or domain. So now the same behavior as with CCA CPRBs becomes possible: Address any card with given domain or address any domain within given card. For convenience the zcrypt.h header file now has two new defines AUTOSEL_AP and AUTOSEL_DOM covering the 0xFFFF value to address card any and domain any. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 7f820d053948ca82bd8221b1df3d676b9c93a494 Author: Harald Freudenberger Date: Wed Jan 22 12:24:00 2020 +0100 s390/crypto: enable clear key values for paes ciphers With this patch the paes ciphers do accept AES clear key values of size 16, 24 or 32 byte. The key value is internal rearranged to form a paes clear key token so that the pkey kernel module recognizes and handles this key material as source for protected keys. Using clear key material as a source for protected keys is a security risc as the raw key material is kept in memory. However, so the AES selftests provided with the testmanager can be run during registration of the paes ciphers. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 888edbc48857c7189592fb0be3ab09994247199c Author: Harald Freudenberger Date: Fri Sep 27 11:16:42 2019 +0200 s390/pkey: Add support for key blob with clear key value This patch adds support for a new key blob format to the pkey kernel module. The new key blob comprises a clear key value together with key type information. The implementation tries to derive an protected key from the blob with the clear key value inside with 1) the PCKMO instruction. This may fail as the LPAR profile may disable this way. 2) Generate an CCA AES secure data key with exact the clear key value. This requires to have a working crypto card in CCA Coprocessor mode. Then derive an protected key from the CCA AES secure key again with the help of a working crypto card in CCA mode. If both way fail, the transformation of the clear key blob into a protected key will fail. For the PAES cipher this would result in a failure at setkey() invocation. A clear key value exposed in main memory is a security risk. The intention of this new 'clear key blob' support for pkey is to provide self-tests for the PAES cipher key implementation. These known answer tests obviously need to be run with well known key values. So with the clear key blob format there is a way to provide knwon answer tests together with an pkey clear key blob for the in-kernel self tests done at cipher registration. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 6f3196b74d64fe4b0a51cefa6f2f80f7f55bcf49 Author: Harald Freudenberger Date: Wed Jan 22 10:29:33 2020 +0100 s390/crypto: Rework on paes implementation There have been some findings during Eric Biggers rework of the paes implementation which this patch tries to address: A very minor finding within paes ctr where when the cpacf instruction returns with only partially data en/decrytped the walk_done() was mistakenly done with the all data counter. Please note this can only happen when the kmctr returns because the protected key became invalid in the middle of the operation. And this is only with suspend and resume on a system with different effective wrapping key. Eric Biggers mentioned that the context struct within the tfm struct may be shared among multiple kernel threads. So here now a rework which uses a spinlock per context to protect the read and write of the protected key blob value. The en/decrypt functions copy the protected key(s) at the beginning into a param struct and do not work with the protected key within the context any more. If the protected key in the param struct becomes invalid, the key material is again converted to protected key(s) and the context gets this update protected by the spinlock. Race conditions are still possible and may result in writing the very same protected key value more than once. So the spinlock needs to make sure the protected key(s) within the context are consistent updated. The ctr page is now locked by a mutex instead of a spinlock. A similar patch went into the aes_s390 code as a result of a complain "sleeping function called from invalid context at ...algapi.h". See commit 1c2c7029c008 ("s390/crypto: fix possible sleep during spinlock aquired")' for more. During testing with instrumented code another issue with the xts en/decrypt function revealed. The retry cleared the running iv value and thus let to wrong en/decrypted data. Tested and verified with additional testcases via AF_ALG interface and additional selftests within the kernel (which will be made available as soon as possible). Reported-by: Eric Biggers Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 657480d9c01574d1e11bbb29e725db9907daf782 Author: Sven Schnelle Date: Tue Jan 21 12:31:47 2020 +0100 s390: support KPROBES_ON_FTRACE Instead of using our own kprobes-on-ftrace handling convert the code to support KPROBES_ON_FTRACE. Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik commit 5f490a520bcb393389a4d44bec90afcb332eb112 Author: Gerald Schaefer Date: Thu Jan 16 19:59:04 2020 +0100 s390/mm: fix dynamic pagetable upgrade for hugetlbfs Commit ee71d16d22bb ("s390/mm: make TASK_SIZE independent from the number of page table levels") changed the logic of TASK_SIZE and also removed the arch_mmap_check() implementation for s390. This combination has a subtle effect on how get_unmapped_area() for hugetlbfs pages works. It is now possible that a user process establishes a hugetlbfs mapping at an address above 4 TB, without triggering a dynamic pagetable upgrade from 3 to 4 levels. This is because hugetlbfs mappings will not use mm->get_unmapped_area, but rather file->f_op->get_unmapped_area, which currently is the generic implementation of hugetlb_get_unmapped_area() that does not know about s390 dynamic pagetable upgrades, but with the new definition of TASK_SIZE, it will now allow mappings above 4 TB. Subsequent access to such a mapped address above 4 TB will result in a page fault loop, because the CPU cannot translate such a large address with 3 pagetable levels. The fault handler will try to map in a hugepage at the address, but due to the folded pagetable logic it will end up with creating entries in the 3 level pagetable, possibly overwriting existing mappings, and then it all repeats when the access is retried. Apart from the page fault loop, this can have various nasty effects, e.g. kernel panic from one of the BUG_ON() checks in memory management code, or even data loss if an existing mapping gets overwritten. Fix this by implementing HAVE_ARCH_HUGETLB_UNMAPPED_AREA support for s390, providing an s390 version for hugetlb_get_unmapped_area() with pagetable upgrade support similar to arch_get_unmapped_area(), which will then be used instead of the generic version. Fixes: ee71d16d22bb ("s390/mm: make TASK_SIZE independent from the number of page table levels") Cc: # 4.12+ Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik commit 0ada120c883d4f1f6aafd01cf0fbb10d8bbba015 Author: Changbin Du Date: Tue Jan 28 23:29:38 2020 +0800 perf: Make perf able to build with latest libbfd libbfd has changed the bfd_section_* macros to inline functions bfd_section_ since 2019-09-18. See below two commits: o http://www.sourceware.org/ml/gdb-cvs/2019-09/msg00064.html o https://www.sourceware.org/ml/gdb-cvs/2019-09/msg00072.html This fix make perf able to build with both old and new libbfd. Signed-off-by: Changbin Du Acked-by: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20200128152938.31413-1-changbin.du@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 0dd1979f7f9981dcc5c497e68390f208580032ae Author: Thomas Richter Date: Mon Jan 20 14:20:09 2020 +0100 perf test: Fix test case Merge cpu map Commit a2408a70368a ("perf evlist: Maintain evlist->all_cpus") introduces a test case for cpumap merge operation, see functions perf_cpu_map__merge() and test__cpu_map_merge(). The test case fails on s390 with this error message: [root@m35lp76 perf]# ./perf test -Fvvvvv 52 52: Merge cpu map : --- start --- cpumask list: 1-2,4-5,7 perf: /root/linux/tools/include/linux/refcount.h:131:\ refcount_sub_and_test: Assertion `!(new > val)' failed. Aborted (core dumped) [root@m35lp76 perf]# The root cause is in the function test__cpu_map_merge(): It creates two cpu_maps named 'a' and 'b': struct perf_cpu_map *a = perf_cpu_map__new("4,2,1"); struct perf_cpu_map *b = perf_cpu_map__new("4,5,7"); and creates a third map named 'c' which is the result of the merge of maps a and b: struct perf_cpu_map *c = perf_cpu_map__merge(a, b); After some verifaction of the merged cpu_map all three of them are have their reference count reduced and are freed: perf_cpu_map__put(a); (1) perf_cpu_map__put(b); perf_cpu_map__put(c); The release of perf_cpu_map__put(a) is wrong. The map is already released and free'ed as part of the function perf_cpu_map__merge(struct perf_cpu_map *orig, | struct perf_cpu_map *other) +--> perf_cpu_map__put(orig); | +--> cpu_map__delete(orig) At the end perf_cpu_map_put() is called for map 'orig' alias 'a' and since the reference count is 1, the map is deleted, as can be seen by the following gdb trace: (gdb) where #0 tcache_put (tc_idx=0, chunk=0x156cc30) at malloc.c:2940 #1 _int_free (av=0x3fffd49ee80 , p=0x156cc30, have_lock=) at malloc.c:4222 #2 0x00000000012d5e78 in cpu_map__delete (map=0x156cc40) at cpumap.c:31 #3 0x00000000012d5f7a in perf_cpu_map__put (map=0x156cc40) at cpumap.c:45 #4 0x00000000012d723a in perf_cpu_map__merge (orig=0x156cc40, other=0x156cc60) at cpumap.c:343 #5 0x000000000110cdd0 in test__cpu_map_merge ( test=0x14ea6c8 , subtest=-1) at tests/cpumap.c:128 Thus the perf_cpu_map__put(a) (see (1) above) frees map 'a' a second time and causes the failure. Fix this be removing that function call. Output after: [root@m35lp76 perf]# ./perf test -Fvvvvv 52 52: Merge cpu map : --- start --- cpumask list: 1-2,4-5,7 ---- end ---- Merge cpu map: Ok [root@m35lp76 perf]# Signed-off-by: Thomas Richter Reviewed-by: Andi Kleen Cc: Heiko Carstens Cc: Vasily Gorbik Cc: sumanthk@linux.ibm.com Link: http://lore.kernel.org/lkml/20200120132011.64698-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3220fb8d5e59d7a9b59d02965d4209aef7691e9f Author: Leo Yan Date: Fri Jan 17 13:52:51 2020 +0800 perf parse: Copy string to perf_evsel_config_term perf with CoreSight fails to record trace data with command: perf record -e cs_etm/@tmc_etr0/u --per-thread ls failed to set sink "" on event cs_etm/@tmc_etr0/u with 21 (Is a directory)/perf/ This failure is root caused with the commit 1dc925568f01 ("perf parse: Add a deep delete for parse event terms"). The log shows, cs_etm fails to parse the sink attribution; cs_etm event relies on the event configuration to pass sink name, but the event specific configuration data cannot be passed properly with flow: get_config_terms() ADD_CONFIG_TERM(DRV_CFG, term->val.str); __t->val.str = term->val.str; `> __t->val.str is assigned to term->val.str; parse_events_terms__purge() parse_events_term__delete() zfree(&term->val.str); `> term->val.str is freed and assigned to NULL pointer; cs_etm_set_sink_attr() sink = __t->val.str; `> sink string has been freed. To fix this issue, in the function get_config_terms(), this patch changes to use strdup() for allocation a new duplicate string rather than directly assignment string pointer. This patch addes a new field 'free_str' in the data structure perf_evsel_config_term; 'free_str' is set to true when the union is used as a string pointer; thus it can tell perf_evsel__free_config_terms() to free the string. Fixes: 1dc925568f01 ("perf parse: Add a deep delete for parse event terms") Suggested-by: Jiri Olsa Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20200117055251.24058-2-leo.yan@linaro.org [ Use zfree() in perf_evsel__free_config_terms ] Signed-off-by: Arnaldo Carvalho de Melo :# modified: tools/perf/util/evsel_config.h commit e884602b57c07fae54ff357e4b996b2053b47c1e Author: Leo Yan Date: Fri Jan 17 13:52:50 2020 +0800 perf parse: Refactor 'struct perf_evsel_config_term' The struct perf_evsel_config_term::val is a union which contains fields 'callgraph', 'drv_cfg' and 'branch' as string pointers. This leads to the complex code logic for handling every type's string separately, and it's hard to release string as a general way. This patch refactors the structure to add a common field 'str' in the 'val' union as string pointer and remove the other three fields 'callgraph', 'drv_cfg' and 'branch'. Without passing field name, the patch simplifies the string handling with macro ADD_CONFIG_TERM_STR() for string pointer assignment. This patch fixes multiple warnings of line over 80 characters detected by checkpatch tool. Signed-off-by: Leo Yan Reviewed-by: Andi Kleen Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20200117055251.24058-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit d68712ee35069455ea4043d443c8d4fb9a1ee956 Author: Arnd Bergmann Date: Mon Dec 16 15:48:53 2019 +0100 y2038: sparc: remove use of struct timex 'struct timex' is one of the last users of 'struct timeval' and is only referenced in one place in the kernel any more, to convert the user space timex into the kernel-internal version on sparc64, with a different tv_usec member type. As a preparation for hiding the time_t definition and everything using that in the kernel, change the implementation once more to only convert the timeval member, and then enclose the struct definition in an #ifdef. Signed-off-by: Arnd Bergmann Reviewed-by: Julian Calaby Acked-by: Thomas Gleixner Signed-off-by: David S. Miller commit 5637bc5048340456176fcd4c8986edc1ac1acbe1 Author: Mike Rapoport Date: Sun Nov 24 10:57:20 2019 +0200 sparc64: add support for folded p4d page tables Implement primitives necessary for the 4th level folding, add walks of p4d level where appropriate and replace 5level-fixup.h with pgtable-nop4d.h. Signed-off-by: Mike Rapoport Acked-by: David S. Miller Signed-off-by: David S. Miller commit 2fd3c5c617937cde5aafa48db4f4056e1f705987 Author: Dan Carpenter Date: Tue Jan 21 16:06:42 2020 +0300 ide: make drive->dn read only The IDE core always sets ->dn correctly so changing it is never required. Setting it to a different value than assigned by IDE core is very likely to result in data corruption (due to wrong transfer timings being set on the controller etc.) Signed-off-by: Dan Carpenter Acked-by: Bartlomiej Zolnierkiewicz Tested-by: Bartlomiej Zolnierkiewicz Signed-off-by: David S. Miller commit 31484d56ca9511e62c08626db338d2aaafb3aa3f Author: Geert Uytterhoeven Date: Thu Jan 30 10:45:26 2020 +0100 mptcp: Fix undefined mptcp_handle_ipv6_mapped for modular IPV6 If CONFIG_MPTCP=y, CONFIG_MPTCP_IPV6=n, and CONFIG_IPV6=m: ERROR: "mptcp_handle_ipv6_mapped" [net/ipv6/ipv6.ko] undefined! This does not happen if CONFIG_MPTCP_IPV6=y, as CONFIG_MPTCP_IPV6 selects CONFIG_IPV6, and thus forces CONFIG_IPV6 builtin. As exporting a symbol for an empty function would be a bit wasteful, fix this by providing a dummy version of mptcp_handle_ipv6_mapped() for the CONFIG_MPTCP_IPV6=n case. Rename mptcp_handle_ipv6_mapped() to mptcpv6_handle_mapped(), to make it clear this is a pure-IPV6 function, just like mptcpv6_init(). Fixes: cec37a6e41aae7bf ("mptcp: Handle MP_CAPABLE options for outgoing connections") Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 72d62c4e422ed2380a2acd51747789b48146e4ee Author: Joe Perches Date: Tue Jan 28 11:02:50 2020 -0800 net: drop_monitor: Use kstrdup Convert the equivalent but rather odd uses of kmemdup with __GFP_ZERO to the more common kstrdup and avoid unnecessary zeroing of copied over memory. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit d0208bf4da97f76237300afb83c097de25645de6 Author: Willem de Bruijn Date: Wed Jan 29 15:20:17 2020 -0500 udp: document udp_rcv_segment special case for looped packets Commit 6cd021a58c18a ("udp: segment looped gso packets correctly") fixes an issue with rare udp gso multicast packets looped onto the receive path. The stable backport makes the narrowest change to target only these packets, when needed. As opposed to, say, expanding __udp_gso_segment, which is harder to reason to be free from unintended side-effects. But the resulting code is hardly self-describing. Document its purpose and rationale. Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit 389b8fb3c4befcc42edbc6d40525c6cb7704daf8 Author: Geert Uytterhoeven Date: Wed Jan 29 19:02:24 2020 +0100 mptcp: MPTCP_HMAC_TEST should depend on MPTCP As the MPTCP HMAC test is integrated into the MPTCP code, it can be built only when MPTCP is enabled. Hence when MPTCP is disabled, asking the user if the test code should be enabled is futile. Wrap the whole block of MPTCP-specific config options inside a check for MPTCP. While at it, drop the "default n" for MPTCP_HMAC_TEST, as that is the default anyway. Fixes: 65492c5a6ab5df50 ("mptcp: move from sha1 (v0) to sha256 (v1)") Signed-off-by: Geert Uytterhoeven Reviewed-by: Mat Martineau Signed-off-by: David S. Miller commit 8e1974a2a02bf5b77831c686f01761163ea0cd3e Author: Geert Uytterhoeven Date: Wed Jan 29 19:01:17 2020 +0100 mptcp: Fix incorrect IPV6 dependency check If CONFIG_MPTCP=y, CONFIG_MPTCP_IPV6=n, and CONFIG_IPV6=m: net/mptcp/protocol.o: In function `__mptcp_tcp_fallback': protocol.c:(.text+0x786): undefined reference to `inet6_stream_ops' Fix this by checking for CONFIG_MPTCP_IPV6 instead of CONFIG_IPV6, like is done in all other places in the mptcp code. Fixes: 8ab183deb26a3b79 ("mptcp: cope with later TCP fallback") Signed-off-by: Geert Uytterhoeven Reviewed-by: Mat Martineau Signed-off-by: David S. Miller commit ea6dd25deeb5b797a145be7f860e3085e7d104c3 Author: Alain Volmat Date: Mon Jan 6 14:28:32 2020 +0100 i2c: stm32f7: add PM_SLEEP suspend/resume support Backup/restore I2C registers as part of the suspend/resume handlers. The device is marked as suspended to ensure that transfers are rejected during the suspended period. Signed-off-by: Pierre-Yves MORDRET Signed-off-by: Alain Volmat Signed-off-by: Wolfram Sang commit 474809a28e7b0671a5090de6e0db91f0e3821360 Author: Marek Szyprowski Date: Thu Jan 30 08:08:34 2020 +0100 dmaengine: Fix return value for dma_request_chan() in case of failure Commit 71723a96b8b1 ("dmaengine: Create symlinks between DMA channels and slaves") changed the dma_request_chan() function flow in such a way that it always returns EPROBE_DEFER in case of channels that cannot be found. This break the operation of the devices which have optional DMA channels as it puts their drivers in endless deferred probe loop. Fix this by propagating the proper error value. Fixes: 71723a96b8b1 ("dmaengine: Create symlinks between DMA channels and slaves") Signed-off-by: Marek Szyprowski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20200130070834.17537-1-m.szyprowski@samsung.com [vkoul: fix typo in patch title] Signed-off-by: Vinod Koul commit 9253975bcba65bece2d982db06bb959186ec7780 Author: Michal Simek Date: Thu Jan 9 11:07:53 2020 +0530 i2c: cadence: Fix wording in i2c-cadence driver Fix wording based on checkpatch.pl Signed-off-by: Michal Simek Signed-off-by: Shubhrajyoti Datta Signed-off-by: Wolfram Sang commit db3fad841d9bf5c8b002ce86fd82aec32af80fc0 Author: Topi Kuutela Date: Mon Dec 9 16:10:50 2019 +0530 i2c: cadence: Fix power management order of operations E.g. pm_runtime_set_active must be called while the power management system is disabled. Fixes extra hanging clk_enable. Signed-off-by: Topi Kuutela Acked-by: Sören Brinkmann Signed-off-by: Michal Simek Signed-off-by: Shubhrajyoti Datta Signed-off-by: Wolfram Sang commit 69dc44bcbc11fab397b614b1204ce10f3d74219c Author: Shubhrajyoti Datta Date: Mon Dec 9 16:10:49 2019 +0530 i2c: cadence: Fix error printing in case of defer Do not print error in case of EPROBE_DEFER. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Wolfram Sang commit bbf967b223b3f1b55eb494d735226152afbad64e Author: Alex Williams Date: Thu Jan 31 13:39:57 2019 -0800 i2c: cadence: Handle transfer_size rollover Under certain conditions, Cadence's I2C controller's transfer_size register will roll over and generate invalid read transactions. Before this change, the ISR relied solely on the RXDV bit to determine when to write more data to the user's buffer. The invalid read data would cause overruns, smashing stacks and worse. This change stops the buffer writes to the requested boundary and reports the error. The controller will be reset so normal transactions may resume. Signed-off-by: Alex Williams Reviewed-by: Shubhrajyoti Datta Reviewed-by: Michal Simek # in a seperate mail Signed-off-by: Wolfram Sang commit 98c49f1746ac44ccc164e914b9a44183fad09f51 Author: Gustavo A. R. Silva Date: Tue Jan 28 20:26:13 2020 -0600 char: hpet: Fix out-of-bounds read bug Currently, there is an out-of-bounds read on array hpetp->hp_dev in the following for loop: 870 for (i = 0; i < hdp->hd_nirqs; i++) 871 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i]; This is due to the recent change from one-element array to flexible-array member in struct hpets: 104 struct hpets { ... 113 struct hpet_dev hp_dev[]; 114 }; This change affected the total size of the dynamic memory allocation, decreasing it by one time the size of struct hpet_dev. Fix this by adjusting the allocation size when calling struct_size(). Fixes: 987f028b8637c ("char: hpet: Use flexible-array member") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Tetsuo Handa Acked-by: Eric Biggers Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com Signed-off-by: Greg Kroah-Hartman commit d47c7f06268082bc0082a15297a07c0da59b0fc4 Merge: c689b069916c c3463aed05ab Author: Dave Airlie Date: Thu Jan 30 15:18:33 2020 +1000 Merge branch 'linux-5.6' of git://github.com/skeggsb/linux into drm-next A couple of OOPS fixes, fixes for TU1xx if firmware isn't available, better behaviour in the face of GPU faults, and a patch to make HD audio work again after runpm changes. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Mon Jan 13 16:27:47 2020 +0200 ata: pata_arasan_cf: Use dma_request_chan() instead dma_request_slave_channel() dma_request_slave_channel() is a wrapper on top of dma_request_chan() eating up the error code. The dma_request_chan() is the standard API to request slave channel, clients should be moved away from the legacy API to allow us to retire them. Acked-by: Viresh Kumar Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Peter Ujfalusi Signed-off-by: Jens Axboe commit 0265d6e8ddb8901c2c03d09f9444f382a60ba6b1 Author: Juergen Gross Date: Fri Jan 17 15:39:55 2020 +0100 xen/blkfront: limit allocated memory size to actual use case Today the Xen blkfront driver allocates memory for one struct blkfront_ring_info for each communication ring. This structure is statically sized for the maximum supported configuration resulting in a size of more than 90 kB. As the main size contributor is one array inside the struct, the memory allocation can easily be limited by moving this array to be the last structure element and to allocate only the memory for the actually needed array size. Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross Signed-off-by: Jens Axboe commit 5c0dd228b5fc30a3b732c7ae2657e0161ec7ed80 Author: Sun Ke Date: Wed Jan 22 11:18:57 2020 +0800 nbd: add a flush_workqueue in nbd_start_device When kzalloc fail, may cause trying to destroy the workqueue from inside the workqueue. If num_connections is m (2 < m), and NO.1 ~ NO.n (1 < n < m) kzalloc are successful. The NO.(n + 1) failed. Then, nbd_start_device will return ENOMEM to nbd_start_device_ioctl, and nbd_start_device_ioctl will return immediately without running flush_workqueue. However, we still have n recv threads. If nbd_release run first, recv threads may have to drop the last config_refs and try to destroy the workqueue from inside the workqueue. To fix it, add a flush_workqueue in nbd_start_device. Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs") Signed-off-by: Sun Ke Signed-off-by: Jens Axboe commit 6a365874a43c43b227492266f59cd68ecc5a6f83 Author: Stephen Kitt Date: Fri Jan 24 21:03:07 2020 +0100 drbd: fifo_alloc() should use struct_size Switching to struct_size for the allocation in fifo_alloc avoids hard-coding the type of fifo_buffer.values in fifo_alloc. It also provides overflow protection; to avoid pessimistic code being generated by the compiler as a result, this patch also switches fifo_size to unsigned, propagating the change as appropriate. Reviewed-by: Gustavo A. R. Silva Signed-off-by: Stephen Kitt Signed-off-by: Jens Axboe commit 10a663a1b15134a5a714aa515e11425a44d4fdf7 Author: Prabhakar Kushwaha Date: Sat Jan 25 03:37:29 2020 +0000 ata: ahci: Add shutdown to freeze hardware resources of ahci device_shutdown() called from reboot or power_shutdown expect all devices to be shutdown. Same is true for even ahci pci driver. As no ahci shutdown function is implemented, the ata subsystem always remains alive with DMA & interrupt support. File system related calls should not be honored after device_shutdown(). So defining ahci pci driver shutdown to freeze hardware (mask interrupt, stop DMA engine and free DMA resources). Signed-off-by: Prabhakar Kushwaha Signed-off-by: Jens Axboe commit 39bed42de2e7d74686a2d5a45638d6a5d7e7d473 Merge: 83fa805bcbfc 5292e24a6acf Author: Linus Torvalds Date: Wed Jan 29 19:56:50 2020 -0800 Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull mmu_notifier updates from Jason Gunthorpe: "This small series revises the names in mmu_notifier to make the code clearer and more readable" * tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: mm/mmu_notifiers: Use 'interval_sub' as the variable for mmu_interval_notifier mm/mmu_notifiers: Use 'subscription' as the variable name for mmu_notifier mm/mmu_notifier: Rename struct mmu_notifier_mm to mmu_notifier_subscriptions commit 73e4eab0a8dacd0ad6921a1717eb38a959b53f09 Author: Christian Zigotzky Date: Wed Jan 29 20:54:43 2020 -0700 pata_pcmia: add SanDisk High (>8G) CF card to supported list Add new SanDisk High (>8G) CF cards to the pata_pcmcia driver. Signed-off-by: Christian Zigotzky Signed-off-by: Jens Axboe commit a258edbca2d94a4d902daeecb3073c88b57ac7ad Author: Jon Derrick Date: Fri Jan 10 14:56:46 2020 -0700 MAINTAINERS: Add Revanth Rajashekar as a SED-Opal maintainer Scott hasn't worked for Intel for some time and has already given us his blessing. CC: Scott Bauer Signed-off-by: Revanth Rajashekar Signed-off-by: Jon Derrick Signed-off-by: Jens Axboe commit 83fa805bcbfc53ae82eedd65132794ae324798e5 Merge: 896f8d23d0cb 8d19f1c8e193 Author: Linus Torvalds Date: Wed Jan 29 19:38:34 2020 -0800 Merge tag 'threads-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull thread management updates from Christian Brauner: "Sargun Dhillon over the last cycle has worked on the pidfd_getfd() syscall. This syscall allows for the retrieval of file descriptors of a process based on its pidfd. A task needs to have ptrace_may_access() permissions with PTRACE_MODE_ATTACH_REALCREDS (suggested by Oleg and Andy) on the target. One of the main use-cases is in combination with seccomp's user notification feature. As a reminder, seccomp's user notification feature was made available in v5.0. It allows a task to retrieve a file descriptor for its seccomp filter. The file descriptor is usually handed of to a more privileged supervising process. The supervisor can then listen for syscall events caught by the seccomp filter of the supervisee and perform actions in lieu of the supervisee, usually emulating syscalls. pidfd_getfd() is needed to expand its uses. There are currently two major users that wait on pidfd_getfd() and one future user: - Netflix, Sargun said, is working on a service mesh where users should be able to connect to a dns-based VIP. When a user connects to e.g. 1.2.3.4:80 that runs e.g. service "foo" they will be redirected to an envoy process. This service mesh uses seccomp user notifications and pidfd to intercept all connect calls and instead of connecting them to 1.2.3.4:80 connects them to e.g. 127.0.0.1:8080. - LXD uses the seccomp notifier heavily to intercept and emulate mknod() and mount() syscalls for unprivileged containers/processes. With pidfd_getfd() more uses-cases e.g. bridging socket connections will be possible. - The patchset has also seen some interest from the browser corner. Right now, Firefox is using a SECCOMP_RET_TRAP sandbox managed by a broker process. In the future glibc will start blocking all signals during dlopen() rendering this type of sandbox impossible. Hence, in the future Firefox will switch to a seccomp-user-nofication based sandbox which also makes use of file descriptor retrieval. The thread for this can be found at https://sourceware.org/ml/libc-alpha/2019-12/msg00079.html With pidfd_getfd() it is e.g. possible to bridge socket connections for the supervisee (binding to a privileged port) and taking actions on file descriptors on behalf of the supervisee in general. Sargun's first version was using an ioctl on pidfds but various people pushed for it to be a proper syscall which he duely implemented as well over various review cycles. Selftests are of course included. I've also added instructions how to deal with merge conflicts below. There's also a small fix coming from the kernel mentee project to correctly annotate struct sighand_struct with __rcu to fix various sparse warnings. We've received a few more such fixes and even though they are mostly trivial I've decided to postpone them until after -rc1 since they came in rather late and I don't want to risk introducing build warnings. Finally, there's a new prctl() command PR_{G,S}ET_IO_FLUSHER which is needed to avoid allocation recursions triggerable by storage drivers that have userspace parts that run in the IO path (e.g. dm-multipath, iscsi, etc). These allocation recursions deadlock the device. The new prctl() allows such privileged userspace components to avoid allocation recursions by setting the PF_MEMALLOC_NOIO and PF_LESS_THROTTLE flags. The patch carries the necessary acks from the relevant maintainers and is routed here as part of prctl() thread-management." * tag 'threads-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: prctl: PR_{G,S}ET_IO_FLUSHER to support controlling memory reclaim sched.h: Annotate sighand_struct with __rcu test: Add test for pidfd getfd arch: wire up pidfd_getfd syscall pid: Implement pidfd_getfd syscall vfs, fdtable: Add fget_task helper commit 896f8d23d0cb5889021d66eab6107e97109c5459 Merge: 33c84e89abe4 3e4827b05d2a Author: Linus Torvalds Date: Wed Jan 29 18:53:37 2020 -0800 Merge tag 'for-5.6/io_uring-vfs-2020-01-29' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: - Support for various new opcodes (fallocate, openat, close, statx, fadvise, madvise, openat2, non-vectored read/write, send/recv, and epoll_ctl) - Faster ring quiesce for fileset updates - Optimizations for overflow condition checking - Support for max-sized clamping - Support for probing what opcodes are supported - Support for io-wq backend sharing between "sibling" rings - Support for registering personalities - Lots of little fixes and improvements * tag 'for-5.6/io_uring-vfs-2020-01-29' of git://git.kernel.dk/linux-block: (64 commits) io_uring: add support for epoll_ctl(2) eventpoll: support non-blocking do_epoll_ctl() calls eventpoll: abstract out epoll_ctl() handler io_uring: fix linked command file table usage io_uring: support using a registered personality for commands io_uring: allow registering credentials io_uring: add io-wq workqueue sharing io-wq: allow grabbing existing io-wq io_uring/io-wq: don't use static creds/mm assignments io-wq: make the io_wq ref counted io_uring: fix refcounting with batched allocations at OOM io_uring: add comment for drain_next io_uring: don't attempt to copy iovec for READ/WRITE io_uring: honor IOSQE_ASYNC for linked reqs io_uring: prep req when do IOSQE_ASYNC io_uring: use labeled array init in io_op_defs io_uring: optimise sqe-to-req flags translation io_uring: remove REQ_F_IO_DRAINED io_uring: file switch work needs to get flushed on exit io_uring: hide uring_fd in ctx ... commit 76be4414be4a0d17e29e2337167bf976533149cd Author: Randy Dunlap Date: Tue Jan 28 18:22:25 2020 -0800 powerpc: indent to improve Kconfig readability Indent a Kconfig continuation line to improve readability. Signed-off-by: Randy Dunlap Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/ff8729c1-3a4b-c720-48ba-a1a42b0ef892@infradead.org commit 33c84e89abe4a92ab699c33029bd54269d574782 Merge: e9f8ca0ae7b7 11e673206f21 Author: Linus Torvalds Date: Wed Jan 29 18:16:16 2020 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This series is slightly unusual because it includes Arnd's compat ioctl tree here: 1c46a2cf2dbd Merge tag 'block-ioctl-cleanup-5.6' into 5.6/scsi-queue Excluding Arnd's changes, this is mostly an update of the usual drivers: megaraid_sas, mpt3sas, qla2xxx, ufs, lpfc, hisi_sas. There are a couple of core and base updates around error propagation and atomicity in the attribute container base we use for the SCSI transport classes. The rest is minor changes and updates" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (149 commits) scsi: hisi_sas: Rename hisi_sas_cq.pci_irq_mask scsi: hisi_sas: Add prints for v3 hw interrupt converge and automatic affinity scsi: hisi_sas: Modify the file permissions of trigger_dump to write only scsi: hisi_sas: Replace magic number when handle channel interrupt scsi: hisi_sas: replace spin_lock_irqsave/spin_unlock_restore with spin_lock/spin_unlock scsi: hisi_sas: use threaded irq to process CQ interrupts scsi: ufs: Use UFS device indicated maximum LU number scsi: ufs: Add max_lu_supported in struct ufs_dev_info scsi: ufs: Delete is_init_prefetch from struct ufs_hba scsi: ufs: Inline two functions into their callers scsi: ufs: Move ufshcd_get_max_pwr_mode() to ufshcd_device_params_init() scsi: ufs: Split ufshcd_probe_hba() based on its called flow scsi: ufs: Delete struct ufs_dev_desc scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails scsi: ufs-mediatek: enable low-power mode for hibern8 state scsi: ufs: export some functions for vendor usage scsi: ufs-mediatek: add dbg_register_dump implementation scsi: qla2xxx: Fix a NULL pointer dereference in an error path scsi: qla1280: Make checking for 64bit support consistent scsi: megaraid_sas: Update driver version to 07.713.01.00-rc1 ... commit e9f8ca0ae7b7bc9a032b429929431c626a69dd5e Merge: 05ef8b97ddf9 47ace7e012b9 Author: Linus Torvalds Date: Wed Jan 29 18:08:49 2020 -0800 Merge tag 'for-5.6/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Fix DM core's potential for q->make_request_fn NULL pointer in the unlikely case that a DM device is created without a DM table and then accessed due to upper-layer userspace code or user error. - Fix DM thin-provisioning's metadata_pre_commit_callback to not use memory after it is free'd. Also refactor code to disallow changing the thin-pool's data device once in use -- doing so guarantees smae lifetime of pool's data device relative to the pool metadata. - Fix DM space maps used by DM thinp and DM cache to avoid reuse of a already used block. This race was identified with extremely heavy snapshot use in the context of DM thin provisioning. - Fix DM raid's table status relative to an active rebuild. - Fix DM crypt to use GFP_NOIO rather than GFP_NOFS in call to skcipher_request_alloc(). Also fix benbi IV constructor crash if used in authenticated mode. - Add DM crypt support for Elephant diffuser to allow for Bitlocker compatibility. - Fix DM verity target to not prefetch hash blocks for data that has already been verified. - Fix DM writecache's incorrect flush sequence during commit when in SSD mode. - Improve DM writecache's sequential write performance on SSDs. - Add DM zoned target support for zone sizes smaller than 128MiB. - Add DM multipath 'queue_if_no_path_timeout_secs' module param to allow timeout if path isn't reinstated. This allows users a kernel safety-net against IO hanging indefinitely, due to no active paths, that has historically only been provided by multipathd userspace. - Various DM code cleanups to use true/false rather than 1/0, a variable rename in dm-dust, and fix for a math error in comment for DM thin metadata's ondisk format. * tag 'for-5.6/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (21 commits) dm: fix potential for q->make_request_fn NULL pointer dm writecache: improve performance of large linear writes on SSDs dm mpath: Add timeout mechanism for queue_if_no_path dm thin: change data device's flush_bio to be member of struct pool dm thin: don't allow changing data device during thin-pool reload dm thin: fix use-after-free in metadata_pre_commit_callback dm thin metadata: use pool locking at end of dm_pool_metadata_close dm writecache: fix incorrect flush sequence when doing SSD mode commit dm crypt: fix benbi IV constructor crash if used in authenticated mode dm crypt: Implement Elephant diffuser for Bitlocker compatibility dm space map common: fix to ensure new block isn't already in use dm verity: don't prefetch hash blocks for already-verified data dm crypt: fix GFP flags passed to skcipher_request_alloc() dm thin metadata: Fix trivial math error in on-disk format documentation dm thin metadata: use true/false for bool variable dm snapshot: use true/false for bool variable dm bio prison v2: use true/false for bool variable dm mpath: use true/false for bool variable dm zoned: support zone sizes smaller than 128MiB dm raid: table line rebuild status fixes ... commit 05ef8b97ddf9aed40df977477daeab01760d7f9a Merge: 08a3ef8f6b0b 77ce1a47ebca Author: Linus Torvalds Date: Wed Jan 29 15:27:31 2020 -0800 Merge tag 'docs-5.6' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It has been a relatively quiet cycle for documentation, but there's still a couple of things of note: - Conversion of the NFS documentation to RST - A new document on how to help with documentation (and a maintainer profile entry too) Plus the usual collection of typo fixes, etc" * tag 'docs-5.6' of git://git.lwn.net/linux: (40 commits) docs: filesystems: add overlayfs to index.rst docs: usb: remove some broken references scripts/find-unused-docs: Fix massive false positives docs: nvdimm: use ReST notation for subsection zram: correct documentation about sysfs node of huge page writeback Documentation: zram: various fixes in zram.rst Add a maintainer entry profile for documentation Add a document on how to contribute to the documentation docs: Keep up with the location of NoUri Documentation: Call out example SYM_FUNC_* usage as x86-specific Documentation: nfs: fault_injection: convert to ReST Documentation: nfs: pnfs-scsi-server: convert to ReST Documentation: nfs: convert pnfs-block-server to ReST Documentation: nfs: idmapper: convert to ReST Documentation: convert nfsd-admin-interfaces to ReST Documentation: nfs-rdma: convert to ReST Documentation: nfsroot.rst: COSMETIC: refill a paragraph Documentation: nfsroot.txt: convert to ReST Documentation: convert nfs.txt to ReST Documentation: filesystems: convert vfat.txt to RST ... commit 08a3ef8f6b0b1341c670caba35f782c9a452d488 Merge: ce7ae9d9fe43 35c57fc3f8ea Author: Linus Torvalds Date: Wed Jan 29 15:25:34 2020 -0800 Merge tag 'linux-kselftest-5.6-rc1-kunit' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest kunit updates from Shuah Khan: "This kunit update consists of: - Support for building kunit as a module from Alan Maguire - AppArmor KUnit tests for policy unpack from Mike Salvatore" * tag 'linux-kselftest-5.6-rc1-kunit' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: building kunit as a module breaks allmodconfig kunit: update documentation to describe module-based build kunit: allow kunit to be loaded as a module kunit: remove timeout dependence on sysctl_hung_task_timeout_seconds kunit: allow kunit tests to be loaded as a module kunit: hide unexported try-catch interface in try-catch-impl.h kunit: move string-stream.h to lib/kunit apparmor: add AppArmor KUnit tests for policy unpack commit ce7ae9d9fe4391413db680ce0732da2144b6f4a3 Merge: 22b17db4ea05 af4ddd607dff Author: Linus Torvalds Date: Wed Jan 29 15:24:03 2020 -0800 Merge tag 'linux-kselftest-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest update from Shuah Khan: "This Kselftest update consists of several fixes to framework and individual tests. In addition, it enables LKDTM tests adding lkdtm target to kselftest Makefile" * tag 'linux-kselftest-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/ftrace: fix glob selftest selftests: settings: tests can be in subsubdirs kselftest: Minimise dependency of get_size on C library interfaces selftests/livepatch: Remove unused local variable in set_ftrace_enabled() selftests/livepatch: Replace set_dynamic_debug() with setup_config() in README selftests/lkdtm: Add tests for LKDTM targets selftests: Uninitialized variable in test_cgcore_proc_migration() selftests: fix build behaviour on targets' failures commit 01b810ed71878785d189d01e4d7425a11203d7a8 Merge: b647d2bd8064 d36925be5382 Author: Bjorn Helgaas Date: Wed Jan 29 17:00:08 2020 -0600 Merge branch 'remotes/lorenzo/pci/uniphier' - Remove unused modular code from uniphier, which cannot be built as a module (Masahiro Yamada) * remotes/lorenzo/pci/uniphier: PCI: uniphier: remove module code from built-in driver commit b647d2bd8064c6a5113e7b50e3adbbf6108d7e21 Merge: c11dfed9caa2 21a92676e1fe Author: Bjorn Helgaas Date: Wed Jan 29 17:00:07 2020 -0600 Merge branch 'remotes/lorenzo/pci/tegra' - Fix checking of pm_runtime_get_sync() return value (David Engraf) - Fix AFI_PEX2_CTRL reg offset for Tegra30 (Marcel Ziswiler) * remotes/lorenzo/pci/tegra: PCI: tegra: Fix afi_pex2_ctrl reg offset for Tegra30 PCI: tegra: Fix return value check of pm_runtime_get_sync() commit c11dfed9caa2a01237fd4281fc3b44b1e6425d8b Merge: d86936363c10 ed8cc3b1fc84 Author: Bjorn Helgaas Date: Wed Jan 29 17:00:06 2020 -0600 Merge branch 'remotes/lorenzo/pci/qcom' - Add DT clock/reset info for SDM845 PCIe controller (Bjorn Andersson) - Add support for SDM845 PCIe controller to the qcom driver (Bjorn Andersson) * remotes/lorenzo/pci/qcom: PCI: qcom: Add support for SDM845 PCIe controller dt-bindings: PCI: qcom: Add support for SDM845 PCIe commit d86936363c108bcd7fa1635601f78633c7ee1f71 Merge: 518fc4a3a609 216bbaa337bf Author: Bjorn Helgaas Date: Wed Jan 29 17:00:05 2020 -0600 Merge branch 'remotes/lorenzo/pci/misc' - Fix "EXYNOS" typographical styling (Krzysztof Kozlowski) - Update MAINTAINERS with Andrew Murray's email address (Andrew Murray) * remotes/lorenzo/pci/misc: MAINTAINERS: Update my email address PCI: exynos: Rename Exynos to lowercase commit 518fc4a3a609dd5a5ce7044fed1338c76511a182 Merge: 4c6a8fe3aaa5 b0de922af53e Author: Bjorn Helgaas Date: Wed Jan 29 17:00:05 2020 -0600 Merge branch 'remotes/lorenzo/pci/keystone' - Fix link training so we can do it more than once (Yurii Monakov) - Fix keystone outbound window mapping (Yurii Monakov) - Fix error handling when DT lacks "num-viewport" (Kishon Vijay Abraham I) * remotes/lorenzo/pci/keystone: PCI: keystone: Fix error handling when "num-viewport" DT property is not populated PCI: keystone: Fix outbound region mapping PCI: keystone: Fix link training retries initiation commit 4c6a8fe3aaa5ea5508207e062fdd67014fbdd2f7 Merge: 61d02c37fcd0 6fd622c226e6 Author: Bjorn Helgaas Date: Wed Jan 29 17:00:04 2020 -0600 Merge branch 'remotes/lorenzo/pci/dwc' - Add intel-gw driver for PCIe host controller on Intel Gateway SoC (Dilip Kota) - Use shared DesignWare helpers to configure Fast Training Sequence (FTS) in artpec6 (Dilip Kota) * remotes/lorenzo/pci/dwc: PCI: artpec6: Configure FTS with dwc helper function PCI: dwc: intel: PCIe RC controller driver dt-bindings: PCI: intel: Add YAML schemas for the PCIe RC controller commit 61d02c37fcd0b7d3adc8a51160b9335a7b24638f Merge: db83c269d225 40ca1bf580ef Author: Bjorn Helgaas Date: Wed Jan 29 17:00:03 2020 -0600 Merge branch 'remotes/lorenzo/pci/brcmstb' - Add brcmstb PCIe bindings for Raspberry Pi 4 (Jim Quinlan) - Add Broadcom STB PCIe host controller driver (Jim Quinlan) - Add MSI support for Broadcom STB PCIe host controller driver (Jim Quinlan) * remotes/lorenzo/pci/brcmstb: PCI: brcmstb: Add MSI support PCI: brcmstb: Add Broadcom STB PCIe host controller driver dt-bindings: PCI: Add bindings for brcmstb's PCIe device commit db83c269d22598ec1f5e3e6692a58a92a153e5f1 Merge: c7417cf36aab db51b4c85fb7 Author: Bjorn Helgaas Date: Wed Jan 29 17:00:02 2020 -0600 Merge branch 'pci/host-vmd' - Save VMD's pci_dev in x86 struct pci_sysdata (Jon Derrick) - Add pci_real_dma_dev() for DMA aliases not on the same bus as requester (Jon Derrick) - Add IOMMU mappings for pci_real_dma_dev() (Jon Derrick) - Remove IOMMU sanity checks for VMD devices (Jon Derrick) - Remove VMD dma_map_ops overrides (Jon Derrick) - Remove unused X86_DEV_DMA_OPS (Christoph Hellwig) - Add VMD device IDs that need bus restriction mode (Sushma Kalakota) * pci/host-vmd: PCI: vmd: Add two VMD Device IDs x86/PCI: Remove X86_DEV_DMA_OPS PCI: vmd: Remove dma_map_ops overrides iommu/vt-d: Remove VMD child device sanity check iommu/vt-d: Use pci_real_dma_dev() for mapping PCI: Introduce pci_real_dma_dev() x86/PCI: Expose VMD's pci_dev in struct pci_sysdata x86/PCI: Add to_pci_sysdata() helper commit c7417cf36aabb93f3b1e37b7e28bece46711429e Merge: 5272b7fc3a45 7b90dfc4873b Author: Bjorn Helgaas Date: Wed Jan 29 17:00:01 2020 -0600 Merge branch 'pci/virtualization' - Fix memory leak in pci_iov_add_virtfn() (Navid Emamdoost) - Extend pci_add_dma_alias() so it can add a range of aliases (James Sewart) - Add DMA aliases for PLX PEX NTB (James Sewart) * pci/virtualization: PCI: Add DMA alias quirk for PLX PEX NTB PCI: Add nr_devfns parameter to pci_add_dma_alias() PCI: Fix pci_add_dma_alias() bitmask size PCI/IOV: Fix memory leak in pci_iov_add_virtfn() commit 5272b7fc3a45466a01d58a3169423218e218bc4c Merge: cee538f6a24e 7a30ebb9f2a2 Author: Bjorn Helgaas Date: Wed Jan 29 17:00:00 2020 -0600 Merge branch 'pci/switchtec' - Support 64-bit addressing for both streaming and coherent DMA (Wesley Sheng) - Read vep_vector_number with 16-bit, not 32-bit read (Logan Gunthorpe) - Add Intercomm Notify and Upstream Error Containment support (Logan Gunthorpe) - Remove redundant valid PFF number count (Wesley Sheng) - Avoid unnecessary CSR read in ISR (Wesley Sheng) - Rename Gen3-specific constants (Logan Gunthorpe) - Rework infrastructure to support Gen3- and Gen4-specific code (Logan Gunthorpe) - Add Gen4 system info register support (Logan Gunthorpe) - Add Gen4 flash information interface support (Kelvin Cao) - Add Gen4 MRPC GAS access permission check (Kelvin Cao) * pci/switchtec: PCI/switchtec: Add Gen4 device IDs PCI/switchtec: Add Gen4 MRPC GAS access permission check PCI/switchtec: Add Gen4 flash information interface support PCI/switchtec: Add Gen4 system info register support PCI/switchtec: Separate Gen3 register structures into unions PCI/switchtec: Factor out Gen3 ioctl_flash_part_info() PCI/switchtec: Add 'generation' variable PCI/switchtec: Rename generation-specific constants PCI/switchtec: Move check event ID from mask_event() to switchtec_event_isr() PCI/switchtec: Remove redundant valid PFF number count PCI/switchtec: Add support for Intercomm Notify and Upstream Error Containment PCI/switchtec: Fix vep_vector_number ioread width PCI/switchtec: Use dma_set_mask_and_coherent() commit cee538f6a24eefdbdb7820d3e97b120d496bb345 Merge: f629ddc9cd3d 948675736a77 Author: Bjorn Helgaas Date: Wed Jan 29 16:59:59 2020 -0600 Merge branch 'pci/resource' - Clear only bridge windows (not BARs) while assigning bus resources (Logan Gunthorpe) - Improve resource assignment for deep hotplug hierarchies, e.g., Thunderbolt (Nicholas Johnson) * pci/resource: PCI: Allow adjust_bridge_window() to shrink resource if necessary PCI: Set resource size directly in adjust_bridge_window() PCI: Rename extend_bridge_window() to adjust_bridge_window() PCI: Rename extend_bridge_window() parameter PCI: Consider alignment of hot-added bridges when assigning resources PCI: Remove local variable usage in pci_bus_distribute_available_resources() PCI: Pass size + alignment to pci_bus_distribute_available_resources() PCI: Rename variables PCI: Remove unnecessary braces PCI: Don't disable bridge BARs when assigning bus resources commit f629ddc9cd3d88363f58ad3130165fcdff837779 Merge: 4161953f9545 47b802d5d80c Author: Bjorn Helgaas Date: Wed Jan 29 16:59:58 2020 -0600 Merge branch 'pci/pm' - Print config space before suspend for debugging (Chen Yu) * pci/pm: PCI/PM: Print config space of devices before suspend commit 4161953f95454c4ad465fcc01cca1c870dd1057f Merge: 04df6ad95a5e bc123a515cb7 Author: Bjorn Helgaas Date: Wed Jan 29 16:59:58 2020 -0600 Merge branch 'pci/p2pdma' - Add Intel SkyLake-E to the whitelist of host bridges that support peer-to-peer DMA (Armen Baloyan) * pci/p2pdma: PCI/P2PDMA: Add Intel SkyLake-E to the whitelist commit 04df6ad95a5e4bf332c9ed364ddb24ac3e9d334c Merge: ba51b7188db4 7730c3be06e2 Author: Bjorn Helgaas Date: Wed Jan 29 16:59:57 2020 -0600 Merge branch 'pci/misc' - Fix Broadcom iProc quirk so it's applied regardless of whether the iproc driver is built-in or a module (Wei Liu) - Add extra delay when resuming AMD Ryzen5/7 XHCI controllers from D3hot so they work after resume from runtime suspend or suspend-to-idle (Daniel Drake) - Fix pci_alloc_irq_vectors() function name typo in docs (Zenghui Yu) * pci/misc: Documentation: PCI: Fix pci_alloc_irq_vectors() function name typo PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers PCI: Add generic quirk for increasing D3hot delay PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in commit ba51b7188db4a879d600d95471adac24a7b90a66 Merge: e42617b825f8 d95f20c4f070 Author: Bjorn Helgaas Date: Wed Jan 29 16:59:57 2020 -0600 Merge branch 'pci/aer' - Log a message to identify the device that caused AER/DPC recovery to fail (Yicong Yang) - Initialize aer_fifo before use (Dongdong Liu) * pci/aer: PCI/AER: Initialize aer_fifo PCI/AER: Factor message prefixes with dev_fmt() PCI/AER: Log which device prevents error recovery commit 948675736a77cb951b40bcb646d22dd794f8ed14 Author: Nicholas Johnson Date: Mon Jan 6 15:48:06 2020 +0000 PCI: Allow adjust_bridge_window() to shrink resource if necessary Remove checks for resource size in adjust_bridge_window(). This is necessary to allow pci_bus_distribute_available_resources() to function when the kernel parameter "pci=hpmemsize=nn[KMG]" is used to allocate resources. Because the kernel parameter sets the size of all hotplug bridges to be the same, there are problems when nested hotplug bridges are encountered. Fitting a downstream hotplug bridge with size X and normal bridges with non-zero size Y into parent hotplug bridge with size X is impossible, and hence the downstream hotplug bridge needs to shrink to fit into its parent. Add check for if bridge is extended or shrunken and reflect that in the call to pci_dbg(). Reset the resource if its new size is zero (if we have run out of a bridge window resource) to prevent the PCI resource assignment code from attempting to assign a zero-sized resource. Link: https://lore.kernel.org/r/PSXP216MB0438D3E2CFE64EBAA32AF691803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit ae4611f1d7e99eda6916bbc5fc8df26516edf95e Author: Nicholas Johnson Date: Mon Jan 6 15:47:46 2020 +0000 PCI: Set resource size directly in adjust_bridge_window() Change adjust_bridge_window() to set resource size directly instead of using additional resource lists. Because additional resource lists are optional resources, any algorithm that requires guaranteed allocation that uses them cannot be guaranteed to work. Remove the resource from add_list, as a zero-sized additional resource is redundant. Update comment in pci_bus_distribute_available_resources() to reflect the above changes. Link: https://lore.kernel.org/r/PSXP216MB04386BA48874B56BC5CB0292803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 1e58f4e1cb47de03988f8b14f07f6941acc7e669 Author: Nicholas Johnson Date: Mon Jan 6 15:47:26 2020 +0000 PCI: Rename extend_bridge_window() to adjust_bridge_window() Rename extend_bridge_window() to adjust_bridge_window() to prepare for the fact that the window will be able to shrink. No functional change intended. Link: https://lore.kernel.org/r/PSXP216MB0438C47B3473D0C9DE531F18803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 3d264da9b741fc6503ea54e3bb65c08a77dabca4 Author: Nicholas Johnson Date: Mon Jan 6 15:47:05 2020 +0000 PCI: Rename extend_bridge_window() parameter In extend_bridge_window(), change "available" parameter name to "new_size". This makes more sense as this parameter represents the new size for the window. No functional change intended. Link: https://lore.kernel.org/r/PSXP216MB043853617ECA4118C472A417803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit f924c26e4ee651493f602da2a3d7ff628824e636 Author: Nicholas Johnson Date: Mon Jan 6 15:46:13 2020 +0000 PCI: Consider alignment of hot-added bridges when assigning resources Change pci_bus_distribute_available_resources() to better handle bridges with different resource alignment requirements. The arguments io, mmio and mmio_pref represent the start and end addresses of resource, into which we must fit the current bridge window. The steps taken by pci_bus_distribute_available_resources(): - For io, mmio and mmio_pref, increase .start to align with the alignment of the current bridge window (otherwise the current bridge window may not fit within the available range). - For io, mmio and mmio_pref, adjust the current bridge window to the size after the above. - Count the number of hotplug bridges and normal bridges on this bus. - If the total number of bridges is one, give that bridge all of the resources and return. - If there are no hotplug bridges, return. - For io, mmio and mmio_pref, increase .start by the amount required for each bridge resource on the bus for non hotplug bridges, giving extra room to make up for alignment of those resources. - For io, mmio and mmio_pref, calculate the resource size per hotplug bridge which is available after the previous steps. - For io, mmio and mmio_pref, distribute the resources to each hotplug bridge, with the sizes calculated above. The motivation for fixing this is enabling devices that require greater than 1MB alignment. This fixes the case where the user hot-adds devices with BAR alignment >1MB and Linux fails to assign resources to it. Link: https://bugzilla.kernel.org/show_bug.cgi?id=199581 Link: https://lore.kernel.org/r/PSXP216MB0438C2BFD0FD3691ED9C83F4803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM Reported-by: Mika Westerberg Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 7779385484dad7c95b624f7c9ee1aa07ab8cf43b Author: Nicholas Johnson Date: Tue Jan 28 15:57:09 2020 -0600 PCI: Remove local variable usage in pci_bus_distribute_available_resources() In pci_bus_distribute_available_resources(), use resource_size() rather than the local available_io, etc. No functional change intended; this just makes the preceding patch smaller. [bhelgaas: extracted from https://lore.kernel.org/r/PSXP216MB0438587C47CBEDF365B1EA27803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM] Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit d555a50fd6e0280735cabf8581feff875f3f39d7 Author: Nicholas Johnson Date: Mon Jan 6 15:45:52 2020 +0000 PCI: Pass size + alignment to pci_bus_distribute_available_resources() Change pci_bus_distribute_available_resources() arguments from resource_size_t to struct resource to add more information required to get the alignment correct for bridge windows with alignment >1M. We require (size, alignment), instead of just (size) which is what is currently available. The change from resource_size_t to struct resource does just that. Note that the struct resource arguments are passed by value and not by reference. We do not want to pass by reference and change the resource size of the parent bridge window. We only want the size information. No functional change intended. Link: https://lore.kernel.org/r/PSXP216MB0438587C47CBEDF365B1EA27803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM [bhelgaas: split parts to other patches to reduce the size of this one] Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 053eb5c150fd732624a1ea2f456337972d52b163 Author: Nicholas Johnson Date: Tue Jan 28 14:59:23 2020 -0600 PCI: Rename variables In pci_bus_distribute_available_resources(), rename: io => io_per_hp mmio => mmio_per_hp mmio_pref => mmio_pref_per_hp No functional change; this is just to make a subsequent patch smaller. [bhelgaas: extracted from https://lore.kernel.org/r/PSXP216MB0438587C47CBEDF365B1EA27803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM] Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 22b17db4ea05561c7c8e4d770f10751e22e339f9 Merge: a4fe2b4d87c9 c4e71212a245 Author: Linus Torvalds Date: Wed Jan 29 14:55:47 2020 -0800 Merge tag 'y2038-drivers-for-v5.6-signed' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground Pull y2038 updates from Arnd Bergmann: "Core, driver and file system changes These are updates to device drivers and file systems that for some reason or another were not included in the kernel in the previous y2038 series. I've gone through all users of time_t again to make sure the kernel is in a long-term maintainable state, replacing all remaining references to time_t with safe alternatives. Some related parts of the series were picked up into the nfsd, xfs, alsa and v4l2 trees. A final set of patches in linux-mm removes the now unused time_t/timeval/timespec types and helper functions after all five branches are merged for linux-5.6, ensuring that no new users get merged. As a result, linux-5.6, or my backport of the patches to 5.4 [1], should be the first release that can serve as a base for a 32-bit system designed to run beyond year 2038, with a few remaining caveats: - All user space must be compiled with a 64-bit time_t, which will be supported in the coming musl-1.2 and glibc-2.32 releases, along with installed kernel headers from linux-5.6 or higher. - Applications that use the system call interfaces directly need to be ported to use the time64 syscalls added in linux-5.1 in place of the existing system calls. This impacts most users of futex() and seccomp() as well as programming languages that have their own runtime environment not based on libc. - Applications that use a private copy of kernel uapi header files or their contents may need to update to the linux-5.6 version, in particular for sound/asound.h, xfs/xfs_fs.h, linux/input.h, linux/elfcore.h, linux/sockios.h, linux/timex.h and linux/can/bcm.h. - A few remaining interfaces cannot be changed to pass a 64-bit time_t in a compatible way, so they must be configured to use CLOCK_MONOTONIC times or (with a y2106 problem) unsigned 32-bit timestamps. Most importantly this impacts all users of 'struct input_event'. - All y2038 problems that are present on 64-bit machines also apply to 32-bit machines. In particular this affects file systems with on-disk timestamps using signed 32-bit seconds: ext4 with ext3-style small inodes, ext2, xfs (to be fixed soon) and ufs" [1] https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git/log/?h=y2038-endgame * tag 'y2038-drivers-for-v5.6-signed' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: (21 commits) Revert "drm/etnaviv: reject timeouts with tv_nsec >= NSEC_PER_SEC" y2038: sh: remove timeval/timespec usage from headers y2038: sparc: remove use of struct timex y2038: rename itimerval to __kernel_old_itimerval y2038: remove obsolete jiffies conversion functions nfs: fscache: use timespec64 in inode auxdata nfs: fix timstamp debug prints nfs: use time64_t internally sunrpc: convert to time64_t for expiry drm/etnaviv: avoid deprecated timespec drm/etnaviv: reject timeouts with tv_nsec >= NSEC_PER_SEC drm/msm: avoid using 'timespec' hfs/hfsplus: use 64-bit inode timestamps hostfs: pass 64-bit timestamps to/from user space packet: clarify timestamp overflow tsacct: add 64-bit btime field acct: stop using get_seconds() um: ubd: use 64-bit time_t where possible xtensa: ISS: avoid struct timeval dlm: use SO_SNDTIMEO_NEW instead of SO_SNDTIMEO_OLD ... commit a4fe2b4d87c9f2298ae6a641a7a64bc941d079d0 Merge: 3893c2025fec def97da13651 Author: Linus Torvalds Date: Wed Jan 29 14:53:23 2020 -0800 Merge tag 'printk-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk update from Petr Mladek: "Prevent replaying log on all consoles" * tag 'printk-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: printk: fix exclusive_console replaying commit db51b4c85fb756f33617c1d29643e57be9bd2f1d Author: Sushma Kalakota Date: Wed Jan 8 15:05:10 2020 -0700 PCI: vmd: Add two VMD Device IDs Add new VMD device IDs that require the bus restriction mode. Signed-off-by: Sushma Kalakota Signed-off-by: Jon Derrick Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas commit 3e4827b05d2ac2d377ed136a52829ec46787bf4b Author: Jens Axboe Date: Wed Jan 8 15:18:09 2020 -0700 io_uring: add support for epoll_ctl(2) This adds IORING_OP_EPOLL_CTL, which can perform the same work as the epoll_ctl(2) system call. Signed-off-by: Jens Axboe commit 39220e8d4a2aaab045ea03cc16d737e85d0817bf Author: Jens Axboe Date: Wed Jan 8 15:05:37 2020 -0700 eventpoll: support non-blocking do_epoll_ctl() calls Also make it available outside of epoll, along with the helper that decides if we need to copy the passed in epoll_event. Signed-off-by: Jens Axboe commit 58e41a44c488f3e9601fd8150f58377ef8f44889 Author: Jens Axboe Date: Wed Jan 8 14:35:13 2020 -0700 eventpoll: abstract out epoll_ctl() handler No functional changes in this patch. Signed-off-by: Jens Axboe commit f53938d2c79ae3c768dc92b1c3d898dfe820a491 Author: Jarkko Nikula Date: Thu Jan 16 09:46:51 2020 +0200 i2c: i801: Add support for Intel Comet Lake PCH-V Add support for Intel Comet Lake PCH-V which is based on Intel Kaby Lake. Difference between it and other Comet Lake variants is that former uses previous iTCO version 4 and latter use version 6 like Intel Cannon Lake PCH. Signed-off-by: Jarkko Nikula Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 4fcb445ec688a62da9c864ab05a4bd39b0307cdc Author: Luca Ceresoli Date: Wed Jan 29 16:19:53 2020 +0100 docs: i2c: writing-clients: properly name the stop condition In I2C there is no such thing as a "stop bit". Use the proper naming: "stop condition". Signed-off-by: Luca Ceresoli Reported-by: Jean Delvare Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit ca5dbb0272cc30bbebd40315bb8a329e780f347a Author: Luca Ceresoli Date: Wed Jan 29 16:19:52 2020 +0100 docs: i2c: i2c-protocol: use same wording as smbus-protocol In smbus-protocol.rst we use the text "Implemented by" for the same meaning as "This corresponds to". Change everything to "Implemented by" for coherency. Signed-off-by: Luca Ceresoli Reported-by: Jean Delvare Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit f6fcefa10fdbc852ececadb1fd600570228b49ab Author: Luca Ceresoli Date: Wed Jan 29 16:19:51 2020 +0100 docs: i2c: rename sections so the overall picture is clearer Some of the section names are not very clear. Reading those names in the index.rst page does not help much in grasping what the content is supposed to be. Rename those sections to clarify their content, especially when reading the index page. Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 1ef0572296273b634339dd9c640c20ce1b8f436f Author: Luca Ceresoli Date: Wed Jan 29 16:19:50 2020 +0100 docs: i2c: old-module-parameters: use monospace instead of "" Use a monospace (literal) formatting for better readability of sysfs attributes and the "dummy" client name. This looks much more readable in ReST-generated output. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit dfea2b16cc993ff00d0e1c137fd9b3e8f4badcd3 Author: Luca Ceresoli Date: Wed Jan 29 16:19:49 2020 +0100 docs: i2c: old-module-parameters: clarify this is for obsolete kernels This section applies only to code for very old kernels. Avoid people reading this unnecessarily. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 899b56b37eb64ce1406e5de079147984b284f439 Author: Luca Ceresoli Date: Wed Jan 29 16:19:48 2020 +0100 docs: i2c: old-module-parameters: fix internal hyperlink Use ReST syntax so that a proper hyperlink is generated. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 22714ef85478f7ff3a2dfd3e2bc854b72271ab8f Author: Luca Ceresoli Date: Wed Jan 29 16:19:47 2020 +0100 docs: i2c: instantiating-devices: use monospace for sysfs attributes Use a monospace (literal) formatting for better readability of sysfs attributes. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit da9a80bf1976148cfb26feebe34b626cd460f3d3 Author: Luca Ceresoli Date: Wed Jan 29 16:19:46 2020 +0100 docs: i2c: instantiating-devices: rearrange static instatiation Among the "static" instantiation methods the "board file" method is described first. Move it as last, since it is being replaced by the other methods. Also fix subsubsection heading syntax and remove the "Method 1[abc]" prefix as the subsubsection structure clarifies the logical hierarchy. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 4f71daf6294be7f376b52c668f044575764d97b3 Author: Luca Ceresoli Date: Wed Jan 29 16:19:45 2020 +0100 docs: i2c: instantiating-devices: fix internal hyperlink Use ReST syntax so that a proper hyperlink is generated. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 95b83774e310fa5ef8fc60434ac55fe3dc375adc Author: Luca Ceresoli Date: Wed Jan 29 16:19:44 2020 +0100 docs: i2c: smbus-protocol: improve I2C Block transactions description Clarify from the beginning what these transactions are, and specifically how they differ from the SMBus counterparts, i.e. the lack of a Count byte. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit c7148b059c2f88b2b70325cfe45a3271f5c16c43 Author: Luca Ceresoli Date: Wed Jan 29 16:19:43 2020 +0100 docs: i2c: smbus-protocol: fix punctuation Remove misplaced dot before colon. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 414a596454a68c8672d339c916d8d2ed03245444 Author: Luca Ceresoli Date: Wed Jan 29 16:19:42 2020 +0100 docs: i2c: smbus-protocol: fix typo The subject is plural, fix the verb. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit b36cbb70e4a2b81b26042b04538ffa69cfa24642 Author: Luca Ceresoli Date: Wed Jan 29 16:19:41 2020 +0100 docs: i2c: smbus-protocol: fix kernel-doc function syntax This clarifies these are functions (and would/will adds a hyperlink to the function documentation if/when documented). Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 3c13f1fbec59c75b115392b18271701ed6f77242 Author: Luca Ceresoli Date: Wed Jan 29 16:19:40 2020 +0100 docs: i2c: smbus-protocol: enable kernel-doc function syntax Hyperlinks from function names are not generated in headings. Move them in the plain text so they are rendered as clickable hyperlinks. While there also remove an unneeded colon in a heading. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 9e89d61878f2969bfe018881566bc78871a00fa1 Author: Luca Ceresoli Date: Wed Jan 29 16:19:39 2020 +0100 docs: i2c: smbus-protocol: use proper names for ACK and NACK Use the proper ACK and NACK naming from the I2C specification instead of "accept" and "reverse accept". Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 026c0fe666dfa2cc759467b5e2dd3d963b5f43fb Author: Luca Ceresoli Date: Wed Jan 29 16:19:38 2020 +0100 docs: i2c: smbus-protocol: remove unneeded colons from table These colons are not needed: the columns already nicely separate the symbols from their description. They are also inconsistently preceded by whitespace. Remove the colons completely to simplify and clean up. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit c0faa8a6be2465f6df8bf1249df321e6966fa062 Author: Luca Ceresoli Date: Wed Jan 29 16:19:37 2020 +0100 docs: i2c: smbus-protocol: properly name start and stop conditions In I2C there is no such thing as a "start bit" or a "stop bit". Use the proper naming: "start condition" and "stop condition". Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 924fbb4d2eb8941ff576b6dca57dff8222048cb5 Author: Luca Ceresoli Date: Wed Jan 29 16:19:36 2020 +0100 docs: i2c: smbus-protocol: fix link syntax Use the proper ReST syntax to generate a valid hyperlink. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit db0d7424e774d830eb998de1b13b937ae6a55335 Author: Luca Ceresoli Date: Wed Jan 29 16:19:35 2020 +0100 docs: i2c: i2c-protocol: use proper names for ACK and NACK Use the proper ACK and NACK naming from the I2C specification instead of "accept" and "reverse accept". Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 02622c88618bb24faf50c51926e744e9e3ab334d Author: Luca Ceresoli Date: Wed Jan 29 16:19:34 2020 +0100 docs: i2c: i2c-protocol: remove unneeded colons from table These colons are not needed: the columns already nicely separate the symbols from their description. They are also inconsistently preceded by whitespace. Remove the colons completely to simplify and clean up. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit f954731d2af433ce012f8dc456206eccd3cf2ee4 Author: Luca Ceresoli Date: Wed Jan 29 16:19:33 2020 +0100 docs: i2c: i2c-protocol: properly name start and stop conditions In I2C there is no such thing as a "start bit" or a "stop bit". Use the proper naming: "start condition" and "stop condition". Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit f72beb8bf9c401483a08fb548bbc9b946680a637 Author: Luca Ceresoli Date: Wed Jan 29 16:19:32 2020 +0100 docs: i2c: i2c-protocol: fix kernel-doc function syntax This clarifies these are functions and adds a hyperlink to the function documentation. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 48ca3b7fb82ccc00a20e8d97f35ee7e6813ac1f9 Author: Luca Ceresoli Date: Wed Jan 29 16:19:31 2020 +0100 docs: i2c: replace "I2C-transfer" -> "I2C transfer" consistently "I2C transfer" is a legitimate english sentence, no need for a hyphen between the two words, as as such it is used in most of the documentation. Remove the hyphen in the few places where it is present. Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 40c573d12ea5d13c740322f6b9cdd93e593ceb1d Author: Luca Ceresoli Date: Wed Jan 29 16:19:30 2020 +0100 docs: i2c: fix typo Fix "issus" -> "issues". Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 2f07c05f14a8bf5ee815e159a451d580d9113db9 Author: Luca Ceresoli Date: Wed Jan 29 16:19:29 2020 +0100 docs: i2c: call it "I2C" consistently Uppercase "I2C" is used almost everywhere in the docs, but the lowercase version "i2c" is used somewhere. Use the uppercase form consistently. Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 020bc5b9296af6d3e0b255cff3a2674191287624 Author: Luca Ceresoli Date: Wed Jan 29 16:19:28 2020 +0100 docs: i2c: summary: rewrite the "terminology" section This section, partly dating back to the pre-git era, is somewhat unclear and partly incorrect. Rewrite it almost completely including a reference figure, concise but precise definition of each term and the paths where drivers are found. Particular care has been put in clarifying the relation between adapter and algorithm, which has no correspondence in the I2C spec terminology. Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 096c22f88ea09dab449f039863a46cb504b9b3ec Author: Luca Ceresoli Date: Wed Jan 29 16:19:27 2020 +0100 docs: i2c: summary: extend introduction - state the "official" name (I²C, not I2C, according to the spec) at the beginning but keep using the more practical I2C elsewhere - mention some known different names - add link to the specification document Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 21593938086fa2886fe07d06aaeb674254a02e3f Author: Luca Ceresoli Date: Wed Jan 29 16:19:26 2020 +0100 docs: i2c: sort index logically The index page currently lists sections in alphabetical file order without caring about their content. Sort sections based on their content logically, according to the following structure: * Intro to I2C/SMBus and their usage in Linux: summary, i2c-protocol, smbus-protocol, instantiating-devices, busses/index, i2c-topology, muxes/i2c-mux-gpio * Implementing drivers: writing-clients, dev-interface, dma-considerations, fault-codes, functionality * Debugging: gpio-fault-injection, i2c-stub * Slave I2C: slave-interface, slave-eeprom-backend * Advanced: ten-bit-addresses * Obsolete info: upgrading-clients, old-module-parameters Signed-off-by: Luca Ceresoli Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 4a890148df4740a6fce25f9bd4a70d1587a8e8e8 Merge: 6810df46c418 e65e228eb096 Author: Wolfram Sang Date: Wed Jan 29 21:59:20 2020 +0100 Merge branch 'i2c-mux/for-next' of https://github.com/peda-r/i2c-mux into i2c/for-5.6 The main feature is the idle-state rework of the pca954x driver from Biwen Li. commit 6810df46c41879eba8437ab020c7abf5d1db827e Merge: 878508aed477 cd5676db0574 Author: Wolfram Sang Date: Wed Jan 29 21:56:36 2020 +0100 Merge tag 'at24-updates-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-5.6 at24 updates for linux v5.6 - minor maintenance: update the license tag, sort headers - move support for the write-protect pin into nvmem core - add a reference to the new wp-gpios property in nvmem to at25 bindings - add support for regulator and pm_runtime control commit 878508aed4776a5b08dcc000d33a01a42e3fd07d Author: Colin Ian King Date: Mon Jan 27 11:13:36 2020 +0000 i2c: xiic: fix indentation issue There is a statement that is indented one level too deeply, remove the extraneous tab. Fixes: b4c119dbc300 ("i2c: xiic: Add timeout to the rx fifo wait loop") Signed-off-by: Colin Ian King Reviewed-by: Shubhrajyoti Datta Signed-off-by: Wolfram Sang commit eca95cd5a36d1fb547e84b8fd86fa2b7ba7f4b91 Author: Colin Ian King Date: Sat Jan 25 20:20:20 2020 +0000 i2c: parport: fix spelling mistake: "Atmost" -> "At most" There is a spelling mistake in a module parameter description. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit f86cd20c9454847a524ddbdcdec32c0380ed7c9b Author: Jens Axboe Date: Wed Jan 29 13:46:44 2020 -0700 io_uring: fix linked command file table usage We're not consistent in how the file table is grabbed and assigned if we have a command linked that requires the use of it. Add ->file_table to the io_op_defs[] array, and use that to determine when to grab the table instead of having the handlers set it if they need to defer. This also means we can kill the IO_WQ_WORK_NEEDS_FILES flag. We always initialize work->files, so io-wq can just check for that. Signed-off-by: Jens Axboe commit ba19e16651a5c67fa8b53ce4fb5bfbab8d326b6c Author: Gal Pressman Date: Wed Jan 29 09:18:03 2020 +0200 RDMA/efa: Mask access flags with the correct optional range The uapi value IB_UVERBS_ACCESS_OPTIONAL_RANGE shouldn't be used inside the driver, use IB_ACCESS_OPTIONAL instead. Fixes: 86dd738cf20c ("RDMA/efa: Allow passing of optional access flags for MR registration") Link: https://lore.kernel.org/r/20200129071803.40117-1-galpress@amazon.com Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit 3d67a2dbdbe9400523164d8557a7a5fb7ef83c7e Author: Nicholas Johnson Date: Mon Jan 6 15:45:32 2020 +0000 PCI: Remove unnecessary braces Remove unnecessary braces in pci_bus_distribute_available_resources(). No functional changes. Link: https://lore.kernel.org/r/PSXP216MB0438061CB4442460BB92A75F803C0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM Signed-off-by: Nicholas Johnson Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 66f2d19f8116e16898f8d82e28573a384ddc430d Author: Takashi Iwai Date: Wed Jan 29 20:59:07 2020 +0100 ALSA: pcm: Fix memory leak at closing a stream without hw_free ALSA PCM core recently introduced a new managed PCM buffer allocation mode that does allocate / free automatically at hw_params and hw_free. However, it overlooked the code path directly calling hw_free PCM ops at releasing the PCM substream, and it may result in a memory leak as spotted by syzkaller when no buffer preallocation is used (e.g. vmalloc buffer). This patch papers over it with a slight refactoring. The hw_free ops call and relevant tasks are unified in a new helper function, and call it from both places. Fixes: 0dba808eae26 ("ALSA: pcm: Introduce managed buffer allocation mode") Reported-by: syzbot+30edd0f34bfcdc548ac4@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20200129195907.12197-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 46b770f720bdd8a7de1c04a1cab5d4e9e21d6666 Author: Ranjani Sridharan Date: Wed Jan 29 10:44:48 2020 -0800 ALSA: uapi: Fix sparse warning Fix the following sparse warning generated due to 64-bit compat type having fields defined explicitly with __s32: sound/soc/sof/sof-audio.c:46:31: warning: incorrect type in assignment (different base types) sound/soc/sof/sof-audio.c:46:31: expected restricted snd_pcm_state_t [usertype] state sound/soc/sof/sof-audio.c:46:31: got signed int [usertype] state Fixes: 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control") Reported-by: Pierre-Louis Bossart Suggested-by: Takashi Iwai Signed-off-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20200129184448.3005-1-ranjani.sridharan@linux.intel.com Signed-off-by: Takashi Iwai commit 3893c2025fec6f0fa4b2d794f36bd56a55e46dec Merge: 5307040655d0 1e4a29556794 Author: Linus Torvalds Date: Wed Jan 29 11:47:08 2020 -0800 Merge tag 'erofs-for-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "A regression fix, several cleanups and (maybe) plus an upcoming new mount api convert patch as a part of vfs update are considered available for this cycle. All commits have been in linux-next and tested with no smoke out. Summary: - fix an out-of-bound read access introduced in v5.3, which could rarely cause data corruption - various cleanup patches" * tag 'erofs-for-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: clean up z_erofs_submit_queue() erofs: fold in postsubmit_is_all_bypassed() erofs: fix out-of-bound read for shifted uncompressed block erofs: remove void tagging/untagging of workgroup pointers erofs: remove unused tag argument while registering a workgroup erofs: remove unused tag argument while finding a workgroup erofs: correct indentation of an assigned structure inside a function commit 5307040655d0b8d465a2f54d9c67be5b3a780bcd Merge: 6aee4badd812 587065dcac64 Author: Linus Torvalds Date: Wed Jan 29 11:45:09 2020 -0800 Merge branch 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull adfs updates from Al Viro: "adfs stuff for this cycle" * 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (42 commits) fs/adfs: bigdir: Fix an error code in adfs_fplus_read() Documentation: update adfs filesystem documentation fs/adfs: mostly divorse inode number from indirect disc address fs/adfs: super: add support for E and E+ floppy image formats fs/adfs: super: extract filesystem block probe fs/adfs: dir: remove debug in adfs_dir_update() fs/adfs: super: fix inode dropping fs/adfs: bigdir: implement directory update support fs/adfs: bigdir: calculate and validate directory checkbyte fs/adfs: bigdir: directory validation strengthening fs/adfs: bigdir: extract directory validation fs/adfs: bigdir: factor out directory entry offset calculation fs/adfs: newdir: split out directory commit from update fs/adfs: newdir: clean up adfs_f_update() fs/adfs: newdir: merge adfs_dir_read() into adfs_f_read() fs/adfs: newdir: improve directory validation fs/adfs: newdir: factor out directory format validation fs/adfs: dir: use pointers to access directory head/tails fs/adfs: dir: add more efficient iterate() per-format method fs/adfs: dir: switch to iterate_shared method ... commit ccd1f27368e42a11117cf1bdb113cc640802f91e Author: Mat Martineau Date: Wed Jan 29 09:41:37 2020 -0800 Revert "MAINTAINERS: mptcp@ mailing list is moderated" This reverts commit 74759e1693311a8d1441de836c4080c192374238. mptcp@lists.01.org accepts messages from non-subscribers. There was an invisible and unexpected server-wide rule limiting the number of recipients for subscribers and non-subscribers alike, and that has now been turned off for this list. Cc: Randy Dunlap Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 6aee4badd8126f3a2b6d31c5e2db2439d316374f Merge: 15d663249653 b55eef872a96 Author: Linus Torvalds Date: Wed Jan 29 11:20:24 2020 -0800 Merge branch 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull openat2 support from Al Viro: "This is the openat2() series from Aleksa Sarai. I'm afraid that the rest of namei stuff will have to wait - it got zero review the last time I'd posted #work.namei, and there had been a leak in the posted series I'd caught only last weekend. I was going to repost it on Monday, but the window opened and the odds of getting any review during that... Oh, well. Anyway, openat2 part should be ready; that _did_ get sane amount of review and public testing, so here it comes" From Aleksa's description of the series: "For a very long time, extending openat(2) with new features has been incredibly frustrating. This stems from the fact that openat(2) is possibly the most famous counter-example to the mantra "don't silently accept garbage from userspace" -- it doesn't check whether unknown flags are present[1]. This means that (generally) the addition of new flags to openat(2) has been fraught with backwards-compatibility issues (O_TMPFILE has to be defined as __O_TMPFILE|O_DIRECTORY|[O_RDWR or O_WRONLY] to ensure old kernels gave errors, since it's insecure to silently ignore the flag[2]). All new security-related flags therefore have a tough road to being added to openat(2). Furthermore, the need for some sort of control over VFS's path resolution (to avoid malicious paths resulting in inadvertent breakouts) has been a very long-standing desire of many userspace applications. This patchset is a revival of Al Viro's old AT_NO_JUMPS[3] patchset (which was a variant of David Drysdale's O_BENEATH patchset[4] which was a spin-off of the Capsicum project[5]) with a few additions and changes made based on the previous discussion within [6] as well as others I felt were useful. In line with the conclusions of the original discussion of AT_NO_JUMPS, the flag has been split up into separate flags. However, instead of being an openat(2) flag it is provided through a new syscall openat2(2) which provides several other improvements to the openat(2) interface (see the patch description for more details). The following new LOOKUP_* flags are added: LOOKUP_NO_XDEV: Blocks all mountpoint crossings (upwards, downwards, or through absolute links). Absolute pathnames alone in openat(2) do not trigger this. Magic-link traversal which implies a vfsmount jump is also blocked (though magic-link jumps on the same vfsmount are permitted). LOOKUP_NO_MAGICLINKS: Blocks resolution through /proc/$pid/fd-style links. This is done by blocking the usage of nd_jump_link() during resolution in a filesystem. The term "magic-links" is used to match with the only reference to these links in Documentation/, but I'm happy to change the name. It should be noted that this is different to the scope of ~LOOKUP_FOLLOW in that it applies to all path components. However, you can do openat2(NO_FOLLOW|NO_MAGICLINKS) on a magic-link and it will *not* fail (assuming that no parent component was a magic-link), and you will have an fd for the magic-link. In order to correctly detect magic-links, the introduction of a new LOOKUP_MAGICLINK_JUMPED state flag was required. LOOKUP_BENEATH: Disallows escapes to outside the starting dirfd's tree, using techniques such as ".." or absolute links. Absolute paths in openat(2) are also disallowed. Conceptually this flag is to ensure you "stay below" a certain point in the filesystem tree -- but this requires some additional to protect against various races that would allow escape using "..". Currently LOOKUP_BENEATH implies LOOKUP_NO_MAGICLINKS, because it can trivially beam you around the filesystem (breaking the protection). In future, there might be similar safety checks done as in LOOKUP_IN_ROOT, but that requires more discussion. In addition, two new flags are added that expand on the above ideas: LOOKUP_NO_SYMLINKS: Does what it says on the tin. No symlink resolution is allowed at all, including magic-links. Just as with LOOKUP_NO_MAGICLINKS this can still be used with NOFOLLOW to open an fd for the symlink as long as no parent path had a symlink component. LOOKUP_IN_ROOT: This is an extension of LOOKUP_BENEATH that, rather than blocking attempts to move past the root, forces all such movements to be scoped to the starting point. This provides chroot(2)-like protection but without the cost of a chroot(2) for each filesystem operation, as well as being safe against race attacks that chroot(2) is not. If a race is detected (as with LOOKUP_BENEATH) then an error is generated, and similar to LOOKUP_BENEATH it is not permitted to cross magic-links with LOOKUP_IN_ROOT. The primary need for this is from container runtimes, which currently need to do symlink scoping in userspace[7] when opening paths in a potentially malicious container. There is a long list of CVEs that could have bene mitigated by having RESOLVE_THIS_ROOT (such as CVE-2017-1002101, CVE-2017-1002102, CVE-2018-15664, and CVE-2019-5736, just to name a few). In order to make all of the above more usable, I'm working on libpathrs[8] which is a C-friendly library for safe path resolution. It features a userspace-emulated backend if the kernel doesn't support openat2(2). Hopefully we can get userspace to switch to using it, and thus get openat2(2) support for free once it's ready. Future work would include implementing things like RESOLVE_NO_AUTOMOUNT and possibly a RESOLVE_NO_REMOTE (to allow programs to be sure they don't hit DoSes though stale NFS handles)" * 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: Documentation: path-lookup: include new LOOKUP flags selftests: add openat2(2) selftests open: introduce openat2(2) syscall namei: LOOKUP_{IN_ROOT,BENEATH}: permit limited ".." resolution namei: LOOKUP_IN_ROOT: chroot-like scoped resolution namei: LOOKUP_BENEATH: O_BENEATH-like scoped resolution namei: LOOKUP_NO_XDEV: block mountpoint crossing namei: LOOKUP_NO_MAGICLINKS: block magic-link resolution namei: LOOKUP_NO_SYMLINKS: block symlink resolution namei: allow set_root() to produce errors namei: allow nd_jump_link() to produce errors nsfs: clean-up ns_get_path() signature to return int namei: only return -ECHILD from follow_dotdot_rcu() commit 15d6632496537fa66488221ee5dd2f9fb318ef2e Merge: 80b60e3849bf 59d8cc6b2e37 Author: Linus Torvalds Date: Wed Jan 29 11:04:49 2020 -0800 Merge branch 'urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU warning removal from Paul McKenney: "A single commit that fixes an embarrassing bug discussed here: https://lore.kernel.org/lkml/20200125131425.GB16136@zn.tnic/ which apparently also affects smaller systems" [ This was sent to Ingo, but since I see the issue on the laptop I use for testing during the merge window, I'm doing the pull directly - Linus ] * 'urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: rcu: Forgive slow expedited grace periods at boot time commit 80b60e3849bfe987801a73ebd4bab43b7b591a09 Merge: 701a9c8092dd 74777eaf7aef Author: Linus Torvalds Date: Wed Jan 29 11:03:21 2020 -0800 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fixes from Ingo Molnar: "Three objtool fixes, plus marking SFI as obsolete" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Skip samples subdirectory objtool: Fix ARCH=x86_64 build error objtool: Silence build output MAINTAINERS: Mark simple firmware interface (SFI) obsolete commit 701a9c8092ddf299d7f90ab2d66b19b4526d1186 Merge: 975f9ce9a067 0db4a15d4c27 Author: Linus Torvalds Date: Wed Jan 29 10:35:54 2020 -0800 Merge tag 'char-misc-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the big char/misc/whatever driver changes for 5.6-rc1 Included in here are loads of things from a variety of different driver subsystems: - soundwire updates - binder updates - nvmem updates - firmware drivers updates - extcon driver updates - various misc driver updates - fpga driver updates - interconnect subsystem and driver updates - bus driver updates - uio driver updates - mei driver updates - w1 driver cleanups - various other small driver updates All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (86 commits) mei: me: add jasper point DID char: hpet: Use flexible-array member binder: fix log spam for existing debugfs file creation. mei: me: add comet point (lake) H device ids nvmem: add QTI SDAM driver dt-bindings: nvmem: add binding for QTI SPMI SDAM dt-bindings: imx-ocotp: Add i.MX8MP compatible dt-bindings: soundwire: fix example soundwire: cadence: fix kernel-doc parameter descriptions soundwire: intel: report slave_ids for each link to SOF driver siox: Use the correct style for SPDX License Identifier w1: omap-hdq: Simplify driver with PM runtime autosuspend firmware: stratix10-svc: Remove unneeded semicolon firmware: google: Probe for a GSMI handler in firmware firmware: google: Unregister driver_info on failure and exit in gsmi firmware: google: Release devices before unregistering the bus slimbus: qcom: add missed clk_disable_unprepare in remove slimbus: Use the correct style for SPDX License Identifier slimbus: qcom-ngd-ctrl: Use dma_request_chan() instead dma_request_slave_channel() dt-bindings: SLIMBus: add slim devices optional properties ... commit 975f9ce9a067a82b89d49e63938e01b2773ac9d4 Merge: 7ba31c3f2f1e 85db1cde8253 Author: Linus Torvalds Date: Wed Jan 29 10:18:20 2020 -0800 Merge tag 'driver-core-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is a small set of changes for 5.6-rc1 for the driver core and some firmware subsystem changes. Included in here are: - device.h splitup like you asked for months ago - devtmpfs minor cleanups - firmware core minor changes - debugfs fix for lockdown mode - kernfs cleanup fix - cpu topology minor fix All of these have been in linux-next for a while with no reported issues" * tag 'driver-core-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (22 commits) firmware: Rename FW_OPT_NOFALLBACK to FW_OPT_NOFALLBACK_SYSFS devtmpfs: factor out common tail of devtmpfs_{create,delete}_node devtmpfs: initify a bit devtmpfs: simplify initialization of mount_dev devtmpfs: factor out setup part of devtmpfsd() devtmpfs: fix theoretical stale pointer deref in devtmpfsd() driver core: platform: fix u32 greater or equal to zero comparison cpu-topology: Don't error on more than CONFIG_NR_CPUS CPUs in device tree debugfs: Return -EPERM when locked down driver core: Print device when resources present in really_probe() driver core: Fix test_async_driver_probe if NUMA is disabled driver core: platform: Prevent resouce overflow from causing infinite loops fs/kernfs/dir.c: Clean code by removing always true condition component: do not dereference opaque pointer in debugfs drivers/component: remove modular code debugfs: Fix warnings when building documentation device.h: move 'struct driver' stuff out to device/driver.h device.h: move 'struct class' stuff out to device/class.h device.h: move 'struct bus' stuff out to device/bus.h device.h: move dev_printk()-like functions to dev_printk.h ... commit 7ba31c3f2f1ee095d8126f4d3757fc3b2bc3c838 Merge: ca9b5b628398 fc157998b825 Author: Linus Torvalds Date: Wed Jan 29 10:15:11 2020 -0800 Merge tag 'staging-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO updates from Greg KH: "Here is the big staging/iio driver patches for 5.6-rc1 Included in here are: - lots of new IIO drivers and updates for that subsystem - the usual huge quantity of minor cleanups for staging drivers - removal of the following staging drivers: - isdn/avm - isdn/gigaset - isdn/hysdn - octeon-usb - octeon ethernet Overall we deleted far more lines than we added, removing over 40k of old and obsolete driver code. All of these changes have been in linux-next for a while with no reported issues" * tag 'staging-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (353 commits) staging: most: usb: check for NULL device staging: next: configfs: fix release link staging: most: core: fix logging messages staging: most: core: remove container struct staging: most: remove struct device core driver staging: most: core: drop device reference staging: most: remove device from interface structure staging: comedi: drivers: fix spelling mistake "to" -> "too" staging: exfat: remove fs_func struct. staging: wilc1000: avoid mutex unlock without lock in wilc_wlan_handle_txq() staging: wilc1000: return zero on success and non-zero on function failure staging: axis-fifo: replace spinlock with mutex staging: wilc1000: remove unused code prior to throughput enhancement in SPI staging: wilc1000: added 'wilc_' prefix for 'struct assoc_resp' name staging: wilc1000: move firmware API struct's to separate header file staging: wilc1000: remove use of infinite loop conditions staging: kpc2000: rename variables with kpc namespace staging: vt6656: Remove memory buffer from vnt_download_firmware. staging: vt6656: Just check NEWRSR_DECRYPTOK for RX_FLAG_DECRYPTED. staging: vt6656: Use vnt_rx_tail struct for tail variables. ... commit ca9b5b6283984f67434cee810f3b08e19630226d Merge: aac96626713f 85f4c95172d6 Author: Linus Torvalds Date: Wed Jan 29 10:13:27 2020 -0800 Merge tag 'tty-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver updates from Greg KH: "Here are the big set of tty and serial driver updates for 5.6-rc1 Included in here are: - dummy_con cleanups (touches lots of arch code) - sysrq logic cleanups (touches lots of serial drivers) - samsung driver fixes (wasn't really being built) - conmakeshash move to tty subdir out of scripts - lots of small tty/serial driver updates All of these have been in linux-next for a while with no reported issues" * tag 'tty-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (140 commits) tty: n_hdlc: Use flexible-array member and struct_size() helper tty: baudrate: SPARC supports few more baud rates tty: baudrate: Synchronise baud_table[] and baud_bits[] tty: serial: meson_uart: Add support for kernel debugger serial: imx: fix a race condition in receive path serial: 8250_bcm2835aux: Document struct bcm2835aux_data serial: 8250_bcm2835aux: Use generic remapping code serial: 8250_bcm2835aux: Allocate uart_8250_port on stack serial: 8250_bcm2835aux: Suppress register_port error on -EPROBE_DEFER serial: 8250_bcm2835aux: Suppress clk_get error on -EPROBE_DEFER serial: 8250_bcm2835aux: Fix line mismatch on driver unbind serial_core: Remove unused member in uart_port vt: Correct comment documenting do_take_over_console() vt: Delete comment referencing non-existent unbind_con_driver() arch/xtensa/setup: Drop dummy_con initialization arch/x86/setup: Drop dummy_con initialization arch/unicore32/setup: Drop dummy_con initialization arch/sparc/setup: Drop dummy_con initialization arch/sh/setup: Drop dummy_con initialization arch/s390/setup: Drop dummy_con initialization ... commit aac96626713fe167c672f9a008be0f514aa3e237 Merge: 6ba3d7066c71 eaa519983fd9 Author: Linus Torvalds Date: Wed Jan 29 10:09:44 2020 -0800 Merge tag 'usb-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt/PHY driver updates from Greg KH: "Here is the big USB and Thunderbolt and PHY driver updates for 5.6-rc1. With the advent of USB4, "Thunderbolt" has really become USB4, so the renaming of the Kconfig option and starting to share subsystem code has begun, hence both subsystems coming in through the same tree here. PHY driver updates also touched USB drivers, so that is coming in through here as well. Major stuff included in here are: - USB 4 initial support added (i.e. Thunderbolt) - musb driver updates - USB gadget driver updates - PHY driver updates - USB PHY driver updates - lots of USB serial stuff fixed up - USB typec updates - USB-IP fixes - lots of other smaller USB driver updates All of these have been in linux-next for a while now (the usb-serial tree is already tested in linux-next on its own before merged into here), with no reported issues" [ Removed an incorrect compile test enablement for PHY_EXYNOS5250_SATA that causes configuration warnings - Linus ] * tag 'usb-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (207 commits) Doc: ABI: add usb charger uevent usb: phy: show USB charger type for user usb: cdns3: fix spelling mistake and rework grammar in text usb: phy: phy-gpio-vbus-usb: Convert to GPIO descriptors USB: serial: cyberjack: fix spelling mistake "To" -> "Too" USB: serial: ir-usb: simplify endpoint check USB: serial: ir-usb: make set_termios synchronous USB: serial: ir-usb: fix IrLAP framing USB: serial: ir-usb: fix link-speed handling USB: serial: ir-usb: add missing endpoint sanity check usb: typec: fusb302: fix "op-sink-microwatt" default that was in mW usb: typec: wcove: fix "op-sink-microwatt" default that was in mW usb: dwc3: pci: add ID for the Intel Comet Lake -V variant usb: typec: tcpci: mask event interrupts when remove driver usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 usb: chipidea: add inline for ci_hdrc_host_driver_init if host is not defined usb: chipidea: handle single role for usb role class usb: musb: fix spelling mistake: "periperal" -> "peripheral" phy: ti: j721e-wiz: Fix build error without CONFIG_OF_ADDRESS USB: usbfs: Always unlink URBs in reverse order ... commit 6ba3d7066c71d2103da255df19eb613d299bab15 Merge: fa889d85551e 122ce22cb37b Author: Linus Torvalds Date: Wed Jan 29 09:51:36 2020 -0800 Merge tag 'pinctrl-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "This is the bulk of pin control changes, nothing too exciting about this. Some changes hit arch/sh and arch/arm but are well isolated and acknowledged by the respective arch maintainers. Core changes: - Dropped the chained IRQ setup callback into GPIOLIB as we got rid of the last users of that in this changeset. New drivers: - New driver for Ingenic X1830. - New driver for Freescale i.MX8MP. Driver enhancements: - Fix all remaining Intel drivers to pass their IRQ chips along with the GPIO chips. - Intel Baytrail allocates its irqchip dynamically. - Intel Lynxpoint is thoroughly rewritten and modernized. - Aspeed AST2600 pin muxing and configuration is much improved. - Qualcomm SC7180 functions are updated and wakeup interrupt map is provided. - A whole slew of Renesas SH-PFC cleanups and improvements. - Fix up the Intel DT bindings to use the generic YAML DT bindings schema (a first user of this)" * tag 'pinctrl-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (99 commits) pinctrl: madera: Remove extra blank line pinctrl: qcom: Don't lock around irq_set_irq_wake() pinctrl: mvebu: armada-37xx: use use platform api gpio: Drop the chained IRQ handler assign function pinctrl: freescale: Add i.MX8MP pinctrl driver support dt-bindings: imx: Add pinctrl binding doc for i.MX8MP pinctrl: tigerlake: Tiger Lake uses _HID enumeration pinctrl: sunrisepoint: Add Coffee Lake-S ACPI ID pinctrl: iproc: Use platform_get_irq_optional() to avoid error message pinctrl: dt-bindings: Fix some errors in the lgm and pinmux schema pinctrl: intel: Pass irqchip when adding gpiochip pinctrl: intel: Add GPIO <-> pin mapping ranges via callback pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins pinctrl: sunrisepoint: Add missing Interrupt Status register offset pinctrl: sh-pfc: Split R-Car H3 support in two independent drivers pinctrl: artpec6: fix __iomem on reg in set pinctrl: ingenic: Use devm_platform_ioremap_resource() pinctrl: ingenic: Factorize irq_set_type function pinctrl: ingenic: Remove duplicated ingenic_chip_info structures ... commit a5b0cda136f4f420a8e24e50d19dfcef2f81df2e Author: Petr Vorel Date: Tue Jan 28 00:14:39 2020 +0100 regulator: qcom_spmi: Fix docs for PM8004 Fixes: 2e36e140b8b8 ("regulator: qcom_spmi: Add support for PM8004 regulators") Signed-off-by: Petr Vorel Link: https://lore.kernel.org/r/20200127231439.3562452-1-petr.vorel@gmail.com Signed-off-by: Mark Brown commit 4099c3295e480907e37b93d51fc17fda81dd5bed Author: Takashi Iwai Date: Mon Jan 27 20:28:31 2020 +0100 ASoC: rt715: Add __maybe_unused to PM callbacks Fix the compile warnings by adding __maybe_unused to PM callbacks: sound/soc/codecs/rt715-sdw.c:566:12: warning: ‘rt715_dev_resume’ defined but not used [-Wunused-function] sound/soc/codecs/rt715-sdw.c:552:12: warning: ‘rt715_dev_suspend’ defined but not used [-Wunused-function] Fixes: d1ede0641b05 ("ASoC: rt715: add RT715 codec driver") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200127192831.14057-5-tiwai@suse.de Signed-off-by: Mark Brown commit 973649d38e2664eb45e1ae9adfdce53626c29f94 Author: Takashi Iwai Date: Mon Jan 27 20:28:30 2020 +0100 ASoC: rt711: Add __maybe_unused to PM callbacks Fix the compile warnings by adding __maybe_unused to PM callbacks: sound/soc/codecs/rt711-sdw.c:504:12: warning: ‘rt711_dev_resume’ defined but not used [-Wunused-function] sound/soc/codecs/rt711-sdw.c:490:12: warning: ‘rt711_dev_suspend’ defined but not used [-Wunused-function] Fixes: 320b8b0d13b8 ("ASoC: rt711: add rt711 codec driver") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200127192831.14057-4-tiwai@suse.de Signed-off-by: Mark Brown commit 809a9b63323278e94f73d8b1f85b64e347f639ba Author: Takashi Iwai Date: Mon Jan 27 20:28:29 2020 +0100 ASoC: rt700: Add __maybe_unused to PM callbacks Fix the compile warnings by adding __maybe_unused to PM callbacks: sound/soc/codecs/rt700-sdw.c:503:12: warning: ‘rt700_dev_resume’ defined but not used [-Wunused-function] sound/soc/codecs/rt700-sdw.c:489:12: warning: ‘rt700_dev_suspend’ defined but not used [-Wunused-function] Fixes: 7d2a5f9ae41e ("ASoC: rt700: add rt700 codec driver") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200127192831.14057-3-tiwai@suse.de Signed-off-by: Mark Brown commit faa37a9318899752d85761d47e79a42f3a0aa1b9 Author: Takashi Iwai Date: Mon Jan 27 20:28:28 2020 +0100 ASoC: rt1308-sdw: Add __maybe_unused to PM callbacks Fix the compile warnings by adding __maybe_unused to PM callbacks: sound/soc/codecs/rt1308-sdw.c:690:12: warning: ‘rt1308_dev_resume’ defined but not used [-Wunused-function] sound/soc/codecs/rt1308-sdw.c:676:12: warning: ‘rt1308_dev_suspend’ defined but not used [-Wunused-function] Fixes: a87a6653a28c ("ASoC: rt1308-sdw: add rt1308 SdW amplifier driver") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200127192831.14057-2-tiwai@suse.de Signed-off-by: Mark Brown commit 67e69e1d46becd934a03489c38fc42bb2510c1c6 Author: Akshu Agrawal Date: Tue Jan 28 16:00:22 2020 +0530 ASoC: amd: Fix simultaneous playback and capture Stopping of one stream is killing the other stream when they are running simultaneously. This is because, IER register is cleared which disables I2S and overrides any other block enables. Clearing IER register only when all streams on a channel are disabled, fixes the issue. Signed-off-by: Akshu Agrawal Link: https://lore.kernel.org/r/20200128103029.128841-1-akshu.agrawal@amd.com Signed-off-by: Mark Brown commit fa889d85551e0bd962fdefe1cc113f9ba1d04a36 Merge: b3a608222336 0282c72d30d3 Author: Linus Torvalds Date: Wed Jan 29 09:43:39 2020 -0800 Merge tag 'gpio-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO updates from Linus Walleij: "This is the bulk of GPIO changes for the v5.6 kernel cycle. This is a pretty calm cycle so far, nothing special going on really. Some more changes will come in from the irqchip and pin control trees. I also deleted an orphan include file for FMC that was dangling since subsystem was removed. Core changes: - Document the usecases for the kernelspace vs userspace handling of GPIOs. - Handle MSI (message signalled interrupts) properly in the core hierarchical irqdomain code. - Fix a rare race condition while initializing the descriptor array. New drivers: - Xylon LogiCVC GPIO driver. - WDC934x GPIO controller driver. Driver improvements: - Implemented suspend/resume in the Tegra driver. - MPC8xx edge detection fixup. - Properly convert ThunderX to use hierarchical irqdomain with GPIOLIB_IRQCHIP on top of the revert of the previous buggy switchover. This time it works (hopefully). Misc: - Drop a FMC remnant file - A slew of fixes" * tag 'gpio-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (48 commits) MAINTAINERS: Replace Tien Hock Loh as Altera PIO maintainer gpiolib: hold gpio devices lock until ->descs array is initialised gpio: aspeed-sgpio: fixed typos gpio: mvebu: clear irq in edge cause register before unmask edge irq gpiolib: Lower verbosity when allocating hierarchy irq gpiolib: Remove duplicated function gpio_do_set_config() gpio: Fix the no return statement warning gpio: wcd934x: Add support to wcd934x gpio controller gpiolib: remove set but not used variable 'config' gpio: vx855: fixed a typo gpio: mockup: sort headers alphabetically gpio: mockup: update the license tag gpio: Remove the unused flags gpiolib: Set lockdep class for hierarchical irq domains gpio: thunderx: Switch to GPIOLIB_IRQCHIP gpiolib: Add the support for the msi parent domain gpiolib: Add support for the irqdomain which doesn't use irq_fwspec as arg gpio: Add use guidance documentation dt-bindings: gpio: wcd934x: Add bindings for gpio gpio: altera: change to platform_get_irq_optional to avoid false-positive error ... commit 5038517119d50ed0240059b1d7fc2faa92371c08 Author: Kadlecsik József Date: Sat Jan 25 20:39:25 2020 +0100 netfilter: ipset: fix suspicious RCU usage in find_set_and_id find_set_and_id() is called when the NFNL_SUBSYS_IPSET mutex is held. However, in the error path there can be a follow-up recvmsg() without the mutex held. Use the start() function of struct netlink_dump_control instead of dump() to verify and report if the specified set does not exist. Thanks to Pablo Neira Ayuso for helping me to understand the subleties of the netlink protocol. Reported-by: syzbot+fc69d7cb21258ab4ae4d@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit d55c6ab4b368633f39f8fe059f3b877f978cfb4c Merge: 44efc78d0e46 ae2dd7164943 Author: David S. Miller Date: Wed Jan 29 17:45:20 2020 +0100 Merge branch 'mptcp-fix-sockopt-crash-and-lockdep-splats' Florian Westphal says: ==================== mptcp: fix sockopt crash and lockdep splats Christoph Paasch reported a few bugs and lockdep splats triggered by syzkaller. One patch fixes a crash in set/getsockopt. Two patches fix lockdep splats related to the order in which RTNL and socket lock are taken. Last patch fixes out-of-bounds access when TCP syncookies are used. Change since last iteration on mptcp-list: - add needed refcount in patch 2 - call tcp_get/setsockopt directly in patch 2 Other patches unchanged except minor amends to commit messages. ==================== Signed-off-by: David S. Miller commit ae2dd7164943e03644293af92802550d052632e6 Author: Florian Westphal Date: Wed Jan 29 15:54:46 2020 +0100 mptcp: handle tcp fallback when using syn cookies We can't deal with syncookie mode yet, the syncookie rx path will create tcp reqsk, i.e. we get OOB access because we treat tcp reqsk as mptcp reqsk one: TCP: SYN flooding on port 20002. Sending cookies. BUG: KASAN: slab-out-of-bounds in subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191 Read of size 1 at addr ffff8881167bc148 by task syz-executor099/2120 subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191 tcp_get_cookie_sock+0xcf/0x520 net/ipv4/syncookies.c:209 cookie_v6_check+0x15a5/0x1e90 net/ipv6/syncookies.c:252 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1123 [inline] [..] Bug can be reproduced via "sysctl net.ipv4.tcp_syncookies=2". Note that MPTCP should work with syncookies (4th ack would carry needed state), but it appears better to sort that out in -next so do tcp fallback for now. I removed the MPTCP ifdef for tcp_rsk "is_mptcp" member because if (IS_ENABLED()) is easier to read than "#ifdef IS_ENABLED()/#endif" pair. Cc: Eric Dumazet Fixes: cec37a6e41aae7bf ("mptcp: Handle MP_CAPABLE options for outgoing connections") Reported-by: Christoph Paasch Tested-by: Christoph Paasch Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit b2c5b614ca6ed460144788e7f9634569cc0c7b51 Author: Florian Westphal Date: Wed Jan 29 15:54:45 2020 +0100 mptcp: avoid a lockdep splat when mcast group was joined syzbot triggered following lockdep splat: ffffffff82d2cd40 (rtnl_mutex){+.+.}, at: ip_mc_drop_socket+0x52/0x180 but task is already holding lock: ffff8881187a2310 (sk_lock-AF_INET){+.+.}, at: mptcp_close+0x18/0x30 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (sk_lock-AF_INET){+.+.}: lock_acquire+0xee/0x230 lock_sock_nested+0x89/0xc0 do_ip_setsockopt.isra.0+0x335/0x22f0 ip_setsockopt+0x35/0x60 tcp_setsockopt+0x5d/0x90 __sys_setsockopt+0xf3/0x190 __x64_sys_setsockopt+0x61/0x70 do_syscall_64+0x72/0x300 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (rtnl_mutex){+.+.}: check_prevs_add+0x2b7/0x1210 __lock_acquire+0x10b6/0x1400 lock_acquire+0xee/0x230 __mutex_lock+0x120/0xc70 ip_mc_drop_socket+0x52/0x180 inet_release+0x36/0xe0 __sock_release+0xfd/0x130 __mptcp_close+0xa8/0x1f0 inet_release+0x7f/0xe0 __sock_release+0x69/0x130 sock_close+0x18/0x20 __fput+0x179/0x400 task_work_run+0xd5/0x110 do_exit+0x685/0x1510 do_group_exit+0x7e/0x170 __x64_sys_exit_group+0x28/0x30 do_syscall_64+0x72/0x300 entry_SYSCALL_64_after_hwframe+0x49/0xbe The trigger is: socket(AF_INET, SOCK_STREAM, 0x106 /* IPPROTO_MPTCP */) = 4 setsockopt(4, SOL_IP, MCAST_JOIN_GROUP, {gr_interface=7, gr_group={sa_family=AF_INET, sin_port=htons(20003), sin_addr=inet_addr("224.0.0.2")}}, 136) = 0 exit(0) Which results in a call to rtnl_lock while we are holding the parent mptcp socket lock via mptcp_close -> lock_sock(msk) -> inet_release -> ip_mc_drop_socket -> rtnl_lock(). >From lockdep point of view we thus have both 'rtnl_lock; lock_sock' and 'lock_sock; rtnl_lock'. Fix this by stealing the msk conn_list and doing the subflow close without holding the msk lock. Fixes: cec37a6e41aae7bf ("mptcp: Handle MP_CAPABLE options for outgoing connections") Reported-by: Christoph Paasch Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit 50e741bb3b15fd5410bac379bdb4bc795d62b45c Author: Florian Westphal Date: Wed Jan 29 15:54:44 2020 +0100 mptcp: fix panic on user pointer access Its not possible to call the kernel_(s|g)etsockopt functions here, the address points to user memory: General protection fault in user access. Non-canonical address? WARNING: CPU: 1 PID: 5352 at arch/x86/mm/extable.c:77 ex_handler_uaccess+0xba/0xe0 arch/x86/mm/extable.c:77 Kernel panic - not syncing: panic_on_warn set ... [..] Call Trace: fixup_exception+0x9d/0xcd arch/x86/mm/extable.c:178 general_protection+0x2d/0x40 arch/x86/entry/entry_64.S:1202 do_ip_getsockopt+0x1f6/0x1860 net/ipv4/ip_sockglue.c:1323 ip_getsockopt+0x87/0x1c0 net/ipv4/ip_sockglue.c:1561 tcp_getsockopt net/ipv4/tcp.c:3691 [inline] tcp_getsockopt+0x8c/0xd0 net/ipv4/tcp.c:3685 kernel_getsockopt+0x121/0x1f0 net/socket.c:3736 mptcp_getsockopt+0x69/0x90 net/mptcp/protocol.c:830 __sys_getsockopt+0x13a/0x220 net/socket.c:2175 We can call tcp_get/setsockopt functions instead. Doing so fixes crashing, but still leaves rtnl related lockdep splat: WARNING: possible circular locking dependency detected 5.5.0-rc6 #2 Not tainted ------------------------------------------------------ syz-executor.0/16334 is trying to acquire lock: ffffffff84f7a080 (rtnl_mutex){+.+.}, at: do_ip_setsockopt.isra.0+0x277/0x3820 net/ipv4/ip_sockglue.c:644 but task is already holding lock: ffff888116503b90 (sk_lock-AF_INET){+.+.}, at: lock_sock include/net/sock.h:1516 [inline] ffff888116503b90 (sk_lock-AF_INET){+.+.}, at: mptcp_setsockopt+0x28/0x90 net/mptcp/protocol.c:1284 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (sk_lock-AF_INET){+.+.}: lock_sock_nested+0xca/0x120 net/core/sock.c:2944 lock_sock include/net/sock.h:1516 [inline] do_ip_setsockopt.isra.0+0x281/0x3820 net/ipv4/ip_sockglue.c:645 ip_setsockopt+0x44/0xf0 net/ipv4/ip_sockglue.c:1248 udp_setsockopt+0x5d/0xa0 net/ipv4/udp.c:2639 __sys_setsockopt+0x152/0x240 net/socket.c:2130 __do_sys_setsockopt net/socket.c:2146 [inline] __se_sys_setsockopt net/socket.c:2143 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2143 do_syscall_64+0xbd/0x5b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (rtnl_mutex){+.+.}: check_prev_add kernel/locking/lockdep.c:2475 [inline] check_prevs_add kernel/locking/lockdep.c:2580 [inline] validate_chain kernel/locking/lockdep.c:2970 [inline] __lock_acquire+0x1fb2/0x4680 kernel/locking/lockdep.c:3954 lock_acquire+0x127/0x330 kernel/locking/lockdep.c:4484 __mutex_lock_common kernel/locking/mutex.c:956 [inline] __mutex_lock+0x158/0x1340 kernel/locking/mutex.c:1103 do_ip_setsockopt.isra.0+0x277/0x3820 net/ipv4/ip_sockglue.c:644 ip_setsockopt+0x44/0xf0 net/ipv4/ip_sockglue.c:1248 tcp_setsockopt net/ipv4/tcp.c:3159 [inline] tcp_setsockopt+0x8c/0xd0 net/ipv4/tcp.c:3153 kernel_setsockopt+0x121/0x1f0 net/socket.c:3767 mptcp_setsockopt+0x69/0x90 net/mptcp/protocol.c:1288 __sys_setsockopt+0x152/0x240 net/socket.c:2130 __do_sys_setsockopt net/socket.c:2146 [inline] __se_sys_setsockopt net/socket.c:2143 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2143 do_syscall_64+0xbd/0x5b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET); lock(rtnl_mutex); lock(sk_lock-AF_INET); lock(rtnl_mutex); The lockdep complaint is because we hold mptcp socket lock when calling the sk_prot get/setsockopt handler, and those might need to acquire the rtnl mutex. Normally, order is: rtnl_lock(sk) -> lock_sock Whereas for mptcp the order is lock_sock(mptcp_sk) rtnl_lock -> lock_sock(subflow_sk) We can avoid this by releasing the mptcp socket lock early, but, as Paolo points out, we need to get/put the subflow socket refcount before doing so to avoid race with concurrent close(). Fixes: 717e79c867ca5 ("mptcp: Add setsockopt()/getsockopt() socket operations") Reported-by: Christoph Paasch Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit c9fd9c5f4b935516ba8be31f2e7590caf0bc2c6f Author: Florian Westphal Date: Wed Jan 29 15:54:43 2020 +0100 mptcp: defer freeing of cached ext until last moment access to msk->cached_ext is only legal if the msk is locked or all concurrent accesses are impossible. Furthermore, once we start to tear down, we must make sure nothing else can step in and allocate a new cached ext. So place this code in the destroy callback where it belongs. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit d3e42bb0a329fadff98fcb927714d0a486840e3b Author: Martin KaFai Lau Date: Mon Jan 27 09:51:45 2020 -0800 bpf: Reuse log from btf_prase_vmlinux() in btf_struct_ops_init() Instead of using a locally defined "struct bpf_verifier_log log = {}", btf_struct_ops_init() should reuse the "log" from its calling function "btf_parse_vmlinux()". It should also resolve the frame-size too large compiler warning in some ARCH. Fixes: 27ae7997a661 ("bpf: Introduce BPF_PROG_TYPE_STRUCT_OPS") Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200127175145.1154438-1-kafai@fb.com commit 61ffb9d27860769c5d5596f6e4cca3cded2755e0 Author: Yash Shah Date: Tue Dec 10 16:41:14 2019 +0530 riscv: dts: Add DT support for SiFive FU540 GPIO driver Add the gpio DT node in SiFive FU540 soc-specific DT file. Enable the gpio node in HiFive Unleashed board-specific DT file. Signed-off-by: Yash Shah Signed-off-by: Palmer Dabbelt commit 5c3469cb899abe998299aafb8f16f325d62d2d68 Author: Masami Hiramatsu Date: Wed Jan 29 18:36:44 2020 +0900 tracing/boot: Move external function declarations to kernel/trace/trace.h Move external function declarations into kernel/trace/trace.h from trace_boot.c for tracing subsystem internal use. Link: http://lkml.kernel.org/r/158029060405.12381.11944554430359702545.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 76a598ec8c4fde58aab79b9f7c40c33d54eca67b Author: Masami Hiramatsu Date: Wed Jan 29 18:36:35 2020 +0900 tracing/boot: Include required headers and sort it alphabetically Include some required (but currently indirectly included) headers and sort it alphabetically. Link: http://lkml.kernel.org/r/158029059514.12381.6597832266860248781.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 8557bbe5156e5fba022d5a5220004b1e016227ee Author: SeongJae Park Date: Mon Jan 27 09:19:57 2020 +0100 xen/blkback: Consistently insert one empty line between functions The number of empty lines between functions in the xenbus.c is inconsistent. This trivial style cleanup commit fixes the file to consistently place only one empty line. Acked-by: Roger Pau Monné Signed-off-by: SeongJae Park Signed-off-by: Boris Ostrovsky commit 823f20914693673e5e057ff8eac1acfd8954cf85 Author: SeongJae Park Date: Mon Jan 27 09:18:11 2020 +0100 xen/blkback: Remove unnecessary static variable name prefixes A few of static variables in blkback have 'xen_blkif_' prefix, though it is unnecessary for static variables. This commit removes such prefixes. Reviewed-by: Roger Pau Monné Signed-off-by: SeongJae Park Signed-off-by: Boris Ostrovsky commit cb9369bdbb84440e9a8fded7eb2d0f94014f9a8f Author: SeongJae Park Date: Mon Jan 27 09:18:10 2020 +0100 xen/blkback: Squeeze page pools if a memory pressure is detected Each `blkif` has a free pages pool for the grant mapping. The size of the pool starts from zero and is increased on demand while processing the I/O requests. If current I/O requests handling is finished or 100 milliseconds has passed since last I/O requests handling, it checks and shrinks the pool to not exceed the size limit, `max_buffer_pages`. Therefore, host administrators can cause memory pressure in blkback by attaching a large number of block devices and inducing I/O. Such problematic situations can be avoided by limiting the maximum number of devices that can be attached, but finding the optimal limit is not so easy. Improper set of the limit can results in memory pressure or a resource underutilization. This commit avoids such problematic situations by squeezing the pools (returns every free page in the pool to the system) for a while (users can set this duration via a module parameter) if memory pressure is detected. Discussions =========== The `blkback`'s original shrinking mechanism returns only pages in the pool which are not currently be used by `blkback` to the system. In other words, the pages that are not mapped with granted pages. Because this commit is changing only the shrink limit but still uses the same freeing mechanism it does not touch pages which are currently mapping grants. Once memory pressure is detected, this commit keeps the squeezing limit for a user-specified time duration. The duration should be neither too long nor too short. If it is too long, the squeezing incurring overhead can reduce the I/O performance. If it is too short, `blkback` will not free enough pages to reduce the memory pressure. This commit sets the value as `10 milliseconds` by default because it is a short time in terms of I/O while it is a long time in terms of memory operations. Also, as the original shrinking mechanism works for at least every 100 milliseconds, this could be a somewhat reasonable choice. I also tested other durations (refer to the below section for more details) and confirmed that 10 milliseconds is the one that works best with the test. That said, the proper duration depends on actual configurations and workloads. That's why this commit allows users to set the duration as a module parameter. Memory Pressure Test ==================== To show how this commit fixes the memory pressure situation well, I configured a test environment on a xen-running virtualization system. On the `blkfront` running guest instances, I attach a large number of network-backed volume devices and induce I/O to those. Meanwhile, I measure the number of pages that swapped in (pswpin) and out (pswpout) on the `blkback` running guest. The test ran twice, once for the `blkback` before this commit and once for that after this commit. As shown below, this commit has dramatically reduced the memory pressure: pswpin pswpout before 76,672 185,799 after 867 3,967 Optimal Aggressive Shrinking Duration ------------------------------------- To find a best squeezing duration, I repeated the test with three different durations (1ms, 10ms, and 100ms). The results are as below: duration pswpin pswpout 1 707 5,095 10 867 3,967 100 362 3,348 As expected, the memory pressure decreases as the duration increases, but the reduction become slow from the `10ms`. Based on this results, I chose the default duration as 10ms. Performance Overhead Test ========================= This commit could incur I/O performance degradation under severe memory pressure because the squeezing will require more page allocations per I/O. To show the overhead, I artificially made a worst-case squeezing situation and measured the I/O performance of a `blkfront` running guest. For the artificial squeezing, I set the `blkback.max_buffer_pages` using the `/sys/module/xen_blkback/parameters/max_buffer_pages` file. In this test, I set the value to `1024` and `0`. The `1024` is the default value. Setting the value as `0` is same to a situation doing the squeezing always (worst-case). If the underlying block device is slow enough, the squeezing overhead could be hidden. For the reason, I use a fast block device, namely the rbd[1]: # xl block-attach guest phy:/dev/ram0 xvdb w For the I/O performance measurement, I run a simple `dd` command 5 times directly to the device as below and collect the 'MB/s' results. $ for i in {1..5}; do dd if=/dev/zero of=/dev/xvdb \ bs=4k count=$((256*512)); sync; done The results are as below. 'max_pgs' represents the value of the `blkback.max_buffer_pages` parameter. max_pgs Min Max Median Avg Stddev 0 417 423 420 419.4 2.5099801 1024 414 425 416 417.8 4.4384682 No difference proven at 95.0% confidence In short, even worst case squeezing on ramdisk based fast block device makes no visible performance degradation. Please note that this is just a very simple and minimal test. On systems using super-fast block devices and a special I/O workload, the results might be different. If you have any doubt, test on your machine with your workload to find the optimal squeezing duration for you. [1] https://www.kernel.org/doc/html/latest/admin-guide/blockdev/ramdisk.html Reviewed-by: Roger Pau Monné Signed-off-by: SeongJae Park Signed-off-by: Boris Ostrovsky commit 060eabe8fbe726aca341b518366da4d79e338100 Author: SeongJae Park Date: Mon Jan 27 09:18:09 2020 +0100 xenbus/backend: Protect xenbus callback with lock A driver's 'reclaim_memory' callback can race with 'probe' or 'remove' because it will be called whenever memory pressure is detected. To avoid such race, this commit embeds a spinlock in each 'xenbus_device' and make 'xenbus' to hold the lock while the corresponded callbacks are running. Reviewed-by: Juergen Gross Signed-off-by: SeongJae Park Signed-off-by: Boris Ostrovsky commit 8a105678fb3ec4763352db84745968bf2cb4aa65 Author: SeongJae Park Date: Mon Jan 27 09:18:08 2020 +0100 xenbus/backend: Add memory pressure handler callback Granting pages consumes backend system memory. In systems configured with insufficient spare memory for those pages, it can cause a memory pressure situation. However, finding the optimal amount of the spare memory is challenging for large systems having dynamic resource utilization patterns. Also, such a static configuration might lack flexibility. To mitigate such problems, this commit adds a memory reclaim callback to 'xenbus_driver'. If a memory pressure is detected, 'xenbus' requests every backend driver to volunarily release its memory. Note that it would be able to improve the callback facility for more sophisticated handlings of general pressures. For example, it would be possible to monitor the memory consumption of each device and issue the release requests to only devices which causing the pressure. Also, the callback could be extended to handle not only memory, but general resources. Nevertheless, this version of the implementation defers such sophisticated goals as a future work. Reviewed-by: Juergen Gross Reviewed-by: Roger Pau Monné Signed-off-by: SeongJae Park Signed-off-by: Boris Ostrovsky commit 44efc78d0e464ce70b45b165c005f8bedc17952e Author: Lorenzo Bianconi Date: Wed Jan 29 12:50:53 2020 +0100 net: mvneta: fix XDP support if sw bm is used as fallback In order to fix XDP support if sw buffer management is used as fallback for hw bm devices, define MVNETA_SKB_HEADROOM as maximum between XDP_PACKET_HEADROOM and NET_SKB_PAD and let the hw aligns the IP header to 4-byte boundary. Fix rx_offset_correction initialization if mvneta_bm_port_init fails in mvneta_resume routine Fixes: 0db51da7a8e9 ("net: mvneta: add basic XDP support") Tested-by: Sven Auhagen Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 656b42deddea57e55a570671db9403af0ed3c439 Author: Randy Dunlap Date: Tue Jan 28 18:25:14 2020 -0800 irqchip: Some Kconfig cleanup for C-SKY Fixes to Kconfig help text: - spell out "hardware" - fix verb usage Signed-off-by: Randy Dunlap Signed-off-by: Marc Zyngier Acked-by: Guo Ren Link: https://lore.kernel.org/r/d44baeee-cceb-7c02-7249-e6b4817f0847@infradead.org commit 979923871f69a4dc926658f9f9a1a4c1bde57552 Author: Thomas Gleixner Date: Thu Jan 23 12:54:53 2020 +0100 x86/timer: Don't skip PIT setup when APIC is disabled or in legacy mode Tony reported a boot regression caused by the recent workaround for systems which have a disabled (clock gate off) PIT. On his machine the kernel fails to initialize the PIT because apic_needs_pit() does not take into account whether the local APIC interrupt delivery mode will actually allow to setup and use the local APIC timer. This should be easy to reproduce with acpi=off on the command line which also disables HPET. Due to the way the PIT/HPET and APIC setup ordering works (APIC setup can require working PIT/HPET) the information is not available at the point where apic_needs_pit() makes this decision. To address this, split out the interrupt mode selection from apic_intr_mode_init(), invoke the selection before making the decision whether PIT is required or not, and add the missing checks into apic_needs_pit(). Fixes: c8c4076723da ("x86/timer: Skip PIT initialization on modern chipsets") Reported-by: Anthony Buckley Tested-by: Anthony Buckley Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Cc: Daniel Drake Link: https://bugzilla.kernel.org/show_bug.cgi?id=206125 Link: https://lore.kernel.org/r/87sgk6tmk2.fsf@nanos.tec.linutronix.de commit 6ac7e4d7ad70640310feedc2e5f1cb712685cb05 Author: Srinivas Kandagatla Date: Thu Dec 19 10:31:44 2019 +0000 mfd: wcd934x: Add support to wcd9340/wcd9341 codec Qualcomm WCD9340/WCD9341 Codec is a standalone Hi-Fi audio codec IC. This codec has integrated SoundWire controller, pin controller and interrupt controller. Signed-off-by: Srinivas Kandagatla Reviewed-by: Pierre-Louis Bossart Signed-off-by: Lee Jones commit 793da4bfba7b8a785d38662f57fbcb2252b6f904 Author: Joe Perches Date: Tue Jan 28 11:12:03 2020 -0800 sch_choke: Use kvcalloc Convert the use of kvmalloc_array with __GFP_ZERO to the equivalent kvcalloc. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit 58b278f568f0509497e2df7310bfd719156a60d1 Author: Vaibhav Jain Date: Wed Aug 28 13:57:29 2019 +0530 powerpc: Provide initial documentation for PAPR hcalls This doc patch provides an initial description of the hcall op-codes that are used by Linux kernel running as a guest (LPAR) on top of PowerVM or any other sPAPR compliant hyper-visor (e.g qemu). Apart from documenting the hcalls the doc-patch also provides a rudimentary overview of how hcall ABI, how they are issued with the Linux kernel and how information/control flows between the guest and hypervisor. Signed-off-by: Vaibhav Jain Reviewed-by: Laurent Dufour Acked-by: Nicholas Piggin [mpe: Add SPDX tag, add it to index.rst] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190828082729.16695-1-vaibhav@linux.ibm.com commit f6f7d8cf55348751cc8a5f40c8f9835ee1752df4 Author: David S. Miller Date: Wed Jan 29 10:39:23 2020 +0100 mptcp: Fix build with PROC_FS disabled. net/mptcp/subflow.c: In function ‘mptcp_subflow_create_socket’: net/mptcp/subflow.c:624:25: error: ‘struct netns_core’ has no member named ‘sock_inuse’ Reported-by: Randy Dunlap Signed-off-by: David S. Miller commit 74759e1693311a8d1441de836c4080c192374238 Author: Randy Dunlap Date: Tue Jan 28 20:45:54 2020 -0800 MAINTAINERS: mptcp@ mailing list is moderated Note that mptcp@lists.01.org is moderated, like we note for other mailing lists. Signed-off-by: Randy Dunlap Cc: Mat Martineau Cc: Matthieu Baerts Cc: netdev@vger.kernel.org Cc: mptcp@lists.01.org Signed-off-by: David S. Miller commit c3463aed05abf06bd5ebaac12f2c015db298b98f Author: Ben Skeggs Date: Wed Jan 29 11:29:05 2020 +1000 drm/nouveau/fb/gp102-: allow module to load even when scrubber binary is missing Without relaxing this requirement, TU10x boards will fail to load without an updated linux-firmware, and TU11x will completely fail to load because FW isn't available yet. Signed-off-by: Ben Skeggs commit 1c338ed5e52b62737a9d45f37f085bdbb367821b Author: Ben Skeggs Date: Wed Jan 29 11:20:34 2020 +1000 drm/nouveau/acr: return error when registering LSF if ACR not supported This fixes an oops on TU11x GPUs where SEC2 attempts to register its falcon, and triggers a NULL-pointer deref because ACR isn't yet supported. Signed-off-by: Ben Skeggs commit 86e18ebd87072ed1ba6ecd86271e7a712115d579 Author: Ben Skeggs Date: Tue Jan 28 15:03:25 2020 +1000 drm/nouveau/disp/gv100-: not all channel types support reporting error codes Signed-off-by: Ben Skeggs commit 0e6176c6d286316e9431b4f695940cfac4ffe6c2 Author: Ben Skeggs Date: Tue Jan 28 14:39:26 2020 +1000 drm/nouveau/disp/nv50-: prevent oops when no channel method map provided The implementations for most channel types contains a map of methods to priv registers in order to provide debugging info when a disp exception has been raised. This info is missing from the implementation of PIO channels as they're rather simplistic already, however, if an exception is raised by one of them, we'd end up triggering a NULL-pointer deref. Not ideal... Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206299 Signed-off-by: Ben Skeggs commit 0352029ed83ff4d3f99e6bcf31bed5a97b07e3cf Author: Ben Skeggs Date: Thu Jan 23 15:52:12 2020 +1000 drm/nouveau: support synchronous pushbuf submission This is useful for debugging GPU hangs. Signed-off-by: Ben Skeggs commit ea13e5abf807ea912ce84eef6a1946b9a38c6508 Author: Ben Skeggs Date: Thu Jan 23 15:39:27 2020 +1000 drm/nouveau: signal pending fences when channel has been killed Signed-off-by: Ben Skeggs commit 0181f4bfbdcdfdf8474946bf14fd644727fb8363 Author: Ben Skeggs Date: Thu Jan 23 13:47:12 2020 +1000 drm/nouveau: reject attempts to submit to dead channels Signed-off-by: Ben Skeggs commit 4c9ee1bfca820b93f107957f5322845c862ea368 Author: Ben Skeggs Date: Thu Jan 23 13:55:19 2020 +1000 drm/nouveau: zero vma pointer even if we only unreference it rather than free I'm not sure this affects anything, but best be safe. Signed-off-by: Ben Skeggs commit 742db30c4ee6cd28142e83e154b5271f95a2c67a Author: Takashi Iwai Date: Mon Jan 13 15:17:21 2020 +0100 drm/nouveau: Add HD-audio component notifier support This patch adds the support for the notification of HD-audio hotplug via the already existing drm_audio_component framework. This allows us more reliable hotplug notification and ELD transfer without accessing HD-audio bus; it's more efficient, and more importantly, it works without waking up the runtime PM. The implementation is rather simplistic: nouveau driver provides the get_eld ops for HD-audio, and it notifies the audio hotplug via pin_eld_notify callback upon each nv50_audio_enable() and _disable() call. As the HD-audio pin assignment seems corresponding to the CRTC, the crtc->index number is passed directly as the zero-based port number. The bind and unbind callbacks handle the device-link so that it assures the PM call order. Link: https://lore.kernel.org/r/20190722143815.7339-3-tiwai@suse.de Reviewed-by: Lyude Paul Cc: Jaroslav Kysela Signed-off-by: Takashi Iwai Signed-off-by: Ben Skeggs commit fd24a8624eb29d3b6b7df68096ce0321b19b03c6 Author: David Michael Date: Sun Jan 26 17:31:58 2020 -0500 KVM: PPC: Book3S PR: Fix -Werror=return-type build failure Fixes: 3a167beac07c ("kvm: powerpc: Add kvmppc_ops callback") Signed-off-by: David Michael Signed-off-by: Paul Mackerras commit e032e3b55b6f487e48c163c5dca74086f147a169 Author: Bharata B Rao Date: Wed Jan 22 10:25:42 2020 +0530 KVM: PPC: Book3S HV: Release lock on page-out failure path When migrate_vma_setup() fails in kvmppc_svm_page_out(), release kvm->arch.uvmem_lock before returning. Fixes: ca9f4942670 ("KVM: PPC: Book3S HV: Support for running secure guests") Signed-off-by: Bharata B Rao Reviewed-by: Kamalesh Babulal Signed-off-by: Paul Mackerras commit 34f71a4a2de84dde52ccfcb96ce25240ea7981a8 Author: Tom Zanussi Date: Fri Jun 28 12:40:23 2019 -0500 tracing: Add new testcases for hist trigger parsing errors Add a testcase ensuring that the tracing error_log correctly displays hist trigger parsing errors. Link: http://lkml.kernel.org/r/62ec58d9aca661cde46ba678e32a938427945e9e.1561743018.git.zanussi@kernel.org Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit d0a497066f92eee6e5750af6a0ca32866030931a Author: Tom Zanussi Date: Fri Jun 28 12:40:22 2019 -0500 tracing: Add 'hist:' to hist trigger error log error string The 'hist:' prefix gets stripped from the command text during command processing, but should be added back when displaying the command during error processing. Not only because it's what should be displayed but also because not having it means the test cases fail because the caret is miscalculated by the length of the prefix string. Link: http://lkml.kernel.org/r/449df721f560042e22382f67574bcc5b4d830d3d.1561743018.git.zanussi@kernel.org Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 4de26c8c967d55551d3983771116a2c3c0a4f464 Author: Tom Zanussi Date: Fri Jun 28 12:40:21 2019 -0500 tracing: Add hist trigger error messages for sort specification Add error codes and messages for all the error paths leading to sort specification parsing errors. Link: http://lkml.kernel.org/r/237830dc05e583fbb53664d817a784297bf961be.1561743018.git.zanussi@kernel.org Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit b527b638fd63ba791dc90a0a6e9a3035b10df52b Author: Tom Zanussi Date: Fri Jun 28 12:40:20 2019 -0500 tracing: Simplify assignment parsing for hist triggers In the process of adding better error messages for sorting, I realized that strsep was being used incorrectly and some of the error paths I was expecting to be hit weren't and just fell through to the common invalid key error case. It also became obvious that for keyword assignments, it wasn't necessary to save the full assignment and reparse it later, and having a common empty-assignment check would also make more sense in terms of error processing. Change the code to fix these problems and simplify it for new error message changes in a subsequent patch. Link: http://lkml.kernel.org/r/1c3ef0b6655deaf345f6faee2584a0298ac2d743.1561743018.git.zanussi@kernel.org Fixes: e62347d24534 ("tracing: Add hist trigger support for user-defined sorting ('sort=' param)") Fixes: 7ef224d1d0e3 ("tracing: Add 'hist' event trigger command") Fixes: a4072fe85ba3 ("tracing: Add a clock attribute for hist triggers") Reported-by: Masami Hiramatsu Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit d0ce47cb993ec88d293bac7b51ba2d97ea99594c Author: Mauro Carvalho Chehab Date: Tue Jun 18 15:51:17 2019 -0300 docs: tracing: Fix a broken label Sphinx warnings about his: Documentation/trace/kprobetrace.rst:68: WARNING: undefined label: user_mem_access (if the link has no caption the label must precede a section header) The problem is quite simple: Sphinx wants a blank line after references. Link: http://lkml.kernel.org/r/a83ea390bc28784518fce772b4c961ea1c976f14.1560883872.git.mchehab+samsung@kernel.org Acked-by: Masami Hiramatsu Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Steven Rostedt (VMware) commit b3a6082223369203d7e7db7e81253ac761377644 Merge: 73a0bff2058f 10c2d111c906 Author: Linus Torvalds Date: Tue Jan 28 18:55:17 2020 -0800 Merge branch 'for-v5.6' of git://git.kernel.org:/pub/scm/linux/kernel/git/jmorris/linux-security Pull security subsystem update from James Morris: "Just one minor fix this time" * 'for-v5.6' of git://git.kernel.org:/pub/scm/linux/kernel/git/jmorris/linux-security: security: remove EARLY_LSM_COUNT which never used commit 73a0bff2058f2403c604371c325fec737ac2ac61 Merge: 2cf64d7cb20b d54e17b40666 Author: Linus Torvalds Date: Tue Jan 28 18:52:09 2020 -0800 Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull IMA updates from Mimi Zohar: "Two new features - measuring certificates and querying IMA for a file hash - and three bug fixes: - Measuring certificates is like the rest of IMA, based on policy, but requires loading a custom policy. Certificates loaded onto a keyring, for example during early boot, before a custom policy has been loaded, are queued and only processed after loading the custom policy. - IMA calculates and caches files hashes. Other kernel subsystems, and possibly kernel modules, are interested in accessing these cached file hashes. The bug fixes prevent classifying a file short read (e.g. shutdown) as an invalid file signature, add a missing blank when displaying the securityfs policy rules containing LSM labels, and, lastly, fix the handling of the IMA policy information for unknown LSM labels" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: IMA: Defined delayed workqueue to free the queued keys IMA: Call workqueue functions to measure queued keys IMA: Define workqueue for early boot key measurements IMA: pre-allocate buffer to hold keyrings string ima: ima/lsm policy rule loading logic bug fixes ima: add the ability to query the cached hash of a given file ima: Add a space after printing LSM rules for readability IMA: fix measuring asymmetric keys Kconfig IMA: Read keyrings= option from the IMA policy IMA: Add support to limit measuring keys KEYS: Call the IMA hook to measure keys IMA: Define an IMA hook to measure keys IMA: Add KEY_CHECK func to measure keys IMA: Check IMA policy flag ima: avoid appraise error for hash calc interrupt commit 2cf64d7cb20b04cf25e4ebffc37833298f1d4bde Merge: 740eaf7d4dd2 a8772fad0172 Author: Linus Torvalds Date: Tue Jan 28 18:49:23 2020 -0800 Merge tag 'tomoyo-pr-20200128' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 Pull tomoyo update from Tetsuo Handa: "One 'int' -> 'atomic_t' conversion patch to suppress KCSAN's warning" * tag 'tomoyo-pr-20200128' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1: tomoyo: Use atomic_t for statistics counter commit 740eaf7d4dd255789987a543b0203ca239b37087 Merge: fad7bdc9b054 17248ea03674 Author: Linus Torvalds Date: Tue Jan 28 18:43:08 2020 -0800 Merge tag 's390-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Add clang 10 build support. - Fix BUG() implementation to contain precise bug address, which is relevant for kprobes. - Make ftraced function appear in a stacktrace. - Minor perf improvements and refactoring. - Possible deadlock and recovery fixes in pci code. * tag 's390-5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: fix __EMIT_BUG() macro s390/ftrace: generate traced function stack frame s390: adjust -mpacked-stack support check for clang 10 s390/jump_label: use "i" constraint for clang s390/cpum_sf: Use DIV_ROUND_UP s390/cpum_sf: Use kzalloc and minor changes s390/cpum_sf: Convert debug trace to common layout s390/pci: Fix possible deadlock in recover_store() s390/pci: Recover handle in clp_set_pci_fn() commit fad7bdc9b054a3dc2f5e77a8061c07aead6f5a5e Merge: a78416d97425 d65197ad5249 Author: Linus Torvalds Date: Tue Jan 28 18:29:25 2020 -0800 Merge tag 'for-linus-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Anton Ivanov: "I am sending this on behalf of Richard who is traveling. This contains the following changes for UML: - Fix for time travel mode - Disable CONFIG_CONSTRUCTORS again - A new command line option to have an non-raw serial line - Preparations to remove obsolete UML network drivers" * tag 'for-linus-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Fix time-travel=inf-cpu with xor/raid6 Revert "um: Enable CONFIG_CONSTRUCTORS" um: Mark non-vector net transports as obsolete um: Add an option to make serial driver non-raw commit a78416d97425551b6790dc56626ac5c87415f3fc Merge: abb22e44cff3 20279420ae3a Author: Linus Torvalds Date: Tue Jan 28 18:26:09 2020 -0800 Merge tag 'trace-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Kprobe events added 'ustring' to distinguish reading strings from kernel space or user space. But the creating of the event format file only checks for 'string' to display string formats. 'ustring' must also be handled" * tag 'trace-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/kprobes: Have uname use __get_str() in print_fmt commit 75c6a03904e0dd414a4d99a3072075cb5117e5bc Author: Jens Axboe Date: Tue Jan 28 10:15:23 2020 -0700 io_uring: support using a registered personality for commands For personalities previously registered via IORING_REGISTER_PERSONALITY, allow any command to select them. This is done through setting sqe->personality to the id returned from registration, and then flagging sqe->flags with IOSQE_PERSONALITY. Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 071698e13ac6ba786dfa22349a7b62deb5a9464d Author: Jens Axboe Date: Tue Jan 28 10:04:42 2020 -0700 io_uring: allow registering credentials If an application wants to use a ring with different kinds of credentials, it can register them upfront. We don't lookup credentials, the credentials of the task calling IORING_REGISTER_PERSONALITY is used. An 'id' is returned for the application to use in subsequent personality support. Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 24369c2e3bb06d8c4e71fd6ceaf4f8a01ae79b7c Author: Pavel Begunkov Date: Tue Jan 28 03:15:48 2020 +0300 io_uring: add io-wq workqueue sharing If IORING_SETUP_ATTACH_WQ is set, it expects wq_fd in io_uring_params to be a valid io_uring fd io-wq of which will be shared with the newly created io_uring instance. If the flag is set but it can't share io-wq, it fails. This allows creation of "sibling" io_urings, where we prefer to keep the SQ/CQ private, but want to share the async backend to minimize the amount of overhead associated with having multiple rings that belong to the same backend. Reported-by: Jens Axboe Reported-by: Daurnimator Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit eba6f5a330cf042bb0001f0b5e8cbf21be1b25d6 Author: Pavel Begunkov Date: Tue Jan 28 03:15:47 2020 +0300 io-wq: allow grabbing existing io-wq Export a helper to attach to an existing io-wq, rather than setting up a new one. This is doable now that we have reference counted io_wq's. Reported-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit cccf0ee834559ae0b327b40290e14f6a2a017177 Author: Jens Axboe Date: Mon Jan 27 16:34:48 2020 -0700 io_uring/io-wq: don't use static creds/mm assignments We currently setup the io_wq with a static set of mm and creds. Even for a single-use io-wq per io_uring, this is suboptimal as we have may have multiple enters of the ring. For sharing the io-wq backend, it doesn't work at all. Switch to passing in the creds and mm when the work item is setup. This means that async work is no longer deferred to the io_uring mm and creds, it is done with the current mm and creds. Flag this behavior with IORING_FEAT_CUR_PERSONALITY, so applications know they can rely on the current personality (mm and creds) being the same for direct issue and async issue. Reviewed-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit abb22e44cff3f11d9e087bdd46c04bb32ff57678 Merge: fb95aae6e67c 2f23e319b133 Author: Linus Torvalds Date: Tue Jan 28 16:31:08 2020 -0800 Merge tag 'thermal-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal updates from Daniel Lezcano: - Depromote debug print on the db8500 platform (Linus Walleij) - Fix compilation warning when compiling with make W=1 (Amit Kucheria) - Code cleanup and refactoring, regmap conversion and add hwmon support on Qoriq (Andrey Smirnov) - Add an idle injection cpu cooling device and its documentation, rename the cpu_cooling device to cpufreq_cooling device (Daniel Lezcano) - Convert unexported functions to static, add the __init annotation in the thermal-of code and remove the pointless wrapper functions (Daniel Lezcano) - Fix register offset for Armada XP and register reset bit initialization (Zak Hays) - Enable hwmon on the rockchip (Stefan Schaeckeler) - Add the thermal sensor for the H6/H5/H3/A64/A83T/R40 sun8i platform and their device tree bindings, followed by a fix for the ths number and the sparse warnings (Yangtao Li) - Code cleansup for the sun8i and hwmon support (Yangtao Li) - Silent some messages which are misleading given the changes made in the previous version on generic-adc (Martin Blumenstingl) - Rename exynos to Exynos (Krzysztof Kozlowski) - Add the bcm2711 thermal driver with the device tree bindings (Stefan Wahren) - Use usleep_range() instead of udelay() as the call is always done in a sleep-able context (Geert Uytterhoeven) - Do code cleanup and re-organization to set the scene for a new process for the brcmstb (Florian Fainelli) - Fix bindings check issues on brcm (Stefan Wahren) - Add Jasper Lake support on int340x (Nivedita Swaminathan) - Add Comet Lake support on intel pch (Gayatri Kammela) - Fix unmatched pci_release_region() on x86 (Chuhong Yuan) - Remove temperature boundaries for rcar and rcar3 (Niklas Söderlund) - Fix return value to -ENODEV when thermal_zone_of_sensor_register() is called with the of-node is missing (Peter Mamonov) - Code cleanup, interrupt bouncing, and better support on stm32 (Pascal Paillet) * tag 'thermal-v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (66 commits) thermal: stm32: Fix low threshold interrupt flood thermal: stm32: Improve temperature computing thermal: stm32: Handle multiple trip points thermal: stm32: Disable interrupts at probe thermal: stm32: Rework sensor mode management thermal: stm32: Fix icifr register name thermal: of: Make thermal_zone_of_sensor_register return -ENODEV if a sensor OF node is missing thermal: rcar_gen3_thermal: Remove temperature bound thermal: rcar_thermal: Remove temperature bound thermal: intel: intel_pch_thermal: Add Comet Lake (CML) platform support thermal: intel: Fix unmatched pci_release_region thermal: int340x: processor_thermal: Add Jasper Lake support dt-bindings: brcm,avs-ro-thermal: Fix binding check issues thermal: brcmstb_thermal: Register different ops per process thermal: brcmstb_thermal: Restructure interrupt registration thermal: brcmstb_thermal: Add 16nm process thermal parameters dt-bindings: thermal: Define BCM7216 thermal sensor compatible thermal: brcmstb_thermal: Prepare to support a different process thermal: brcmstb_thermal: Do not use DT coefficients thermal: rcar_thermal: Use usleep_range() instead of udelay() ... commit fb95aae6e67c4e319a24b3eea32032d4246a5335 Merge: bd2463ac7d7e 90fb04f890bc Author: Linus Torvalds Date: Tue Jan 28 16:26:57 2020 -0800 Merge tag 'sound-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "As the diffstat shows we've had again a lot of works done for this cycle: the majority of changes are the continued componentization and code refactoring in ASoC, the tree-wide PCM API updates and cleanups and SOF updates while a few ASoC driver updates are seen, too. Here we go, some highlights: Core: - Finally y2038 support landed to ALSA ABI; some ioctls have been extended and lots of tricks were applied - Applying the new managed PCM buffer API to all drivers; the API itself was already merged in 5.5 - The already deprecated dimension support in ALSA control API is dropped completely now - Verification of ALSA control elements to catch API misuses ASoC: - Further code refactorings and moving things to the component level - Lots of updates and improvements on SOF / Intel drivers; now including common HDMI driver and SoundWire support - New driver support for Ingenic JZ4770, Mediatek MT6660, Qualcomm WCD934x and WSA881x, and Realtek RT700, RT711, RT715, RT1011, RT1015 and RT1308 HD-audio: - Improved ring-buffer communications using waitqueue - Drop the superfluous buffer preallocation on x86 Others: - Many code cleanups, mostly constifications over the whole tree - USB-audio: quirks for MOTU, Corsair Virtuoso, Line6 Helix - FireWire: code refactoring for oxfw and dice drivers" * tag 'sound-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (638 commits) ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82 ALSA: hda: Add Clevo W65_67SB the power_save blacklist ASoC: soc-core: remove null_snd_soc_ops ASoC: soc-pcm: add soc_rtd_trigger() ASoC: soc-pcm: add soc_rtd_hw_free() ASoC: soc-pcm: add soc_rtd_hw_params() ASoC: soc-pcm: add soc_rtd_prepare() ASoC: soc-pcm: add soc_rtd_shutdown() ASoC: soc-pcm: add soc_rtd_startup() ASoC: rt1015: add rt1015 amplifier driver ASoC: madera: Correct some kernel doc ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug ASoC: madera: Correct DMIC only input hook ups ALSA: cs46xx: fix spelling mistake "to" -> "too" ALSA: hda - Add docking station support for Lenovo Thinkpad T420s ASoC: Add MediaTek MT6660 Speaker Amp Driver ASoC: dt-bindings: rt5645: add suppliers ASoC: max98090: fix deadlock in max98090_dapm_put_enum_double() ASoC: dapm: add snd_soc_dapm_put_enum_double_locked ... commit bd2463ac7d7ec51d432f23bf0e893fb371a908cd Merge: a78208e24369 f76e4c167ea2 Author: Linus Torvalds Date: Tue Jan 28 16:02:33 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from David Miller: 1) Add WireGuard 2) Add HE and TWT support to ath11k driver, from John Crispin. 3) Add ESP in TCP encapsulation support, from Sabrina Dubroca. 4) Add variable window congestion control to TIPC, from Jon Maloy. 5) Add BCM84881 PHY driver, from Russell King. 6) Start adding netlink support for ethtool operations, from Michal Kubecek. 7) Add XDP drop and TX action support to ena driver, from Sameeh Jubran. 8) Add new ipv4 route notifications so that mlxsw driver does not have to handle identical routes itself. From Ido Schimmel. 9) Add BPF dynamic program extensions, from Alexei Starovoitov. 10) Support RX and TX timestamping in igc, from Vinicius Costa Gomes. 11) Add support for macsec HW offloading, from Antoine Tenart. 12) Add initial support for MPTCP protocol, from Christoph Paasch, Matthieu Baerts, Florian Westphal, Peter Krystad, and many others. 13) Add Octeontx2 PF support, from Sunil Goutham, Geetha sowjanya, Linu Cherian, and others. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1469 commits) net: phy: add default ARCH_BCM_IPROC for MDIO_BCM_IPROC udp: segment looped gso packets correctly netem: change mailing list qed: FW 8.42.2.0 debug features qed: rt init valid initialization changed qed: Debug feature: ilt and mdump qed: FW 8.42.2.0 Add fw overlay feature qed: FW 8.42.2.0 HSI changes qed: FW 8.42.2.0 iscsi/fcoe changes qed: Add abstraction for different hsi values per chip qed: FW 8.42.2.0 Additional ll2 type qed: Use dmae to write to widebus registers in fw_funcs qed: FW 8.42.2.0 Parser offsets modified qed: FW 8.42.2.0 Queue Manager changes qed: FW 8.42.2.0 Expose new registers and change windows qed: FW 8.42.2.0 Internal ram offsets modifications MAINTAINERS: Add entry for Marvell OcteonTX2 Physical Function driver Documentation: net: octeontx2: Add RVU HW and drivers overview octeontx2-pf: ethtool RSS config support octeontx2-pf: Add basic ethtool support ... commit a78208e2436963d0b2c7d186277d6e1a9755029a Merge: 68353984d63d 0bc81767c5bd Author: Linus Torvalds Date: Tue Jan 28 15:38:56 2020 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Removed CRYPTO_TFM_RES flags - Extended spawn grabbing to all algorithm types - Moved hash descsize verification into API code Algorithms: - Fixed recursive pcrypt dead-lock - Added new 32 and 64-bit generic versions of poly1305 - Added cryptogams implementation of x86/poly1305 Drivers: - Added support for i.MX8M Mini in caam - Added support for i.MX8M Nano in caam - Added support for i.MX8M Plus in caam - Added support for A33 variant of SS in sun4i-ss - Added TEE support for Raven Ridge in ccp - Added in-kernel API to submit TEE commands in ccp - Added AMD-TEE driver - Added support for BCM2711 in iproc-rng200 - Added support for AES256-GCM based ciphers for chtls - Added aead support on SEC2 in hisilicon" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (244 commits) crypto: arm/chacha - fix build failured when kernel mode NEON is disabled crypto: caam - add support for i.MX8M Plus crypto: x86/poly1305 - emit does base conversion itself crypto: hisilicon - fix spelling mistake "disgest" -> "digest" crypto: chacha20poly1305 - add back missing test vectors and test chunking crypto: x86/poly1305 - fix .gitignore typo tee: fix memory allocation failure checks on drv_data and amdtee crypto: ccree - erase unneeded inline funcs crypto: ccree - make cc_pm_put_suspend() void crypto: ccree - split overloaded usage of irq field crypto: ccree - fix PM race condition crypto: ccree - fix FDE descriptor sequence crypto: ccree - cc_do_send_request() is void func crypto: ccree - fix pm wrongful error reporting crypto: ccree - turn errors to debug msgs crypto: ccree - fix AEAD decrypt auth fail crypto: ccree - fix typo in comment crypto: ccree - fix typos in error msgs crypto: atmel-{aes,sha,tdes} - Retire crypto_platform_data crypto: x86/sha - Eliminate casts on asm implementations ... commit 68353984d63d8d7ea728819dbdb7aecc5f32d360 Merge: c8994374d90b f1f27ad74557 Author: Linus Torvalds Date: Tue Jan 28 15:34:03 2020 -0800 Merge tag '5.6-smb3-fixes-and-dfs-and-readdir-improvements' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs updates from Steve French: "Various SMB3/CIFS fixes including four for stable. - Improvement to fallocate (enables 3 additional xfstests) - Fix for file creation when mounting with modefromsid - Add ability to backup/restore dos attributes and creation time - DFS failover and reconnect fixes - performance optimization for readir Note that due to the upcoming SMB3 Test Event (at SNIA SDC next week) there will likely be more changesets near the end of the merge window (since we will be testing heavily next week, I held off on some patches and I expect some additional multichannel patches as well as patches to enable some additional xfstests)" * tag '5.6-smb3-fixes-and-dfs-and-readdir-improvements' of git://git.samba.org/sfrench/cifs-2.6: (24 commits) CIFS: Fix task struct use-after-free on reconnect cifs: use PTR_ERR_OR_ZERO() to simplify code cifs: add support for fallocate mode 0 for non-sparse files cifs: fix NULL dereference in match_prepath smb3: fix default permissions on new files when mounting with modefromsid CIFS: Add support for setting owner info, dos attributes, and create time cifs: remove set but not used variable 'server' cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() cifs: Fix mount options set in automount cifs: fix unitialized variable poential problem with network I/O cache lock patch cifs: Fix return value in __update_cache_entry cifs: Avoid doing network I/O while holding cache lock cifs: Fix potential deadlock when updating vol in cifs_reconnect() cifs: Merge is_path_valid() into get_normalized_path() cifs: Introduce helpers for finding TCP connection cifs: Get rid of kstrdup_const()'d paths cifs: Clean up DFS referral cache cifs: Don't use iov_iter::type directly cifs: set correct max-buffer-size for smb2_ioctl_init() cifs: use compounding for open and first query-dir for readdir() ... commit c8994374d90b5823b3b29a5e5d8648ac418b57b4 Merge: f0d874414329 da3a3da4e6c6 Author: Linus Torvalds Date: Tue Jan 28 15:31:03 2020 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fsverity updates from Eric Biggers: - Optimize fs-verity sequential read performance by implementing readahead of Merkle tree pages. This allows the Merkle tree to be read in larger chunks. - Optimize FS_IOC_ENABLE_VERITY performance in the uncached case by implementing readahead of data pages. - Allocate the hash requests from a mempool in order to eliminate the possibility of allocation failures during I/O. * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fs-verity: use u64_to_user_ptr() fs-verity: use mempool for hash requests fs-verity: implement readahead of Merkle tree pages fs-verity: implement readahead for FS_IOC_ENABLE_VERITY commit f0d874414329a86b67198cb0299d0dc9310592f1 Merge: b5f7ab6b1c4e edc440e3d27f Author: Linus Torvalds Date: Tue Jan 28 15:22:21 2020 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt updates from Eric Biggers: - Extend the FS_IOC_ADD_ENCRYPTION_KEY ioctl to allow the raw key to be provided via a keyring key. - Prepare for the new dirhash method (SipHash of plaintext name) that will be used by directories that are both encrypted and casefolded. - Switch to a new format for "no-key names" that prepares for the new dirhash method, and also fixes a longstanding bug where multiple filenames could map to the same no-key name. - Allow the crypto algorithms used by fscrypt to be built as loadable modules when the fscrypt-capable filesystems are. - Optimize fscrypt_zeroout_range(). - Various cleanups. * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: (26 commits) fscrypt: improve format of no-key names ubifs: allow both hash and disk name to be provided in no-key names ubifs: don't trigger assertion on invalid no-key filename fscrypt: clarify what is meant by a per-file key fscrypt: derive dirhash key for casefolded directories fscrypt: don't allow v1 policies with casefolding fscrypt: add "fscrypt_" prefix to fname_encrypt() fscrypt: don't print name of busy file when removing key ubifs: use IS_ENCRYPTED() instead of ubifs_crypt_is_encrypted() fscrypt: document gfp_flags for bounce page allocation fscrypt: optimize fscrypt_zeroout_range() fscrypt: remove redundant bi_status check fscrypt: Allow modular crypto algorithms fscrypt: include in UAPI header fscrypt: don't check for ENOKEY from fscrypt_get_encryption_info() fscrypt: remove fscrypt_is_direct_key_policy() fscrypt: move fscrypt_valid_enc_modes() to policy.c fscrypt: check for appropriate use of DIRECT_KEY flag earlier fscrypt: split up fscrypt_supported_policy() by policy version fscrypt: introduce fscrypt_needs_contents_encryption() ... commit b5f7ab6b1c4ed967fb76258f79251193cb1ad41d Merge: 81a046b18b33 831d2fa25ab8 Author: Linus Torvalds Date: Tue Jan 28 15:18:23 2020 -0800 Merge tag 'fs-dedupe-last-block-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull fs deduplication fix from David Sterba: "This is a fix for deduplication bug: the last block of two files is allowed to deduplicated. This got broken in 5.1 by lifting some generic checks to VFS layer. The affected filesystems are btrfs and xfs. The patches are marked for stable as the bug decreases deduplication effectivity" * tag 'fs-dedupe-last-block-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: make deduplication with range including the last block work fs: allow deduplication of eof block into the end of the destination file commit 81a046b18b331ed6192e6fd9ff6d12a1f18058cf Merge: 511fdb784422 4e19443da194 Author: Linus Torvalds Date: Tue Jan 28 14:53:31 2020 -0800 Merge tag 'for-5.6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Features, highlights: - async discard - "mount -o discard=async" to enable it - freed extents are not discarded immediatelly, but grouped together and trimmed later, with IO rate limiting - the "sync" mode submits short extents that could have been ignored completely by the device, for SATA prior to 3.1 the requests are unqueued and have a big impact on performance - the actual discard IO requests have been moved out of transaction commit to a worker thread, improving commit latency - IO rate and request size can be tuned by sysfs files, for now enabled only with CONFIG_BTRFS_DEBUG as we might need to add/delete the files and don't have a stable-ish ABI for general use, defaults are conservative - export device state info in sysfs, eg. missing, writeable - no discard of extents known to be untouched on disk (eg. after reservation) - device stats reset is logged with process name and PID that called the ioctl Fixes: - fix missing hole after hole punching and fsync when using NO_HOLES - writeback: range cyclic mode could miss some dirty pages and lead to OOM - two more corner cases for metadata_uuid change after power loss during the change - fix infinite loop during fsync after mix of rename operations Core changes: - qgroup assign returns ENOTCONN when quotas not enabled, used to return EINVAL that was confusing - device closing does not need to allocate memory anymore - snapshot aware code got removed, disabled for years due to performance problems, reimplmentation will allow to select wheter defrag breaks or does not break COW on shared extents - tree-checker: - check leaf chunk item size, cross check against number of stripes - verify location keys for DIR_ITEM, DIR_INDEX and XATTR items - new self test for physical -> logical mapping code, used for super block range exclusion - assertion helpers/macros updated to avoid objtool "unreachable code" reports on older compilers or config option combinations" * tag 'for-5.6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (84 commits) btrfs: free block groups after free'ing fs trees btrfs: Fix split-brain handling when changing FSID to metadata uuid btrfs: Handle another split brain scenario with metadata uuid feature btrfs: Factor out metadata_uuid code from find_fsid. btrfs: Call find_fsid from find_fsid_inprogress Btrfs: fix infinite loop during fsync after rename operations btrfs: set trans->drity in btrfs_commit_transaction btrfs: drop log root for dropped roots btrfs: sysfs, add devid/dev_state kobject and device attributes btrfs: Refactor btrfs_rmap_block to improve readability btrfs: Add self-tests for btrfs_rmap_block btrfs: selftests: Add support for dummy devices btrfs: Move and unexport btrfs_rmap_block btrfs: separate definition of assertion failure handlers btrfs: device stats, log when stats are zeroed btrfs: fix improper setting of scanned for range cyclic write cache pages btrfs: safely advance counter when looking up bio csums btrfs: remove unused member btrfs_device::work btrfs: remove unnecessary wrapper get_alloc_profile btrfs: add correction to handle -1 edge case in async discard ... commit d8639f0d6c230d4c632cbf8ed1f3b9456f338ca0 Author: Andy Shevchenko Date: Tue Jan 28 17:42:00 2020 +0200 MAINTAINERS: Sort entries in database for X-POWERS AXP288 Run parse-maintainers.pl and choose X-POWERS AXP288 record. Fix it accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 4e384d715e0348a4806ce9222078c97fb669640c Author: Andy Shevchenko Date: Tue Jan 28 17:21:51 2020 +0200 MAINTAINERS: Sort entries in database for ACPICA Run parse-maintainers.pl and choose ACPICA record. Fix it accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 54d963968707e21aecd46d5244bc9ae61adac8a0 Author: Andy Shevchenko Date: Tue Jan 28 17:16:41 2020 +0200 MAINTAINERS: Sort entries in database for ACPI Run parse-maintainers.pl and choose ACPI records. Fix them accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 709bd70d070ee6d775c6e77e40e8444bd5fa123f Author: Doug Smythies Date: Mon Jan 27 19:59:57 2020 -0800 tools/power/x86/intel_pstate_tracer: change several graphs to autoscale y-axis Processors have exceeded some of the fixed y-axis scale maximum values. Change them to autoscale the y-axis. Signed-off-by: Doug Smythies Signed-off-by: Rafael J. Wysocki commit e749e09db30c38f1a275945814b0109e530a07b0 Author: Doug Smythies Date: Mon Jan 27 19:59:56 2020 -0800 tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility Some syntax needs to be more rigorous for python 3. Backwards compatibility tested with python 2.7 Signed-off-by: Doug Smythies Signed-off-by: Rafael J. Wysocki commit a7aebdeb13b922590841b7982f75a337aacf43a1 Merge: 6d277aca488f 8c30fa7666ff Author: Rafael J. Wysocki Date: Tue Jan 28 23:38:45 2020 +0100 Merge tag 'linux-cpupower-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility updates for v5.6 from Shuah Khan: "This cpupower update for Linux 5.6-rc1 consists of a revert from Thomas Renninger and a manpage correction from Brahadambal Srinivasan." * tag 'linux-cpupower-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: Correction to manpage of cpupower cpupower: Revert library ABI changes from commit ae2917093fb60bdc1ed3e commit c4e71212a245017d2ab05f322f7722f0b87a55da Author: Arnd Bergmann Date: Tue Jan 28 14:01:52 2020 +0100 Revert "drm/etnaviv: reject timeouts with tv_nsec >= NSEC_PER_SEC" This reverts commit 245595e83fbedda9e107eb0b37cec0ad07733778. Guido Günther reported issues with this patch that broke existing user space. Let's revert it for now and fix it properly later on. Link: https://patchwork.kernel.org/patch/11291089/ https://lore.kernel.org/lkml/20200121114553.2667556-1-arnd@arndb.de/ Cc: Guido Günther Signed-off-by: Arnd Bergmann commit f45719240700398b63a165f6b7f3fbab04f0b052 Author: Alexandre Belloni Date: Tue Jan 28 21:42:00 2020 +0100 dt-bindings: rtc: at91rm9200: document clocks property The clocks property is mandatory, document it. Reported-by: Rob Herring Acked-by: Rob Herring Link: https://lore.kernel.org/r/20200128204200.22201-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 9cd10205227cbe9bbd48fd6bf78dad88b45526b0 Author: Michael Walle Date: Fri Jan 3 00:11:01 2020 +0100 clk: fsl-sai: new driver With this driver it is possible to use the BCLK pin of the SAI module as a generic clock output. This is esp. useful if you want to drive a clock to an audio codec. Because the output only allows integer divider values the audio codec needs an integrated PLL. Signed-off-by: Michael Walle Link: https://lkml.kernel.org/r/20200102231101.11834-3-michael@walle.cc Signed-off-by: Stephen Boyd commit 8798e8fb08b72c60aa1a9e06af7f10425ef40efd Author: Michael Walle Date: Fri Jan 3 00:11:00 2020 +0100 dt-bindings: clock: document the fsl-sai driver Signed-off-by: Michael Walle Reviewed-by: Rob Herring Link: https://lkml.kernel.org/r/20200102231101.11834-2-michael@walle.cc Signed-off-by: Stephen Boyd commit 73ef657275c01928c30c8cec5878834d44af9685 Author: Michael Walle Date: Fri Jan 3 00:10:59 2020 +0100 clk: composite: add _register_composite_pdata() variants Add support for the new way of specifying the clock parents. Add the two new functions clk_hw_register_composite_pdata() clk_register_composite_pdata() to let the driver provide parent_data instead of the parent_names. Signed-off-by: Michael Walle Link: https://lkml.kernel.org/r/20200102231101.11834-1-michael@walle.cc Signed-off-by: Stephen Boyd commit 511fdb78442229ac11057b4a55c3f03c253c062f Merge: 4d6245ce8c8b 4fc265a9c9b2 Author: Linus Torvalds Date: Tue Jan 28 13:06:05 2020 -0800 Merge branch 'x86-mtrr-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mtrr updates from Ingo Molnar: "Two changes: restrict /proc/mtrr to CAP_SYS_ADMIN, plus a cleanup" * 'x86-mtrr-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mtrr: Require CAP_SYS_ADMIN for all access x86/mtrr: Get rid of mtrr_seq_show() forward declaration commit 4d6245ce8c8b441e01a3a1c1e67a1963a84498dd Merge: c0275ae758f8 bbc55341b9c6 Author: Linus Torvalds Date: Tue Jan 28 13:04:38 2020 -0800 Merge branch 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 FPU updates from Ingo Molnar: "Three changes: fix a race that can result in FPU corruption, plus two cleanups" * 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Deactivate FPU state after failure during state load x86/fpu/xstate: Make xfeature_is_supervisor()/xfeature_is_user() return bool x86/fpu/xstate: Fix small issues commit c0275ae758f8ce72306da200b195d1e1d66d0a8d Merge: f6170f0afbe2 283bab980978 Author: Linus Torvalds Date: Tue Jan 28 12:46:42 2020 -0800 Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu-features updates from Ingo Molnar: "The biggest change in this cycle was a large series from Sean Christopherson to clean up the handling of VMX features. This both fixes bugs/inconsistencies and makes the code more coherent and future-proof. There are also two cleanups and a minor TSX syslog messages enhancement" * 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) x86/cpu: Remove redundant cpu_detect_cache_sizes() call x86/cpu: Print "VMX disabled" error message iff KVM is enabled KVM: VMX: Allow KVM_INTEL when building for Centaur and/or Zhaoxin CPUs perf/x86: Provide stubs of KVM helpers for non-Intel CPUs KVM: VMX: Use VMX_FEATURE_* flags to define VMCS control bits KVM: VMX: Check for full VMX support when verifying CPU compatibility KVM: VMX: Use VMX feature flag to query BIOS enabling KVM: VMX: Drop initialization of IA32_FEAT_CTL MSR x86/cpufeatures: Add flag to track whether MSR IA32_FEAT_CTL is configured x86/cpu: Set synthetic VMX cpufeatures during init_ia32_feat_ctl() x86/cpu: Print VMX flags in /proc/cpuinfo using VMX_FEATURES_* x86/cpu: Detect VMX features on Intel, Centaur and Zhaoxin CPUs x86/vmx: Introduce VMX_FEATURES_* x86/cpu: Clear VMX feature flag if VMX is not fully enabled x86/zhaoxin: Use common IA32_FEAT_CTL MSR initialization x86/centaur: Use common IA32_FEAT_CTL MSR initialization x86/mce: WARN once if IA32_FEAT_CTL MSR is left unlocked x86/intel: Initialize IA32_FEAT_CTL MSR at boot tools/x86: Sync msr-index.h from kernel sources selftests, kvm: Replace manual MSR defs with common msr-index.h ... commit 77ce1a47ebca88bf1eb3018855fc1709c7a1ed86 Author: Mauro Carvalho Chehab Date: Tue Jan 28 07:41:01 2020 +0100 docs: filesystems: add overlayfs to index.rst While the document is there, it is currently missing at the index file. Signed-off-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/3b8e7783b1fcc71e4f94af5ea8e5fa264392f8c4.1580193653.git.mchehab+huawei@kernel.org Signed-off-by: Jonathan Corbet commit 1edca3c64e44df1665b0287fd536e79d74d884b6 Author: Mauro Carvalho Chehab Date: Tue Jan 28 07:41:00 2020 +0100 docs: usb: remove some broken references It seems that some files were removed from USB documentation. Update the links accordingly. Signed-off-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/00008303fde6b4e06d027d3b76ae7032614a7030.1580193653.git.mchehab+huawei@kernel.org Signed-off-by: Jonathan Corbet commit 2a4b03ffc69f2dedc6388e9a6438b5f4c133a40d Author: Vincent Guittot Date: Tue Jan 14 15:13:56 2020 +0100 sched/fair: Prevent unlimited runtime on throttled group When a running task is moved on a throttled task group and there is no other task enqueued on the CPU, the task can keep running using 100% CPU whatever the allocated bandwidth for the group and although its cfs rq is throttled. Furthermore, the group entity of the cfs_rq and its parents are not enqueued but only set as curr on their respective cfs_rqs. We have the following sequence: sched_move_task -dequeue_task: dequeue task and group_entities. -put_prev_task: put task and group entities. -sched_change_group: move task to new group. -enqueue_task: enqueue only task but not group entities because cfs_rq is throttled. -set_next_task : set task and group_entities as current sched_entity of their cfs_rq. Another impact is that the root cfs_rq runnable_load_avg at root rq stays null because the group_entities are not enqueued. This situation will stay the same until an "external" event triggers a reschedule. Let trigger it immediately instead. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Ben Segall Link: https://lkml.kernel.org/r/1579011236-31256-1-git-send-email-vincent.guittot@linaro.org commit e938b9c94164e4d981039f1cf6007d7453883e5a Author: Wanpeng Li Date: Mon Jan 13 08:50:27 2020 +0800 sched/nohz: Optimize get_nohz_timer_target() On a machine, CPU 0 is used for housekeeping, the other 39 CPUs in the same socket are in nohz_full mode. We can observe huge time burn in the loop for seaching nearest busy housekeeper cpu by ftrace. 2) | get_nohz_timer_target() { 2) 0.240 us | housekeeping_test_cpu(); 2) 0.458 us | housekeeping_test_cpu(); ... 2) 0.292 us | housekeeping_test_cpu(); 2) 0.240 us | housekeeping_test_cpu(); 2) 0.227 us | housekeeping_any_cpu(); 2) + 43.460 us | } This patch optimizes the searching logic by finding a nearest housekeeper CPU in the housekeeping cpumask, it can minimize the worst searching time from ~44us to < 10us in my testing. In addition, the last iterated busy housekeeper can become a random candidate while current CPU is a better fallback if it is a housekeeper. Signed-off-by: Wanpeng Li Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Frederic Weisbecker Link: https://lkml.kernel.org/r/1578876627-11938-1-git-send-email-wanpengli@tencent.com commit b562d140649966d4daedd0483a8fe59ad3bb465a Author: Qais Yousef Date: Tue Jan 14 21:09:47 2020 +0000 sched/uclamp: Reject negative values in cpu_uclamp_write() The check to ensure that the new written value into cpu.uclamp.{min,max} is within range, [0:100], wasn't working because of the signed comparison 7301 if (req.percent > UCLAMP_PERCENT_SCALE) { 7302 req.ret = -ERANGE; 7303 return req; 7304 } # echo -1 > cpu.uclamp.min # cat cpu.uclamp.min 42949671.96 Cast req.percent into u64 to force the comparison to be unsigned and work as intended in capacity_from_percent(). # echo -1 > cpu.uclamp.min sh: write error: Numerical result out of range Fixes: 2480c093130f ("sched/uclamp: Extend CPU's cgroup controller") Signed-off-by: Qais Yousef Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20200114210947.14083-1-qais.yousef@arm.com commit b396f52326de20ec974471b7b19168867b365cbf Author: Mel Gorman Date: Tue Jan 14 10:13:20 2020 +0000 sched/fair: Allow a small load imbalance between low utilisation SD_NUMA domains The CPU load balancer balances between different domains to spread load and strives to have equal balance everywhere. Communicating tasks can migrate so they are topologically close to each other but these decisions are independent. On a lightly loaded NUMA machine, two communicating tasks pulled together at wakeup time can be pushed apart by the load balancer. In isolation, the load balancer decision is fine but it ignores the tasks data locality and the wakeup/LB paths continually conflict. NUMA balancing is also a factor but it also simply conflicts with the load balancer. This patch allows a fixed degree of imbalance of two tasks to exist between NUMA domains regardless of utilisation levels. In many cases, this prevents communicating tasks being pulled apart. It was evaluated whether the imbalance should be scaled to the domain size. However, no additional benefit was measured across a range of workloads and machines and scaling adds the risk that lower domains have to be rebalanced. While this could change again in the future, such a change should specify the use case and benefit. The most obvious impact is on netperf TCP_STREAM -- two simple communicating tasks with some softirq offload depending on the transmission rate. 2-socket Haswell machine 48 core, HT enabled netperf-tcp -- mmtests config config-network-netperf-unbound baseline lbnuma-v3 Hmean 64 568.73 ( 0.00%) 577.56 * 1.55%* Hmean 128 1089.98 ( 0.00%) 1128.06 * 3.49%* Hmean 256 2061.72 ( 0.00%) 2104.39 * 2.07%* Hmean 1024 7254.27 ( 0.00%) 7557.52 * 4.18%* Hmean 2048 11729.20 ( 0.00%) 13350.67 * 13.82%* Hmean 3312 15309.08 ( 0.00%) 18058.95 * 17.96%* Hmean 4096 17338.75 ( 0.00%) 20483.66 * 18.14%* Hmean 8192 25047.12 ( 0.00%) 27806.84 * 11.02%* Hmean 16384 27359.55 ( 0.00%) 33071.88 * 20.88%* Stddev 64 2.16 ( 0.00%) 2.02 ( 6.53%) Stddev 128 2.31 ( 0.00%) 2.19 ( 5.05%) Stddev 256 11.88 ( 0.00%) 3.22 ( 72.88%) Stddev 1024 23.68 ( 0.00%) 7.24 ( 69.43%) Stddev 2048 79.46 ( 0.00%) 71.49 ( 10.03%) Stddev 3312 26.71 ( 0.00%) 57.80 (-116.41%) Stddev 4096 185.57 ( 0.00%) 96.15 ( 48.19%) Stddev 8192 245.80 ( 0.00%) 100.73 ( 59.02%) Stddev 16384 207.31 ( 0.00%) 141.65 ( 31.67%) In this case, there was a sizable improvement to performance and a general reduction in variance. However, this is not univeral. For most machines, the impact was roughly a 3% performance gain. Ops NUMA base-page range updates 19796.00 292.00 Ops NUMA PTE updates 19796.00 292.00 Ops NUMA PMD updates 0.00 0.00 Ops NUMA hint faults 16113.00 143.00 Ops NUMA hint local faults % 8407.00 142.00 Ops NUMA hint local percent 52.18 99.30 Ops NUMA pages migrated 4244.00 1.00 Without the patch, only 52.18% of sampled accesses are local. In an earlier changelog, 100% of sampled accesses are local and indeed on most machines, this was still the case. In this specific case, the local sampled rates was 99.3% but note the "base-page range updates" and "PTE updates". The activity with the patch is negligible as were the number of faults. The small number of pages migrated were related to shared libraries. A 2-socket Broadwell showed better results on average but are not presented for brevity as the performance was similar except it showed 100% of the sampled NUMA hints were local. The patch holds up for a 4-socket Haswell, an AMD EPYC and AMD Epyc 2 machine. For dbench, the impact depends on the filesystem used and the number of clients. On XFS, there is little difference as the clients typically communicate with workqueues which have a separate class of scheduler problem at the moment. For ext4, performance is generally better, particularly for small numbers of clients as NUMA balancing activity is negligible with the patch applied. A more interesting example is the Facebook schbench which uses a number of messaging threads to communicate with worker threads. In this configuration, one messaging thread is used per NUMA node and the number of worker threads is varied. The 50, 75, 90, 95, 99, 99.5 and 99.9 percentiles for response latency is then reported. Lat 50.00th-qrtle-1 44.00 ( 0.00%) 37.00 ( 15.91%) Lat 75.00th-qrtle-1 53.00 ( 0.00%) 41.00 ( 22.64%) Lat 90.00th-qrtle-1 57.00 ( 0.00%) 42.00 ( 26.32%) Lat 95.00th-qrtle-1 63.00 ( 0.00%) 43.00 ( 31.75%) Lat 99.00th-qrtle-1 76.00 ( 0.00%) 51.00 ( 32.89%) Lat 99.50th-qrtle-1 89.00 ( 0.00%) 52.00 ( 41.57%) Lat 99.90th-qrtle-1 98.00 ( 0.00%) 55.00 ( 43.88%) Lat 50.00th-qrtle-2 42.00 ( 0.00%) 42.00 ( 0.00%) Lat 75.00th-qrtle-2 48.00 ( 0.00%) 47.00 ( 2.08%) Lat 90.00th-qrtle-2 53.00 ( 0.00%) 52.00 ( 1.89%) Lat 95.00th-qrtle-2 55.00 ( 0.00%) 53.00 ( 3.64%) Lat 99.00th-qrtle-2 62.00 ( 0.00%) 60.00 ( 3.23%) Lat 99.50th-qrtle-2 63.00 ( 0.00%) 63.00 ( 0.00%) Lat 99.90th-qrtle-2 68.00 ( 0.00%) 66.00 ( 2.94% For higher worker threads, the differences become negligible but it's interesting to note the difference in wakeup latency at low utilisation and mpstat confirms that activity was almost all on one node until the number of worker threads increase. Hackbench generally showed neutral results across a range of machines. This is different to earlier versions of the patch which allowed imbalances for higher degrees of utilisation. perf bench pipe showed negligible differences in overall performance as the differences are very close to the noise. An earlier prototype of the patch showed major regressions for NAS C-class when running with only half of the available CPUs -- 20-30% performance hits were measured at the time. With this version of the patch, the impact is negligible with small gains/losses within the noise measured. This is because the number of threads far exceeds the small imbalance the aptch cares about. Similarly, there were report of regressions for the autonuma benchmark against earlier versions but again, normal load balancing now applies for that workload. In general, the patch simply seeks to avoid unnecessary cross-node migrations in the basic case where imbalances are very small. For low utilisation communicating workloads, this patch generally behaves better with less NUMA balancing activity. For high utilisation, there is no change in behaviour. Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Valentin Schneider Reviewed-by: Vincent Guittot Reviewed-by: Srikar Dronamraju Acked-by: Phil Auld Tested-by: Phil Auld Link: https://lkml.kernel.org/r/20200114101319.GO3466@techsingularity.net commit af4ddd607dff7aabd466a4a878e01b9f592a75ab Author: Sven Schnelle Date: Tue Jan 28 09:30:29 2020 +0100 selftests/ftrace: fix glob selftest test.d/ftrace/func-filter-glob.tc is failing on s390 because it has ARCH_INLINE_SPIN_LOCK and friends set to 'y'. So the usual __raw_spin_lock symbol isn't in the ftrace function list. Change '*aw*lock' to '*spin*lock' which would hopefully match some of the locking functions on all platforms. Reviewed-by: Steven Rostedt (VMware) Signed-off-by: Sven Schnelle Signed-off-by: Shuah Khan commit ebc0f83c78a2d26384401ecf2d2fa48063c0ee27 Author: Peter Zijlstra (Intel) Date: Sat Jan 11 04:53:39 2020 -0500 timers/nohz: Update NOHZ load in remote tick The way loadavg is tracked during nohz only pays attention to the load upon entering nohz. This can be particularly noticeable if full nohz is entered while non-idle, and then the cpu goes idle and stays that way for a long time. Use the remote tick to ensure that full nohz cpus report their deltas within a reasonable time. [ swood: Added changelog and removed recheck of stopped tick. ] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Scott Wood Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/1578736419-14628-3-git-send-email-swood@redhat.com commit 488603b815a7514c7009e6fc339d74ed4a30f343 Author: Scott Wood Date: Sat Jan 11 04:53:38 2020 -0500 sched/core: Don't skip remote tick for idle CPUs This will be used in the next patch to get a loadavg update from nohz cpus. The delta check is skipped because idle_sched_class doesn't update se.exec_start. Signed-off-by: Scott Wood Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/1578736419-14628-2-git-send-email-swood@redhat.com commit f6170f0afbe23ad82b4a1195168949c31e3a2527 Merge: 6da49d1abd2c 248ed51048c4 Author: Linus Torvalds Date: Tue Jan 28 12:28:06 2020 -0800 Merge branch 'x86-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Ingo Molnar: "Misc changes: - Enhance #GP fault printouts by distinguishing between canonical and non-canonical address faults, and also add KASAN fault decoding. - Fix/enhance the x86 NMI handler by putting the duration check into a direct function call instead of an irq_work which we know to be broken in some cases. - Clean up do_general_protection() a bit" * 'x86-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/nmi: Remove irq_work from the long duration NMI handler x86/traps: Cleanup do_general_protection() x86/kasan: Print original address on #GP x86/dumpstack: Introduce die_addr() for die() with #GP fault address x86/traps: Print address on #GP x86/insn-eval: Add support for 64-bit kernel mode commit f1ec3a517b4352e78dbef6b1e591f43202ecb3fe Author: Benjamin Thiel Date: Thu Jan 9 14:13:51 2020 +0100 kernel/events: Add a missing prototype for arch_perf_update_userpage() ... in order to fix a -Wmissing-prototype warning. No functional changes. Signed-off-by: Benjamin Thiel Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20200109131351.9468-1-b.thiel@posteo.de commit 07c5972951f088094776038006a0592a46d14bbc Author: Song Liu Date: Wed Jan 22 11:50:27 2020 -0800 perf/cgroups: Install cgroup events to correct cpuctx cgroup events are always installed in the cpuctx. However, when it is not installed via IPI, list_update_cgroup_event() adds it to cpuctx of current CPU, which triggers list corruption: [] list_add double add: new=ffff888ff7cf0db0, prev=ffff888ff7ce82f0, next=ffff888ff7cf0db0. To reproduce this, we can simply run: # perf stat -e cs -a & # perf stat -e cs -G anycgroup Fix this by installing it to cpuctx that contains event->ctx, and the proper cgrp_cpuctx_list. Fixes: db0503e4f675 ("perf/core: Optimize perf_install_in_event()") Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Song Liu Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Cc: Link: https://lkml.kernel.org/r/20200122195027.2112449-1-songliubraving@fb.com commit 003461559ef7a9bd0239bae35a22ad8924d6e9ad Author: Song Liu Date: Thu Jan 23 10:11:46 2020 -0800 perf/core: Fix mlock accounting in perf_mmap() Decreasing sysctl_perf_event_mlock between two consecutive perf_mmap()s of a perf ring buffer may lead to an integer underflow in locked memory accounting. This may lead to the undesired behaviors, such as failures in BPF map creation. Address this by adjusting the accounting logic to take into account the possibility that the amount of already locked memory may exceed the current limit. Fixes: c4b75479741c ("perf/core: Make the mlock accounting simple again") Suggested-by: Alexander Shishkin Signed-off-by: Song Liu Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Cc: Acked-by: Alexander Shishkin Link: https://lkml.kernel.org/r/20200123181146.2238074-1-songliubraving@fb.com commit 6da49d1abd2c2b70063f3606e3974c13d22497a1 Merge: 4244057c3da1 3c749b81ee99 Author: Linus Torvalds Date: Tue Jan 28 12:11:23 2020 -0800 Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: "Misc cleanups all around the map" * 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Remove amd_get_topology_early() x86/tsc: Remove redundant assignment x86/crash: Use resource_size() x86/cpu: Add a missing prototype for arch_smt_update() x86/nospec: Remove unused RSB_FILL_LOOPS x86/vdso: Provide missing include file x86/Kconfig: Correct spelling and punctuation Documentation/x86/boot: Fix typo x86/boot: Fix a comment's incorrect file reference x86/process: Remove set but not used variables prev and next x86/Kconfig: Fix Kconfig indentation commit 4244057c3da1dde07c0f338ea32fed6e79d6a657 Merge: 6b90e71a472b e79f15a4598c Author: Linus Torvalds Date: Tue Jan 28 12:00:29 2020 -0800 Merge branch 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Ingo Molnar: "The main change in this tree is the extension of the resctrl procfs ABI with a new file that helps tooling to navigate from tasks back to resctrl groups: /proc/{pid}/cpu_resctrl_groups. Also fix static key usage for certain feature combinations and simplify the task exit resctrl case" * 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Add task resctrl information display x86/resctrl: Check monitoring static key in the MBM overflow handler x86/resctrl: Do not reconfigure exiting tasks commit 6b90e71a472be131186276a5fd19d319fa2125d9 Merge: bcc8aff6af53 dacc9092336b Author: Linus Torvalds Date: Tue Jan 28 11:54:05 2020 -0800 Merge branch 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot update from Ingo Molnar: "Two minor changes: fix an atypical binutils combination build bug, and also fix a VRAM size check for simplefb" * 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sysfb: Fix check for bad VRAM size x86/boot: Discard .eh_frame sections commit bcc8aff6af53907ecb60e5aa8b34fbd429408a7a Merge: 435dd727a411 183ef7adf4ed Author: Linus Torvalds Date: Tue Jan 28 11:08:13 2020 -0800 Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "Misc updates: - Remove last remaining calls to exception_enter/exception_exit() and simplify the entry code some more. - Remove force_iret() - Add support for "Fast Short Rep Mov", which is available starting with Ice Lake Intel CPUs - and make the x86 assembly version of memmove() use REP MOV for all sizes when FSRM is available. - Micro-optimize/simplify the 32-bit boot code a bit. - Use a more future-proof SYSRET instruction mnemonic" * 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Simplify calculation of output address x86/entry/64: Add instruction suffix to SYSRET x86: Remove force_iret() x86/cpufeatures: Add support for fast short REP; MOVSB x86/context-tracking: Remove exception_enter/exit() from KVM_PV_REASON_PAGE_NOT_PRESENT async page fault x86/context-tracking: Remove exception_enter/exit() from do_page_fault() commit 435dd727a411004d9402ad0c868c958408271a48 Merge: c677124e631d d0b778880448 Author: Linus Torvalds Date: Tue Jan 28 11:06:49 2020 -0800 Merge branch 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 apic fix from Ingo Molnar: "A single commit that simplifies the code and gets rid of a compiler warning" * 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic/uv: Avoid unused variable warning commit 9e0cda721d18f44f1cd74d3a426931d71c1f1b30 Author: Bjorn Andersson Date: Fri Jan 24 09:59:34 2020 -0800 clk: qcom: rpmh: Sort OF match table sc7180 was added to the end of the match table, sort the table. Fixes: eee28109f871 ("clk: qcom: clk-rpmh: Add support for RPMHCC for SC7180") Signed-off-by: Bjorn Andersson Link: https://lkml.kernel.org/r/20200124175934.3937473-1-bjorn.andersson@linaro.org Signed-off-by: Stephen Boyd commit 7914d5c6266abff4918f0fd91ee53e8b537d65a1 Author: Dafna Hirschfeld Date: Wed Jan 22 14:57:41 2020 +0100 dt-bindings: fix warnings in validation of qcom,gcc.yaml The last example in qcom,gcc.yaml set 'sleep' as the second value of 'clock-names'. According to the schema is should be 'sleep_clk'. Fix the example to conform the schema. This fixes a warning when validating the schema: "clock-names: ... is not valid under any of the given schemas" Signed-off-by: Dafna Hirschfeld Link: https://lkml.kernel.org/r/20200122135741.12123-1-dafna.hirschfeld@collabora.com Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 957d100926b4dbdd9a67b3de5065bfafbe4ac19f Author: Dafna Hirschfeld Date: Wed Jan 22 14:46:39 2020 +0100 dt-binding: fix compilation error of the example in qcom,gcc.yaml Running `make dt_binging_check`, gives the error: DTC Documentation/devicetree/bindings/clock/qcom,gcc.example.dt.yaml Error: Documentation/devicetree/bindings/clock/qcom,gcc.example.dts:111.28-29 syntax error FATAL ERROR: Unable to parse input tree This is because the last example uses the macro RPM_SMD_XO_CLK_SRC which is defined in qcom,rpmcc.h but the include of this header is missing. Add the include to fix the error. Signed-off-by: Dafna Hirschfeld Link: https://lkml.kernel.org/r/20200122134639.11735-1-dafna.hirschfeld@collabora.com Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 9293724192a73f49c722e9685d45649c6df67dfe Author: Boris Ostrovsky Date: Tue Jan 28 10:31:26 2020 -0500 xen/gntdev: Do not use mm notifiers with autotranslating guests Commit d3eeb1d77c5d ("xen/gntdev: use mmu_interval_notifier_insert") missed a test for use_ptemod when calling mmu_interval_read_begin(). Fix that. Fixes: d3eeb1d77c5d ("xen/gntdev: use mmu_interval_notifier_insert") CC: stable@vger.kernel.org # 5.5 Reported-by: Ilpo Järvinen Tested-by: Ilpo Järvinen Signed-off-by: Boris Ostrovsky Reviewed-by: Jason Gunthorpe Acked-by: Juergen Gross commit b4fb4cc5ba83b20dae13cef116c33648e81d2f44 Author: Parav Pandit Date: Sun Jan 26 16:26:46 2020 +0200 RDMA/cma: Fix unbalanced cm_id reference count during address resolve Below commit missed the AF_IB and loopback code flow in rdma_resolve_addr(). This leads to an unbalanced cm_id refcount in cma_work_handler() which puts the refcount which was not incremented prior to queuing the work. A call trace is observed with such code flow: BUG: unable to handle kernel NULL pointer dereference at (null) [] __mutex_lock_slowpath+0x166/0x1d0 [] mutex_lock+0x1f/0x2f [] cma_work_handler+0x25/0xa0 [] process_one_work+0x17f/0x440 [] worker_thread+0x126/0x3c0 Hence, hold the cm_id reference when scheduling the resolve work item. Fixes: 722c7b2bfead ("RDMA/{cma, core}: Avoid callback on rdma_addr_cancel()") Link: https://lore.kernel.org/r/20200126142652.104803-2-leon@kernel.org Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 36798d5ae1af62e830c5e045b2e41ce038690c61 Author: Artemy Kovalyov Date: Tue Jan 28 15:56:12 2020 +0200 RDMA/umem: Fix ib_umem_find_best_pgsz() Except for the last entry, the ending iova alignment sets the maximum possible page size as the low bits of the iova must be zero when starting the next chunk. Fixes: 4a35339958f1 ("RDMA/umem: Add API to find best driver supported page size in an MR") Link: https://lore.kernel.org/r/20200128135612.174820-1-leon@kernel.org Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Tested-by: Gal Pressman Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 6bd3357b6181bd38c1a757168a8842e09ec6f3fb Merge: 32ada3b9e04c 538f127cd3bc 8757dc970f55 8b7e20a7ba54 Author: Ingo Molnar Date: Tue Jan 28 19:08:52 2020 +0100 Merge branches 'x86/hyperv', 'x86/kdump' and 'x86/misc' into x86/urgent, to pick up single-commit branches Signed-off-by: Ingo Molnar commit c677124e631d97130e4ff7db6e10acdfb7a82321 Merge: c0e809e24480 afa70d941f66 Author: Linus Torvalds Date: Tue Jan 28 10:07:09 2020 -0800 Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "These were the main changes in this cycle: - More -rt motivated separation of CONFIG_PREEMPT and CONFIG_PREEMPTION. - Add more low level scheduling topology sanity checks and warnings to filter out nonsensical topologies that break scheduling. - Extend uclamp constraints to influence wakeup CPU placement - Make the RT scheduler more aware of asymmetric topologies and CPU capacities, via uclamp metrics, if CONFIG_UCLAMP_TASK=y - Make idle CPU selection more consistent - Various fixes, smaller cleanups, updates and enhancements - please see the git log for details" * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits) sched/fair: Define sched_idle_cpu() only for SMP configurations sched/topology: Assert non-NUMA topology masks don't (partially) overlap idle: fix spelling mistake "iterrupts" -> "interrupts" sched/fair: Remove redundant call to cpufreq_update_util() sched/psi: create /proc/pressure and /proc/pressure/{io|memory|cpu} only when psi enabled sched/fair: Fix sgc->{min,max}_capacity calculation for SD_OVERLAP sched/fair: calculate delta runnable load only when it's needed sched/cputime: move rq parameter in irqtime_account_process_tick stop_machine: Make stop_cpus() static sched/debug: Reset watchdog on all CPUs while processing sysrq-t sched/core: Fix size of rq::uclamp initialization sched/uclamp: Fix a bug in propagating uclamp value in new cgroups sched/fair: Load balance aggressively for SCHED_IDLE CPUs sched/fair : Improve update_sd_pick_busiest for spare capacity case watchdog: Remove soft_lockup_hrtimer_cnt and related code sched/rt: Make RT capacity-aware sched/fair: Make EAS wakeup placement consider uclamp restrictions sched/fair: Make task_fits_capacity() consider uclamp restrictions sched/uclamp: Rename uclamp_util_with() into uclamp_rq_util_with() sched/uclamp: Make uclamp util helpers use and return UL values ... commit c0e809e244804d428bcd976eaf9369f60508ea8a Merge: 2180f214f4a5 0cc4bd8f70d1 Author: Linus Torvalds Date: Tue Jan 28 09:44:15 2020 -0800 Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: "Kernel side changes: - Ftrace is one of the last W^X violators (after this only KLP is left). These patches move it over to the generic text_poke() interface and thereby get rid of this oddity. This requires a surprising amount of surgery, by Peter Zijlstra. - x86/AMD PMUs: add support for 'Large Increment per Cycle Events' to count certain types of events that have a special, quirky hw ABI (by Kim Phillips) - kprobes fixes by Masami Hiramatsu Lots of tooling updates as well, the following subcommands were updated: annotate/report/top, c2c, clang, record, report/top TUI, sched timehist, tests; plus updates were done to the gtk ui, libperf, headers and the parser" * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (57 commits) perf/x86/amd: Add support for Large Increment per Cycle Events perf/x86/amd: Constrain Large Increment per Cycle events perf/x86/intel/rapl: Add Comet Lake support tracing: Initialize ret in syscall_enter_define_fields() perf header: Use last modification time for timestamp perf c2c: Fix return type for histogram sorting comparision functions perf beauty sockaddr: Fix augmented syscall format warning perf/ui/gtk: Fix gtk2 build perf ui gtk: Add missing zalloc object perf tools: Use %define api.pure full instead of %pure-parser libperf: Setup initial evlist::all_cpus value perf report: Fix no libunwind compiled warning break s390 issue perf tools: Support --prefix/--prefix-strip perf report: Clarify in help that --children is default tools build: Fix test-clang.cpp with Clang 8+ perf clang: Fix build with Clang 9 kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic tools lib: Fix builds when glibc contains strlcpy() perf report/top: Make 'e' visible in the help and make it toggle showing callchains perf report/top: Do not offer annotation for symbols without samples ... commit 2180f214f4a5d8e2d8b7138d9a59246ee05753b9 Merge: 634cd4b6afe1 f5bfdc8e3947 Author: Linus Torvalds Date: Tue Jan 28 09:33:25 2020 -0800 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Just a handful of changes in this cycle: an ARM64 performance optimization, a comment fix and a debug output fix" * 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/osq: Use optimized spinning loop for arm64 locking/qspinlock: Fix inaccessible URL of MCS lock paper locking/lockdep: Fix lockdep_stats indentation problem commit 634cd4b6afe15dca8df02bcba242b9b0c5e9b5a5 Merge: d99391ec2b42 ac6119e7f25b Author: Linus Torvalds Date: Tue Jan 28 09:03:40 2020 -0800 Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI updates from Ingo Molnar: "The main changes in this cycle were: - Cleanup of the GOP [graphics output] handling code in the EFI stub - Complete refactoring of the mixed mode handling in the x86 EFI stub - Overhaul of the x86 EFI boot/runtime code - Increase robustness for mixed mode code - Add the ability to disable DMA at the root port level in the EFI stub - Get rid of RWX mappings in the EFI memory map and page tables, where possible - Move the support code for the old EFI memory mapping style into its only user, the SGI UV1+ support code. - plus misc fixes, updates, smaller cleanups. ... and due to interactions with the RWX changes, another round of PAT cleanups make a guest appearance via the EFI tree - with no side effects intended" * 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (75 commits) efi/x86: Disable instrumentation in the EFI runtime handling code efi/libstub/x86: Fix EFI server boot failure efi/x86: Disallow efi=old_map in mixed mode x86/boot/compressed: Relax sed symbol type regex for LLVM ld.lld efi/x86: avoid KASAN false positives when accessing the 1: 1 mapping efi: Fix handling of multiple efi_fake_mem= entries efi: Fix efi_memmap_alloc() leaks efi: Add tracking for dynamically allocated memmaps efi: Add a flags parameter to efi_memory_map efi: Fix comment for efi_mem_type() wrt absent physical addresses efi/arm: Defer probe of PCIe backed efifb on DT systems efi/x86: Limit EFI old memory map to SGI UV machines efi/x86: Avoid RWX mappings for all of DRAM efi/x86: Don't map the entire kernel text RW for mixed mode x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd efi/libstub/x86: Fix unused-variable warning efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode efi/libstub/x86: Use const attribute for efi_is_64bit() efi: Allow disabling PCI busmastering on bridges during boot efi/x86: Allow translating 64-bit arguments for mixed mode calls ... commit 451dff37f0752cc8ad6f1bb82081a98d7b760310 Author: Masahiro Yamada Date: Sat Jan 25 13:12:35 2020 +0900 builddeb: split libc headers deployment out into a function Deploy user-space headers (linux-libc-dev package) in a separate function for readability. Signed-off-by: Masahiro Yamada commit 3126c17d28b696ba555bb959888fe4b5143bb389 Author: Masahiro Yamada Date: Sat Jan 25 13:12:34 2020 +0900 builddeb: split kernel headers deployment out into a function Deploy kernel headers (linux-headers package) in a separate function for readability. Signed-off-by: Masahiro Yamada commit aae6a6712440d566ae148fc3af223dc25fbd9794 Author: Masahiro Yamada Date: Sat Jan 25 13:12:33 2020 +0900 builddeb: remove redundant make for ARCH=um The kernel build has already been done before builddeb is invoked. Signed-off-by: Masahiro Yamada commit 9a92eee38790c63b45b32876cb1967154f8b9ee5 Author: Masahiro Yamada Date: Sat Jan 25 13:12:32 2020 +0900 builddeb: avoid invoking sub-shells where possible The commands surrounded by ( ... ) is run in a sub-shell, but you do not have to spawn a sub-shell for every single line. Use just one ( ... ) for creating debian/hdrsrcfiles. For tar, use -C option instead. Signed-off-by: Masahiro Yamada commit f9a4711ebb248ad37c830b2715342ec60edb1330 Author: Masahiro Yamada Date: Sat Jan 25 13:12:31 2020 +0900 builddeb: remove redundant $objtree/ This script works only when it is invoked in the $objtree, that is, it is already relying on $objtree is '.' Signed-off-by: Masahiro Yamada commit 1694e94e4f4698b7fdd37e6700ca6c5b7e01d25a Author: Masahiro Yamada Date: Sat Jan 25 13:12:30 2020 +0900 builddeb: match temporary directory name to the package name The temporary directory names, debian/hdrtmp (linux-headers package) vs debian/headertmp (linux-libc-dev package), are confusing. Matching the directory name to the package name is clearer, IMHO. Signed-off-by: Masahiro Yamada commit 7e61b167eb29f949f74a465aa135c69fac3d1c8f Author: Masahiro Yamada Date: Sat Jan 25 13:12:29 2020 +0900 builddeb: remove unneeded files in hdrobjfiles for headers package - We do not need tools/objtool/fixdep or tools/objtool/sync-check.sh for building external modules. Including tools/objtool/objtool is enough. - gcc-common.h is a check-in file. I do not see any point to search for it in objtree. Signed-off-by: Masahiro Yamada commit d99391ec2b42d827d92003dcdcb96fadac9d862b Merge: 8b561778f297 f8a4bb6bfa63 Author: Linus Torvalds Date: Tue Jan 28 08:46:13 2020 -0800 Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU updates from Ingo Molnar: "The RCU changes in this cycle were: - Expedited grace-period updates - kfree_rcu() updates - RCU list updates - Preemptible RCU updates - Torture-test updates - Miscellaneous fixes - Documentation updates" * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (69 commits) rcu: Remove unused stop-machine #include powerpc: Remove comment about read_barrier_depends() .mailmap: Add entries for old paulmck@kernel.org addresses srcu: Apply *_ONCE() to ->srcu_last_gp_end rcu: Switch force_qs_rnp() to for_each_leaf_node_cpu_mask() rcu: Move rcu_{expedited,normal} definitions into rcupdate.h rcu: Move gp_state_names[] and gp_state_getname() to tree_stall.h rcu: Remove the declaration of call_rcu() in tree.h rcu: Fix tracepoint tracking RCU CPU kthread utilization rcu: Fix harmless omission of "CONFIG_" from #if condition rcu: Avoid tick_dep_set_cpu() misordering rcu: Provide wrappers for uses of ->rcu_read_lock_nesting rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special() rcu: Clear ->rcu_read_unlock_special only once rcu: Clear .exp_hint only when deferred quiescent state has been reported rcu: Rename some instance of CONFIG_PREEMPTION to CONFIG_PREEMPT_RCU rcu: Remove kfree_call_rcu_nobatch() rcu: Remove kfree_rcu() special casing and lazy-callback handling rcu: Add support for debug_objects debugging for kfree_rcu() rcu: Add multiple in-flight batches of kfree_rcu() work ... commit 8b561778f29766675e88566215aa835fff9dc1f7 Merge: 9f2a43019edc 22a7fa8848c5 Author: Linus Torvalds Date: Tue Jan 28 08:38:25 2020 -0800 Merge branch 'core-objtool-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: "The main changes are to move the ORC unwind table sorting from early init to build-time - this speeds up booting. No change in functionality intended" * 'core-objtool-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/unwind/orc: Fix !CONFIG_MODULES build warning x86/unwind/orc: Remove boot-time ORC unwind tables sorting scripts/sorttable: Implement build-time ORC unwind table sorting scripts/sorttable: Rename 'sortextable' to 'sorttable' scripts/sortextable: Refactor the do_func() function scripts/sortextable: Remove dead code scripts/sortextable: Clean up the code to meet the kernel coding style better scripts/sortextable: Rewrite error/success handling commit e9a3bfe38e393e1d8bd74986cdc9b99b8f9d1efc Author: Rob Herring Date: Tue Jan 28 10:16:45 2020 -0600 scripts/dtc: Revert "yamltree: Ensure consistent bracketing of properties with phandles" This reverts upstream commit 18d7b2f4ee45fec422b7d82bab0b3c762ee907e4. A revert in upstream dtc is pending. This commit didn't work for properties such as 'interrupt-map' that have phandle in the middle of an entry. It would also not work for a 0 or -1 phandle value that acts as a NULL. Signed-off-by: Rob Herring commit 9f2a43019edc097347900daade277571834a3e2c Merge: b0be0eff1a5a 960786422fe9 Author: Linus Torvalds Date: Tue Jan 28 08:20:54 2020 -0800 Merge branch 'core-headers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull header cleanup from Ingo Molnar: "This is a treewide cleanup, mostly (but not exclusively) with x86 impact, which breaks implicit dependencies on the asm/realtime.h header and finally removes it from asm/acpi.h" * 'core-headers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/ACPI/sleep: Move acpi_get_wakeup_address() into sleep.c, remove from ACPI/sleep: Convert acpi_wakeup_address into a function x86/ACPI/sleep: Remove an unnecessary include of asm/realmode.h ASoC: Intel: Skylake: Explicitly include linux/io.h for virt_to_phys() vmw_balloon: Explicitly include linux/io.h for virt_to_phys() virt: vbox: Explicitly include linux/io.h to pick up various defs efi/capsule-loader: Explicitly include linux/io.h for page_to_phys() perf/x86/intel: Explicitly include asm/io.h to use virt_to_phys() x86/kprobes: Explicitly include vmalloc.h for set_vm_flush_reset_perms() x86/ftrace: Explicitly include vmalloc.h for set_vm_flush_reset_perms() x86/boot: Explicitly include realmode.h to handle RM reservations x86/efi: Explicitly include realmode.h to handle RM trampoline quirk x86/platform/intel/quark: Explicitly include linux/io.h for virt_to_phys() x86/setup: Enhance the comments x86/setup: Clean up the header portion of setup.c commit 4ab2bb3c311a45d80d31f2f189606871669ed792 Author: Filipe Laíns Date: Sat Jan 11 19:24:19 2020 +0000 HID: logitech-hidpp: BatteryVoltage: only read chargeStatus if extPower is active In the HID++ 2.0 function getBatteryInfo() from the BatteryVoltage (0x1001) feature, chargeStatus is only valid if extPower is active. Previously we were ignoring extPower, which resulted in wrong values. Example: With an unplugged mouse $ cat /sys/class/power_supply/hidpp_battery_0/status Charging This patch fixes that, it also renames charge_sts to flags as charge_sts can be confused with chargeStatus from the spec. Spec: +--------+-------------------------------------------------------------------------+ | byte | 2 | +--------+--------------+------------+------------+----------+----------+----------+ | bit | 0..2 | 3 | 4 | 5 | 6 | 7 | +--------+--------------+------------+------------+----------+----------+----------+ | buffer | chargeStatus | fastCharge | slowCharge | critical | (unused) | extPower | +--------+--------------+------------+------------+----------+----------+----------+ Table 1 - battery voltage (0x1001), getBatteryInfo() (ASE 0), 3rd byte +-------+--------------------------------------+ | value | meaning | +-------+--------------------------------------+ | 0 | Charging | +-------+--------------------------------------+ | 1 | End of charge (100% charged) | +-------+--------------------------------------+ | 2 | Charge stopped (any "normal" reason) | +-------+--------------------------------------+ | 7 | Hardware error | +-------+--------------------------------------+ Table 2 - chargeStatus value Signed-off-by: Filipe Laíns Tested-by: Pedro Vanzella Reviewed-by: Pedro Vanzella Signed-off-by: Benjamin Tissoires commit 25a3a15417cf4311f812f5a2b18c5fc2809f66d7 Author: Sebastian Andrzej Siewior Date: Mon Jan 27 09:39:15 2020 +0100 smp: Remove superfluous cond_func check in smp_call_function_many_cond() It was requested to remove the cond_func check but the follow up patch was overlooked. Remove it now. Fixes: 67719ef25eeb ("smp: Add a smp_cond_func_t argument to smp_call_function_many()") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20200127083915.434tdkztorkklpdu@linutronix.de commit dabf6b36b83a18d57e3d4b9d50544ed040d86255 Author: Michael Ellerman Date: Sun Jan 26 22:52:47 2020 +1100 of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc There's an OF helper called of_dma_is_coherent(), which checks if a device has a "dma-coherent" property to see if the device is coherent for DMA. But on some platforms devices are coherent by default, and on some platforms it's not possible to update existing device trees to add the "dma-coherent" property. So add a Kconfig symbol to allow arch code to tell of_dma_is_coherent() that devices are coherent by default, regardless of the presence of the property. Select that symbol on powerpc when NOT_COHERENT_CACHE is not set, ie. when the system has a coherent cache. Fixes: 92ea637edea3 ("of: introduce of_dma_is_coherent() helper") Cc: stable@vger.kernel.org # v3.16+ Reported-by: Christian Zigotzky Tested-by: Christian Zigotzky Signed-off-by: Michael Ellerman Reviewed-by: Ulf Hansson Signed-off-by: Rob Herring commit a31b4ec539e966515f1f97f4000d0e2a399930ce Author: Bob Peterson Date: Mon Jan 20 15:49:28 2020 +0100 Revert "gfs2: eliminate tr_num_revoke_rm" This reverts commit e955537e3262de8e56f070b13817f525f472fa00. Before patch e955537e32, tr_num_revoke tracked the number of revokes added to the transaction, and tr_num_revoke_rm tracked how many revokes were removed. But since revokes are queued off the sdp (superblock) pointer, some transactions could remove more revokes than they added. (e.g. revokes added by a different process). Commit e955537e32 eliminated transaction variable tr_num_revoke_rm, but in order to do so, it changed the accounting to always use tr_num_revoke for its math. Since you can remove more revokes than you add, tr_num_revoke could now become a negative value. This negative value broke the assert in function gfs2_trans_end: if (gfs2_assert_withdraw(sdp, (nbuf <=3D tr->tr_blocks) && (tr->tr_num_revoke <=3D tr->tr_revokes))) One way to fix this is to simply remove the tr_num_revoke clause from the assert and allow the value to become negative. Andreas didn't like that idea, so instead, we decided to revert e955537e32. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 40ca1bf580ef24df30702032ba5e40dfdcaa200b Author: Jim Quinlan Date: Mon Dec 16 12:01:10 2019 +0100 PCI: brcmstb: Add MSI support This adds MSI support to the Broadcom STB PCIe host controller. The MSI controller is physically located within the PCIe block, however, there is no reason why the MSI controller could not be moved elsewhere in the future. MSIX is not supported by the HW. Since the internal Brcmstb MSI controller is intertwined with the PCIe controller, it is not its own platform device but rather part of the PCIe platform device. Signed-off-by: Jim Quinlan Co-developed-by: Nicolas Saenz Julienne Signed-off-by: Nicolas Saenz Julienne Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Reviewed-by: Andrew Murray commit c0452137034bda8f686dd9a2e167949bfffd6776 Author: Jim Quinlan Date: Mon Dec 16 12:01:09 2019 +0100 PCI: brcmstb: Add Broadcom STB PCIe host controller driver This adds a basic driver for Broadcom's STB PCIe controller, for now aimed at Raspberry Pi 4's SoC, bcm2711. Signed-off-by: Jim Quinlan Co-developed-by: Nicolas Saenz Julienne Signed-off-by: Nicolas Saenz Julienne [lorenzo.pieralisi@arm.com: updated brcm_pcie_get_rc_bar2_size_and_offset()according to https://lore.kernel.org/linux-pci/be8ddb33a7360af1815cf686f77f3f0913d02be3.camel@suse.de] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrew Murray Reviewed-by: Jeremy Linton commit 926b5dfa6b8dc666ff398044af6906b156e1d949 Author: Marc Zyngier Date: Mon Dec 16 11:24:57 2019 +0000 irqchip/gic-v3: Only provision redistributors that are enabled in ACPI We currently allocate redistributor region structures for individual redistributors when ACPI doesn't present us with compact MMIO regions covering multiple redistributors. It turns out that we allocate these structures even when the redistributor is flagged as disabled by ACPI. It works fine until someone actually tries to tarse one of these structures, and access the corresponding MMIO region. Instead, track the number of enabled redistributors, and only allocate what is required. This makes sure that there is no invalid data to misuse. Signed-off-by: Marc Zyngier Reported-by: Heyi Guo Tested-by: Heyi Guo Link: https://lore.kernel.org/r/20191216062745.63397-1-guoheyi@huawei.com commit 4a267aa707953a9a73d1f5dc7f894dd9024a92be Author: Alexandru Elisei Date: Mon Jan 27 10:36:52 2020 +0000 KVM: arm64: Treat emulated TVAL TimerValue as a signed 32-bit integer According to the ARM ARM, registers CNT{P,V}_TVAL_EL0 have bits [63:32] RES0 [1]. When reading the register, the value is truncated to the least significant 32 bits [2], and on writes, TimerValue is treated as a signed 32-bit integer [1, 2]. When the guest behaves correctly and writes 32-bit values, treating TVAL as an unsigned 64 bit register works as expected. However, things start to break down when the guest writes larger values, because (u64)0x1_ffff_ffff = 8589934591. but (s32)0x1_ffff_ffff = -1, and the former will cause the timer interrupt to be asserted in the future, but the latter will cause it to be asserted now. Let's treat TVAL as a signed 32-bit register on writes, to match the behaviour described in the architecture, and the behaviour experimentally exhibited by the virtual timer on a non-vhe host. [1] Arm DDI 0487E.a, section D13.8.18 [2] Arm DDI 0487E.a, section D11.2.4 Signed-off-by: Alexandru Elisei [maz: replaced the read-side mask with lower_32_bits] Signed-off-by: Marc Zyngier Fixes: 8fa761624871 ("KVM: arm/arm64: arch_timer: Fix CNTP_TVAL calculation") Link: https://lore.kernel.org/r/20200127103652.2326-1-alexandru.elisei@arm.com commit c01d6a18023b94fdd0cb7cf11bbfe769bf71653f Author: Eric Auger Date: Fri Jan 24 15:25:35 2020 +0100 KVM: arm64: pmu: Only handle supported event counters Let the code never use unsupported event counters. Change kvm_pmu_handle_pmcr() to only reset supported counters and kvm_pmu_vcpu_reset() to only stop supported counters. Other actions are filtered on the supported counters in kvm/sysregs.c Signed-off-by: Eric Auger Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200124142535.29386-5-eric.auger@redhat.com commit 08607e8319c76a8a37fc2a0ecac328833f4e9f39 Author: Vinod Koul Date: Tue Jan 28 18:20:32 2020 +0530 dmaengine: doc: Properly indent metadata title The newly added metadata documentation title was not properly indented resulting in doc build break: Sphinx parallel build error: docutils.utils.SystemMessage: /linux/Documentation/driver-api/dmaengine/client.rst:155: (SEVERE/4) Unexpected section title. Optional: per descriptor metadata --------------------------------- Fix this by doing the right indent Reported-by: Michael Ellerman Fixes: 7d083ae98357 ("dmaengine: doc: Add sections for per descriptor metadata support") Link: https://lore.kernel.org/r/20200128125032.1650816-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit aa76829171e98bd75a0cc00b6248eca269ac7f4f Author: Eric Auger Date: Fri Jan 24 15:25:34 2020 +0100 KVM: arm64: pmu: Fix chained SW_INCR counters At the moment a SW_INCR counter always overflows on 32-bit boundary, independently on whether the n+1th counter is programmed as CHAIN. Check whether the SW_INCR counter is a 64b counter and if so, implement the 64b logic. Fixes: 80f393a23be6 ("KVM: arm/arm64: Support chained PMU counters") Signed-off-by: Eric Auger Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200124142535.29386-4-eric.auger@redhat.com commit 76c9fc56ddfdfeb0c9ff984d0d63b083e608fc92 Author: Eric Auger Date: Fri Jan 24 15:25:33 2020 +0100 KVM: arm64: pmu: Don't mark a counter as chained if the odd one is disabled At the moment we update the chain bitmap on type setting. This does not take into account the enable state of the odd register. Let's make sure a counter is never considered as chained if the high counter is disabled. We recompute the chain state on enable/disable and type changes. Also let create_perf_event() use the chain bitmap and not use kvm_pmu_idx_has_chain_evtype(). Suggested-by: Marc Zyngier Signed-off-by: Eric Auger Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200124142535.29386-3-eric.auger@redhat.com commit 3837407c1aa1101ed5e214c7d6041e7a23335c6e Author: Eric Auger Date: Fri Jan 24 15:25:32 2020 +0100 KVM: arm64: pmu: Don't increment SW_INCR if PMCR.E is unset The specification says PMSWINC increments PMEVCNTR_EL1 by 1 if PMEVCNTR_EL0 is enabled and configured to count SW_INCR. For PMEVCNTR_EL0 to be enabled, we need both PMCNTENSET to be set for the corresponding event counter but we also need the PMCR.E bit to be set. Fixes: 7a0adc7064b8 ("arm64: KVM: Add access handler for PMSWINC register") Signed-off-by: Eric Auger Signed-off-by: Marc Zyngier Reviewed-by: Andrew Murray Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20200124142535.29386-2-eric.auger@redhat.com commit 3d7dfd632f9b60cfce069b4da517e6b1a1c3f613 Author: Christophe Leroy Date: Fri Jan 24 11:54:45 2020 +0000 powerpc: Implement user_access_save() and user_access_restore() Implement user_access_save() and user_access_restore() On 8xx and radix: - On save, get the value of the associated special register then prevent user access. - On restore, set back the saved value to the associated special register. On book3s/32: - On save, get the value stored in current->thread.kuap and prevent user access. - On restore, regenerate address range from the stored value and reopen read/write access for that range. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/54f2f74938006b33c55a416674807b42ef222068.1579866752.git.christophe.leroy@c-s.fr commit 5cd623333e7cf4e3a334c70529268b65f2a6c2c7 Author: Christophe Leroy Date: Fri Jan 24 11:54:44 2020 +0000 powerpc: Implement user_access_begin and friends Today, when a function like strncpy_from_user() is called, the userspace access protection is de-activated and re-activated for every word read. By implementing user_access_begin and friends, the protection is de-activated at the beginning of the copy and re-activated at the end. Implement user_access_begin(), user_access_end() and unsafe_get_user(), unsafe_put_user() and unsafe_copy_to_user() For the time being, we keep user_access_save() and user_access_restore() as nops. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/36d4fbf9e56a75994aca4ee2214c77b26a5a8d35.1579866752.git.christophe.leroy@c-s.fr commit bedb4dbe443c11ff551b4ae4e48c8676fdc96467 Author: Christophe Leroy Date: Fri Jan 24 11:54:43 2020 +0000 powerpc/32s: Prepare prevent_user_access() for user_access_end() In preparation of implementing user_access_begin and friends on powerpc, the book3s/32 version of prevent_user_access() need to be prepared for user_access_end(). user_access_end() doesn't provide the address and size which were passed to user_access_begin(), required by prevent_user_access() to know which segment to modify. The list of segments which where unprotected by allow_user_access() are available in current->kuap. But we don't want prevent_user_access() to read this all the time, especially everytime it is 0 (for instance because the access was not a write access). Implement a special direction named KUAP_CURRENT. In this case only, the addr and end are retrieved from current->kuap. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/55bcc1f25d8200892a31f67a0b024ff3b816c3cc.1579866752.git.christophe.leroy@c-s.fr commit 88f8c080d47f307871840a0a825ef556673eb592 Author: Christophe Leroy Date: Fri Jan 24 11:54:42 2020 +0000 powerpc/32s: Drop NULL addr verification NULL addr is a user address. Don't waste time checking it. If someone tries to access it, it will SIGFAULT the same way as for address 1, so no need to make it special. The special case is when not doing a write, in that case we want to drop the entire function. This is now handled by 'dir' param and not by the nulity of 'to' anymore. Also make beginning of prevent_user_access() similar to beginning of allow_user_access(), and tell the compiler that writing in kernel space or with a 0 length is unlikely Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/85e971223dfe6ace734637db1841678939a76155.1579866752.git.christophe.leroy@c-s.fr commit 1d8f739b07bd538f272f60bf53f10e7e6248d295 Author: Christophe Leroy Date: Fri Jan 24 11:54:41 2020 +0000 powerpc/kuap: Fix set direction in allow/prevent_user_access() __builtin_constant_p() always return 0 for pointers, so on RADIX we always end up opening both direction (by writing 0 in SPR29): 0000000000000170 <._copy_to_user>: ... 1b0: 4c 00 01 2c isync 1b4: 39 20 00 00 li r9,0 1b8: 7d 3d 03 a6 mtspr 29,r9 1bc: 4c 00 01 2c isync 1c0: 48 00 00 01 bl 1c0 <._copy_to_user+0x50> 1c0: R_PPC64_REL24 .__copy_tofrom_user ... 0000000000000220 <._copy_from_user>: ... 2ac: 4c 00 01 2c isync 2b0: 39 20 00 00 li r9,0 2b4: 7d 3d 03 a6 mtspr 29,r9 2b8: 4c 00 01 2c isync 2bc: 7f c5 f3 78 mr r5,r30 2c0: 7f 83 e3 78 mr r3,r28 2c4: 48 00 00 01 bl 2c4 <._copy_from_user+0xa4> 2c4: R_PPC64_REL24 .__copy_tofrom_user ... Use an explicit parameter for direction selection, so that GCC is able to see it is a constant: 00000000000001b0 <._copy_to_user>: ... 1f0: 4c 00 01 2c isync 1f4: 3d 20 40 00 lis r9,16384 1f8: 79 29 07 c6 rldicr r9,r9,32,31 1fc: 7d 3d 03 a6 mtspr 29,r9 200: 4c 00 01 2c isync 204: 48 00 00 01 bl 204 <._copy_to_user+0x54> 204: R_PPC64_REL24 .__copy_tofrom_user ... 0000000000000260 <._copy_from_user>: ... 2ec: 4c 00 01 2c isync 2f0: 39 20 ff ff li r9,-1 2f4: 79 29 00 04 rldicr r9,r9,0,0 2f8: 7d 3d 03 a6 mtspr 29,r9 2fc: 4c 00 01 2c isync 300: 7f c5 f3 78 mr r5,r30 304: 7f 83 e3 78 mr r3,r28 308: 48 00 00 01 bl 308 <._copy_from_user+0xa8> 308: R_PPC64_REL24 .__copy_tofrom_user ... Signed-off-by: Christophe Leroy [mpe: Spell out the directions, s/KUAP_R/KUAP_READ/ etc.] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/f4e88ec4941d5facb35ce75026b0112f980086c3.1579866752.git.christophe.leroy@c-s.fr commit 6ec20aa2e510b6297906c45f009aa08b2d97269a Author: Christophe Leroy Date: Fri Jan 24 11:54:40 2020 +0000 powerpc/32s: Fix bad_kuap_fault() At the moment, bad_kuap_fault() reports a fault only if a bad access to userspace occurred while access to userspace was not granted. But if a fault occurs for a write outside the allowed userspace segment(s) that have been unlocked, bad_kuap_fault() fails to detect it and the kernel loops forever in do_page_fault(). Fix it by checking that the accessed address is within the allowed range. Fixes: a68c31fc01ef ("powerpc/32s: Implement Kernel Userspace Access Protection") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/f48244e9485ada0a304ed33ccbb8da271180c80d.1579866752.git.christophe.leroy@c-s.fr commit 9933819099c4600b41a042f27a074470a43cf6b9 Author: Christophe Leroy Date: Mon Jan 27 10:42:04 2020 +0000 powerpc/32s: Fix CPU wake-up from sleep mode Commit f7354ccac844 ("powerpc/32: Remove CURRENT_THREAD_INFO and rename TI_CPU") broke the CPU wake-up from sleep mode (i.e. when _TLF_SLEEPING is set) by delaying the tovirt(r2, r2). This is because r2 is not restored by fast_exception_return. It used to work (by chance ?) because CPU wake-up interrupt never comes from user, so r2 is expected to point to 'current' on return. Commit e2fb9f544431 ("powerpc/32: Prepare for Kernel Userspace Access Protection") broke it even more by clobbering r0 which is not restored by fast_exception_return either. Use r6 instead of r0. This is possible because r3-r6 are restored by fast_exception_return and only r3-r5 are used for exception arguments. For r2 it could be converted back to virtual address, but stay on the safe side and restore it from the stack instead. It should be live in the cache at that moment, so loading from the stack should make no difference compared to converting it from phys to virt. Fixes: f7354ccac844 ("powerpc/32: Remove CURRENT_THREAD_INFO and rename TI_CPU") Fixes: e2fb9f544431 ("powerpc/32: Prepare for Kernel Userspace Access Protection") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/6d02c3ae6ad77af34392e98117e44c2bf6d13ba1.1580121710.git.christophe.leroy@c-s.fr commit fcfd7345209210ab309f4422a308bad3e1fa6b8c Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Jan 27 14:37:48 2020 +0000 MAINTAINERS: Correct path to time namespace source file According to reviews, Time Namespace source was moved from kernel/time_namespace.c to kernel/time/namespace.c between patchset versions, while the path in MAINTERNERS file wasn't adjusted properly. Correct it, so get_maintainer.pl produces a correct emails list again. Fixes: 769071ac9f20 ("ns: Introduce Time Namespace") Reported-by: Dmitry Vyukov Signed-off-by: Dmitry Safonov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20200127143748.268515-1-dima@arista.com commit f76e4c167ea2212e23c15ee7e601a865e822c291 Author: Scott Branden Date: Mon Jan 27 16:38:28 2020 -0800 net: phy: add default ARCH_BCM_IPROC for MDIO_BCM_IPROC Add default MDIO_BCM_IPROC Kconfig setting such that it is default on for IPROC family of devices. Signed-off-by: Scott Branden Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 6cd021a58c18a1731f7e47f83e172c0c302d65e5 Author: Willem de Bruijn Date: Mon Jan 27 15:40:31 2020 -0500 udp: segment looped gso packets correctly Multicast and broadcast packets can be looped from egress to ingress pre segmentation with dev_loopback_xmit. That function unconditionally sets ip_summed to CHECKSUM_UNNECESSARY. udp_rcv_segment segments gso packets in the udp rx path. Segmentation usually executes on egress, and does not expect packets of this type. __udp_gso_segment interprets !CHECKSUM_PARTIAL as CHECKSUM_NONE. But the offsets are not correct for gso_make_checksum. UDP GSO packets are of type CHECKSUM_PARTIAL, with their uh->check set to the correct pseudo header checksum. Reset ip_summed to this type. (CHECKSUM_PARTIAL is allowed on ingress, see comments in skbuff.h) Reported-by: syzbot Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3127642dc1d16124cdf175f8235e89bc2b63f424 Author: Stephen Hemminger Date: Mon Jan 27 06:40:36 2020 -0800 netem: change mailing list The old netem mailing list was inactive and recently was targeted by spammers. Switch to just using netdev mailing list which is where all the real change happens. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 7faa26c1bbe312d9191524e4b7ab010f91fcd654 Author: Mohan Kumar Date: Tue Jan 28 10:45:08 2020 +0530 ALSA: hda: Reset stream if DMA RUN bit not cleared Tegra HDA has FIFO size which can hold upto 10 audio frames to support DVFS. When HDA DMA RUN bit is set to 0 to stop the stream, the DMA RUN bit will be cleared to 0 only after transferring all the remaining audio frames queued up in the fifo. This is not in sync with spec which states the controller will stop transmitting(output) in the beginning of the next frame for the relevant stream. The above behavior with Tegra HDA was resulting in machine check error during the system suspend flow with active audio playback with below kernel error logs. [ 33.524583] mc-err: [mcerr] (hda) csr_hdar: EMEM address decode error [ 33.531088] mc-err: [mcerr] status = 0x20000015; addr = 0x00000000 [ 33.537431] mc-err: [mcerr] secure: no, access-type: read, SMMU fault: none This was due to the fifo has more than one audio frame when the DMA RUN bit is set to 0 during system suspend flow and the timeout handling in snd_hdac_stream_sync() was not designed to handle this scenario. So the DMA will continue running even after timeout hit until all remaining audio frames in the fifo are transferred, but the suspend flow will try to reset the controller and turn off the hda clocks without the knowledge of the DMA is still running and could result in mc-err. The above issue can be resolved by doing stream reset with the help of snd_hdac_stream_reset() which would ensure the DMA RUN bit is cleared if the timeout was hit in snd_hdac_stream_sync(). Signed-off-by: Mohan Kumar Link: https://lore.kernel.org/r/20200128051508.26064-1-mkumard@nvidia.com Signed-off-by: Takashi Iwai commit 8d19f1c8e1937baf74e1962aae9f90fa3aeab463 Author: Mike Christie Date: Mon Nov 11 18:19:00 2019 -0600 prctl: PR_{G,S}ET_IO_FLUSHER to support controlling memory reclaim There are several storage drivers like dm-multipath, iscsi, tcmu-runner, amd nbd that have userspace components that can run in the IO path. For example, iscsi and nbd's userspace deamons may need to recreate a socket and/or send IO on it, and dm-multipath's daemon multipathd may need to send SG IO or read/write IO to figure out the state of paths and re-set them up. In the kernel these drivers have access to GFP_NOIO/GFP_NOFS and the memalloc_*_save/restore functions to control the allocation behavior, but for userspace we would end up hitting an allocation that ended up writing data back to the same device we are trying to allocate for. The device is then in a state of deadlock, because to execute IO the device needs to allocate memory, but to allocate memory the memory layers want execute IO to the device. Here is an example with nbd using a local userspace daemon that performs network IO to a remote server. We are using XFS on top of the nbd device, but it can happen with any FS or other modules layered on top of the nbd device that can write out data to free memory. Here a nbd daemon helper thread, msgr-worker-1, is performing a write/sendmsg on a socket to execute a request. This kicks off a reclaim operation which results in a WRITE to the nbd device and the nbd thread calling back into the mm layer. [ 1626.609191] msgr-worker-1 D 0 1026 1 0x00004000 [ 1626.609193] Call Trace: [ 1626.609195] ? __schedule+0x29b/0x630 [ 1626.609197] ? wait_for_completion+0xe0/0x170 [ 1626.609198] schedule+0x30/0xb0 [ 1626.609200] schedule_timeout+0x1f6/0x2f0 [ 1626.609202] ? blk_finish_plug+0x21/0x2e [ 1626.609204] ? _xfs_buf_ioapply+0x2e6/0x410 [ 1626.609206] ? wait_for_completion+0xe0/0x170 [ 1626.609208] wait_for_completion+0x108/0x170 [ 1626.609210] ? wake_up_q+0x70/0x70 [ 1626.609212] ? __xfs_buf_submit+0x12e/0x250 [ 1626.609214] ? xfs_bwrite+0x25/0x60 [ 1626.609215] xfs_buf_iowait+0x22/0xf0 [ 1626.609218] __xfs_buf_submit+0x12e/0x250 [ 1626.609220] xfs_bwrite+0x25/0x60 [ 1626.609222] xfs_reclaim_inode+0x2e8/0x310 [ 1626.609224] xfs_reclaim_inodes_ag+0x1b6/0x300 [ 1626.609227] xfs_reclaim_inodes_nr+0x31/0x40 [ 1626.609228] super_cache_scan+0x152/0x1a0 [ 1626.609231] do_shrink_slab+0x12c/0x2d0 [ 1626.609233] shrink_slab+0x9c/0x2a0 [ 1626.609235] shrink_node+0xd7/0x470 [ 1626.609237] do_try_to_free_pages+0xbf/0x380 [ 1626.609240] try_to_free_pages+0xd9/0x1f0 [ 1626.609245] __alloc_pages_slowpath+0x3a4/0xd30 [ 1626.609251] ? ___slab_alloc+0x238/0x560 [ 1626.609254] __alloc_pages_nodemask+0x30c/0x350 [ 1626.609259] skb_page_frag_refill+0x97/0xd0 [ 1626.609274] sk_page_frag_refill+0x1d/0x80 [ 1626.609279] tcp_sendmsg_locked+0x2bb/0xdd0 [ 1626.609304] tcp_sendmsg+0x27/0x40 [ 1626.609307] sock_sendmsg+0x54/0x60 [ 1626.609308] ___sys_sendmsg+0x29f/0x320 [ 1626.609313] ? sock_poll+0x66/0xb0 [ 1626.609318] ? ep_item_poll.isra.15+0x40/0xc0 [ 1626.609320] ? ep_send_events_proc+0xe6/0x230 [ 1626.609322] ? hrtimer_try_to_cancel+0x54/0xf0 [ 1626.609324] ? ep_read_events_proc+0xc0/0xc0 [ 1626.609326] ? _raw_write_unlock_irq+0xa/0x20 [ 1626.609327] ? ep_scan_ready_list.constprop.19+0x218/0x230 [ 1626.609329] ? __hrtimer_init+0xb0/0xb0 [ 1626.609331] ? _raw_spin_unlock_irq+0xa/0x20 [ 1626.609334] ? ep_poll+0x26c/0x4a0 [ 1626.609337] ? tcp_tsq_write.part.54+0xa0/0xa0 [ 1626.609339] ? release_sock+0x43/0x90 [ 1626.609341] ? _raw_spin_unlock_bh+0xa/0x20 [ 1626.609342] __sys_sendmsg+0x47/0x80 [ 1626.609347] do_syscall_64+0x5f/0x1c0 [ 1626.609349] ? prepare_exit_to_usermode+0x75/0xa0 [ 1626.609351] entry_SYSCALL_64_after_hwframe+0x44/0xa9 This patch adds a new prctl command that daemons can use after they have done their initial setup, and before they start to do allocations that are in the IO path. It sets the PF_MEMALLOC_NOIO and PF_LESS_THROTTLE flags so both userspace block and FS threads can use it to avoid the allocation recursion and try to prevent from being throttled while writing out data to free up memory. Signed-off-by: Mike Christie Acked-by: Michal Hocko Tested-by: Masato Suzuki Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Link: https://lore.kernel.org/r/20191112001900.9206-1-mchristi@redhat.com Signed-off-by: Christian Brauner commit 0cc4bd8f70d1ea2940295f1050508c663fe9eff9 Merge: 56ee04aa6328 31537cf8f3f9 Author: Ingo Molnar Date: Tue Jan 28 07:59:05 2020 +0100 Merge branch 'core/kprobes' into perf/core, to pick up fixes Signed-off-by: Ingo Molnar commit 74777eaf7aef0f80276cb1c3fad5b8292c368859 Merge: 872849789579 b2aa09178d11 Author: Ingo Molnar Date: Tue Jan 28 07:53:12 2020 +0100 Merge branch 'core/documentation' into core/urgent, to pick up single commit Signed-off-by: Ingo Molnar commit b0be0eff1a5ab77d588b76bd8b1c92d5d17b3f73 Merge: 3d3b44a61a9c a84de2fa962c Author: Linus Torvalds Date: Mon Jan 27 17:28:52 2020 -0800 Merge tag 'x86-pti-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 pti updates from Thomas Gleixner: "The performance deterioration departement provides a few non-scary fixes and improvements: - Update the cached HLE state when the TSX state is changed via the new control register. This ensures feature bit consistency. - Exclude the new Zhaoxin CPUs from Spectre V2 and SWAPGS vulnerabilities" * tag 'x86-pti-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation/swapgs: Exclude Zhaoxin CPUs from SWAPGS vulnerability x86/speculation/spectre_v2: Exclude Zhaoxin CPUs from SPECTRE_V2 x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR commit 3d3b44a61a9cfd268fc071ea1b1c5dfea7ed133d Merge: ab67f600253f 43ee74487bd2 Author: Linus Torvalds Date: Mon Jan 27 17:22:21 2020 -0800 Merge tag 'irq-core-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "The interrupt departement provides: - A mechanism to shield isolated tasks from managed interrupts: The affinity of managed interrupts is completely controlled by the kernel and user space has no influence on them. The reason is that the automatically assigned affinity correlates to the multi-queue CPU handling of block devices. If the generated affinity mask spaws both housekeeping and isolated CPUs the interrupt could be routed to an isolated CPU which would then be disturbed by I/O submitted by a housekeeping CPU. The new mechamism ensures that as long as one housekeeping CPU is online in the assigned affinity mask the interrupt is routed to a housekeeping CPU. If there is no online housekeeping CPU in the affinity mask, then the interrupt is routed to an isolated CPU to keep the device queue intact, but unless the isolated CPU submits I/O by itself these interrupts are not raised. - A small addon to the device tree irqdomain core code to avoid duplication in irq chip drivers - Conversion of the SiFive PLIC to hierarchical domains - The usual pile of new irq chip drivers: SiFive GPIO, Aspeed SCI, NXP INTMUX, Meson A1 GPIO - The first cut of support for the new ARM GICv4.1 - The usual pile of fixes and improvements in core and driver code" * tag 'irq-core-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits) genirq, sched/isolation: Isolate from handling managed interrupts irqchip/gic-v4.1: Allow direct invalidation of VLPIs irqchip/gic-v4.1: Suppress per-VLPI doorbell irqchip/gic-v4.1: Add VPE INVALL callback irqchip/gic-v4.1: Add VPE eviction callback irqchip/gic-v4.1: Add VPE residency callback irqchip/gic-v4.1: Add mask/unmask doorbell callbacks irqchip/gic-v4.1: Plumb skeletal VPE irqchip irqchip/gic-v4.1: Implement the v4.1 flavour of VMOVP irqchip/gic-v4.1: Don't use the VPE proxy if RVPEID is set irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP irqchip/gic-v4.1: VPE table (aka GICR_VPROPBASER) allocation irqchip/gic-v3: Add GICv4.1 VPEID size discovery irqchip/gic-v3: Detect GICv4.1 supporting RVPEID irqchip/gic-v3-its: Fix get_vlpi_map() breakage with doorbells irqdomain: Fix a memory leak in irq_domain_push_irq() irqchip: Add NXP INTMUX interrupt multiplexer support dt-bindings: interrupt-controller: Add binding for NXP INTMUX interrupt multiplexer irqchip: Define EXYNOS_IRQ_COMBINER irqchip/meson-gpio: Add support for meson a1 SoCs ... commit ab67f600253f0f7b3992399918cf69e71b22ff37 Merge: e279160f4913 cb923159bbb8 Author: Linus Torvalds Date: Mon Jan 27 17:04:51 2020 -0800 Merge tag 'smp-core-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core SMP updates from Thomas Gleixner: "A small set of SMP core code changes: - Rework the smp function call core code to avoid the allocation of an additional cpumask - Remove the not longer required GFP argument from on_each_cpu_cond() and on_each_cpu_cond_mask() and fixup the callers" * tag 'smp-core-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Remove allocation mask from on_each_cpu_cond.*() smp: Add a smp_cond_func_t argument to smp_call_function_many() smp: Use smp_cond_func_t as type for the conditional function commit e279160f491392f1345f6eb4b0eeec5a6a2ecdd7 Merge: 534b0a8b6774 fd928f3e32ba Author: Linus Torvalds Date: Mon Jan 27 16:47:05 2020 -0800 Merge tag 'timers-core-2020-01-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "The timekeeping and timers departement provides: - Time namespace support: If a container migrates from one host to another then it expects that clocks based on MONOTONIC and BOOTTIME are not subject to disruption. Due to different boot time and non-suspended runtime these clocks can differ significantly on two hosts, in the worst case time goes backwards which is a violation of the POSIX requirements. The time namespace addresses this problem. It allows to set offsets for clock MONOTONIC and BOOTTIME once after creation and before tasks are associated with the namespace. These offsets are taken into account by timers and timekeeping including the VDSO. Offsets for wall clock based clocks (REALTIME/TAI) are not provided by this mechanism. While in theory possible, the overhead and code complexity would be immense and not justified by the esoteric potential use cases which were discussed at Plumbers '18. The overhead for tasks in the root namespace (ie where host time offsets = 0) is in the noise and great effort was made to ensure that especially in the VDSO. If time namespace is disabled in the kernel configuration the code is compiled out. Kudos to Andrei Vagin and Dmitry Sofanov who implemented this feature and kept on for more than a year addressing review comments, finding better solutions. A pleasant experience. - Overhaul of the alarmtimer device dependency handling to ensure that the init/suspend/resume ordering is correct. - A new clocksource/event driver for Microchip PIT64 - Suspend/resume support for the Hyper-V clocksource - The usual pile of fixes, updates and improvements mostly in the driver code" * tag 'timers-core-2020-01-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (71 commits) alarmtimer: Make alarmtimer_get_rtcdev() a stub when CONFIG_RTC_CLASS=n alarmtimer: Use wakeup source from alarmtimer platform device alarmtimer: Make alarmtimer platform device child of RTC device alarmtimer: Update alarmtimer_get_rtcdev() docs to reflect reality hrtimer: Add missing sparse annotation for __run_timer() lib/vdso: Only read hrtimer_res when needed in __cvdso_clock_getres() MIPS: vdso: Define BUILD_VDSO32 when building a 32bit kernel clocksource/drivers/hyper-v: Set TSC clocksource as default w/ InvariantTSC clocksource/drivers/hyper-v: Untangle stimers and timesync from clocksources clocksource/drivers/timer-microchip-pit64b: Fix sparse warning clocksource/drivers/exynos_mct: Rename Exynos to lowercase clocksource/drivers/timer-ti-dm: Fix uninitialized pointer access clocksource/drivers/timer-ti-dm: Switch to platform_get_irq clocksource/drivers/timer-ti-dm: Convert to devm_platform_ioremap_resource clocksource/drivers/em_sti: Fix variable declaration in em_sti_probe clocksource/drivers/em_sti: Convert to devm_platform_ioremap_resource clocksource/drivers/bcm2835_timer: Fix memory leak of timer clocksource/drivers/cadence-ttc: Use ttc driver as platform driver clocksource/drivers/timer-microchip-pit64b: Add Microchip PIT64B support clocksource/drivers/hyper-v: Reserve PAGE_SIZE space for tsc page ... commit 534b0a8b677443c0aa8c4c71ff7887f08a2b9b41 Merge: b11c89a158f2 35fd7a637c42 Author: Linus Torvalds Date: Mon Jan 27 16:45:58 2020 -0800 Merge tag 'core-debugobjects-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "A single commit for debug objects which fixes a pile of potential data races detected by KCSAN" * tag 'core-debugobjects-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Fix various data races commit b11c89a158f29a9b9d740f8f60b74f261ce6557f Merge: a56c41e5d766 11e31f608b49 Author: Linus Torvalds Date: Mon Jan 27 16:42:11 2020 -0800 Merge tag 'core-core-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull watchdog updates from Thomas Gleixner: "A set of watchdog/softlockup related improvements: - Enforce that the watchdog timestamp is always valid on boot. The original implementation caused a watchdog disabled gap of one second in the boot process due to truncation of the underlying sched clock. The sched clock is divided by 1e9 to convert nanoseconds to seconds. So for the first second of the boot process the result is 0 which is at the same time the indicator to disable the watchdog. The trivial fix is to change the disabled indicator to ULONG_MAX. - Two cleanup patches removing unused and redundant code which got forgotten to be cleaned up in previous changes" * tag 'core-core-2020-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: watchdog/softlockup: Enforce that timestamp is valid on boot watchdog/softlockup: Remove obsolete check of last reported task watchdog: Remove soft_lockup_hrtimer_cnt and related code commit a56c41e5d766871231828046f477611d6ee7d2db Merge: b1dba2473114 9f24c540f7f8 Author: Linus Torvalds Date: Mon Jan 27 16:37:40 2020 -0800 Merge tag 'timers-urgent-2020-01-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Two fixes for the generic VDSO code which missed 5.5: - Make the update to the coarse timekeeper unconditional. This is required because the coarse timekeeper interfaces in the VDSO do not depend on a VDSO capable clocksource. If the system does not have a VDSO capable clocksource and the update is depending on the VDSO capable clocksource, the coarse VDSO interfaces would operate on stale data forever. - Invert the logic of __arch_update_vdso_data() to avoid further head scratching. Tripped over this several times while analyzing the update problem above" * tag 'timers-urgent-2020-01-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lib/vdso: Update coarse timekeeper unconditionally lib/vdso: Make __arch_update_vdso_data() logic understandable commit b1dba2473114588be3df916bf629a61bdcc83737 Merge: 07e309a972ca 98aa00345de5 Author: Linus Torvalds Date: Mon Jan 27 15:38:15 2020 -0800 Merge tag 'selinux-pr-20200127' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux update from Paul Moore: "This is one of the bigger SELinux pull requests in recent years with 28 patches. Everything is passing our test suite and the highlights are below: - Mark CONFIG_SECURITY_SELINUX_DISABLE as deprecated. We're some time away from actually attempting to remove this in the kernel, but the only distro we know that still uses it (Fedora) is working on moving away from this so we want to at least let people know we are planning to remove it. - Reorder the SELinux hooks to help prevent bad things when SELinux is disabled at runtime. The proper fix is to remove the CONFIG_SECURITY_SELINUX_DISABLE functionality (see above) and just take care of it at boot time (e.g. "selinux=0"). - Add SELinux controls for the kernel lockdown functionality, introducing a new SELinux class/permissions: "lockdown { integrity confidentiality }". - Add a SELinux control for move_mount(2) that reuses the "file { mounton }" permission. - Improvements to the SELinux security label data store lookup functions to speed up translations between our internal label representations and the visible string labels (both directions). - Revisit a previous fix related to SELinux inode auditing and permission caching and do it correctly this time. - Fix the SELinux access decision cache to cleanup properly on error. In some extreme cases this could limit the cache size and result in a decrease in performance. - Enable SELinux per-file labeling for binderfs. - The SELinux initialized and disabled flags were wrapped with accessors to ensure they are accessed correctly. - Mark several key SELinux structures with __randomize_layout. - Changes to the LSM build configuration to only build security/lsm_audit.c when needed. - Changes to the SELinux build configuration to only build the IB object cache when CONFIG_SECURITY_INFINIBAND is enabled. - Move a number of single-caller functions into their callers. - Documentation fixes (/selinux -> /sys/fs/selinux). - A handful of cleanup patches that aren't worth mentioning on their own, the individual descriptions have plenty of detail" * tag 'selinux-pr-20200127' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: (28 commits) selinux: fix regression introduced by move_mount(2) syscall selinux: do not allocate ancillary buffer on first load selinux: remove redundant allocation and helper functions selinux: remove redundant selinux_nlmsg_perm selinux: fix wrong buffer types in policydb.c selinux: reorder hooks to make runtime disable less broken selinux: treat atomic flags more carefully selinux: make default_noexec read-only after init selinux: move ibpkeys code under CONFIG_SECURITY_INFINIBAND. selinux: remove redundant msg_msg_alloc_security Documentation,selinux: fix references to old selinuxfs mount point selinux: deprecate disabling SELinux and runtime selinux: allow per-file labelling for binderfs selinuxfs: use scnprintf to get real length for inode selinux: remove set but not used variable 'sidtab' selinux: ensure the policy has been loaded before reading the sidtab stats selinux: ensure we cleanup the internal AVC counters on error in avc_update() selinux: randomize layout of key structures selinux: clean up selinux_enabled/disabled/enforcing_boot selinux: remove unnecessary selinux cred request ... commit 07e309a972cae9de1807f48968f4673f6868e211 Merge: 03aa8c8cfaec cb5172d96d16 Author: Linus Torvalds Date: Mon Jan 27 15:35:50 2020 -0800 Merge tag 'audit-pr-20200127' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit update from Paul Moore: "One small audit patch for the Linux v5.6 merge window, and unsurprisingly it passes our test suite with flying colors" * tag 'audit-pr-20200127' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: Add __rcu annotation to RCU pointer commit 03aa8c8cfaec1aab6b1ea7fde656bbc893f6cff8 Merge: 16d06120d73a 9ea37e24d4a9 Author: Linus Torvalds Date: Mon Jan 27 15:18:25 2020 -0800 Merge branch 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - cgroup2 interface for hugetlb controller. I think this was the last remaining bit which was missing from cgroup2 - fixes for race and a spurious warning in threaded cgroup handling - other minor changes * 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: iocost: Fix iocost_monitor.py due to helper type mismatch cgroup: Prevent double killing of css when enabling threaded cgroup cgroup: fix function name in comment mm: hugetlb controller for cgroups v2 commit 16d06120d73acde39ac0d5e3c539b4f407e9e588 Merge: 6a1000bd2703 e8ab20d9bcb3 Author: Linus Torvalds Date: Mon Jan 27 15:16:52 2020 -0800 Merge branch 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: "Just a couple tracepoint patches" * 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: remove workqueue_work event class workqueue: add worker function to workqueue_execute_end tracepoint commit 848f7e1887c46f21679c2c12b9e8022f17750721 Author: Jens Axboe Date: Thu Jan 23 15:33:32 2020 -0700 io-wq: make the io_wq ref counted In preparation for sharing an io-wq across different users, add a reference count that manages destruction of it. Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 34719de919af07682861cb0fa2bcf64da33ecf44 Author: Geert Uytterhoeven Date: Sun Jan 12 18:13:49 2020 +0100 rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed Merely enabling I2C and RTC selects REGMAP_I2C and REGMAP_SPI, even when no driver needs it. While the former can be moduler, the latter cannot, and thus becomes built-in. Fix this by moving the select statements for REGMAP_I2C and REGMAP_SPI from the RTC_I2C_AND_SPI helper to the individual drivers that depend on it. Note that the comment for RTC_I2C_AND_SPI refers to SND_SOC_I2C_AND_SPI for more information, but the latter does not select REGMAP_{I2C,SPI} itself, and defers that to the individual drivers, too. Fixes: 080481f54ef62121 ("rtc: merge ds3232 and ds3234") Signed-off-by: Geert Uytterhoeven Reported-by: kbuild test robot Reported-by: kbuild test robot Link: https://lore.kernel.org/r/20200112171349.22268-1-geert@linux-m68k.org Signed-off-by: Alexandre Belloni commit 9466f43741bc08edd7b1bee642dd6f5561091634 Author: Pavel Begunkov Date: Sat Jan 25 22:34:01 2020 +0300 io_uring: fix refcounting with batched allocations at OOM In case of out of memory the second argument of percpu_ref_put_many() in io_submit_sqes() may evaluate into "nr - (-EAGAIN)", that is clearly wrong. Fixes: 2b85edfc0c90 ("io_uring: batch getting pcpu references") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8cdf2193a3335b4cfb6e023b41ac293d0843d287 Author: Pavel Begunkov Date: Sat Jan 25 00:40:24 2020 +0300 io_uring: add comment for drain_next Draining the middle of a link is tricky, so leave a comment there Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 980ad26304abf11e78caaa68023411b9c088b848 Author: Jens Axboe Date: Fri Jan 24 23:08:54 2020 -0700 io_uring: don't attempt to copy iovec for READ/WRITE For the non-vectored variant of READV/WRITEV, we don't need to setup an async io context, and we flag that appropriately in the io_op_defs array. However, in fixing this for the 5.5 kernel in commit 74566df3a71c we didn't have these opcodes, so the check there was added just for the READ_FIXED and WRITE_FIXED opcodes. Replace that check with just a single check for needing async context, that covers all four of these read/write variants that don't use an iovec. Signed-off-by: Jens Axboe commit 578c2b661e2b1b474ea3571a3c3c6d57bae89e8d Author: Alexandre Belloni Date: Mon Jan 27 23:17:24 2020 +0100 rtc: Kconfig: select REGMAP_I2C when necessary Some i2c RTC drivers are using regmap but are not selecting REGMAP_I2C which may lead to build failures. Link: https://lore.kernel.org/r/20200127221724.10160-2-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit c68209410752117fd0b11d88ca514563878f64aa Author: Alexandre Belloni Date: Mon Jan 27 23:17:23 2020 +0100 rtc: Kconfig: properly indent sd3078 entry The RTC_DRV_SD3078 is indented using spaces, use tabs instead. Link: https://lore.kernel.org/r/20200127221724.10160-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit f61023dfb6d489cc4dfa235d3f02a9feb6f1ec7e Author: Benjamin Gaignard Date: Mon Jan 27 14:07:04 2020 -0800 dt-bindings: touchscreen: Convert Goodix touchscreen to json-schema Convert the Goodix binding to DT schema format using json-schema Signed-off-by: Benjamin Gaignard Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20200108091118.5130-3-benjamin.gaignard@st.com Signed-off-by: Dmitry Torokhov commit 1d6204e2f51fcef7dd174e7703294fa0abbc0740 Author: Benjamin Gaignard Date: Mon Jan 27 14:06:32 2020 -0800 dt-bindings: touchscreen: Add touchscreen schema Add touchscreen schema for common properties Signed-off-by: Benjamin Gaignard Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20200108091118.5130-2-benjamin.gaignard@st.com Signed-off-by: Dmitry Torokhov commit 269a0bf79b3346fbebe7f62aef516ce61c2f02d0 Author: Colin Ian King Date: Sat Jan 25 20:26:13 2020 +0000 drm/amd/powerplay: fix spelling mistake "Attemp" -> "Attempt" There are several spelling mistakes in PP_ASSERT_WITH_CODE messages. Fix these. Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 54f73df4cab18734b71a4325feb4749d334dc877 Author: Colin Ian King Date: Fri Jan 17 13:33:05 2020 +0000 drm/amd/display: fix for-loop with incorrectly sized loop counter (v2) A for-loop is iterating from 0 up to 1000 however the loop variable count is a u8 and hence not large enough. Fix this by making count an int. Also remove the redundant initialization of count since this is never used and add { } on the loop statement make the loop block clearer. v2: drop useless else (Walter Harms) Addresses-Coverity: ("Operands don't affect result") Fixes: ed581a0ace44 ("drm/amd/display: wait for update when setting dpg test pattern") Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 2cb44fb09305e23fe60dbfcccad3f8c4028749f1 Author: Alex Deucher Date: Mon Jan 27 14:35:10 2020 -0500 drm/amdgpu: enable GPU reset by default on renoir Everything is in place. Reviewed-by: Andrey Grodzovsky Signed-off-by: Alex Deucher commit 658c663947b04b1f8a2fd061a3ef767983c880e5 Author: Alex Deucher Date: Mon Jan 27 14:31:49 2020 -0500 drm/amdgpu: enable GPU reset by default on Navi Has been working fine for a while. Reviewed-by: Andrey Grodzovsky Signed-off-by: Alex Deucher commit bb67bfd2e7101bf2ac5327b0b7a847cd9fb9723f Author: Dor Askayo Date: Sat Jan 4 14:22:15 2020 +0200 drm/amd/display: do not allocate display_mode_lib unnecessarily This allocation isn't required and can fail when resuming from suspend. Bug: https://gitlab.freedesktop.org/drm/amd/issues/1009 Signed-off-by: Dor Askayo Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 77171eade8faa713c1104b29ea7ff96915ecf9fb Author: Christian König Date: Thu Jan 16 14:06:59 2020 +0100 drm/amdgpu: add coreboot workaround for KV/KB Coreboot seems to have a problem correctly setting up access to the stolen VRAM on KV/KB. Use the direct access only when necessary. Signed-off-by: Christian König Reported-and-tested-by: Fredrik Bruhn Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit da2f84ba73df11186cf23bec45d039f3b9162bd8 Author: Harry Wentland Date: Tue Jan 21 16:29:54 2020 -0500 Revert "drm/amd/display: Don't skip link training for empty dongle" This reverts commit 80adaebd2d411b7d6872a097634848a71eb13d20. [WHY] This change was working around a regression that occured in this: commit 0301ccbaf67d ("drm/amd/display: DP Compliance 400.1.1 failure") With the fix to run verify_link_cap when the SINK_COUNT of dongles becomes non-zero this change is no longer needed. Cc: Louis Li Cc: Wenjing Liu Cc: Hersen Wu Cc: Eric Yang Reviewed-by: Wenjing Liu Signed-off-by: Harry Wentland Signed-off-by: Alex Deucher commit 3eb6d7aca53d81ce888624f09cd44dc0302161e8 Author: Harry Wentland Date: Tue Jan 21 16:12:45 2020 -0500 drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero [WHY] Two years ago the patch referenced by the Fixes tag stopped running dp_verify_link_cap_with_retries during DP detection when the reason for the detection was a short-pulse interrupt. This effectively meant that we were no longer doing the verify_link_cap training on active dongles when their SINK_COUNT changed from 0 to 1. A year ago this was partly remedied with: commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle") This made sure that we trained the dongle on initial hotplug (without connected downstream devices). This is all fine and dandy if it weren't for the fact that there are some dongles on the market that don't like link training when SINK_COUNT is 0 These dongles will in fact indicate a SINK_COUNT of 0 immediately after hotplug, even when a downstream device is connected, and then trigger a shortpulse interrupt indicating a SINK_COUNT change to 1. In order to play nicely we will need our policy to not link train an active DP dongle when SINK_COUNT is 0 but ensure we train it when the SINK_COUNT changes to 1. [HOW] Call dp_verify_link_cap_with_retries on detection even when the detection is triggered from a short pulse interrupt. With this change we can also revert this commit which we'll do in a separate follow-up change: commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle") Fixes: 0301ccbaf67d ("drm/amd/display: DP Compliance 400.1.1 failure") Suggested-by: Louis Li Tested-by: Louis Li Cc: Wenjing Liu Cc: Hersen Wu Cc: Eric Yang Reviewed-by: Wenjing Liu Signed-off-by: Harry Wentland Signed-off-by: Alex Deucher commit 276cc92945ab4af02d8bedce18b4b6f87b9c1609 Author: Alex Deucher Date: Wed Jan 15 12:56:37 2020 -0500 drm/amdgpu: original raven doesn't support full asic reset So don't use it. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 7af2a5771e0918cdadb1614c1f81dd67a58e00aa Author: Alex Deucher Date: Wed Jan 15 12:26:51 2020 -0500 drm/amdgpu: attempt to enable gfxoff on more raven1 boards (v2) Switch to a blacklist so we can disable specific boards that are problematic. v2: make the blacklist non-raven specific. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b20dcd72c150d82c56682606202f3f028403e581 Author: Colin Ian King Date: Thu Jan 23 00:22:16 2020 +0000 drm/amd/amdgpu: fix spelling mistake "to" -> "too" There is a spelling mistake in a DRM_ERROR message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit a16afcdd8c58285e83951ce318b55eafb7948997 Author: zhengbin Date: Wed Jan 22 15:53:11 2020 +0800 drm/amd/powerplay: use true, false for bool variable in smu7_hwmgr.c Fixes coccicheck warning: drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:723:2-50: WARNING: Assignment of 0/1 to bool variable drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:733:3-52: WARNING: Assignment of 0/1 to bool variable drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:747:3-51: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Alex Deucher commit 2639f453f28e71dc4149fb06c71bcf6f93eb468f Author: Nirmoy Das Date: Wed Jan 22 10:37:56 2020 +0100 drm/amdgpu: fix doc by clarifying sched_list definition expand sched_list definition for better understanding. Also fix a typo atleast -> at least Signed-off-by: Nirmoy Das Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f583cc57ba70afdd02e36b0ada3790e8bf4fb10f Author: xinhui pan Date: Wed Jan 22 11:03:30 2020 +0800 drm/amdgpu: initialize bo_va_list when add gws to process bo_va_list is list_head, so initialize it. Signed-off-by: xinhui pan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 55bbb747ecfa39806198419e96e7bc2c44221d4e Author: James Zhu Date: Tue Jan 21 16:33:21 2020 -0500 drm/amdgpu/vcn: use inst_idx relacing inst Use inst_idx relacing inst in SOC15_DPG_MODE macro to avoid confusion. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit a4555732142e96855c854fa7b2a65035044391b3 Author: James Zhu Date: Tue Jan 21 16:28:07 2020 -0500 drm/amdgpu/vcn: fix typo error Fix typo error, should be inst_idx instead of inst. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 326b523eeb521368fd1566c8ceeddf04a68cb01e Author: James Zhu Date: Mon Jan 20 21:44:07 2020 -0500 drm/amdgpu/vcn: fix vcn2.5 instance issue Fix vcn2.5 instance issue, vcn0 and vcn1 have same register offset Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 62884a7bf34379b2cacd391c510cb9d852b36560 Author: James Zhu Date: Mon Jan 20 15:47:35 2020 -0500 drm/amdgpu/vcn2.5: fix a bug for the 2nd vcn instance (v2) Fix a bug for the 2nd vcn instance at start and stop. v2: squash in unused label removal. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit b6501217265f770957548eec818f6c08aa1ef6a1 Author: James Zhu Date: Mon Jan 20 15:43:04 2020 -0500 drm/amdgpu/vcn: Share vcn_v2_0_dec_ring_test_ring to vcn2.5 Share vcn_v2_0_dec_ring_test_ring to vcn2.5 to support vcn software ring. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit fa34edbed46178545285fd080c8d4d3fbc8fbc71 Author: Felix Kuehling Date: Fri Jan 17 20:08:42 2020 -0500 drm/amdgpu: Use the correct flush_type in flush_gpu_tlb_pasid The flush_type was incorrectly hard-coded to 0 when calling falling back to MMIO-based invalidation in flush_gpu_tlb_pasid. Fixes: ea930000a6dc ("drm/amdgpu: export function to flush TLB via pasid") Signed-off-by: Felix Kuehling Reviewed-by: Christian König Reviewed-by: Oak Zeng Signed-off-by: Alex Deucher commit 37c58ddf57364d1a636850bb8ba6acbe1e16195e Author: Felix Kuehling Date: Fri Jan 17 19:54:45 2020 -0500 drm/amdgpu: Fix TLB invalidation request when using semaphore Use a more meaningful variable name for the invalidation request that is distinct from the tmp variable that gets overwritten when acquiring the invalidation semaphore. Fixes: 4ed8a03740d0 ("drm/amdgpu: invalidate mmhub semaphore workaround in gmc9/gmc10") Signed-off-by: Felix Kuehling Reviewed-by: Christian König Reviewed-by: Yong Zhao Signed-off-by: Alex Deucher commit 1630146db2111412e7524d05d812ff8f2c75977e Author: Geert Uytterhoeven Date: Mon Jan 27 10:31:07 2020 +0100 scripts/find-unused-docs: Fix massive false positives scripts/find-unused-docs.sh invokes scripts/kernel-doc to find out if a source file contains kerneldoc or not. However, as it passes the no longer supported "-text" option to scripts/kernel-doc, the latter prints out its help text, causing all files to be considered containing kerneldoc. Get rid of these false positives by removing the no longer supported "-text" option from the scripts/kernel-doc invocation. Cc: stable@vger.kernel.org # 4.16+ Fixes: b05142675310d2ac ("scripts: kernel-doc: get rid of unused output formats") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20200127093107.26401-1-geert+renesas@glider.be Signed-off-by: Jonathan Corbet commit 6a1000bd27035bba17ede9dc915166276a811edb Merge: 9dd70e2880b8 4bdc0d676a64 Author: Linus Torvalds Date: Mon Jan 27 13:03:00 2020 -0800 Merge tag 'ioremap-5.6' of git://git.infradead.org/users/hch/ioremap Pull ioremap updates from Christoph Hellwig: "Remove the ioremap_nocache API (plus wrappers) that are always identical to ioremap" * tag 'ioremap-5.6' of git://git.infradead.org/users/hch/ioremap: remove ioremap_nocache and devm_ioremap_nocache MIPS: define ioremap_nocache to ioremap commit 9dd70e2880b8c8386097de51564c60352b3e4070 Merge: 22a8f39c520f 7e053d3e820b Author: Linus Torvalds Date: Mon Jan 27 12:57:17 2020 -0800 Merge tag 'for-5.6/libata-2020-01-27' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: "As usual pretty quiet, mostly trivial fixes (or dead code removal), outside of various fixes for ahci_bcrm" * tag 'for-5.6/libata-2020-01-27' of git://git.kernel.dk/linux-block: ata/acard_ahci: remove unused variable n_elem ata: pata_macio: fix comparing pointer to 0 ata: ahci_brcm: BCM7216 reset is self de-asserting ata: ahci_brcm: Perform reset after obtaining resources ata: brcm: fix reset controller API usage ata: brcm: mark PM functions as __maybe_unused ata: ahci_brcm: Support BCM7216 reset controller name dt-bindings: ata: Document BCM7216 AHCI controller compatible ata: ahci_brcm: Add a shutdown callback ata: ahci_brcm: Manage reset line during suspend/resume commit 22a8f39c520fc577c02b4e5c99f8bb3b6017680b Merge: 48b4b4ff1ee0 e3de04469a49 Author: Linus Torvalds Date: Mon Jan 27 12:55:48 2020 -0800 Merge tag 'for-5.6/drivers-2020-01-27' of git://git.kernel.dk/linux-block Pull block driver updates from Jens Axboe: "Like the core side, not a lot of changes here, just two main items: - Series of patches (via Coly) with fixes for bcache (Coly, Christoph) - MD pull request from Song" * tag 'for-5.6/drivers-2020-01-27' of git://git.kernel.dk/linux-block: (31 commits) bcache: reap from tail of c->btree_cache in bch_mca_scan() bcache: reap c->btree_cache_freeable from the tail in bch_mca_scan() bcache: remove member accessed from struct btree bcache: print written and keys in trace_bcache_btree_write bcache: avoid unnecessary btree nodes flushing in btree_flush_write() bcache: add code comments for state->pool in __btree_sort() lib: crc64: include for 'crc64_be' bcache: use read_cache_page_gfp to read the superblock bcache: store a pointer to the on-disk sb in the cache and cached_dev structures bcache: return a pointer to the on-disk sb from read_super bcache: transfer the sb_page reference to register_{bdev,cache} bcache: fix use-after-free in register_bcache() bcache: properly initialize 'path' and 'err' in register_bcache() bcache: rework error unwinding in register_bcache bcache: use a separate data structure for the on-disk super block bcache: cached_dev_free needs to put the sb page md/raid1: introduce wait_for_serialization md/raid1: use bucket based mechanism for IO serialization md: introduce a new struct for IO serialization md: don't destroy serial_info_pool if serialize_policy is true ... commit ea660ad7c1c476fd6e5e3b17780d47159db71dea Author: Håkon Bugge Date: Thu Jan 23 16:55:21 2020 +0100 IB/mlx4: Fix leak in id_map_find_del Using CX-3 virtual functions, either from a bare-metal machine or pass-through from a VM, MAD packets are proxied through the PF driver. Since the VF drivers have separate name spaces for MAD Transaction Ids (TIDs), the PF driver has to re-map the TIDs and keep the book keeping in a cache. Following the RDMA Connection Manager (CM) protocol, it is clear when an entry has to evicted from the cache. When a DREP is sent from mlx4_ib_multiplex_cm_handler(), id_map_find_del() is called. Similar when a REJ is received by the mlx4_ib_demux_cm_handler(), id_map_find_del() is called. This function wipes out the TID in use from the IDR or XArray and removes the id_map_entry from the table. In short, it does everything except the topping of the cake, which is to remove the entry from the list and free it. In other words, for the REJ case enumerated above, one id_map_entry will be leaked. For the other case above, a DREQ has been received first. The reception of the DREQ will trigger queuing of a delayed work to delete the id_map_entry, for the case where the VM doesn't send back a DREP. In the normal case, the VM _will_ send back a DREP, and id_map_find_del() will be called. But this scenario introduces a secondary leak. First, when the DREQ is received, a delayed work is queued. The VM will then return a DREP, which will call id_map_find_del(). As stated above, this will free the TID used from the XArray or IDR. Now, there is window where that particular TID can be re-allocated, lets say by an outgoing REQ. This TID will later be wiped out by the delayed work, when the function id_map_ent_timeout() is called. But the id_map_entry allocated by the outgoing REQ will not be de-allocated, and we have a leak. Both leaks are fixed by removing the id_map_find_del() function and only using schedule_delayed(). Of course, a check in schedule_delayed() to see if the work already has been queued, has been added. Another benefit of always using the delayed version for deleting entries, is that we do get a TimeWait effect; a TID no longer in use, will occupy the XArray or IDR for CM_CLEANUP_CACHE_TIMEOUT time, without any ability of being re-used for that time period. Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") Link: https://lore.kernel.org/r/20200123155521.1212288-1-haakon.bugge@oracle.com Signed-off-by: Håkon Bugge Signed-off-by: Manjunath Patil Reviewed-by: Rama Nichanamatlu Reviewed-by: Jack Morgenstein Signed-off-by: Jason Gunthorpe commit 48b4b4ff1ee044a977929bcf80e79f8212f756b4 Merge: 34dabd81160f 5336da37a5ea Author: Linus Torvalds Date: Mon Jan 27 12:38:25 2020 -0800 Merge tag 'for-5.6/block-2020-01-27' of git://git.kernel.dk/linux-block Pull core block updates from Jens Axboe: "This may be the most quiet round we've had in years. I'm not complaining. Really not a lot to detail here, outside of spelling and documentation improvements/fixes, we have: - Allow t10-pi to be modular (Herbert) - Remove dead code in bfq (Alex) - Mark zone management requests with REQ_SYNC (Chaitanya) - BFQ division improvement (Wen) - Small series improving plugging (Pavel)" * tag 'for-5.6/block-2020-01-27' of git://git.kernel.dk/linux-block: partitions/ldm: fix spelling mistake "to" -> "too" block, bfq: improve arithmetic division in bfq_delta() block/bfq: remove unused bfq_class_rt which never used block: mark zone-mgmt bios with REQ_SYNC blk-mq: Document functions for sending request block: Allow t10-pi to be modular blk-mq: optimise blk_mq_flush_plug_list() list: introduce list_for_each_continue() blk-mq: optimise rq sort function commit 34dabd81160f7bfb18b67c1161b3c4d7ca6cab83 Merge: 85c009e8e5d2 786c87cd312a Author: Linus Torvalds Date: Mon Jan 27 12:04:48 2020 -0800 Merge tag 'pnp-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull PNP updates from Rafael Wysocki: "Get rid of unused variable and function (yu kuai)" * tag 'pnp-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PNP: isapnp: remove defined but not used function 'isapnp_checksum' PNP: isapnp: remove set but not used variable 'checksum' commit 85c009e8e5d2794e2efb1019e3648f3d8126f1b5 Merge: 55816dc1a504 aa811e3cecec Author: Linus Torvalds Date: Mon Jan 27 11:57:40 2020 -0800 Merge tag 'devprop-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework updates from Rafael Wysocki: "Add support for reference properties in sofrware nodes (Dmitry Torokhov) and a basic test for property entries along with fixes on top of it (Dmitry Torokhov, Qian Cai, Alan Maguire)" * tag 'devprop-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: software node: introduce CONFIG_KUNIT_DRIVER_PE_TEST usb: dwc3: use proper initializers for property entries drivers/base/test: fix global-out-of-bounds error software node: add basic tests for property entries software node: remove separate handling of references platform/x86: intel_cht_int33fe: use inline reference properties software node: implement reference properties software node: allow embedding of small arrays into property_entry software node: replace is_array with is_inline commit 47ace7e012b9f7ad71d43ac9063d335ea3d6820b Author: Mike Snitzer Date: Mon Jan 27 14:07:23 2020 -0500 dm: fix potential for q->make_request_fn NULL pointer Move blk_queue_make_request() to dm.c:alloc_dev() so that q->make_request_fn is never NULL during the lifetime of a DM device (even one that is created without a DM table). Otherwise generic_make_request() will crash simply by doing: dmsetup create -n test mount /dev/dm-N /mnt While at it, move ->congested_data initialization out of dm.c:alloc_dev() and into the bio-based specific init method. Reported-by: Stefan Bader BugLink: https://bugs.launchpad.net/bugs/1860231 Fixes: ff36ab34583a ("dm: remove request-based logic from make_request_fn wrapper") Depends-on: c12c9a3c3860c ("dm: various cleanups to md->queue initialization code") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit 55816dc1a50463ec0ea45954e87ec3dff70e2863 Merge: 6d277aca488f ca11abf11347 Author: Linus Torvalds Date: Mon Jan 27 11:48:47 2020 -0800 Merge tag 'acpi-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to the most recent upstream revision (20200110), add new hardware support to a handful of ACPI drivers, make the ACPI fan driver expose power states information for fans, add some more quirks, fix bugs and clean up assorted things. Specifics: - Update the ACPICA code in the kernel to upstream revision 20200110 including: - Update of copyright notices to 2020 (Bob Moore). - Dispatcher fix to always generate buffer objects for the ASL create_field() operator (Maximilian Luz). - Debugger cleanup (Colin Ian King). - Disassembler change to create buffer fields in ACPI_PARSE_LOAD_PASS1 (Erik Kaneda). - UNIX line ending support for non-windows builds in acpisrc (Erik Kaneda). - Update the list of ACPICA maintainers (Rafael Wysocki). - Add Intel Tiger Lake ACPI device IDs to the ACPI DPTF, ACPI fan, int340x_thermal and intel-hid drivers (Gayatri Kammela). - Make the ACPI fan driver create additional sysfs attributes to expose power states information for fans (Srinivas Pandruvada). - Fix up the ACPI battery driver to deal with unexpected battery capacity information in a better way (Hans de Goede). - Add ACPI backlight quirks for Lenovo E41-25/45 and MSI MS-7721 boards (Aaron Ma, Hans de Goede). - Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch to the ACPI button driver (Jason Ekstrand). - Drop TIMER_DEFERRABLE from the GHES polling mode timer function flags to make it run precisely at the configured time (Bhaskar Upadhaya). - Fix race condition related to the reference counting of query handlers in the ACPI EC driver (Rafael Wysocki). - Fix ACPI tools build issue (Zhengyuan Liu). - Replace dma_request_slave_channel() with dma_request_chan() in the firmware guide documentation for ACPI (Peter Ujfalusi). - Fix typo in a comment and clean up function parameter data type inconsistencies (Kacper Piwiński, Tian Tao)" * tag 'acpi-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (25 commits) ACPICA: Update version to 20200110 ACPICA: All acpica: Update copyrights to 2020 Including tool signons. apei/ghes: Do not delay GHES polling ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch ACPI: PPTT: Consistently use unsigned int as parameter type ACPI: EC: Reference count query handlers under lock ACPICA: Update the list of maintainers ACPICA: Update version to 20191213 ACPICA: Dispatcher: always generate buffer objects for ASL create_field() operator ACPICA: acpisrc: add unix line ending support for non-windows build ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 ACPICA: debugger: fix spelling mistake "adress" -> "address" ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards docs: firmware-guide: ACPI: Replace dma_request_slave_channel() with dma_request_chan() thermal: int340x_thermal: Add Tiger Lake ACPI device IDs platform/x86: intel-hid: Add Tiger Lake ACPI device ID ACPI: fan: Add Tiger Lake ACPI device ID ACPI: DPTF: Add Tiger Lake ACPI device IDs ACPI: fan: Expose fan performance state information tools/power/acpi: fix compilation error ... commit 6d277aca488fdf0a1e67cd14b5a58869f66197c9 Merge: aae1464f46a2 c102671af085 Author: Linus Torvalds Date: Mon Jan 27 11:23:54 2020 -0800 Merge tag 'pm-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add ACPI support to the intel_idle driver along with an admin guide document for it, add support for CPR (Core Power Reduction) to the AVS (Adaptive Voltage Scaling) subsystem, add new hardware support in a few places, add some new sysfs attributes, debugfs files and tracepoints, fix bugs and clean up a bunch of things all over. Specifics: - Update the ACPI processor driver in order to export acpi_processor_evaluate_cst() to the code outside of it, add ACPI support to the intel_idle driver based on that and clean up that driver somewhat (Rafael Wysocki). - Add an admin guide document for the intel_idle driver (Rafael Wysocki). - Clean up cpuidle core and drivers, enable compilation testing for some of them (Benjamin Gaignard, Krzysztof Kozlowski, Rafael Wysocki, Yangtao Li). - Fix reference counting of OPP (operating performance points) table structures (Viresh Kumar). - Add support for CPR (Core Power Reduction) to the AVS (Adaptive Voltage Scaling) subsystem (Niklas Cassel, Colin Ian King, YueHaibing). - Add support for TigerLake Mobile and JasperLake to the Intel RAPL power capping driver (Zhang Rui). - Update cpufreq drivers: - Add i.MX8MP support to imx-cpufreq-dt (Anson Huang). - Fix usage of a macro in loongson2_cpufreq (Alexandre Oliva). - Fix cpufreq policy reference counting issues in s3c and brcmstb-avs (chenqiwu). - Fix ACPI table reference counting issue and HiSilicon quirk handling in the CPPC driver (Hanjun Guo). - Clean up spelling mistake in intel_pstate (Harry Pan). - Convert the kirkwood and tegra186 drivers to using devm_platform_ioremap_resource() (Yangtao Li). - Update devfreq core: - Add 'name' sysfs attribute for devfreq devices (Chanwoo Choi). - Clean up the handing of transition statistics and allow them to be reset by writing 0 to the 'trans_stat' devfreq device attribute in sysfs (Kamil Konieczny). - Add 'devfreq_summary' to debugfs (Chanwoo Choi). - Clean up kerneldoc comments and Kconfig indentation (Krzysztof Kozlowski, Randy Dunlap). - Update devfreq drivers: - Add dynamic scaling for the imx8m DDR controller and clean up imx8m-ddrc (Leonard Crestez, YueHaibing). - Fix DT node reference counting and nitialization error code path in rk3399_dmc and add COMPILE_TEST and HAVE_ARM_SMCCC dependency for it (Chanwoo Choi, Yangtao Li). - Fix DT node reference counting in rockchip-dfi and make it use devm_platform_ioremap_resource() (Yangtao Li). - Fix excessive stack usage in exynos-ppmu (Arnd Bergmann). - Fix initialization error code paths in exynos-bus (Yangtao Li). - Clean up exynos-bus and exynos somewhat (Artur Świgoń, Krzysztof Kozlowski). - Add tracepoints for tracking usage_count updates unrelated to status changes in PM-runtime (Michał Mirosław). - Add sysfs attribute to control the "sync on suspend" behavior during system-wide suspend (Jonas Meurer). - Switch system-wide suspend tests over to 64-bit time (Alexandre Belloni). - Make wakeup sources statistics in debugfs cover deleted ones which used to be the case some time ago (zhuguangqing). - Clean up computations carried out during hibernation, update messages related to hibernation and fix a spelling mistake in one of them (Wen Yang, Luigi Semenzato, Colin Ian King). - Add mailmap entry for maintainer e-mail address that has not been functional for several years (Rafael Wysocki)" * tag 'pm-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (83 commits) cpufreq: loongson2_cpufreq: adjust cpufreq uses of LOONGSON_CHIPCFG intel_idle: Clean up irtl_2_usec() intel_idle: Move 3 functions closer to their callers intel_idle: Annotate initialization code and data structures intel_idle: Move and clean up intel_idle_cpuidle_devices_uninit() intel_idle: Rearrange intel_idle_cpuidle_driver_init() intel_idle: Clean up NULL pointer check in intel_idle_init() intel_idle: Fold intel_idle_probe() into intel_idle_init() intel_idle: Eliminate __setup_broadcast_timer() cpuidle: fix cpuidle_find_deepest_state() kerneldoc warnings cpuidle: sysfs: fix warnings when compiling with W=1 cpuidle: coupled: fix warnings when compiling with W=1 cpufreq: brcmstb-avs: fix imbalance of cpufreq policy refcount PM: suspend: Add sysfs attribute to control the "sync on suspend" behavior PM / devfreq: Add debugfs support with devfreq_summary file Documentation: admin-guide: PM: Add intel_idle document cpuidle: arm: Enable compile testing for some of drivers PM-runtime: add tracepoints for usage_count changes cpufreq: intel_pstate: fix spelling mistake: "Whethet" -> "Whether" PM: hibernate: fix spelling mistake "shapshot" -> "snapshot" ... commit 10c2d111c906599942efd13109061885631c4a0c Author: Alex Shi Date: Tue Jan 21 16:50:03 2020 +0800 security: remove EARLY_LSM_COUNT which never used This macro is never used from it was introduced in commit e6b1db98cf4d5 ("security: Support early LSMs"), better to remove it. Signed-off-by: Alex Shi Acked-by: Serge Hallyn Signed-off-by: James Morris commit aae1464f46a2403565f75717438118691d31ccf1 Merge: 1e1ab4ba4747 e4e4c2ff78ed Author: Linus Torvalds Date: Mon Jan 27 11:18:55 2020 -0800 Merge tag 'regulator-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "Hardly anything going on in the core this time around with the regulator API and pretty quiet on the driver front: - An API for comparing regulators, useful for devices that need to check if supply voltages exactly match rather than just nominally match. - Conversion of several DT bindings to YAML format. - Conversion of I2C drivers to probe_new(). - New drivers for Monolithic MPQ7920 and MP8859, and Rohm BD71828" * tag 'regulator-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (34 commits) dt-bindings: regulator: add document bindings for mpq7920 regulator: core: Fix exported symbols to the exported GPL version regulator: mpq7920: Fix incorrect defines regulator: vqmmc-ipq4019: Fix platform_no_drv_owner.cocci warnings regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage regulator fix for "regulator: core: Add regulator_is_equal() helper" regulator: core: Add regulator_is_equal() helper regulator: mpq7920: Convert to use .probe_new regulator: mpq7920: Remove unneeded fields from struct mpq7920_regulator_info regulator: vqmmc-ipq4019: Trivial clean up regulator: vqmmc-ipq4019: Remove ipq4019_regulator_remove regulator: bindings: Drop document bindings for mpq7920 dt-bindings: Drop entry for Monolithic Power System, MPS regulator: bd718x7: Simplify the code by removing struct bd718xx_pmic_inits regulator: add IPQ4019 SDHCI VQMMC LDO driver regulator: Convert i2c drivers to use .probe_new regulator: mpq7920: Check the correct variable in mpq7920_regulator_register() regulator: mpq7920: Fix Woverflow warning on conversion regulator: mp8859: tidy up white space in probe regulator: mpq7920: add mpq7920 regulator driver ... commit 1e1ab4ba4747afad3e44a77dded1bab4cb77049e Merge: e83a0ed2a6a3 754a36a58c29 Author: Linus Torvalds Date: Mon Jan 27 11:15:34 2020 -0800 Merge tag 'spi-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "Not much going on in the core for SPI this time but a reasonable amount of change in the drivers: - Removal of dmal_request_slave_channel() from Peter Ujfalusi. - More conversions of drivers to GPIO descriptors from Linus Walleij. - A big rework of the sh-msiof driver from Geert Uytterhoeven moving it over to the generic native chipselect support. - DMA support for the uniphier driver from Kunihiko Hayashi. - New driver support for HiSilcon v3xx SPI NOR controllers from John Garry" * tag 'spi-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (52 commits) dt-binding: spi: add NPCM PSPI reset binding spi: pxa2xx: Avoid touching SSCR0_SSE on MMP2 spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations spi: npcm-pspi: modify reset support spi: npcm-pspi: improve spi transfer performance spi: spi-ti-qspi: fix warning spi: npcm-pspi: fix 16 bit send and receive support spi: pxa2xx: Add support for Intel Comet Lake PCH-V spi: fsl: simplify error path in of_fsl_spi_probe() spi: fsl-lpspi: fix only one cs-gpio working spi: spi-ti-qspi: optimize byte-transfers spi: spi-ti-qspi: support large flash devices spi: spi-qcom-qspi: Use device managed memory for clk_bulk_data MAINTAINERS: Add a maintainer for the HiSilicon v3xx SFC driver spi: Add HiSilicon v3xx SPI NOR flash controller driver dt-bindings: spi_atmel: add microchip,sam9x60-spi spi: bcm2835: Raise maximum number of slaves to 4 spi: sh-msiof: Do not redefine STR while compile testing spi: rspi: Add support for GPIO chip selects spi: rspi: Add support for multiple native chip selects ... commit e83a0ed2a6a3f6e67630d1580f1ade97a54c524f Merge: a5b871c91d47 ea87683909bc Author: Linus Torvalds Date: Mon Jan 27 11:13:02 2020 -0800 Merge tag 'regmap-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This is quite a busy release for a subsystem that's usually very quiet, though still a small set of updates in the grand scheme of things: - A fix for writes to non-incrementing registers. - An iopoll() style helper for use with atomic safe regmaps, making it easier to transition from raw memory mapped I/O. - Some constification" * tag 'regmap-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: fix writes to non incrementing registers regmap: add iopoll-like atomic polling macro regmap-i2c: constify regmap_bus structures commit 185dfe32d7e27b2cbf56c441160f4b8407eed055 Merge: e42617b825f8 41a1f096e94c Author: Stephen Boyd Date: Mon Jan 27 11:00:24 2020 -0800 Merge tag 'for-5.6-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into clk-nvidia Pull Nvidia Tegra clk driver updates from Thierry Reding * tag 'for-5.6-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: clk: tegra20/30: Explicitly set parent clock for Video Decoder clk: tegra20/30: Don't pre-initialize displays parent clock clk: tegra: divider: Check UART's divider enable-bit state on rate's recalculation clk: tegra: clk-dfll: Remove call to pm_runtime_irq_safe() clk: tegra: Mark fuse clock as critical commit 3009afc6e39e78708d8fb444ae50544b3bcd3a3f Author: Sean Christopherson Date: Tue Jan 21 20:43:39 2020 -0800 KVM: x86: Use a typedef for fastop functions Add a typedef to for the fastop function prototype to make the code more readable. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 52db369823b28616377b8ceb6b6b3879735b9e75 Author: Miaohe Lin Date: Wed Jan 22 11:21:44 2020 +0800 KVM: X86: Add 'else' to unify fastop and execute call path It also helps eliminate some duplicated code. Signed-off-by: Miaohe Lin Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 91b0d268a59dd9c18221ea750b80f9a317b29ed2 Author: Paolo Bonzini Date: Tue Jan 21 16:16:32 2020 +0100 KVM: x86: inline memslot_valid_for_gpte The function now has a single caller, so there is no point in keeping it separate. Signed-off-by: Paolo Bonzini commit e851265a816f96a86c5a0316d2fc4d45be76d1d4 Author: Sean Christopherson Date: Wed Jan 8 12:24:48 2020 -0800 KVM: x86/mmu: Use huge pages for DAX-backed files Walk the host page tables to identify hugepage mappings for ZONE_DEVICE pfns, i.e. DAX pages. Explicitly query kvm_is_zone_device_pfn() when deciding whether or not to bother walking the host page tables, as DAX pages do not set up the head/tail infrastructure, i.e. will return false for PageCompound() even when using huge pages. Zap ZONE_DEVICE sptes when disabling dirty logging, e.g. if live migration fails, to allow KVM to rebuild large pages for DAX-based mappings. Presumably DAX favors large pages, and worst case scenario is a minor performance hit as KVM will need to re-fault all DAX-based pages. Suggested-by: Barret Rhoden Cc: David Hildenbrand Cc: Dan Williams Cc: Jason Zeng Cc: Dave Jiang Cc: Liran Alon Cc: linux-nvdimm Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 2c0629f4b95cf5adf5b6f78f7d318df894b5f9a1 Author: Sean Christopherson Date: Wed Jan 8 12:24:47 2020 -0800 KVM: x86/mmu: Remove lpage_is_disallowed() check from set_spte() Remove the late "lpage is disallowed" check from set_spte() now that the initial check is performed after acquiring mmu_lock. Fold the guts of the remaining helper, __mmu_gfn_lpage_is_disallowed(), into kvm_mmu_hugepage_adjust() to eliminate the unnecessary slot !NULL check. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 293e306e7faac4eafaefb9518a1cd6eaecad88e9 Author: Sean Christopherson Date: Wed Jan 8 12:24:46 2020 -0800 KVM: x86/mmu: Fold max_mapping_level() into kvm_mmu_hugepage_adjust() Fold max_mapping_level() into kvm_mmu_hugepage_adjust() now that HugeTLB mappings are handled in kvm_mmu_hugepage_adjust(), i.e. there isn't a need to pre-calculate the max mapping level. Co-locating all hugepage checks eliminates a memslot lookup, at the cost of performing the __mmu_gfn_lpage_is_disallowed() checks while holding mmu_lock. The latency of lpage_is_disallowed() is likely negligible relative to the rest of the code run while holding mmu_lock, and can be offset to some extent by eliminating the mmu_gfn_lpage_is_disallowed() check in set_spte() in a future patch. Eliminating the check in set_spte() is made possible by performing the initial lpage_is_disallowed() checks while holding mmu_lock. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d32ec81bab670e599e645e1d1d5231d62de7d0d6 Author: Sean Christopherson Date: Wed Jan 8 12:24:45 2020 -0800 KVM: x86/mmu: Zap any compound page when collapsing sptes Zap any compound page, e.g. THP or HugeTLB pages, when zapping sptes that can potentially be converted to huge sptes after disabling dirty logging on the associated memslot. Note, this approach could result in false positives, e.g. if a random compound page is mapped into the guest, but mapping non-huge compound pages into the guest is far from the norm, and toggling dirty logging is not a frequent operation. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 09c4453ee8e63a710774ae10da7909289aa6a58e Author: Sean Christopherson Date: Wed Jan 8 12:24:44 2020 -0800 KVM: x86/mmu: Remove obsolete gfn restoration in FNAME(fetch) Remove logic to retrieve the original gfn now that HugeTLB mappings are are identified in FNAME(fetch), i.e. FNAME(page_fault) no longer adjusts the level or gfn. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 83f06fa7a6fd9d5758e5f8438e2137f25f6f2e6b Author: Sean Christopherson Date: Wed Jan 8 12:24:43 2020 -0800 KVM: x86/mmu: Rely on host page tables to find HugeTLB mappings Remove KVM's HugeTLB specific logic and instead rely on walking the host page tables (already done for THP) to identify HugeTLB mappings. Eliminating the HugeTLB-only logic avoids taking mmap_sem and calling find_vma() for all hugepage compatible page faults, and simplifies KVM's page fault code by consolidating all hugepage adjustments into a common helper. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit f9fa2509e5ca8229b4baca295865b542803bf25d Author: Sean Christopherson Date: Wed Jan 8 12:24:42 2020 -0800 KVM: x86/mmu: Drop level optimization from fast_page_fault() Remove fast_page_fault()'s optimization to stop the shadow walk if the iterator level drops below the intended map level. The intended map level is only acccurate for HugeTLB mappings (THP mappings are detected after fast_page_fault()), i.e. it's not required for correctness, and a future patch will also move HugeTLB mapping detection to after fast_page_fault(). Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit db5432165e9b51d2a36572be38d078e79f8df0d8 Author: Sean Christopherson Date: Wed Jan 8 12:24:41 2020 -0800 KVM: x86/mmu: Walk host page tables to find THP mappings Explicitly walk the host page tables to identify THP mappings instead of relying solely on the metadata in struct page. This sets the stage for using a common method of identifying huge mappings regardless of the underlying implementation (HugeTLB vs THB vs DAX), and hopefully avoids the pitfalls of relying on metadata to identify THP mappings, e.g. see commit 169226f7e0d2 ("mm: thp: handle page cache THP correctly in PageTransCompoundMap") and the need for KVM to explicitly check for a THP compound page. KVM will also naturally work with 1gb THP pages, if they are ever supported. Walking the tables for THP mappings is likely marginally slower than querying metadata, but a future patch will reuse the walk to identify HugeTLB mappings, at which point eliminating the existing VMA lookup for HugeTLB will make this a net positive. Cc: Andrea Arcangeli Cc: Barret Rhoden Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 17eff01904f5f2fa12f4a56666637ce69ce5c645 Author: Sean Christopherson Date: Wed Jan 8 12:24:40 2020 -0800 KVM: x86/mmu: Refactor THP adjust to prep for changing query Refactor transparent_hugepage_adjust() in preparation for walking the host page tables to identify hugepage mappings, initially for THP pages, and eventualy for HugeTLB and DAX-backed pages as well. The latter cases support 1gb pages, i.e. the adjustment logic needs access to the max allowed level. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 13c72c060f1ba6f4eddd7b1c4f52a8aded43d6d9 Author: Sean Christopherson Date: Wed Jan 8 12:24:39 2020 -0800 x86/mm: Introduce lookup_address_in_mm() Add a helper, lookup_address_in_mm(), to traverse the page tables of a given mm struct. KVM will use the helper to retrieve the host mapping level, e.g. 4k vs. 2mb vs. 1gb, of a compound (or DAX-backed) page without having to resort to implementation specific metadata. E.g. KVM currently uses different logic for HugeTLB vs. THP, and would add a third variant for DAX-backed files. Cc: Dan Williams Signed-off-by: Sean Christopherson Reviewed-by: Thomas Gleixner Signed-off-by: Paolo Bonzini commit 42cde48b2d39772dba47e680781a32a6c4b7dc33 Author: Sean Christopherson Date: Wed Jan 8 12:24:38 2020 -0800 KVM: Play nice with read-only memslots when querying host page size Avoid the "writable" check in __gfn_to_hva_many(), which will always fail on read-only memslots due to gfn_to_hva() assuming writes. Functionally, this allows x86 to create large mappings for read-only memslots that are backed by HugeTLB mappings. Note, the changelog for commit 05da45583de9 ("KVM: MMU: large page support") states "If the largepage contains write-protected pages, a large pte is not used.", but "write-protected" refers to pages that are temporarily read-only, e.g. read-only memslots didn't even exist at the time. Fixes: 4d8b81abc47b ("KVM: introduce readonly memslot") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson [Redone using kvm_vcpu_gfn_to_memslot_prot. - Paolo] Signed-off-by: Paolo Bonzini commit f9b84e19221efc5f493156ee0329df3142085f28 Author: Sean Christopherson Date: Wed Jan 8 12:24:37 2020 -0800 KVM: Use vcpu-specific gva->hva translation when querying host page size Use kvm_vcpu_gfn_to_hva() when retrieving the host page size so that the correct set of memslots is used when handling x86 page faults in SMM. Fixes: 54bf36aac520 ("KVM: x86: use vcpu-specific functions to read/write/translate GFNs") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 005ba37cb89bcc0cf63c2029a41f8db165aeb615 Author: Sean Christopherson Date: Wed Jan 8 12:24:36 2020 -0800 mm: thp: KVM: Explicitly check for THP when populating secondary MMU Add a helper, is_transparent_hugepage(), to explicitly check whether a compound page is a THP and use it when populating KVM's secondary MMU. The explicit check fixes a bug where a remapped compound page, e.g. for an XDP Rx socket, is mapped into a KVM guest and is mistaken for a THP, which results in KVM incorrectly creating a huge page in its secondary MMU. Fixes: 936a5fe6e6148 ("thp: kvm mmu transparent hugepage support") Reported-by: syzbot+c9d1fb51ac9d0d10c39d@syzkaller.appspotmail.com Cc: Andrea Arcangeli Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 22b1d57b032cea4d612746473ed28cb20665d876 Author: Sean Christopherson Date: Wed Jan 8 12:24:35 2020 -0800 KVM: x86/mmu: Enforce max_level on HugeTLB mappings Limit KVM's mapping level for HugeTLB based on its calculated max_level. The max_level check prior to invoking host_mapping_level() only filters out the case where KVM cannot create a 2mb mapping, it doesn't handle the scenario where KVM can create a 2mb but not 1gb mapping, and the host is using a 1gb HugeTLB mapping. Fixes: 2f57b7051fe8 ("KVM: x86/mmu: Persist gfn_lpage_is_disallowed() to max_level") Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit dc9ce71e66b84497c375c529d818d8e8d0d793a9 Author: Sean Christopherson Date: Thu Jan 9 15:56:20 2020 -0800 KVM: Return immediately if __kvm_gfn_to_hva_cache_init() fails Check the result of __kvm_gfn_to_hva_cache_init() and return immediately instead of relying on the kvm_is_error_hva() check to detect errors so that it's abundantly clear KVM intends to immediately bail on an error. Note, the hva check is still mandatory to handle errors on subqeuesnt calls with the same generation. Similarly, always return -EFAULT on error so that multiple (bad) calls for a given generation will get the same result, e.g. on an illegal gfn wrap, propagating the return from __kvm_gfn_to_hva_cache_init() would cause the initial call to return -EINVAL and subsequent calls to return -EFAULT. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 6ad1e29fe0aba843dfffc714fced0ef6a2e19502 Author: Sean Christopherson Date: Thu Jan 9 14:58:55 2020 -0500 KVM: Clean up __kvm_gfn_to_hva_cache_init() and its callers Barret reported a (technically benign) bug where nr_pages_avail can be accessed without being initialized if gfn_to_hva_many() fails. virt/kvm/kvm_main.c:2193:13: warning: 'nr_pages_avail' may be used uninitialized in this function [-Wmaybe-uninitialized] Rather than simply squashing the warning by initializing nr_pages_avail, fix the underlying issues by reworking __kvm_gfn_to_hva_cache_init() to return immediately instead of continuing on. Now that all callers check the result and/or bail immediately on a bad hva, there's no need to explicitly nullify the memslot on error. Reported-by: Barret Rhoden Fixes: f1b9dd5eb86c ("kvm: Disallow wraparound in kvm_gfn_to_hva_cache_init") Cc: Jim Mattson Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit fcfbc617547fc6d9552cb6c1c563b6a90ee98085 Author: Sean Christopherson Date: Thu Jan 9 15:56:18 2020 -0800 KVM: Check for a bad hva before dropping into the ghc slow path When reading/writing using the guest/host cache, check for a bad hva before checking for a NULL memslot, which triggers the slow path for handing cross-page accesses. Because the memslot is nullified on error by __kvm_gfn_to_hva_cache_init(), if the bad hva is encountered after crossing into a new page, then the kvm_{read,write}_guest() slow path could potentially write/access the first chunk prior to detecting the bad hva. Arguably, performing a partial access is semantically correct from an architectural perspective, but that behavior is certainly not intended. In the original implementation, memslot was not explicitly nullified and therefore the partial access behavior varied based on whether the memslot itself was null, or if the hva was simply bad. The current behavior was introduced as a seemingly unintentional side effect in commit f1b9dd5eb86c ("kvm: Disallow wraparound in kvm_gfn_to_hva_cache_init"), which justified the change with "since some callers don't check the return code from this function, it sit seems prudent to clear ghc->memslot in the event of an error". Regardless of intent, the partial access is dependent on _not_ checking the result of the cache initialization, which is arguably a bug in its own right, at best simply weird. Fixes: 8f964525a121 ("KVM: Allow cross page reads and writes from cached translations.") Cc: Jim Mattson Cc: Andrew Honig Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 4d6d07aee8343eac68ebde9389ba829c8c17dfc7 Author: Peng Hao Date: Wed Nov 27 08:30:25 2019 +0800 kvm/x86: export kvm_vector_hashing_enabled() is unnecessary kvm_vector_hashing_enabled() is just called in kvm.ko module. Signed-off-by: Peng Hao Signed-off-by: Paolo Bonzini commit cef6db76f3165ac01ea49e023dea17002ee91618 Author: Miaohe Lin Date: Tue Jan 21 10:15:18 2020 -0500 KVM: VMX: remove duplicated segment cache clear vmx_set_segment() clears segment cache unconditionally, so we should not clear it again by calling vmx_segment_cache_clear(). Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 17ac43a894ed3dd237d6def00c5ec2c7d975567e Author: Haiwei Li Date: Thu Jan 16 16:50:21 2020 +0800 Adding 'else' to reduce checking. These two conditions are in conflict, adding 'else' to reduce checking. Signed-off-by: Haiwei Li Reviewed-by: Vitaly Kuznetsov Reviewed-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit b91991bf6b707482953c094dbd9615f6382ba2cb Author: Krish Sadhukhan Date: Wed Jan 15 19:54:32 2020 -0500 KVM: nVMX: Check GUEST_DR7 on vmentry of nested guests According to section "Checks on Guest Control Registers, Debug Registers, and and MSRs" in Intel SDM vol 3C, the following checks are performed on vmentry of nested guests: If the "load debug controls" VM-entry control is 1, bits 63:32 in the DR7 field must be 0. In KVM, GUEST_DR7 is set prior to the vmcs02 VM-entry by kvm_set_dr() and the latter synthesizes a #GP if any bit in the high dword in the former is set. Hence this field needs to be checked in software. Signed-off-by: Krish Sadhukhan Reviewed-by: Karl Heubaum Signed-off-by: Paolo Bonzini commit e174bb94831e792a50877754c78c1f340543bb64 Author: Alex Shi Date: Thu Jan 16 11:32:39 2020 +0800 KVM: remove unused guest_enter After commit 61bd0f66ff92 ("KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN"), no one use this function anymore, So better to remove it. Signed-off-by: Alex Shi Cc: Paolo Bonzini Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Frederic Weisbecker Cc: linux-kernel@vger.kernel.org Signed-off-by: Paolo Bonzini commit 7495e22bb165e7030bae4d9c6e84addb5ea17b29 Author: Paolo Bonzini Date: Thu Jan 9 09:57:19 2020 -0500 KVM: Move running VCPU from ARM to common code For ring-based dirty log tracking, it will be more efficient to account writes during schedule-out or schedule-in to the currently running VCPU. We would like to do it even if the write doesn't use the current VCPU's address space, as is the case for cached writes (see commit 4e335d9e7ddb, "Revert "KVM: Support vCPU-based gfn->hva cache"", 2017-05-02). Therefore, add a mechanism to track the currently-loaded kvm_vcpu struct. There is already something similar in KVM/ARM; one important difference is that kvm_arch_vcpu_{load,put} have two callers in virt/kvm/kvm_main.c: we have to update both the architecture-independent vcpu_{load,put} and the preempt notifiers. Another change made in the process is to allow using kvm_get_running_vcpu() in preemptible code. This is allowed because preempt notifiers ensure that the value does not change even after the VCPU thread is migrated. Signed-off-by: Paolo Bonzini Reviewed-by: Paolo Bonzini Signed-off-by: Peter Xu Signed-off-by: Paolo Bonzini commit 6a3c623ba8a842f895e80a7fa0feb94b7b4368f2 Author: Peter Xu Date: Thu Jan 9 09:57:16 2020 -0500 KVM: X86: Drop x86_set_memory_region() The helper x86_set_memory_region() is only used in vmx_set_tss_addr() and kvm_arch_destroy_vm(). Push the lock upper in both cases. With that, drop x86_set_memory_region(). This prepares to allow __x86_set_memory_region() to return a HVA mapped, because the HVA will need to be protected by the lock too even after __x86_set_memory_region() returns. Signed-off-by: Peter Xu Signed-off-by: Paolo Bonzini commit 2a5755bb21ee2f6567ce3eb2af10e8948df047d6 Author: Peter Xu Date: Thu Jan 9 09:57:14 2020 -0500 KVM: X86: Don't take srcu lock in init_rmode_identity_map() We've already got the slots_lock, so we should be safe. Signed-off-by: Peter Xu Signed-off-by: Paolo Bonzini commit fcd97ad58f76efcd58808941e4dd2bc6c544b9de Author: Peter Xu Date: Thu Jan 9 09:57:12 2020 -0500 KVM: Add build-time error check on kvm_run size It's already going to reach 2400 Bytes (which is over half of page size on 4K page archs), so maybe it's good to have this build-time check in case it overflows when adding new fields. Signed-off-by: Peter Xu Signed-off-by: Paolo Bonzini commit ef82eddc0e3179b4529a67ed102fe4f7efba2e65 Author: Peter Xu Date: Thu Jan 9 09:57:11 2020 -0500 KVM: Remove kvm_read_guest_atomic() Remove kvm_read_guest_atomic() because it's not used anywhere. Signed-off-by: Peter Xu Signed-off-by: Paolo Bonzini commit de9bf4d4cea369355440c5afbbbc7e62302de8fd Author: Vitaly Kuznetsov Date: Wed Jan 15 18:10:12 2020 +0100 x86/kvm/hyper-v: remove stale evmcs_already_enabled check from nested_enable_evmcs() In nested_enable_evmcs() evmcs_already_enabled check doesn't really do anything: controls are already sanitized and we return '0' regardless. Just drop the check. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit de761ea792c8344b7170624dbbcba4d730e23897 Author: Sean Christopherson Date: Wed Jan 15 10:36:05 2020 -0800 KVM: x86: Perform non-canonical checks in 32-bit KVM Remove the CONFIG_X86_64 condition from the low level non-canonical helpers to effectively enable non-canonical checks on 32-bit KVM. Non-canonical checks are performed by hardware if the CPU *supports* 64-bit mode, whether or not the CPU is actually in 64-bit mode is irrelevant. For the most part, skipping non-canonical checks on 32-bit KVM is ok-ish because 32-bit KVM always (hopefully) drops bits 63:32 of whatever value it's checking before propagating it to hardware, and architecturally, the expected behavior for the guest is a bit of a grey area since the vCPU itself doesn't support 64-bit mode. I.e. a 32-bit KVM guest can observe the missed checks in several paths, e.g. INVVPID and VM-Enter, but it's debatable whether or not the missed checks constitute a bug because technically the vCPU doesn't support 64-bit mode. The primary motivation for enabling the non-canonical checks is defense in depth. As mentioned above, a guest can trigger a missed check via INVVPID or VM-Enter. INVVPID is straightforward as it takes a 64-bit virtual address as part of its 128-bit INVVPID descriptor and fails if the address is non-canonical, even if INVVPID is executed in 32-bit PM. Nested VM-Enter is a bit more convoluted as it requires the guest to write natural width VMCS fields via memory accesses and then VMPTRLD the VMCS, but it's still possible. In both cases, KVM is saved from a true bug only because its flows that propagate values to hardware (correctly) take "unsigned long" parameters and so drop bits 63:32 of the bad value. Explicitly performing the non-canonical checks makes it less likely that a bad value will be propagated to hardware, e.g. in the INVVPID case, if __invvpid() didn't implicitly drop bits 63:32 then KVM would BUG() on the resulting unexpected INVVPID failure due to hardware rejecting the non-canonical address. The only downside to enabling the non-canonical checks is that it adds a relatively small amount of overhead, but the affected flows are not hot paths, i.e. the overhead is negligible. Note, KVM technically could gate the non-canonical checks on 32-bit KVM with static_cpu_has(X86_FEATURE_LM), but on bare metal that's an even bigger waste of code for everyone except the 0.00000000000001% of the population running on Yonah, and nested 32-bit on 64-bit already fudges things with respect to 64-bit CPU behavior. Signed-off-by: Sean Christopherson [Also do so in nested_vmx_check_host_state as reported by Krish. - Paolo] Signed-off-by: Paolo Bonzini commit d196842150e046a523f75785438137a9243c9627 Author: Oliver Upton Date: Fri Dec 13 16:33:58 2019 -0800 KVM: nVMX: WARN on failure to set IA32_PERF_GLOBAL_CTRL Writes to MSR_CORE_PERF_GLOBAL_CONTROL should never fail if the VM-exit and VM-entry controls are exposed to L1. Promote the checks to perform a full WARN if kvm_set_msr() fails and remove the now unused macro SET_MSR_OR_WARN(). Suggested-by: Sean Christopherson Cc: Paolo Bonzini Signed-off-by: Oliver Upton Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit c0a21c3f9d9b21a4bd67a46d96eaeb372b0daf20 Author: Sean Christopherson Date: Fri Jan 17 11:30:52 2020 -0800 KVM: x86: Remove unused ctxt param from emulator's FPU accessors Remove an unused struct x86_emulate_ctxt * param from low level helpers used to access guest FPU state. The unused param was left behind by commit 6ab0b9feb82a ("x86,kvm: remove KVM emulator get_fpu / put_fpu"). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 2620fe268e80d667a94553cd37a94ccaa2cb8c83 Author: Sean Christopherson Date: Fri Jan 17 11:30:51 2020 -0800 KVM: x86: Revert "KVM: X86: Fix fpu state crash in kvm guest" Reload the current thread's FPU state, which contains the guest's FPU state, to the CPU registers if necessary during vcpu_enter_guest(). TIF_NEED_FPU_LOAD can be set any time control is transferred out of KVM, e.g. if I/O is triggered during a KVM call to get_user_pages() or if a softirq occurs while KVM is scheduled in. Moving the handling of TIF_NEED_FPU_LOAD from vcpu_enter_guest() to kvm_arch_vcpu_load(), effectively kvm_sched_in(), papered over a bug where kvm_put_guest_fpu() failed to account for TIF_NEED_FPU_LOAD. The easiest way to the kvm_put_guest_fpu() bug was to run with involuntary preemption enable, thus handling TIF_NEED_FPU_LOAD during kvm_sched_in() made the bug go away. But, removing the handling in vcpu_enter_guest() exposed KVM to the rare case of a softirq triggering kernel_fpu_begin() between vcpu_load() and vcpu_enter_guest(). Now that kvm_{load,put}_guest_fpu() correctly handle TIF_NEED_FPU_LOAD, revert the commit to both restore the vcpu_enter_guest() behavior and eliminate the superfluous switch_fpu_return() in kvm_arch_vcpu_load(). Note, leaving the handling in kvm_arch_vcpu_load() isn't wrong per se, but it is unnecessary, and most critically, makes it extremely difficult to find bugs such as the kvm_put_guest_fpu() issue due to shrinking the window where a softirq can corrupt state. A sample trace triggered by warning if TIF_NEED_FPU_LOAD is set while vcpu state is loaded: gcmaes_crypt_by_sg.constprop.12+0x26e/0x660 ? 0xffffffffc024547d ? __qdisc_run+0x83/0x510 ? __dev_queue_xmit+0x45e/0x990 ? ip_finish_output2+0x1a8/0x570 ? fib4_rule_action+0x61/0x70 ? fib4_rule_action+0x70/0x70 ? fib_rules_lookup+0x13f/0x1c0 ? helper_rfc4106_decrypt+0x82/0xa0 ? crypto_aead_decrypt+0x40/0x70 ? crypto_aead_decrypt+0x40/0x70 ? crypto_aead_decrypt+0x40/0x70 ? esp_output_tail+0x8f4/0xa5a [esp4] ? skb_ext_add+0xd3/0x170 ? xfrm_input+0x7a6/0x12c0 ? xfrm4_rcv_encap+0xae/0xd0 ? xfrm4_transport_finish+0x200/0x200 ? udp_queue_rcv_one_skb+0x1ba/0x460 ? udp_unicast_rcv_skb.isra.63+0x72/0x90 ? __udp4_lib_rcv+0x51b/0xb00 ? ip_protocol_deliver_rcu+0xd2/0x1c0 ? ip_local_deliver_finish+0x44/0x50 ? ip_local_deliver+0xe0/0xf0 ? ip_protocol_deliver_rcu+0x1c0/0x1c0 ? ip_rcv+0xbc/0xd0 ? ip_rcv_finish_core.isra.19+0x380/0x380 ? __netif_receive_skb_one_core+0x7e/0x90 ? netif_receive_skb_internal+0x3d/0xb0 ? napi_gro_receive+0xed/0x150 ? 0xffffffffc0243c77 ? net_rx_action+0x149/0x3b0 ? __do_softirq+0xe4/0x2f8 ? handle_irq_event_percpu+0x6a/0x80 ? irq_exit+0xe6/0xf0 ? do_IRQ+0x7f/0xd0 ? common_interrupt+0xf/0xf ? irq_entries_start+0x20/0x660 ? vmx_get_interrupt_shadow+0x2f0/0x710 [kvm_intel] ? kvm_set_msr_common+0xfc7/0x2380 [kvm] ? recalibrate_cpu_khz+0x10/0x10 ? ktime_get+0x3a/0xa0 ? kvm_arch_vcpu_ioctl_run+0x107/0x560 [kvm] ? kvm_init+0x6bf/0xd00 [kvm] ? __seccomp_filter+0x7a/0x680 ? do_vfs_ioctl+0xa4/0x630 ? security_file_ioctl+0x32/0x50 ? ksys_ioctl+0x60/0x90 ? __x64_sys_ioctl+0x16/0x20 ? do_syscall_64+0x5f/0x1a0 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 ---[ end trace 9564a1ccad733a90 ]--- This reverts commit e751732486eb3f159089a64d1901992b1357e7cc. Fixes: e751732486eb3 ("KVM: X86: Fix fpu state crash in kvm guest") Reported-by: Derek Yerger Reported-by: kernel@najdan.com Cc: Wanpeng Li Cc: Thomas Lambertz Cc: Rik van Riel Cc: Sebastian Andrzej Siewior Cc: Borislav Petkov Cc: Dave Hansen Cc: Thomas Gleixner Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a7baead7e312f5a05381d68585fb6dc68e19e90f Author: Sean Christopherson Date: Fri Jan 17 11:30:50 2020 -0800 KVM: x86: Ensure guest's FPU state is loaded when accessing for emulation Lock the FPU regs and reload the current thread's FPU state, which holds the guest's FPU state, to the CPU registers if necessary prior to accessing guest FPU state as part of emulation. kernel_fpu_begin() can be called from softirq context, therefore KVM must ensure softirqs are disabled (locking the FPU regs disables softirqs) when touching CPU FPU state. Note, for all intents and purposes this reverts commit 6ab0b9feb82a7 ("x86,kvm: remove KVM emulator get_fpu / put_fpu"), but at the time it was applied, removing get/put_fpu() was correct. The re-introduction of {get,put}_fpu() is necessitated by the deferring of FPU state load. Fixes: 5f409e20b7945 ("x86/fpu: Defer FPU state load until return to userspace") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit c9aef3b85f425d1f6635382ec210ee5a7ef55d7d Author: Sean Christopherson Date: Fri Jan 17 11:30:49 2020 -0800 KVM: x86: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu() Handle TIF_NEED_FPU_LOAD similar to how fpu__copy() handles the flag when duplicating FPU state to a new task struct. TIF_NEED_FPU_LOAD can be set any time control is transferred out of KVM, be it voluntarily, e.g. if I/O is triggered during a KVM call to get_user_pages, or involuntarily, e.g. if softirq runs after an IRQ occurs. Therefore, KVM must account for TIF_NEED_FPU_LOAD whenever it is (potentially) accessing CPU FPU state. Fixes: 5f409e20b7945 ("x86/fpu: Defer FPU state load until return to userspace") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 3911b65ee1d3e3fc5e3786b1f309dcad0e33f7fd Author: Paolo Bonzini Date: Sat Jan 18 22:29:46 2020 +0100 Revert "KVM: x86: Add a WARN on TIF_NEED_FPU_LOAD in kvm_load_guest_fpu()" This reverts commit 95145c25a78cc0a9d3cbc75708abde432310c5a1. The next few patches will fix the issue so the warning is not needed anymore; revert it separately to simplify application to stable kernels. Signed-off-by: Paolo Bonzini commit 3ce4dc17e0c1e7280d53abeb85ce851a88868c63 Author: Miaohe Lin Date: Sat Jan 18 10:50:37 2020 +0800 KVM: apic: short-circuit kvm_apic_accept_pic_intr() when pic intr is accepted Short-circuit kvm_apic_accept_pic_intr() when pic intr is accepted, there is no need to proceed further. Also remove unnecessary var r. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 767b839afa5d62ba9cf859f4e90fef3d4a1780b5 Author: Miaohe Lin Date: Sat Jan 18 10:41:55 2020 +0800 KVM: x86: avoid clearing pending exception event twice The exception pending event is cleared by kvm_clear_exception_queue(). We shouldn't clear it again. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 66061740f1a487f4ed54fde75e724709f805da53 Author: Marios Pomonis Date: Wed Dec 11 12:47:53 2019 -0800 KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks This fixes Spectre-v1/L1TF vulnerabilities in intel_find_fixed_event() and intel_rdpmc_ecx_to_pmc(). kvm_rdpmc() (ancestor of intel_find_fixed_event()) and reprogram_fixed_counter() (ancestor of intel_rdpmc_ecx_to_pmc()) are exported symbols so KVM should treat them conservatively from a security perspective. Fixes: 25462f7f5295 ("KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit ea740059ecb37807ba47b84b33d1447435a8d868 Author: Marios Pomonis Date: Wed Dec 11 12:47:52 2019 -0800 KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in __kvm_set_dr() and kvm_get_dr(). Both kvm_get_dr() and kvm_set_dr() (a wrapper of __kvm_set_dr()) are exported symbols so KVM should tream them conservatively from a security perspective. Fixes: 020df0794f57 ("KVM: move DR register access handling into generic code") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit c926f2f7230b1a29e31914b51db680f8cbf3103f Author: Marios Pomonis Date: Wed Dec 11 12:47:51 2019 -0800 KVM: x86: Protect exit_reason from being used in Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in vmx_handle_exit(). While exit_reason is set by the hardware and therefore should not be attacker-influenced, an unknown exit_reason could potentially be used to perform such an attack. Fixes: 55d2375e58a6 ("KVM: nVMX: Move nested code to dedicated files") Signed-off-by: Marios Pomonis Signed-off-by: Nick Finco Suggested-by: Sean Christopherson Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 125ffc5e0a56a3eded608dc51e09d5ebf72cf652 Author: Marios Pomonis Date: Wed Dec 11 12:47:50 2019 -0800 KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks This fixes Spectre-v1/L1TF vulnerabilities in vmx_read_guest_seg_selector(), vmx_read_guest_seg_base(), vmx_read_guest_seg_limit() and vmx_read_guest_seg_ar(). When invoked from emulation, these functions contain index computations based on the (attacker-influenced) segment value. Using constants prevents the attack. Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 6ec4c5eee1750d5d17951c4e1960d953376a0dda Author: Marios Pomonis Date: Wed Dec 11 12:47:49 2019 -0800 KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and get_msr_mce(). Both functions contain index computations based on the (attacker-controlled) MSR number. Fixes: 890ca9aefa78 ("KVM: Add MCE support") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 13c5183a4e643cc2b03a22d0e582c8e17bb7457d Author: Marios Pomonis Date: Wed Dec 11 12:47:48 2019 -0800 KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in the get_gp_pmc() and get_fixed_pmc() functions. They both contain index computations based on the (attacker-controlled) MSR number. Fixes: 25462f7f5295 ("KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 25a5edea71b7c154b6a0b8cec14c711cafa31d26 Author: Marios Pomonis Date: Wed Dec 11 12:47:47 2019 -0800 KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in fixed_msr_to_seg_unit(). This function contains index computations based on the (attacker-controlled) MSR number. Fixes: de9aef5e1ad6 ("KVM: MTRR: introduce fixed_mtrr_segment table") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 4bf79cb089f6b1c6c632492c0271054ce52ad766 Author: Marios Pomonis Date: Wed Dec 11 12:47:46 2019 -0800 KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in kvm_lapic_reg_write(). This function contains index computations based on the (attacker-controlled) MSR number. Fixes: 0105d1a52640 ("KVM: x2apic interface to lapic") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 670564559ca35b439c8d8861fc399451ddf95137 Author: Marios Pomonis Date: Wed Dec 11 12:47:45 2019 -0800 KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in ioapic_write_indirect(). This function contains index computations based on the (attacker-controlled) IOREGSEL register. This patch depends on patch "KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks". Fixes: 70f93dae32ac ("KVM: Use temporary variable to shorten lines.") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 8c86405f606ca8508b8d9280680166ca26723695 Author: Marios Pomonis Date: Wed Dec 11 12:47:44 2019 -0800 KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in ioapic_read_indirect(). This function contains index computations based on the (attacker-controlled) IOREGSEL register. Fixes: a2c118bfab8b ("KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 14e32321f3606e4b0970200b6e5e47ee6f1e6410 Author: Marios Pomonis Date: Wed Dec 11 12:47:43 2019 -0800 KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in picdev_write(). It replaces index computations based on the (attacked-controlled) port number with constants through a minor refactoring. Fixes: 85f455f7ddbe ("KVM: Add support for in-kernel PIC emulation") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 8618793750071d66028584a83ed0b4fa7eb4f607 Author: Marios Pomonis Date: Wed Dec 11 12:47:42 2019 -0800 KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks This fixes Spectre-v1/L1TF vulnerabilities in kvm_hv_msr_get_crash_data() and kvm_hv_msr_set_crash_data(). These functions contain index computations that use the (attacker-controlled) MSR number. Fixes: e7d9513b60e8 ("kvm/x86: added hyper-v crash msrs into kvm hyperv context") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 3c9053a2cae7ba2ba73766a34cea41baa70f57f7 Author: Marios Pomonis Date: Wed Dec 11 12:47:41 2019 -0800 KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks This fixes a Spectre-v1/L1TF vulnerability in x86_decode_insn(). kvm_emulate_instruction() (an ancestor of x86_decode_insn()) is an exported symbol, so KVM should treat it conservatively from a security perspective. Fixes: 045a282ca415 ("KVM: emulator: implement fninit, fnstsw, fnstcw") Signed-off-by: Nick Finco Signed-off-by: Marios Pomonis Reviewed-by: Andrew Honig Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit a47970ed74a535b1accb4bc73643fd5a93993c3e Author: John Allen Date: Thu Dec 19 14:17:59 2019 -0600 kvm/svm: PKU not currently supported Current SVM implementation does not have support for handling PKU. Guests running on a host with future AMD cpus that support the feature will read garbage from the PKRU register and will hit segmentation faults on boot as memory is getting marked as protected that should not be. Ensure that cpuid from SVM does not advertise the feature. Signed-off-by: John Allen Cc: stable@vger.kernel.org Fixes: 0556cbdc2fbc ("x86/pkeys: Don't check if PKRU is zero before writing it") Signed-off-by: Paolo Bonzini commit 8bd826d629d6ff4a4e647079db15d64d06346004 Author: Sean Christopherson Date: Wed Dec 18 13:55:30 2019 -0800 KVM: Move vcpu->run page allocation out of kvm_vcpu_init() Open code the allocation and freeing of the vcpu->run page in kvm_vm_ioctl_create_vcpu() and kvm_vcpu_destroy() respectively. Doing so allows kvm_vcpu_init() to be a pure init function and eliminates kvm_vcpu_uninit() entirely. Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 9941d224fb7c765bc20f3cb6c747786adc5cd002 Author: Sean Christopherson Date: Wed Dec 18 13:55:29 2019 -0800 KVM: Move putting of vcpu->pid to kvm_vcpu_destroy() Move the putting of vcpu->pid to kvm_vcpu_destroy(). vcpu->pid is guaranteed to be NULL when kvm_vcpu_uninit() is called in the error path of kvm_vm_ioctl_create_vcpu(), e.g. it is explicitly nullified by kvm_vcpu_init() and is only changed by KVM_RUN. No functional change intended. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit ddd259c9aaba08244dba8877687ee856f79c4f45 Author: Sean Christopherson Date: Wed Dec 18 13:55:28 2019 -0800 KVM: Drop kvm_arch_vcpu_init() and kvm_arch_vcpu_uninit() Remove kvm_arch_vcpu_init() and kvm_arch_vcpu_uninit() now that all arch specific implementations are nops. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 19bcc89eb8a9fa1d4be4bff5b5e7917cb8bbc1f7 Author: Sean Christopherson Date: Wed Dec 18 13:55:27 2019 -0800 KVM: arm64: Free sve_state via arm specific hook Add an arm specific hook to free the arm64-only sve_state. Doing so eliminates the last functional code from kvm_arch_vcpu_uninit() across all architectures and paves the way for removing kvm_arch_vcpu_init() and kvm_arch_vcpu_uninit() entirely. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 74ce2e60d4874fc2464e321af1397c6fae984ec9 Author: Sean Christopherson Date: Wed Dec 18 13:55:26 2019 -0800 KVM: PPC: Move all vcpu init code into kvm_arch_vcpu_create() Fold init() into create() now that the two are called back-to-back by common KVM code (kvm_vcpu_init() calls kvm_arch_vcpu_init() as its last action, and kvm_vm_ioctl_create_vcpu() calls kvm_arch_vcpu_create() immediately thereafter). Rinse and repeat for kvm_arch_vcpu_uninit() and kvm_arch_vcpu_destroy(). This paves the way for removing kvm_arch_vcpu_{un}init() entirely. Note, calling kvmppc_mmu_destroy() if kvmppc_core_vcpu_create() fails may or may not be necessary. Move it along with the more obvious call to kvmppc_subarch_vcpu_uninit() so as not to inadvertantly introduce a functional change and/or bug. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 39a93a8794719a37a37140460865c4edaff795a6 Author: Sean Christopherson Date: Wed Dec 18 13:55:25 2019 -0800 KVM: ARM: Move all vcpu init code into kvm_arch_vcpu_create() Fold init() into create() now that the two are called back-to-back by common KVM code (kvm_vcpu_init() calls kvm_arch_vcpu_init() as its last action, and kvm_vm_ioctl_create_vcpu() calls kvm_arch_vcpu_create() immediately thereafter). This paves the way for removing kvm_arch_vcpu_{un}init() entirely. Note, there is no associated unwinding in kvm_arch_vcpu_uninit() that needs to be relocated (to kvm_arch_vcpu_destroy()). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d11dfed5d700b8973d5742300e04b2aaa9d11217 Author: Sean Christopherson Date: Wed Dec 18 13:55:24 2019 -0800 KVM: MIPS: Move all vcpu init code into kvm_arch_vcpu_create() Fold init() into create() now that the two are called back-to-back by common KVM code (kvm_vcpu_init() calls kvm_arch_vcpu_init() as its last action, and kvm_vm_ioctl_create_vcpu() calls kvm_arch_vcpu_create() immediately thereafter). Rinse and repeat for kvm_arch_vcpu_uninit() and kvm_arch_vcpu_destroy(). This paves the way for removing kvm_arch_vcpu_{un}init() entirely. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 95a0d01eef7a1b97358c25d335c4a28f91345cf9 Author: Sean Christopherson Date: Wed Dec 18 13:55:23 2019 -0800 KVM: x86: Move all vcpu init code into kvm_arch_vcpu_create() Fold init() into create() now that the two are called back-to-back by common KVM code (kvm_vcpu_init() calls kvm_arch_vcpu_init() as its last action, and kvm_vm_ioctl_create_vcpu() calls kvm_arch_vcpu_create() immediately thereafter). This paves the way for removing kvm_arch_vcpu_init() entirely. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit afede96df55e9cba948c8cc8a682e962244285b4 Author: Sean Christopherson Date: Wed Dec 18 13:55:22 2019 -0800 KVM: Drop kvm_arch_vcpu_setup() Remove kvm_arch_vcpu_setup() now that all arch specific implementations are nops. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit b3d42c9862e0e2a2d95839d91120ddf8dd8a8af6 Author: Sean Christopherson Date: Wed Dec 18 13:55:21 2019 -0800 KVM: PPC: BookE: Setup vcpu during kvmppc_core_vcpu_create() Fold setup() into create() now that the two are called back-to-back by common KVM code. This paves the way for removing kvm_arch_vcpu_setup(). Note, BookE directly implements kvm_arch_vcpu_setup() and PPC's common kvm_arch_vcpu_create() is responsible for its own cleanup, thus the only cleanup required when directly invoking kvmppc_core_vcpu_setup() is to call .vcpu_free(), which is the BookE specific portion of PPC's kvm_arch_vcpu_destroy() by way of kvmppc_core_vcpu_free(). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit ff72bb55cbfd060172cfbafafe4838ce92ab080f Author: Sean Christopherson Date: Wed Dec 18 13:55:20 2019 -0800 KVM: s390: Manually invoke vcpu setup during kvm_arch_vcpu_create() Rename kvm_arch_vcpu_setup() to kvm_s390_vcpu_setup() and manually call the new function during kvm_arch_vcpu_create(). Define an empty kvm_arch_vcpu_setup() as it's still required for compilation. This is effectively a nop as kvm_arch_vcpu_create() and kvm_arch_vcpu_setup() are called back-to-back by common KVM code. Obsoleting kvm_arch_vcpu_setup() paves the way for its removal. Note, gmap_remove() is now called if setup fails, as s390 was previously freeing it via kvm_arch_vcpu_destroy(), which is called by common KVM code if kvm_arch_vcpu_setup() fails. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 5259878432098ffd26cef7294b0a85ab5cfaf556 Author: Sean Christopherson Date: Wed Dec 18 13:55:19 2019 -0800 KVM: MIPS: Move .vcpu_setup() call to kvm_arch_vcpu_create() Fold setup() into create() now that the two are called back-to-back by common KVM code. This paves the way for removing kvm_arch_vcpu_setup(). Note, there is no unwind function associated with kvm_arch_vcpu_setup(), i.e. no teardown path that also needs to be moved. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 5f73db112e597b30efb7f81ab5fee87a9febad3e Author: Sean Christopherson Date: Wed Dec 18 13:55:18 2019 -0800 KVM: x86: Move guts of kvm_arch_vcpu_setup() into kvm_arch_vcpu_create() Fold setup() into create() now that the two are called back-to-back by common KVM code. This paves the way for removing kvm_arch_vcpu_setup(). Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d5c48debcc4fbdd09e3e0871980b7ebf06ec6e07 Author: Sean Christopherson Date: Wed Dec 18 13:55:17 2019 -0800 KVM: Move initialization of preempt notifier to kvm_vcpu_init() Initialize the preempt notifier immediately in kvm_vcpu_init() to pave the way for removing kvm_arch_vcpu_setup(), i.e. to allow arch specific code to call vcpu_load() during kvm_arch_vcpu_create(). Back when preemption support was added, the location of the call to init the preempt notifier was perfectly sane. The overall vCPU creation flow featured a single arch specific hook and the preempt notifer was used immediately after its initialization (by vcpu_load()). E.g.: vcpu = kvm_arch_ops->vcpu_create(kvm, n); if (IS_ERR(vcpu)) return PTR_ERR(vcpu); preempt_notifier_init(&vcpu->preempt_notifier, &kvm_preempt_ops); vcpu_load(vcpu); r = kvm_mmu_setup(vcpu); vcpu_put(vcpu); if (r < 0) goto free_vcpu; Today, the call to preempt_notifier_init() is sandwiched between two arch specific calls, kvm_arch_vcpu_create() and kvm_arch_vcpu_setup(), which needlessly forces x86 (and possibly others?) to split its vCPU creation flow. Init the preempt notifier prior to any arch specific call so that each arch can independently decide how best to organize its creation flow. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit aaba298c6bca8d8625880a8016e5b80adc8a11af Author: Sean Christopherson Date: Wed Dec 18 13:55:16 2019 -0800 KVM: Unexport kvm_vcpu_cache and kvm_vcpu_{un}init() Unexport kvm_vcpu_cache and kvm_vcpu_{un}init() and make them static now that they are referenced only in kvm_main.c. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit e529ef66e6b53b34f9b8caac55950c8a55c79dac Author: Sean Christopherson Date: Wed Dec 18 13:55:15 2019 -0800 KVM: Move vcpu alloc and init invocation to common code Now that all architectures tightly couple vcpu allocation/free with the mandatory calls to kvm_{un}init_vcpu(), move the sequences verbatim to common KVM code. Move both allocation and initialization in a single patch to eliminate thrash in arch specific code. The bisection benefits of moving the two pieces in separate patches is marginal at best, whereas the odds of introducing a transient arch specific bug are non-zero. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit a5b871c91d470326eed3ae0ebd2fc07f3aee9050 Merge: 715d12856953 71723a96b8b1 Author: Linus Torvalds Date: Mon Jan 27 10:55:50 2020 -0800 Merge tag 'dmaengine-5.6-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine updates from Vinod Koul: "This time we have a bunch of core changes to support dynamic channels, hotplug of controllers, new apis for metadata ops etc along with new drivers for Intel data accelerators, TI K3 UDMA, PLX DMA engine and hisilicon Kunpeng DMA engine. Also usual assorted updates to drivers. Core: - Support for dynamic channels - Removal of various slave wrappers - Make few slave request APIs as private to dmaengine - Symlinks between channels and slaves - Support for hotplug of controllers - Support for metadata_ops for dma_async_tx_descriptor - Reporting DMA cached data amount - Virtual dma channel locking updates New drivers/device/feature support support: - Driver for Intel data accelerators - Driver for TI K3 UDMA - Driver for PLX DMA engine - Driver for hisilicon Kunpeng DMA engine - Support for eDMA support for QorIQ LS1028A in fsl edma driver - Support for cyclic dma in sun4i driver - Support for X1830 in JZ4780 driver" * tag 'dmaengine-5.6-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (62 commits) dmaengine: Create symlinks between DMA channels and slaves dmaengine: hisilicon: Add Kunpeng DMA engine support dmaengine: idxd: add char driver to expose submission portal to userland dmaengine: idxd: connect idxd to dmaengine subsystem dmaengine: idxd: add descriptor manipulation routines dmaengine: idxd: add sysfs ABI for idxd driver dmaengine: idxd: add configuration component of driver dmaengine: idxd: Init and probe for Intel data accelerators dmaengine: add support to dynamic register/unregister of channels dmaengine: break out channel registration x86/asm: add iosubmit_cmds512() based on MOVDIR64B CPU instruction dmaengine: ti: k3-udma: fix spelling mistake "limted" -> "limited" dmaengine: s3c24xx-dma: fix spelling mistake "to" -> "too" dmaengine: Move dma_get_{,any_}slave_channel() to private dmaengine.h dmaengine: Remove dma_request_slave_channel_compat() wrapper dmaengine: Remove dma_device_satisfies_mask() wrapper dt-bindings: fsl-imx-sdma: Add i.MX8MM/i.MX8MN/i.MX8MP compatible string dmaengine: zynqmp_dma: fix burst length configuration dmaengine: sun4i: Add support for cyclic requests with dedicated DMA dmaengine: fsl-qdma: fix duplicated argument to && ... commit 715d1285695382b5074e49a0fe475b9ba56a1101 Merge: 12fb2b993e15 f46e49a9cc38 Author: Linus Torvalds Date: Mon Jan 27 10:54:24 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Jiri Kosina: "Fixes for selftests and samples for 'shadow variables' livepatching feature, from Petr Mladek" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Handle allocation failure in the sample of shadow variable API livepatch/samples/selftest: Use klp_shadow_alloc() API correctly livepatch/selftest: Clean up shadow variable names and type livepatch/sample: Use the right type for the leaking data pointer commit 12fb2b993e1508a0d9032a2314dfdda2a3a5535e Merge: 08c49dc13522 fef684af392b Author: Linus Torvalds Date: Mon Jan 27 10:48:30 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: "This time it's surprisingly quiet (probably due to the christmas break): - Logitech HID++ protocol improvements from Mazin Rezk, Pedro Vanzella and Adrian Freund - support for hidraw uniq ioctl from Marcel Holtmann" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: logitech-hidpp: avoid duplicate error handling code in 'hidpp_probe()' hid-logitech-hidpp: read battery voltage from newer devices HID: logitech: Add MX Master 3 Mouse HID: logitech-hidpp: Support WirelessDeviceStatus connect events HID: logitech-hidpp: Support translations from short to long reports HID: hidraw: add support uniq ioctl commit 08c49dc135225ab29569df955114912544df5c53 Merge: 9e1af7567b26 cf85e7c7f437 Author: Linus Torvalds Date: Mon Jan 27 10:42:35 2020 -0800 Merge tag 'platform-drivers-x86-v5.6-1' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver updates from Andy Shevchenko: - Enable thermal policy for ASUS TUF FX705DY/FX505DY - Support left round button on ASUS N56VB - Support new Mellanox platforms of basic class VMOD0009 and VMOD0010 - Intel Comet Lake, Tiger Lake and Elkhart Lake support in the PMC driver - Big clean-up to Intel PMC core, PMC IPC and SCU IPC drivers - Touchscreen support for the PiPO W11 tablet * tag 'platform-drivers-x86-v5.6-1' of git://git.infradead.org/linux-platform-drivers-x86: (64 commits) platform/x86: intel_pmc_ipc: Switch to use driver->dev_groups platform/x86: intel_pmc_ipc: Propagate error from kstrtoul() platform/x86: intel_pmc_ipc: Use octal permissions in sysfs attributes platform/x86: intel_pmc_ipc: Get rid of unnecessary includes platform/x86: intel_pmc_ipc: Drop ipc_data_readb() platform/x86: intel_pmc_ipc: Drop intel_pmc_gcr_read() and intel_pmc_gcr_write() platform/x86: intel_pmc_ipc: Make intel_pmc_ipc_raw_cmd() static platform/x86: intel_pmc_ipc: Make intel_pmc_ipc_simple_command() static platform/x86: intel_pmc_ipc: Make intel_pmc_gcr_update() static platform/x86: intel_scu_ipc: Reformat kernel-doc comments of exported functions platform/x86: intel_scu_ipc: Drop intel_scu_ipc_raw_command() platform/x86: intel_scu_ipc: Drop intel_scu_ipc_io[read|write][8|16]() platform/x86: intel_scu_ipc: Drop unused macros platform/x86: intel_scu_ipc: Drop unused prototype intel_scu_ipc_fw_update() platform/x86: intel_scu_ipc: Sleeping is fine when polling platform/x86: intel_scu_ipc: Drop intel_scu_ipc_i2c_cntrl() platform/x86: intel_scu_ipc: Remove Lincroft support platform/x86: intel_scu_ipc: Add constants for register offsets platform/x86: intel_scu_ipc: Fix interrupt support platform/x86: intel_scu_ipcutil: Remove default y from Kconfig ... commit 9e1af7567b266dc6c3c8fd434ea807b3206bfdc1 Merge: b9b627a44988 533a6cfe08f9 Author: Linus Torvalds Date: Mon Jan 27 10:30:42 2020 -0800 Merge tag 'mmc-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "There are no updates for the MEMSTICK subsystem this time. But note that I am also carrying a patch from the pinctrl tree, which has been shared through an immutable branch. Summary: MMC core: - Convert to reasonable timeouts for all CMD6 commands (updates for BKOPS, CACHE_FLUSH and INAND_CMD38_ARG_EXT_CSD) for eMMC - Respect f_max clock rate at card initialization - Add gpiod_toggle_active_low() API - Consolidate slot-gpio code by using gpiod_toggle_active_low() MMC host: - Add pinctrl_select_default_state() API - Consolidate pintctrl code by using pinctrl_select_default_state() - mmci: Support any block sizes for SDIO for some variants - mmci: Enable reset control for stm32_sdmmc - mmc_spi: Toggle SPI_CS_HIGH polarity rather than hard-coding it - renesas_sdhi: Add support for the r8a77961 variant - renesas_sdhi: A few minor improvements - rockchip-dw-mshc: Add support for the rk3308 variant - sdhci: Enable support for external DMA controllers - sdhci: Fixup error path when sending CMD12 - sdhci-brcmstb: Add support for 7216b0 variant - sdhci-brcmstb: Add support for command queuing (CQHCI) - sdhci-brcmstb: Add support for eMMC HS400ES mode - sdhci-msm: Add support for the sc7180 variant - sdhci-msm: Add support for command queuing (CQHCI) - sdhci-of-at91: Add support for the SAM9x60 variant - sdhci-of-at91: Improve support for tunings - sdhci-of-esdhc: A few fixups for some clock related issues - sdhci-omap: Add support for the am335x and the am437x variants - sdhci-omap: Improve support for erase operations - sdhci-omap: Add support for external DMA" * tag 'mmc-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (89 commits) mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC mmc: sdhci-cadence: remove unneeded 'inline' marker dt-bindings: mmc: rockchip-dw-mshc: add description for rk3308 dt-bindings: mmc: convert rockchip dw-mshc bindings to yaml dt-bindings: mmc: convert synopsys dw-mshc bindings to yaml mmc: sdhci-msm: Add CQHCI support for sdhci-msm mmc: sdhci: Let a vendor driver supply and update ADMA descriptor size mmc: sdhci-of-esdhc: fix serious issue clock is always disabled mmc: sdhci-of-esdhc: fix transfer mode register reading mmc: sdhci-brcmstb: Fix incorrect switch to HS mode mmc: sdhci-brcmstb: Add support for Command Queuing (CQE) mmc: sdhci-brcmstb: Add shutdown callback mmc: sdhci-brcmstb: Fix driver to defer on clk_get defer mmc: sdhci-brcmstb: Add ability to use HS400ES transfer mode dt-bindings: mmc: brcm,sdhci-brcmstb: Add support for 7216b0 mmc: core: limit probe clock frequency to configured f_max mmc: sdhci-milbeaut: Remove redundant platform_get_irq error message mmc: sdhci: fix an issue of mixing different types ... commit b9b627a449889e9dacfe9e7ac3cdf829a0004845 Merge: 067ba54c7a7d 3952cf8ff2f7 Author: Linus Torvalds Date: Mon Jan 27 10:28:43 2020 -0800 Merge tag 'i3c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Boris Brezillon: "Core changes: - Make i3c_bus_set_mode() static Driver changes: - Add a per-SoC data_hold_delay property to the Cadence driver - Fix formatting issues in the 'CADENCE I3C MASTER IP' MAINTAINERS entry - Use devm_platform_ioremap_resource() where appropriate - Adjust DesignWare reattach logic" * tag 'i3c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: dw: reattach device on first available location of address table i3c: master: cdns: convert to devm_platform_ioremap_resource i3c: master: dw: convert to devm_platform_ioremap_resource MAINTAINERS: fix style in CADENCE I3C MASTER IP entry i3c: master: make i3c_bus_set_mode static i3c: master: cdns: add data hold delay support commit 98ff5c262f27aafee077a4c096f71a8566e9e948 Author: Guennadi Liakhovetski Date: Fri Jan 24 15:36:25 2020 -0600 ASoC: Intel: consistent HDMI codec probing code Multiple Intel ASoC machine drivers repeat the same pattern in their .late_probe() methods: they first check whether the common HDMI codec driver is used, if not, they proceed by linking the legacy HDMI driver to each HDMI port. While doing that they use some inconsistent code: 1. after the loop they check, whether the list contained at least one element and if not, they return an error. However, the earlier code to use the common HDMI driver uses the first element of the same list without checking. To fix this we move the check to the top of the function. 2. some of those .late_probe() implementations execute code, only needed for the common HDMI driver, before checking, whether the driver is used. Move the code to after the check. 3. Some of those functions also perform a redundant initialisation of the "err" variable. This patch fixes those issues. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200124213625.30186-8-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit bd01cf38eedceb87d43f9205a75b259361e056ea Author: Bard Liao Date: Fri Jan 24 15:36:24 2020 -0600 ASoC: intel: soc-acpi-intel-icl-match: fix rt715 ADR Fix the part id of rt715 (typo with zero in the wrong place) Signed-off-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200124213625.30186-7-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit e3b9f5f4ef92801f62c58665283c61cece0af905 Author: Pan Xiuli Date: Fri Jan 24 15:36:23 2020 -0600 ASoC: SOF: pci: add missing default_fw_name of JasperLake jsl_desc missed default_fw_name, this will fail the probe in nocodec or generice HDA mode due the firmware path is intel/sof/(null) Signed-off-by: Pan Xiuli Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200124213625.30186-6-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit e6110114d18d330c05fd6de9f31283fd086a5a3a Author: Kai Vehmanen Date: Fri Jan 24 15:36:22 2020 -0600 ASoC: SOF: trace: fix unconditional free in trace release Check if DMA pages were successfully allocated in initialization before calling free. For many types of memory (like sgbufs) the extra free is harmless, but not all backends track allocation state, so add an explicit check. Signed-off-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200124213625.30186-5-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 410e5e55c9c1c9c0d452ac5b9adb37b933a7747e Author: Pierre-Louis Bossart Date: Fri Jan 24 15:36:21 2020 -0600 ASoC: SOF: core: release resources on errors in probe_continue The initial intent of releasing resources in the .remove does not work well with HDaudio codecs. If the probe_continue() fails in a work queue, e.g. due to missing firmware or authentication issues, we don't release any resources, and as a result the kernel oopses during suspend operations. The suggested fix is to release all resources during errors in probe_continue(), and use fw_state to track resource allocation state, so that .remove does not attempt to release the same hardware resources twice. PM operations are also modified so that no action is done if DSP resources have been freed due to an error at probe. Reported-by: Takashi Iwai Co-developed-by: Kai Vehmanen Signed-off-by: Kai Vehmanen Bugzilla: http://bugzilla.suse.com/show_bug.cgi?id=1161246 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20200124213625.30186-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown Cc: stable@vger.kernel.org commit 37e97e6faeabda405d0c4319f8419dcc3da14b2b Author: Pierre-Louis Bossart Date: Fri Jan 24 15:36:20 2020 -0600 ASoC: SOF: core: free trace on errors free_trace() is not called on probe errors, fix Reviewed-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200124213625.30186-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown Cc: stable@vger.kernel.org commit 4f7f9564a8937f38f97e8624cb7d6a28ee35f7cb Author: Guennadi Liakhovetski Date: Fri Jan 24 15:36:19 2020 -0600 ASoC: SOF: fix an Oops, caused by invalid topology It is possible to create invalid topology that will cause a kernel Oops when trying to allocate buffers for a NULL substream. Specifically such an Oops was caused by a topology, where a DAI on a capture pipeline was referencing the PCM ID from a playback pipeline. Fix the Oops by explicitly checking for NULL. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200124213625.30186-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 90b141614a4133ffeb1075049a49c702f98e26df Author: Ravulapati Vishnu vardhan rao Date: Mon Jan 27 16:56:03 2020 +0530 ASoC: amd: Fix for Subsequent Playback issue. If we play audio back to back, which kills one playback and immediately start another, we can hear clicks. This patch fixes the issue. Signed-off-by: Ravulapati Vishnu vardhan rao Link: https://lore.kernel.org/r/1580124397-19842-1-git-send-email-Vishnuvardhanrao.Ravulapati@amd.com Signed-off-by: Mark Brown commit 0c75419a94a20b2bf791825a665d8b64cf7c560d Author: Kai Vehmanen Date: Mon Jan 20 18:01:16 2020 +0200 ASoC: SOF: Intel: do not disable i915 power during probe Change HDA probe behaviour slightly so that i915 power is not turned off if i915 audio codecs are found in the initial probe done by SOF Intel driver, and power is kept on until HDA codec driver probe runs. This will reduce number of mode sets on platforms with low minimum CDCLK (like GLK) and brings the SOF probe sequence closer to legacy HDA driver in terms of i915 audio codec power management. BugLink: https://github.com/thesofproject/linux/issues/1642 Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20200120160117.29130-3-kai.vehmanen@linux.intel.com Pierre-Louis Bossart Signed-off-by: Mark Brown commit 23ee09032d44736c5e8c7becbe03170dbc6f2e8d Author: Kai Vehmanen Date: Mon Jan 20 18:01:15 2020 +0200 ASoC: SOF: Intel: refactor i915_get/put functions The current interface to control i915 display power is misleading. The hda_codec_i915_get() and hda_codec_i915_put() names suggest a refcounting based interface. This is confusing as no refcounting is done and the underlying HDAC library interface does not support refcounts eithers. Clarify the code by replacing the functions with a single hda_codec_i915_display_power() that is aligned with snd_hdac_display_power(). Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20200120160117.29130-2-kai.vehmanen@linux.intel.com Acked-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit ac87813d4372f4c005264acbe3b7f00c1dee37c4 Author: Matthieu Baerts Date: Tue Oct 22 19:12:20 2019 +0200 selftests: settings: tests can be in subsubdirs Commit 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") adds support for a new per-test-directory "settings" file. But this only works for tests not in a sub-subdirectories, e.g. - tools/testing/selftests/rtc (rtc) is OK, - tools/testing/selftests/net/mptcp (net/mptcp) is not. We have to increase the timeout for net/mptcp tests which are not upstreamed yet but this fix is valid for other tests if they need to add a "settings" file, see the full list with: tools/testing/selftests/*/*/**/Makefile Note that this patch changes the text header message printed at the end of the execution but this text is modified only for the tests that are in sub-subdirectories, e.g. ok 1 selftests: net/mptcp: mptcp_connect.sh Before we had: ok 1 selftests: mptcp: mptcp_connect.sh But showing the full target name is probably better, just in case a subsubdir has the same name as another one in another subdirectory. Fixes: 852c8cbf34d3 (selftests/kselftest/runner.sh: Add 45 second timeout per test) Signed-off-by: Matthieu Baerts Reviewed-by: Kees Cook Signed-off-by: Shuah Khan commit 067ba54c7a7d4cb76da4c8434bd6f117b61ac8ee Merge: 30f5a7564099 82c881b28aa8 Author: Linus Torvalds Date: Mon Jan 27 09:25:59 2020 -0800 Merge branch 'x86-microcode-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode update from Borislav Petkov: "Another boring branch this time around: mark a stub function inline, by Valdis Kletnieks" * 'x86-microcode-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Make stub function static inline commit e4e4c2ff78edd2f9c7d2d3e588ca68ffa1dd8dc8 Merge: ebe0bdf9cfb9 44e9b3446423 Author: Mark Brown Date: Mon Jan 27 17:24:38 2020 +0000 Merge branch 'regulator-5.6' into regulator-next commit 44e9b3446423164dd04f58a5f9efd988c4d5e84b Author: Saravanan Sekar Date: Thu Jan 23 22:53:38 2020 +0100 dt-bindings: regulator: add document bindings for mpq7920 Add device tree binding information for mpq7920 regulator driver. Example bindings for mpq7920 are added. Signed-off-by: Saravanan Sekar Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20200123215338.11109-1-sravanhome@gmail.com Signed-off-by: Mark Brown commit 30f5a75640998900d995e099e060e920e72790b2 Merge: b62061b82a6e 86e9f9d60eb5 Author: Linus Torvalds Date: Mon Jan 27 09:19:35 2020 -0800 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - Misc fixes to the MCE code all over the place, by Jan H. Schönherr. - Initial support for AMD F19h and other cleanups to amd64_edac, by Yazen Ghannam. - Other small cleanups. * 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: EDAC/mce_amd: Make fam_ops static global EDAC/amd64: Drop some family checks for newer systems EDAC/amd64: Add family ops for Family 19h Models 00h-0Fh x86/amd_nb: Add Family 19h PCI IDs EDAC/mce_amd: Always load on SMCA systems x86/MCE/AMD, EDAC/mce_amd: Add new Load Store unit McaType x86/mce: Fix use of uninitialized MCE message string x86/mce: Fix mce=nobootlog x86/mce: Take action on UCNA/Deferred errors again x86/mce: Remove mce_inject_log() in favor of mce_log() x86/mce: Pass MCE message to mce_panic() on failed kernel recovery x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused commit b62061b82a6e6783bed5f9052326694ba1418bba Merge: 35417d57efaa 7e5d6cf35329 Author: Linus Torvalds Date: Mon Jan 27 09:16:22 2020 -0800 Merge tag 'edac_for_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: "A totally boring branch this time around: a garden variety of small fixes all over the place" * tag 'edac_for_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Do not warn when removing instances EDAC/sifive: Fix return value check in ecc_register() EDAC/aspeed: Remove unneeded semicolon EDAC: remove set but not used variable 'ecc_loc' EDAC: skx_common: downgrade message importance on missing PCI device EDAC/Kconfig: Fix Kconfig indentation commit 35417d57efaaf06894868a2e8dfcd7b9f31bd0bf Merge: 189fc98efe59 fd8bdb23b918 Author: Linus Torvalds Date: Mon Jan 27 09:14:11 2020 -0800 Merge tag 'hwmon-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "core: - Add support for enable attributes to hwmon core - Add intrusion templates pmbus: - Support for Infineon Multi-phase xdpe122 family controllers - Support for Intel IMVP9 and AMD 6.25mV modes - Support for vid mode detection per page bases - Detect if chip is write protected - Support for MAX20730, MAX20734, MAX20743, MAX20796, UCD90320, TPS53688 - Various improvements to ibm-cffps driver k10temp: - Support for additional temperature sensors as well as voltage and current telemetry for Zen CPUs w83627ehf: - Remove support for NCT6775, NCT6776 (they have their own driver) New drivers: - ADM1177 - MAX31730 - Driver for disk and solid state drives with temperature sensors Other: - pwm-fan: stop fan on shutdown" * tag 'hwmon-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (35 commits) hwmon: (k10temp) Display up to eight sets of CCD temperatures hwmon: (k10temp) Add debugfs support hwmon: (k10temp) Don't show temperature limits on Ryzen (Zen) CPUs hwmon: (k10temp) Show core and SoC current and voltages on Ryzen CPUs hwmon: (k10temp) Report temperatures per CPU die hmon: (k10temp) Convert to use devm_hwmon_device_register_with_info hwmon: (k10temp) Use bitops hwmon: (pwm-fan) stop fan on shutdown MAINTAINERS: add entry for ADM1177 driver dt-binding: hwmon: Add documentation for ADM1177 hwmon: (adm1177) Add ADM1177 Hot Swap Controller and Digital Power Monitor driver docs: hwmon: Include 'xdpe12284.rst' into docs hwmon: (pmbus) Add support for Infineon Multi-phase xdpe122 family controllers hwmon: (pmbus/tps53679) Extend device list supported by driver hwmon: (pmbus/core) Add support for Intel IMVP9 and AMD 6.25mV modes hwmon: (pmbus/core) Add support for vid mode detection per page bases hwmon: (pmbus/ibm-cffps) Prevent writing on_off_config with bad data hwmon: (w83627ehf) Remove set but not used variable 'fan4min' hwmon: Driver for disk and solid state drives with temperature sensors hwmon: (pmbus/ibm-cffps) Fix the LED behavior when turned off ... commit 189fc98efe59b9b0a49a4f29ee3d91eeded4e4d4 Merge: f11ba7de1565 7084eddf6be9 Author: Linus Torvalds Date: Mon Jan 27 09:12:13 2020 -0800 Merge tag 'tpmdd-next-20200122' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "This adds a new sysfs file for querying TPM major version, which can be used by the user space the TPM protocol used to communicate with the chip" * tag 'tpmdd-next-20200122' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm: Add tpm_version_major sysfs file tpm: Update mailing list contact information in sysfs-class-tpm commit f11ba7de156558ac5e78e285dbf9e9af60ceb2a8 Merge: 0238d3c75303 6aabc1facdb2 Author: Linus Torvalds Date: Mon Jan 27 09:05:55 2020 -0800 Merge tag 'm68k-for-v5.6-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - wire up clone3() syscall - defconfig updates * tag 'm68k-for-v5.6-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Implement copy_thread_tls() m68k: defconfig: Update defconfigs for v5.5-rc3 m68k: Wire up clone3() syscall commit 0238d3c75303d63839ca20e71e4993fdab3fec7b Merge: d5226fa6dbae e533dbe9dcb1 Author: Linus Torvalds Date: Mon Jan 27 08:58:19 2020 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "The changes are a real mixed bag this time around. The only scary looking one from the diffstat is the uapi change to asm-generic/mman-common.h, but this has been acked by Arnd and is actually just adding a pair of comments in an attempt to prevent allocation of some PROT values which tend to get used for arch-specific purposes. We'll be using them for Branch Target Identification (a CFI-like hardening feature), which is currently under review on the mailing list. New architecture features: - Support for Armv8.5 E0PD, which benefits KASLR in the same way as KPTI but without the overhead. This allows KPTI to be disabled on CPUs that are not affected by Meltdown, even is KASLR is enabled. - Initial support for the Armv8.5 RNG instructions, which claim to provide access to a high bandwidth, cryptographically secure hardware random number generator. As well as exposing these to userspace, we also use them as part of the KASLR seed and to seed the crng once all CPUs have come online. - Advertise a bunch of new instructions to userspace, including support for Data Gathering Hint, Matrix Multiply and 16-bit floating point. Kexec: - Cleanups in preparation for relocating with the MMU enabled - Support for loading crash dump kernels with kexec_file_load() Perf and PMU drivers: - Cleanups and non-critical fixes for a couple of system PMU drivers FPU-less (aka broken) CPU support: - Considerable fixes to support CPUs without the FP/SIMD extensions, including their presence in heterogeneous systems. Good luck finding a 64-bit userspace that handles this. Modern assembly function annotations: - Start migrating our use of ENTRY() and ENDPROC() over to the new-fangled SYM_{CODE,FUNC}_{START,END} macros, which are intended to aid debuggers Kbuild: - Cleanup detection of LSE support in the assembler by introducing 'as-instr' - Remove compressed Image files when building clean targets IP checksumming: - Implement optimised IPv4 checksumming routine when hardware offload is not in use. An IPv6 version is in the works, pending testing. Hardware errata: - Work around Cortex-A55 erratum #1530923 Shadow call stack: - Work around some issues with Clang's integrated assembler not liking our perfectly reasonable assembly code - Avoid allocating the X18 register, so that it can be used to hold the shadow call stack pointer in future ACPI: - Fix ID count checking in IORT code. This may regress broken firmware that happened to work with the old implementation, in which case we'll have to revert it and try something else - Fix DAIF corruption on return from GHES handler with pseudo-NMIs Miscellaneous: - Whitelist some CPUs that are unaffected by Spectre-v2 - Reduce frequency of ASID rollover when KPTI is compiled in but inactive - Reserve a couple of arch-specific PROT flags that are already used by Sparc and PowerPC and are planned for later use with BTI on arm64 - Preparatory cleanup of our entry assembly code in preparation for moving more of it into C later on - Refactoring and cleanup" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (73 commits) arm64: acpi: fix DAIF manipulation with pNMI arm64: kconfig: Fix alignment of E0PD help text arm64: Use v8.5-RNG entropy for KASLR seed arm64: Implement archrandom.h for ARMv8.5-RNG arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean' arm64: entry: Avoid empty alternatives entries arm64: Kconfig: select HAVE_FUTEX_CMPXCHG arm64: csum: Fix pathological zero-length calls arm64: entry: cleanup sp_el0 manipulation arm64: entry: cleanup el0 svc handler naming arm64: entry: mark all entry code as notrace arm64: assembler: remove smp_dmb macro arm64: assembler: remove inherit_daif macro ACPI/IORT: Fix 'Number of IDs' handling in iort_id_map() mm: Reserve asm-generic prot flags 0x10 and 0x20 for arch use arm64: Use macros instead of hard-coded constants for MAIR_EL1 arm64: Add KRYO{3,4}XX CPU cores to spectre-v2 safe list arm64: kernel: avoid x18 in __cpu_soft_restart arm64: kvm: stop treating register x18 as caller save arm64/lib: copy_page: avoid x18 register in assembler code ... commit 4575243c5c173f8adbc08a5c6ea2269742ea2b47 Merge: 701ddf0bbfc7 d85339d9ea26 Author: Miquel Raynal Date: Mon Jan 27 17:49:15 2020 +0100 Merge tag 'nand/for-5.6' into mtd/next Raw NAND * Macronix: Use match_string() helper * Atmel: switch to using devm_fwnode_gpiod_get() * Denali: rework the SKIP_BYTES feature and add reset controlling * Brcmnand: set appropriate DMA mask * Various cleanup. Onenand drivers * Rename Samsung and Omap2 drivers to avoid possible build warnings * Enable compile testing * Various build issues * Kconfig cleanup SPI-NAND * Support for Toshiba TC58CVG2S0HRAIJ commit 701ddf0bbfc761b8bdc974ce9c4e05f9833683e3 Merge: 0dcf2572710d ccfb9299a0b6 Author: Miquel Raynal Date: Mon Jan 27 17:48:30 2020 +0100 Merge tag 'spi-nor/for-5.6' into mtd/next SPI NOR core changes: - Add support for TB selection using SR bit 6, - Add support for few flashes. commit 90fb04f890bcb7384b4d4c216dc2640b0a870df3 Merge: 9b132f2764e5 a7196caf83ea Author: Takashi Iwai Date: Mon Jan 27 17:45:44 2020 +0100 Merge tag 'asoc-v5.6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.6 A pretty big release this time around, a lot of new drivers and both Morimoto-san and Takashi were doing subsystem wide updates as well: - Further big refactorings from Morimoto-san simplifying the core interfaces and moving things to the component level. - Transition of drivers to managed buffer allocation and removal of redundant PCM ioctls. - New driver support for Ingenic JZ4770, Mediatek MT6660, Qualcomm WCD934x and WSA881x, and Realtek RT700, RT711, RT715, RT1011, RT1015 and RT1308. commit 0dcf2572710d68c305e58946c435ddf67ea16bf3 Author: Miquel Raynal Date: Wed Nov 13 18:15:02 2019 +0100 mtd: concat: Fix a comment referring to an unknown symbol Fix the comment describing what the mtd_concat_destroy() function does. It referrers to the concat_mtd_devs symbol which has never existed (at least not since the beginning of the Git era). Signed-off-by: Miquel Raynal commit baebaa2b13d92bd588ed8d06b28d787611b52a46 Author: Brendan Higgins Date: Wed Dec 11 11:27:37 2019 -0800 mtd: rawnand: add unspecified HAS_IOMEM dependency Currently CONFIG_MTD_NAND_CADENCE implicitly depends on CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get the following build error: ld: drivers/mtd/nand/raw/cadence-nand-controller.o: in function `cadence_nand_dt_probe.cold.31': drivers/mtd/nand/raw/cadence-nand-controller.c:2969: undefined reference to `devm_platform_ioremap_resource' ld: drivers/mtd/nand/raw/cadence-nand-controller.c:2977: undefined reference to `devm_ioremap_resource' Fix the build error by adding the unspecified dependency. Reported-by: Brendan Higgins Signed-off-by: Brendan Higgins Signed-off-by: Miquel Raynal commit 20279420ae3a8ef4c5d9fedc360a2c37a1dbdf1b Author: Steven Rostedt (VMware) Date: Fri Jan 24 10:07:42 2020 -0500 tracing/kprobes: Have uname use __get_str() in print_fmt Thomas Richter reported: > Test case 66 'Use vfs_getname probe to get syscall args filenames' > is broken on s390, but works on x86. The test case fails with: > > [root@m35lp76 perf]# perf test -F 66 > 66: Use vfs_getname probe to get syscall args filenames > :Recording open file: > [ perf record: Woken up 1 times to write data ] > [ perf record: Captured and wrote 0.004 MB /tmp/__perf_test.perf.data.TCdYj\ > (20 samples) ] > Looking at perf.data file for vfs_getname records for the file we touched: > FAILED! > [root@m35lp76 perf]# The root cause was the print_fmt of the kprobe event that referenced the "ustring" > Setting up the kprobe event using perf command: > > # ./perf probe "vfs_getname=getname_flags:72 pathname=filename:ustring" > > generates this format file: > [root@m35lp76 perf]# cat /sys/kernel/debug/tracing/events/probe/\ > vfs_getname/format > name: vfs_getname > ID: 1172 > format: > field:unsigned short common_type; offset:0; size:2; signed:0; > field:unsigned char common_flags; offset:2; size:1; signed:0; > field:unsigned char common_preempt_count; offset:3; size:1; signed:0; > field:int common_pid; offset:4; size:4; signed:1; > > field:unsigned long __probe_ip; offset:8; size:8; signed:0; > field:__data_loc char[] pathname; offset:16; size:4; signed:1; > > print fmt: "(%lx) pathname=\"%s\"", REC->__probe_ip, REC->pathname Instead of using "__get_str(pathname)" it referenced it directly. Link: http://lkml.kernel.org/r/20200124100742.4050c15e@gandalf.local.home Cc: stable@vger.kernel.org Fixes: 88903c464321 ("tracing/probe: Add ustring type for user-space string") Acked-by: Masami Hiramatsu Reported-by: Thomas Richter Tested-by: Thomas Richter Signed-off-by: Steven Rostedt (VMware) commit c3917a04843fa38d9e3926e7508813e115d3df78 Author: Liu Song Date: Fri Nov 29 22:33:52 2019 +0800 mtd: block2mtd: page index should use pgoff_t Page index use pgoff_t to prevent risk of truncation. Signed-off-by: Liu Song Signed-off-by: Miquel Raynal commit 0bc448b49e8a017e16edf843baf5b4221e191b1f Author: Geert Uytterhoeven Date: Mon Dec 9 14:48:23 2019 +0100 mtd: maps: physmap: Add minimal Runtime PM support Add minimal runtime PM support (enable on probe, disable on remove), to ensure proper operation with a parent device that uses runtime PM. This is needed on systems where the FLASH is connected to a bus controller that is contained in a PM domain and/or has a gateable functional clock. In such cases, before accessing any device connected to the external bus, the PM domain must be powered up, and/or the functional clock must be enabled, which is typically handled through runtime PM by the bus controller driver. An example of this is the Renesas APE6-EVM development board, which has an Ethernet controller and a CFI FLASH connected to the Bus State Controller (BSC) of an R-Mobile APE6 SoC. As long as the Ethernet driver, which had Runtime PM support since commit 3a611e26e958b037 ("net/smsc911x: Add minimal runtime PM support"), keeps the BSC powered, accessing the FLASH works. When the ethernet node in r8a73a4-ape6evm.dts is disabled, the BSC is never powered up, and the kernel crashes when trying to access the FLASH: Unhandled fault: imprecise external abort (0x1406) at 0x00000000 pgd = (ptrval) [00000000] *pgd=7fef2835 Internal error: : 1406 [#1] SMP ARM CPU: 0 PID: 122 Comm: hd Tainted: G W 5.5.0-rc1-ape6evm-00814-g38ca966db25b9dbd-dirty #136 Hardware name: Generic R8A73A4 (Flattened Device Tree) PC is at chip_ready+0x12c/0x380 LR is at chip_ready+0x10c/0x380 Signed-off-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit 2a0b390b472b7be8909beb77d47db361b613cdc8 Author: Jia-Ju Bai Date: Thu Dec 19 11:20:23 2019 +0800 mtd: maps: pcmciamtd: fix possible sleep-in-atomic-context bugs in pcmciamtd_set_vpp() The driver may sleep while holding a spinlock. The function call path (from bottom to top) in Linux 4.19 is: drivers/pcmcia/pcmcia_resource.c, 312: mutex_lock in pcmcia_fixup_vpp drivers/mtd/maps/pcmciamtd.c, 309: pcmcia_fixup_vpp in pcmciamtd_set_vpp drivers/mtd/maps/pcmciamtd.c, 306: _raw_spin_lock_irqsave in pcmciamtd_set_vpp drivers/pcmcia/pcmcia_resource.c, 312: mutex_lock in pcmcia_fixup_vpp drivers/mtd/maps/pcmciamtd.c, 312: pcmcia_fixup_vpp in pcmciamtd_set_vpp drivers/mtd/maps/pcmciamtd.c, 306: _raw_spin_lock_irqsave in pcmciamtd_set_vp mutex_lock() may sleep at runtime. To fix these bugs, the spinlock is replaced with a mutex. These bugs are found by a static analysis tool STCheck written by myself. Signed-off-by: Jia-Ju Bai Reviewed-by: Dominik Brodowski Signed-off-by: Miquel Raynal commit 3325322f773bae68b20d8fa0e9e8ebb005271db5 Author: Hannes Reinecke Date: Thu Jan 23 13:44:33 2020 +0100 rbd: set the 'device' link in sysfs The rbd driver already provides additional information in sysfs under /sys/bus/rbd, so we should set the 'device' link in the block device to reference this information. Signed-off-by: Hannes Reinecke Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 24604f7e2bde5e6458812c3e9ee2a0d60c8c99fe Author: Jeff Layton Date: Mon Jan 6 19:05:19 2020 -0500 ceph: move net/ceph/ceph_fs.c to fs/ceph/util.c All of these functions are only called from CephFS, so move them into ceph.ko, and drop the exports. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d36e0b620aa53d9a33c739f0368e85707a997430 Author: Jeff Layton Date: Tue Jan 7 13:12:57 2020 -0500 ceph: print name of xattr in __ceph_{get,set}xattr() douts Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 3c802092dab69351b1c2e52a2250f47d5bf60253 Author: Xiubo Li Date: Wed Jan 1 22:09:37 2020 -0500 ceph: print r_direct_hash in hex in __choose_mds() dout It's hard to read, especially when it is: ceph: __choose_mds 00000000b7bc9c15 is_hash=1 (-271041095) mode 0 At the same time, switch to __func__ to get rid of the checkpatch warning. Signed-off-by: Xiubo Li Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 78beb0ff2feceb1d7568333f93195e1a4d95a49a Author: Luis Henriques Date: Wed Jan 8 10:03:53 2020 +0000 ceph: use copy-from2 op in copy_file_range Instead of using the copy-from operation, switch copy_file_range to the new copy-from2 operation, which allows to send the truncate_seq and truncate_size parameters. If an OSD does not support the copy-from2 operation it will return -EOPNOTSUPP. In that case, the kernel client will stop trying to do remote object copies for this fs client and will always use the generic VFS copy_file_range. Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 045100cd79f503487b95a1d11e96b221fe50693c Author: Jeff Layton Date: Fri Nov 15 09:13:59 2019 -0500 ceph: close holes in structs ceph_mds_session and ceph_mds_request Move s_ref up to plug a 4 byte hole, which plugs another. Move r_kref to shave 8 bytes off per request on x86_64. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit a55e601b2f02df5db7070e9a37bd655c9c576a52 Author: Arnd Bergmann Date: Tue Jan 7 22:01:04 2020 +0100 rbd: work around -Wuninitialized warning gcc -O3 warns about a dummy variable that is passed down into rbd_img_fill_nodata without being initialized: drivers/block/rbd.c: In function 'rbd_img_fill_nodata': drivers/block/rbd.c:2573:13: error: 'dummy' is used uninitialized in this function [-Werror=uninitialized] fctx->iter = *fctx->pos; Since this is a dummy, I assume the warning is harmless, but it's better to initialize it anyway and avoid the warning. Fixes: mmtom ("init/Kconfig: enable -O3 for all arches") Signed-off-by: Arnd Bergmann Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 9ba1e224538a021b989302bb2777abc7a3b3ec79 Author: Xiubo Li Date: Wed Jan 8 05:17:31 2020 -0500 ceph: allocate the correct amount of extra bytes for the session features The total bytes may potentially be larger than 8. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5b3248c6772459a0737afe0c85bb45ee3ba79eeb Author: Xiubo Li Date: Thu Dec 19 19:44:09 2019 -0500 ceph: rename get_session and switch to use ceph_get_mds_session Just in case the session's refcount reach 0 and is releasing, and if we get the session without checking it, we may encounter kernel crash. Rename get_session to ceph_get_mds_session and make it global. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 4fbc0c711b2464ee1551850b85002faae0b775d5 Author: Xiubo Li Date: Fri Dec 20 09:34:04 2019 -0500 ceph: remove the extra slashes in the server path It's possible to pass the mount helper a server path that has more than one contiguous slash character. For example: $ mount -t ceph 192.168.195.165:40176:/// /mnt/cephfs/ In the MDS server side the extra slashes of the server path will be treated as snap dir, and then we can get the following debug logs: ceph: mount opening path // ceph: open_root_inode opening '//' ceph: fill_trace 0000000059b8a3bc is_dentry 0 is_target 1 ceph: alloc_inode 00000000dc4ca00b ceph: get_inode created new inode 00000000dc4ca00b 1.ffffffffffffffff ino 1 ceph: get_inode on 1=1.ffffffffffffffff got 00000000dc4ca00b And then when creating any new file or directory under the mount point, we can hit the following BUG_ON in ceph_fill_trace(): BUG_ON(ceph_snap(dir) != dvino.snap); Have the client ignore the extra slashes in the server path when mounting. This will also canonicalize the path, so that identical mounts can be consilidated. 1) "//mydir1///mydir//" 2) "/mydir1/mydir" 3) "/mydir1/mydir/" Regardless of the internal treatment of these paths, the kernel still stores the original string including the leading '/' for presentation to userland. URL: https://tracker.ceph.com/issues/42771 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit b38c9eb4757d5bac1eb8634a9516ef918fca2525 Author: Xiubo Li Date: Wed Dec 4 06:57:39 2019 -0500 ceph: add possible_max_rank and make the code more readable The m_num_mds here is actually the number for MDSs which are in up:active status, and it will be duplicated to m_num_active_mds, so remove it. Add possible_max_rank to the mdsmap struct and this will be the correctly possible largest rank boundary. Remove the special case for one mds in __mdsmap_get_random_mds(), because the validate mds rank may not always be 0. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 0eb308531f0776fc87f7a7eb4a8efe943d98ab8c Author: Xiubo Li Date: Wed Dec 18 21:15:18 2019 -0500 ceph: print dentry offset in hex and fix xattr_version type In the debug logs about the di->offset or ctx->pos it is in hex format, but some others are using the dec format. It is a little hard to read. For the xattr version, it is u64 type, using a shorter type may truncate it. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 9f8b72b3a9485d659410989c6daf5467ebe264ea Author: Xiubo Li Date: Mon Dec 16 00:12:07 2019 -0500 ceph: only touch the caps which have the subset mask requested For the caps having no any subset mask requested we shouldn't touch them. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 893e456b2c0bae61e172d2600a89c96abf9b3daf Author: Jeff Layton Date: Wed Dec 11 15:21:24 2019 -0500 ceph: don't clear I_NEW until inode metadata is fully populated Currently, we could have an open-by-handle (or NFS server) call into the filesystem and start working with an inode before it's properly filled out. Don't clear I_NEW until we have filled out the inode, and discard it properly if that fails. Note that we occasionally take an extra reference to the inode to ensure that we don't put the last reference in discard_new_inode, but rather leave it for ceph_async_iput. Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit c4853e9776caefbd2f59739ce1a75798a2b4b7a5 Author: Xiubo Li Date: Mon Dec 9 07:47:15 2019 -0500 ceph: retry the same mds later after the new session is opened If max_mds > 1 and a request is submitted that chooses a random mds rank, and the relating session is not opened yet, the request will wait until the session has been opened and resend again. Every time the request goes through __do_request, it will release the req->session first and choose a random one again, which may be a completely different rank than the one it just waited on. In the worst case, it will open all the mds sessions one by one just before the request can be successfully sent out. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 97820058fb2831a4b203981fa2566ceaaa396103 Author: Xiubo Li Date: Tue Dec 10 20:29:40 2019 -0500 ceph: check availability of mds cluster on mount after wait timeout If all the MDS daemons are down for some reason, then the first mount attempt will fail with EIO after the mount request times out. A mount attempt will also fail with EIO if all of the MDS's are laggy. This patch changes the code to return -EHOSTUNREACH in these situations and adds a pr_info error message to help the admin determine the cause. URL: https://tracker.ceph.com/issues/4386 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 4d681c2f9141cf50261eef85b3233151c83d068b Author: Xiubo Li Date: Thu Dec 5 22:35:51 2019 -0500 ceph: keep the session state until it is released When reconnecting the session but if it is denied by the MDS due to client was in blacklist or something else, kclient will receive a session close reply, and we will never see the important log: "ceph: mds%d reconnect denied" And with the confusing log: "ceph: handle_session mds0 close 0000000085804730 state ??? seq 0" Let's keep the session state until its memories is released. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 9cf54563b090f52db10ae6ebdca29dcc76bc7f34 Author: Xiubo Li Date: Thu Dec 5 20:50:21 2019 -0500 ceph: add __send_request helper Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 9a6bed4fe0c8bf57785cbc4db9f86086cb9b193d Author: Jeff Layton Date: Thu Dec 5 08:41:25 2019 -0500 ceph: ensure we have a new cap before continuing in fill_inode If the caller passes in a NULL cap_reservation, and we can't allocate one then ensure that we fail gracefully. Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 57c219948245cb1e8970040a365058baab450316 Author: Jeff Layton Date: Wed Dec 4 15:28:17 2019 -0500 ceph: drop unused ttl_from parameter from fill_inode Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 07edc0571ef1b13e124b462aca8d09f79809d6dd Author: Xiubo Li Date: Wed Dec 4 01:27:18 2019 -0500 ceph: fix possible long time wait during umount During umount, if there has no any unsafe request in the mdsc and some requests still in-flight and not got reply yet, and if the rest requets are all safe ones, after that even all of them in mdsc are unregistered, the umount must wait until after mount_timeout seconds anyway. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5d47648fe95412beffe2089d6d6484adb5ea0f96 Author: Xiubo Li Date: Tue Nov 26 07:24:22 2019 -0500 ceph: only choose one MDS who is in up:active state without laggy Even the MDS is in up:active state, but it also maybe laggy. Here will skip the laggy MDSs. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 4d7ace02ba5c6ef1f8eeb32a86fef7c528bd7f36 Author: Xiubo Li Date: Tue Nov 26 07:24:21 2019 -0500 ceph: fix mdsmap cluster available check based on laggy number In case the max_mds > 1 in MDS cluster and there is no any standby MDS and all the max_mds MDSs are in up:active state, if one of the up:active MDSs is dead, the m->m_num_laggy in kclient will be 1. Then the mount will fail without considering other healthy MDSs. There manybe some MDSs still "in" the cluster but not in up:active state, we will ignore them. Only when all the up:active MDSs in the cluster are laggy will treat the cluster as not be available. In case decreasing the max_mds, the cluster will not stop the extra up:active MDSs immediately and there will be a latency. During it the up:active MDS number will be larger than the max_mds, so later the m_info memories will 100% be reallocated. Here will pick out the up:active MDSs as the m_num_mds and allocate the needed memories once. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit d80865bff5201cc56bc247989ebbab6169b3a101 Author: Chengguang Xu Date: Fri Aug 17 22:05:31 2018 +0800 ceph: remove unnecessary assignment in ceph_pre_init_acls() ceph_pagelist_encode_string() will not fail in reserved case, also, we do not check err code here, so remove unnecessary assignment. Signed-off-by: Chengguang Xu Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 8f5ac172abb79171eac9ecb7bedc071b56630097 Author: Chengguang Xu Date: Thu Jul 12 16:45:08 2018 +0800 ceph: delete redundant douts in con_get/put() We print session's refcount in debug message inside ceph_put_mds_session() and get_session(), so we don't have to print it in con_get()/__ceph_lookup_mds_session()/con_put(). Signed-off-by: Chengguang Xu Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 8c30fa7666ff08dad632411d1a9b9883940e53ef Author: Brahadambal Srinivasan Date: Thu Jan 23 20:03:19 2020 +0530 Correction to manpage of cpupower Manpage of cpupower is listing wrong sub-commands in "See Also" section. The option for cpupower-idle(1) should actually be cpupower-idle-info(1) and cpupower-idle-set(1). This patch corrects this anomaly. Signed-off-by: Brahadambal Srinivasan Signed-off-by: Shuah Khan commit a832eb203ecd34e486bdde0042cf166e687eb227 Merge: 19d52e94e083 5e06d19694a4 Author: Olof Johansson Date: Mon Jan 27 07:36:40 2020 -0800 Merge tag 'davinci-for-v5.6/soc' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into arm/late DaVinci SoC updates for v5.6 include migrating DM365 SoC to use drivers/clocksource based driver for timer. This leads to removal of machine specific timer driver. There are two patches adding missing fixed regulators for audio codecs on DM365 and DM644x EVMs. * tag 'davinci-for-v5.6/soc' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: davinci: dm644x-evm: Add Fixed regulators needed for tlv320aic33 ARM: davinci: dm365-evm: Add Fixed regulators needed for tlv320aic3101 ARM: davinci: remove legacy timer support ARM: davinci: dm365: switch to using the clocksource driver clocksource: davinci: only enable clockevents once tim34 is initialized Link: https://lore.kernel.org/r/043eb5b2-a302-4de6-a3e8-8238e49483b1@ti.com/ Signed-off-by: Olof Johansson commit 057b52b4b3d58f4ee5944171da50f77b00a1bb0d Author: Marco Felsch Date: Wed Jan 15 17:23:07 2020 +0100 watchdog: da9062: make restart handler atomic safe The restart handler is executed during the shutdown phase which is atomic/irq-less. The i2c framework supports atomic transfers since commit 63b96983a5dd ("i2c: core: introduce callbacks for atomic transfers") to address this use case. Using regmap within an atomic context is allowed only if the regmap type is MMIO and the cache type 'flat' or no cache is used. Using the i2c_smbus_write_byte_data() function can be done without additional tests because: 1) the DA9062 is an i2c-only device and 2) the i2c framework emulates the smbus protocol if the host adapter does not support smbus_xfer by using the master_xfer. Signed-off-by: Marco Felsch Reviewed-by: Guenter Roeck Reviewed-by: Stefan Lengfeld Tested-by: Stefan Lengfeld Reviewed-by: Adam Thomson Link: https://lore.kernel.org/r/20200115162307.7336-1-m.felsch@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9e5236e7cec110610f3bc824a4d535c1271e4bb5 Author: yong.liang Date: Wed Jan 15 16:58:28 2020 +0800 watchdog: mtk_wdt: mt2712: Add reset controller Add reset controller for 2712. Besides watchdog, MTK toprgu module alsa provide sub-system (eg, audio, camera, codec and connectivity) software reset functionality. Signed-off-by: yong.liang Signed-off-by: Jiaxin Yu Reviewed-by: Yingjoe Chen Reviewed-by: Philipp Zabel Acked-by: Matthias Brugger Link: https://lore.kernel.org/r/20200115085828.27791-5-yong.liang@mediatek.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c254e103082b74e4f0987c364e5e3b138dbef1cc Author: yong.liang Date: Wed Jan 15 16:58:27 2020 +0800 watchdog: mtk_wdt: mt8183: Add reset controller Add reset controller API in watchdog driver. Besides watchdog, MTK toprgu module alsa provide sub-system (eg, audio, camera, codec and connectivity) software reset functionality. Signed-off-by: yong.liang Signed-off-by: Jiaxin Yu Reviewed-by: Yingjoe Chen Reviewed-by: Philipp Zabel Reviewed-by: Guenter Roeck Acked-by: Matthias Brugger Link: https://lore.kernel.org/r/20200115085828.27791-4-yong.liang@mediatek.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fe42cc30a965143a10ed7823989b7e50d7529dac Author: yong.liang Date: Wed Jan 15 16:58:26 2020 +0800 dt-bindings: mediatek: mt2712: Add #reset-cells Add #reset-cells and update mtk-wdt.txt Signed-off-by: yong.liang Signed-off-by: Jiaxin Yu Reviewed-by: Yingjoe Chen Reviewed-by: Philipp Zabel Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200115085828.27791-3-yong.liang@mediatek.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f43f97a0fc0e568a6f68480b043e8f7fdfa8fb23 Author: yong.liang Date: Wed Jan 15 16:58:25 2020 +0800 dt-bindings: mediatek: mt8183: Add #reset-cells Add #reset-cells property and update example Signed-off-by: yong.liang Signed-off-by: Jiaxin Yu Reviewed-by: Yingjoe Chen Reviewed-by: Philipp Zabel Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200115085828.27791-2-yong.liang@mediatek.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c514430c51ee83a40a31b98336d31dfaf736b9c4 Author: Marco Felsch Date: Wed Jan 8 10:57:03 2020 +0100 dt-bindings: watchdog: da9062: add suspend disable option Document the watchdog disable option which can be used if the hardware automatic suspend option is broken. Signed-off-by: Marco Felsch Reviewed-by: Adam Thomson Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200108095704.23233-3-m.felsch@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6ae58eecad31362f5caa0bd44ff7e78fbac391dd Author: Vincent Prince Date: Thu Jan 23 15:05:44 2020 +0100 watchdog: it87_wdt: add IT8786 ID IT8786 watchdog works as in IT872x Tested on VECOW ECS-9000 board. Signed-off-by: Vincent Prince Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200123140544.25937-1-vincent.prince.fr@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e7046df873548bfc87c0c594ca473226c5d3317b Author: Jack Mitchell Date: Tue Jan 7 15:51:55 2020 +0000 watchdog: dw_wdt: ping watchdog to reset countdown before start Currently on an rk3288 SoC when trying to use the watchdog the SoC will instantly reset. This is due to the watchdog countdown counter being set to its initial value of 0x0. Reset the watchdog counter before start in order to correctly start the countdown timer from the right position. Signed-off-by: Jack Mitchell Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200107155155.278521-1-ml@embed.me.uk Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 69503e585192fdd84b240f18a0873d20e18a2e0a Author: Vladis Dronov Date: Wed Jan 8 13:53:47 2020 +0100 watchdog: fix UAF in reboot notifier handling in watchdog core code After the commit 44ea39420fc9 ("drivers/watchdog: make use of devm_register_reboot_notifier()") the struct notifier_block reboot_nb in the struct watchdog_device is removed from the reboot notifiers chain at the time watchdog's chardev is closed. But at least in i6300esb.c case reboot_nb is embedded in the struct esb_dev which can be freed on its device removal and before the chardev is closed, thus UAF at reboot: [ 7.728581] esb_probe: esb_dev.watchdog_device ffff91316f91ab28 ts# uname -r note the address ^^^ 5.5.0-rc5-ae6088-wdog ts# ./openwdog0 & [1] 696 ts# opened /dev/watchdog0, sleeping 10s... ts# echo 1 > /sys/devices/pci0000\:00/0000\:00\:09.0/remove [ 178.086079] devres:rel_nodes: dev ffff91317668a0b0 data ffff91316f91ab28 esb_dev.watchdog_device.reboot_nb memory is freed here ^^^ ts# ...woken up [ 181.459010] devres:rel_nodes: dev ffff913171781000 data ffff913174a1dae8 [ 181.460195] devm_unreg_reboot_notifier: res ffff913174a1dae8 nb ffff91316f91ab78 attempt to use memory already freed ^^^ [ 181.461063] devm_unreg_reboot_notifier: nb->call 6b6b6b6b6b6b6b6b [ 181.461243] devm_unreg_reboot_notifier: nb->next 6b6b6b6b6b6b6b6b freed memory is filled with a slub poison ^^^ [1]+ Done ./openwdog0 ts# reboot [ 229.921862] systemd-shutdown[1]: Rebooting. [ 229.939265] notifier_call_chain: nb ffffffff9c6c2f20 nb->next ffffffff9c6d50c0 [ 229.943080] notifier_call_chain: nb ffffffff9c6d50c0 nb->next 6b6b6b6b6b6b6b6b [ 229.946054] notifier_call_chain: nb 6b6b6b6b6b6b6b6b INVAL [ 229.957584] general protection fault: 0000 [#1] SMP [ 229.958770] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.5.0-rc5-ae6088-wdog [ 229.960224] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... [ 229.963288] RIP: 0010:notifier_call_chain+0x66/0xd0 [ 229.969082] RSP: 0018:ffffb20dc0013d88 EFLAGS: 00010246 [ 229.970812] RAX: 000000000000002e RBX: 6b6b6b6b6b6b6b6b RCX: 00000000000008b3 [ 229.972929] RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffffffff9ccc46ac [ 229.975028] RBP: 0000000000000001 R08: 0000000000000000 R09: 00000000000008b3 [ 229.977039] R10: 0000000000000001 R11: ffffffff9c26c740 R12: 0000000000000000 [ 229.979155] R13: 6b6b6b6b6b6b6b6b R14: 0000000000000000 R15: 00000000fffffffa ... slub_debug=FZP poison ^^^ [ 229.989089] Call Trace: [ 229.990157] blocking_notifier_call_chain+0x43/0x59 [ 229.991401] kernel_restart_prepare+0x14/0x30 [ 229.992607] kernel_restart+0x9/0x30 [ 229.993800] __do_sys_reboot+0x1d2/0x210 [ 230.000149] do_syscall_64+0x3d/0x130 [ 230.001277] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 230.002639] RIP: 0033:0x7f5461bdd177 [ 230.016402] Modules linked in: i6300esb [ 230.050261] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix the crash by reverting 44ea39420fc9 so unregister_reboot_notifier() is called when watchdog device is removed. This also makes handling of the reboot notifier unified with the handling of the restart handler, which is freed with unregister_restart_handler() in the same place. Fixes: 44ea39420fc9 ("drivers/watchdog: make use of devm_register_reboot_notifier()") Cc: stable@vger.kernel.org # v4.15+ Signed-off-by: Vladis Dronov Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20200108125347.6067-1-vdronov@redhat.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b1301b9022e9769f3228a353a83bb9623c0f6e41 Author: Srinivas Neeli Date: Fri Dec 20 12:28:16 2019 +0530 watchdog: cadence: Skip printing pointer value "%p" is not printing the pointer value. In driver, printing pointer value is not useful so avoiding print. Signed-off-by: Srinivas Neeli Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1576825096-26605-1-git-send-email-srinivas.neeli@xilinx.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e0b4f4e0cf7fa9d62628d4249c765ec18dffd143 Author: Sai Prakash Ranjan Date: Fri Dec 13 12:19:34 2019 +0530 watchdog: qcom: Use platform_get_irq_optional() for bark irq platform_get_irq() prints an error message when the interrupt is not available. So on platforms where bark interrupt is not specified, following error message is observed on SDM845. [ 2.975888] qcom_wdt 17980000.watchdog: IRQ index 0 not found This is also seen on SC7180, SM8150 SoCs as well. Fix this by using platform_get_irq_optional() instead. Fixes: 36375491a4395654 ("watchdog: qcom: support pre-timeout when the bark irq is available") Signed-off-by: Sai Prakash Ranjan Reviewed-by: Bjorn Andersson Reviewed-by: Guenter Roeck Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20191213064934.4112-1-saiprakash.ranjan@codeaurora.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f6c98b08381c774a56b2f0f0067da646c23f1447 Author: Marco Felsch Date: Thu Nov 28 18:19:31 2019 +0100 watchdog: da9062: add power management ops Disable the watchdog during suspend if it is enabled and re-enable it on resume. So we can sleep without the interruptions. Signed-off-by: Marco Felsch Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191128171931.22563-1-m.felsch@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d4ba76d79854178ffff55d66e1a72580484a741d Author: Wang, Peng 1. (NSB - CN/Hangzhou) Date: Mon Nov 25 02:04:13 2019 +0000 watchdog: make DesignWare watchdog allow users to set bigger timeout value watchdog_dev.c provides means to allow users to set bigger timeout value than HW can support, make DesignWare watchdog align with this. Signed-off-by: Peng Wang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/8fa54e92c6cd4544a7a3eb60a373ac43@nokia-sbell.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 85fdc63fe256b595f923a69848cd99972ff446d8 Author: Christophe Roullier Date: Fri Nov 22 14:22:46 2019 +0100 drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe If the watchdog hardware is already enabled during the boot process, when the Linux watchdog driver loads, it should start/reset the watchdog and tell the watchdog framework. As a result, ping can be generated from the watchdog framework (if CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED is set), until the userspace watchdog daemon takes over control Fixes:4332d113c66a ("watchdog: Add STM32 IWDG driver") Signed-off-by: Christophe Roullier Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191122132246.8473-1-christophe.roullier@st.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bb44aa09e53960c0230a645144fe566e094a2a02 Author: Eugen Hristev Date: Mon Nov 18 08:50:36 2019 +0000 watchdog: sama5d4_wdt: addition of sam9x60 compatible watchdog Add support for SAM9X60 WDT into sama5d4_wdt. This means that this driver gets a flag inside the data struct that represents the sam9x60 support. This flag differentiates between the two hardware blocks, and is set according to the compatible of the driver instantiation. Signed-off-by: Eugen Hristev Reviewed-by-off-by: Guenter Roeck Link: https://lore.kernel.org/r/1574067012-18559-3-git-send-email-eugen.hristev@microchip.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fef684af392b91ade9c83f7ed0f8164af2aae142 Merge: a09ac40e420d 8f2828d73724 Author: Jiri Kosina Date: Mon Jan 27 15:49:49 2020 +0100 Merge branch 'for-5.6/logitech' into for-linus - voltage support for newer Logitech HID++ devices, from Pedro Vanzella. - MX Master support improvements, from Adrian Freund and Mazin Rezk commit a09ac40e420d547f58a40608f05a3a3b3a538ce8 Merge: 9e635c2851df 2f48865db332 Author: Jiri Kosina Date: Mon Jan 27 15:49:30 2020 +0100 Merge branch 'for-5.6/hidraw' into for-linus - support for uniq ioctl() commit 2f23e319b133c7392493e77f515a237c8e1e6dd6 Author: Pascal Paillet Date: Fri Jan 10 11:16:05 2020 +0100 thermal: stm32: Fix low threshold interrupt flood With the STM32 thermal peripheral, it is not possible to dump the temperature that has caused the interrupt. When the temperature reaches the low threshold, we generally read a temperature that is a little bit higher than the low threshold. This maybe due to sampling precision, and also because the CPU becomes hotter when it quits WFI mode. In that case, the framework does not change the trip points. This leads to a lot of low threshold interrupts. The fix is to set the low threshold value 0.5 degrees Celsius below the actual request. The problem is not so frequent with the high threshold and it would no be a good idea to set the threshold value higher than the request. Signed-off-by: Pascal Paillet Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200110101605.24984-7-p.paillet@st.com commit 9d8593f22ea33a88f89075b14fc58a95fc15b8ae Author: Pascal Paillet Date: Fri Jan 10 11:16:04 2020 +0100 thermal: stm32: Improve temperature computing Change the way of computing to avoid rounds by 1 or 2 degrees. Also simplify the sampling time management that is hard-coded to maximum value during probe. Signed-off-by: Pascal Paillet Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200110101605.24984-6-p.paillet@st.com commit dd4c3919a83074683aab3c1950c69e1131f3c46e Author: Pascal Paillet Date: Fri Jan 10 11:16:03 2020 +0100 thermal: stm32: Handle multiple trip points Let the thermal framework handle the trip points instead of custom code inside the driver. This is backward compatible, simplifies the driver and offers the possibility to the user to set any trip point he needs. stm_thermal_set_trips callback that is registered to set_trips ops to handle the low and high thresholds and replaces stm_thermal_set_threshold and stm_thermal_update_threshold functions. modify irq enable to handle the thresholds. Signed-off-by: Pascal Paillet Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200110101605.24984-5-p.paillet@st.com commit 1f64fa365148f003e39b28a86ce3ada020ea3eec Author: Pascal Paillet Date: Fri Jan 10 11:16:02 2020 +0100 thermal: stm32: Disable interrupts at probe In case of CPU reset, the interrupts could be enabled at boot time. Disable interrupts and clear flags. Signed-off-by: Pascal Paillet Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200110101605.24984-4-p.paillet@st.com commit d4a7e0538fe957fc78187468fa404060da7fa6f4 Author: Pascal Paillet Date: Fri Jan 10 11:16:01 2020 +0100 thermal: stm32: Rework sensor mode management Be sure get_temp returns an error while disabling or enabling the device. Set THERMAL_DEVICE_ENABLED state at the end of power on function. Set THERMAL_DEVICE_DISABLED state at the beginning of power off function. Signed-off-by: Pascal Paillet Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200110101605.24984-3-p.paillet@st.com commit d401652c1c92f164bc5590548aa3a90f4636af89 Author: Pascal Paillet Date: Fri Jan 10 11:16:00 2020 +0100 thermal: stm32: Fix icifr register name Fix a mistake with the ICIFR register name. Signed-off-by: Pascal Paillet Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200110101605.24984-2-p.paillet@st.com commit 370f995d587852dc8da4ce5687acae8be61d7529 Author: Peter Mamonov Date: Tue Aug 27 17:39:52 2019 +0300 thermal: of: Make thermal_zone_of_sensor_register return -ENODEV if a sensor OF node is missing When devm_thermal_zone_of_sensor_register() is called from hwmon_thermal_add_sensor() it is possible that the relevant sensor is missing an OF node. In this case thermal_zone_of_sensor_register() returns -EINVAL which causes hwmon_thermal_add_sensor() to fail as well. This patch changes relevant return code of thermal_zone_of_sensor_register() to -ENODEV, which is tolerated by hwmon_thermal_add_sensor(). Here is a particular case of such behaviour: the Marvell ethernet PHYs driver registers hwmon device for the built-in temperature sensor (see drivers/net/phy/marvell.c). Since the sensor doesn't have associated OF node devm_hwmon_device_register() returns error which ultimately causes failure of the PHY driver's probe function. Signed-off-by: Peter Mamonov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20190827143952.19591-1-pmamonov@gmail.com commit 1754c4f60aaf1e17d886afefee97e94d7f27b4cb Author: Nicolai Stange Date: Tue Jan 14 11:39:03 2020 +0100 libertas: make lbs_ibss_join_existing() return error code on rates overflow Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor") introduced a bounds check on the number of supplied rates to lbs_ibss_join_existing() and made it to return on overflow. However, the aforementioned commit doesn't set the return value accordingly and thus, lbs_ibss_join_existing() would return with zero even though it failed. Make lbs_ibss_join_existing return -EINVAL in case the bounds check on the number of supplied rates fails. Fixes: e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor") Signed-off-by: Nicolai Stange Signed-off-by: Kalle Valo commit c7bf1fb7ddca331780b9a733ae308737b39f1ad4 Author: Nicolai Stange Date: Tue Jan 14 11:39:02 2020 +0100 libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor") introduced a bounds check on the number of supplied rates to lbs_ibss_join_existing(). Unfortunately, it introduced a return path from within a RCU read side critical section without a corresponding rcu_read_unlock(). Fix this. Fixes: e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor") Signed-off-by: Nicolai Stange Signed-off-by: Kalle Valo commit b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d Author: Qing Xu Date: Thu Jan 2 10:39:27 2020 +0800 mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking the destination size may trigger a buffer overflower, which a local user could use to cause denial of service or the execution of arbitrary code. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu Signed-off-by: Kalle Valo commit 3a9b153c5591548612c3955c9600a98150c81875 Author: Qing Xu Date: Thu Jan 2 10:39:26 2020 +0800 mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() mwifiex_ret_wmm_get_status() calls memcpy() without checking the destination size.Since the source is given from remote AP which contains illegal wmm elements , this may trigger a heap buffer overflow. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu Signed-off-by: Kalle Valo commit 65b1aae0d9d5962faccc06bdb8e91a2a0b09451c Author: Brian Norris Date: Mon Jan 6 14:42:12 2020 -0800 mwifiex: fix unbalanced locking in mwifiex_process_country_ie() We called rcu_read_lock(), so we need to call rcu_read_unlock() before we return. Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") Cc: stable@vger.kernel.org Cc: huangwen Cc: Ganapathi Bhat Signed-off-by: Brian Norris Acked-by: Ganapathi Bhat Signed-off-by: Kalle Valo commit 8e5aa6173ad3ef794e52afa2bb56451db18642b9 Merge: 3d4864b30bed 2d22bc8354b1 Author: David S. Miller Date: Mon Jan 27 14:35:40 2020 +0100 Merge branch 'qed-Utilize-FW-8.42.2.0' Michal Kalderon says: ==================== qed*: Utilize FW 8.42.2.0 This FW contains several fixes and features, main ones listed below. We have taken into consideration past comments on previous FW versions that were uploaded and tried to separate this one to smaller patches to ease review. - RoCE - SRIOV support - Fixes in following flows: - latency optimization flow for inline WQEs - iwarp OOO packed DDPs flow - tx-dif workaround calculations flow - XRC-SRQ exceed cache num - iSCSI - Fixes: - iSCSI TCP out-of-order handling. - iscsi retransmit flow - Fcoe - Fixes: - upload + cleanup flows - Debug - Better handling of extracting data during traffic - ILT Dump -> dumping host memory used by chip - MDUMP -> collect debug data on system crash and extract after reboot Patches prefixed with FW 8.42.2.0 are required to work with binary 8.42.2.0 FW where as the rest are FW related but do not require the binary. Changes from V2 --------------- - Move FW version to the start of the series to maintain minimal compatibility - Fix some kbuild errors: - frame size larger than 1024 (Queue Manager patch - remove redundant field from struct) - sparse warning on endianity (Dmae patch fix - wrong use of __le32 for field used only on host, should be u32) - static should be used for some functions (Debug feature ilt and mdump) Reported-by: kbuild test robot Changes from V1 --------------- - Remove epoch + kernel version from device debug dump - don't bump driver version ==================== Signed-off-by: David S. Miller commit 2d22bc8354b15abe413dff76cfe0f7aeb88ef9aa Author: Michal Kalderon Date: Mon Jan 27 15:26:19 2020 +0200 qed: FW 8.42.2.0 debug features Add to debug dump more information on the platform it was collected from (pci func, path id). Provide human readable reg fifo erros. Removed static debug arrays from HSI Functions, and move them to the hwfn. Some structures were slightly changed (removing reserved chip id for example) which lead to many long initializations being modified with one parameter less during initialization. This leads to some long diffs that don't really change anything. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 6bc82d9b7e6371673992ed5e3897cf7fb8cc4f41 Author: Michal Kalderon Date: Mon Jan 27 15:26:18 2020 +0200 qed: rt init valid initialization changed The QM phase init tool can be invoked multiple times during the driver lifetime. Part of the init comes from the runtime array. The logic for setting the values did not init all values, basically assuming the runtime array was all zeroes. But if it was invoked multiple times, nobody was zeroing it after the first time. In this change we zero the runtime array right after using it. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 8a52bbab39c9791480cbae86c69ad0d47f62972e Author: Michal Kalderon Date: Mon Jan 27 15:26:17 2020 +0200 qed: Debug feature: ilt and mdump Part of the FW drop includes new debug capabilities implemented in the qed_debug file. This patch dumps additional information during ethtool -d for better debugging. The data dumped is the ilt (internal logical table) and information gathered by the management firmware incase there was a crash and driver was not able to extract the information (mdump). Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 30d5f85895fad1b3fec34b86cb779d4f56f85e32 Author: Michal Kalderon Date: Mon Jan 27 15:26:16 2020 +0200 qed: FW 8.42.2.0 Add fw overlay feature This feature enables the FW to page out FW code when required Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 0500a70d6e071040ffdaadebb966986afa83c5e9 Author: Michal Kalderon Date: Mon Jan 27 15:26:15 2020 +0200 qed: FW 8.42.2.0 HSI changes This patch contains several HSI changes. The changes are part of features like RDMA VF and OVS, the patch also contains a fix to how the init code determines if the dmae is ready to be used. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 6459d93619b5bc21f775e7eb12bc4d051743d7aa Author: Michal Kalderon Date: Mon Jan 27 15:26:14 2020 +0200 qed: FW 8.42.2.0 iscsi/fcoe changes - Remove struct iscsi_slow_path_hdr and field fw_cid from several structs - Remove struct iscsi_spe_func_dstry - Remove fields pbe_page_size_log and pbl_page_size_log from struct iscsi_conn_offload_param Signed-off-by: Manish Rangankar Signed-off-by: Saurav Kashyap Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 1392d19ff1d6ddd370cefa73b552a0262f9c35ea Author: Michal Kalderon Date: Mon Jan 27 15:26:13 2020 +0200 qed: Add abstraction for different hsi values per chip The number of BTB blocks was modified to be different between the two chip flavors supported (BB/K2) as a result, this lead to a re-write of selecting the default hsi value based on the chip. This patch creates a lookup table for hsi values per chip rather than ask again and again for every value. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 997af5df230e3288ec1f5b332955f9be643e450b Author: Michal Kalderon Date: Mon Jan 27 15:26:12 2020 +0200 qed: FW 8.42.2.0 Additional ll2 type LL2 queues were a limited resource due to FW constraints. This FW introduced a new resource which is a context based ll2 queue (memory on host). The additional ll2 queues are required for RDMA SRIOV. The code refers to the previous ll2 queues as ram-based or legacy, and the new queues as ctx-based. This change decreased the "legacy" ram-based queues therefore the first ll2 queue used for iWARP was converted to the ctx-based ll2 queue. This feature also exposed a bug in the DIRECT_REG_WR64 macro implementation which didn't have an effect in other use cases. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 804c5702fc583afbdb6860f79e9d4058570ccc43 Author: Michal Kalderon Date: Mon Jan 27 15:26:11 2020 +0200 qed: Use dmae to write to widebus registers in fw_funcs There are several wide-bus registers written to by the fw_funcs that require using the dmae for atomicity. Therefore using the dmae channel functionality was added to the fw_funcs file, since the code is very similar to the previously used code, the structures used were moved to qed_hsi. Due to FW conventions, the names of the flags in the struct changed. Since this required slight modification in the places that set the flags the code was modified to use GET/SET FIELD macros. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 63ddca3052ce2397ffd71899390d552cd40ddb6f Author: Michal Kalderon Date: Mon Jan 27 15:26:10 2020 +0200 qed: FW 8.42.2.0 Parser offsets modified Convert storm ram line to regpair rather than two distinct u32 to better represent the u64 width of the ram. Convert some defines to be hex instead of negative values these values also changed by FW from previous value. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 92fae6fb231f66ce0e71ed348e788180c1a603f9 Author: Michal Kalderon Date: Mon Jan 27 15:26:09 2020 +0200 qed: FW 8.42.2.0 Queue Manager changes This patch contains changes in initialization and usage of the QM blocks. Instead of setting a rate limiter per vport the rate limiters are now a global resource and set independentaly. The patch also contains a field name change: vport_wfq which is part of vport_params was renamed to wfq as the vport prefix is redundant. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 6aebde8dc767088a3171b864755f26ceae2f8bc7 Author: Michal Kalderon Date: Mon Jan 27 15:26:08 2020 +0200 qed: FW 8.42.2.0 Expose new registers and change windows This patch contains register initialization related changes. - Modifications to the runtime offsets - these are defines used by the driver or firmware functions to set values that are used by the initialization functions to set device register values. - Global window values changes to provide different device register ranges. - Additional device registers addresses were added to the register file, used in later stages. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 2924e0699963b839f88f8c4e855929ea49185870 Author: Michal Kalderon Date: Mon Jan 27 15:26:07 2020 +0200 qed: FW 8.42.2.0 Internal ram offsets modifications IRO stands for internal RAM offsets. Updating the FW binary produces different iro offsets. This file contains the different values, and a new representation of the values. Update the FW version Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 3d4864b30bed73ebfcffd45771c28bdc89e2a07e Merge: 9e0703a2650d 688b3e829d60 Author: David S. Miller Date: Mon Jan 27 14:33:40 2020 +0100 Merge branch 'octeontx2-pf-Add-network-driver-for-physical-function' Sunil Goutham says: ==================== octeontx2-pf: Add network driver for physical function OcteonTX2 SOC's resource virtualization unit (RVU) supports multiple physical and virtual functions. Each of the PF's functionality is determined by what kind of resources are attached to it. If NPA and NIX blocks are attached to a PF it can function as a highly capable network device. This patch series add a network driver for the PF. Initial set of patches adds mailbox communication with admin function (RVU AF) and configuration of queues. Followed by Rx and tx pkts NAPI handler and then support for HW offloads like RSS, TSO, Rxhash etc. Ethtool support to extract stats, config RSS, queue sizes, queue count is also added. Added documentation to give a high level overview of HW and different drivers which will be upstreamed and how they interact. Changes from v5: * Fixed otx2_atomic64_add() non ARM64 fallback definition. - Suggested by David Miller Changes from v4: * Replaced pci_set_dma_mask and pci_set_consistent_dma_mask fn()s with dma_set_mask_and_coherent(). * Some additonal code cleanup. * Fixed receive buffer segmnetation logic in otx2_alloc_rbuf() * Removed all unused BIG_ENDIAN structure definitions. * Removed unnecessary memory barriers - Sugested by Jakub Kicinski * Fixed mailbox initalization failure handling * Removed unused function parameter in otx2_skb_add_frag() - Suggested by Maciej Fijalkowski Changes from v3: * Fixed receive side scaling reinitialization during interface DOWN and UP to retain user configured settings, if any. * Removed driver version from ethtool. * Fixed otx2_set_rss_hash_opts() to return error incase RSS is not enabled. - Sugested by Jakub Kicinski Changes from v2: * Removed frames, bytes, dropped packet stats from ethtool to avoid duplication of same stats in netlink and ethtool. - Sugested by Jakub Kicinski * Removed number of channels and ringparam upper bound checking in ethtool support. * Fixed RSS hash option setting to reject unsupported config. - Suggested by Michal Kubecek Changes from v1: * Made driver dependent on 64bit, to fix build errors related to non availability of writeq/readq APIs for 32bit platforms. - Reported by kbuild test robot ==================== Signed-off-by: David S. Miller commit 688b3e829d60a290c9a0a2c8b0b99f816ed37a8c Author: Sunil Goutham Date: Mon Jan 27 18:35:31 2020 +0530 MAINTAINERS: Add entry for Marvell OcteonTX2 Physical Function driver Added maintainers entry for Marvell OcteonTX2 SOC's physical function NIC driver. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 493aeb26e12ad4f0f7ad7f320b5706b6902e6eed Author: Sunil Goutham Date: Mon Jan 27 18:35:30 2020 +0530 Documentation: net: octeontx2: Add RVU HW and drivers overview Added high level overview of OcteonTx2 RVU HW and functionality of various drivers which will be upstreamed. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 6e92d71bf88208ddcbd48b3c831c0e394d0f56e2 Author: Sunil Goutham Date: Mon Jan 27 18:35:29 2020 +0530 octeontx2-pf: ethtool RSS config support Added support to show or configure RSS hash key, indirection table, 2,4 tuple via ethtool. Also added debug msg_level support to dump messages when HW reports errors in packet received or transmitted. Signed-off-by: Prakash Brahmajyosyula Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit d45d8979840d9c9ac93d3fe8cfc8e794b7228445 Author: Christina Jacob Date: Mon Jan 27 18:35:28 2020 +0530 octeontx2-pf: Add basic ethtool support This patch adds ethtool support for - Driver stats, Tx/Rx perqueue and CGX LMAC stats - Set/show Rx/Tx queue count - Set/show Rx/Tx ring sizes - Set/show IRQ coalescing parameters Signed-off-by: Christina Jacob Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit e239d0c78c42e49558ea2c0e5857c4f9ca064f48 Author: Geetha sowjanya Date: Mon Jan 27 18:35:27 2020 +0530 octeontx2-pf: Add ndo_get_stats64 Added ndo_get_stats64 which returns stats maintained by HW. Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 86d7476078b87874ce5dee39cbbd094055c73d49 Author: Sunil Goutham Date: Mon Jan 27 18:35:26 2020 +0530 octeontx2-pf: TCP segmentation offload support Adds TCP segmentation offload (TSO) support. First version of the silicon didn't support TSO offload, for this driver level TSO support is added. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 85069e95e53161f8bcc1aa266f47c60c1f3e4ec3 Author: Sunil Goutham Date: Mon Jan 27 18:35:25 2020 +0530 octeontx2-pf: Receive side scaling support Adds receive side scaling (RSS) support to distribute pkts/flows across multiple queues. Sets up key, indirection table etc. Also added extraction of HW calculated rxhash and adding to same to SKB ie NETIF_F_RXHASH offload support. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 4ff7d1488a8496fddcfdf40c42489eaa64892f3e Author: Geetha sowjanya Date: Mon Jan 27 18:35:24 2020 +0530 octeontx2-pf: Error handling support HW reports many errors on the receive and transmit paths. Such as incorrect queue configuration, pkt transmission errors, LMTST instruction errors, transmit queue full etc. These are reported via QINT interrupt. Most of the errors are fatal and needs reinitialization. Also added support to allocate receive buffers in non-atomic context when allocation fails in NAPI context. Signed-off-by: Geetha sowjanya Signed-off-by: Aleksey Makarov Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 34bfe0ebedb76aeb964341d96cf7c5135d14e1bf Author: Sunil Goutham Date: Mon Jan 27 18:35:23 2020 +0530 octeontx2-pf: MTU, MAC and RX mode config support This patch addes support to change interface MTU, MAC address retrieval and config, RX mode ie unicast, multicast and promiscuous. Also added link loopback support Signed-off-by: Tomasz Duszynski Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 50fe6c02e5ad50727fb1069bb31099385fb59883 Author: Linu Cherian Date: Mon Jan 27 18:35:22 2020 +0530 octeontx2-pf: Register and handle link notifications PF and AF (admin function) shares 64KB of reserved memory region for communication. This region is shared for - Messages sent by PF and responses sent by AF. - Notifications sent by AF and ACKs sent by PF. This patch adds infrastructure to handle notifications sent by AF and adds handlers to process them. One of the main usecase of notifications from AF is physical link changes. So this patch adds registration of PF with AF to receive link status change notifications and also adds the handler for that notification. Signed-off-by: Linu Cherian Signed-off-by: Tomasz Duszynski Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 3ca6c4c882a7f34085b170d93cf0d0e843aa00e6 Author: Sunil Goutham Date: Mon Jan 27 18:35:21 2020 +0530 octeontx2-pf: Add packet transmission support This patch adds the packet transmission support. For a given skb prepares send queue descriptors (SQEs) and pushes them to HW. Here driver doesn't maintain it's own SQ rings, SQEs are pushed to HW using a silicon specific operations called LMTST. From the instuction HW derives the transmit queue number and queues the SQE to that queue. These LMTST instructions are designed to avoid queue maintenance in SW and lockless behavior ie when multiple cores are trying to add SQEs to same queue then HW will takecare of serialization, no need for SW to hold locks. Also supports scatter/gather. Co-developed-by: Geetha sowjanya Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit abe0254333124598d1e7452c19e9e753c6bfaada Author: Sunil Goutham Date: Mon Jan 27 18:35:20 2020 +0530 octeontx2-pf: Receive packet handling support Added receive packet handling (NAPI) support, error stats, RX_ALL capability config option to passon error pkts to stack upon user request. In subsequent patches these error stats will be added to ethttool. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 04a21ef303df74737259190d7d7cf77a129bb56a Author: Sunil Goutham Date: Mon Jan 27 18:35:19 2020 +0530 octeontx2-pf: Setup interrupts and NAPI handler Completion queue (CQ) is the one with which HW notifies SW on a packet reception or transmission. Each of the RQ and SQ are mapped to a unique CQ and again both CQs are mapped to same interrupt ie the CINT. So that each core has one interrupt source in whose handler both Rx and Tx notifications are processed. Also - Registered a NAPI handler for the CINT. - Setup coalescing parameters. - IRQ affinity hints etc Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit caa2da34fd25a37e9fd43343b6966fb9d730a6d5 Author: Sunil Goutham Date: Mon Jan 27 18:35:18 2020 +0530 octeontx2-pf: Initialize and config queues This patch does the initialization of all queues ie the receive buffer pools, receive and transmit queues, completion or notification queues etc. Allocates all required resources (eg transmit schedulers, receive buffers etc) and configures them for proper functioning of queues. Also sets up receive queue's RED dropping levels. Co-developed-by: Geetha sowjanya Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 05fcc9e08955b7c04afb7f53402902f4a86e553c Author: Sunil Goutham Date: Mon Jan 27 18:35:17 2020 +0530 octeontx2-pf: Attach NIX and NPA block LFs For a PF to function as a NIC, NPA (for Rx buffers, Tx descriptors etc) and NIX (for rcv, send and completion queues) are the minimum resources needed. So request admin function (AF) to attach one each of NIX and NPA block LFs (local functions). Only AF can configure a LF's contexts, so request AF to allocate memory for NPA aura/pool and NIX RQ/SQ/CQ HW contexts. Upon receiving response, save some of the HW constants like number of pointers per stack page, size of send queue buffer (SQBs, where SQEs are queued by HW) e.t.c which are later used to initialize queues. A HW context here is like a state machine maintained for a descriptor queue. eg size, head/tail pointers, irq etc etc. HW maintains this in memory. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 5a6d7c9daef392370d873f8a626bb525629cdd6a Author: Sunil Goutham Date: Mon Jan 27 18:35:16 2020 +0530 octeontx2-pf: Mailbox communication with AF In the resource virtualization unit (RVU) each of the PF and AF (admin function) share a 64KB of reserved memory region for communication. This patch initializes PF <=> AF mailbox IRQs, registers handlers for processing these communication messages. Also adds support to process these messages in both directions ie responses to PF initiated DOWN (PF => AF) messages and AF initiated UP messages (AF => PF). Mbox communication APIs and message formats are defined in AF driver (drivers/net/ethernet/marvell/octeontx2/af), mbox.h from AF driver is included here to avoid duplication. Signed-off-by: Geetha sowjanya Signed-off-by: Christina Jacob Signed-off-by: Subbaraya Sundeep Signed-off-by: Aleksey Makarov Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 165475779ba1d4758429f48d65960473df9dc35a Author: Sunil Goutham Date: Mon Jan 27 18:35:15 2020 +0530 octeontx2-pf: Add Marvell OcteonTX2 NIC driver This patch adds template for the Marvell's OcteonTX2 network controller's physical function driver. Just the probe, PCI specific initialization and netdev registration. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 9e0703a2650def6fffe91235a880bb6f37d9ad74 Merge: c312840cd790 82650dab9a5a Author: David S. Miller Date: Mon Jan 27 14:31:40 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2020-01-27 The following pull-request contains BPF updates for your *net-next* tree. We've added 20 non-merge commits during the last 5 day(s) which contain a total of 24 files changed, 433 insertions(+), 104 deletions(-). The main changes are: 1) Make BPF trampolines and dispatcher aware for the stack unwinder, from Jiri Olsa. 2) Improve handling of failed CO-RE relocations in libbpf, from Andrii Nakryiko. 3) Several fixes to BPF sockmap and reuseport selftests, from Lorenz Bauer. 4) Various cleanups in BPF devmap's XDP flush code, from John Fastabend. 5) Fix BPF flow dissector when used with port ranges, from Yoshiki Komachi. 6) Fix bpffs' map_seq_next callback to always inc position index, from Vasily Averin. 7) Allow overriding LLVM tooling for runqslower utility, from Andrey Ignatov. 8) Silence false-positive lockdep splats in devmap hash lookup, from Amol Grover. 9) Fix fentry/fexit selftests to initialize a variable before use, from John Sperbeck. ==================== Signed-off-by: David S. Miller commit c312840cd79061af37158cb42590931cfa364c1b Author: David S. Miller Date: Mon Jan 27 13:49:33 2020 +0100 Revert "pktgen: Allow configuration of IPv6 source address range" This reverts commit 7786a1af2a6bceb07860ec720e74714004438834. It causes build failures on 32-bit, for example: net/core/pktgen.o: In function `mod_cur_headers': >> pktgen.c:(.text.mod_cur_headers+0xba0): undefined reference to `__umoddi3' Signed-off-by: David S. Miller commit 6a7e25c7fb482dba3e80fec953f1907bcb24d52c Author: Leon Romanovsky Date: Mon Jan 27 09:20:28 2020 +0200 net/core: Replace driver version to be kernel version In order to stop useless driver version bumps and unify output presented by ethtool -i, let's set default version string. As Linus said in [1]: "Things are supposed to be backwards and forwards compatible, because we don't accept breakage in user space anyway. So versioning is pointless, and only causes problems." They cause problems when users start to see version changes and expect specific set of features which will be different for stable@, vanilla and distribution kernels. Distribution kernels are based on some kernel version with extra patches on top, for example, in RedHat world this "extra" is a lot and for them your driver version say nothing. Users who run vanilla kernels won't use driver version information too, because running such kernels requires knowledge and understanding. Another set of problems are related to difference in versioning scheme and such doesn't allow to write meaningful automation which will work sanely on all ethtool capable devices. Before this change: [leonro@erver ~]$ ethtool -i eth0 driver: virtio_net version: 1.0.0 After this change and once ->version assignment will be deleted from virtio_net: [leonro@server ~]$ ethtool -i eth0 driver: virtio_net version: 5.5.0-rc6+ Link: https://lore.kernel.org/ksummit-discuss/CA+55aFx9A=5cc0QZ7CySC4F2K7eYaEfzkdYEc9JaNgCcV25=rg@mail.gmail.com/ Link: https://lore.kernel.org/linux-rdma/20200122152627.14903-1-michal.kalderon@marvell.com/T/#md460ff8f976c532a89d6860411c3c50bb811038b Link: https://lore.kernel.org/linux-rdma/20200127060835.GA570@unicorn.suse.cz Signed-off-by: Leon Romanovsky Acked-by: Shannon Nelson Signed-off-by: David S. Miller commit 7d9996870ae49b4febe8b6ac458a2f8f70cea132 Merge: 4d94e4350e11 6c77065bbdff Author: David S. Miller Date: Mon Jan 27 13:05:43 2020 +0100 Merge branch 'sfc-refactor-mcdi-filtering-code' Alex Maftei says: ==================== sfc: refactor mcdi filtering code Splitting final bits of the driver code into different files, which will later be used in another driver for a new product. This is a continuation to my previous patch series. (three of them) Refactoring will be concluded with this series, for now. As instructed, split the renaming and moving into different patches. Removed stray spaces before tabs... twice. Minor refactoring was done with the renaming, as explained in the first patch. ==================== Signed-off-by: David S. Miller commit 6c77065bbdff817cea4c391720b120d4dd81e1c8 Author: Alex Maftei (amaftei) Date: Mon Jan 27 11:13:55 2020 +0000 sfc: move mcdi filtering code Signed-off-by: Alexandru-Mihai Maftei Signed-off-by: David S. Miller commit 00aaf7e56f890b0b5fd4568ad0d82c6c1d89a2d4 Author: Alex Maftei (amaftei) Date: Mon Jan 27 11:13:40 2020 +0000 sfc: create header for mcdi filtering code Moved structs, enums, and added function prototypes. The affected functions are no longer static. Signed-off-by: Alexandru-Mihai Maftei Signed-off-by: David S. Miller commit 90c914d2a39367b18b25b67b0a69335df8b92d56 Author: Alex Maftei (amaftei) Date: Mon Jan 27 11:13:27 2020 +0000 sfc: rename mcdi filtering functions/structs Minor style fixes included due to name lengths changing. Signed-off-by: Alexandru-Mihai Maftei Signed-off-by: David S. Miller commit 21613cfad181c882b1effd227dcfbddc61dc80f7 Author: Christophe Leroy Date: Tue Jan 14 17:54:04 2020 +0000 powerpc/32: Reuse orphaned memblocks in kasan_init_shadow_page_tables() If concurrent PMD population has happened, re-use orphaned memblocks. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b29ffffb9206dc14541fa420c17604240728041b.1579024426.git.christophe.leroy@c-s.fr commit 509cd3f2b473330238c768bb21a4f2cdc80393fa Author: Christophe Leroy Date: Tue Jan 14 17:54:03 2020 +0000 powerpc/32: Simplify KASAN init Since kasan_init_region() is not used anymore for modules, KASAN init is done while slab_is_available() is false. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/84b27bf08b41c8343efd88e10f2eccd8e9f85593.1579024426.git.christophe.leroy@c-s.fr commit 47febbeeec440eec213960e3d25c57a8312d5340 Author: Christophe Leroy Date: Tue Jan 14 17:54:02 2020 +0000 powerpc/32: Force KASAN_VMALLOC for modules Unloading/Reloading of modules seems to fail with KASAN_VMALLOC but works properly with it. Force selection of KASAN_VMALLOC when MODULES are selected, and drop module_alloc() which was dedicated to KASAN for modules. Reported-by: Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://bugzilla.kernel.org/show_bug.cgi?id=205283 Link: https://lore.kernel.org/r/f909da11aecb59ab7f32ba01fae6f356eaa4d7bc.1579024426.git.christophe.leroy@c-s.fr commit af1725d2493dcad4eeb7e63141678181fcd8a2ff Author: Christophe Leroy Date: Tue Jan 14 17:54:01 2020 +0000 powerpc/kconfig: Move CONFIG_PPC32 into Kconfig.cputype Move CONFIG_PPC32 at the same place as CONFIG_PPC64 for consistency. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/6f28085c2a1aa987093d50db17586633bbf8e206.1579024426.git.christophe.leroy@c-s.fr commit 3d4247fcc938d0ab5cf6fdb752dae07fdeab9736 Author: Christophe Leroy Date: Tue Jan 14 17:54:00 2020 +0000 powerpc/32: Add support of KASAN_VMALLOC Add support of KASAN_VMALLOC on PPC32. To allow this, the early shadow covering the VMALLOC space need to be removed once high_memory var is set and before freeing memblock. And the VMALLOC area need to be aligned such that boundaries are covered by a full shadow page. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/031dec5487bde9b2181c8b3c9800e1879cf98c1a.1579024426.git.christophe.leroy@c-s.fr commit 0f9aee0cb9da7db7d96f63cfa2dc5e4f1bffeb87 Author: Christophe Leroy Date: Mon Dec 23 07:54:22 2019 +0000 powerpc/mm: Don't log user reads to 0xffffffff Running vdsotest leaves many times the following log: [ 79.629901] vdsotest[396]: User access of kernel address (ffffffff) - exploit attempt? (uid: 0) A pointer set to (-1) is likely a programming error similar to a NULL pointer and is not worth logging as an exploit attempt. Don't log user accesses to 0xffffffff. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/0728849e826ba16f1fbd6fa7f5c6cc87bd64e097.1577087627.git.christophe.leroy@c-s.fr commit cd08f109e26231b279bcc0388428afcac6408ec6 Author: Christophe Leroy Date: Sat Dec 21 08:32:38 2019 +0000 powerpc/32s: Enable CONFIG_VMAP_STACK A few changes to retrieve DAR and DSISR from struct regs instead of retrieving them directly, as they may have changed due to a TLB miss. Also modifies hash_page() and friends to work with virtual data addresses instead of physical ones. Same on load_up_fpu() and load_up_altivec(). Signed-off-by: Christophe Leroy [mpe: Fix tovirt_vmstack call in head_32.S to fix CHRP build] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/2e2509a242fd5f3e23df4a06530c18060c4d321e.1576916812.git.christophe.leroy@c-s.fr commit 94dd54c51a410b9ffa6356c3ed2ab0317f998ded Author: Christophe Leroy Date: Sat Dec 21 08:32:37 2019 +0000 powerpc/32s: Avoid crossing page boundary while changing SRR0/1. Trying VMAP_STACK with KVM, vmlinux was not starting. This was due to SRR0 and SRR1 clobbered by an ISI due to the rfi being in a different page than the mtsrr0/1: c0003fe0 : c0003fe0: 38 83 00 54 addi r4,r3,84 c0003fe4: 7c 60 00 a6 mfmsr r3 c0003fe8: 70 60 00 30 andi. r0,r3,48 c0003fec: 4d 82 00 20 beqlr c0003ff0: 7c 63 00 78 andc r3,r3,r0 c0003ff4: 7c 9a 03 a6 mtsrr0 r4 c0003ff8: 7c 7b 03 a6 mtsrr1 r3 c0003ffc: 7c 00 04 ac hwsync c0004000: 4c 00 00 64 rfi Align the 4 instruction block used to deactivate MMU to order 4, so that the block never crosses a page boundary. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/30d2cda111b7977227fff067fa7e358440e2b3a4.1576916812.git.christophe.leroy@c-s.fr commit 2e15001ea9ea110837a6eb6dba518416dedb4c39 Author: Christophe Leroy Date: Sat Dec 21 08:32:36 2019 +0000 powerpc/32s: Reorganise DSI handler. The part decidated to handling hash_page() is fully unneeded for processors not having real hash pages like the 603. Lets enlarge the content of the feature fixup, and provide an alternative which jumps directly instead of getting NIPs. Also, in preparation of VMAP stacks, the end of DSI handler has moved to later in the code as it won't fit anymore once VMAP stacks are there. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c31b22c91af8b011d0a4fd9e52ad6afb4b593f71.1576916812.git.christophe.leroy@c-s.fr commit 99b229161f8d99742cdfd6be21059ebd9eb7b696 Author: Christophe Leroy Date: Sat Dec 21 08:32:35 2019 +0000 powerpc/8xx: Enable CONFIG_VMAP_STACK This patch enables CONFIG_VMAP_STACK. For that, a few changes are done in head_8xx.S. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d7ba1e34e80898310d6a314cbebe48baa32894ef.1576916812.git.christophe.leroy@c-s.fr commit d52668f6b3e052fa97e93e536c492f5880c73474 Author: Michael Ellerman Date: Sun Jan 26 00:20:16 2020 +1100 powerpc/8xx: Move tail of alignment exception out of line When we enable VMAP_STACK there will not be enough room for the alignment handler at 0x600 in head_8xx.S. For now move the tail of the alignment handler out of line, and branch to it. Suggested-by: Christophe Leroy Signed-off-by: Michael Ellerman commit afe1ec5ab83029baf0f8368a255dc6b998bde576 Author: Christophe Leroy Date: Sat Dec 21 08:32:34 2019 +0000 powerpc/8xx: Split breakpoint exception Breakpoint exception is big. Split it to support future growth on exception prolog. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1dda3293d86d0f715b13b2633c95d2188a42a02c.1576916812.git.christophe.leroy@c-s.fr commit 596419afed72656a4529d3d67475e4b2b1912485 Author: Christophe Leroy Date: Sat Dec 21 08:32:33 2019 +0000 powerpc/8xx: Move DataStoreTLBMiss perf handler Move DataStoreTLBMiss perf handler in order to cope with future growing exception prolog. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/75dd28b04efd2cbdbf01153173d99c11cdff2f08.1576916812.git.christophe.leroy@c-s.fr commit 9260f76ae2533787e92be58d5e509e81b72f5f9c Author: Christophe Leroy Date: Sat Dec 21 08:32:32 2019 +0000 powerpc/8xx: Drop exception entries for non-existing exceptions head_8xx.S has entries for all exceptions from 0x100 to 0x1f00. Several of them do not exist and are never generated by the 8xx in accordance with the documentation. Remove those entry points to make some room for future growing exception code. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/66f92866fe9524cf0f056016921c7d53adaef3a0.1576916812.git.christophe.leroy@c-s.fr commit 6edc318585410b9cae5a7e4d156f09c8e5e3a700 Author: Christophe Leroy Date: Sat Dec 21 08:32:31 2019 +0000 powerpc/8xx: Use alternative scratch registers in DTLB miss handler In preparation of handling CONFIG_VMAP_STACK, DTLB miss handler need to use different scratch registers than other exception handlers in order to not jeopardise exception entry on stack DTLB misses. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c5287ea59ae9630f505019b309bf94029241635f.1576916812.git.christophe.leroy@c-s.fr commit 547db12fd8a0ce753c6bafd130827f1755c93fe6 Author: Christophe Leroy Date: Sat Dec 21 08:32:30 2019 +0000 powerpc/32: Use vmapped stacks for interrupts In order to also catch overflows on IRQ stacks, use vmapped stacks. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d33ad1b36ddff4dcc19f96c592c12a61cf85d406.1576916812.git.christophe.leroy@c-s.fr commit 3978eb78517c1fc06dd75405d732af45c80f5bd2 Author: Christophe Leroy Date: Sat Dec 21 08:32:29 2019 +0000 powerpc/32: Add early stack overflow detection with VMAP stack. To avoid recursive faults, stack overflow detection has to be performed before writing in the stack in exception prologs. Do it by checking the alignment. If the stack pointer alignment is wrong, it means it is pointing to the following or preceding page. Without VMAP stack, a stack overflow is catastrophic. With VMAP stack, a stack overflow isn't destructive, so don't panic. Kill the task with SIGSEGV instead. A dedicated overflow stack is set up for each CPU. lkdtm: Performing direct entry EXHAUST_STACK lkdtm: Calling function with 512 frame size to depth 32 ... lkdtm: loop 32/32 ... lkdtm: loop 31/32 ... lkdtm: loop 30/32 ... lkdtm: loop 29/32 ... lkdtm: loop 28/32 ... lkdtm: loop 27/32 ... lkdtm: loop 26/32 ... lkdtm: loop 25/32 ... lkdtm: loop 24/32 ... lkdtm: loop 23/32 ... lkdtm: loop 22/32 ... lkdtm: loop 21/32 ... lkdtm: loop 20/32 ... Kernel stack overflow in process test[359], r1=c900c008 Oops: Kernel stack overflow, sig: 6 [#1] BE PAGE_SIZE=4K MMU=Hash PowerMac Modules linked in: CPU: 0 PID: 359 Comm: test Not tainted 5.3.0-rc7+ #2225 NIP: c0622060 LR: c0626710 CTR: 00000000 REGS: c0895f48 TRAP: 0000 Not tainted (5.3.0-rc7+) MSR: 00001032 CR: 28004224 XER: 00000000 GPR00: c0626ca4 c900c008 c783c000 c07335cc c900c010 c07335cc c900c0f0 c07335cc GPR08: c900c0f0 00000001 00000000 00000000 28008222 00000000 00000000 00000000 GPR16: 00000000 00000000 10010128 10010000 b799c245 10010158 c07335cc 00000025 GPR24: c0690000 c08b91d4 c068f688 00000020 c900c0f0 c068f668 c08b95b4 c08b91d4 NIP [c0622060] format_decode+0x0/0x4d4 LR [c0626710] vsnprintf+0x80/0x5fc Call Trace: [c900c068] [c0626ca4] vscnprintf+0x18/0x48 [c900c078] [c007b944] vprintk_store+0x40/0x214 [c900c0b8] [c007bf50] vprintk_emit+0x90/0x1dc [c900c0e8] [c007c5cc] printk+0x50/0x60 [c900c128] [c03da5b0] recursive_loop+0x44/0x6c [c900c338] [c03da5c4] recursive_loop+0x58/0x6c [c900c548] [c03da5c4] recursive_loop+0x58/0x6c [c900c758] [c03da5c4] recursive_loop+0x58/0x6c [c900c968] [c03da5c4] recursive_loop+0x58/0x6c [c900cb78] [c03da5c4] recursive_loop+0x58/0x6c [c900cd88] [c03da5c4] recursive_loop+0x58/0x6c [c900cf98] [c03da5c4] recursive_loop+0x58/0x6c [c900d1a8] [c03da5c4] recursive_loop+0x58/0x6c [c900d3b8] [c03da5c4] recursive_loop+0x58/0x6c [c900d5c8] [c03da5c4] recursive_loop+0x58/0x6c [c900d7d8] [c03da5c4] recursive_loop+0x58/0x6c [c900d9e8] [c03da5c4] recursive_loop+0x58/0x6c [c900dbf8] [c03da5c4] recursive_loop+0x58/0x6c [c900de08] [c03da67c] lkdtm_EXHAUST_STACK+0x30/0x4c [c900de18] [c03da3e8] direct_entry+0xc8/0x140 [c900de48] [c029fb40] full_proxy_write+0x64/0xcc [c900de68] [c01500f8] __vfs_write+0x30/0x1d0 [c900dee8] [c0152cb8] vfs_write+0xb8/0x1d4 [c900df08] [c0152f7c] ksys_write+0x58/0xe8 [c900df38] [c0014208] ret_from_syscall+0x0/0x34 --- interrupt: c01 at 0xf806664 LR = 0x1000c868 Instruction dump: 4bffff91 80010014 7c832378 7c0803a6 38210010 4e800020 3d20c08a 3ca0c089 8089a0cc 38a58f0c 38600001 4ba2d494 <9421ffe0> 7c0802a6 bfc10018 7c9f2378 Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1b89c121b4070c7ee99e4f22cc178f15a736b07b.1576916812.git.christophe.leroy@c-s.fr commit 0f510a2457cbbba18a98492bab1bf540be57ebd1 Author: Niklas Söderlund Date: Fri Jan 17 17:05:54 2020 +0100 thermal: rcar_gen3_thermal: Remove temperature bound The hardware manual states that the operation of the sensor is not guaranteed with temperatures above 125°C, not that the readings are invalid. Remove the bound check and try to deliver temperature readings even if we are outside the guaranteed operation range. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200117160554.3812787-3-niklas.soderlund+renesas@ragnatech.se commit dff6d4f80509d1aaf07da9534f3f4b6876876caf Author: Niklas Söderlund Date: Fri Jan 17 17:05:53 2020 +0100 thermal: rcar_thermal: Remove temperature bound The hardware manual states that the operation of the sensor is not guaranteed outside the range of -45°C to 125°C, not that the readings are invalid. Remove the bound check and try to deliver temperature readings even if we are outside the guaranteed operation range. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200117160554.3812787-2-niklas.soderlund+renesas@ragnatech.se commit 35709c4ee772afc3818cd6d42d123d608feeaa33 Author: Gayatri Kammela Date: Wed Dec 11 12:00:43 2019 -0800 thermal: intel: intel_pch_thermal: Add Comet Lake (CML) platform support Add Comet Lake to the list of the platforms to support intel_pch_thermal driver. Cc: Zhang rui Cc: Srinivas Pandruvada Signed-off-by: Gayatri Kammela Acked-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191211200043.4985-1-gayatri.kammela@intel.com commit 66dd8b802c555a9becd81679dc0ee57ede67b142 Author: Chuhong Yuan Date: Fri Dec 6 15:55:31 2019 +0800 thermal: intel: Fix unmatched pci_release_region The driver calls pci_request_regions() in probe and uses pci_release_regions() in probe failure. However, it calls pci_release_region() in remove, which does match the other two calls. Use pci_release_regions() instead to unify them. Signed-off-by: Chuhong Yuan Acked-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191206075531.18637-1-hslester96@gmail.com commit f64a6583d3f527b297b88441e1c20e6ed45f8f56 Author: Swaminathan, Nivedita Date: Thu Dec 12 12:30:25 2019 -0800 thermal: int340x: processor_thermal: Add Jasper Lake support Added new PCI id for Jasper Lake processor thermal device. Signed-off-by: Swaminathan, Nivedita Signed-off-by: Srinivas Pandruvada Acked-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191212203025.36310-1-srinivas.pandruvada@linux.intel.com commit c168baec00a04e06cd3a6b644946190f5bbb472a Author: Stefan Wahren Date: Thu Jan 16 19:41:17 2020 +0100 dt-bindings: brcm,avs-ro-thermal: Fix binding check issues Drop the reg property since this only necessary for the parent and add the missing thermal-sensor-cells property description. Signed-off-by: Stefan Wahren Fixes: 37e9cc08e9678 ("dt-bindings: Add Broadcom AVS RO thermal") Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1579200077-17496-1-git-send-email-stefan.wahren@i2se.com commit 5fdd4e310b450939aac5486cd20e222a127cf114 Author: Florian Fainelli Date: Tue Jan 14 11:06:07 2020 -0800 thermal: brcmstb_thermal: Register different ops per process Since we do not have interrupts on BCM7216, we cannot have trip point crossing, the thermal subsystem expects us to provide a NULL set_trips operation in that case, so make it possible to provide per-process thermal_zone_of_device_ops Reviewed-by: Amit Kucheria Signed-off-by: Florian Fainelli Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200114190607.29339-7-f.fainelli@gmail.com commit eaf7a88d4f4c48efff77e0c66462d152d3334bcc Author: Florian Fainelli Date: Tue Jan 14 11:06:06 2020 -0800 thermal: brcmstb_thermal: Restructure interrupt registration If we are successful grabbing the interrupt resource, then register an interrupt handler, this makes it easier to support the interrupt as being optional, which is it for 7216. Reviewed-by: Amit Kucheria Signed-off-by: Florian Fainelli Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200114190607.29339-6-f.fainelli@gmail.com commit c9a506139b7a772be286c34493792ce1b428e992 Author: Florian Fainelli Date: Tue Jan 14 11:06:05 2020 -0800 thermal: brcmstb_thermal: Add 16nm process thermal parameters Match the 7216 compatible string in order to derive the correct 16nm process thermal parameters to obtain correct readings. Reviewed-by: Amit Kucheria Signed-off-by: Florian Fainelli Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200114190607.29339-5-f.fainelli@gmail.com commit ea0ad0ff382f5c86a090dc164a0df6993fb85d06 Author: Florian Fainelli Date: Tue Jan 14 11:06:04 2020 -0800 dt-bindings: thermal: Define BCM7216 thermal sensor compatible BCM7216 is a 16nm process STB chip, which requires a different compatible string to differentiate different temperature formulas. Reviewed-by: Rob Herring Signed-off-by: Florian Fainelli Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200114190607.29339-4-f.fainelli@gmail.com commit 8bcda3257acf86b652fb98b7d1ef6bf6c911bd28 Author: Florian Fainelli Date: Tue Jan 14 11:06:03 2020 -0800 thermal: brcmstb_thermal: Prepare to support a different process The driver is currently assuming that it is operating with a 28nm process chip, which has a specific formula to convert temperature to a code and vice versa. Update the code to support providing two key values: offset and multiplier to derive the correct formulas. Signed-off-by: Florian Fainelli Reviewed-by: Amit Kucheria Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200114190607.29339-3-f.fainelli@gmail.com commit e1ff6fc22f19e2af8adbad618526b80067911d40 Author: Florian Fainelli Date: Tue Jan 14 11:06:02 2020 -0800 thermal: brcmstb_thermal: Do not use DT coefficients At the time the brcmstb_thermal driver and its binding were merged, the DT binding did not make the coefficients properties a mandatory one, therefore all users of the brcmstb_thermal driver out there have a non functional implementation with zero coefficients. Even if these properties were provided, the formula used for computation is incorrect. The coefficients are entirely process specific (right now, only 28nm is supported) and not board or SoC specific, it is therefore appropriate to hard code them in the driver given the compatibility string we are probed with which has to be updated whenever a new process is introduced. We remove the existing coefficients definition since subsequent patches are going to add support for a new process and will introduce new coefficients as well. Fixes: 9e03cf1b2dd5 ("thermal: add brcmstb AVS TMON driver") Signed-off-by: Florian Fainelli Reviewed-by: Amit Kucheria Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200114190607.29339-2-f.fainelli@gmail.com commit 263c8c4c76d9da63f1f8805ac5fc62a270448301 Author: Geert Uytterhoeven Date: Wed Jan 15 13:54:17 2020 +0100 thermal: rcar_thermal: Use usleep_range() instead of udelay() rcar_thermal_update_temp() takes a mutex, so it is always called in a context that can sleep. Hence replace the 300 µs busy loop by a call to usleep_range(), to allow other threads to run. Signed-off-by: Geert Uytterhoeven Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200115125417.5263-1-geert+renesas@glider.be commit 1a90e73248c4d0add6583bd88bb5e082c3e090bc Author: Stefan Wahren Date: Mon Jan 13 19:56:18 2020 +0100 ARM: configs: Build BCM2711 thermal as module This builds the BCM2711 thermal driver as module for the Raspberry Pi 4. Signed-off-by: Stefan Wahren Reviewed-by: Florian Fainelli Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1578941778-23321-5-git-send-email-stefan.wahren@i2se.com commit a1d6989bf12b01cd9198e2c31a96678ac9c47415 Author: Stefan Wahren Date: Mon Jan 13 19:56:17 2020 +0100 ARM: dts: bcm2711: Enable thermal This enables thermal for the BCM2711 (used on Raspberry Pi 4) by adding the AVS monitor and a subnode for the thermal part. Signed-off-by: Stefan Wahren Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Signed-off-by: Florian Fainelli Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1578941778-23321-4-git-send-email-stefan.wahren@i2se.com commit 59b781352dc4cb9ae27a8ddae0cda979d29d8af7 Author: Stefan Wahren Date: Mon Jan 13 19:56:16 2020 +0100 thermal: Add BCM2711 thermal driver This adds the thermal sensor driver for the Broadcom BCM2711 SoC, which is placed on the Raspberry Pi 4. The driver only provides SoC temperature reading so far. Signed-off-by: Stefan Wahren Reviewed-by: Florian Fainelli Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1578941778-23321-3-git-send-email-stefan.wahren@i2se.com commit ee31ff373da6602e7a4e60fe11322b41ac38eb22 Author: Stefan Wahren Date: Mon Jan 13 19:56:15 2020 +0100 dt-bindings: Add Broadcom AVS RO thermal Since the BCM2711 doesn't have a AVS TMON block, the thermal information must be retrieved from the AVS ring oscillator block. This block is part of the AVS monitor which contains a bunch of raw sensors. Signed-off-by: Stefan Wahren Reviewed-by: Rob Herring Reviewed-by: Nicolas Saenz Julienne Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1578941778-23321-2-git-send-email-stefan.wahren@i2se.com commit 85f0ad221317c18e6032b6735f6b36c8a6a96ea9 Author: Yangtao Li Date: Sat Dec 28 17:19:04 2019 +0000 thermal: sun8i: Add hwmon support Expose sun8i thermal as a HWMON device. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191228171904.24618-1-tiny.windzz@gmail.com commit 291292cddccaca99f48b4701121bcb1870e4f7ce Author: Yangtao Li Date: Sun Jan 12 18:09:25 2020 +0000 thermal: sun8i: Remove unused variable and unneeded macros The cp_ft_flag variable is not used after initialization, so delete it. After that, THS_EFUSE_CP_FT_MASK, THS_EFUSE_CP_FT_BIT and THS_CALIBRATION_IN_FT are not needed, so delete them. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200112180925.23705-1-tiny.windzz@gmail.com commit 69d5f3a9c0c9044202db8793f34f0f0eb1e0302b Author: Yangtao Li Date: Sun Jan 12 17:13:18 2020 +0000 thermal: sun8i: Fix using plain integer as NULL pointer in sun8i_ths_resource_init sparse returns a warning: "drivers/thermal/sun8i_thermal.c:341:60: sparse: sparse: Using plain integer as NULL pointer". Fix it by replacing the zero integer by a NULL pointer. Reported-by: kbuild test robot Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200112171318.23025-1-tiny.windzz@gmail.com commit d8186285f1fdbc847af75dfeaa4fcc574753c97c Author: Yangtao Li Date: Mon Jan 6 17:46:38 2020 +0000 thermal: sun8i: Fix r40 ths number According to the spec, r40 has 2 thermal sensors. Sensor0 located in the CPU, another in the GPU. Fixes: dccc5c3b6f30f ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40") Signed-off-by: Yangtao Li Tested-by: Corentin Labbe Tested-on: sun8i-r40-bananapi-m2-ultra Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200106174639.20862-1-tiny.windzz@gmail.com commit 4d94e4350e119050be5122a01849d000024d5c88 Merge: db038b1b2778 92439915e0e3 Author: David S. Miller Date: Mon Jan 27 11:33:29 2020 +0100 Merge branch 'bnxt_en-next' Michael Chan says: ==================== bnxt_en: Updates for net-next. This patch-set includes link up and link initialization improvements, RSS and aRFS improvements, devlink refactoring and registration improvements, devlink info support including documentation. v2: Removed the TC ingress rate limiting patch. The developer Harsha needs to rework some code. Use fw.psid suggested by Jakub Kicinski. ==================== Signed-off-by: David S. Miller commit 92439915e0e37495389bdaec5bda877293dd68b4 Author: Vasundhara Volam Date: Mon Jan 27 04:56:27 2020 -0500 devlink: document devlink info versions reported by bnxt_en driver Add the set of info versions reported by bnxt_en driver, including a description of what the version represents, and what modes (fixed, running, stored) it reports. v2: Use fw.psid. Cc: Jiri Pirko Cc: Jakub Kicinski Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 9599e036b161243d7c62399a1b6c250573e08a43 Author: Vasundhara Volam Date: Mon Jan 27 04:56:26 2020 -0500 bnxt_en: Add support for devlink info command Display the following information via devlink info command: - Driver name - Board id - Broad revision - Board Serial number - Board FW version - FW parameter set version - FW App version - FW management version - FW RoCE version Standard output example: $ devlink dev info pci/0000:3b:00.0 pci/0000:3b:00.0: driver bnxt_en serial_number 00-10-18-FF-FE-AD-05-00 versions: fixed: asic.id D802 asic.rev 1 running: fw 216.1.124.0 fw.psid 0.0.0 fw.app 216.1.122.0 fw.mgmt 864.0.32.0 fw.roce 216.1.15.0 [ This version has incorporated changes suggested by Jakub Kicinski to use generic devlink version tags. ] v2: Use fw.psid Cc: Jiri Pirko Cc: Jakub Kicinski Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 41c0d917d11edf9a34461f56e14f067aadb36101 Author: Vasundhara Volam Date: Mon Jan 27 04:56:25 2020 -0500 devlink: add macro for "fw.roce" Add definition and documentation for the new generic info "fw.roce". v2: Remove board.nvm_cfg since fw.psid is similar. Cc: Jiri Pirko Cc: Jakub Kicinski Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit b014232f7f56f6db10b8540b0b97ae8c7eeef28e Author: Vasundhara Volam Date: Mon Jan 27 04:56:24 2020 -0500 bnxt_en: Rename switch_id to dsn Instead of switch_id, renaming it to dsn will be more meaningful so that it can be used to display device serial number in follow up patch via devlink_info command. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 8159cbe3e0b24489f97ca0fb7df7a1710f03a26b Author: Vasundhara Volam Date: Mon Jan 27 04:56:23 2020 -0500 bnxt_en: Add support to update progress of flash update This patch adds status notification to devlink flash update while flashing is in progress. $ devlink dev flash pci/0000:05:00.0 file 103.pkg Preparing to flash Flashing done Cc: Jiri Pirko Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit cda2cab0771183932d6ba73c5ac63bb63decdadf Author: Vasundhara Volam Date: Mon Jan 27 04:56:22 2020 -0500 bnxt_en: Move devlink_register before registering netdev Latest kernels get the phys_port_name via devlink, if ndo_get_phys_port_name is not defined. To provide the phys_port_name correctly, register devlink before registering netdev. Also call devlink_port_type_eth_set() after registering netdev as devlink port updates the netdev structure and notifies user. Cc: Jiri Pirko Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 002870ebdabb75809d753e3c171c68c4e70a0e91 Author: Vasundhara Volam Date: Mon Jan 27 04:56:21 2020 -0500 bnxt_en: Register devlink irrespective of firmware spec version This will allow to register for devlink port and use port features. Also register params only if firmware spec version is at least 0x10600 which will support reading/setting numbered variables in NVRAM. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit d6292ade7f6f109bffe9e1065de37f688fa0107f Author: Vasundhara Volam Date: Mon Jan 27 04:56:20 2020 -0500 bnxt_en: Refactor bnxt_dl_register() Define bnxt_dl_params_register() and bnxt_dl_params_unregister() functions and move params register/unregister code to these newly defined functions. This patch is in preparation to register devlink irrespective of firmware spec. version in the next patch. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 5313845f491f22761c675f7009dd77b5ae64172d Author: Michael Chan Date: Mon Jan 27 04:56:19 2020 -0500 bnxt_en: Disable workaround for lost interrupts on 575XX B0 and newer chips. The hardware bug has been fixed on B0 and newer chips, so disable the workaround on these chips. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 87d67f59d6a33f741b5c6a42fa01b99ea2b14b7d Author: Pavan Chebbi Date: Mon Jan 27 04:56:18 2020 -0500 bnxt_en: Periodically check and remove aged-out ntuple filters Currently the only time we check and remove expired filters is when we are inserting new filters. Improving the aRFS expiry handling by adding code to do the above work periodically. Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f47d0e19ae99329177423db80f86a601f8cd8e3e Author: Michael Chan Date: Mon Jan 27 04:56:17 2020 -0500 bnxt_en: Do not accept fragments for aRFS flow steering. In bnxt_rx_flow_steer(), if the dissected packet is a fragment, do not proceed to create the ntuple filter and return error instead. Otherwise we would create a filter with 0 source and destination ports because the dissected ports would not be available for fragments. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit c66c06c5e28a55920c87b386876461c139aa1878 Author: Michael Chan Date: Mon Jan 27 04:56:16 2020 -0500 bnxt_en: Support UDP RSS hashing on 575XX chips. 575XX (P5) chips have the same UDP RSS hashing capability as P4 chips, so we can enable it on P5 chips. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1d86859fdf31a0d50cc82b5d0d6bfb5fe98f6c00 Author: Michael Chan Date: Mon Jan 27 04:56:15 2020 -0500 bnxt_en: Remove the setting of dev_port. The dev_port is meant to distinguish the network ports belonging to the same PCI function. Our devices only have one network port associated with each PCI function and so we should not set it for correctness. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 43a5107dc1acbf88a8a194beb9ff4e8563a2c7a3 Author: Michael Chan Date: Mon Jan 27 04:56:14 2020 -0500 bnxt_en: Improve bnxt_probe_phy(). If the 2nd parameter fw_dflt is not set, we are calling bnxt_probe_phy() after the firmware has reset. There is no need to query the current PHY settings from firmware as these settings may be different from the ethtool settings that the driver will re-establish later. So return earlier in bnxt_probe_phy() to save one firmware call. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 83d8f5e92d034a4c4a04d780107e73af31a38504 Author: Michael Chan Date: Mon Jan 27 04:56:13 2020 -0500 bnxt_en: Improve link up detection. In bnxt_update_phy_setting(), ethtool_get_link_ksettings() and bnxt_disable_an_for_lpbk(), we inconsistently use netif_carrier_ok() to determine link. Instead, we should use bp->link_info.link_up which has the true link state. The netif_carrier state may be off during self-test and while the device is being reset and may not always reflect the true link state. By always using bp->link_info.link_up, the code is now more consistent and more correct. Some unnecessary link toggles are now prevented with this patch. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit db038b1b277886e3a082175a6ef6c1d4da17715d Merge: 82bc2e4a26a6 67bffa79231f Author: David S. Miller Date: Mon Jan 27 11:31:36 2020 +0100 Merge branch 'ethtool-netlink-interface-part-2' Michal Kubecek says: ==================== ethtool netlink interface, part 2 This shorter series adds support for getting and setting of wake-on-lan settings and message mask (originally message level). Together with the code already in net-next, this will allow full implementation of "ethtool " and "ethtool -s ...". Older versions of the ethtool netlink series allowed getting WoL settings by unprivileged users and only filtered out the password but this was a source of controversy so for now, ETHTOOL_MSG_WOL_GET request always requires CAP_NET_ADMIN as ETHTOOL_GWOL ioctl request does. ==================== Signed-off-by: David S. Miller commit 67bffa79231f15ba372007972563cc8aa5e48bfa Author: Michal Kubecek Date: Sun Jan 26 23:11:19 2020 +0100 ethtool: add WOL_NTF notification Send ETHTOOL_MSG_WOL_NTF notification whenever wake-on-lan settings of a device are modified using ETHTOOL_MSG_WOL_SET netlink message or ETHTOOL_SWOL ioctl request. As notifications can be received by anyone, do not include SecureOn(tm) password in notification messages. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit 8d425b19b305a77cb1ba67b84e7c1ca547de032f Author: Michal Kubecek Date: Sun Jan 26 23:11:16 2020 +0100 ethtool: set wake-on-lan settings with WOL_SET request Implement WOL_SET netlink request to set wake-on-lan settings. This is equivalent to ETHTOOL_SWOL ioctl request. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit 51ea22b04ea0c210f9ce87b8a600965dbe476bc2 Author: Michal Kubecek Date: Sun Jan 26 23:11:13 2020 +0100 ethtool: provide WoL settings with WOL_GET request Implement WOL_GET request to get wake-on-lan settings for a device, traditionally available via ETHTOOL_GWOL ioctl request. As part of the implementation, provide symbolic names for wake-on-line modes as ETH_SS_WOL_MODES string set. Signed-off-by: Michal Kubecek Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 0bda7af39d2ba6ef83bd18e26bcb027f1630004e Author: Michal Kubecek Date: Sun Jan 26 23:11:10 2020 +0100 ethtool: add DEBUG_NTF notification Send ETHTOOL_MSG_DEBUG_NTF notification message whenever debugging message mask for a device are modified using ETHTOOL_MSG_DEBUG_SET netlink message or ETHTOOL_SMSGLVL ioctl request. The notification message has the same format as reply to DEBUG_GET request. As with other ethtool notifications, netlink requests only trigger the notification if the mask is actually changed while ioctl request trigger it whenever the request results in calling the ethtool_ops handler. Signed-off-by: Michal Kubecek Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit e54d04e3afead22d8e7d6edaaac487a1205bac39 Author: Michal Kubecek Date: Sun Jan 26 23:11:07 2020 +0100 ethtool: set message mask with DEBUG_SET request Implement DEBUG_SET netlink request to set debugging settings for a device. At the moment, only message mask corresponding to message level as set by ETHTOOL_SMSGLVL ioctl request can be set. (It is called message level in ioctl interface but almost all drivers interpret it as a bit mask.) Signed-off-by: Michal Kubecek Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 6a94b8ccf6b77f005ab1b36a878e1d81df0c033e Author: Michal Kubecek Date: Sun Jan 26 23:11:04 2020 +0100 ethtool: provide message mask with DEBUG_GET request Implement DEBUG_GET request to get debugging settings for a device. At the moment, only message mask corresponding to message level as reported by ETHTOOL_GMSGLVL ioctl request is provided. (It is called message level in ioctl interface but almost all drivers interpret it as a bit mask.) As part of the implementation, provide symbolic names for message mask bits as ETH_SS_MSG_CLASSES string set. Signed-off-by: Michal Kubecek Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit d2c4b444fd13f4699ab8c4c49062cd2c7516c241 Author: Michal Kubecek Date: Sun Jan 26 23:11:01 2020 +0100 ethtool: fix kernel-doc descriptions Fix missing or incorrect function argument and struct member descriptions. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit c102671af085aacf17219e9bdcfccddc6620a866 Merge: c95d9c140cea 854e334903df Author: Rafael J. Wysocki Date: Mon Jan 27 11:30:38 2020 +0100 Merge branch 'pm-devfreq' * pm-devfreq: (24 commits) PM / devfreq: Add debugfs support with devfreq_summary file PM / devfreq: exynos: Rename Exynos to lowercase PM / devfreq: imx8m-ddrc: Fix inconsistent IS_ERR and PTR_ERR PM / devfreq: exynos-bus: Add error log when fail to get devfreq-event PM / devfreq: exynos-bus: Disable devfreq-event device when fails PM / devfreq: rk3399_dmc: Disable devfreq-event device when fails PM / devfreq: imx8m-ddrc: Remove unused defines PM / devfreq: exynos-bus: Reduce goto statements and remove unused headers PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency PM / devfreq: rockchip-dfi: Convert to devm_platform_ioremap_resource PM / devfreq: rk3399_dmc: Add missing of_node_put() PM / devfreq: rockchip-dfi: Add missing of_node_put() PM / devfreq: Fix multiple kernel-doc warnings PM / devfreq: exynos-bus: Extract exynos_bus_profile_init_passive() PM / devfreq: exynos-bus: Extract exynos_bus_profile_init() PM / devfreq: Move declaration of DEVICE_ATTR_RW(min_freq) PM / devfreq: Move statistics to separate struct devfreq_stats PM / devfreq: Add clearing transitions stats PM / devfreq: Change time stats to 64-bit PM / devfreq: Add new name attribute for sysfs ... commit c95d9c140cea04bb052bd853eee24d0020734d9d Merge: 245224d1cb54 d229290689ae ead067beb56f c267930f3f10 f9900c178d61 0b7c99d9a229 Author: Rafael J. Wysocki Date: Mon Jan 27 11:30:13 2020 +0100 Merge branches 'pm-core', 'powercap', 'pm-opp', 'pm-avs' and 'pm-misc' * pm-core: PM-runtime: add tracepoints for usage_count changes * powercap: powercap/intel_rapl: add support for JasperLake x86/cpu: Add Jasper Lake to Intel family powercap/intel_rapl: add support for TigerLake Mobile * pm-opp: opp: Replace list_kref with a local counter opp: Free static OPPs on errors while adding them * pm-avs: power: avs: qcom-cpr: remove duplicated include from qcom-cpr.c power: avs: fix uninitialized error return on failed cpr_read_fuse_uV() call power: avs: qcom-cpr: make cpr_get_opp_hz_for_req() static power: avs: qcom-cpr: remove set but unused variable power: avs: qcom-cpr: make sure that regmap is available power: avs: qcom-cpr: fix unsigned expression compared with zero power: avs: qcom-cpr: fix invalid printk specifier in debug print power: avs: Add support for CPR (Core Power Reduction) dt-bindings: power: avs: Add support for CPR (Core Power Reduction) * pm-misc: mailmap: Add entry for commit 245224d1cb5465414e52fcd1873057f7ce7b14ca Merge: 5b82ba70ded0 0a9db0a0e32c 322e929d196c Author: Rafael J. Wysocki Date: Mon Jan 27 11:29:09 2020 +0100 Merge branches 'pm-cpufreq' and 'pm-sleep' * pm-cpufreq: cpufreq: loongson2_cpufreq: adjust cpufreq uses of LOONGSON_CHIPCFG cpufreq: brcmstb-avs: fix imbalance of cpufreq policy refcount cpufreq: intel_pstate: fix spelling mistake: "Whethet" -> "Whether" cpufreq: s3c: fix unbalances of cpufreq policy refcount cpufreq: imx-cpufreq-dt: Add i.MX8MP support cpufreq: Use imx-cpufreq-dt for i.MX8MP's speed grading cpufreq: tegra186: convert to devm_platform_ioremap_resource cpufreq: kirkwood: convert to devm_platform_ioremap_resource cpufreq: CPPC: put ACPI table after using it cpufreq : CPPC: Break out if HiSilicon CPPC workaround is matched * pm-sleep: PM: suspend: Add sysfs attribute to control the "sync on suspend" behavior PM: hibernate: fix spelling mistake "shapshot" -> "snapshot" PM: hibernate: Add more logging on hibernation failure PM: hibernate: improve arithmetic division in preallocate_highmem_fraction() PM: wakeup: Show statistics for deleted wakeup sources again PM: sleep: Switch to rtc_time64_to_tm()/rtc_tm_to_time64() commit 5b82ba70ded00337eafa7de65ffe40b530bfbe61 Merge: 3a83c8c81c91 86e9466ae620 Author: Rafael J. Wysocki Date: Mon Jan 27 11:28:57 2020 +0100 Merge branch 'pm-cpuidle' * pm-cpuidle: (27 commits) intel_idle: Clean up irtl_2_usec() intel_idle: Move 3 functions closer to their callers intel_idle: Annotate initialization code and data structures intel_idle: Move and clean up intel_idle_cpuidle_devices_uninit() intel_idle: Rearrange intel_idle_cpuidle_driver_init() intel_idle: Clean up NULL pointer check in intel_idle_init() intel_idle: Fold intel_idle_probe() into intel_idle_init() intel_idle: Eliminate __setup_broadcast_timer() cpuidle: fix cpuidle_find_deepest_state() kerneldoc warnings cpuidle: sysfs: fix warnings when compiling with W=1 cpuidle: coupled: fix warnings when compiling with W=1 Documentation: admin-guide: PM: Add intel_idle document cpuidle: arm: Enable compile testing for some of drivers cpuidle: Drop unused cpuidle_driver_ref/unref() functions intel_idle: Use ACPI _CST on server systems intel_idle: Add module parameter to prevent ACPI _CST from being used intel_idle: Allow ACPI _CST to be used for selected known processors cpuidle: Allow idle states to be disabled by default intel_idle: Use ACPI _CST for processor models without C-state tables intel_idle: Refactor intel_idle_cpuidle_driver_init() ... commit 82bc2e4a26a65e8b23590565b89115f8634d4fe6 Merge: c4c57b974d27 2a13513f99e7 Author: David S. Miller Date: Mon Jan 27 11:25:36 2020 +0100 Merge tag 'wireless-drivers-next-2020-01-26' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for v5.6 Second set of patches for v5.6. Nothing special standing out, smaller new features and fixes allover. Major changes: ar5523 * add support for SMCWUSBT-G2 USB device iwlwifi * support new versions of the FTM FW APIs * support new version of the beacon template FW API * print some extra information when the driver is loaded rtw88 * support wowlan feature for 8822c * add support for WIPHY_WOWLAN_NET_DETECT brcmfmac * add initial support for monitor mode qtnfmac * add module parameter to enable DFS offloading in firmware * add support for STA HE rates * add support for TWT responder and spatial reuse ==================== Signed-off-by: David S. Miller commit 82650dab9a5a2928c8d982cce5e3c687f14f8716 Merge: b23bfa5633b1 265bb359061d Author: Daniel Borkmann Date: Mon Jan 27 11:25:07 2020 +0100 Merge branch 'bpf-flow-dissector-fix-port-ranges' Yoshiki Komachi says: ==================== When I tried a test based on the selftest program for BPF flow dissector (test_flow_dissector.sh), I observed unexpected result as below: $ tc filter add dev lo parent ffff: protocol ip pref 1337 flower ip_proto \ udp src_port 8-10 action drop $ tools/testing/selftests/bpf/test_flow_dissector -i 4 -f 9 -F inner.dest4: 127.0.0.1 inner.source4: 127.0.0.3 pkts: tx=10 rx=10 The last rx means the number of received packets. I expected rx=0 in this test (i.e., all received packets should have been dropped), but it resulted in acceptance. Although the previous commit 8ffb055beae5 ("cls_flower: Fix the behavior using port ranges with hw-offload") added new flag and field toward filtering based on port ranges with hw-offload, it missed applying for BPF flow dissector then. As a result, BPF flow dissector currently stores data extracted from packets in incorrect field used for exact match whenever packets are classified by filters based on port ranges. Thus, they never match rules in such cases because flow dissector gives rise to generating incorrect flow keys. This series fixes the issue by replacing incorrect flag and field with new ones in BPF flow dissector, and adds a test for filtering based on specified port ranges to the existing selftest program. Changes in v2: - set key_ports to NULL at the top of __skb_flow_bpf_to_target() ==================== Signed-off-by: Daniel Borkmann commit 265bb359061db6ef825dec3912f341a604966371 Author: Yoshiki Komachi Date: Fri Jan 17 16:05:33 2020 +0900 selftests/bpf: Add test based on port range for BPF flow dissector Add a simple test to make sure that a filter based on specified port range classifies packets correctly. Signed-off-by: Yoshiki Komachi Signed-off-by: Daniel Borkmann Acked-by: Petar Penkov Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200117070533.402240-3-komachi.yoshiki@gmail.com commit 59fb9b62fb6c929a756563152a89f39b07cf8893 Author: Yoshiki Komachi Date: Fri Jan 17 16:05:32 2020 +0900 flow_dissector: Fix to use new variables for port ranges in bpf hook This patch applies new flag (FLOW_DISSECTOR_KEY_PORTS_RANGE) and field (tp_range) to BPF flow dissector to generate appropriate flow keys when classified by specified port ranges. Fixes: 8ffb055beae5 ("cls_flower: Fix the behavior using port ranges with hw-offload") Signed-off-by: Yoshiki Komachi Signed-off-by: Daniel Borkmann Acked-by: Petar Penkov Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200117070533.402240-2-komachi.yoshiki@gmail.com commit c4c57b974d27f53744b1bc5669e002f080cec839 Merge: 5a44c71ccda6 11eb85ec42dc Author: David S. Miller Date: Mon Jan 27 11:24:46 2020 +0100 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2020-01-26 Here's (probably) the last bluetooth-next pull request for the 5.6 kernel. - Initial pieces of Bluetooth 5.2 Isochronous Channels support - mgmt: Various cleanups and a new Set Blocked Keys command - btusb: Added support for 04ca:3021 QCA_ROME device - hci_qca: Multiple fixes & cleanups - hci_bcm: Fixes & improved device tree support - Fixed attempts to create duplicate debugfs entries Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit 5a44c71ccda60a50073c5d7fe3f694cdfa3ab0c2 Author: Christophe JAILLET Date: Sun Jan 26 11:44:29 2020 +0100 drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()' 'alloc_etherdev_mqs()' expects first 'tx', then 'rx'. The semantic here looks reversed. Reorder the arguments passed to 'alloc_etherdev_mqs()' in order to keep the correct semantic. In fact, this is a no-op because both XGENE_NUM_[RT]X_RING are 8. Fixes: 107dec2749fe ("drivers: net: xgene: Add support for multiple queues") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit b23bfa5633b19bf1db87b36a76b2225c734f794c Author: John Fastabend Date: Sun Jan 26 16:14:02 2020 -0800 bpf, xdp: Remove no longer required rcu_read_{un}lock() Now that we depend on rcu_call() and synchronize_rcu() to also wait for preempt_disabled region to complete the rcu read critical section in __dev_map_flush() is no longer required. Except in a few special cases in drivers that need it for other reasons. These originally ensured the map reference was safe while a map was also being free'd. And additionally that bpf program updates via ndo_bpf did not happen while flush updates were in flight. But flush by new rules can only be called from preempt-disabled NAPI context. The synchronize_rcu from the map free path and the rcu_call from the delete path will ensure the reference there is safe. So lets remove the rcu_read_lock and rcu_read_unlock pair to avoid any confusion around how this is being protected. If the rcu_read_lock was required it would mean errors in the above logic and the original patch would also be wrong. Now that we have done above we put the rcu_read_lock in the driver code where it is needed in a driver dependent way. I think this helps readability of the code so we know where and why we are taking read locks. Most drivers will not need rcu_read_locks here and further XDP drivers already have rcu_read_locks in their code paths for reading xdp programs on RX side so this makes it symmetric where we don't have half of rcu critical sections define in driver and the other half in devmap. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/bpf/1580084042-11598-4-git-send-email-john.fastabend@gmail.com commit 9719c6b98db42462bfb9aa172f017bdfd6d66c6f Author: John Fastabend Date: Sun Jan 26 16:14:01 2020 -0800 bpf, xdp: virtio_net use access ptr macro for xdp enable check virtio_net currently relies on rcu critical section to access the xdp program in its xdp_xmit handler. However, the pointer to the xdp program is only used to do a NULL pointer comparison to determine if xdp is enabled or not. Use rcu_access_pointer() instead of rcu_dereference() to reflect this. Then later when we drop rcu_read critical section virtio_net will not need in special handling. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/bpf/1580084042-11598-3-git-send-email-john.fastabend@gmail.com commit 42a84a8cd0ff0cbff5a4595e1304c4567a30267d Author: John Fastabend Date: Sun Jan 26 16:14:00 2020 -0800 bpf, xdp: Update devmap comments to reflect napi/rcu usage Now that we rely on synchronize_rcu and call_rcu waiting to exit perempt-disable regions (NAPI) lets update the comments to reflect this. Fixes: 0536b85239b84 ("xdp: Simplify devmap cleanup") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Acked-by: Song Liu Link: https://lore.kernel.org/bpf/1580084042-11598-2-git-send-email-john.fastabend@gmail.com commit a8ec173a3f29fd777681c72835d4d8642ebea899 Author: Heiner Kallweit Date: Sun Jan 26 10:40:44 2020 +0100 r8169: don't set min_mtu/max_mtu if not needed Defaults for min_mtu and max_mtu are set by ether_setup(), which is called from devm_alloc_etherdev(). Let rtl_jumbo_max() only return a positive value if actually jumbo packets are supported. This also allows to remove constant Jumbo_1K which is a little misleading anyway. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 6dd4b4f3936e17fedea1308bc70e9716f68bf232 Author: Christophe JAILLET Date: Sat Jan 25 22:18:47 2020 +0100 mlxsw: minimal: Fix an error handling path in 'mlxsw_m_port_create()' An 'alloc_etherdev()' called is not ballanced by a corresponding 'free_netdev()' call in one error handling path. Slighly reorder the error handling code to catch the missed case. Fixes: c100e47caa8e ("mlxsw: minimal: Add ethtool support") Signed-off-by: Christophe JAILLET Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit 6dc43cd3aae0ffeeaebe427e1bf5e5faf9de7d42 Author: Vladimir Oltean Date: Sat Jan 25 23:01:11 2020 +0200 net: dsa: Fix use-after-free in probing of DSA switch tree DSA sets up a switch tree little by little. Every switch of the N members of the tree calls dsa_register_switch, and (N - 1) will just touch the dst->ports list with their ports and quickly exit. Only the last switch that calls dsa_register_switch will find all DSA links complete in dsa_tree_setup_routing_table, and not return zero as a result but instead go ahead and set up the entire DSA switch tree (practically on behalf of the other switches too). The trouble is that the (N - 1) switches don't clean up after themselves after they get an error such as EPROBE_DEFER. Their footprint left in dst->ports by dsa_switch_touch_ports is still there. And switch N, the one responsible with actually setting up the tree, is going to work with those stale dp, dp->ds and dp->ds->dev pointers. In particular ds and ds->dev might get freed by the device driver. Be there a 2-switch tree and the following calling order: - Switch 1 calls dsa_register_switch - Calls dsa_switch_touch_ports, populates dst->ports - Calls dsa_port_parse_cpu, gets -EPROBE_DEFER, exits. - Switch 2 calls dsa_register_switch - Calls dsa_switch_touch_ports, populates dst->ports - Probe doesn't get deferred, so it goes ahead. - Calls dsa_tree_setup_routing_table, which returns "complete == true" due to Switch 1 having called dsa_switch_touch_ports before. - Because the DSA links are complete, it calls dsa_tree_setup_switches now. - dsa_tree_setup_switches iterates through dst->ports, initializing the Switch 1 ds structure (invalid) and the Switch 2 ds structure (valid). - Undefined behavior (use after free, sometimes NULL pointers, etc). Real example below (debugging prints added by me, as well as guards against NULL pointers): [ 5.477947] dsa_tree_setup_switches: Setting up port 0 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.313002] dsa_tree_setup_switches: Setting up port 1 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.319932] dsa_tree_setup_switches: Setting up port 2 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.329693] dsa_tree_setup_switches: Setting up port 3 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.339458] dsa_tree_setup_switches: Setting up port 4 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.349226] dsa_tree_setup_switches: Setting up port 5 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.358991] dsa_tree_setup_switches: Setting up port 6 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.368758] dsa_tree_setup_switches: Setting up port 7 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.378524] dsa_tree_setup_switches: Setting up port 8 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.388291] dsa_tree_setup_switches: Setting up port 9 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.398057] dsa_tree_setup_switches: Setting up port 10 of switch ffffff803df0b980 (dev ffffff803f775c00) [ 6.407912] dsa_tree_setup_switches: Setting up port 0 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.417682] dsa_tree_setup_switches: Setting up port 1 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.427446] dsa_tree_setup_switches: Setting up port 2 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.437212] dsa_tree_setup_switches: Setting up port 3 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.446979] dsa_tree_setup_switches: Setting up port 4 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.456744] dsa_tree_setup_switches: Setting up port 5 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.466512] dsa_tree_setup_switches: Setting up port 6 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.476277] dsa_tree_setup_switches: Setting up port 7 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.486043] dsa_tree_setup_switches: Setting up port 8 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.495810] dsa_tree_setup_switches: Setting up port 9 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.505577] dsa_tree_setup_switches: Setting up port 10 of switch ffffff803da02f80 (dev 0000000000000000) [ 6.515433] dsa_tree_setup_switches: Setting up port 0 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.354120] dsa_tree_setup_switches: Setting up port 1 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.361045] dsa_tree_setup_switches: Setting up port 2 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.370805] dsa_tree_setup_switches: Setting up port 3 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.380571] dsa_tree_setup_switches: Setting up port 4 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.390337] dsa_tree_setup_switches: Setting up port 5 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.400104] dsa_tree_setup_switches: Setting up port 6 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.409872] dsa_tree_setup_switches: Setting up port 7 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.419637] dsa_tree_setup_switches: Setting up port 8 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.429403] dsa_tree_setup_switches: Setting up port 9 of switch ffffff803db15b80 (dev ffffff803d8e4800) [ 7.439169] dsa_tree_setup_switches: Setting up port 10 of switch ffffff803db15b80 (dev ffffff803d8e4800) The solution is to recognize that the functions that call dsa_switch_touch_ports (dsa_switch_parse_of, dsa_switch_parse) have side effects, and therefore one should clean up their side effects on error path. The cleanup of dst->ports was taken from dsa_switch_remove and moved into a dedicated dsa_switch_release_ports function, which should really be per-switch (free only the members of dst->ports that are also members of ds, instead of all switch ports). Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit a85dd3a5170c8812cd835ea968ccadf0ebf1648e Author: Heiner Kallweit Date: Sat Jan 25 13:42:14 2020 +0100 net: remove eth_change_mtu All usage of this function was removed three years ago, and the function was marked as deprecated: a52ad514fdf3 ("net: deprecate eth_change_mtu, remove usage") So I think we can remove it now. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 0e6223ea903a892ba6962bdf823572e595dc8236 Merge: 09917a126d5b 02758cb6dac3 Author: David S. Miller Date: Mon Jan 27 11:05:42 2020 +0100 Merge branch 'XDP-fixes-for-socionext-driver' Lorenzo Bianconi says: ==================== XDP fixes for socionext driver Fix possible user-after-in XDP rx path Fix rx statistics accounting if no bpf program is attached ==================== Signed-off-by: David S. Miller commit 02758cb6dac31a2b4bd9e535cffbe718acd46404 Author: Lorenzo Bianconi Date: Sat Jan 25 12:48:51 2020 +0100 net: socionext: fix xdp_result initialization in netsec_process_rx Fix xdp_result initialization in netsec_process_rx in order to not increase rx counters if there is no bpf program attached to the xdp hook and napi_gro_receive returns GRO_DROP Fixes: ba2b232108d3c ("net: netsec: add XDP support") Signed-off-by: Lorenzo Bianconi Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit b5e82e3c89c78ee0407ea8e8087af5519b6c7bae Author: Lorenzo Bianconi Date: Sat Jan 25 12:48:50 2020 +0100 net: socionext: fix possible user-after-free in netsec_process_rx Fix possible use-after-free in in netsec_process_rx that can occurs if the first packet is sent to the normal networking stack and the following one is dropped by the bpf program attached to the xdp hook. Fix the issue defining the skb pointer in the 'budget' loop Fixes: ba2b232108d3c ("net: netsec: add XDP support") Signed-off-by: Lorenzo Bianconi Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 09917a126d5babd9d0d9bee8ee2c5fc8517851e6 Merge: cd94ef06392f d48834f9d4b4 Author: David S. Miller Date: Mon Jan 27 11:03:44 2020 +0100 Merge branch 'net-allow-per-net-notifier-to-follow-netdev-into-namespace' Jiri Pirko says: ==================== net: allow per-net notifier to follow netdev into namespace Currently we have per-net notifier, which allows to get only notifications relevant to particular network namespace. That is enough for drivers that have netdevs local in a particular namespace (cannot move elsewhere). However if netdev can change namespace, per-net notifier cannot be used. Introduce dev_net variant that is basically per-net notifier with an extension that re-registers the per-net notifier upon netdev namespace change. Basically the per-net notifier follows the netdev into namespace. ==================== Signed-off-by: David S. Miller commit d48834f9d4b4e7611cc84ac2c5018f1b420d59c2 Author: Jiri Pirko Date: Sat Jan 25 12:17:09 2020 +0100 mlx5: Use dev_net netdevice notifier registrations Register the dev_net notifier and allow the per-net notifier to follow the device into different namespace. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 93642e14bd50e59b11cf6389ce3fc243e932777a Author: Jiri Pirko Date: Sat Jan 25 12:17:08 2020 +0100 net: introduce dev_net notifier register/unregister variants Introduce dev_net variants of netdev notifier register/unregister functions and allow per-net notifier to follow the netdevice into the namespace it is moved to. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 1f637703d8b63f1ba411b4c798e998e3f828b6cb Author: Jiri Pirko Date: Sat Jan 25 12:17:07 2020 +0100 net: push code from net notifier reg/unreg into helpers Push the code which is done under rtnl lock in net notifier register and unregister function into separate helpers. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 48b3a1379fc6603c1ff26893ea05322c1c41e31c Author: Jiri Pirko Date: Sat Jan 25 12:17:06 2020 +0100 net: call call_netdevice_unregister_net_notifiers from unregister The function does the same thing as the existing code, so rather call call_netdevice_unregister_net_notifiers() instead of code duplication. Signed-off-by: Jiri Pirko Reviewed-by: David Ahern Signed-off-by: David S. Miller commit cd94ef06392ffd49e0a0e1c28bc5cd44f37f1f6b Author: Kuniyuki Iwashima Date: Sat Jan 25 10:41:02 2020 +0000 soreuseport: Cleanup duplicate initialization of more_reuse->max_socks. reuseport_grow() does not need to initialize the more_reuse->max_socks again. It is already initialized in __reuseport_alloc(). Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4d434705cbdbb2415b20a0d89f0a3065f5501e28 Merge: 79572c98c554 9fd1ff5d2ac7 Author: David S. Miller Date: Mon Jan 27 11:00:21 2020 +0100 Merge branch 'Support-fraglist-GRO-GSO' Steffen Klassert says: ==================== Support fraglist GRO/GSO This patchset adds support to do GRO/GSO by chaining packets of the same flow at the SKB frag_list pointer. This avoids the overhead to merge payloads into one big packet, and on the other end, if GSO is needed it avoids the overhead of splitting the big packet back to the native form. Patch 1 adds netdev feature flags to enable fraglist GRO, this implements one of the configuration options discussed at netconf 2019. Patch 2 adds a netdev software feature set that defaults to off and assigns the new fraglist GRO feature flag to it. Patch 3 adds the core infrastructure to do fraglist GRO/GSO. Patch 4 enables UDP to use fraglist GRO/GSO if configured. I have only meaningful forwarding performance measurements. I did some tests for the local receive path with netperf and iperf, but in this case the sender that generates the packets is the bottleneck. So the benchmarks are not that meaningful for the receive path. Paolo Abeni did some benchmarks of the local receive path for the RFC v2 version of this pachset, results can be found here: https://www.spinics.net/lists/netdev/msg551158.html I used my IPsec forwarding test setup for the performance measurements: ------------ ------------ -->| router 1 |-------->| router 2 |-- | ------------ ------------ | | | | -------------------- | --------|Spirent Testcenter|<---------- -------------------- net-next (September 7th 2019): Single stream UDP frame size 1460 Bytes: 1.161.000 fps (13.5 Gbps). ---------------------------------------------------------------------- net-next (September 7th 2019) + standard UDP GRO/GSO (not implemented in this patchset): Single stream UDP frame size 1460 Bytes: 1.801.000 fps (21 Gbps). ---------------------------------------------------------------------- net-next (September 7th 2019) + fraglist UDP GRO/GSO: Single stream UDP frame size 1460 Bytes: 2.860.000 fps (33.4 Gbps). ======================================================================= net-next (January 23th 2020): Single stream UDP frame size 1460 Bytes: 919.000 fps (10.73 Gbps). ---------------------------------------------------------------------- net-next (January 23th 2020) + fraglist UDP GRO/GSO: Single stream UDP frame size 1460 Bytes: 2.430.000 fps (28.38 Gbps). ----------------------------------------------------------------------- Changes from RFC v1: - Add IPv6 support. - Split patchset to enable UDP GRO by default before adding fraglist GRO support. - Mark fraglist GRO packets as CHECKSUM_NONE. - Take a refcount on the first segment skb when doing fraglist segmentation. With this we can use the same error handling path as with standard segmentation. Changes from RFC v2: - Add a netdev feature flag to configure listifyed GRO. - Fix UDP GRO enabling for IPv6. - Fix a rcu_read_lock() imbalance. - Fix error path in skb_segment_list(). Changes from RFC v3: - Rename NETIF_F_GRO_LIST to NETIF_F_GRO_FRAGLIST and add NETIF_F_GSO_FRAGLIST. - Move introduction of SKB_GSO_FRAGLIST to patch 2. - Use udpv6_encap_needed_key instead of udp_encap_needed_key in IPv6. - Move some missplaced code from patch 5 to patch 1 where it belongs to. Changes from RFC v4: - Drop the 'UDP: enable GRO by default' patch for now. Standard UDP GRO is not changed with this patchset. - Rebase to net-next current. Changes fom v1 (December 18th): - Do a full __copy_skb_header instead of tryng to find the really needed subset header fields. Thisa can be done later. - Mark all fraglist GRO packets with CHECKSUM_UNNECESSARY. - Rebase to net-next current. Changes fom v2 (January 24th): - Do the CHECKSUM_UNNECESSARY setting from IPv4 for IPv6 too. ==================== Signed-off-by: David S. Miller commit 9fd1ff5d2ac7181844735806b0a703c942365291 Author: Steffen Klassert Date: Sat Jan 25 11:26:45 2020 +0100 udp: Support UDP fraglist GRO/GSO. This patch extends UDP GRO to support fraglist GRO/GSO by using the previously introduced infrastructure. If the feature is enabled, all UDP packets are going to fraglist GRO (local input and forward). After validating the csum, we mark ip_summed as CHECKSUM_UNNECESSARY for fraglist GRO packets to make sure that the csum is not touched. Signed-off-by: Steffen Klassert Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Author: Steffen Klassert Date: Sat Jan 25 11:26:44 2020 +0100 net: Support GRO/GSO fraglist chaining. This patch adds the core functions to chain/unchain GSO skbs at the frag_list pointer. This also adds a new GSO type SKB_GSO_FRAGLIST and a is_flist flag to napi_gro_cb which indicates that this flow will be GROed by fraglist chaining. Signed-off-by: Steffen Klassert Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 1a3c998f3a27ab6ecf56bdbb17e27e55fd6d47cd Author: Steffen Klassert Date: Sat Jan 25 11:26:43 2020 +0100 net: Add a netdev software feature set that defaults to off. The previous patch added the NETIF_F_GRO_FRAGLIST feature. This is a software feature that should default to off. Current software features default to on, so add a new feature set that defaults to off. Signed-off-by: Steffen Klassert Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3b33583265ed3b0ae76eddbabf9d038b4076d1a9 Author: Steffen Klassert Date: Sat Jan 25 11:26:42 2020 +0100 net: Add fraglist GRO/GSO feature flags This adds new Fraglist GRO/GSO feature flags. They will be used to configure fraglist GRO/GSO what will be implemented with some followup paches. Signed-off-by: Steffen Klassert Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 79572c98c554dcdb080bca547c871a51716dcdf8 Author: Sven Auhagen Date: Sat Jan 25 08:07:03 2020 +0000 mvneta driver disallow XDP program on hardware buffer management Recently XDP Support was added to the mvneta driver for software buffer management only. It is still possible to attach an XDP program if hardware buffer management is used. It is not doing anything at that point. The patch disallows attaching XDP programs to mvneta if hardware buffer management is used. I am sorry about that. It is my first submission and I am having some troubles with the format of my emails. v4 -> v5: - Remove extra tabs v3 -> v4: - Please ignore v3 I accidentally submitted my other patch with git-send-mail and v4 is correct v2 -> v3: - My mailserver corrupted the patch resubmission with git-send-email v1 -> v2: - Fixing the patches indentation Signed-off-by: Sven Auhagen Signed-off-by: David S. Miller commit ca11abf113474fe8e1205c6851a9a6ffd598bb26 Merge: 3dd855147fef 643956e61ced 0528904926aa 3df663a147fe 0435bcd9e185 1985f8c7f9a4 Author: Rafael J. Wysocki Date: Mon Jan 27 10:58:05 2020 +0100 Merge branches 'acpi-tables', 'acpi-button', 'acpi-ec', 'acpi-doc' and 'acpi-tools' * acpi-tables: ACPI: PPTT: Consistently use unsigned int as parameter type * acpi-button: ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch * acpi-ec: ACPI: EC: Reference count query handlers under lock * acpi-doc: docs: firmware-guide: ACPI: Replace dma_request_slave_channel() with dma_request_chan() * acpi-tools: tools/power/acpi: fix compilation error commit 3dd855147feff375dfa6737331628ea919e9da59 Merge: ff7a672f83b3 ff3154d1d89a d21a91629f4b d19e470b6605 9b1b5535dfc9 Author: Rafael J. Wysocki Date: Mon Jan 27 10:57:09 2020 +0100 Merge branches 'acpi-battery', 'acpi-video', 'acpi-fan' and 'acpi-drivers' * acpi-battery: ACPI / battery: Deal better with neither design nor full capacity not being reported ACPI / battery: Use design-cap for capacity calculations if full-cap is not available ACPI / battery: Deal with design or full capacity being reported as -1 * acpi-video: ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards ACPI: video: Use native backlight on Lenovo E41-25/45 ACPI: video: fix typo in comment * acpi-fan: ACPI: fan: Expose fan performance state information * acpi-drivers: thermal: int340x_thermal: Add Tiger Lake ACPI device IDs platform/x86: intel-hid: Add Tiger Lake ACPI device ID ACPI: fan: Add Tiger Lake ACPI device ID ACPI: DPTF: Add Tiger Lake ACPI device IDs commit ff7a672f83b355365478a1fdfb60933ef34d8d02 Merge: cea79e7e2f24 be91c44288be Author: Rafael J. Wysocki Date: Mon Jan 27 10:56:49 2020 +0100 Merge branch 'acpica' * acpica: ACPICA: Update version to 20200110 ACPICA: All acpica: Update copyrights to 2020 Including tool signons. ACPICA: Update the list of maintainers ACPICA: Update version to 20191213 ACPICA: Dispatcher: always generate buffer objects for ASL create_field() operator ACPICA: acpisrc: add unix line ending support for non-windows build ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 ACPICA: debugger: fix spelling mistake "adress" -> "address" commit 122d74fac84204b9a98263636f6f9a3b2e665639 Author: David Howells Date: Fri Jan 24 23:08:04 2020 +0000 rxrpc: Fix use-after-free in rxrpc_receive_data() The subpacket scanning loop in rxrpc_receive_data() references the subpacket count in the private data part of the sk_buff in the loop termination condition. However, when the final subpacket is pasted into the ring buffer, the function is no longer has a ref on the sk_buff and should not be looking at sp->* any more. This point is actually marked in the code when skb is cleared (but sp is not - which is an error). Fix this by caching sp->nr_subpackets in a local variable and using that instead. Also clear 'sp' to catch accesses after that point. This can show up as an oops in rxrpc_get_skb() if sp->nr_subpackets gets trashed by the sk_buff getting freed and reused in the meantime. Fixes: e2de6c404898 ("rxrpc: Use info in skbuff instead of reparsing a jumbo packet") Signed-off-by: David Howells Signed-off-by: David S. Miller commit 55cd9f67f1e45de8517cdaab985fb8e56c0bc1d8 Author: Eric Dumazet Date: Fri Jan 24 14:57:20 2020 -0800 net_sched: ematch: reject invalid TCF_EM_SIMPLE It is possible for malicious userspace to set TCF_EM_SIMPLE bit even for matches that should not have this bit set. This can fool two places using tcf_em_is_simple() 1) tcf_em_tree_destroy() -> memory leak of em->data if ops->destroy() is NULL 2) tcf_em_tree_dump() wrongly report/leak 4 low-order bytes of a kernel pointer. BUG: memory leak unreferenced object 0xffff888121850a40 (size 32): comm "syz-executor927", pid 7193, jiffies 4294941655 (age 19.840s) hex dump (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f67036ea>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<00000000f67036ea>] slab_post_alloc_hook mm/slab.h:586 [inline] [<00000000f67036ea>] slab_alloc mm/slab.c:3320 [inline] [<00000000f67036ea>] __do_kmalloc mm/slab.c:3654 [inline] [<00000000f67036ea>] __kmalloc_track_caller+0x165/0x300 mm/slab.c:3671 [<00000000fab0cc8e>] kmemdup+0x27/0x60 mm/util.c:127 [<00000000d9992e0a>] kmemdup include/linux/string.h:453 [inline] [<00000000d9992e0a>] em_nbyte_change+0x5b/0x90 net/sched/em_nbyte.c:32 [<000000007e04f711>] tcf_em_validate net/sched/ematch.c:241 [inline] [<000000007e04f711>] tcf_em_tree_validate net/sched/ematch.c:359 [inline] [<000000007e04f711>] tcf_em_tree_validate+0x332/0x46f net/sched/ematch.c:300 [<000000007a769204>] basic_set_parms net/sched/cls_basic.c:157 [inline] [<000000007a769204>] basic_change+0x1d7/0x5f0 net/sched/cls_basic.c:219 [<00000000e57a5997>] tc_new_tfilter+0x566/0xf70 net/sched/cls_api.c:2104 [<0000000074b68559>] rtnetlink_rcv_msg+0x3b2/0x4b0 net/core/rtnetlink.c:5415 [<00000000b7fe53fb>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<00000000e83a40d0>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 [<00000000d62ba933>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [<00000000d62ba933>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328 [<0000000088070f72>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917 [<00000000f70b15ea>] sock_sendmsg_nosec net/socket.c:639 [inline] [<00000000f70b15ea>] sock_sendmsg+0x54/0x70 net/socket.c:659 [<00000000ef95a9be>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330 [<00000000b650f1ab>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384 [<0000000055bfa74a>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417 [<000000002abac183>] __do_sys_sendmsg net/socket.c:2426 [inline] [<000000002abac183>] __se_sys_sendmsg net/socket.c:2424 [inline] [<000000002abac183>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot+03c4738ed29d5d366ddf@syzkaller.appspotmail.com Cc: Cong Wang Acked-by: Cong Wang Signed-off-by: David S. Miller commit 90435a7891a2259b0f74c5a1bc5600d0d64cba8f Author: Vasily Averin Date: Sat Jan 25 12:10:02 2020 +0300 bpf: map_seq_next should always increase position index If seq_file .next fuction does not change position index, read after some lseek can generate an unexpected output. See also: https://bugzilla.kernel.org/show_bug.cgi?id=206283 v1 -> v2: removed missed increment in end of function Signed-off-by: Vasily Averin Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/eca84fdd-c374-a154-d874-6c7b55fc3bc4@virtuozzo.com commit f9e95555757915fc194288862d2978e370fe316b Author: Stephen Worley Date: Fri Jan 24 16:53:27 2020 -0500 net: include struct nhmsg size in nh nlmsg size Include the size of struct nhmsg size when calculating how much of a payload to allocate in a new netlink nexthop notification message. Without this, we will fail to fill the skbuff at certain nexthop group sizes. You can reproduce the failure with the following iproute2 commands: ip link add dummy1 type dummy ip link add dummy2 type dummy ip link add dummy3 type dummy ip link add dummy4 type dummy ip link add dummy5 type dummy ip link add dummy6 type dummy ip link add dummy7 type dummy ip link add dummy8 type dummy ip link add dummy9 type dummy ip link add dummy10 type dummy ip link add dummy11 type dummy ip link add dummy12 type dummy ip link add dummy13 type dummy ip link add dummy14 type dummy ip link add dummy15 type dummy ip link add dummy16 type dummy ip link add dummy17 type dummy ip link add dummy18 type dummy ip link add dummy19 type dummy ip ro add 1.1.1.1/32 dev dummy1 ip ro add 1.1.1.2/32 dev dummy2 ip ro add 1.1.1.3/32 dev dummy3 ip ro add 1.1.1.4/32 dev dummy4 ip ro add 1.1.1.5/32 dev dummy5 ip ro add 1.1.1.6/32 dev dummy6 ip ro add 1.1.1.7/32 dev dummy7 ip ro add 1.1.1.8/32 dev dummy8 ip ro add 1.1.1.9/32 dev dummy9 ip ro add 1.1.1.10/32 dev dummy10 ip ro add 1.1.1.11/32 dev dummy11 ip ro add 1.1.1.12/32 dev dummy12 ip ro add 1.1.1.13/32 dev dummy13 ip ro add 1.1.1.14/32 dev dummy14 ip ro add 1.1.1.15/32 dev dummy15 ip ro add 1.1.1.16/32 dev dummy16 ip ro add 1.1.1.17/32 dev dummy17 ip ro add 1.1.1.18/32 dev dummy18 ip ro add 1.1.1.19/32 dev dummy19 ip next add id 1 via 1.1.1.1 dev dummy1 ip next add id 2 via 1.1.1.2 dev dummy2 ip next add id 3 via 1.1.1.3 dev dummy3 ip next add id 4 via 1.1.1.4 dev dummy4 ip next add id 5 via 1.1.1.5 dev dummy5 ip next add id 6 via 1.1.1.6 dev dummy6 ip next add id 7 via 1.1.1.7 dev dummy7 ip next add id 8 via 1.1.1.8 dev dummy8 ip next add id 9 via 1.1.1.9 dev dummy9 ip next add id 10 via 1.1.1.10 dev dummy10 ip next add id 11 via 1.1.1.11 dev dummy11 ip next add id 12 via 1.1.1.12 dev dummy12 ip next add id 13 via 1.1.1.13 dev dummy13 ip next add id 14 via 1.1.1.14 dev dummy14 ip next add id 15 via 1.1.1.15 dev dummy15 ip next add id 16 via 1.1.1.16 dev dummy16 ip next add id 17 via 1.1.1.17 dev dummy17 ip next add id 18 via 1.1.1.18 dev dummy18 ip next add id 19 via 1.1.1.19 dev dummy19 ip next add id 1111 group 1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16/17/18/19 ip next del id 1111 Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Signed-off-by: Stephen Worley Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 07fdbee134b3530ef30c709aa4251ca04ea9e3f8 Author: Andrey Ignatov Date: Fri Jan 24 14:41:42 2020 -0800 tools/bpf: Allow overriding llvm tools for runqslower tools/testing/selftests/bpf/Makefile supports overriding clang, llc and other tools so that custom ones can be used instead of those from PATH. It's convinient and heavily used by some users. Apply same rules to runqslower/Makefile. Signed-off-by: Andrey Ignatov Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20200124224142.1833678-1-rdna@fb.com commit 760d228e322e99cdf6d81b4b60a268b8f13cf67a Author: Cong Wang Date: Thu Jan 23 17:27:08 2020 -0800 net_sched: walk through all child classes in tc_bind_tclass() In a complex TC class hierarchy like this: tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 100Mbit \ avpkt 1000 cell 8 tc class add dev eth0 parent 1:0 classid 1:1 cbq bandwidth 100Mbit \ rate 6Mbit weight 0.6Mbit prio 8 allot 1514 cell 8 maxburst 20 \ avpkt 1000 bounded tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip \ sport 80 0xffff flowid 1:3 tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip \ sport 25 0xffff flowid 1:4 tc class add dev eth0 parent 1:1 classid 1:3 cbq bandwidth 100Mbit \ rate 5Mbit weight 0.5Mbit prio 5 allot 1514 cell 8 maxburst 20 \ avpkt 1000 tc class add dev eth0 parent 1:1 classid 1:4 cbq bandwidth 100Mbit \ rate 3Mbit weight 0.3Mbit prio 5 allot 1514 cell 8 maxburst 20 \ avpkt 1000 where filters are installed on qdisc 1:0, so we can't merely search from class 1:1 when creating class 1:3 and class 1:4. We have to walk through all the child classes of the direct parent qdisc. Otherwise we would miss filters those need reverse binding. Fixes: 07d79fc7d94e ("net_sched: add reverse binding for tc class") Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 2e24cd755552350b94a7617617c6877b8cbcb701 Author: Cong Wang Date: Thu Jan 23 16:26:18 2020 -0800 net_sched: fix ops->bind_class() implementations The current implementations of ops->bind_class() are merely searching for classid and updating class in the struct tcf_result, without invoking either of cl_ops->bind_tcf() or cl_ops->unbind_tcf(). This breaks the design of them as qdisc's like cbq use them to count filters too. This is why syzbot triggered the warning in cbq_destroy_class(). In order to fix this, we have to call cl_ops->bind_tcf() and cl_ops->unbind_tcf() like the filter binding path. This patch does so by refactoring out two helper functions __tcf_bind_filter() and __tcf_unbind_filter(), which are lockless and accept a Qdisc pointer, then teaching each implementation to call them correctly. Note, we merely pass the Qdisc pointer as an opaque pointer to each filter, they only need to pass it down to the helper functions without understanding it at all. Fixes: 07d79fc7d94e ("net_sched: add reverse binding for tc class") Reported-and-tested-by: syzbot+0a0596220218fcb603a8@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+63bdb6006961d8c917c6@syzkaller.appspotmail.com Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit cf913e9683273f2640501094fa63a67e29f437b3 Author: Jernej Skrabec Date: Sun Jan 26 07:59:37 2020 +0100 Revert "drm/sun4i: drv: Allow framebuffer modifiers in mode config" This reverts commit 9db9c0cf5895e4ddde2814360cae7bea9282edd2. Setting mode_config.allow_fb_modifiers manually is completely unnecessary. It is set automatically by drm_universal_plane_init() based on the fact if modifier list is provided or not. Even more, it breaks DE2 and DE3 as they don't support any modifiers beside linear. Modifiers aware applications can be confused by provided empty modifier list - at least linear modifier should be included, but it's not for DE2 and DE3. Fixes: 9db9c0cf5895 ("drm/sun4i: drv: Allow framebuffer modifiers in mode config") Signed-off-by: Jernej Skrabec Reviewed-by: Paul Kocialkowski Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20200126065937.9564-1-jernej.skrabec@siol.net commit c267930f3f10afc225e6c18f34be2fd4fd928194 Merge: e42617b825f8 03758d60265c Author: Rafael J. Wysocki Date: Mon Jan 27 10:38:51 2020 +0100 Merge branch 'opp/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull operating performance points (OPP) framework updates for v5.6 from Viresh Kumar: "This contains a single patchset to fix reference counting of OPP table structures." * 'opp/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: opp: Replace list_kref with a local counter opp: Free static OPPs on errors while adding them commit 1e4f63aecb53e48468661e922fc2fa3b83e55722 Author: Rafael J. Wysocki Date: Sun Jan 26 23:40:11 2020 +0100 cpufreq: Avoid creating excessively large stack frames In the process of modifying a cpufreq policy, the cpufreq core makes a copy of it including all of the internals which is stored on the CPU stack. Because struct cpufreq_policy is relatively large, this may cause the size of the stack frame to exceed the 2 KB limit and so the GCC complains when -Wframe-larger-than= is used. In fact, it is not necessary to copy the entire policy structure in order to modify it, however. First, because cpufreq_set_policy() obtains the min and max policy limits from frequency QoS now, it is not necessary to pass the limits to it from the callers. The only things that need to be passed to it from there are the new governor pointer or (if there is a built-in governor in the driver) the "policy" value representing the governor choice. They both can be passed as individual arguments, though, so make cpufreq_set_policy() take them this way and rework its callers accordingly. This avoids making copies of cpufreq policies in the callers of cpufreq_set_policy(). Second, cpufreq_set_policy() still needs to pass the new policy data to the ->verify() callback of the cpufreq driver whose task is to sanitize the min and max policy limits. It still does not need to make a full copy of struct cpufreq_policy for this purpose, but it needs to pass a few items from it to the driver in case they are needed (different drivers have different needs in that respect and all of them have to be covered). For this reason, introduce struct cpufreq_policy_data to hold copies of the members of struct cpufreq_policy used by the existing ->verify() driver callbacks and pass a pointer to a temporary structure of that type to ->verify() (instead of passing a pointer to full struct cpufreq_policy to it). While at it, notice that intel_pstate and longrun don't really need to verify the "policy" value in struct cpufreq_policy, so drop those check from them to avoid copying "policy" into struct cpufreq_policy_data (which allows it to be slightly smaller). Also while at it fix up white space in a couple of places and make cpufreq_set_policy() static (as it can be so). Fixes: 3000ce3c52f8 ("cpufreq: Use per-policy frequency QoS") Link: https://lore.kernel.org/linux-pm/CAMuHMdX6-jb1W8uC2_237m8ctCpsnGp=JCxqt8pCWVqNXHmkVg@mail.gmail.com Reported-by: kbuild test robot Reported-by: Geert Uytterhoeven Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar commit 0a9db0a0e32c450a937206cec56d7bd5bb8c8907 Merge: 1250c1a568ca a48ac1c9f294 Author: Rafael J. Wysocki Date: Mon Jan 27 10:31:11 2020 +0100 Merge branch 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq material for v5.6 from Viresh Kumar: "This contains: - Update to imx cpufreq driver to add support for i.MX8MP platform. - Blacklists few NVIDIA SoCs from cpufreq-dt-platdev layer. - Convertion of few platform drivers to use devm_platform_ioremap_resource(). - Fixed refcount imbalance in few drivers." * 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: brcmstb-avs: fix imbalance of cpufreq policy refcount cpufreq: s3c: fix unbalances of cpufreq policy refcount cpufreq: imx-cpufreq-dt: Add i.MX8MP support cpufreq: Use imx-cpufreq-dt for i.MX8MP's speed grading cpufreq: tegra186: convert to devm_platform_ioremap_resource cpufreq: kirkwood: convert to devm_platform_ioremap_resource commit ca07ee4e3de468582e9a370ccfad3e4cf83b5268 Author: Krzysztof Kozlowski Date: Sat Jan 4 16:20:53 2020 +0100 thermal: exynos: Rename Samsung and Exynos to lowercase Fix up inconsistent usage of upper and lowercase letters in "Samsung" and "Exynos" names. "SAMSUNG" and "EXYNOS" are not abbreviations but regular trademarked names. Therefore they should be written with lowercase letters starting with capital letter. The lowercase "Exynos" name is promoted by its manufacturer Samsung Electronics Co., Ltd., in advertisement materials and on website. Although advertisement materials usually use uppercase "SAMSUNG", the lowercase version is used in all legal aspects (e.g. on Wikipedia and in privacy/legal statements on https://www.samsung.com/semiconductor/privacy-global/). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200104152107.11407-7-krzk@kernel.org commit 07d243a6249712c4a32caf18057a4008d3610d48 Author: Martin Blumenstingl Date: Wed Jan 8 00:20:44 2020 +0100 thermal: generic-adc: silence info message for IIO_TEMP channels Since commit d36e2fa0253875 ("thermal: generic-adc: make lookup table optional") "generic-adc-thermal" can be used with an IIO_TEMP channel. In this case the following message is logged at probe time: no lookup table, assuming DAC channel returns milliCelcius Silence this info message if the channel type is known to be in milli celsius. Keep this message when the channel type is unknown or not of type temperature. Signed-off-by: Martin Blumenstingl Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200107232044.889075-3-martin.blumenstingl@googlemail.com commit c1fde6e19f23f78146a4aeb4a70bbf273224bb0c Author: Martin Blumenstingl Date: Wed Jan 8 00:20:43 2020 +0100 thermal: generic-adc: silence "no lookup table" on deferred probe A "generic-adc-thermal" without "temperature-lookup-table" is perfectly valid since commit d36e2fa0253875 ("thermal: generic-adc: make lookup table optional"). On deferred probe the message "no lookup table, assuming DAC channel returns milliCelcius" is still logged. Prevent this message on deferred probe of the IIO channel by first looking up the IIO channel. Signed-off-by: Martin Blumenstingl Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20200107232044.889075-2-martin.blumenstingl@googlemail.com commit 0b28594d67a80894aa97f466fbe547d74d3f740c Author: Yangtao Li Date: Thu Dec 19 09:28:18 2019 -0800 dt-bindings: thermal: Add YAML schema for sun8i-thermal driver bindings sun8i-thermal driver supports thermal sensor in wide range of Allwinner SoCs. Add YAML schema for its bindings. Signed-off-by: Yangtao Li Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191219172823.1652600-3-anarsoul@gmail.com commit dccc5c3b6f30f27ed0f1bea82221e18face20bef Author: Yangtao Li Date: Thu Dec 19 09:28:17 2019 -0800 thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40 This patch adds the support for allwinner thermal sensor, within allwinner SoC. It will register sensors for thermal framework and use device tree to bind cooling device. Signed-off-by: Yangtao Li Signed-off-by: Ondrej Jirman Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191219172823.1652600-2-anarsoul@gmail.com commit 93802b031b3664a72c54d731f5e68f4f5a4c56a0 Author: Daniel Lezcano Date: Thu Dec 19 23:21:53 2019 +0100 thermal/drivers/of-thermal: Move the of_thermal_free_zone() to the init section The function of_thermal_free_zone() is only used the initialization function which all belonging to the init section. Move it also to the __init section. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191219222154.16100-2-daniel.lezcano@linaro.org commit 8c24b85d2dd479558dc7a53be3f598007ec1a489 Author: Daniel Lezcano Date: Thu Dec 19 23:21:52 2019 +0100 thermal/drivers/of-thermal: Make of_thermal_destroy_zones static The function of_thermal_destroy_zones() is only used internally by the of_parse_thermal_zones() for rollbacking in case of error. Make it static and tag it as an __init function. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191219222154.16100-1-daniel.lezcano@linaro.org commit 23affa2e29c5faa8cb59778f71e3bce2c8b3aa5c Author: Daniel Lezcano Date: Thu Dec 19 23:53:17 2019 +0100 thermal/drivers/cpu_cooling: Rename to cpufreq_cooling As we introduced the idle injection cooling device called cpuidle_cooling, let's be consistent and rename the cpu_cooling to cpufreq_cooling as this one mitigates with OPPs changes. Signed-off-by: Daniel Lezcano Acked-by: Viresh Kumar Reviewed-by: Amit Kucheria Link: https://lore.kernel.org/r/20191219225317.17158-3-daniel.lezcano@linaro.org commit a4c428e523490bf53e9c4ba2d809130c58c06ac7 Author: Daniel Lezcano Date: Thu Dec 19 23:53:16 2019 +0100 thermal/drivers/cpu_cooling: Introduce the cpu idle cooling driver The cpu idle cooling device offers a new method to cool down a CPU by injecting idle cycles at runtime. It has some similarities with the intel power clamp driver but it is actually designed to be more generic and relying on the idle injection powercap framework. The idle injection duration is fixed while the running duration is variable. That allows to have control on the device reactivity for the user experience. An idle state powering down the CPU or the cluster will allow to drop the static leakage, thus restoring the heat capacity of the SoC. It can be set with a trip point between the hot and the critical points, giving the opportunity to prevent a hard reset of the system when the cpufreq cooling fails to cool down the CPU. With more sophisticated boards having a per core sensor, the idle cooling device allows to cool down a single core without throttling the compute capacity of several cpus belonging to the same clock line, so it could be used in collaboration with the cpufreq cooling device. Signed-off-by: Daniel Lezcano Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20191219225317.17158-2-daniel.lezcano@linaro.org commit 0a1990a2d1f2217db20b30f915f48d9b8b976949 Author: Daniel Lezcano Date: Thu Dec 19 23:53:15 2019 +0100 thermal/drivers/cpu_cooling: Add idle cooling device documentation Provide some documentation for the idle injection cooling effect in order to let people to understand the rational of the approach for the idle injection CPU cooling device. Signed-off-by: Daniel Lezcano Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20191219225317.17158-1-daniel.lezcano@linaro.org commit d27970b82a0f552f70e76fab154855b3192aac23 Author: Stefan Schaeckeler Date: Wed Dec 11 22:17:02 2019 -0800 thermal: rockchip: Enable hwmon By default, of-based thermal drivers do not enable hwmon. Explicitly enable hwmon for both, the soc and gpu temperature sensor. Signed-off-by: Stefan Schaeckeler Tested-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191212061702.BFE2D6E85603@corona.crabdance.com commit ff6628951c214ff9f88dd0b3e292b2b54ca28276 Author: Zak Hays Date: Mon Dec 9 18:57:23 2019 +0000 thermal: armada: Clear reset in armadaxp_init The reset bit needs to be cleared in the init sequence otherwise it holds the block in reset. Signed-off-by: Zachary Hays Reviewed-by: Miquel Raynal Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/BN8PR10MB33797EECAC557B5018A0A6628C580@BN8PR10MB3379.namprd10.prod.outlook.com commit 4abb629bea046758b712f4e26b83d7478d3400b2 Author: Zak Hays Date: Mon Dec 9 18:55:51 2019 +0000 thermal: armada: Fix register offsets for AXP As shown in its device tree, Armada XP has the control1 register at 0x184d0, not 0x182d0. Signed-off-by: Zachary Hays Reviewed-by: Miquel Raynal Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/BN8PR10MB337990B7688320D736760BB68C580@BN8PR10MB3379.namprd10.prod.outlook.com commit 2b586feab44f41db605924db15c5b039535b1f9b Author: Daniel Lezcano Date: Wed Dec 4 16:39:27 2019 +0100 thermal/drivers/Kconfig: Convert the CPU cooling device to a choice The next changes will add a new way to cool down a CPU by injecting idle cycles. With the current configuration, a CPU cooling device is the cpufreq cooling device. As we want to add a new CPU cooling device, let's convert the CPU cooling to a choice giving a list of CPU cooling devices. At this point, there is obviously only one CPU cooling device. There is no functional changes. Signed-off-by: Daniel Lezcano Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20191204153930.9128-1-daniel.lezcano@linaro.org commit fd8433099c5b78c2a1915e1b9911ecfdfc041103 Author: Andrey Smirnov Date: Tue Dec 10 08:41:53 2019 -0800 thermal: qoriq: Add hwmon support Expose thermal readings as a HWMON device, so that it could be accessed using lm-sensors. Signed-off-by: Andrey Smirnov Reviewed-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-13-andrew.smirnov@gmail.com commit c7fc403e40b0ea18976a59e968c23439a80809e8 Author: Andrey Smirnov Date: Tue Dec 10 08:41:52 2019 -0800 thermal_hwmon: Add devres wrapper for thermal_add_hwmon_sysfs() Add devres wrapper for thermal_add_hwmon_sysfs() to simplify driver code. Signed-off-by: Andrey Smirnov Reviewed-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-12-andrew.smirnov@gmail.com commit 36564d7e53f9efd14ab5692cd9475a75e8000c98 Author: Andrey Smirnov Date: Tue Dec 10 08:41:51 2019 -0800 thermal: qoriq: Do not report invalid temperature reading Before returning measured temperature data to upper layer we need to make sure that the reading was marked as "valid" to avoid reporting bogus data. Signed-off-by: Andrey Smirnov Reviewed-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-11-andrew.smirnov@gmail.com commit 45038e03d633b0d49e4211e6dc2b5774ca1672f4 Author: Andrey Smirnov Date: Tue Dec 10 08:41:50 2019 -0800 thermal: qoriq: Enable all sensors before registering them Tmu_get_temp will get called as a part of sensor registration via devm_thermal_zone_of_sensor_register(). To prevent it from retruning bogus data we need to enable sensor monitoring before that. Looking at the datasheet (i.MX8MQ RM) there doesn't seem to be any harm in enabling them all, so, for the sake of simplicity, change the code to do just that. Signed-off-by: Andrey Smirnov Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-10-andrew.smirnov@gmail.com commit 4316237bd62728a33e7c069ffb3350399ecdab37 Author: Andrey Smirnov Date: Tue Dec 10 08:41:49 2019 -0800 thermal: qoriq: Convert driver to use regmap API Convert driver to use regmap API, drop custom LE/BE IO helpers and simplify bit manipulation using regmap_update_bits(). This also allows us to convert some register initialization to use loops and adds convenient debug access to TMU registers via debugfs. Signed-off-by: Andrey Smirnov Reviewed-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-9-andrew.smirnov@gmail.com commit 01dc58420a2a506848d26cb80f062e6ae84db458 Author: Andrey Smirnov Date: Tue Dec 10 08:41:48 2019 -0800 thermal: qoriq: Drop unnecessary drvdata cleanup Driver data of underlying struct device will be set to NULL by Linux's driver infrastructure. Clearing it here is unnecessary. Signed-off-by: Andrey Smirnov Reviewed-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-8-andrew.smirnov@gmail.com commit 8e1cda35c3be8ed35cafa50c2b5f719032dd7224 Author: Andrey Smirnov Date: Tue Dec 10 08:41:47 2019 -0800 thermal: qoriq: Pass data to qoriq_tmu_calibration() directly We can simplify error cleanup code if instead of passing a "struct platform_device *" to qoriq_tmu_calibration() and deriving a bunch of pointers from it, we pass those pointers directly. This way we won't be force to call platform_set_drvdata() as early in qoriq_tmu_probe() and need to have "platform_set_drvdata(pdev, NULL);" in error path. Signed-off-by: Andrey Smirnov Reviewed-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-7-andrew.smirnov@gmail.com commit 03036625d35b6b9c152bb81e406aaf98a7cd3c85 Author: Andrey Smirnov Date: Tue Dec 10 08:41:46 2019 -0800 thermal: qoriq: Pass data to qoriq_tmu_register_tmu_zone() directly Pass all necessary data to qoriq_tmu_register_tmu_zone() directly instead of passing a platform device and then deriving it. This is done as a first step to simplify resource deallocation code. Signed-off-by: Andrey Smirnov Acked-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-6-andrew.smirnov@gmail.com commit b319da1b00d28fb7717784a81e5d9ecac0e98bec Author: Andrey Smirnov Date: Tue Dec 10 08:41:45 2019 -0800 thermal: qoriq: Embed per-sensor data into struct qoriq_tmu_data Embed per-sensor data into struct qoriq_tmu_data so we can drop the code allocating it. This also allows us to get rid of per-sensor back reference to struct qoriq_tmu_data since now its address can be calculated using container_of(). Signed-off-by: Andrey Smirnov Cc: Chris Healy Cc: Lucas Stach Cc: Zhang Rui Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-5-andrew.smirnov@gmail.com commit d6fb05647b10bfd440616de12ca92df6b80652cd Author: Andrey Smirnov Date: Tue Dec 10 08:41:44 2019 -0800 thermal: qoriq: Add local struct qoriq_sensor pointer Add local struct qoriq_sensor pointer in qoriq_tmu_register_tmu_zone() for brevity. Signed-off-by: Andrey Smirnov Cc: Chris Healy Cc: Lucas Stach Cc: Zhang Rui Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-4-andrew.smirnov@gmail.com commit 11ef00f799133b141eb50cab68bca96480c72d80 Author: Andrey Smirnov Date: Tue Dec 10 08:41:43 2019 -0800 thermal: qoriq: Don't store struct thermal_zone_device reference Struct thermal_zone_device reference stored as sensor's private data isn't really used anywhere in the code. Drop it. Signed-off-by: Andrey Smirnov Acked-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-3-andrew.smirnov@gmail.com commit e167dc43295fb76ff711dd55ce4e39d3656c5481 Author: Andrey Smirnov Date: Tue Dec 10 08:41:42 2019 -0800 thermal: qoriq: Add local struct device pointer Use a local "struct device *dev" for brevity. No functional change intended. Signed-off-by: Andrey Smirnov Acked-by: Daniel Lezcano Tested-by: Lucas Stach Cc: Chris Healy Cc: Lucas Stach Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: Angus Ainslie (Purism) Cc: linux-imx@nxp.com Cc: linux-pm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191210164153.10463-2-andrew.smirnov@gmail.com commit 5ca73af203951c60b328c7f394825b3fa0f6b0b8 Author: Amit Kucheria Date: Wed Nov 20 21:15:20 2019 +0530 thermal: zx2967: Appease the kernel-doc deity Fix up the following warning when compiled with make W=1: linux.git/drivers/thermal/zx2967_thermal.c:57: warning: Function parameter or member 'dev' not described in 'zx2967_thermal_priv' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1b4f6fb91e2e713ad5135f0d40dcded65dee9d0e.1574242756.git.amit.kucheria@linaro.org commit be7b848be582ef0c39963d8bd8915b82b99469d6 Author: Amit Kucheria Date: Wed Nov 20 21:15:19 2019 +0530 thermal: amlogic: Appease the kernel-doc deity Fix up the following warning when compiled with make W=1: linux.git/drivers/thermal/amlogic_thermal.c:78: warning: Function parameter or member 'A' not described in 'amlogic_thermal_soc_calib_data' linux.git/drivers/thermal/amlogic_thermal.c:78: warning: Function parameter or member 'B' not described in 'amlogic_thermal_soc_calib_data' linux.git/drivers/thermal/amlogic_thermal.c:78: warning: Function parameter or member 'm' not described in 'amlogic_thermal_soc_calib_data' linux.git/drivers/thermal/amlogic_thermal.c:78: warning: Function parameter or member 'n' not described in 'amlogic_thermal_soc_calib_data' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/139c9191f1a18d528b5f94376facf40291d28244.1574242756.git.amit.kucheria@linaro.org commit 6a6d634cd8df10471775911a0d21e0deebbf7ff5 Author: Amit Kucheria Date: Wed Nov 20 21:15:18 2019 +0530 thermal: tegra: Appease the kernel-doc deity Fix up the following warning when compiled with make W=1: linux.git/drivers/thermal/tegra/soctherm.c:369: warning: Function parameter or member 'value' not described in 'ccroc_writel' linux.git/drivers/thermal/tegra/soctherm.c:369: warning: Excess function parameter 'v' description in 'ccroc_writel' linux.git/drivers/thermal/tegra/soctherm.c:447: warning: Function parameter or member 'dev' not described in 'enforce_temp_range' linux.git/drivers/thermal/tegra/soctherm.c:772: warning: Function parameter or member 'sg' not described in 'tegra_soctherm_set_hwtrips' linux.git/drivers/thermal/tegra/soctherm.c:772: warning: Function parameter or member 'tz' not described in 'tegra_soctherm_set_hwtrips' linux.git/drivers/thermal/tegra/soctherm.c:944: warning: Function parameter or member 'ts' not described in 'soctherm_oc_intr_enable' linux.git/drivers/thermal/tegra/soctherm.c:1167: warning: Function parameter or member 'data' not described in 'soctherm_oc_irq_disable' linux.git/drivers/thermal/tegra/soctherm.c:1167: warning: Excess function parameter 'irq_data' description in 'soctherm_oc_irq_disable' linux.git/drivers/thermal/tegra/soctherm.c:1224: warning: Function parameter or member 'ctrlr' not described in 'soctherm_irq_domain_xlate_twocell' linux.git/drivers/thermal/tegra/soctherm.c:1686: warning: Function parameter or member 'pdev' not described in 'soctherm_init_hw_throt_cdev' linux.git/drivers/thermal/tegra/soctherm.c:1764: warning: Function parameter or member 'ts' not described in 'throttlectl_cpu_level_cfg' linux.git/drivers/thermal/tegra/soctherm.c:1812: warning: Function parameter or member 'ts' not described in 'throttlectl_cpu_level_select' linux.git/drivers/thermal/tegra/soctherm.c:1855: warning: Function parameter or member 'ts' not described in 'throttlectl_cpu_mn' linux.git/drivers/thermal/tegra/soctherm.c:1886: warning: Function parameter or member 'ts' not described in 'throttlectl_gpu_level_select' linux.git/drivers/thermal/tegra/soctherm.c:1928: warning: Function parameter or member 'ts' not described in 'soctherm_throttle_program' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/db764f71253bb2ad569b0aeab4c91207a39317ce.1574242756.git.amit.kucheria@linaro.org commit 9625e9e694e7470beaa4bf61244f3568d1457081 Author: Amit Kucheria Date: Wed Nov 20 21:15:17 2019 +0530 thermal: samsung: Appease the kernel-doc deity Fix up the following warning when compiled with make W=1: linux.git/drivers/thermal/samsung/exynos_tmu.c:141: warning: bad line: driver linux.git/drivers/thermal/samsung/exynos_tmu.c:203: warning: Function parameter or member 'tzd' not described in 'exynos_tmu_data' linux.git/drivers/thermal/samsung/exynos_tmu.c:203: warning: Function parameter or member 'tmu_set_trip_temp' not described in 'exynos_tmu_data' linux.git/drivers/thermal/samsung/exynos_tmu.c:203: warning: Function parameter or member 'tmu_set_trip_hyst' not described in 'exynos_tmu_data' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1ded1697c6e5eff11b034b3302b9c79e88fa9c42.1574242756.git.amit.kucheria@linaro.org commit 66ec4bfcb55e5da0a7258a954f7be1495c053167 Author: Amit Kucheria Date: Wed Nov 20 21:15:16 2019 +0530 thermal: rockchip: Appease the kernel-doc deity Replace a comment starting with /** by simply /* to avoid having it interpreted as a kernel-doc comment. Describe missing function parameters where needed. Fixes up the following warnings when compiled with make W=1: linux.git/drivers/thermal/rockchip_thermal.c:27: warning: cannot understand function prototype: 'enum tshut_mode ' linux.git/drivers/thermal/rockchip_thermal.c:37: warning: cannot understand function prototype: 'enum tshut_polarity ' linux.git/drivers/thermal/rockchip_thermal.c:46: warning: cannot understand function prototype: 'enum sensor_id ' linux.git/drivers/thermal/rockchip_thermal.c:56: warning: cannot understand function prototype: 'enum adc_sort_mode ' linux.git/drivers/thermal/rockchip_thermal.c:123: warning: Function parameter or member 'chn_id' not described in 'rockchip_tsadc_chip' linux.git/drivers/thermal/rockchip_thermal.c:123: warning: Function parameter or member 'control' not described in 'rockchip_tsadc_chip' linux.git/drivers/thermal/rockchip_thermal.c:167: warning: Function parameter or member 'sensors' not described in 'rockchip_thermal_data' linux.git/drivers/thermal/rockchip_thermal.c:608: warning: Function parameter or member 'grf' not described in 'rk_tsadcv2_initialize' linux.git/drivers/thermal/rockchip_thermal.c:608: warning: Function parameter or member 'regs' not described in 'rk_tsadcv2_initialize' linux.git/drivers/thermal/rockchip_thermal.c:608: warning: Function parameter or member 'tshut_polarity' not described in 'rk_tsadcv2_initialize' linux.git/drivers/thermal/rockchip_thermal.c:644: warning: Function parameter or member 'grf' not described in 'rk_tsadcv3_initialize' linux.git/drivers/thermal/rockchip_thermal.c:644: warning: Function parameter or member 'regs' not described in 'rk_tsadcv3_initialize' linux.git/drivers/thermal/rockchip_thermal.c:644: warning: Function parameter or member 'tshut_polarity' not described in 'rk_tsadcv3_initialize' linux.git/drivers/thermal/rockchip_thermal.c:732: warning: Function parameter or member 'regs' not described in 'rk_tsadcv3_control' linux.git/drivers/thermal/rockchip_thermal.c:732: warning: Function parameter or member 'enable' not described in 'rk_tsadcv3_control' linux.git/drivers/thermal/rockchip_thermal.c:1211: warning: Function parameter or member 'reset' not described in 'rockchip_thermal_reset_controller' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/c3cbdb0619fec602668ba7ae703ba49d67e30b33.1574242756.git.amit.kucheria@linaro.org commit 3772bb422072d499683f6dc8a9e3a6c8791bbd86 Author: Amit Kucheria Date: Wed Nov 20 21:15:15 2019 +0530 thermal: mediatek: Appease the kernel-doc deity Replace a comment starting with /** by simply /* to avoid having it interpreted as a kernel-doc comment. Describe missing function parameters where needed. Fixes up the following warnings when compiled with make W=1: linux.git/drivers/thermal/mtk_thermal.c:374: warning: cannot understand function prototype: 'const struct mtk_thermal_data mt8173_thermal_data = ' linux.git/drivers/thermal/mtk_thermal.c:413: warning: cannot understand function prototype: 'const struct mtk_thermal_data mt2701_thermal_data = ' linux.git/drivers/thermal/mtk_thermal.c:443: warning: cannot understand function prototype: 'const struct mtk_thermal_data mt2712_thermal_data = ' linux.git/drivers/thermal/mtk_thermal.c:499: warning: cannot understand function prototype: 'const struct mtk_thermal_data mt8183_thermal_data = ' linux.git/drivers/thermal/mtk_thermal.c:529: warning: Function parameter or member 'sensno' not described in 'raw_to_mcelsius' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/ba10b886705879fd1b7d529fec50503d6696df20.1574242756.git.amit.kucheria@linaro.org commit 0f43e646dddd60e51e66f8cf53de0a13d8fdd06b Author: Amit Kucheria Date: Wed Nov 20 21:15:14 2019 +0530 thermal: max77620: Appease the kernel-doc deity Fix up the following warning when compiled with make W=1: linux.git/drivers/thermal/max77620_thermal.c:48: warning: Function parameter or member 'temp' not described in 'max77620_thermal_read_temp' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/c943d51e7913a4b73cda447547b8ee77c857f7ba.1574242756.git.amit.kucheria@linaro.org commit 1b5cb9570670a6277cc0bba70409402359f7715d Author: Amit Kucheria Date: Wed Nov 20 21:15:13 2019 +0530 thermal: devfreq_cooling: Appease the kernel-doc deity Fix up the following warnings with make W=1: linux.git/drivers/thermal/devfreq_cooling.c:68: warning: Function parameter or member 'capped_state' not described in 'devfreq_cooling_device' linux.git/drivers/thermal/devfreq_cooling.c:593: warning: Function parameter or member 'cdev' not described in 'devfreq_cooling_unregister' linux.git/drivers/thermal/devfreq_cooling.c:593: warning: Excess function parameter 'dfc' description in 'devfreq_cooling_unregister' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/7059d82472fe12139fc7a3379c5b9716a23cce5c.1574242756.git.amit.kucheria@linaro.org commit 53d256e7966d13d0f48556680e7fe682ee18084b Author: Amit Kucheria Date: Wed Nov 20 21:15:12 2019 +0530 thermal: step_wise: Appease the kernel-doc deity Replace - with : to appease the kernel-doc gods and fix warnings such as the following when compiled with make W=1: linux-amit.git/drivers/thermal/step_wise.c:187: warning: Function parameter or member 'tz' not described in 'step_wise_throttle' linux-amit.git/drivers/thermal/step_wise.c:187: warning: Function parameter or member 'trip' not described in 'step_wise_throttle' linux.git/drivers/thermal/fair_share.c:79: warning: Function parameter or member 'tz' not described in 'fair_share_throttle' linux.git/drivers/thermal/fair_share.c:79: warning: Function parameter or member 'trip' not described in 'fair_share_throttle' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/5d48ac6f85667a53902092ad5bbfef8cc89a7162.1574242756.git.amit.kucheria@linaro.org commit 7b4e7f07a2c6dab26344e9802822206ba7337bed Author: Amit Kucheria Date: Wed Nov 20 21:15:11 2019 +0530 thermal: cpu_cooling: Appease the kernel-doc deity Describe the function parameter to fix the following warning with make W=1: linux.git/drivers/thermal/cpu_cooling.c:92: warning: Function parameter or member 'qos_req' not described in 'cpufreq_cooling_device' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/ddb09e9728533c274edae7ff3da515b3cf7ef231.1574242756.git.amit.kucheria@linaro.org commit faae0ed7a5a2d212143d615ec27f9e46aade01a9 Author: Amit Kucheria Date: Wed Nov 20 21:15:10 2019 +0530 thermal: of-thermal: Appease the kernel-doc deity Replace a comment starting with /** by simply /* to avoid having it interpreted as a kernel-doc comment. Fixes the following warning when compile with make W=1: linux.git/drivers/thermal/of-thermal.c:761: warning: cannot understand function prototype: 'const char *trip_types[] = ' Signed-off-by: Amit Kucheria Reviewed-by: Viresh Kumar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/dc742789bf4b3c8207b01c7946f2b401350536a7.1574242756.git.amit.kucheria@linaro.org commit c56dcfa3d4d0f49f0c37cd24886aa86db7aa7f30 Author: Linus Walleij Date: Tue Nov 19 08:46:50 2019 +0100 thermal: db8500: Depromote debug print We are not interested in getting this debug print on our console all the time. Cc: Daniel Lezcano Cc: Stephan Gerhold Fixes: 6c375eccded4 ("thermal: db8500: Rewrite to be a pure OF sensor") Signed-off-by: Linus Walleij Reviewed-by: Stephan Gerhold Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191119074650.2664-1-linus.walleij@linaro.org commit eaa519983fd9e53c2a62a1e56777e1fb461865a9 Merge: 880082666c8d 19c64e7354e5 Author: Greg Kroah-Hartman Date: Mon Jan 27 10:21:22 2020 +0100 Merge tag 'usb-serial-5.6-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: Here are the USB-serial updates for 5.6-rc1, including: - a missing ir-usb endpoint sanity check - fixes for two long-standing regressions in ir-usb - opticon chars_in_buffer support Included are also various clean ups. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-5.6-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: cyberjack: fix spelling mistake "To" -> "Too" USB: serial: ir-usb: simplify endpoint check USB: serial: ir-usb: make set_termios synchronous USB: serial: ir-usb: fix IrLAP framing USB: serial: ir-usb: fix link-speed handling USB: serial: ir-usb: add missing endpoint sanity check USB: serial: garmin_gps: Use flexible-array member USB: serial: opticon: stop all I/O on close() USB: serial: opticon: add chars_in_buffer() implementation commit 16b25d1a968e683eeef7523a4bbc4c8fd63aeedc Merge: 32efcc06d2a1 611973c1e06f Author: David S. Miller Date: Mon Jan 27 10:17:15 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next This batch contains Netfilter updates for net-next: 1) Add nft_setelem_parse_key() helper function. 2) Add NFTA_SET_ELEM_KEY_END to specify a range with one single element. 3) Add NFTA_SET_DESC_CONCAT to describe the set element concatenation, from Stefano Brivio. 4) Add bitmap_cut() to copy n-bits from source to destination, from Stefano Brivio. 5) Add set to match on arbitrary concatenations, from Stefano Brivio. 6) Add selftest for this new set type. An extract of Stefano's description follows: "Existing nftables set implementations allow matching entries with interval expressions (rbtree), e.g. 192.0.2.1-192.0.2.4, entries specifying field concatenation (hash, rhash), e.g. 192.0.2.1:22, but not both. In other words, none of the set types allows matching on range expressions for more than one packet field at a time, such as ipset does with types bitmap:ip,mac, and, to a more limited extent (netmasks, not arbitrary ranges), with types hash:net,net, hash:net,port, hash:ip,port,net, and hash:net,port,net. As a pure hash-based approach is unsuitable for matching on ranges, and "proxying" the existing red-black tree type looks impractical as elements would need to be shared and managed across all employed trees, this new set implementation intends to fill the functionality gap by employing a relatively novel approach. The fundamental idea, illustrated in deeper detail in patch 5/9, is to use lookup tables classifying a small number of grouped bits from each field, and map the lookup results in a way that yields a verdict for the full set of specified fields. The grouping bit aspect is loosely inspired by the Grouper algorithm, by Jay Ligatti, Josh Kuhn, and Chris Gage (see patch 5/9 for the full reference). A reference, stand-alone implementation of the algorithm itself is available at: https://pipapo.lameexcu.se Some notes about possible future optimisations are also mentioned there. This algorithm reduces the matching problem to, essentially, a repetitive sequence of simple bitwise operations, and is particularly suitable to be optimised by leveraging SIMD instruction sets." ==================== Signed-off-by: David S. Miller commit 8121fbc4ebbbb2ad29f4393ebfaaa588905dc693 Author: Mike Rapoport Date: Sun Jan 12 13:36:15 2020 +0200 parisc: map_pages(): cleanup page table initialization The current code uses '#if PTRS_PER_PMD == 1' to distinguish 2 vs 3 levels, setup, it casts pgd to pgd to cope with page table folding and converts addresses of page table entries from physical to virtual and back for no good reason. Simplify the accesses to the page table entries using proper unfolding of the upper layers and replacing '#if PTRS_PER_PMD' with explicit '#if CONFIG_PGTABLE_LEVELS == 3' Signed-off-by: Mike Rapoport Signed-off-by: Helge Deller commit 611973c1e06faef31d034deeb3ae7b7960b1f043 Author: Stefano Brivio Date: Wed Jan 22 00:17:56 2020 +0100 selftests: netfilter: Introduce tests for sets with range concatenation This test covers functionality and stability of the newly added nftables set implementation supporting concatenation of ranged fields. For some selected set expression types, test: - correctness, by checking that packets match or don't - concurrency, by attempting races between insertion, deletion, lookup - timeout feature, checking that packets don't match expired entries and (roughly) estimate matching rates, comparing to baselines for simple drop on netdev ingress hook and for hash and rbtrees sets. In order to send packets, this needs one of sendip, netcat or bash. To flood with traffic, iperf3, iperf and netperf are supported. For performance measurements, this relies on the sample pktgen script pktgen_bench_xmit_mode_netif_receive.sh. If none of the tools suitable for a given test are available, specific tests will be skipped. Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 3c4287f62044a90e73a561aa05fc46e62da173da Author: Stefano Brivio Date: Wed Jan 22 00:17:55 2020 +0100 nf_tables: Add set type for arbitrary concatenation of ranges This new set type allows for intervals in concatenated fields, which are expressed in the usual way, that is, simple byte concatenation with padding to 32 bits for single fields, and given as ranges by specifying start and end elements containing, each, the full concatenation of start and end values for the single fields. Ranges are expanded to composing netmasks, for each field: these are inserted as rules in per-field lookup tables. Bits to be classified are divided in 4-bit groups, and for each group, the lookup table contains 4^2 buckets, representing all the possible values of a bit group. This approach was inspired by the Grouper algorithm: http://www.cse.usf.edu/~ligatti/projects/grouper/ Matching is performed by a sequence of AND operations between bucket values, with buckets selected according to the value of packet bits, for each group. The result of this sequence tells us which rules matched for a given field. In order to concatenate several ranged fields, per-field rules are mapped using mapping arrays, one per field, that specify which rules should be considered while matching the next field. The mapping array for the last field contains a reference to the element originally inserted. The notes in nft_set_pipapo.c cover the algorithm in deeper detail. A pure hash-based approach is of no use here, as ranges need to be classified. An implementation based on "proxying" the existing red-black tree set type, creating a tree for each field, was considered, but deemed impractical due to the fact that elements would need to be shared between trees, at least as long as we want to keep UAPI changes to a minimum. A stand-alone implementation of this algorithm is available at: https://pipapo.lameexcu.se together with notes about possible future optimisations (in pipapo.c). This algorithm was designed with data locality in mind, and can be highly optimised for SIMD instruction sets, as the bulk of the matching work is done with repetitive, simple bitwise operations. At this point, without further optimisations, nft_concat_range.sh reports, for one AMD Epyc 7351 thread (2.9GHz, 512 KiB L1D$, 8 MiB L2$): TEST: performance net,port [ OK ] baseline (drop from netdev hook): 10190076pps baseline hash (non-ranged entries): 6179564pps baseline rbtree (match on first field only): 2950341pps set with 1000 full, ranged entries: 2304165pps port,net [ OK ] baseline (drop from netdev hook): 10143615pps baseline hash (non-ranged entries): 6135776pps baseline rbtree (match on first field only): 4311934pps set with 100 full, ranged entries: 4131471pps net6,port [ OK ] baseline (drop from netdev hook): 9730404pps baseline hash (non-ranged entries): 4809557pps baseline rbtree (match on first field only): 1501699pps set with 1000 full, ranged entries: 1092557pps port,proto [ OK ] baseline (drop from netdev hook): 10812426pps baseline hash (non-ranged entries): 6929353pps baseline rbtree (match on first field only): 3027105pps set with 30000 full, ranged entries: 284147pps net6,port,mac [ OK ] baseline (drop from netdev hook): 9660114pps baseline hash (non-ranged entries): 3778877pps baseline rbtree (match on first field only): 3179379pps set with 10 full, ranged entries: 2082880pps net6,port,mac,proto [ OK ] baseline (drop from netdev hook): 9718324pps baseline hash (non-ranged entries): 3799021pps baseline rbtree (match on first field only): 1506689pps set with 1000 full, ranged entries: 783810pps net,mac [ OK ] baseline (drop from netdev hook): 10190029pps baseline hash (non-ranged entries): 5172218pps baseline rbtree (match on first field only): 2946863pps set with 1000 full, ranged entries: 1279122pps v4: - fix build for 32-bit architectures: 64-bit division needs div_u64() (kbuild test robot ) v3: - rework interface for field length specification, NFT_SET_SUBKEY disappears and information is stored in description - remove scratch area to store closing element of ranges, as elements now come with an actual attribute to specify the upper range limit (Pablo Neira Ayuso) - also remove pointer to 'start' element from mapping table, closing key is now accessible via extension data - use bytes right away instead of bits for field lengths, this way we can also double the inner loop of the lookup function to take care of upper and lower bits in a single iteration (minor performance improvement) - make it clearer that set operations are actually atomic API-wise, but we can't e.g. implement flush() as one-shot action - fix type for 'dup' in nft_pipapo_insert(), check for duplicates only in the next generation, and in general take care of differentiating generation mask cases depending on the operation (Pablo Neira Ayuso) - report C implementation matching rate in commit message, so that AVX2 implementation can be compared (Pablo Neira Ayuso) v2: - protect access to scratch maps in nft_pipapo_lookup() with local_bh_disable/enable() (Florian Westphal) - drop rcu_read_lock/unlock() from nft_pipapo_lookup(), it's already implied (Florian Westphal) - explain why partial allocation failures don't need handling in pipapo_realloc_scratch(), rename 'm' to clone and update related kerneldoc to make it clear we're not operating on the live copy (Florian Westphal) - add expicit check for priv->start_elem in nft_pipapo_insert() to avoid ending up in nft_pipapo_walk() with a NULL start element, and also zero it out in every operation that might make it invalid, so that insertion doesn't proceed with an invalid element (Florian Westphal) Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 2092767168f0681aa03727448b801600a364c013 Author: Stefano Brivio Date: Wed Jan 22 00:17:54 2020 +0100 bitmap: Introduce bitmap_cut(): cut bits and shift remaining The new bitmap function bitmap_cut() copies bits from source to destination by removing the region specified by parameters first and cut, and remapping the bits above the cut region by right shifting them. Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit f3a2181e16f1dcbf5446ed43f6b5d9f56c459f85 Author: Stefano Brivio Date: Wed Jan 22 00:17:53 2020 +0100 netfilter: nf_tables: Support for sets with multiple ranged fields Introduce a new nested netlink attribute, NFTA_SET_DESC_CONCAT, used to specify the length of each field in a set concatenation. This allows set implementations to support concatenation of multiple ranged items, as they can divide the input key into matching data for every single field. Such set implementations would be selected as they specify support for NFT_SET_INTERVAL and allow desc->field_count to be greater than one. Explicitly disallow this for nft_set_rbtree. In order to specify the interval for a set entry, userspace would include in NFTA_SET_DESC_CONCAT attributes field lengths, and pass range endpoints as two separate keys, represented by attributes NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_KEY_END. While at it, export the number of 32-bit registers available for packet matching, as nftables will need this to know the maximum number of field lengths that can be specified. For example, "packets with an IPv4 address between 192.0.2.0 and 192.0.2.42, with destination port between 22 and 25", can be expressed as two concatenated elements: NFTA_SET_ELEM_KEY: 192.0.2.0 . 22 NFTA_SET_ELEM_KEY_END: 192.0.2.42 . 25 and NFTA_SET_DESC_CONCAT attribute would contain: NFTA_LIST_ELEM NFTA_SET_FIELD_LEN: 4 NFTA_LIST_ELEM NFTA_SET_FIELD_LEN: 2 v4: No changes v3: Complete rework, NFTA_SET_DESC_CONCAT instead of NFTA_SET_SUBKEY v2: No changes Signed-off-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 7b225d0b5c6dda5fefab578175f210c6fc7e389a Author: Pablo Neira Ayuso Date: Wed Jan 22 00:17:52 2020 +0100 netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute Add NFTA_SET_ELEM_KEY_END attribute to convey the closing element of the interval between kernel and userspace. This patch also adds the NFT_SET_EXT_KEY_END extension to store the closing element value in this interval. v4: No changes v3: New patch [sbrivio: refactor error paths and labels; add corresponding nft_set_ext_type for new key; rebase] Signed-off-by: Pablo Neira Ayuso commit 20a1452c35425b2cef76f21f8395ef069dfddfa9 Author: Pablo Neira Ayuso Date: Wed Jan 22 00:17:51 2020 +0100 netfilter: nf_tables: add nft_setelem_parse_key() Add helper function to parse the set element key netlink attribute. v4: No changes v3: New patch [sbrivio: refactor error paths and labels; use NFT_DATA_VALUE_MAXLEN instead of sizeof(*key) in helper, value can be longer than that; rebase] Signed-off-by: Pablo Neira Ayuso commit 54e19d34011fea26d39aa74781131de0ce642a01 Author: Dexuan Cui Date: Sat Jan 25 21:49:44 2020 -0800 hv_utils: Add the support of hibernation Add util_pre_suspend() and util_pre_resume() for some hv_utils devices (e.g. kvp/vss/fcopy), because they need special handling before util_suspend() calls vmbus_close(). For kvp, all the possible pending work items should be cancelled. For vss and fcopy, some extra clean-up needs to be done, i.e. fake a THAW message for hv_vss_daemon and fake a CANCEL_FCOPY message for hv_fcopy_daemon, otherwise when the VM resums back, the daemons can end up in an inconsistent state (i.e. the file systems are frozen but will never be thawed; the file transmitted via fcopy may not be complete). Note: there is an extra patch for the daemons: "Tools: hv: Reopen the devices if read() or write() returns errors", because the hv_utils driver can not guarantee the whole transaction finishes completely once util_suspend() starts to run (at this time, all the userspace processes are frozen). util_probe() disables channel->callback_event to avoid the race with the channel callback. Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit ffd1d4a49336b7f0078f45332fa4b93d25720f6c Author: Dexuan Cui Date: Sat Jan 25 21:49:43 2020 -0800 hv_utils: Support host-initiated hibernation request Update the Shutdown IC version to 3.2, which is required for the host to send the hibernation request. The user is expected to create the below udev rule file, which is applied upon the host-initiated hibernation request: root@localhost:~# cat /usr/lib/udev/rules.d/40-vm-hibernation.rules SUBSYSTEM=="vmbus", ACTION=="change", DRIVER=="hv_utils", ENV{EVENT}=="hibernate", RUN+="/usr/bin/systemctl hibernate" Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 3e9c72056ed5618bef253f602e79dd2312a0d8a5 Author: Dexuan Cui Date: Sat Jan 25 21:49:42 2020 -0800 hv_utils: Support host-initiated restart request The hv_utils driver currently supports a "shutdown" operation initiated from the Hyper-V host. Newer versions of Hyper-V also support a "restart" operation. So add support for the updated protocol version that has "restart" support, and perform a clean reboot when such a message is received from Hyper-V. To test the restart functionality, run this PowerShell command on the Hyper-V host: Restart-VM -Type Reboot Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 9fc3c01a1fae669a2ef9f13ee1e1a26e057d79f8 Author: Dexuan Cui Date: Sat Jan 25 21:49:41 2020 -0800 Tools: hv: Reopen the devices if read() or write() returns errors The state machine in the hv_utils driver can run out of order in some corner cases, e.g. if the kvp daemon doesn't call write() fast enough due to some reason, kvp_timeout_func() can run first and move the state to HVUTIL_READY; next, when kvp_on_msg() is called it returns -EINVAL since kvp_transaction.state is smaller than HVUTIL_USERSPACE_REQ; later, the daemon's write() gets an error -EINVAL, and the daemon will exit(). We can reproduce the issue by sending a SIGSTOP signal to the daemon, wait for 1 minute, and send a SIGCONT signal to the daemon: the daemon will exit() quickly. We can fix the issue by forcing a reset of the device (which means the daemon can close() and open() the device again) and doing extra necessary clean-up. Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 3a6fb6c4255c3893ab61e2bd4e9ae01ca6bbcd94 Author: Wei Hu Date: Mon Dec 9 15:57:49 2019 +0800 video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs. On Hyper-V, Generation 1 VMs can directly use VM's physical memory for their framebuffers. This can improve the efficiency of framebuffer and overall performence for VM. The physical memory assigned to framebuffer must be contiguous. We use CMA allocator to get contiguouse physicial memory when the framebuffer size is greater than 4MB. For size under 4MB, we use alloc_pages to achieve this. To enable framebuffer memory allocation from CMA, supply a kernel parameter to give enough space to CMA allocator at boot time. For example: cma=130m This gives 130MB memory to CAM allocator that can be allocated to framebuffer. If this fails, we fall back to the old way of using mmio for framebuffer. Reported-by: kbuild test robot Signed-off-by: Wei Hu Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin commit f1f27ad74557e39f67a8331a808b860f89254f2d Author: Vincent Whitchurch Date: Thu Jan 23 17:09:06 2020 +0100 CIFS: Fix task struct use-after-free on reconnect The task which created the MID may be gone by the time cifsd attempts to call the callbacks on MIDs from cifs_reconnect(). This leads to a use-after-free of the task struct in cifs_wake_up_task: ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x31a0/0x3270 Read of size 8 at addr ffff8880103e3a68 by task cifsd/630 CPU: 0 PID: 630 Comm: cifsd Not tainted 5.5.0-rc6+ #119 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x8e/0xcb print_address_description.constprop.5+0x1d3/0x3c0 ? __lock_acquire+0x31a0/0x3270 __kasan_report+0x152/0x1aa ? __lock_acquire+0x31a0/0x3270 ? __lock_acquire+0x31a0/0x3270 kasan_report+0xe/0x20 __lock_acquire+0x31a0/0x3270 ? __wake_up_common+0x1dc/0x630 ? _raw_spin_unlock_irqrestore+0x4c/0x60 ? mark_held_locks+0xf0/0xf0 ? _raw_spin_unlock_irqrestore+0x39/0x60 ? __wake_up_common_lock+0xd5/0x130 ? __wake_up_common+0x630/0x630 lock_acquire+0x13f/0x330 ? try_to_wake_up+0xa3/0x19e0 _raw_spin_lock_irqsave+0x38/0x50 ? try_to_wake_up+0xa3/0x19e0 try_to_wake_up+0xa3/0x19e0 ? cifs_compound_callback+0x178/0x210 ? set_cpus_allowed_ptr+0x10/0x10 cifs_reconnect+0xa1c/0x15d0 ? generic_ip_connect+0x1860/0x1860 ? rwlock_bug.part.0+0x90/0x90 cifs_readv_from_socket+0x479/0x690 cifs_read_from_socket+0x9d/0xe0 ? cifs_readv_from_socket+0x690/0x690 ? mempool_resize+0x690/0x690 ? rwlock_bug.part.0+0x90/0x90 ? memset+0x1f/0x40 ? allocate_buffers+0xff/0x340 cifs_demultiplex_thread+0x388/0x2a50 ? cifs_handle_standard+0x610/0x610 ? rcu_read_lock_held_common+0x120/0x120 ? mark_lock+0x11b/0xc00 ? __lock_acquire+0x14ed/0x3270 ? __kthread_parkme+0x78/0x100 ? lockdep_hardirqs_on+0x3e8/0x560 ? lock_downgrade+0x6a0/0x6a0 ? lockdep_hardirqs_on+0x3e8/0x560 ? _raw_spin_unlock_irqrestore+0x39/0x60 ? cifs_handle_standard+0x610/0x610 kthread+0x2bb/0x3a0 ? kthread_create_worker_on_cpu+0xc0/0xc0 ret_from_fork+0x3a/0x50 Allocated by task 649: save_stack+0x19/0x70 __kasan_kmalloc.constprop.5+0xa6/0xf0 kmem_cache_alloc+0x107/0x320 copy_process+0x17bc/0x5370 _do_fork+0x103/0xbf0 __x64_sys_clone+0x168/0x1e0 do_syscall_64+0x9b/0xec0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 0: save_stack+0x19/0x70 __kasan_slab_free+0x11d/0x160 kmem_cache_free+0xb5/0x3d0 rcu_core+0x52f/0x1230 __do_softirq+0x24d/0x962 The buggy address belongs to the object at ffff8880103e32c0 which belongs to the cache task_struct of size 6016 The buggy address is located 1960 bytes inside of 6016-byte region [ffff8880103e32c0, ffff8880103e4a40) The buggy address belongs to the page: page:ffffea000040f800 refcount:1 mapcount:0 mapping:ffff8880108da5c0 index:0xffff8880103e4c00 compound_mapcount: 0 raw: 4000000000010200 ffffea00001f2208 ffffea00001e3408 ffff8880108da5c0 raw: ffff8880103e4c00 0000000000050003 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880103e3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880103e3980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880103e3a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880103e3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880103e3b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== This can be reliably reproduced by adding the below delay to cifs_reconnect(), running find(1) on the mount, restarting the samba server while find is running, and killing find during the delay: spin_unlock(&GlobalMid_Lock); mutex_unlock(&server->srv_mutex); + msleep(10000); + cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__); list_for_each_safe(tmp, tmp2, &retry_list) { mid_entry = list_entry(tmp, struct mid_q_entry, qhead); Fix this by holding a reference to the task struct until the MID is freed. Signed-off-by: Vincent Whitchurch Signed-off-by: Steve French CC: Stable Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Pavel Shilovsky commit 050d2a8b6992fd012773e75de9f82d45e3b3dfff Author: Chen Zhou Date: Wed Jan 22 18:20:30 2020 +0800 cifs: use PTR_ERR_OR_ZERO() to simplify code PTR_ERR_OR_ZERO contains if(IS_ERR(...)) + PTR_ERR, just use PTR_ERR_OR_ZERO directly. Signed-off-by: Chen Zhou Signed-off-by: Steve French Reviewed-by: Paulo Alcantara (SUSE) commit 8bd0d701445ef263a52968ced2854c3d35712695 Author: Ronnie Sahlberg Date: Fri Jan 17 11:45:02 2020 +1000 cifs: add support for fallocate mode 0 for non-sparse files RHBZ 1336264 When we extend a file we must also force the size to be updated. This fixes an issue with holetest in xfs-tests which performs the following sequence : 1, create a new file 2, use fallocate mode==0 to populate the file 3, mmap the file 4, touch each page by reading the mmapped region. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit fe1292686333d1dadaf84091f585ee903b9ddb84 Author: Ronnie Sahlberg Date: Wed Jan 22 11:07:56 2020 +1000 cifs: fix NULL dereference in match_prepath RHBZ: 1760879 Fix an oops in match_prepath() by making sure that the prepath string is not NULL before we pass it into strcmp(). This is similar to other checks we make for example in cifs_root_iget() Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 643fbceef48e5b22bf8e0905f903e908b5d2ba69 Author: Steve French Date: Thu Jan 16 19:55:33 2020 -0600 smb3: fix default permissions on new files when mounting with modefromsid When mounting with "modefromsid" mount parm most servers will require that some default permissions are given to users in the ACL on newly created files, files created with the new 'sd context' - when passing in an sd context on create, permissions are not inherited from the parent directory, so in addition to the ACE with the special SID which contains the mode, we also must pass in an ACE allowing users to access the file (GENERIC_ALL for authenticated users seemed like a reasonable default, although later we could allow a mount option or config switch to make it GENERIC_ALL for EVERYONE special sid). CC: Stable Signed-off-by: Steve French Reviewed-By: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky commit 438471b67963b8267e94beab383b6d6fc41b3481 Author: Boris Protopopov Date: Thu Dec 19 16:52:50 2019 +0000 CIFS: Add support for setting owner info, dos attributes, and create time This is needed for backup/restore scenarios among others. Add extended attribute "system.cifs_ntsd" (and alias "system.smb3_ntsd") to allow for setting owner and DACL in the security descriptor. This is in addition to the existing "system.cifs_acl" and "system.smb3_acl" attributes that allow for setting DACL only. Add support for setting creation time and dos attributes using set_file_info() calls to complement the existing support for getting these attributes via query_path_info() calls. Signed-off-by: Boris Protopopov Signed-off-by: Steve French commit c4985c3d9902dcd66f0b61d048560ef2cc415542 Author: YueHaibing Date: Fri Jan 17 10:57:17 2020 +0800 cifs: remove set but not used variable 'server' fs/cifs/smb2pdu.c: In function 'SMB2_query_directory': fs/cifs/smb2pdu.c:4444:26: warning: variable 'server' set but not used [-Wunused-but-set-variable] struct TCP_Server_Info *server; It is not used, so remove it. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Steve French commit 0a5a98863c9debc02387b3d23c46d187756f5e2b Author: Paulo Alcantara (SUSE) Date: Mon Jan 13 17:46:59 2020 -0300 cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() __smb2_handle_cancelled_cmd() is called under a spin lock held in cifs_mid_q_entry_release(), so make its memory allocation GFP_ATOMIC. This issue was observed when running xfstests generic/028: [ 1722.589204] CIFS VFS: \\192.168.30.26 Cancelling wait for mid 72064 cmd: 5 [ 1722.590687] CIFS VFS: \\192.168.30.26 Cancelling wait for mid 72065 cmd: 17 [ 1722.593529] CIFS VFS: \\192.168.30.26 Cancelling wait for mid 72066 cmd: 6 [ 1723.039014] BUG: sleeping function called from invalid context at mm/slab.h:565 [ 1723.040710] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 30877, name: cifsd [ 1723.045098] CPU: 3 PID: 30877 Comm: cifsd Not tainted 5.5.0-rc4+ #313 [ 1723.046256] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 [ 1723.048221] Call Trace: [ 1723.048689] dump_stack+0x97/0xe0 [ 1723.049268] ___might_sleep.cold+0xd1/0xe1 [ 1723.050069] kmem_cache_alloc_trace+0x204/0x2b0 [ 1723.051051] __smb2_handle_cancelled_cmd+0x40/0x140 [cifs] [ 1723.052137] smb2_handle_cancelled_mid+0xf6/0x120 [cifs] [ 1723.053247] cifs_mid_q_entry_release+0x44d/0x630 [cifs] [ 1723.054351] ? cifs_reconnect+0x26a/0x1620 [cifs] [ 1723.055325] cifs_demultiplex_thread+0xad4/0x14a0 [cifs] [ 1723.056458] ? cifs_handle_standard+0x2c0/0x2c0 [cifs] [ 1723.057365] ? kvm_sched_clock_read+0x14/0x30 [ 1723.058197] ? sched_clock+0x5/0x10 [ 1723.058838] ? sched_clock_cpu+0x18/0x110 [ 1723.059629] ? lockdep_hardirqs_on+0x17d/0x250 [ 1723.060456] kthread+0x1ab/0x200 [ 1723.061149] ? cifs_handle_standard+0x2c0/0x2c0 [cifs] [ 1723.062078] ? kthread_create_on_node+0xd0/0xd0 [ 1723.062897] ret_from_fork+0x3a/0x50 Signed-off-by: Paulo Alcantara (SUSE) Fixes: 9150c3adbf24 ("CIFS: Close open handle after interrupted close") Cc: Stable Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit 5739375ee4230980166807d347cc21c305532bbc Author: Paulo Alcantara (SUSE) Date: Thu Jan 9 10:03:19 2020 -0300 cifs: Fix mount options set in automount Starting from 4a367dc04435, we must set the mount options based on the DFS full path rather than the resolved target, that is, cifs_mount() will be responsible for resolving the DFS link (cached) as well as performing failover to any other targets in the referral. Signed-off-by: Paulo Alcantara (SUSE) Reported-by: Martijn de Gouw Fixes: 4a367dc04435 ("cifs: Add support for failover in cifs_mount()") Link: https://lore.kernel.org/linux-cifs/39643d7d-2abb-14d3-ced6-c394fab9a777@prodrive-technologies.com Tested-by: Martijn de Gouw Signed-off-by: Steve French commit 463a7b457c02250a84faa1d23c52da9e3364aed2 Author: Steve French Date: Thu Jan 16 15:58:00 2020 -0600 cifs: fix unitialized variable poential problem with network I/O cache lock patch static analysis with Coverity detected an issue with the following commit: Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:38:03 2019 -0300 cifs: Avoid doing network I/O while holding cache lock Addresses-Coverity: ("Uninitialized pointer read") Reported-by: Colin Ian King Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit eecfc57130b5faa11fa5fe556313254c7ecfabed Author: YueHaibing Date: Fri Jan 17 10:21:56 2020 +0800 cifs: Fix return value in __update_cache_entry copy_ref_data() may return error, it should be returned to upstream caller. Fixes: 03535b72873b ("cifs: Avoid doing network I/O while holding cache lock") Signed-off-by: YueHaibing Signed-off-by: Steve French commit 742d8de0186e9f8ec469f8171ea25781a17421bf Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:38:03 2019 -0300 cifs: Avoid doing network I/O while holding cache lock When creating or updating a cache entry, we need to get an DFS referral (get_dfs_referral), so avoid holding any locks during such network operation. To prevent that, do the following: * change cache hashtable sync method from RCU sync to a read/write lock. * use GFP_ATOMIC in memory allocations. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 06d57378bcc9b2c33640945174842115593795d1 Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:38:02 2019 -0300 cifs: Fix potential deadlock when updating vol in cifs_reconnect() We can't acquire volume lock while refreshing the DFS cache because cifs_reconnect() may call dfs_cache_update_vol() while we are walking through the volume list. To prevent that, make vol_info refcounted, create a temp list with all volumes eligible for refreshing, and then use it without any locks held. Besides, replace vol_lock with a spinlock and protect cache_ttl from concurrent accesses or changes. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit ff2f7fc08268f266372c30a815349749e8499eb5 Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:38:01 2019 -0300 cifs: Merge is_path_valid() into get_normalized_path() Just do the trivial path validation in get_normalized_path(). Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 345c1a4a9e09dc5842b7bbb6728a77910db69c52 Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:38:00 2019 -0300 cifs: Introduce helpers for finding TCP connection Add helpers for finding TCP connections that are good candidates for being used by DFS refresh worker. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 199c6bdfb04b71d88a7765e08285885fbca60df4 Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:37:59 2019 -0300 cifs: Get rid of kstrdup_const()'d paths The DFS cache API is mostly used with heap allocated strings. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 185352ae6171c845951e21017b2925a6f2795904 Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 17:37:58 2019 -0300 cifs: Clean up DFS referral cache Do some renaming and code cleanup. No functional changes. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 6629400a2227c843a84e84c2aa4275dfe6c3bdbc Author: David Howells Date: Thu Nov 21 08:13:58 2019 +0000 cifs: Don't use iov_iter::type directly Don't use iov_iter::type directly, but rather use the new accessor functions that have been added. This allows the .type field to be split and rearranged without the need to update the filesystems. Signed-off-by: David Howells Signed-off-by: Steve French commit 731b82bb1750a906c1e7f070aedf5505995ebea7 Author: Ronnie Sahlberg Date: Wed Jan 8 13:08:07 2020 +1000 cifs: set correct max-buffer-size for smb2_ioctl_init() Fix two places where we need to adjust down the max response size for ioctl when it is used together with compounding. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky CC: Stable commit 37478608f0eb6f232e62791683875a1f557b1b10 Author: Ronnie Sahlberg Date: Wed Jan 8 13:08:06 2020 +1000 cifs: use compounding for open and first query-dir for readdir() Combine the initial SMB2_Open and the first SMB2_Query_Directory in a compound. This shaves one round-trip of each directory listing, changing it from 4 to 3 for small directories. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit af08f9e79c602835f975f0f8f6e90fc48848bffa Author: Ronnie Sahlberg Date: Wed Jan 8 13:08:05 2020 +1000 cifs: create a helper function to parse the query-directory response buffer Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit 0a17799cc02f81c4c82c2de6f7071701714c2267 Author: Ronnie Sahlberg Date: Wed Jan 8 13:08:04 2020 +1000 cifs: prepare SMB2_query_directory to be used with compounding Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit 01d1bd76a170c1cf1864b3b3ef1f8502f189148e Author: zhengbin Date: Wed Dec 25 11:30:21 2019 +0800 fs/cifs/cifssmb.c: use true,false for bool variable Fixes coccicheck warning: fs/cifs/cifssmb.c:4622:3-22: WARNING: Assignment of 0/1 to bool variable fs/cifs/cifssmb.c:4756:3-22: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Steve French commit 720aec01262d49dbce17d862d8cdbfd3cfef4261 Author: zhengbin Date: Wed Dec 25 11:30:20 2019 +0800 fs/cifs/smb2ops.c: use true,false for bool variable Fixes coccicheck warning: fs/cifs/smb2ops.c:807:2-36: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Steve French commit cdbcf82b86ea24aa942991b4233cd8ddf13f590c Author: Darrick J. Wong Date: Thu Jan 23 17:01:20 2020 -0800 xfs: fix xfs_buf_ioerror_alert location reporting Instead of passing __func__ to the error reporting function, let's use the return address builtins so that the messages actually tell you which higher level function called the buffer functions. This was previously true for the xfs_buf_read callers, but not for the xfs_trans_read_buf callers. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Christoph Hellwig commit 706b8c5bc70391be510a5454f307db90b622b279 Author: Darrick J. Wong Date: Thu Jan 23 17:01:20 2020 -0800 xfs: remove unnecessary null pointer checks from _read_agf callers Drop the null buffer pointer checks in all code that calls xfs_alloc_read_agf and doesn't pass XFS_ALLOC_FLAG_TRYLOCK because they're no longer necessary. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit f48e2df8a877ca1c19d92cfd7e74cc5956fa84cb Author: Darrick J. Wong Date: Thu Jan 23 17:01:19 2020 -0800 xfs: make xfs_*read_agf return EAGAIN to ALLOC_FLAG_TRYLOCK callers Refactor xfs_read_agf and xfs_alloc_read_agf to return EAGAIN if the caller passed TRYLOCK and we weren't able to get the lock; and change the callers to recognize this. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit ee647f85cb81b09bbfa2886954828ed03fa3ec38 Author: Darrick J. Wong Date: Thu Jan 23 17:01:19 2020 -0800 xfs: remove the xfs_btree_get_buf[ls] functions Remove the xfs_btree_get_bufs and xfs_btree_get_bufl functions, since they're pretty trivial oneliners. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit ce92464c180b60e79022bdf1175b7737a11f59b7 Author: Darrick J. Wong Date: Thu Jan 23 17:01:18 2020 -0800 xfs: make xfs_trans_get_buf return an error code Convert xfs_trans_get_buf() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 9676b54e6e28689af1b4247569f14466bdfc5390 Author: Darrick J. Wong Date: Thu Jan 23 17:01:18 2020 -0800 xfs: make xfs_trans_get_buf_map return an error code Convert xfs_trans_get_buf_map() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 0e3eccce5e0e438bc1aa3c2913221d3d43a1bef4 Author: Darrick J. Wong Date: Thu Jan 23 17:01:17 2020 -0800 xfs: make xfs_buf_read return an error code Convert xfs_buf_read() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 2842b6db3d539bec08d080b22635b6e8acaa30ec Author: Darrick J. Wong Date: Thu Jan 23 17:01:17 2020 -0800 xfs: make xfs_buf_get_uncached return an error code Convert xfs_buf_get_uncached() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 841263e93310595c30653a9f530b2d7bbeed5aae Author: Darrick J. Wong Date: Thu Jan 23 17:01:16 2020 -0800 xfs: make xfs_buf_get return an error code Convert xfs_buf_get() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 4ed8e27b4f755f50d78dc3d9f9760b60e891f97b Author: Darrick J. Wong Date: Thu Jan 23 17:01:16 2020 -0800 xfs: make xfs_buf_read_map return an error code Convert xfs_buf_read_map() to return numeric error codes like most everywhere else in xfs. This involves moving the open-coded logic that reports metadata IO read / corruption errors and stales the buffer into xfs_buf_read_map so that the logic is all in one place. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 3848b5f6709221b7ab52c9639baee50dc4b006bb Author: Darrick J. Wong Date: Thu Jan 23 17:01:15 2020 -0800 xfs: make xfs_buf_get_map return an error code Convert xfs_buf_get_map() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 32dff5e5d1b5889b068e411d490453834c639701 Author: Darrick J. Wong Date: Thu Jan 23 17:01:15 2020 -0800 xfs: make xfs_buf_alloc return an error code Convert _xfs_buf_alloc() to return numeric error codes like most everywhere else in xfs. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 2a13513f99e735184fd6f889d78da6424fda80a1 Merge: c2f9a4e4a5ab d7809bd9eae6 Author: Kalle Valo Date: Sun Jan 26 17:54:46 2020 +0200 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for v5.6. Major changes: ar5523 * add support for SMCWUSBT-G2 USB device commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 Author: Colin Ian King Date: Sun Jan 26 00:09:54 2020 +0000 iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop The loop counter addr is a u16 where as the upper limit of the loop is an int. In the unlikely event that the il->cfg->eeprom_size is greater than 64K then we end up with an infinite loop since addr will wrap around an never reach upper loop limit. Fix this by making addr an int. Addresses-Coverity: ("Infinite loop") Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965") Signed-off-by: Colin Ian King Acked-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit f76c34082b24534c813a9e3e175ef778c11e9950 Author: Colin Ian King Date: Wed Jan 22 09:33:40 2020 +0000 rtlwifi: btcoex: fix spelling mistake "initilized" -> "initialized" There is a spelling mistake in one of the fields in the btc_coexist struct, fix it. Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo commit c5f9852411098474ab21f5d7b1b84e5cdd59ca5a Author: YueHaibing Date: Tue Jan 21 11:04:28 2020 +0800 rtlwifi: rtl8723ae: remove unused variables drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c:16:18: warning: ofdmswing_table defined but not used [-Wunused-const-variable=] drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c:56:17: warning: cckswing_table_ch1ch13 defined but not used [-Wunused-const-variable=] drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c:92:17: warning: cckswing_table_ch14 defined but not used [-Wunused-const-variable=] These variable is never used, so remove them. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Kalle Valo commit 253e5aba937973fd29bd5c559d21e35d0642242e Author: YueHaibing Date: Tue Jan 21 10:19:24 2020 +0800 rtlwifi: rtl8192ee: remove unused variables drivers/net/wireless/realtek/rtlwifi/rtl8192ee/dm.c:15:18: warning: ofdmswing_table defined but not used [-Wunused-const-variable=] drivers/net/wireless/realtek/rtlwifi/rtl8192ee/dm.c:61:17: warning: cckswing_table_ch1ch13 defined but not used [-Wunused-const-variable=] drivers/net/wireless/realtek/rtlwifi/rtl8192ee/dm.c:97:17: warning: cckswing_table_ch14 defined but not used [-Wunused-const-variable=] These variable is never used, so remove them. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Kalle Valo commit cc071a6f26aae3321cf193dc2e8c35090709b8ab Author: YueHaibing Date: Tue Jan 21 10:09:58 2020 +0800 rtlwifi: rtl8821ae: remove unused variables drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:142:17: warning: cckswing_table_ch1ch13 defined but not used [-Wunused-const-variable=] drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:178:17: warning: cckswing_table_ch14 defined but not used [-Wunused-const-variable=] drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:96:18: warning: ofdmswing_table defined but not used [-Wunused-const-variable=] These variable is never used, so remove them. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Kalle Valo commit c3a913357c3e3d2225a83508f06ece01f5bada20 Author: Colin Ian King Date: Tue Jan 14 16:56:01 2020 +0000 rtlwifi: rtl8188ee: remove redundant assignment to variable cond Variable cond is being assigned with a value that is never read, it is assigned a new value later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Acked-by: Ping-Ke Shih Signed-off-by: Kalle Valo commit ed7791d9d0abc7e24223ab1663931c8e5351fea8 Author: Mikhail Karpenko Date: Thu Jan 9 16:17:55 2020 +0300 qtnfmac: add support for TWT responder and spatial reuse Add support for 11ax features: TWT responder and spatial reuse. Add separate structure for spatial reuse parameters and pass this structure to firmware along with other parameters in start_ap command. Pass TWT responder value to firmware. Bump qlink protocol version. Signed-off-by: Mikhail Karpenko Signed-off-by: Kalle Valo commit b73f0aac731ce87a656d9911cb9e2e79eb721d1a Author: Sergey Matyukevich Date: Thu Jan 9 16:17:54 2020 +0300 qtnfmac: add support for STA HE rates Add HE rates into STA info. Report HE Rx/Tx MCS if STA supports them. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit e14291752e568bf936907be7f11ae3cc39d89fd2 Author: Sergey Matyukevich Date: Thu Jan 9 16:17:53 2020 +0300 qtnfmac: control qtnfmac wireless interfaces bridging Bridging qtnfmac interfaces is possible only if the following two conditions are fulfilled: - firmware advertises proper support with QLINK_HW_CAPAB_HW_BRIDGE - kernel is built with CONFIG_NET_SWITCHDEV support Otherwise adding qtnfmac wireless interfaces into the same bridge should not be allowed since packets flooded by kernel may break internal forwarding rules between interfaces. This patch disables adding qtnfmac wireless interfaces into the same bridge if no support is provided either by card or by kernel. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit 155b424c86f8169b30d30beb46ad216c5e61749a Author: Sergey Matyukevich Date: Thu Jan 9 16:17:52 2020 +0300 qtnfmac: add module param to configure DFS offload Firmware may support DFS offload. However the final decision on whether to use it or not should be up to the user. So even if firmware supports DFS offload, it should be enabled only if user explicitly requests it. For this purpose introduce kernel param dfs_offload which is disabled by default. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit e92b07a20b5f039ccd8776dc7c6323a3e1d726d9 Author: Sergey Matyukevich Date: Thu Jan 9 16:17:51 2020 +0300 qtnfmac: cleanup slave_radar access function Currently this parameter is global, it is not specific to mac. So this function does not need any input parameters. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit 627b0d094240c38393b2f2d40626c33a8fff6103 Author: yuehaibing Date: Wed Jan 8 21:57:48 2020 +0800 brcmfmac: Remove always false 'idx < 0' statement idx is declared as u32, it will never less than 0. Signed-off-by: yuehaibing Signed-off-by: Kalle Valo commit 6b6c150b8464e91af26be805f88d5e58c6d626ae Author: Yan-Hsuan Chuang Date: Tue Jan 7 22:27:29 2020 +0800 rtw88: use shorter delay time to poll PS state When TX packet arrives, driver should leave deep PS state to make sure the DMA is working. After requested to leave deep PS state, driver needs to poll the PS state to check if the mode has been changed successfully. The driver used to check the state of the hardware every 20 msecs, which means upon the first failure of state check, the CPU is delayed 20 msecs for next check. This is harmful for some time-sensitive applications such as media players. So, use shorter delay time each check from 20 msecs to 100 usecs. The state should be changed in several tries. But we still need to reserve ~15 msecs in total in case of the state just took too long to be changed successfully. If the states of driver and the hardware is not synchronized, the power state could be locked forever, which mean we could never enter/leave the PS state. Signed-off-by: Yan-Hsuan Chuang Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit f4f84ff8377d4cedf18317747bc407b2cf657d0f Author: Yan-Hsuan Chuang Date: Tue Jan 7 16:08:07 2020 +0800 rtw88: fix potential NULL skb access in TX ISR Sometimes the TX queue may be empty and we could possible dequeue a NULL pointer, crash the kernel. If the skb is NULL then there is nothing to do, just leave the ISR. And the TX queue should not be empty here, so print an error to see if there is anything wrong for DMA ring. Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 20f2c5fa3af060401c72e444999470a4cab641cf Author: Rafał Miłecki Date: Thu Dec 26 14:30:50 2019 +0100 brcmfmac: add initial support for monitor mode Report monitor interface availability using cfg80211 and support it in the add_virtual_intf() and del_virtual_intf() callbacks. This new feature is conditional and depends on firmware flagging monitor packets. Receiving monitor frames is already handled by the brcmf_netif_mon_rx(). Signed-off-by: Rafał Miłecki Signed-off-by: Kalle Valo commit 24332f8068ff6df7f16aefee45d514de1de4de80 Author: Rafał Miłecki Date: Thu Dec 26 14:30:49 2019 +0100 brcmfmac: simplify building interface combinations Move similar/duplicated code out of combination specific code blocks. This simplifies code a bit and allows adding more combinations later. A list of combinations remains unchanged. Signed-off-by: Rafał Miłecki Signed-off-by: Kalle Valo commit 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 Author: Jean-Philippe Brucker Date: Thu Dec 26 10:20:33 2019 +0100 brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362 Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()") changed the initialization order of the brcmfmac SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now called before the sdiodev->bus_if initialization, it reads the wrong chip ID and fails to initialize the GPIO on brcm43362. Thus the chip cannot send interrupts and fails to probe: [ 12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout [ 12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110 [ 12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110 [ 12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed Initialize the bus interface earlier to ensure that brcmf_sdiod_intr_register() properly sets up the OOB interrupt. BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438 Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()") Signed-off-by: Jean-Philippe Brucker Reviewed-by: Arend van Spriel Signed-off-by: Kalle Valo commit b92c017deda819e45a0f054f6df6b53e645d7fe4 Author: zhengbin Date: Tue Dec 24 22:16:06 2019 +0800 brcmfmac: use true,false for bool variable Fixes coccicheck warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c:911:2-24: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit ab36bb72d00e24ae637a87ce8cde568435322a56 Author: zhengbin Date: Tue Dec 24 22:16:02 2019 +0800 cw1200: use true,false for bool variable Fixes coccicheck warning: drivers/net/wireless/st/cw1200/txrx.c:718:6-16: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit 891984bccf64138cb721f87abae838af5636281a Author: zhengbin Date: Tue Dec 24 22:16:01 2019 +0800 rtw88: use true,false for bool variable Fixes coccicheck warning: drivers/net/wireless/realtek/rtw88/phy.c:1437:1-24: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit 8ddd4a2a6b5930b8318b994e416db4491795a8aa Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:15 2019 +0100 rtlwifi: rtl8821ae: Make functions static & rm sw.h Some of functions which were exposed in sw.h, are only used in sw.c, so just make them static. This makes sw.h unnecessary, so remove it. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit 02a214e29ea4415437d9e38c6bf5604e564397da Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:14 2019 +0100 rtlwifi: rtl8723be: Make functions static & rm sw.h Some of functions which were exposed in sw.h, are only used in sw.c, so just make them static. This makes sw.h unnecessary, so remove it. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit c218acfaa637d02830549cf27798921f820ec818 Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:13 2019 +0100 rtlwifi: rtl8723ae: Make functions static & rm sw.h Some of functions which were exposed in sw.h, are only used in sw.c, so just make them static. This makes sw.h unnecessary, so remove it. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit 5b2640835a3443e629ee2af4b8367f6abdeb142a Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:12 2019 +0100 rtlwifi: rtl8192se: Remove sw.h header It has one define, which is already defined in include from reg.h. All the declared functions are not implemented anywhere, sw.c has ones with similar names which are already static. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit fef8a2d969af25638f48411930f491088d6ccea0 Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:11 2019 +0100 rtlwifi: rtl8192ee: Make functions static & rm sw.h Some of functions which were exposed in sw.h, are only used in sw.c, so just make them static. This makes sw.h unnecessary, so remove it. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit a3cda3c363ca747758a3bcc6fc23529003a1c983 Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:10 2019 +0100 rtlwifi: rtl8192cu: Remove sw.h header It has one define, which is already defined in include from reg.h. All functions are declared in their own headers and included in *.c files belonging to them. This makes sw.h unnecessary, so we can remove it. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit be913e3f49ac943c230dca5de40974f3a5f7ae90 Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:09 2019 +0100 rtlwifi: rtl8192ce: Make functions static & rm sw.h Some of functions which were exposed in sw.h, are only used in sw.c, so just make them static. The rtl92c_init_var_map function is not defined anywhere, while declared in sw.h. Two other functions are also declared in phy.h (which is included in sw.c) and their definitions are in phy.c Overall sw.h is unnecessary and can be removed. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit 5d3f9145f54ee81b33752f68285eb15ef644e08a Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:08 2019 +0100 rtlwifi: rtl8188ee: Make functions static & rm sw.h Some of functions which were exposed in sw.h, are only used in sw.c, so just make them static. This makes sw.h unnecessary, so remove it. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit fd156bdf62bb06271084f45eff9384b24f734fd8 Author: Amadeusz Sławiński Date: Mon Dec 23 13:37:07 2019 +0100 rtlwifi: rtl8192cu: Fix typo Replace USB_VENDER_ID_REALTEK with USB_VENDOR_ID_REALTEK. Signed-off-by: Amadeusz Sławiński Signed-off-by: Kalle Valo commit bbdd1d854e0a97b771ab642fc07992b28e853036 Author: Zong-Zhe Yang Date: Fri Dec 20 17:21:56 2019 +0800 rtw88: change max_num_of_tx_queue() definition to inline in pci.h It's more reasonable to define max_num_of_tx_queue() as an inline function. Signed-off-by: Zong-Zhe Yang Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit f48abf064ade7a08015bc3a50a873437375843b2 Author: Yan-Hsuan Chuang Date: Fri Dec 20 17:21:55 2019 +0800 rtw88: assign NULL to skb after being kfree()'ed Should assign NULL to skb after kfree(), in case of driver trying to free the same skb again. This could happen if driver failed to allocate an skb when building reserved page. Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit fc83c616d4d95c386e2bac7994b635b24662bca4 Author: Chin-Yen Lee Date: Fri Dec 20 17:21:54 2019 +0800 rtw88: use rtw_hci_stop() instead of rtwdev->hci.ops->stop() Fix typo, should use rtw_hci_stop() Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 65ae64d375751cad79c6e74222d348f72e310e4c Author: Yan-Hsuan Chuang Date: Fri Dec 20 17:21:53 2019 +0800 rtw88: remove unused vif pointer in struct rtw_vif As driver can easily get vif with container_of(), we can just remove it. Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 962562cde15463f712e9cc007086f6140930199d Author: Yan-Hsuan Chuang Date: Fri Dec 20 17:21:52 2019 +0800 rtw88: remove unused variable 'in_lps' Unused, will not be used neither, because the hardware/firmware can only support one vif for LPS currnetly. If there's more than one vif, than driver will never enter LPS. So remove it. Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 3f43f10bd619b1acebb570bebf989265920aeb27 Author: Tzu-En Huang Date: Fri Dec 20 17:21:51 2019 +0800 rtw88: remove unused spinlock dm_lock is never used. Thus, remove this redundant spinlock. Signed-off-by: Tzu-En Huang Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit e339b649352437c529616daa0c15db04c76f0e85 Author: Tzu-En Huang Date: Fri Dec 20 17:21:49 2019 +0800 rtw88: 8822c: update power sequence to v15 Update card enable power sequence flow, to fix CMD11 fail after reboot and wrong PLL clock. Signed-off-by: Tzu-En Huang Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 73a2d0b83424f7150a1f607470dac67c95b8b2d4 Author: Ping-Ke Shih Date: Fri Dec 20 17:21:47 2019 +0800 rtw88: fix TX secondary channel offset of 40M if current bw is 20M or 40M TX secondary channel offset is valid only if current bandwidth is 80M, otherwise leave this value as zero. The wrong value of txsc40 causes MAC unpredictable behavior. Signed-off-by: Ping-Ke Shih Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 35a68fa5f96a80797e11b6952a47c5a84939a7bf Author: Ping-Ke Shih Date: Fri Dec 20 17:21:46 2019 +0800 rtw88: fix rate mask for 1SS chip The rate mask is used to tell firmware the supported rate depends on negotiation. We loop 2 times for all VHT/HT 2SS rate mask first, and then only keep the part according to chip's NSS. This commit fixes the logic error of '&' operations for VHT/HT rate, and we should run this logic before adding legacy rate. To access HT MCS map, index 0/1 represent MCS 0-7/8-15 respectively. Use NL80211_BAND_xxx is incorrect, so fix it as well. Signed-off-by: Ping-Ke Shih Signed-off-by: Yan-Hsuan Chuang Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit b6c12908a33e4e413523e73464cd5957690f1a76 Author: Chin-Yen Lee Date: Thu Dec 19 16:58:16 2019 +0800 rtw88: Add wowlan net-detect support Net-detect is an option of wowlan to allow the device to be woken up from suspend mode when configured network is detected. When user enables net-detect and lets the device enter suspend state, wowlan firmware will periodically scan until beacon or probe response of configured networks are received. Between two scans, wowlan firmware keeps wifi chip in idle mode to reduce power consumption. If configured networks are detected, wowlan firmware will trigger resume process. Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit e3e400df30078830871b927ca24826667d97d1f6 Author: Chin-Yen Lee Date: Thu Dec 19 16:58:15 2019 +0800 rtw88: Add wowlan pattern match support Pattern match is an option of wowlan to allow the device to be woken up from suspend mode when receiving packets matched user-designed patterns. The patterns are written into hardware cam in suspend flow if users have set up them. If packets matched designed pattern are received, wowlan firmware will get an interrupt and then wake up the device. Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 44bc17f7f5b3b2cc4084eba6307ba750078a8a73 Author: Chin-Yen Lee Date: Thu Dec 19 16:58:14 2019 +0800 rtw88: support wowlan feature for 8822c Wake on WLAN(wowlan) is a feature which allows devices to be woken up from suspend state through wlan events. When user enables wowlan feature and then let the device enter suspend state, wowlan firmware will be loaded by the driver and periodically monitors wifi packets. Power consumption of wifi chip will be reduced in this state. If wowlan firmware detects that specific wlan event happens, it will issue wakeup signal to trigger resume process. Driver will load normal firmware and let wifi chip return to the original state. Currently supported wlan events include receiving magic packet, rekey packet and deauth packet, and disconnecting from AP. Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit c8e5695eae9959fc5774c0f490f2450be8bad3de Author: Chin-Yen Lee Date: Thu Dec 19 16:58:13 2019 +0800 rtw88: load wowlan firmware if wowlan is supported Driver used to download normal firmware only, but some devices support wowlan and require to download wowlan firmware when system suspends. So modify rtw_load_firmware() and its callback to allow driver to download both normal and wowlan firmware. Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit 786221048e8f74bafb87b4ba8b613cd5bc0ea159 Author: Yan-Hsuan Chuang Date: Thu Dec 19 16:58:12 2019 +0800 rtw88: add interface config for 8822c Some devices need to configure interface/HCI related reigsters in power on flow. Add interface_cfg for HCI for the settings. The driver only supports RTL8822BE/RTL8822CE now, and since RTL8822BE does not need to configure PCIE, the configuration is only added for RTL8822CE. Without it, some of the RTL8822CE device can crash and disconnected to host in suspend/wowlan mode. Signed-off-by: Tzu-En Huang Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit fd30e891e0bc68735b52d480d078959e5fb30e70 Author: Chin-Yen Lee Date: Thu Dec 19 16:58:11 2019 +0800 rtw88: pci: reset dma when reset pci trx ring When PCI trx rings are reset, the DMA engine should also be reset. Otherswise, the rx_tag of rx flow is not synchronous to hw. Remove DMA reset when rtw_pci_start() as we added it in rtw_pci_setup(). Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit 25cab7e71da32d46651f5fc9373eef9b79938629 Author: Chin-Yen Lee Date: Thu Dec 19 16:58:10 2019 +0800 rtw88: pci: reset ring index when release skbs in tx ring When skbs queued for each TX ring are relased in PCI stop flow, the ring index should be reset at the same time. Signed-off-by: Chin-Yen Lee Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit b61156fba74f659d0bc2de8f2dbf5bad9f4b8faf Author: Nathan Chancellor Date: Tue Dec 17 18:15:46 2019 -0700 hostap: Adjust indentation in prism2_hostapd_add_sta Clang warns: ../drivers/net/wireless/intersil/hostap/hostap_ap.c:2511:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] if (sta->tx_supp_rates & WLAN_RATE_5M5) ^ ../drivers/net/wireless/intersil/hostap/hostap_ap.c:2509:2: note: previous statement is here if (sta->tx_supp_rates & WLAN_RATE_2M) ^ 1 warning generated. This warning occurs because there is a space before the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns. Fixes: ff1d2767d5a4 ("Add HostAP wireless driver.") Link: https://github.com/ClangBuiltLinux/linux/issues/813 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Kalle Valo commit cf33a7728bf27e6f8c5e9190410db85c11103699 Author: Maital Hahn Date: Thu Jan 16 08:33:53 2020 -0600 wlcore: mesh: Add support for RX Broadcast Key In order to support authentication of equals peers, need to save RX Broadcast key per peer (on top of 1 TX broadcast key and unicast key per peer). Signed-off-by: Maital Hahn Acked-by: Guy Mishol Signed-off-by: Hari Nagalla Signed-off-by: Kalle Valo commit d7809bd9eae67b4252cbc4672431610227cbb729 Author: Colin Ian King Date: Thu Jan 23 00:51:17 2020 +0000 wcn36xx: fix spelling mistake "to" -> "too" There is a spelling mistake in a wcn36xx_err message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo commit d92e8fa8ce882107e3f5be1244ff77ea1a74e63e Author: Colin Ian King Date: Thu Jan 23 00:18:01 2020 +0000 ar5523: fix spelling mistake "to" -> "too" There is a spelling mistake in a ar5523_err message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo commit 5b362498a79631f283578b64bf6f4d15ed4cc19a Author: Mert Dirik Date: Thu Jan 16 14:11:25 2020 +0300 ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter Add the required USB ID for running SMCWUSBT-G2 wireless adapter (SMC "EZ Connect g"). This device uses ar5523 chipset and requires firmware to be loaded. Even though pid of the device is 4507, this patch adds it as 4506 so that AR5523_DEVICE_UG macro can set the AR5523_FLAG_PRE_FIRMWARE flag for pid 4507. Signed-off-by: Mert Dirik Signed-off-by: Kalle Valo commit fa43e99dd4b76201eb323ee3918c68132e8abba9 Author: Stephen Boyd Date: Thu Jan 23 15:29:44 2020 -0800 ath10k: Use device_get_match_data() to simplify code Use device_get_match_data() here to simplify the code a bit. Signed-off-by: Stephen Boyd Signed-off-by: Kalle Valo commit 79a4b788451dd5afd4ef62d5ff9bcde219ce5286 Author: Stephen Boyd Date: Thu Jan 23 15:24:56 2020 -0800 ath10k: Add newlines to printk messages Some printks in here don't have newlines at the end, meaning the log will be sort of hard to read. Add newlines. Signed-off-by: Stephen Boyd Signed-off-by: Kalle Valo commit 32efcc06d2a15fa87585614d12d6c2308cc2d3f3 Author: Abdul Kabbani Date: Fri Jan 24 16:34:02 2020 -0500 tcp: export count for rehash attempts Using IPv6 flow-label to swiftly route around avoid congested or disconnected network path can greatly improve TCP reliability. This patch adds SNMP counters and a OPT_STATS counter to track both host-level and connection-level statistics. Network administrators can use these counters to evaluate the impact of this new ability better. Export count for rehash attempts to 1) two SNMP counters: TcpTimeoutRehash (rehash due to timeouts), and TcpDuplicateDataRehash (rehash due to receiving duplicate packets) 2) Timestamping API SOF_TIMESTAMPING_OPT_STATS. Signed-off-by: Abdul Kabbani Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Kevin(Yudong) Yang Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 6ba8b3b6bd772f575f7736c8fd893c6981fcce16 Author: Rakesh Pillai Date: Tue Jan 21 12:42:28 2020 +0530 ath10k: Correct the DMA direction for management tx buffers The management packets, send to firmware via WMI, are mapped using the direction DMA_TO_DEVICE. Currently in case of wmi cleanup, these buffers are being unmapped using an incorrect DMA direction. This can cause unwanted behavior when the host driver is handling a restart of the wlan firmware. We might see a trace like below [] __dma_inv_area+0x28/0x58 [] ath10k_wmi_mgmt_tx_clean_up_pending+0x60/0xb0 [ath10k_core] [] idr_for_each+0x78/0xe4 [] ath10k_wmi_detach+0x4c/0x7c [ath10k_core] [] ath10k_core_stop+0x58/0x68 [ath10k_core] [] ath10k_halt+0xec/0x13c [ath10k_core] [] ath10k_core_restart+0x11c/0x1a8 [ath10k_core] [] process_one_work+0x16c/0x31c Fix the incorrect DMA direction during the wmi management tx buffer cleanup. Tested HW: WCN3990 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Fixes: dc405152bb6 ("ath10k: handle mgmt tx completion event") Signed-off-by: Rakesh Pillai Signed-off-by: Kalle Valo commit 6efca894e92295174a95b0b9a0c59012a1bb2d20 Merge: 14a1d2468ab3 17d9723e69d4 Author: David S. Miller Date: Sun Jan 26 15:20:32 2020 +0100 Merge branch 's390-qeth-next' Julian Wiedmann says: ==================== s390/qeth: updates 2020-01-25 please apply the following patch series for qeth to your net-next tree. This brings a number of cleanups for the init/teardown code paths. ==================== Signed-off-by: David S. Miller commit 17d9723e69d44491d04289213006fea1647bd0a6 Author: Julian Wiedmann Date: Sat Jan 25 16:53:03 2020 +0100 s390/qeth: remove HARDSETUP state qeth_l?_stop_card() is _never_ called while in HARDSETUP state, and there's no other usage of the card state that relies on the DOWN -> HARDSETUP -> SOFTSETUP transition. As related cleanup, remove the check in qeth_realloc_buffer_pool() as it is already done by the callers. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 7f92316c5393b583c5217bb2cfc789d6820ec393 Author: Julian Wiedmann Date: Sat Jan 25 16:53:02 2020 +0100 s390/qeth: make cmd/reply matching more flexible When data is received on the READ channel, the matching logic for cmds that are waiting for a reply is currently hard-coded into the channel's main IO callback. Move this into a per-cmd callback, so that we can apply custom matching logic for each individual cmd. This also allows us to remove the coarse-grained check for unexpected non-IPA replies, since they will no longer match against _all_ pending cmds. Note that IDX cmds use _no_ matcher, since their reply is synchronously received as part of the cmd's IO. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 91003f354e6bbe8d225b4d54127d80c694d201d9 Author: Julian Wiedmann Date: Sat Jan 25 16:53:01 2020 +0100 s390/qeth: consolidate online/offline code Large parts of the online/offline code are identical now, and cleaning up the remaining stuff is easier with a shared core. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit aa3ad3920301f2cf6d406209b14acde0c50f2323 Author: Julian Wiedmann Date: Sat Jan 25 16:53:00 2020 +0100 s390/qeth: consolidate QDIO queue setup Move some duplicated logic into a shared code path. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 8ca769e2b88f9e564aecdfab54fcc5a9d20190c1 Author: Julian Wiedmann Date: Sat Jan 25 16:52:59 2020 +0100 s390/qeth: shift some bridgeport code around qeth_l2_setup_bridgeport_attrs() is entirely unrelated to sysfs functionality, move it where it belongs. While at it merge all the bridgeport-specific code in the set-online path together. Signed-off-by: Julian Wiedmann Reviewed-by: Alexandra Winter Signed-off-by: David S. Miller commit d04bf42891a7ea43d15384262ae6ddd8e0461642 Author: Ganapathi Bhat Date: Mon Jan 13 10:42:46 2020 +0000 MAINTAINERS: update for mwifiex driver maintainers Remove Nishant Sarmukadam from Maintainer list, as he is no longer working in NXP. Signed-off-by: Ganapathi Bhat Signed-off-by: Kalle Valo commit 70e5b8f445fd27fde0c5583460e82539a7242424 Author: Brian Norris Date: Fri Dec 6 11:45:35 2019 -0800 mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame() Before commit 1e58252e334d ("mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()"), mwifiex_process_tdls_action_frame() already had too many magic numbers. But this commit just added a ton more, in the name of checking for buffer overflows. That seems like a really bad idea. Let's make these magic numbers a little less magic, by (a) factoring out 'pos[1]' as 'ie_len' (b) using 'sizeof' on the appropriate source or destination fields where possible, instead of bare numbers (c) dropping redundant checks, per below. Regarding redundant checks: the beginning of the loop has this: if (pos + 2 + pos[1] > end) break; but then individual 'case's include stuff like this: if (pos > end - 3) return; if (pos[1] != 1) return; Note that the second 'return' (validating the length, pos[1]) combined with the above condition (ensuring 'pos + 2 + length' doesn't exceed 'end'), makes the first 'return' (whose 'if' can be reworded as 'pos > end - pos[1] - 2') redundant. Rather than unwind the magic numbers there, just drop those conditions. Fixes: 1e58252e334d ("mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()") Signed-off-by: Brian Norris Signed-off-by: Kalle Valo commit 63289e7d3a645a4291ec43c1d526dd4a811da1a0 Author: Christophe Leroy Date: Sat Dec 21 08:32:28 2019 +0000 powerpc: align stack to 2 * THREAD_SIZE with VMAP_STACK In order to ease stack overflow detection, align stack to 2 * THREAD_SIZE when using VMAP_STACK. This allows overflow detection using a single bit check. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/60e9ae86b7d2cdcf21468787076d345663648f46.1576916812.git.christophe.leroy@c-s.fr commit 028474876f472c3b6eee633aed528a1206609657 Author: Christophe Leroy Date: Sat Dec 21 08:32:27 2019 +0000 powerpc/32: prepare for CONFIG_VMAP_STACK To support CONFIG_VMAP_STACK, the kernel has to activate Data MMU Translation for accessing the stack. Before doing that it must save SRR0, SRR1 and also DAR and DSISR when relevant, in order to not loose them in case there is a Data TLB Miss once the translation is reactivated. This patch adds fields in thread struct for saving those registers. It prepares entry_32.S to handle exception entry with Data MMU Translation enabled and alters EXCEPTION_PROLOG macros to save SRR0, SRR1, DAR and DSISR then reenables Data MMU. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a775a1fea60f190e0f63503463fb775310a2009b.1576916812.git.christophe.leroy@c-s.fr commit c9c84fd945bbaadbf69d953be308e6f35737fef6 Author: Christophe Leroy Date: Sat Dec 21 08:32:26 2019 +0000 powerpc/32: add a macro to get and/or save DAR and DSISR on stack. Refactor reading and saving of DAR and DSISR in exception vectors. This will ease the implementation of VMAP stack. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1286b3e51b07727c6b4b05f2df9af3f9b1717fb5.1576916812.git.christophe.leroy@c-s.fr commit 5ae8fabc644632d31babbc7162aa876c79aaadb3 Author: Christophe Leroy Date: Sat Dec 21 08:32:25 2019 +0000 powerpc/32: move MSR_PR test into EXCEPTION_PROLOG_0 In order to simplify VMAP stack implementation, move MSR_PR test into EXCEPTION_PROLOG_0. This requires to not modify cr0 between EXCEPTION_PROLOG_0 and EXCEPTION_PROLOG_1. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/5c8b5bba692b92654dbd363a229a1ba91db725bb.1576916812.git.christophe.leroy@c-s.fr commit 1ca9db5b6556c38aacac4c50a617aa3f7efbb306 Author: Christophe Leroy Date: Sat Dec 21 08:32:24 2019 +0000 powerpc/32: save DEAR/DAR before calling handle_page_fault handle_page_fault() is the only function that save DAR/DEAR itself. Save DAR/DEAR before calling handle_page_fault() to prepare for VMAP stack which will require to save even before. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/3a4d58d378091086f00fde42b59610c80289e120.1576916812.git.christophe.leroy@c-s.fr commit 1f1c4d0122eebd204468684f21f0270ea8a4999d Author: Christophe Leroy Date: Sat Dec 21 08:32:23 2019 +0000 powerpc/32: Add EXCEPTION_PROLOG_0 in head_32.h This patch creates a macro for the very first part of exception prolog, this will help when implementing CONFIG_VMAP_STACK Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/2249fe62f481121a180e9655ad2b998093f318f3.1576916812.git.christophe.leroy@c-s.fr commit 39bccfd164970557c5cfc60b2db029f70542549f Author: Christophe Leroy Date: Sat Dec 21 08:32:22 2019 +0000 powerpc/32: replace MTMSRD() by mtmsr On PPC32, MTMSRD() is simply defined as mtmsr. Replace MTMSRD(reg) by mtmsr reg in files dedicated to PPC32, this makes the code less obscure. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/22469e78230edea3dbd0c79a555d73124f6c6d93.1576916812.git.christophe.leroy@c-s.fr commit 7195c8747e8757daaf48d862e1314f8bcfdb3207 Author: Dan Carpenter Date: Wed Jan 15 20:46:52 2020 +0300 ath11k: fix up some error paths There are two error paths where "ret" wasn't set. Also one error path we set the error code to -EINVAL but we should just preserve the error code from ath11k_hal_srng_get_entrysize(). That function only returns -EINVAL so this doesn't change anything. I removed the "ret = 0;" initializers so that hopefully GCC will be able to detect these sorts of bugs in the future. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo commit 93634c61056e34522e824d56ff77ee2332ed7f8a Author: John Crispin Date: Tue Dec 17 21:20:57 2019 +0100 ath11k: make sure to also report the RX bandwidth inside radiotap Add IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN to the list of known fields. Not doing so will result in wireshark not calculating the bitrate correctly. Signed-off-by: John Crispin Signed-off-by: Kalle Valo commit 3b4516838eaabacc56770f12407d5f791c88838a Author: Colin Ian King Date: Sat Jan 11 09:08:24 2020 +0000 ath11k: avoid null pointer dereference when pointer band is null In the unlikely event that cap->supported_bands has neither WMI_HOST_WLAN_2G_CAP set or WMI_HOST_WLAN_5G_CAP set then pointer band is null and a null dereference occurs when assigning band->n_iftype_data. Move the assignment to the if blocks to avoid this. Cleans up static analysis warnings. Addresses-Coverity: ("Explicit null dereference") Fixes: 9f056ed8ee01 ("ath11k: add HE support") Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo commit 875603b3de9fb5dc11acf80b6df45709adec68b2 Author: Bhagavathi Perumal S Date: Thu Jan 9 17:18:50 2020 +0530 ath11k: Add missing pdev rx rate stats This adds missing rx rate info stats like pilot evm, per chain rssi, per user ul ppdu and mpdu counts and ul ofdma rate info etc. And add null checks for memory alloc failures. Signed-off-by: Bhagavathi Perumal S Signed-off-by: Kalle Valo commit eefca584140b42551e642277515ca26be0ca5ef3 Author: Colin Ian King Date: Sat Dec 21 00:40:46 2019 +0000 ath11k: ensure ts.flags is initialized before bit-wise or'ing in values Currently the structure ts is not inititalized and ts.flags contains garbage values from the stack. This is being passed into function ath11k_dp_tx_status_parse that bit-wise or'ing in settings into the ts.flags field. To avoid flags (and other fields) from containing garbage, initialize the structure to zero before use. Addresses-Coverity: ("Uninitialized scalar variable)" Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo commit 5815719dd2714a369448159a562f6fdf75ffe87b Author: Bhagavathi Perumal S Date: Tue Dec 17 17:49:17 2019 +0100 ath11k: set TxBf parameters after vdev start The channel info parameters are required by the firmware to process TxBf parameters. Currently TxBf is passed prior to the channel info. This patch moves TxBf setup after the channel setup. Signed-off-by: John Crispin Signed-off-by: Bhagavathi Perumal S Signed-off-by: Kalle Valo commit 14a1d2468ab370c8f02d341b1551bc742a8975d3 Merge: 4d8773b68e83 18a8d3586310 Author: David S. Miller Date: Sun Jan 26 11:38:10 2020 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 100GbE Intel Wired LAN Driver Updates 2020-01-25 This series contains updates to the ice driver to add support for RSS. Henry and Tony enable the driver to write the filtering hardware tables to allow for changing of RSS rules, also introduced and initialized the structures for storing the configuration. Then followed it up by creating an extraction sequence based on the packet header protocols to be programmed. Next was storing the TCAM entry with the profile data and VSI group in the respective software structures. Md Fahad sets up the configuration to support RSS tables for the virtual function (VF) driver (iavf). Add support for flow types TCP4, TCP6, UDP4, UDP6, SCTP4 and SCTP6 for RSS via ethtool. ==================== Signed-off-by: David S. Miller commit 1e93a78113b4eaf009b3c994595db44356544b05 Author: Anilkumar Kolli Date: Tue Dec 17 17:21:40 2019 +0100 ath11k: enable HE tlvs in ppdu stats for pktlog lite This patch enables HE tlvs in ppdu stats for pktlog lite mode. Signed-off-by: John Crispin Signed-off-by: Anilkumar Kolli Signed-off-by: Kalle Valo commit a45ceea5015d5be4bab4f6ce59cffcbeceba7e6c Author: Arnd Bergmann Date: Tue Jan 7 22:50:04 2020 +0100 ath11k: fix debugfs build failure When CONFIG_ATH11K_DEBUGFS is disabled, but CONFIG_MAC80211_DEBUGFS is turned on, the driver fails to build: drivers/net/wireless/ath/ath11k/debugfs_sta.c: In function 'ath11k_dbg_sta_open_htt_peer_stats': drivers/net/wireless/ath/ath11k/debugfs_sta.c:416:4: error: 'struct ath11k' has no member named 'debug' ar->debug.htt_stats.stats_req = stats_req; ^~ It appears that just using the former symbol is sufficient here, adding a Kconfig dependency takes care of the corner cases. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo commit ab000ea6a3939972b6eaca78046c4cd7d3aeee22 Author: Govind Singh Date: Fri Jan 3 19:14:14 2020 +0530 ath10k: Don't call SCM interface for statically mapped msa region For some targets ex: QCS404, SCM permissions for MSA region is statically configured in TrustZone fw. Add SCM call disable option for such targets to avoid duplicate permissions. Testing: Tested on WCN3990 HW Tested FW: WLAN.HL.3.1-01040-QCAHLSWMTPLZ-1 Signed-off-by: Govind Singh Signed-off-by: Kalle Valo commit 6ca71a10aee8d5613446a180f85aa5efbb370b10 Author: Govind Singh Date: Fri Jan 3 19:14:13 2020 +0530 dt: bindings: add dt entry flag to skip SCM call for msa region Add boolean context flag to disable SCM call for statically mapped msa region. Signed-off-by: Govind Singh Acked-by: Rob Herring Signed-off-by: Kalle Valo commit a1769bb68a850508a492e3674ab1e5e479b11254 Author: Zhi Chen Date: Tue Jan 14 12:35:21 2020 +0800 Revert "ath10k: fix DMA related firmware crashes on multiple devices" This reverts commit 76d164f582150fd0259ec0fcbc485470bcd8033e. PCIe hung issue was observed on multiple platforms. The issue was reproduced when DUT was configured as AP and associated with 50+ STAs. For QCA9984/QCA9888, the DMA_BURST_SIZE register controls the AXI burst size of the RD/WR access to the HOST MEM. 0 - No split , RAW read/write transfer size from MAC is put out on bus as burst length 1 - Split at 256 byte boundary 2,3 - Reserved With PCIe protocol analyzer, we can see DMA Read crossing 4KB boundary when issue happened. It broke PCIe spec and caused PCIe stuck. So revert the default value from 0 to 1. Tested: IPQ8064 + QCA9984 with firmware 10.4-3.10-00047 QCS404 + QCA9984 with firmware 10.4-3.9.0.2--00044 Synaptics AS370 + QCA9888 with firmware 10.4-3.9.0.2--00040 Signed-off-by: Zhi Chen Signed-off-by: Kalle Valo commit 218f646d235a84d716c603100a6aa5447bc3c9a2 Author: Wen Gong Date: Tue Dec 31 17:27:06 2019 +0800 ath10k: drop RX skb with invalid length for sdio When simulate random transfer fail for sdio write and read, it crash sometimes. Test steps: 1. Add config and update kernel: CONFIG_FAIL_MMC_REQUEST=y CONFIG_FAULT_INJECTION=y CONFIG_FAULT_INJECTION_DEBUG_FS=y 2. run simulate fail: cd /sys/kernel/debug/mmc1/fail_mmc_request echo 10 > probability echo 10 > times # repeat until hitting issues 3. it crash, the act len of ath10k_htc_hdr is higher than allocate len, it cause panic: [ 99.723482] skbuff: skb_over_panic: text:00000000caa0f780 len:57013 put:57013 head:000000004116f24a data:0000000019ecb4dc tail:0xdef5 end:0x640 dev: [ 99.737697] ------------[ cut here ]------------ [ 99.742327] kernel BUG at /mnt/host/source/src/third_party/kernel/v4.19/net/core/skbuff.c:104! [ 99.750937] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 99.831154] Process kworker/0:2 (pid: 151, stack limit = 0x00000000728010bf) [ 99.838200] CPU: 0 PID: 151 Comm: kworker/0:2 Tainted: G W 4.19.85 #48 [ 99.846022] Hardware name: MediaTek krane sku0 board (DT) [ 99.851429] Workqueue: events sdio_irq_work [ 99.855614] pstate: 60000005 (nZCv daif -PAN -UAO) [ 99.860402] pc : skb_panic+0x64/0x68 [ 99.863974] lr : skb_panic+0x64/0x68 [ 99.867542] sp : ffffff8008833a90 [ 99.870850] x29: ffffff8008833ac0 x28: ffffffe52e337370 [ 99.876159] x27: ffffffe52e328a90 x26: 000000000000e0d0 [ 99.881469] x25: ffffffe52e336b60 x24: 000000000000deb5 [ 99.886779] x23: ffffffe52e340680 x22: ffffffe4efd47e00 [ 99.892088] x21: 000000000000deb5 x20: ffffffa516d85b4c [ 99.897397] x19: ffffffa526928037 x18: 0000000000000000 [ 99.902706] x17: 000000000000003c x16: ffffffa5265b6c80 [ 99.908015] x15: 0000000000000006 x14: 3a76656420303436 [ 99.913325] x13: 0000000000029bf0 x12: 0000000000000000 [ 99.918634] x11: 0000000000000000 x10: 0000000000000000 [ 99.923943] x9 : a3b907e4b2783000 x8 : a3b907e4b2783000 [ 99.929253] x7 : 0000000000000000 x6 : ffffffa526f66d76 [ 99.934563] x5 : 0000000000000000 x4 : 0000000000000000 [ 99.939872] x3 : 000000000002a5ab x2 : ffffffe53feed918 [ 99.945182] x1 : ffffffe53fee4a08 x0 : 000000000000008e [ 99.950491] Call trace: [ 99.952937] skb_panic+0x64/0x68 [ 99.956165] skb_put+0x7c/0x84 [ 99.959224] ath10k_sdio_irq_handler+0x740/0xbb8 [ath10k_sdio] [ 99.965055] process_sdio_pending_irqs+0x58/0x1a4 [ 99.969758] sdio_run_irqs+0x34/0x60 [ 99.973329] sdio_irq_work+0x1c/0x28 [ 99.974930] cros-ec-spi spi2.0: SPI transfer timed out [ 99.976904] process_one_work+0x210/0x410 [ 99.976911] worker_thread+0x234/0x3dc [ 99.976923] kthread+0x120/0x130 [ 99.982090] cros-ec-spi spi2.0: spi transfer failed: -110 [ 99.986054] ret_from_fork+0x10/0x18 [ 99.986063] Code: aa1403e2 2a1503e4 a90023e9 97e37d1a (d4210000) [ 99.986068] ---[ end trace cb6d948c5a0fd6c7 ]--- [ 100.017250] Kernel panic - not syncing: Fatal exception [ 100.018879] cros-ec-spi spi2.0: Command xfer error (err:-110) [ 100.023659] SMP: stopping secondary CPUs [ 100.023703] Kernel Offset: 0x251dc00000 from 0xffffff8008000000 [ 100.023707] CPU features: 0x0,2188200c [ 100.023709] Memory Limit: none The simulate fail of sdio is not a real sdio transter fail, it only set an error status in mmc_should_fail_request after the transfer end, actually the transfer is success, then sdio_io_rw_ext_helper will return error status and stop transfer the left data. For example, the really RX len is 286 bytes, then it will split to 2 blocks in sdio_io_rw_ext_helper, one is 256 bytes, left is 30 bytes, if the first 256 bytes get an error status by mmc_should_fail_request,then the left 30 bytes will not read in this RX operation. Then when the next RX arrive, the left 30 bytes will be considered as the header of the read, the top 8 bytes will be considered as ath10k_htc_hdr, but actually the 8 bytes is not the ath10k_htc_hdr, so the act_len from this ath10k_htc_hdr is not correct, if it is a big value, such as 57013, it will trigger skb_panic. Drop the skb with invalid length will be reasonable. This patch only effect sdio chips. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00029. Signed-off-by: Wen Gong Signed-off-by: Kalle Valo commit 0f7ab288ade970b7754d89b594e872ea40af8f66 Author: zhengbin Date: Tue Dec 24 22:16:04 2019 +0800 ath10k: use true,false for bool variable Fixes coccicheck warning: drivers/net/wireless/ath/ath10k/htt_rx.c:2143:2-31: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit 57a3b60ddbfa87e8707c453c69915a3c5d2c9e50 Author: Bjorn Andersson Date: Sun Dec 22 21:48:54 2019 -0800 ath10k: Add optional qdss clk The WiFi firmware found on sm8150 requires that the QDSS clock is ticking in order to operate, so add an optional clock to the binding to allow this to be specified in the sm8150 dts and add the clock to the list of clocks in the driver. Signed-off-by: Bjorn Andersson Acked-by: Rob Herring Signed-off-by: Kalle Valo commit 63ec5cbc31f7c37870b7fbd33d9f1a50ba320221 Author: Bryan O'Donoghue Date: Thu Dec 19 13:15:39 2019 +0000 ath10k: pci: Fix comment on ath10k_pci_dump_memory_sram The description of ath10k_pci_dump_memory_sram() is inaccurate, an error can never be returned, it is always the length. Update the comment to reflect. Fixes: 219cc084c6706 ("ath10k: add memory dump support QCA9984") Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo commit d239380196c4e27a26fa4bea73d2bf994c14ec2d Author: Bryan O'Donoghue Date: Thu Dec 19 13:15:38 2019 +0000 ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe ath10k_pci_dump_memory_reg() will try to access memory of type ATH10K_MEM_REGION_TYPE_IOREG however, if a hardware restart is in progress this can crash a system. Individual ioread32() time has been observed to jump from 15-20 ticks to > 80k ticks followed by a secure-watchdog bite and a system reset. Work around this corner case by only issuing the read transaction when the driver state is ATH10K_STATE_ON. Tested-on: QCA9988 PCI 10.4-3.9.0.2-00044 Fixes: 219cc084c6706 ("ath10k: add memory dump support QCA9984") Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo commit f89ee9927a49d805ae355c6d88a22e11a7ec083a Author: zhengbin Date: Tue Dec 24 22:16:05 2019 +0800 wil6210: use true,false for bool variable Fixes coccicheck warning: drivers/net/wireless/ath/wil6210/main.c:765:1-14: WARNING: Assignment of 0/1 to bool variable drivers/net/wireless/ath/wil6210/txrx.c:1143:1-19: WARNING: Assignment of 0/1 to bool variable drivers/net/wireless/ath/wil6210/wmi.c:1516:4-23: WARNING: Assignment of 0/1 to bool variable drivers/net/wireless/ath/wil6210/wmi.c:1523:4-23: WARNING: Assignment of 0/1 to bool variable drivers/net/wireless/ath/wil6210/wmi.c:1538:4-30: WARNING: Assignment of 0/1 to bool variable drivers/net/wireless/ath/wil6210/wmi.c:1545:4-30: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit d27c768f3b617a5a94844e58b18f773d2e40f41c Author: zhengbin Date: Tue Dec 24 22:16:03 2019 +0800 ath9k: use true,false for bool variable Fixes coccicheck warning: drivers/net/wireless/ath/ath9k/ar9003_aic.c:409:2-12: WARNING: Assignment of 0/1 to bool variable Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit fafa7424ba7d091da274f661bd41772ce69cd1e1 Merge: e07c5f2e4e91 0b295a1eb81f Author: Kalle Valo Date: Sun Jan 26 12:10:02 2020 +0200 Merge tag 'iwlwifi-next-for-kalle-2020-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next First set of patches intended for v5.6 * Support new versions of the FTM FW APIs; * Fix an old bug in D3 (WoWLAN); * A couple of fixes/improvements in the receive-buffers code; * Fix in the debugging where we were skipping one TXQ; * Support new version of the beacon template FW API; * Print some extra information when the driver is loaded; * Some debugging infrastructure (aka. yoyo) updates; * Support for a new HW version; * Second phase of device configuration work started; * Some clean-ups; commit 913292c97d750fe4188b4f5aa770e5e0ca1e5a91 Author: Madhuparna Bhowmik Date: Fri Jan 24 10:29:08 2020 +0530 sched.h: Annotate sighand_struct with __rcu This patch fixes the following sparse errors by annotating the sighand_struct with __rcu kernel/fork.c:1511:9: error: incompatible types in comparison expression kernel/exit.c:100:19: error: incompatible types in comparison expression kernel/signal.c:1370:27: error: incompatible types in comparison expression This fix introduces the following sparse error in signal.c due to checking the sighand pointer without rcu primitives: kernel/signal.c:1386:21: error: incompatible types in comparison expression This new sparse error is also fixed in this patch. Signed-off-by: Madhuparna Bhowmik Acked-by: Paul E. McKenney Link: https://lore.kernel.org/r/20200124045908.26389-1-madhuparnabhowmik10@gmail.com Signed-off-by: Christian Brauner commit 4d8773b68e83558025303f266070b31bc4101e73 Merge: 3333e50b64fe 2821e26f3a0a Author: David S. Miller Date: Sun Jan 26 10:40:21 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Minor conflict in mlx5 because changes happened to code that has moved meanwhile. Signed-off-by: David S. Miller commit 11eb85ec42dc8c7a7ec519b90ccf2eeae9409de8 Author: Dan Carpenter Date: Wed Jan 15 20:49:04 2020 +0300 Bluetooth: Fix race condition in hci_release_sock() Syzbot managed to trigger a use after free "KASAN: use-after-free Write in hci_sock_bind". I have reviewed the code manually and one possibly cause I have found is that we are not holding lock_sock(sk) when we do the hci_dev_put(hdev) in hci_sock_release(). My theory is that the bind and the release are racing against each other which results in this use after free. Reported-by: syzbot+eba992608adf3d796bcc@syzkaller.appspotmail.com Signed-off-by: Dan Carpenter Signed-off-by: Johan Hedberg commit 9b132f2764e5a04bfb2e6c6f51cf5a729617d6a4 Merge: 5396c4bd9fd8 b81cbf7abfc9 Author: Takashi Iwai Date: Sun Jan 26 09:31:34 2020 +0100 Merge branch 'for-linus' into for-next Resolve conflicts and correct the hex numbers, too. Signed-off-by: Takashi Iwai commit b81cbf7abfc94878a3c6f0789f2185ee55b1cc21 Author: Nicola Lunghi Date: Sat Jan 25 15:09:17 2020 +0000 ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82 With firmware 2.82 Line6 changed the usb id of some of the Helix devices but the quirks is still needed. Add it to the quirk list for line6 helix family of devices. Thanks to Jens for pointing out the missing ids. Signed-off-by: Nicola Lunghi Link: https://lore.kernel.org/r/20200125150917.5040-1-nick83ola@gmail.com Signed-off-by: Takashi Iwai commit d8feb6080bb0c9f4d799a423d9453048fdd06990 Author: Hans de Goede Date: Sat Jan 25 19:10:21 2020 +0100 ALSA: hda: Add Clevo W65_67SB the power_save blacklist Using HDA power-saving on the Clevo W65_67SB causes the first 0.5 seconds of audio to be missing every time audio starts playing. This commit adds the Clevo W65_67SB the power_save blacklist to avoid this issue. Cc: stable@vger.kernel.org BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104 Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200125181021.70446-1-hdegoede@redhat.com Signed-off-by: Takashi Iwai commit 18a8d3586310743d451c94db46319797e72727da Author: Tony Nguyen Date: Fri Jan 17 07:39:19 2020 -0800 ice: Bump version Bump version to 0.8.2-k Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 6876fb6404a50d764cc1409870207b62f6e21dff Author: Md Fahad Iqbal Polash Date: Fri Jan 17 07:39:18 2020 -0800 ice: Implement ethtool get/set rx-flow-hash Provide support to change or retrieve RSS hash options for a flow type. The supported flow-types are: tcp4, tcp6, udp4, udp6, sctp4, sctp6. Signed-off-by: Md Fahad Iqbal Polash Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 1c01c8c6c969a9da1b0783c2b4138debc4d868c2 Author: Md Fahad Iqbal Polash Date: Fri Jan 17 07:39:17 2020 -0800 ice: Initilialize VF RSS tables Set configuration for hardware RSS tables for VFs. Signed-off-by: Md Fahad Iqbal Polash Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 2c61054c5fdaf3df267c4fa95c8cfc33f7665615 Author: Tony Nguyen Date: Fri Jan 17 07:39:16 2020 -0800 ice: Optimize table usage Attempt to optimize TCAM entries and reduce table resource usage by searching for profiles that can be reused. Provide resource cleanup of both hardware and software structures. Signed-off-by: Tony Nguyen Signed-off-by: Henry Tieman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 43dbfc7bb8f0bd79a98f3fd628266a853d4bae61 Author: Tony Nguyen Date: Fri Jan 17 07:39:15 2020 -0800 ice: Enable writing filtering tables Write the hardware tables based on the populated software structures. Signed-off-by: Tony Nguyen Signed-off-by: Henry Tieman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 451f2c4406e035295169a3abe127e377af694398 Author: Tony Nguyen Date: Fri Jan 17 07:39:14 2020 -0800 ice: Populate TCAM filter software structures Store the TCAM entry with the profile data and the VSI group in the respective SW structures. This will be subsequently used to write out the tables to hardware. Signed-off-by: Tony Nguyen Signed-off-by: Henry Tieman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 0282c72d30d32913d641dc81f3f38607ace98802 Merge: 81563bed1e11 1e4d149e9017 Author: Linus Walleij Date: Sun Jan 26 01:01:55 2020 +0100 Merge tag 'gpio-updates-for-v5.6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into devel gpio: updates for v5.6 - use platform_get_irq_optional() in gpio-altera commit ddc9d357b991838c2d975e8d7e4e9db26f37a7ff Author: Dexuan Cui Date: Sun Jan 19 15:29:22 2020 -0800 Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) When a Linux hv_sock app tries to connect to a Service GUID on which no host app is listening, a recent host (RS3+) sends a CHANNELMSG_TL_CONNECT_RESULT (23) message to Linux and this triggers such a warning: unknown msgtype=23 WARNING: CPU: 2 PID: 0 at drivers/hv/vmbus_drv.c:1031 vmbus_on_msg_dpc Actually Linux can safely ignore the message because the Linux app's connect() will time out in 2 seconds: see VSOCK_DEFAULT_CONNECT_TIMEOUT and vsock_stream_connect(). We don't bother to make use of the message because: 1) it's only supported on recent hosts; 2) a non-trivial effort is required to use the message in Linux, but the benefit is small. So, let's not see the warning by silently ignoring the message. Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 382a46221757250966621f046e91d8c05adac12b Author: Dexuan Cui Date: Mon Jan 6 14:41:51 2020 -0800 video: hyperv_fb: Fix hibernation for the deferred IO feature fb_deferred_io_work() can access the vmbus ringbuffer by calling fbdefio->deferred_io() -> synthvid_deferred_io() -> synthvid_update(). Because the vmbus ringbuffer is inaccessible between hvfb_suspend() and hvfb_resume(), we must cancel info->deferred_work before calling vmbus_close() and then reschedule it after we reopen the channel in hvfb_resume(). Fixes: a4ddb11d297e ("video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver") Fixes: 824946a8b6fb ("video: hyperv_fb: Add the support of hibernation") Signed-off-by: Dexuan Cui Reviewed-by: Wei Hu Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin commit e2379b30324ca5ba808f16cb3d2504349264912f Author: Dexuan Cui Date: Mon Jan 6 14:40:44 2020 -0800 Input: hyperv-keyboard: Add the support of hibernation Add suspend() and resume() functions so the Hyper-V virtual keyboard can participate in VM hibernation. Note that the keyboard is a "wakeup" device that could abort an in-progress hibernation if there is keyboard event. No attempt is made to suppress this behavior. If desired, a sysadmin can disable the keyboard as a wakeup device using standard mechanisms such as: echo disabled > /sys/bus/vmbus/drivers/hyperv_keyboard/XXX/power/wakeup (where XXX is the device's GUID) Reviewed-by: Michael Kelley Signed-off-by: Dexuan Cui Signed-off-by: Sasha Levin commit d33c240d47dab4fd15123d9e73fc8810cbc6ed6a Author: Tianyu Lan Date: Sat Jan 25 16:50:47 2020 -0500 hv_balloon: Balloon up according to request page number Current code has assumption that balloon request memory size aligns with 2MB. But actually Hyper-V doesn't guarantee such alignment. When balloon driver receives non-aligned balloon request, it produces warning and balloon up more memory than requested in order to keep 2MB alignment. Remove the warning and balloon up memory according to actual requested memory size. Fixes: f6712238471a ("hv: hv_balloon: avoid memory leak on alloc_error of 2MB memory block") Cc: stable@vger.kernel.org Reviewed-by: Vitaly Kuznetsov Signed-off-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 19d52e94e08391cd05cee227bcc1360a8fb29369 Merge: 955d8f3ecb9d 2256e6f68c9e Author: Olof Johansson Date: Sat Jan 25 13:28:41 2020 -0800 Merge tag 'omap-for-v5.6/dt-late-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/late Late omap dts changes for v5.6 merge window This series of changes mostly configures the cameras for dra7 and am437x that have been pending for few months now because of waiting for clock dependencies to clear. So these changes are based on earlier dts changes with with Tero Kristo's for-5.6-ti-clk branch merged in. Then there's a series of changes to configure powervr sgx target module for am335x, am437x and dra7 that have been waiting to have the rstctrl reset driver dependencies to clear. Also included are few minor patches to configure 1-wire and coulomb counter calibration interrupt for droid4. * tag 'omap-for-v5.6/dt-late-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: (25 commits) ARM: dts: omap4-droid4: Enable hdq for droid4 ds250x 1-wire battery nvmem ARM: dts: motorola-cpcap-mapphone: Configure calibration interrupt ARM: dts: Configure interconnect target module for am437x sgx ARM: dts: Configure sgx for dra7 ARM: dts: Configure rstctrl reset for am335x SGX ARM: dts: dra7: Add ti-sysc node for VPE ARM: dts: dra7: add vpe clkctrl node ARM: dts: am43x-epos-evm: Add VPFE and OV2659 entries ARM: dts: am437x-sk-evm: Add VPFE and OV2659 entries ARM: dts: am43xx: add support for clkout1 clock arm: dts: dra76-evm: Add CAL and OV5640 nodes arm: dtsi: dra76x: Add CAL dtsi node arm: dts: dra72-evm-common: Add entries for the CSI2 cameras ARM: dts: DRA72: Add CAL dtsi node ARM: dts: dra7-l4: Add ti-sysc node for CAM ARM: OMAP: DRA7xx: Make CAM clock domain SWSUP only ARM: dts: dra7: add cam clkctrl node ARM: dts: Add omap3-echo ARM: dts: Add dtsi files for AM3703, AM3715 and DM3725 ARM: dts: am335x-icev2: Add support for OSD9616P0899-10 at i2c0 ... Link: https://lore.kernel.org/r/pull-1579896427-50330@atomide.com-3 Signed-off-by: Olof Johansson commit 955d8f3ecb9d5d50f9729dd0dfd6164cd726d4bb Merge: d1eef1c61974 885d21e4956d Author: Olof Johansson Date: Sat Jan 25 13:28:04 2020 -0800 Merge tag 'omap-for-v5.6/ti-sysc-drop-pdata-crypto-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/late Late changes for omap secure accelerators for v5.6 merge window A series of changes to configure secure accelerators for omap4 & 5 to finally get hardware random number generator working. Apologies on a late pull request on these changes, but this pull request could not be sent out earlier because of a dependency to recent clock changes. This is based on earlier changes to drop omap legacy platform data with Tero Kristo's for-5.6-ti-clk branch merged in. * tag 'omap-for-v5.6/ti-sysc-drop-pdata-crypto-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: (98 commits) ARM: OMAP2+: Drop legacy platform data for omap4 des ARM: OMAP2+: Drop legacy platform data for omap4 sham ARM: OMAP2+: Drop legacy platform data for omap4 aes ARM: dts: Configure interconnect target module for omap4 des ARM: dts: Configure interconnect target module for omap4 aes ARM: dts: Configure interconnect target module for omap4 sham ARM: dts: Configure omap5 rng to probe with ti-sysc ARM: dts: Configure omap4 rng to probe with ti-sysc ARM: dts: Add missing omap5 secure clocks ARM: dts: Add missing omap4 secure clocks clk: ti: clkctrl: Fix hidden dependency to node name clk: ti: add clkctrl data dra7 sgx clk: ti: omap5: Add missing AESS clock clk: ti: dra7: fix parent for gmac_clkctrl clk: ti: dra7: add vpe clkctrl data clk: ti: dra7: add cam clkctrl data dt-bindings: clock: Move ti-dra7-atl.h to dt-bindings/clock dmaengine: ti: omap-dma: don't allow a null od->plat pointer to be dereferenced ARM: OMAP2+: Drop legacy platform data for sdma ARM: OMAP2+: Drop legacy init for sdma ... Link: https://lore.kernel.org/r/pull-1579896427-50330@atomide.com-2 Signed-off-by: Olof Johansson commit d8430df172118336d050aa61999fb82e55102641 Merge: a9eeb0e61128 c37baa06f8a9 Author: Olof Johansson Date: Sat Jan 25 13:25:41 2020 -0800 Merge tag 'omap-for-v5.6/soc-build-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/soc Randconfig build fix for recent SoC changes for v5.6 We can get build failures if let's say if only am335x SoC is selected. Let's fix this by always building secure-common. * tag 'omap-for-v5.6/soc-build-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: Fix undefined reference to omap_secure_init Link: https://lore.kernel.org/r/pull-1579896427-50330@atomide.com Signed-off-by: Olof Johansson commit 604c521259c8051b7607c000eda7938f7a705d92 Author: Andy Shevchenko Date: Thu Jan 23 15:14:37 2020 +0200 rtc: cmos: Refactor code by using the new dmi_get_bios_year() helper Refactor code by using the new dmi_get_bios_year() helper instead of open coding its functionality. This also makes logic slightly clearer. No changes intended. Cc: Hans de Goede Signed-off-by: Andy Shevchenko Tested-by: Guilherme G. Piccoli Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20200123131437.28157-3-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 5848ad2f1bcbb1bfbf3db3ee1a51fa5d0994ead6 Author: Andy Shevchenko Date: Thu Jan 23 15:14:36 2020 +0200 rtc: cmos: Use predefined value for RTC IRQ on legacy x86 When legacy devices are present on x86 machine, the RTC IRQ has a dedicated pre-defined value. Use it instead of hard coded number. Cc: Hans de Goede Signed-off-by: Andy Shevchenko Tested-by: Guilherme G. Piccoli Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20200123131437.28157-2-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit b6da197a2e9670df6f07e6698629e9ce95ab614e Author: Andy Shevchenko Date: Thu Jan 23 15:14:35 2020 +0200 rtc: cmos: Stop using shared IRQ As reported by Guilherme G. Piccoli: ---8<---8<---8<--- The rtc-cmos interrupt setting was changed in the commit 079062b28fb4 ("rtc: cmos: prevent kernel warning on IRQ flags mismatch") in order to allow shared interrupts; according to that commit's description, some machine got kernel warnings due to the interrupt line being shared between rtc-cmos and other hardware, and rtc-cmos didn't allow IRQ sharing that time. After the aforementioned commit though it was observed a huge increase in lost HPET interrupts in some systems, observed through the following kernel message: [...] hpet1: lost 35 rtc interrupts After investigation, it was narrowed down to the shared interrupts usage when having the kernel option "irqpoll" enabled. In this case, all IRQ handlers are called for non-timer interrupts, if such handlers are setup in shared IRQ lines. The rtc-cmos IRQ handler could be set to hpet_rtc_interrupt(), which will produce the kernel "lost interrupts" message after doing work - lots of readl/writel to HPET registers, which are known to be slow. Although "irqpoll" is not a default kernel option, it's used in some contexts, one being the kdump kernel (which is an already "impaired" kernel usually running with 1 CPU available), so the performance burden could be considerable. Also, the same issue would happen (in a shorter extent though) when using "irqfixup" kernel option. In a quick experiment, a virtual machine with uptime of 2 minutes produced >300 calls to hpet_rtc_interrupt() when "irqpoll" was set, whereas without sharing interrupts this number reduced to 1 interrupt. Machines with more hardware than a VM should generate even more unnecessary HPET interrupts in this scenario. ---8<---8<---8<--- After looking into the rtc-cmos driver history and DSDT table from the Microsoft Surface 3, we may notice that Hans de Goede submitted a correct fix (see dependency below). Thus, we simply revert the culprit commit. Fixes: 079062b28fb4 ("rtc: cmos: prevent kernel warning on IRQ flags mismatch") Depends-on: a1e23a42f1bd ("rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs") Reported-by: Guilherme G. Piccoli Cc: Hans de Goede Signed-off-by: Andy Shevchenko Tested-by: Guilherme G. Piccoli Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20200123131437.28157-1-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 4c4ab451ae367031884629c854eba1716d7e410f Author: Dmitry Osipenko Date: Mon Jan 6 04:56:15 2020 +0300 rtc: tps6586x: Use IRQ_NOAUTOEN flag The IRQ_NOAUTOEN flag tells interrupt core that interrupt shall not be auto-enabled at the time of requesting interrupt. This is a minor clean-up change that doesn't fix any problems. Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20200106015615.12602-1-digetx@gmail.com Signed-off-by: Alexandre Belloni commit 59d8cc6b2e375ff486b030da6703b1d481e186e6 Author: Paul E. McKenney Date: Sat Jan 25 12:00:40 2020 -0800 rcu: Forgive slow expedited grace periods at boot time Boot-time processing often loops in the kernel longer than one might prefer, which can prevent expedited grace periods from completing in a timely manner. This in turn triggers a splat In nohz_full CPUs One could argue that long-looping code should be fixed, but on the other hand, boot time is a bit special. This commit therefore removes the splat. Later commits will add the splat back in, but in a way that removes false positives. Reported-by: Borislav Petkov Signed-off-by: Paul E. McKenney commit 7f04c71f1fc2618f2aeb2d41c65e3b01ee20b3d5 Author: Dillon Brock Date: Sat Jan 18 11:25:42 2020 -0500 IB/opa_vnic: Spelling correction of 'erorr' to 'error' Correcting a minor spelling mistake in the comments. Link: https://lore.kernel.org/r/20200118162542.15188-1-dab9861@gmail.com Signed-off-by: Dillon Brock Acked-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 79ba4f9310673a8870fda5a062a558923fa65c93 Author: Nathan Chancellor Date: Thu Jan 16 15:26:58 2020 -0700 IB/hfi1: Fix logical condition in msix_request_irq Clang warns: drivers/infiniband/hw/hfi1/msix.c:136:22: warning: overlapping comparisons always evaluate to false [-Wtautological-overlap-compare] if (type < IRQ_SDMA && type >= IRQ_OTHER) ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ 1 warning generated. It is impossible for something to be less than 0 (IRQ_SDMA) and greater than or equal to 3 (IRQ_OTHER) at the same time. A logical OR should have been used to keep the same logic as before. Link: https://lore.kernel.org/r/20200116222658.5285-1-natechancellor@gmail.com Link: https://github.com/ClangBuiltLinux/linux/issues/841 Fixes: 13d2a8384bd9 ("IB/hfi1: Decouple IRQ name from type") Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Acked-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 13e0af1801f2e74639b4eadb69ed1fad2cf802f7 Author: Jason Gunthorpe Date: Thu Jan 16 13:00:37 2020 -0400 RDMA/cm: Remove CM message structs All accesses now use the new IBA acessor scheme, so delete the structs entirely and generate the structures from the schema file. Link: https://lore.kernel.org/r/20200116170037.30109-8-jgg@ziepe.ca Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 4ca662a30a3c9c8a320549f7ef3066921e36f0b4 Author: Jason Gunthorpe Date: Thu Jan 16 13:00:36 2020 -0400 RDMA/cm: Use IBA functions for complex structure members Use a Coccinelle spatch to replace CM structure members used as structures, arrays, or pointers with IBA_GET/SET versions. Applied with $ spatch --sp-file edits.sp --in-place drivers/infiniband/core/cm.c The spatch file was generated using the template pattern: @@ expression src; expression len; {struct} *msg; @@ - memcpy(msg->{old_name}, src, len) + IBA_SET_MEM({new_name}, msg, src, len) @@ {struct} *msg; identifier x; @@ - msg->{old_name}.x + IBA_GET_MEM_PTR({new_name}, msg)->x @@ {struct} *msg; @@ - &msg->{old_name} + IBA_GET_MEM_PTR({new_name}, msg) For GIDs: @@ {struct} *msg; @@ - msg->{old_name} + *IBA_GET_MEM_PTR({new_name}, msg) For non-GIDs: @@ {struct} *msg; @@ - msg->{old_name} + IBA_GET_MEM_PTR({new_name}, msg) Iterated for every remaining IBA_CHECK_OFF()/IBA_CHECK_GET() pairing. Touched up with clang-format after. Link: https://lore.kernel.org/r/20200116170037.30109-7-jgg@ziepe.ca Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 91b60a7128d96244794beb9b324eb39273872da2 Author: Jason Gunthorpe Date: Thu Jan 16 13:00:35 2020 -0400 RDMA/cm: Use IBA functions for simple structure members Use a Coccinelle spatch script to replace use of simple CM structure members with IBA_GET/SET versions. Applied with $ spatch --sp-file edits.sp --in-place drivers/infiniband/core/cm.c The spatch file was generated using the template pattern: @@ expression val; {struct} *msg; @@ - msg->{old_name} = val + IBA_SET({new_name}, msg, be{bits}_to_cpu(val)) @@ {struct} *msg; @@ - msg->{old_name} + cpu_to_be{bits}(IBA_GET({new_name}, msg)) Iterated for every IBA_CHECK_OFF that isn't a CM_FIELD_MLOC. And the below iterated over all byte sizes to remove doubled byte swaps: @@ expression val; @@ -be{bits}_to_cpu(cpu_to_be{bits}(val)) +val (and __be_to_cpu and ntoh varients) Touched up with clang-format after. Link: https://lore.kernel.org/r/20200116170037.30109-6-jgg@ziepe.ca Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 01adb7f46fe455975d9aec07966e72958bc20f8e Author: Jason Gunthorpe Date: Thu Jan 16 13:00:34 2020 -0400 RDMA/cm: Use IBA functions for swapping get/set acessors Use a Coccinelle spatch script to replace CM helper functions that return/accept BE values with IBA_GET/SET versions. Applied with $ spatch --sp-file edits.sp --in-place drivers/infiniband/core/cm.c The spatch file was generated using the template pattern: @@ expression val; {struct} *msg; @@ - {old_setter}(msg, val) + IBA_SET({new_name}, msg, be{bits}_to_cpu(val)) @@ {struct} *msg; @@ - {old_getter}(msg) + cpu_to_be{bits}(IBA_GET({new_name}, msg)) Iterated for every IBA_CHECK_GET_BE()/IBA_CHECK_SET_BE() pairing. And the below iterated over all byte sizes to remove doubled byte swaps: @@ expression val; @@ -be{bits}_to_cpu(cpu_to_be{bits}(val)) +val (and __be_to_cpu and ntoh varients) Touched up with clang-format after. Link: https://lore.kernel.org/r/20200116170037.30109-5-jgg@ziepe.ca Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit b6bbee6889300372e8d84373de0afbd980155f90 Author: Jason Gunthorpe Date: Thu Jan 16 13:00:33 2020 -0400 RDMA/cm: Use IBA functions for simple get/set acessors Use a Coccinelle spatch to replace CM helper functions with IBA_GET/SET versions. Applied with $ spatch --sp-file edits.sp --in-place drivers/infiniband/core/cm.c The spatch file was generated using the template pattern: @@ expression val; {struct} *msg; @@ - {old_setter} + IBA_SET({new_name}, msg, val) @@ {struct} *msg; @@ - {old_getter} + IBA_GET({new_name}, msg) Iterated for every IBA_CHECK_GET()/IBA_CHECK_GET() pairing. Touched up with clang-format after. Link: https://lore.kernel.org/r/20200116170037.30109-4-jgg@ziepe.ca Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit d05d4ac4c9316a2e2ea5be434a7f7a021ec44a3c Author: Leon Romanovsky Date: Thu Jan 16 13:00:32 2020 -0400 RDMA/cm: Add SET/GET implementations to hide IBA wire format There is no separation between RDMA-CM wire format as it is declared in IBTA and kernel logic which implements needed support. Such situation causes to many mistakes in conversion between big-endian (wire format) and CPU format used by kernel. It also mixes RDMA core code with combination of uXX and beXX variables. The idea that all accesses to IBA definitions will go through special GET/SET macros to ensure that no conversion mistakes are made. The shifting and masking required to read the value is automatically deduced using the field offset description from the tables in the IBA specification. This starts with the CM MADs described in IBTA release 1.3 volume 1. To confirm that the new macros behave the same as the old accessors a self-test is included in this patch. Each macro replacing a straightforward struct field compile-time tests that the new field has the same offsetof() and width as the old field. For the fields with accessor functions a runtime test, the 'all ones' value is placed in a dummy message and read back in several ways to confirm that both approaches give identical results. Later patches in this series delete the self test. This creates a tested table of new field name, old field name(s) and some meta information like BE coding for the functions which will be used in the next patches. Link: https://lore.kernel.org/r/20200116170037.30109-3-jgg@ziepe.ca Link: https://lore.kernel.org/r/20191212093830.316934-5-leon@kernel.org Signed-off-by: Leon Romanovsky Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 792a7c1f2e74bba878a1836cfbe9611f98576d3b Author: Jason Gunthorpe Date: Thu Jan 16 13:00:31 2020 -0400 RDMA/cm: Add accessors for CM_REQ transport_type Access the two fields through wrappers, like all other fields, to make it clearer what is happening. Link: https://lore.kernel.org/r/20200116170037.30109-2-jgg@ziepe.ca Tested-by: Leon Romanovsky Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 4bbd4923d1f5627b0c47a9d7dfb5cc91224cfe0c Author: Danit Goldberg Date: Thu Jan 16 14:00:48 2020 +0200 IB/mlx5: Return the administrative GUID if exists A user can change the operational GUID (a.k.a affective GUID) through link/infiniband. Therefore it is preferred to return the currently set GUID if it exists instead of the operational. This way the PF can query which VF GUID will be set in the next bind. In order to align with MAC address, zero is returned if administrative GUID is not set. For example, before setting administrative GUID: $ ip link show ib0: mtu 4092 qdisc mq state UP mode DEFAULT group default qlen 256 link/infiniband 00:00:00:08:fe:80:00:00:00:00:00:00:52:54:00:c0:fe:12:34:55 brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff vf 0 link/infiniband 00:00:00:08:fe:80:00:00:00:00:00:00:52:54:00:c0:fe:12:34:55 brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff, spoof checking off, NODE_GUID 00:00:00:00:00:00:00:00, PORT_GUID 00:00:00:00:00:00:00:00, link-state auto, trust off, query_rss off Then: $ ip link set ib0 vf 0 node_guid 11:00:af:21:cb:05:11:00 $ ip link set ib0 vf 0 port_guid 22:11:af:21:cb:05:11:00 After setting administrative GUID: $ ip link show ib0: mtu 4092 qdisc mq state UP mode DEFAULT group default qlen 256 link/infiniband 00:00:00:08:fe:80:00:00:00:00:00:00:52:54:00:c0:fe:12:34:55 brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff vf 0 link/infiniband 00:00:00:08:fe:80:00:00:00:00:00:00:52:54:00:c0:fe:12:34:55 brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff, spoof checking off, NODE_GUID 11:00:af:21:cb:05:11:00, PORT_GUID 22:11:af:21:cb:05:11:00, link-state auto, trust off, query_rss off Fixes: 9c0015ef0928 ("IB/mlx5: Implement callbacks for getting VFs GUID attributes") Link: https://lore.kernel.org/r/20200116120048.12744-1-leon@kernel.org Signed-off-by: Danit Goldberg Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 6b3712c0246ca7b2b8fa05eab2362cf267410f7e Author: Jason Gunthorpe Date: Wed Jan 15 20:20:44 2020 +0000 RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence The set of entry->driver_removed is missing locking, protect it with xa_lock() which is held by the only reader. Otherwise readers may continue to see driver_removed = false after rdma_user_mmap_entry_remove() returns and may continue to try and establish new mmaps. Fixes: 3411f9f01b76 ("RDMA/core: Create mmap database and cookie helper functions") Link: https://lore.kernel.org/r/20200115202041.GA17199@ziepe.ca Reviewed-by: Gal Pressman Acked-by: Michal Kalderon Signed-off-by: Jason Gunthorpe commit 03a575a6a1d27e4e8c954ac0e4d2a8f72b12cbfb Author: Vladimir Murzin Date: Mon Jan 20 11:42:23 2020 +0100 ARM: 8954/1: NOMMU: remove stubs for swapops Stubs for swapops are not required after 9b98fa229485 (mm: stub out all of swapops.h for !CONFIG_MMU) Signed-off-by: Vladimir Murzin Signed-off-by: Russell King commit bc420c6ceefbb86cbbc8c00061bd779c17fa6997 Author: Vincenzo Frascino Date: Fri Jan 10 13:39:26 2020 +0100 ARM: 8952/1: Disable kmemleak on XIP kernels Kmemleak relies on specific symbols to register the read only data during init (e.g. __start_ro_after_init). Trying to build an XIP kernel on arm results in the linking error reported below because when this option is selected read only data after init are not allowed since .data is read only (.rodata). arm-linux-gnueabihf-ld: mm/kmemleak.o: in function `kmemleak_init': kmemleak.c:(.init.text+0x148): undefined reference to `__end_ro_after_init' arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x14c): undefined reference to `__end_ro_after_init' arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x150): undefined reference to `__start_ro_after_init' arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x156): undefined reference to `__start_ro_after_init' arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x162): undefined reference to `__start_ro_after_init' arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x16a): undefined reference to `__start_ro_after_init' linux/Makefile:1078: recipe for target 'vmlinux' failed Fix the issue enabling kmemleak only on non XIP kernels. Signed-off-by: Vincenzo Frascino Signed-off-by: Russell King commit 76950f7162cad51d2200ebd22c620c14af38f718 Author: Vincenzo Frascino Date: Fri Jan 10 13:37:59 2020 +0100 ARM: 8951/1: Fix Kexec compilation issue. To perform the reserve_crashkernel() operation kexec uses SECTION_SIZE to find a memblock in a range. SECTION_SIZE is not defined for nommu systems. Trying to compile kexec in these conditions results in a build error: linux/arch/arm/kernel/setup.c: In function ‘reserve_crashkernel’: linux/arch/arm/kernel/setup.c:1016:25: error: ‘SECTION_SIZE’ undeclared (first use in this function); did you mean ‘SECTIONS_WIDTH’? crash_size, SECTION_SIZE); ^~~~~~~~~~~~ SECTIONS_WIDTH linux/arch/arm/kernel/setup.c:1016:25: note: each undeclared identifier is reported only once for each function it appears in linux/scripts/Makefile.build:265: recipe for target 'arch/arm/kernel/setup.o' failed Make KEXEC depend on MMU to fix the compilation issue. Signed-off-by: Vincenzo Frascino Signed-off-by: Russell King commit 31f3010e60522ede237fb145a63b4af5a41718c2 Author: Olof Johansson Date: Wed Dec 18 01:18:49 2019 +0100 ARM: 8949/1: mm: mark free_memmap as __init As of commit ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly"), free_memmap() might not always be inlined, and thus is triggering a section warning: WARNING: vmlinux.o(.text.unlikely+0x904): Section mismatch in reference from the function free_memmap() to the function .meminit.text:memblock_free() Mark it as __init, since the faller (free_unused_memmap) already is. Fixes: ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly") Signed-off-by: Olof Johansson Signed-off-by: Russell King commit 40ff1ddb5570284e039e0ff14d7a859a73dc3673 Author: Vincent Whitchurch Date: Mon Dec 16 11:48:28 2019 +0100 ARM: 8948/1: Prevent OOB access in stacktrace The stacktrace code can read beyond the stack size, when it attempts to read pt_regs from exception frames. This can happen on normal, non-corrupt stacks. Since the unwind information in the extable is not correct for function prologues, the unwinding code can return data from the stack which is not actually the caller function address, and if in_entry_text() happens to succeed on this value, we can end up reading data from outside the task's stack when attempting to read pt_regs, since there is no bounds check. Example: [<8010e729>] (unwind_backtrace) from [<8010a9c9>] (show_stack+0x11/0x14) [<8010a9c9>] (show_stack) from [<8057d8d7>] (dump_stack+0x87/0xac) [<8057d8d7>] (dump_stack) from [<8012271d>] (tasklet_action_common.constprop.4+0xa5/0xa8) [<8012271d>] (tasklet_action_common.constprop.4) from [<80102333>] (__do_softirq+0x11b/0x31c) [<80102333>] (__do_softirq) from [<80122485>] (irq_exit+0xad/0xd8) [<80122485>] (irq_exit) from [<8015f3d7>] (__handle_domain_irq+0x47/0x84) [<8015f3d7>] (__handle_domain_irq) from [<8036a523>] (gic_handle_irq+0x43/0x78) [<8036a523>] (gic_handle_irq) from [<80101a49>] (__irq_svc+0x69/0xb4) Exception stack(0xeb491f58 to 0xeb491fa0) 1f40: 7eb14794 00000000 1f60: ffffffff 008dd32c 008dd324 ffffffff 008dd314 0000002a 801011e4 eb490000 1f80: 0000002a 7eb1478c 50c5387d eb491fa8 80101001 8023d09c 40080033 ffffffff [<80101a49>] (__irq_svc) from [<8023d09c>] (do_pipe2+0x0/0xac) [<8023d09c>] (do_pipe2) from [] (0xffffffff) Exception stack(0xeb491fc8 to 0xeb492010) 1fc0: 008dd314 0000002a 00511ad8 008de4c8 7eb14790 7eb1478c 1fe0: 00511e34 7eb14774 004c8557 76f44098 60080030 7eb14794 00000000 00000000 2000: 00000001 00000000 ea846c00 ea847cc0 In this example, the stack limit is 0xeb492000, but 16 bytes outside the stack have been read. Fix it by adding bounds checks. Signed-off-by: Vincent Whitchurch Signed-off-by: Russell King commit 9db78852739e9f4335d1f2350c01a6b5e2998507 Author: Masahiro Yamada Date: Wed Dec 4 05:28:12 2019 +0100 ARM: 8945/1: decompressor: use CONFIG option instead of cc-option The Kconfig stage (arch/Kconfig) has already evaluated whether the compiler supports -fno-stack-protector. You can use CONFIG_CC_HAS_STACKPROTECTOR_NONE instead of invoking the compiler to check the flag here. Signed-off-by: Masahiro Yamada Signed-off-by: Russell King commit cf17a1e3aa1ad33d375d71a1c30356b86b2683ef Author: Ard Biesheuvel Date: Fri Nov 22 13:01:17 2019 +0100 ARM: 8942/1: Revert "8857/1: efi: enable CP15 DMB instructions before cleaning the cache" This reverts commit e17b1af96b2afc38e684aa2f1033387e2ed10029, which is no longer necessary now that the v7 specific routines take care not to issue CP15 barrier instructions before they are enabled in SCTLR. Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King commit 8239fc7755fd3d410920006615abd0c7d653560f Author: Ard Biesheuvel Date: Fri Nov 22 12:59:00 2019 +0100 ARM: 8941/1: decompressor: enable CP15 barrier instructions in v7 cache setup code Commit e17b1af96b2afc38e684aa2f1033387e2ed10029 "ARM: 8857/1: efi: enable CP15 DMB instructions before cleaning the cache" added some explicit handling of the CP15BEN bit in the SCTLR system register, to ensure that CP15 barrier instructions are enabled, even if we enter the decompressor via the EFI stub. However, as it turns out, there are other ways in which we may end up using CP15 barrier instructions without them being enabled. I.e., when the decompressor startup code skips the cache_on() initially, we end up calling cache_clean_flush() with the caches and MMU off, in which case the CP15BEN bit in SCTLR may not be programmed either. And in fact, cache_on() itself issues CP15 barrier instructions before actually enabling them by programming the new SCTLR value (and issuing an ISB) Since these routines are shared between v7 CPUs and older ones that implement the CPUID extension as well, using the ordinary v7 barrier instructions in this code is not possible, and so we should enable the CP15 ones explicitly before issuing them. Note that a v7 ISB is still required between programming the SCTLR register and using the CP15 barrier instructions, and we should take care to branch over it if the CP15BEN bit is already set, given that in that case, the CPU may not support it. Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King commit 4cb760b02419061209b9b4cc2557986a6bf93e73 Author: Richard Henderson Date: Fri Jan 10 14:54:22 2020 +0000 s390x: Mark archrandom.h functions __must_check We must not use the pointer output without validating the success of the random read. Reviewed-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-11-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 8dae77ac56fec1e085fca3ecea49abda1b4b73d2 Author: Richard Henderson Date: Fri Jan 10 14:54:21 2020 +0000 powerpc: Mark archrandom.h functions __must_check We must not use the pointer output without validating the success of the random read. Acked-by: Michael Ellerman Reviewed-by: Ard Biesheuvel Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-10-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 98dcfce69729f9ce0fb14f96a39bbdba21429597 Author: Richard Henderson Date: Fri Jan 10 14:54:20 2020 +0000 powerpc: Use bool in archrandom.h The generic interface uses bool not int; match that. Reviewed-by: Ard Biesheuvel Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-9-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 1640a7b9f48293ef548596bdba4a461a89ceec6e Author: Richard Henderson Date: Fri Jan 10 14:54:19 2020 +0000 x86: Mark archrandom.h functions __must_check We must not use the pointer output without validating the success of the random read. Reviewed-by: Ard Biesheuvel Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-8-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 904caa6413c87aacbf7d0682da617c39ca18cf1a Author: Richard Henderson Date: Fri Jan 10 14:54:18 2020 +0000 linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check We must not use the pointer output without validating the success of the random read. Reviewed-by: Ard Biesheuvel Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-7-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 66f5ae899ada79c0e9a3d8d954f93a72344cd350 Author: Richard Henderson Date: Fri Jan 10 14:54:17 2020 +0000 linux/random.h: Use false with bool Keep the generic fallback versions in sync with the other architecture specific implementations and use the proper name for false. Suggested-by: Ard Biesheuvel Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-6-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 647f50d5d9d933b644b29c54f13ac52af1b1774d Author: Richard Henderson Date: Fri Jan 10 14:54:16 2020 +0000 linux/random.h: Remove arch_has_random, arch_has_random_seed The arm64 version of archrandom.h will need to be able to test for support and read the random number without preemption, so a separate query predicate is not practical. Since this part of the generic interface is unused, remove it. Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-5-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 5e054c820f59bbb9714d5767f5f476581c309ca8 Author: Richard Henderson Date: Fri Jan 10 14:54:15 2020 +0000 s390: Remove arch_has_random, arch_has_random_seed These symbols are currently part of the generic archrandom.h interface, but are currently unused and can be removed. Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-4-broonie@kernel.org Signed-off-by: Theodore Ts'o commit cbac004995a0ce8453bdc555fab579e2bdb842a6 Author: Richard Henderson Date: Fri Jan 10 14:54:14 2020 +0000 powerpc: Remove arch_has_random, arch_has_random_seed These symbols are currently part of the generic archrandom.h interface, but are currently unused and can be removed. Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-3-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 5f2ed7f5b99b54389b74e53309677831ac9cb9d7 Author: Richard Henderson Date: Fri Jan 10 14:54:13 2020 +0000 x86: Remove arch_has_random, arch_has_random_seed Use the expansion of these macros directly in arch_get_random_*. These symbols are currently part of the generic archrandom.h interface, but are currently unused and can be removed. Signed-off-by: Richard Henderson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20200110145422.49141-2-broonie@kernel.org Signed-off-by: Theodore Ts'o commit 587065dcac64e88132803cdb0a7f26bb4a79cf46 Author: Dan Carpenter Date: Fri Jan 24 13:15:37 2020 +0300 fs/adfs: bigdir: Fix an error code in adfs_fplus_read() This code accidentally returns success, but it should return the -EIO error code from adfs_fplus_validate_header(). Acked-by: Russell King Fixes: d79288b4f61b ("fs/adfs: bigdir: calculate and validate directory checkbyte") Signed-off-by: Dan Carpenter Signed-off-by: Al Viro commit 24589e3a20876dc07c62f45c8f8f8266dd39ba38 Author: Steven Rostedt (VMware) Date: Sat Jan 25 10:52:30 2020 -0500 tracing: Use pr_err() instead of WARN() for memory failures As warnings can trigger panics, especially when "panic_on_warn" is set, memory failure warnings can cause panics and fail fuzz testers that are stressing memory. Create a MEM_FAIL() macro to use instead of WARN() in the tracing code (perhaps this should be a kernel wide macro?), and use that for memory failure issues. This should stop failing fuzz tests due to warnings. Link: https://lore.kernel.org/r/CACT4Y+ZP-7np20GVRu3p+eZys9GPtbu+JpfV+HtsufAzvTgJrg@mail.gmail.com Suggested-by: Dmitry Vyukov Signed-off-by: Steven Rostedt (VMware) commit e9f02a8027675e3957d463d7f8422d79fa90f2ba Merge: 35b9211c0a24 d633d57902a5 Author: Alexei Starovoitov Date: Sat Jan 25 07:12:41 2020 -0800 Merge branch 'trampoline-fixes' Jiri Olsa says: ==================== hi, sending 2 fixes to fix kernel support for loading trampoline programs in bcc/bpftrace and allow to unwind through trampoline/dispatcher. Original rfc post [1]. Speedup output of perf bench while running klockstat.py on kprobes vs trampolines: Without: $ perf bench sched messaging -l 50000 ... Total time: 18.571 [sec] With current kprobe tracing: $ perf bench sched messaging -l 50000 ... Total time: 183.395 [sec] With kfunc tracing: $ perf bench sched messaging -l 50000 ... Total time: 39.773 [sec] v4 changes: - rebased on latest bpf-next/master - removed image tree mutex and use trampoline_mutex instead - checking directly for string pointer in patch 1 [Alexei] - skipped helpers patches, as they are no longer needed [Alexei] v3 changes: - added ack from John Fastabend for patch 1 - move out is_bpf_image_address from is_bpf_text_address call [David] v2 changes: - make the unwind work for dispatcher as well - added test for allowed trampolines count - used raw tp pt_regs nest-arrays for trampoline helpers thanks, jirka [1] https://lore.kernel.org/netdev/20191229143740.29143-1-jolsa@kernel.org/ ==================== Signed-off-by: Alexei Starovoitov commit d633d57902a510debd4ec5b7a374a009c8c2d620 Author: Jiri Olsa Date: Thu Jan 23 17:15:08 2020 +0100 selftest/bpf: Add test for allowed trampolines count There's limit of 40 programs tht can be attached to trampoline for one function. Adding test that tries to attach that many plus one extra that needs to fail. Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200123161508.915203-4-jolsa@kernel.org commit e9b4e606c2289d6610113253922bb8c9ac7f68b0 Author: Jiri Olsa Date: Thu Jan 23 17:15:07 2020 +0100 bpf: Allow to resolve bpf trampoline and dispatcher in unwind When unwinding the stack we need to identify each address to successfully continue. Adding latch tree to keep trampolines for quick lookup during the unwind. The patch uses first 48 bytes for latch tree node, leaving 4048 bytes from the rest of the page for trampoline or dispatcher generated code. It's still enough not to affect trampoline and dispatcher progs maximum counts. Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200123161508.915203-3-jolsa@kernel.org commit 84ad7a7ab69f112c0c4b878c9be91b950a1fb1f8 Author: Jiri Olsa Date: Thu Jan 23 17:15:06 2020 +0100 bpf: Allow BTF ctx access for string pointers When accessing the context we allow access to arguments with scalar type and pointer to struct. But we deny access for pointer to scalar type, which is the case for many functions. Alexei suggested to take conservative approach and allow currently only string pointer access, which is the case for most functions now: Adding check if the pointer is to string type and allow access to it. Suggested-by: Alexei Starovoitov Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200123161508.915203-2-jolsa@kernel.org commit 18f81241b74fb49d576c83fbbab9a0b6e3bb20d4 Author: Marcel Holtmann Date: Sat Jan 25 09:19:51 2020 +0100 Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le The debugfs entries for {min,max}_key_size are created during SMP registration and thus it might lead to multiple attempts to create the same entries. Avoid this by moving them to the LE controller init section. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg commit cc974003615afa044fa62c7520ae690091fa684a Author: Marcel Holtmann Date: Sat Jan 25 09:23:47 2020 +0100 Bluetooth: Add missing checks for HCI_ISODATA_PKT packet type The checks for HCI_ISODATA_PKT packet type are required in a few additional locations to allow sending/receiving of this new packet type. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg commit 414f50434aa2463202a5b35e844f4125dd1a7101 Author: Oliver O'Halloran Date: Wed Jan 22 14:11:25 2020 +1100 selftests/eeh: Bump EEH wait time to 60s Some newer cards supported by aacraid can take up to 40s to recover after an EEH event. This causes spurious failures in the basic EEH self-test since the current maximim timeout is only 30s. Fix the immediate issue by bumping the timeout to a default of 60s, and allow the wait time to be specified via an environmental variable (EEH_MAX_WAIT). Reported-by: Steve Best Suggested-by: Douglas Miller Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200122031125.25991-1-oohall@gmail.com commit f1dbc1c5c70d0d4c60b5d467ba941fba167c12f6 Author: Michael Bringmann Date: Wed Jan 15 08:53:59 2020 -0600 powerpc/pseries/lparcfg: Fix display of Maximum Memory Correct overflow problem in calculation and display of Maximum Memory value to syscfg. Signed-off-by: Michael Bringmann [mpe: Only n_lmbs needs casting to unsigned long] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/5577aef8-1d5a-ca95-ff0a-9c7b5977e5bf@linux.ibm.com commit 736bcdd3a9fc672af33fb83230ecd0570ec38ec6 Author: Jordan Niethe Date: Fri Dec 6 14:17:22 2019 +1100 powerpc/mm: Remove kvm radix prefetch workaround for Power9 DD2.2 Commit a25bd72badfa ("powerpc/mm/radix: Workaround prefetch issue with KVM") introduced a number of workarounds as coming out of a guest with the mmu enabled would make the cpu would start running in hypervisor state with the PID value from the guest. The cpu will then start prefetching for the hypervisor with that PID value. In Power9 DD2.2 the cpu behaviour was modified to fix this. When accessing Quadrant 0 in hypervisor mode with LPID != 0 prefetching will not be performed. This means that we can get rid of the workarounds for Power9 DD2.2 and later revisions. Add a new cpu feature CPU_FTR_P9_RADIX_PREFETCH_BUG to indicate if the workarounds are needed. Signed-off-by: Jordan Niethe Acked-by: Paul Mackerras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191206031722.25781-1-jniethe5@gmail.com commit 5649607a8d0b0e019a4db14aab3de1e16c3a2b4f Author: Vaibhav Jain Date: Wed Jan 22 21:21:40 2020 +0530 powerpc/papr_scm: Fix leaking 'bus_desc.provider_name' in some paths String 'bus_desc.provider_name' allocated inside papr_scm_nvdimm_init() will leaks in case call to nvdimm_bus_register() fails or when papr_scm_remove() is called. This minor patch ensures that 'bus_desc.provider_name' is freed in error path for nvdimm_bus_register() as well as in papr_scm_remove(). Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Vaibhav Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200122155140.120429-1-vaibhav@linux.ibm.com commit 493a55f1e7724dee5e71bc726d5b819292094587 Author: Sukadev Bhattiprolu Date: Wed Jan 22 18:57:18 2020 -0600 powerpc/xmon: Fix compile error in print_insn* functions Fix couple of compile errors I stumbled upon with CONFIG_XMON=y and CONFIG_XMON_DISASSEMBLY=n Signed-off-by: Sukadev Bhattiprolu Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200123010455.GA15080@us.ibm.com commit def0bfdbd6039e96a9eb2baaa4470b079daab0d4 Author: Christophe Leroy Date: Thu Jan 23 17:30:47 2020 +0000 powerpc: use probe_user_read() and probe_user_write() Instead of opencoding, use probe_user_read() to failessly read a user location and probe_user_write() for writing to user. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/e041f5eedb23f09ab553be8a91c3de2087147320.1579800517.git.christophe.leroy@c-s.fr commit 1e3531982ee70adf1880715a968d9c3365f321ed Author: Chen Zhou Date: Tue Jan 21 09:31:53 2020 +0800 powerpc/maple: Fix comparing pointer to 0 Fixes coccicheck warning: arch/powerpc/platforms/maple/setup.c:232:15-16: WARNING comparing pointer to 0 Compare pointer-typed values to NULL rather than 0. Signed-off-by: Chen Zhou Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200121013153.9937-1-chenzhou10@huawei.com commit aff8c8242bc638ba57247ae1ec5f272ac3ed3b92 Author: Tyrel Datwyler Date: Mon Jan 20 14:10:02 2020 -0800 powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning Commit e5afdf9dd515 ("powerpc/vfio_spapr_tce: Add reference counting to iommu_table") missed an iommu_table allocation in the pseries vio code. The iommu_table is allocated with kzalloc and as a result the associated kref gets a value of zero. This has the side effect that during a DLPAR remove of the associated virtual IOA the iommu_tce_table_put() triggers a use-after-free underflow warning. Call Trace: [c0000002879e39f0] [c00000000071ecb4] refcount_warn_saturate+0x184/0x190 (unreliable) [c0000002879e3a50] [c0000000000500ac] iommu_tce_table_put+0x9c/0xb0 [c0000002879e3a70] [c0000000000f54e4] vio_dev_release+0x34/0x70 [c0000002879e3aa0] [c00000000087cfa4] device_release+0x54/0xf0 [c0000002879e3b10] [c000000000d64c84] kobject_cleanup+0xa4/0x240 [c0000002879e3b90] [c00000000087d358] put_device+0x28/0x40 [c0000002879e3bb0] [c0000000007a328c] dlpar_remove_slot+0x15c/0x250 [c0000002879e3c50] [c0000000007a348c] remove_slot_store+0xac/0xf0 [c0000002879e3cd0] [c000000000d64220] kobj_attr_store+0x30/0x60 [c0000002879e3cf0] [c0000000004ff13c] sysfs_kf_write+0x6c/0xa0 [c0000002879e3d10] [c0000000004fde4c] kernfs_fop_write+0x18c/0x260 [c0000002879e3d60] [c000000000410f3c] __vfs_write+0x3c/0x70 [c0000002879e3d80] [c000000000415408] vfs_write+0xc8/0x250 [c0000002879e3dd0] [c0000000004157dc] ksys_write+0x7c/0x120 [c0000002879e3e20] [c00000000000b278] system_call+0x5c/0x68 Further, since the refcount was always zero the iommu_tce_table_put() fails to call the iommu_table release function resulting in a leak. Fix this issue be initilizing the iommu_table kref immediately after allocation. Fixes: e5afdf9dd515 ("powerpc/vfio_spapr_tce: Add reference counting to iommu_table") Signed-off-by: Tyrel Datwyler Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1579558202-26052-1-git-send-email-tyreld@linux.ibm.com commit 7e6f8cbc5e10cf7601c762db267b795273d53078 Author: Aneesh Kumar K.V Date: Wed Jan 8 12:16:47 2020 +0530 powerpc/papr_scm: Don't enable direct map for a region by default Setting ND_REGION_PAGEMAP flag implies namespace mode defaults to fsdax mode. This also means kernel ends up creating struct page backing for these namspace ranges. With large namespaces that is not the right thing to do. We should let the user select the mode he/she wants the namespace to be created with. Hence disable ND_REGION_PAGEMAP for papr_scm regions. We still keep the flag for of_pmem because it supports only small persistent memory regions. This is similar to what is done for x86 with commit commit: 004f1afbe199 ("libnvdimm, pmem: direct map legacy pmem by default") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200108064647.169637-1-aneesh.kumar@linux.ibm.com commit 3c749b81ee99ef1a01d342ee5e4bc01e4332eb75 Author: Borislav Petkov Date: Thu Jan 23 17:54:33 2020 +0100 x86/CPU/AMD: Remove amd_get_topology_early() ... and fold its function body into its single call site. No functional changes: # arch/x86/kernel/cpu/amd.o: text data bss dec hex filename 5994 385 1 6380 18ec amd.o.before 5994 385 1 6380 18ec amd.o.after md5: 99ec6daa095b502297884e949c520f90 amd.o.before.asm 99ec6daa095b502297884e949c520f90 amd.o.after.asm Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20200123165811.5288-1-bp@alien8.de commit 3333e50b64fe30b7e53cf02456a2f567f689ae4f Merge: 2f64ab27c838 e814c58d454d Author: David S. Miller Date: Sat Jan 25 10:56:31 2020 +0100 Merge branch 'mlxsw-Offload-TBF' Ido Schimmel says: ==================== mlxsw: Offload TBF Petr says: In order to allow configuration of shapers on Spectrum family of machines, recognize TBF either as root Qdisc, or as a child of ETS or PRIO. Configure rate of maximum shaper according to TBF rate setting, and maximum shaper burst size according to TBF burst setting. - Patches #1 and #2 make the TBF shaper suitable for offloading. - Patches #3, #4 and #5 are refactoring aimed at easier support of leaf Qdiscs in general. - Patches #6 to #10 gradually introduce TBF offload. - Patches #11 to #14 add selftests. ==================== Signed-off-by: David S. Miller commit e814c58d454d952778fbb70bd0e71564f8c49f28 Author: Petr Machata Date: Fri Jan 24 15:23:18 2020 +0200 selftests: mlxsw: Add a TBF selftest Add a test that runs traffic across a port throttled with TBF. The test checks that the observed throughput is within +-5% from the installed shaper. To allow checking both the software datapath and the offloaded one, make the test suitable for inclusion from driver-specific wrapper. Introduce such wrappers for mlxsw. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit c143139b7fd36cb66afb4423ac14a1efd8a45609 Author: Petr Machata Date: Fri Jan 24 15:23:17 2020 +0200 selftests: forwarding: lib: Allow reading TC rule byte counters The function tc_rule_stats_get() fetches a packet counter of a given TC rule. Extend it to support byte counters as well by adding an optional argument with selector. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 4121d9479b24c20ff7d3e7b62a7cf330fae7b2af Author: Petr Machata Date: Fri Jan 24 15:23:16 2020 +0200 selftests: forwarding: lib: Add helpers for busywaiting The function busywait() is handy as a safety-latched variant of a while loop. Many selftests deal specifically with counter values, and busywaiting on them is likely to be rather common (it is not quite common now, but busywait() has not been around for very long). To facilitate expressing simply what is tested, introduce two helpers: - until_counter_is(), which can be used as a predicate passed to busywait(), which holds when expression, which is itself passed as an argument to until_counter_is(), reaches a desired value. - busywait_for_counter(), which is useful for waiting until a given counter changes "by" (as opposed to "to") a certain amount. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit adc6c7ec11293117ec2763ccbe17d58349e011cf Author: Petr Machata Date: Fri Jan 24 15:23:15 2020 +0200 selftests: Move two functions from mlxsw's qos_lib to lib The function humanize() is used for converting value in bits/s to a human-friendly approximate value in Kbps, Mbps or Gbps. There is nothing hardware-specific in that, so move the function to lib.sh. Similarly for the rate() function, which just does a bit of math to calculate a rate, given two counter values and a time interval. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit a44f58c41bfbb921c1c4586bed9ad26aa2c6208a Author: Petr Machata Date: Fri Jan 24 15:23:14 2020 +0200 mlxsw: spectrum_qdisc: Support offloading of TBF Qdisc React to the TC messages that were introduced in a preceding patch and configure egress maximum shaper as appropriate. TBF can be used as a root qdisc or under one of PRIO or strict ETS bands. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit dbacf8ba5860e79d5191b0868bffa9e351d205e4 Author: Petr Machata Date: Fri Jan 24 15:23:13 2020 +0200 mlxsw: spectrum: Configure shaper rate and burst size together In order to allow configuration of burst size together with shaper rate, extend mlxsw_sp_port_ets_maxrate_set() with a burst_size argument. Convert call sites to pass 0 (for default). Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 47259544e0fc0659f74f6ca6680745658969a803 Author: Petr Machata Date: Fri Jan 24 15:23:12 2020 +0200 mlxsw: spectrum: Add lowest_shaper_bs to struct mlxsw_sp Lower limit of burst size configuration is dependent on system type. Add a datum to track the value. Initialize as appropriate in mlxsw_spX_init(). Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 92afbfedb77d59a4077d292b88a316f3de706344 Author: Petr Machata Date: Fri Jan 24 15:23:11 2020 +0200 mlxsw: reg: Increase MLXSW_REG_QEEC_MAS_DIS As the port speeds grow, the current value of "unlimited shaper", 200000000Kbps, might become lower than the actually supported speeds. Bump it to the maximum value that fits in the corresponding QEEC field, which is about 2.1Tbps. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 23effa2479bae2fbea69493afaab9914ee3862ca Author: Petr Machata Date: Fri Jan 24 15:23:10 2020 +0200 mlxsw: reg: Add max_shaper_bs to QoS ETS Element Configuration The QEEC register configures scheduling elements. One of the bits of configuration is the burst size to use for the shaper installed on the element. Add the necessary fields to support this configuration. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit be1d5a8a7728cc734fc31b837796e7addc4ba832 Author: Petr Machata Date: Fri Jan 24 15:23:09 2020 +0200 mlxsw: spectrum_qdisc: Extract a common leaf unoffload function When the RED Qdisc is unoffloaded, it needs to reduce the reported backlog by the amount that is in the HW, so that only the SW backlog is contained in the counter. The same thing will need to be done by TBF, and likely any other leaf Qdisc as well. Extract a helper mlxsw_sp_qdisc_leaf_unoffload() and call it from mlxsw_sp_qdisc_red_unoffload(). Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 3d0d592193dce954bf5ccac5128080830dd8e982 Author: Petr Machata Date: Fri Jan 24 15:23:08 2020 +0200 mlxsw: spectrum_qdisc: Add mlxsw_sp_qdisc_get_class_stats() Add a wrapper around mlxsw_sp_qdisc_collect_tc_stats() and mlxsw_sp_qdisc_update_stats() for the simple case of doing both in one go: mlxsw_sp_qdisc_get_class_stats(). Dispatch to that function from mlxsw_sp_qdisc_get_red_stats(). This new function will be useful for other leaf Qdiscs as well. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit cf9af379cd672d6873ae97ec416148708c6575e9 Author: Petr Machata Date: Fri Jan 24 15:23:07 2020 +0200 mlxsw: spectrum_qdisc: Extract a per-TC stat function Extract from mlxsw_sp_qdisc_get_prio_stats() two new functions: mlxsw_sp_qdisc_collect_tc_stats() to accumulate stats for that one TC only, and mlxsw_sp_qdisc_update_stats() that makes the stats relative to base values stored earlier. Use them from mlxsw_sp_qdisc_get_red_stats(). Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit ef6aadcc76c97e25f62adc4e9d19684d3e5d0b87 Author: Petr Machata Date: Fri Jan 24 15:23:06 2020 +0200 net: sched: Make TBF Qdisc offloadable Invoke ndo_setup_tc as appropriate to signal init / replacement, destroying and dumping of TBF Qdisc. Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit c2070152747ebc294f018e4b28bf2d9f719a6b36 Author: Petr Machata Date: Fri Jan 24 15:23:05 2020 +0200 net: sched: sch_tbf: Don't overwrite backlog before dumping In 2011, in commit b0460e4484f9 ("sch_tbf: report backlog information"), TBF started copying backlog depth from the child Qdisc before dumping, with the motivation that the backlog was otherwise not visible in "tc -s qdisc show". Later, in 2016, in commit 8d5958f424b6 ("sch_tbf: update backlog as well"), TBF got a full-blown backlog tracking. However it kept copying the child's backlog over before dumping. That line is now unnecessary, so remove it. As shown in the following example, backlog is still reported correctly: # tc -s qdisc show dev veth0 invisible qdisc tbf 1: root refcnt 2 rate 1Mbit burst 128Kb lat 82.8s Sent 505475370 bytes 406985 pkt (dropped 0, overlimits 812544 requeues 0) backlog 81972b 66p requeues 0 qdisc bfifo 0: parent 1:1 limit 10Mb Sent 505475370 bytes 406985 pkt (dropped 0, overlimits 0 requeues 0) backlog 81972b 66p requeues 0 Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 2f64ab27c838c012b17ac162726e2303cb3e80dd Merge: 6ec8b6cd79a4 12fa74383ed4 Author: David S. Miller Date: Sat Jan 25 10:43:19 2020 +0100 Merge branch 'hv_netvsc-Add-XDP-support' Haiyang Zhang says: ==================== hv_netvsc: Add XDP support Add XDP support and update related document. ==================== Signed-off-by: David S. Miller commit 12fa74383ed4d1ffa283f77c1e7fe038e8182405 Author: Haiyang Zhang Date: Thu Jan 23 13:52:35 2020 -0800 hv_netvsc: Update document for XDP support Added the new section in the document regarding XDP support by hv_netvsc driver. Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit 351e1581395fcc7fb952bbd7dda01238f69968fd Author: Haiyang Zhang Date: Thu Jan 23 13:52:34 2020 -0800 hv_netvsc: Add XDP support This patch adds support of XDP in native mode for hv_netvsc driver, and transparently sets the XDP program on the associated VF NIC as well. Setting / unsetting XDP program on synthetic NIC (netvsc) propagates to VF NIC automatically. Setting / unsetting XDP program on VF NIC directly is not recommended, also not propagated to synthetic NIC, and may be overwritten by setting of synthetic NIC. The Azure/Hyper-V synthetic NIC receive buffer doesn't provide headroom for XDP. We thought about re-use the RNDIS header space, but it's too small. So we decided to copy the packets to a page buffer for XDP. And, most of our VMs on Azure have Accelerated Network (SRIOV) enabled, so most of the packets run on VF NIC. The synthetic NIC is considered as a fallback data-path. So the data copy on netvsc won't impact performance significantly. XDP program cannot run with LRO (RSC) enabled, so you need to disable LRO before running XDP: ethtool -K eth0 lro off XDP actions not yet supported: XDP_REDIRECT Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit 6ec8b6cd79a4360e375da99d848d63f8d4fb08b3 Author: Moshe Shemesh Date: Thu Jan 23 19:57:13 2020 +0200 devlink: Add health recover notifications on devlink flows Devlink health recover notifications were added only on driver direct updates of health_state through devlink_health_reporter_state_update(). Add notifications on updates of health_state by devlink flows of report and recover. Moved functions devlink_nl_health_reporter_fill() and devlink_recover_notify() to avoid forward declaration. Fixes: 97ff3bd37fac ("devlink: add devink notification when reporter update health state") Signed-off-by: Moshe Shemesh Signed-off-by: David S. Miller commit 53c677009581ac5dbe46c4cf667e408ebfe3049a Author: Andy Shevchenko Date: Thu Jan 23 16:27:29 2020 +0200 net: fddi: skfp: Use print_hex_dump() helper Use the print_hex_dump() helper, instead of open-coding the same operations. Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller commit 79ac522402fca97deef3e07be9600bfab20d47a8 Author: Andy Shevchenko Date: Thu Jan 23 16:20:02 2020 +0200 net: atm: use %*ph to print small buffer Use %*ph format to print small buffer as hex string. Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller commit ac6119e7f25b842fc061e8aec88c4f32d3bc28ef Author: Ard Biesheuvel Date: Tue Jan 21 10:39:12 2020 +0100 efi/x86: Disable instrumentation in the EFI runtime handling code We already disable KASAN instrumentation specifically for the EFI routines that are known to dereference memory addresses that KASAN does not know about, avoiding false positive KASAN splats. However, as it turns out, having GCOV or KASAN instrumentation enabled interferes with the compiler's ability to optimize away function calls that are guarded by IS_ENABLED() checks that should have resulted in those references to have been const-propagated out of existence. But with instrumenation enabled, we may get build errors like: ld: arch/x86/platform/efi/efi_64.o: in function `efi_thunk_set_virtual_address_map': ld: arch/x86/platform/efi/efi_64.o: in function `efi_set_virtual_address_map': in builds where CONFIG_EFI=y but CONFIG_EFI_MIXED or CONFIG_X86_UV are not defined, even though the invocations are conditional on IS_ENABLED() checks against the respective Kconfig symbols. So let's disable instrumentation entirely for this subdirectory, which isn't that useful here to begin with. Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: linux-efi@vger.kernel.org commit cada0b6dbb8c07ab353d209437243bec8cc7c64a Author: Qian Cai Date: Wed Jan 22 14:14:30 2020 -0500 efi/libstub/x86: Fix EFI server boot failure x86_64 EFI systems are unable to boot due to a typo in a recent commit: EFI config tables not found. -- System halted This was probably due to the absense of CONFIG_EFI_MIXED=y in testing. Fixes: 796eb8d26a57 ("efi/libstub/x86: Use const attribute for efi_is_64bit()") Signed-off-by: Qian Cai Acked-by: Ard Biesheuvel Signed-off-by: Ingo Molnar Cc: tglx@linutronix.de Cc: linux-efi@vger.kernel.org Link: https://lore.kernel.org/r/20200122191430.4888-1-cai@lca.pw commit f8a4bb6bfa639fbdd07aede615be6dffe86a9713 Merge: 4703d9119972 0e247386d9ed Author: Ingo Molnar Date: Sat Jan 25 10:05:23 2020 +0100 Merge branch 'for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu Pull RCU updates from Paul E. McKenney: - Expedited grace-period updates - kfree_rcu() updates - RCU list updates - Preemptible RCU updates - Torture-test updates - Miscellaneous fixes - Documentation updates Signed-off-by: Ingo Molnar commit 7f6225e446cc8dfa4c3c7959a4de3dd03ec277bf Author: zhangyi (F) Date: Wed Dec 4 20:46:14 2019 +0800 jbd2: clean __jbd2_journal_abort_hard() and __journal_abort_soft() __jbd2_journal_abort_hard() is no longer used, so now we can merge __jbd2_journal_abort_hard() and __journal_abort_soft() these two functions into jbd2_journal_abort() and remove them. Signed-off-by: zhangyi (F) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20191204124614.45424-5-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 0e98c084a21177ef136149c6a293b3d1eb33ff92 Author: zhangyi (F) Date: Wed Dec 4 20:46:13 2019 +0800 jbd2: make sure ESHUTDOWN to be recorded in the journal superblock Commit fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer") want to allow jbd2 layer to distinguish shutdown journal abort from other error cases. So the ESHUTDOWN should be taken precedence over any other errno which has already been recoded after EXT4_FLAGS_SHUTDOWN is set, but it only update errno in the journal suoerblock now if the old errno is 0. Fixes: fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer") Signed-off-by: zhangyi (F) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20191204124614.45424-4-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 51f57b01e4a3c7d7bdceffd84de35144e8c538e7 Author: zhangyi (F) Date: Wed Dec 4 20:46:12 2019 +0800 ext4, jbd2: ensure panic when aborting with zero errno JBD2_REC_ERR flag used to indicate the errno has been updated when jbd2 aborted, and then __ext4_abort() and ext4_handle_error() can invoke panic if ERRORS_PANIC is specified. But if the journal has been aborted with zero errno, jbd2_journal_abort() didn't set this flag so we can no longer panic. Fix this by always record the proper errno in the journal superblock. Fixes: 4327ba52afd03 ("ext4, jbd2: ensure entering into panic after recording an error in superblock") Signed-off-by: zhangyi (F) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20191204124614.45424-3-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit d0a186e0d3e7ac05cc77da7c157dae5aa59f95d9 Author: zhangyi (F) Date: Wed Dec 4 20:46:11 2019 +0800 jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record We invoke jbd2_journal_abort() to abort the journal and record errno in the jbd2 superblock when committing journal transaction besides the failure on submitting the commit record. But there is no need for the case and we can also invoke jbd2_journal_abort() instead of __jbd2_journal_abort_hard(). Fixes: 818d276ceb83a ("ext4: Add the journal checksum feature") Signed-off-by: zhangyi (F) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20191204124614.45424-2-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 1a8e9cf40c9a6a2e40b1e924b13ed303aeea4418 Author: Vasily Averin Date: Thu Jan 23 12:05:10 2020 +0300 jbd2_seq_info_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. Script below generates endless output $ q=;while read -r r;do echo "$((++q)) $r";done Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/d13805e5-695e-8ac3-b678-26ca2313629f@virtuozzo.com Signed-off-by: Theodore Ts'o commit 17c51d836c19ecc58714fc671a914a47b6ae4db7 Author: Shijie Luo Date: Thu Jan 23 02:00:54 2020 -0500 jbd2: remove pointless assertion in __journal_remove_journal_head Only when jh->b_jcount = 0 in jbd2_journal_put_journal_head, we are allowed to call __journal_remove_journal_head. This assertion is meaningless, just remove it. Signed-off-by: Shijie Luo Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20200123070054.50585-1-luoshijie1@huawei.com Signed-off-by: Theodore Ts'o commit 8d6ce136790268fba2fc66cb8d6fa2161d4b2385 Author: Shijie Luo Date: Thu Jan 23 01:43:25 2020 -0500 ext4,jbd2: fix comment and code style Fix comment and remove unneccessary blank. Signed-off-by: Shijie Luo Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20200123064325.36358-1-luoshijie1@huawei.com Signed-off-by: Theodore Ts'o commit 0c1cba6cca862c56bf8cb726314e5196505017f6 Author: wangyan Date: Wed Jan 22 17:33:10 2020 +0800 jbd2: delete the duplicated words in the comments Delete the duplicated words "is" in the comments Signed-off-by: Yan Wang Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/12087f77-ab4d-c7ba-53b4-893dbf0026f0@huawei.com Signed-off-by: Theodore Ts'o commit edc7e4898d5fdb164de1ab9d3a0c30ef9888e4f1 Author: Mat Martineau Date: Fri Jan 24 16:04:03 2020 -0800 mptcp: Fix code formatting checkpatch.pl had a few complaints in the last set of MPTCP patches: ERROR: code indent should use tabs where possible +^I subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);$ CHECK: Comparison to NULL could be written "!new_ctx" + if (new_ctx == NULL) { ERROR: "foo * bar" should be "foo *bar" +static const struct proto_ops * tcp_proto_ops(struct sock *sk) Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit e42f1ac626e7f799717d006e0f8393b6d6f9fc8c Author: Florian Westphal Date: Fri Jan 24 16:04:02 2020 -0800 mptcp: do not inherit inet proto ops We need to initialise the struct ourselves, else we expose tcp-specific callbacks such as tcp_splice_read which will then trigger splat because the socket is an mptcp one: BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57 Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478 CPU: 1 PID: 5478 Comm: syz-executor.0 Not tainted 5.5.0-rc6 #3 Call Trace: tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57 tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612 tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674 tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791 do_splice+0x1259/0x1560 fs/splice.c:1205 To prevent build error with ipv6, add the recv/sendmsg function declaration to ipv6.h. The functions are already accessible "thanks" to retpoline related work, but they are currently only made visible by socket.c specific INDIRECT_CALLABLE macros. Reported-by: Christoph Paasch Signed-off-by: Florian Westphal Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 52144d893d76294db9ed79a909397ea81bc25a02 Author: Dmitry Monakhov Date: Thu Nov 14 20:01:47 2019 +0000 ext4: fix extent_status trace points Show pblock only if it has meaningful value. # before ext4:ext4_es_lookup_extent_exit: dev 253,0 ino 12 found 1 [1/4294967294) 576460752303423487 H ext4:ext4_es_lookup_extent_exit: dev 253,0 ino 12 found 1 [2/4294967293) 576460752303423487 HR # after ext4:ext4_es_lookup_extent_exit: dev 253,0 ino 12 found 1 [1/4294967294) 0 H ext4:ext4_es_lookup_extent_exit: dev 253,0 ino 12 found 1 [2/4294967293) 0 HR Signed-off-by: Dmitry Monakhov Link: https://lore.kernel.org/r/20191114200147.1073-2-dmonakhov@gmail.com Signed-off-by: Theodore Ts'o commit 459c80742e6a4a5375d9765a326e6047103460f5 Author: Dmitry Monakhov Date: Thu Nov 14 20:01:46 2019 +0000 ext4: fix symbolic enum printing in trace output Trace's macro __print_flags() produce raw event's decraration w/o knowing actual flags value cat /sys/kernel/debug/tracing/events/ext4/ext4_ext_map_blocks_exit/format .. __print_flags(REC->mflags, "", { (1 << BH_New), For that reason we have to explicitly define it via special macro TRACE_DEFINE_ENUM() Also add missed EXTENT_STATUS_REFERENCED flag. #Before patch ext4:ext4_ext_map_blocks_exit: dev 253,0 ino 2 flags lblk 0 pblk 4177 len 1 mflags 0x20 ret 1 ext4:ext4_ext_map_blocks_exit: dev 253,0 ino 12 flags CREATE lblk 0 pblk 34304 len 1 mflags 0x60 ret 1 #With patch ext4:ext4_ext_map_blocks_exit: dev 253,0 ino 2 flags lblk 0 pblk 4177 len 1 mflags M ret 1 ext4:ext4_ext_map_blocks_exit: dev 253,0 ino 12 flags CREATE lblk 0 pblk 34816 len 1 mflags NM ret 1 Signed-off-by: Dmitry Monakhov Link: https://lore.kernel.org/r/20191114200147.1073-1-dmonakhov@gmail.com Signed-off-by: Theodore Ts'o commit 57c32ea42f8e802bda47010418e25043e0c9337f Author: Chengguang Xu Date: Wed Oct 16 10:25:01 2019 +0800 ext4: choose hardlimit when softlimit is larger than hardlimit in ext4_statfs_project() Setting softlimit larger than hardlimit seems meaningless for disk quota but currently it is allowed. In this case, there may be a bit of comfusion for users when they run df comamnd to directory which has project quota. For example, we set 20M softlimit and 10M hardlimit of block usage limit for project quota of test_dir(project id 123). [root@hades mnt_ext4]# repquota -P -a *** Report for project quotas on device /dev/loop0 Block grace time: 7days; Inode grace time: 7days Block limits File limits Project used soft hard grace used soft hard grace ---------------------------------------------------------------------- 0 -- 13 0 0 2 0 0 123 -- 10237 20480 10240 5 200 100 The result of df command as below: [root@hades mnt_ext4]# df -h test_dir Filesystem Size Used Avail Use% Mounted on /dev/loop0 20M 10M 10M 50% /home/cgxu/test/mnt_ext4 Even though it looks like there is another 10M free space to use, if we write new data to diretory test_dir(inherit project id), the write will fail with errno(-EDQUOT). After this patch, the df result looks like below. [root@hades mnt_ext4]# df -h test_dir Filesystem Size Used Avail Use% Mounted on /dev/loop0 10M 10M 3.0K 100% /home/cgxu/test/mnt_ext4 Signed-off-by: Chengguang Xu Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20191016022501.760-1-cgxu519@mykernel.net Signed-off-by: Theodore Ts'o commit ec772f01307a2c06ebf6cdd221e6b518a71ddae7 Author: Eric Biggers Date: Thu Jan 23 20:12:34 2020 -0800 ext4: fix race conditions in ->d_compare() and ->d_hash() Since ->d_compare() and ->d_hash() can be called in RCU-walk mode, ->d_parent and ->d_inode can be concurrently modified, and in particular, ->d_inode may be changed to NULL. For ext4_d_hash() this resulted in a reproducible NULL dereference if a lookup is done in a directory being deleted, e.g. with: int main() { if (fork()) { for (;;) { mkdir("subdir", 0700); rmdir("subdir"); } } else { for (;;) access("subdir/file", 0); } } ... or by running the 't_encrypted_d_revalidate' program from xfstests. Both repros work in any directory on a filesystem with the encoding feature, even if the directory doesn't actually have the casefold flag. I couldn't reproduce a crash in ext4_d_compare(), but it appears that a similar crash is possible there. Fix these bugs by reading ->d_parent and ->d_inode using READ_ONCE() and falling back to the case sensitive behavior if the inode is NULL. Reported-by: Al Viro Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups") Cc: # v5.2+ Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20200124041234.159740-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 28394da25888168df379c40910591b95e8e449f7 Author: Steven Rostedt (VMware) Date: Fri Jan 24 20:47:46 2020 -0500 tracing: Decrement trace_array when bootconfig creates an instance The trace_array_get_by_name() creates a ftrace instance and trace_array_put() is used to remove the reference. Even though the trace_array_get_by_name() creates the instance, it also adds a reference count to it, that prevents user space from removing it. As the bootconfig just creates the instance on boot up, it should still be used where it can be deleted by user space after boot. A trace_array_put() is required to let that happen. Also, change the documentation on trace_array_get_by_name() to make this not be so confusing. Link: https://lore.kernel.org/r/20200124205927.76128804@rorschach.local.home Fixes: 4f712a4d04a4e ("tracing/boot: Add instance node support") Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 244adf6426ee31a83f397b700d964cff12a247d3 Author: Theodore Ts'o Date: Thu Jan 23 12:23:17 2020 -0500 ext4: make dioread_nolock the default This fixes the direct I/O versus writeback race which can reveal stale data, and it improves the tail latency of commits on slow devices. Link: https://lore.kernel.org/r/20200125022254.1101588-1-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 31ad4e4ee1e4e2e12985e46aa6263c8bd5ad4271 Author: Tony Nguyen Date: Fri Jan 17 07:39:13 2020 -0800 ice: Allocate flow profile Create an extraction sequence based on the packet header protocols to be programmed and allocate a flow profile for the extraction sequence. Signed-off-by: Tony Nguyen Signed-off-by: Henry Tieman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit eba12ab71e71a2f82836c517596b6bd12664325c Author: Hou Pengyang Date: Tue Mar 3 21:48:18 2015 +0000 tracing: Fix comments about trace/ftrace.h commit f42c85e74faa422cf0bc747ed808681145448f88 moved tracepoint's ftrace creation into include/trace/ftrace.h and trace/define_trace.h was deleted as a result. However some comment info does not adapt to the change, which is such a misguiding when reading related code. This patch fix this by moving trace/trace_events.h to , since tracepoint headers have already been moved to tarce/events/. Link: http://lkml.kernel.org/r/1425419298-61941-1-git-send-email-houpengyang@huawei.com Signed-off-by: Hou Pengyang [ Pulled from the archeological digging of my INBOX ] Signed-off-by: Steven Rostedt (VMware) commit b3f7a6cd490112085eadb578b6f4a5a34d140726 Author: Dan Carpenter Date: Sat Nov 22 21:30:12 2014 +0300 tracing: Remove unneeded NULL check We checked "iter->trace" earlier so there is no need to check here. Link: http://lkml.kernel.org/r/20141122183012.GB6994@mwanda Signed-off-by: Dan Carpenter [ Pulled from the archeological digging of my INBOX ] Signed-off-by: Steven Rostedt (VMware) commit cbc3b92ce037f5e7536f6db157d185cd8b8f615c Author: Josef Bacik Date: Wed Sep 24 16:14:12 2014 -0400 tracing: Set kernel_stack's caller size properly I noticed when trying to use the trace-cmd python interface that reading the raw buffer wasn't working for kernel_stack events. This is because it uses a stubbed version of __dynamic_array that doesn't do the __data_loc trick and encode the length of the array into the field. Instead it just shows up as a size of 0. So change this to __array and set the len to FTRACE_STACK_ENTRIES since this is what we actually do in practice and matches how user_stack_trace works. Link: http://lkml.kernel.org/r/1411589652-1318-1-git-send-email-jbacik@fb.com Signed-off-by: Josef Bacik [ Pulled from the archeological digging of my INBOX ] Signed-off-by: Steven Rostedt (VMware) commit afccc00f75bbbee4e4ae833a96c2d29a7259c693 Author: Luis Henriques Date: Tue Sep 9 22:49:41 2014 +0100 tracing: Fix tracing_stat return values in error handling paths tracing_stat_init() was always returning '0', even on the error paths. It now returns -ENODEV if tracing_init_dentry() fails or -ENOMEM if it fails to created the 'trace_stat' debugfs directory. Link: http://lkml.kernel.org/r/1410299381-20108-1-git-send-email-luis.henriques@canonical.com Fixes: ed6f1c996bfe4 ("tracing: Check return value of tracing_init_dentry()") Signed-off-by: Luis Henriques [ Pulled from the archeological digging of my INBOX ] Signed-off-by: Steven Rostedt (VMware) commit dfb6cd1e654315168e36d947471bd2a0ccd834ae Author: Steven Rostedt (VMware) Date: Fri Jan 24 17:47:49 2020 -0500 tracing: Fix very unlikely race of registering two stat tracers Looking through old emails in my INBOX, I came across a patch from Luis Henriques that attempted to fix a race of two stat tracers registering the same stat trace (extremely unlikely, as this is done in the kernel, and probably doesn't even exist). The submitted patch wasn't quite right as it needed to deal with clean up a bit better (if two stat tracers were the same, it would have the same files). But to make the code cleaner, all we needed to do is to keep the all_stat_sessions_mutex held for most of the registering function. Link: http://lkml.kernel.org/r/1410299375-20068-1-git-send-email-luis.henriques@canonical.com Fixes: 002bb86d8d42f ("tracing/ftrace: separate events tracing and stats tracing engine") Reported-by: Luis Henriques Signed-off-by: Steven Rostedt (VMware) commit 3a21409a0b4bce3171001b168ca42285004c873c Author: David Howells Date: Fri Jan 17 15:55:09 2020 +0000 nfs: Return EINVAL rather than ERANGE for mount parse errors Return EINVAL rather than ERANGE for mount parse errors as the userspace mount command doesn't necessarily understand what to do with anything other than EINVAL. The old code returned -ERANGE as an intermediate error that then get converted to -EINVAL, whereas the new code returns -ERANGE. This was induced by passing minorversion=1 to a v4 mount where CONFIG_NFS_V4_1 was disabled in the kernel build. Fixes: 68f65ef40e1e ("NFS: Convert mount option parsing to use functionality from fs_parser.h") Reported-by: Krzysztof Kozlowski Signed-off-by: David Howells Signed-off-by: Anna Schumaker commit b24ee6c64ca785739b3ef8d95fd6becaad1bde39 Author: Olga Kornievskaia Date: Mon Dec 16 16:34:02 2019 -0500 NFS: allow deprecation of NFS UDP protocol Add a kernel config CONFIG_NFS_DISABLE_UDP_SUPPORT to disallow NFS UDP mounts and enable it by default. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit f7b37b8b139860ed786bf8ce4358290c6053d94d Author: Trond Myklebust Date: Tue Jan 14 12:06:34 2020 -0500 NFS: Add softreval behaviour to nfs_lookup_revalidate() If the server is unavaliable, we want to allow the revalidating lookup to time out, and to default to validating the cached dentry if the 'softreval' mount option is set. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 35b9211c0a2427e8f39e534f442f43804fc8d5ca Author: Andrii Nakryiko Date: Fri Jan 24 12:18:46 2020 -0800 libbpf: Fix realloc usage in bpf_core_find_cands Fix bug requesting invalid size of reallocated array when constructing CO-RE relocation candidate list. This can cause problems if there are many potential candidates and a very fine-grained memory allocator bucket sizes are used. Fixes: ddc7c3042614 ("libbpf: implement BPF CO-RE offset relocation algorithm") Reported-by: William Smith Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200124201847.212528-1-andriin@fb.com commit c90ed40cefe187a20fc565650b119aa696abc2ed Author: Tony Nguyen Date: Fri Jan 17 07:39:12 2020 -0800 ice: Enable writing hardware filtering tables Enable the driver to write the filtering hardware tables to allow for changing of RSS rules. Upon loading of DDP package, a minimal configuration should be written to hardware. Introduce and initialize structures for storing configuration and make the top level calls to configure the RSS tables to initial values. A packet segment will be created but nothing is written to hardware yet. Signed-off-by: Tony Nguyen Signed-off-by: Henry Tieman Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit d7a252708dbc950ca2064310217e8b9f85846e2f Author: Andrii Nakryiko Date: Thu Jan 23 21:38:37 2020 -0800 libbpf: Improve handling of failed CO-RE relocations Previously, if libbpf failed to resolve CO-RE relocation for some instructions, it would either return error immediately, or, if .relaxed_core_relocs option was set, would replace relocatable offset/imm part of an instruction with a bogus value (-1). Neither approach is good, because there are many possible scenarios where relocation is expected to fail (e.g., when some field knowingly can be missing on specific kernel versions). On the other hand, replacing offset with invalid one can hide programmer errors, if this relocation failue wasn't anticipated. This patch deprecates .relaxed_core_relocs option and changes the approach to always replacing instruction, for which relocation failed, with invalid BPF helper call instruction. For cases where this is expected, BPF program should already ensure that that instruction is unreachable, in which case this invalid instruction is going to be silently ignored. But if instruction wasn't guarded, BPF program will be rejected at verification step with verifier log pointing precisely to the place in assembly where the problem is. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20200124053837.2434679-1-andriin@fb.com commit 51bad0f05616c43d6d34b0a19bcc9bdab8e8fb39 Author: Lorenz Bauer Date: Fri Jan 24 11:27:54 2020 +0000 selftests: bpf: Reset global state between reuseport test runs Currently, there is a lot of false positives if a single reuseport test fails. This is because expected_results and the result map are not cleared. Zero both after individual test runs, which fixes the mentioned false positives. Fixes: 91134d849a0e ("bpf: Test BPF_PROG_TYPE_SK_REUSEPORT") Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Acked-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200124112754.19664-5-lmb@cloudflare.com commit 603fba9dfd0b2e2a844ece9ed98ce874c38aa98e Author: Lorenz Bauer Date: Fri Jan 24 11:27:53 2020 +0000 selftests: bpf: Make reuseport test output more legible Include the name of the mismatching result in human readable format when reporting an error. The new output looks like the following: unexpected result result: [1, 0, 0, 0, 0, 0] expected: [0, 0, 0, 0, 0, 0] mismatch on DROP_ERR_INNER_MAP (bpf_prog_linum:153) check_results:FAIL:382 Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Acked-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200124112754.19664-4-lmb@cloudflare.com commit 8bec4f665e0baecb5f1b683379fc10b3745eb612 Author: Lorenz Bauer Date: Fri Jan 24 11:27:52 2020 +0000 selftests: bpf: Ignore FIN packets for reuseport tests The reuseport tests currently suffer from a race condition: FIN packets count towards DROP_ERR_SKB_DATA, since they don't contain a valid struct cmd. Tests will spuriously fail depending on whether check_results is called before or after the FIN is processed. Exit the BPF program early if FIN is set. Fixes: 91134d849a0e ("bpf: Test BPF_PROG_TYPE_SK_REUSEPORT") Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Acked-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200124112754.19664-3-lmb@cloudflare.com commit c31dbb1e41d1857b403f9bf58c87f5898519a0bc Author: Lorenz Bauer Date: Fri Jan 24 11:27:51 2020 +0000 selftests: bpf: Use a temporary file in test_sockmap Use a proper temporary file for sendpage tests. This means that running the tests doesn't clutter the working directory, and allows running the test on read-only filesystems. Fixes: 16962b2404ac ("bpf: sockmap, add selftests") Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Acked-by: Martin KaFai Lau Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200124112754.19664-2-lmb@cloudflare.com commit dab0198413d227f13be7da8abf0d5bc8620427f0 Author: Christoph Hellwig Date: Tue Jan 21 06:37:51 2020 -0700 x86/PCI: Remove X86_DEV_DMA_OPS There are no users of X86_DEV_DMA_OPS left, so remove the code. Link: https://lore.kernel.org/r/1579613871-301529-8-git-send-email-jonathan.derrick@intel.com Signed-off-by: Christoph Hellwig Signed-off-by: Bjorn Helgaas Reviewed-by: Jon Derrick commit 962e329d888cfcb923d39af4e14fd616467de167 Author: Jon Derrick Date: Tue Jan 21 06:37:50 2020 -0700 PCI: vmd: Remove dma_map_ops overrides Devices on the VMD domain use the VMD endpoint's requester ID and have been relying on the VMD endpoint's DMA operations. The problem with this was that VMD domain devices would use the VMD endpoint's attributes when doing DMA and IOMMU mapping. We can be smarter about this by only using the VMD endpoint when mapping and providing the correct child device's attributes during DMA operations. Remove the dma_map_ops redirect. Link: https://lore.kernel.org/r/1579613871-301529-7-git-send-email-jonathan.derrick@intel.com Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas Reviewed-by: Keith Busch Acked-by: Lorenzo Pieralisi commit e3560ee4cfb29e232ea99ff9adfaa8ac5b414345 Author: Jon Derrick Date: Tue Jan 21 06:37:49 2020 -0700 iommu/vt-d: Remove VMD child device sanity check Remove the sanity check required for VMD child devices. The new pci_real_dma_dev() DMA alias mechanism places them in the same IOMMU group as the VMD endpoint. Assignment of the group would require assigning the VMD endpoint, where unbinding the VMD endpoint removes the child device domain from the hierarchy. Link: https://lore.kernel.org/r/1579613871-301529-6-git-send-email-jonathan.derrick@intel.com Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas Acked-by: Lu Baolu commit 2b0140c69637e6f3cf9f8a0b7629567de9645680 Author: Jon Derrick Date: Tue Jan 21 06:37:48 2020 -0700 iommu/vt-d: Use pci_real_dma_dev() for mapping The PCI device may have a DMA requester on another bus, such as VMD subdevices needing to use the VMD endpoint. This case requires the real DMA device for the IOMMU mapping, so use pci_real_dma_dev() to find that device. Link: https://lore.kernel.org/r/1579613871-301529-5-git-send-email-jonathan.derrick@intel.com Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas Acked-by: Lu Baolu commit 2856ba6020fc5cbf051d5a75b2abb3046072c144 Author: Jon Derrick Date: Tue Jan 21 06:37:47 2020 -0700 PCI: Introduce pci_real_dma_dev() The current DMA alias implementation requires the aliased device be on the same PCI bus as the requester ID. Add an arch-specific mechanism to point to another PCI device when doing mapping and PCI DMA alias search. The default case returns the actual device. Link: https://lore.kernel.org/r/1579613871-301529-4-git-send-email-jonathan.derrick@intel.com Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas Cc: Christoph Hellwig commit 34067c56fa177d3582695da8e3e162ef78cd0371 Author: Jon Derrick Date: Tue Jan 21 06:37:46 2020 -0700 x86/PCI: Expose VMD's pci_dev in struct pci_sysdata Expose VMD's pci_dev pointer in struct pci_sysdata. This will be used indirectly by intel-iommu.c to find the correct domain. Link: https://lore.kernel.org/r/1579613871-301529-3-git-send-email-jonathan.derrick@intel.com [bhelgaas: commit log] Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas Cc: Christoph Hellwig commit aad6aa0cd674b7935957354666f82e5b2cdc813d Author: Christoph Hellwig Date: Tue Jan 21 06:37:45 2020 -0700 x86/PCI: Add to_pci_sysdata() helper Various helpers need the pci_sysdata just to dereference a single field in it. Add a little helper that returns the properly typed sysdata pointer to require a little less boilerplate code. [jonathan.derrick: to_pci_sysdata const argument] Link: https://lore.kernel.org/r/1579613871-301529-2-git-send-email-jonathan.derrick@intel.com Signed-off-by: Christoph Hellwig Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas commit d030a0dd01306d45569c6a4449dee603f994744a Merge: 0ea5115a02f0 be28d4da7c73 Author: Olof Johansson Date: Fri Jan 24 12:12:24 2020 -0800 Merge tag 'ti-k3-soc-for-v5.6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux into arm/dt Texas Instruments K3 SoC family changes for 5.6, part 2. - Add DMA nodes for am65x and j721e - Add McASP nodes for am65x and j721e, showcasing the DMA usage - Add CAL node for am65x - Add OV5640 camera support for am65x * tag 'ti-k3-soc-for-v5.6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux: arm64: dts: ti: k3-am654-base-board: Add CSI2 OV5640 camera arm64: dts: ti: k3-am65-main Add CAL node arm64: dts: ti: k3-j721e-main: Add McASP nodes arm64: dts: ti: k3-am654-main: Add McASP nodes arm64: dts: ti: k3-j721e: DMA support arm64: dts: ti: k3-j721e-main: Move secure proxy and smmu under main_navss arm64: dts: ti: k3-j721e-main: Correct main NAVSS representation arm64: dts: ti: k3-j721e: Correct the address for MAIN NAVSS arm64: dts: ti: k3-am65: DMA support arm64: dts: ti: k3-am65-main: Move secure proxy under cbass_main_navss arm64: dts: ti: k3-am65-main: Correct main NAVSS representation Link: https://lore.kernel.org/r/83546942-6215-9c3a-16cd-be7e7c000c0e@ti.com Signed-off-by: Olof Johansson commit 0ea5115a02f08a86e1fe01b837d941263ba870a3 Author: Dafna Hirschfeld Date: Fri Jan 24 11:57:53 2020 +0100 dt-bindings: fix compilation error of the example in marvell,mmp3-hsic-phy.yaml Running `make dt_binging_check`, gives the error: DTC Documentation/devicetree/bindings/phy/marvell,mmp3-hsic-phy.example.dt.yaml Error: Documentation/devicetree/bindings/phy/marvell,mmp3-hsic-phy.example.dts:20.41-42 syntax error FATAL ERROR: Unable to parse input tree This is because the example uses the macro GPIO_ACTIVE_HIGH which is defined in gpio.h but the include of this header is missing. Add the include to fix the error. Fixes: f6f149604eef ("dt-bindings: phy: Add binding for marvell,mmp3-hsic-phy") Link: https://lore.kernel.org/r/20200124105753.15976-1-dafna.hirschfeld@collabora.com Signed-off-by: Dafna Hirschfeld Acked-by: Rob Herring Signed-off-by: Olof Johansson commit e6ecae6b8f6e16b085a70bc6c368626371e3a609 Merge: 3a29339b21a2 e98d5023fe1f Author: Olof Johansson Date: Fri Jan 24 12:06:17 2020 -0800 Merge tag 'uniphier-dt64-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier into arm/dt UniPhier ARM64 SoC DT updates for v5.6 - Add reset-names to NAND controller node * tag 'uniphier-dt64-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier: arm64: dts: uniphier: add reset-names to NAND controller node Link: https://lore.kernel.org/r/CAK7LNASehDHWgOug=Rz0uBBSP2ntJnNLiarfSdj97tZu+OXLkA@mail.gmail.com Signed-off-by: Olof Johansson commit 3a29339b21a290d9ef9700a00aa4c49492afb00f Merge: 9b0b308a1586 37f3e0096f71 Author: Olof Johansson Date: Fri Jan 24 12:05:58 2020 -0800 Merge tag 'uniphier-dt-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier into arm/dt UniPhier ARM SoC DT updates for v5.6 - Add pinmux nodes for I2C ch5, ch6 - Add reset-names to NAND controller node * tag 'uniphier-dt-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier: ARM: dts: uniphier: add reset-names to NAND controller node ARM: dts: uniphier: add pinmux nodes for I2C ch5, ch6 Link: https://lore.kernel.org/r/CAK7LNARYrzv4QU-eXxqYCcC9dziJmx9F02YNZ3mMnF47EfL3fA@mail.gmail.com Signed-off-by: Olof Johansson commit fd928f3e32ba09381b287f8b732418434d932855 Author: Stephen Boyd Date: Thu Jan 23 21:58:48 2020 -0800 alarmtimer: Make alarmtimer_get_rtcdev() a stub when CONFIG_RTC_CLASS=n The stubbed version of alarmtimer_get_rtcdev() is not exported. so this won't work if this function is used in a module when CONFIG_RTC_CLASS=n. Move the stub function to the header file and make it inline so that callers don't have to worry about linking against this symbol. rtcdev isn't used outside of this ifdef so it's not required to be redefined to NULL. Drop that while touching this area. Signed-off-by: Stephen Boyd Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20200124055849.154411-4-swboyd@chromium.org commit 7c94caca877b0feeca6f5f7b07d48c508e20d58f Author: Stephen Boyd Date: Thu Jan 23 21:58:47 2020 -0800 alarmtimer: Use wakeup source from alarmtimer platform device Use the wakeup source that can be associated with the 'alarmtimer' platform device instead of registering another one by hand. Signed-off-by: Stephen Boyd Signed-off-by: Thomas Gleixner Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20200124055849.154411-3-swboyd@chromium.org commit c79108bd19a8490315847e0c95ac6526fcd8e770 Author: Stephen Boyd Date: Thu Jan 23 21:58:46 2020 -0800 alarmtimer: Make alarmtimer platform device child of RTC device The alarmtimer_suspend() function will fail if an RTC device is on a bus such as SPI or i2c and that RTC device registers and probes after alarmtimer_init() registers and probes the 'alarmtimer' platform device. This is because system wide suspend suspends devices in the reverse order of their probe. When alarmtimer_suspend() attempts to program the RTC for a wakeup it will try to program an RTC device on a bus that has already been suspended. Move the alarmtimer device registration to happen when the RTC which is used for wakeup is registered. Register the 'alarmtimer' platform device as a child of the RTC device too, so that it can be guaranteed that the RTC device won't be suspended when alarmtimer_suspend() is called. Reported-by: Douglas Anderson Signed-off-by: Stephen Boyd Signed-off-by: Thomas Gleixner Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20200124055849.154411-2-swboyd@chromium.org commit 6b088cefbeaa87ba48bf838edfc1e19c9ff3976b Author: Stephen Boyd Date: Thu Jan 23 21:58:49 2020 -0800 alarmtimer: Update alarmtimer_get_rtcdev() docs to reflect reality This function doesn't do anything like this comment says when an RTC device hasn't been chosen. It looks like we used to do something like that before commit 8bc0dafb5cf3 ("alarmtimers: Rework RTC device selection using class interface") but that's long gone now. Remove this sentence to avoid confusing the reader. Signed-off-by: Stephen Boyd Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20200124055849.154411-5-swboyd@chromium.org commit cb923159bbb8cc8fe09c19a3435ee11fd546f3d3 Author: Sebastian Andrzej Siewior Date: Fri Jan 17 10:01:37 2020 +0100 smp: Remove allocation mask from on_each_cpu_cond.*() The allocation mask is no longer used by on_each_cpu_cond() and on_each_cpu_cond_mask() and can be removed. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20200117090137.1205765-4-bigeasy@linutronix.de commit 67719ef25eeb2048b11befa6a757aeb3848b5df1 Author: Sebastian Andrzej Siewior Date: Fri Jan 17 10:01:36 2020 +0100 smp: Add a smp_cond_func_t argument to smp_call_function_many() on_each_cpu_cond_mask() allocates a new CPU mask. The newly allocated mask is a subset of the provided mask based on the conditional function. This memory allocation can be avoided by extending smp_call_function_many() with the conditional function and performing the remote function call based on the mask and the conditional function. Rename smp_call_function_many() to smp_call_function_many_cond() and add the smp_cond_func_t argument. If smp_cond_func_t is provided then it is used before invoking the function. Provide smp_call_function_many() with cond_func set to NULL. Let on_each_cpu_cond_mask() use smp_call_function_many_cond(). Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20200117090137.1205765-3-bigeasy@linutronix.de commit 5671d814dbd204b4ecc705045b5f1a647bff6f3b Author: Sebastian Andrzej Siewior Date: Fri Jan 17 10:01:35 2020 +0100 smp: Use smp_cond_func_t as type for the conditional function Use a typdef for the conditional function instead defining it each time in the function prototype. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20200117090137.1205765-2-bigeasy@linutronix.de commit 2c4288719806ca0b3de1b742ada26b25a60d6a45 Author: Thomas Bogendoerfer Date: Fri Jan 24 14:16:08 2020 +0100 MIPS: PCI: Add detection of IOC3 on IO7, IO8, IO9 and Fuel Add detection for IOC3 chips in IP35 machines. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 43ee74487bd2842cb4d37b5c62f074fbed2366b9 Merge: 11ea68f553e2 f4a81f5a853e Author: Thomas Gleixner Date: Fri Jan 24 20:08:51 2020 +0100 Merge tag 'irqchip-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - Conversion of the SiFive PLIC to hierarchical domains - New SiFive GPIO irqchip driver - New Aspeed SCI irqchip driver - New NXP INTMUX irqchip driver - Additional support for the Meson A1 GPIO irqchip - First part of the GICv4.1 support - Assorted fixes commit 268d3636dfb22254324774de1f8875174b3be064 Author: Maxim Mikityanskiy Date: Fri Jan 24 19:15:35 2020 +0200 Bluetooth: btrtl: Use kvmalloc for FW allocations Currently, kmemdup is applied to the firmware data, and it invokes kmalloc under the hood. The firmware size and patch_length are big (more than PAGE_SIZE), and on some low-end systems (like ASUS E202SA) kmalloc may fail to allocate a contiguous chunk under high memory usage and fragmentation: Bluetooth: hci0: RTL: examining hci_ver=06 hci_rev=000a lmp_ver=06 lmp_subver=8821 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: loading rtl_bt/rtl8821a_fw.bin kworker/u9:2: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 As firmware load happens on each resume, Bluetooth will stop working after several iterations, when the kernel fails to allocate an order-4 page. This patch replaces kmemdup with kvmalloc+memcpy. It's not required to have a contiguous chunk here, because it's not mapped to the device directly. Signed-off-by: Maxim Mikityanskiy Signed-off-by: Marcel Holtmann commit 0e247386d9ed5ab8b7dad010cf4b183efeb1e47d Merge: 6e6eca2ee79a df1e849ae455 f6105fc2a9c0 189a6883dcf7 afa47fdfa29f 5b14557b073c b22eb7cefb9d Author: Paul E. McKenney Date: Fri Jan 24 10:37:27 2020 -0800 Merge branches 'doc.2019.12.10a', 'exp.2019.12.09a', 'fixes.2020.01.24a', 'kfree_rcu.2020.01.24a', 'list.2020.01.10a', 'preempt.2020.01.24a' and 'torture.2019.12.09a' into HEAD doc.2019.12.10a: Documentations updates exp.2019.12.09a: Expedited grace-period updates fixes.2020.01.24a: Miscellaneous fixes kfree_rcu.2020.01.24a: Batch kfree_rcu() work list.2020.01.10a: RCU-protected-list updates preempt.2020.01.24a: Preemptible RCU updates torture.2019.12.09a: Torture-test updates commit f6105fc2a9c0ea5be6b9e5c19b2551af0b8b4eac Author: Paul E. McKenney Date: Wed Nov 27 11:36:07 2019 -0800 rcu: Remove unused stop-machine #include Long ago, RCU used the stop-machine mechanism to implement expedited grace periods, but no longer does so. This commit therefore removes the no-longer-needed #includes of linux/stop_machine.h. Link: https://lwn.net/Articles/805317/ Reported-by: Viresh Kumar Signed-off-by: Paul E. McKenney commit c7e9c01f928a0e7e467ec3efe1b56bc566678bae Author: Will Deacon Date: Fri Nov 8 17:01:18 2019 +0000 powerpc: Remove comment about read_barrier_depends() 'read_barrier_depends()' doesn't exist anymore so stop talking about it. Signed-off-by: Will Deacon Acked-by: Michael Ellerman Signed-off-by: Paul E. McKenney commit 05d35961c20b8919bb94df6f626f306553758d59 Author: Paul E. McKenney Date: Mon Nov 25 15:35:26 2019 -0800 .mailmap: Add entries for old paulmck@kernel.org addresses [ paulmck: Apply Florian Fainelli feedback. ] Signed-off-by: Paul E. McKenney commit 844a378de3372c923909681706d62336d702531e Author: Paul E. McKenney Date: Mon Nov 4 08:08:30 2019 -0800 srcu: Apply *_ONCE() to ->srcu_last_gp_end The ->srcu_last_gp_end field is accessed from any CPU at any time by synchronize_srcu(), so non-initialization references need to use READ_ONCE() and WRITE_ONCE(). This commit therefore makes that change. Reported-by: syzbot+08f3e9d26e5541e1ecf2@syzkaller.appspotmail.com Acked-by: Marco Elver Signed-off-by: Paul E. McKenney commit 7441e7661d6586ae36329b7956e4d713d81e9903 Author: Paul E. McKenney Date: Wed Oct 30 09:37:11 2019 -0700 rcu: Switch force_qs_rnp() to for_each_leaf_node_cpu_mask() Currently, force_qs_rnp() uses a for_each_leaf_node_possible_cpu() loop containing a check of the current CPU's bit in ->qsmask. This works, but this commit saves three lines by instead using for_each_leaf_node_cpu_mask(), which combines the functionality of for_each_leaf_node_possible_cpu() and leaf_node_cpu_bit(). This commit also replaces the use of the local variable "bit" with rdp->grpmask. Signed-off-by: Paul E. McKenney commit e1350e8e0ea5d959c23c5e593ff3026a67dbb049 Author: Ben Dooks Date: Tue Oct 15 14:48:22 2019 +0100 rcu: Move rcu_{expedited,normal} definitions into rcupdate.h This commit moves the rcu_{expedited,normal} definitions from kernel/rcu/update.c to include/linux/rcupdate.h to make sure they are in sync, and also to avoid the following warning from sparse: kernel/ksysfs.c:150:5: warning: symbol 'rcu_expedited' was not declared. Should it be static? kernel/ksysfs.c:167:5: warning: symbol 'rcu_normal' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Paul E. McKenney commit e2167b38c87a0c9e85c342a823dae1e6f67b11d9 Author: Lai Jiangshan Date: Tue Oct 15 10:28:47 2019 +0000 rcu: Move gp_state_names[] and gp_state_getname() to tree_stall.h Only tree_stall.h needs to get name from GP state, so this commit moves the gp_state_names[] array and the gp_state_getname() from kernel/rcu/tree.h and kernel/rcu/tree.c, respectively, to kernel/rcu/tree_stall.h. While moving gp_state_names[], this commit uses the GCC syntax to ensure that the right string is associated with the right CPP macro. Signed-off-by: Lai Jiangshan Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit 4778339df0ee361dbf2cbdcb87abaec9dfbc841d Author: Lai Jiangshan Date: Tue Oct 15 10:28:46 2019 +0000 rcu: Remove the declaration of call_rcu() in tree.h The call_rcu() function is an external RCU API that is declared in include/linux/rcupdate.h. There is thus no point in redeclaring it in kernel/rcu/tree.h, so this commit removes that redundant declaration. Signed-off-by: Lai Jiangshan Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit 2488a5e695564897a0f8ea42cd3af71647cd26d2 Author: Lai Jiangshan Date: Tue Oct 15 10:23:57 2019 +0000 rcu: Fix tracepoint tracking RCU CPU kthread utilization In the call to trace_rcu_utilization() at the start of the loop in rcu_cpu_kthread(), "rcu_wait" is incorrect, plus this trace event needs to be hoisted above the loop to balance with either the "rcu_wait" or "rcu_yield", depending on how the loop exits. This commit therefore makes these changes. Signed-off-by: Lai Jiangshan Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit 822175e72995a9ff7eeef4f5cd3f945f2697b67d Author: Lai Jiangshan Date: Tue Oct 15 10:23:56 2019 +0000 rcu: Fix harmless omission of "CONFIG_" from #if condition The C preprocessor macros SRCU and TINY_RCU should instead be CONFIG_SRCU and CONFIG_TINY_RCU, respectively in the #f in kernel/rcu/rcu.h. But there is no harm when "TINY_RCU" is wrongly used, which are always non-defined, which makes "!defined(TINY_RCU)" always true, which means the code block is always included, and the included code block doesn't cause any compilation error so far in CONFIG_TINY_RCU builds. It is also the reason this change should not be taken in -stable. This commit adds the needed "CONFIG_" prefix to both macros. Not for -stable. Signed-off-by: Lai Jiangshan Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit 5b14557b073c96a7cf79adc4d7b6c4a8c26b2a43 Author: Paul E. McKenney Date: Tue Nov 26 18:05:45 2019 -0800 rcu: Avoid tick_dep_set_cpu() misordering In the current code, rcu_nmi_enter_common() might decide to turn on the tick using tick_dep_set_cpu(), but be delayed just before doing so. Then the grace-period kthread might notice that the CPU in question had in fact gone through a quiescent state, thus turning off the tick using tick_dep_clear_cpu(). The later invocation of tick_dep_set_cpu() would then incorrectly leave the tick on. This commit therefore enlists the aid of the leaf rcu_node structure's ->lock to ensure that decisions to enable or disable the tick are carried out before they can be reversed. Signed-off-by: Paul E. McKenney commit 77339e61aa309310a535bd01eb3388f7a27b36f9 Author: Lai Jiangshan Date: Fri Nov 15 14:08:53 2019 -0800 rcu: Provide wrappers for uses of ->rcu_read_lock_nesting This commit provides wrapper functions for uses of ->rcu_read_lock_nesting to improve readability and to ease future changes to support inlining of __rcu_read_lock() and __rcu_read_unlock(). Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit c51f83c315c392d9776c33eb16a2fe1349d65c7f Author: Paul E. McKenney Date: Mon Nov 4 08:22:45 2019 -0800 rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special() The rcu_node structure's ->expmask field is updated only when holding the ->lock, but is also accessed locklessly. This means that all ->expmask updates must use WRITE_ONCE() and all reads carried out without holding ->lock must use READ_ONCE(). This commit therefore changes the lockless ->expmask read in rcu_read_unlock_special() to use READ_ONCE(). Reported-by: syzbot+99f4ddade3c22ab0cf23@syzkaller.appspotmail.com Signed-off-by: Paul E. McKenney Acked-by: Marco Elver commit 3717e1e9f25ec7059e421ab6fc602cab7063c11c Author: Lai Jiangshan Date: Fri Nov 1 05:06:21 2019 -0700 rcu: Clear ->rcu_read_unlock_special only once In rcu_preempt_deferred_qs_irqrestore(), ->rcu_read_unlock_special is cleared one piece at a time. Given that the "if" statements in this function use the copy in "special", this commit removes the clearing of the individual pieces in favor of clearing ->rcu_read_unlock_special in one go just after it has been determined to be non-zero. Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit 2eeba5838fd8c5e19bb91e25624116936348e7af Author: Lai Jiangshan Date: Fri Nov 1 04:06:22 2019 -0700 rcu: Clear .exp_hint only when deferred quiescent state has been reported Currently, the .exp_hint flag is cleared in rcu_read_unlock_special(), which works, but which can also prevent subsequent rcu_read_unlock() calls from helping expedite the quiescent state needed by an ongoing expedited RCU grace period. This commit therefore defers clearing of .exp_hint from rcu_read_unlock_special() to rcu_preempt_deferred_qs_irqrestore(), thus ensuring that intervening calls to rcu_read_unlock() have a chance to help end the expedited grace period. Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit c130d2dc93cd03323494d82dbe7b5fb0d101ab62 Author: Lai Jiangshan Date: Tue Oct 15 10:28:48 2019 +0000 rcu: Rename some instance of CONFIG_PREEMPTION to CONFIG_PREEMPT_RCU CONFIG_PREEMPTION and CONFIG_PREEMPT_RCU are always identical, but some code depends on CONFIG_PREEMPTION to access to rcu_preempt functionality. This patch changes CONFIG_PREEMPTION to CONFIG_PREEMPT_RCU in these cases. Signed-off-by: Lai Jiangshan Signed-off-by: Lai Jiangshan Signed-off-by: Paul E. McKenney commit 189a6883dcf7fa70e17403ae4225c60ffc9e404b Author: Joel Fernandes (Google) Date: Fri Aug 30 12:36:33 2019 -0400 rcu: Remove kfree_call_rcu_nobatch() Now that the kfree_rcu() special-casing has been removed from tree RCU, this commit removes kfree_call_rcu_nobatch() since it is no longer needed. Signed-off-by: Joel Fernandes (Google) Signed-off-by: Paul E. McKenney commit 77a40f97030b27b3fc1640a3ed203870f0817f57 Author: Joel Fernandes (Google) Date: Fri Aug 30 12:36:32 2019 -0400 rcu: Remove kfree_rcu() special casing and lazy-callback handling This commit removes kfree_rcu() special-casing and the lazy-callback handling from Tree RCU. It moves some of this special casing to Tiny RCU, the removal of which will be the subject of later commits. This results in a nice negative delta. Suggested-by: Paul E. McKenney Signed-off-by: Joel Fernandes (Google) [ paulmck: Add slab.h #include, thanks to kbuild test robot . ] Signed-off-by: Paul E. McKenney commit e99637becb2e684bee2b9117f817f4d1346b8353 Author: Joel Fernandes (Google) Date: Sun Sep 22 13:03:17 2019 -0700 rcu: Add support for debug_objects debugging for kfree_rcu() This commit applies RCU's debug_objects debugging to the new batched kfree_rcu() implementations. The object is queued at the kfree_rcu() call and dequeued during reclaim. Tested that enabling CONFIG_DEBUG_OBJECTS_RCU_HEAD successfully detects double kfree_rcu() calls. Signed-off-by: Joel Fernandes (Google) [ paulmck: Fix IRQ per kbuild test robot feedback. ] Signed-off-by: Paul E. McKenney commit 0392bebebf26f09434e6c7ca4c09c014efeef76a Author: Joel Fernandes (Google) Date: Thu Sep 19 14:58:26 2019 -0700 rcu: Add multiple in-flight batches of kfree_rcu() work During testing, it was observed that amount of memory consumed due kfree_rcu() batching is 300-400MB. Previously we had only a single head_free pointer pointing to the list of rcu_head(s) that are to be freed after a grace period. Until this list is drained, we cannot queue any more objects on it since such objects may not be ready to be reclaimed when the worker thread eventually gets to drainin g the head_free list. We can do better by maintaining multiple lists as done by this patch. Testing shows that memory consumption came down by around 100-150MB with just adding another list. Adding more than 1 additional list did not show any improvement. Suggested-by: Paul E. McKenney Signed-off-by: Joel Fernandes (Google) [ paulmck: Code style and initialization handling. ] [ paulmck: Fix field name, reported by kbuild test robot . ] Signed-off-by: Paul E. McKenney commit 569d767087ef56a59bc2d1d5f25ee447eeae442a Author: Joel Fernandes Date: Sun Sep 22 10:49:57 2019 -0700 rcu: Make kfree_rcu() use a non-atomic ->monitor_todo Because the ->monitor_todo field is always protected by krcp->lock, this commit downgrades from xchg() to non-atomic unmarked assignment statements. Signed-off-by: Joel Fernandes [ paulmck: Update to include early-boot kick code. ] Signed-off-by: Paul E. McKenney commit e6e78b004fa7e0ab455d46d27f218bf6ce178a18 Author: Joel Fernandes (Google) Date: Fri Aug 30 12:36:29 2019 -0400 rcuperf: Add kfree_rcu() performance Tests This test runs kfree_rcu() in a loop to measure performance of the new kfree_rcu() batching functionality. The following table shows results when booting with arguments: rcuperf.kfree_loops=20000 rcuperf.kfree_alloc_num=8000 rcuperf.kfree_rcu_test=1 rcuperf.kfree_no_batch=X rcuperf.kfree_no_batch=X # Grace Periods Test Duration (s) X=1 (old behavior) 9133 11.5 X=0 (new behavior) 1732 12.5 On a 16 CPU system with the above boot parameters, we see that the total number of grace periods that elapse during the test drops from 9133 when not batching to 1732 when batching (a 5X improvement). The kfree_rcu() flood itself slows down a bit when batching, though, as shown. Note that the active memory consumption during the kfree_rcu() flood does increase to around 200-250MB due to the batching (from around 50MB without batching). However, this memory consumption is relatively constant. In other words, the system is able to keep up with the kfree_rcu() load. The memory consumption comes down considerably if KFREE_DRAIN_JIFFIES is increased from HZ/50 to HZ/80. A later patch will reduce memory consumption further by using multiple lists. Also, when running the test, please disable CONFIG_DEBUG_PREEMPT and CONFIG_PROVE_RCU for realistic comparisons with/without batching. Signed-off-by: Joel Fernandes (Google) Signed-off-by: Paul E. McKenney commit a35d16905efc6ad5523d864a5c6efcb1e657e386 Author: Byungchul Park Date: Mon Aug 5 18:22:27 2019 -0400 rcu: Add basic support for kfree_rcu() batching Recently a discussion about stability and performance of a system involving a high rate of kfree_rcu() calls surfaced on the list [1] which led to another discussion how to prepare for this situation. This patch adds basic batching support for kfree_rcu(). It is "basic" because we do none of the slab management, dynamic allocation, code moving or any of the other things, some of which previous attempts did [2]. These fancier improvements can be follow-up patches and there are different ideas being discussed in those regards. This is an effort to start simple, and build up from there. In the future, an extension to use kfree_bulk and possibly per-slab batching could be done to further improve performance due to cache-locality and slab-specific bulk free optimizations. By using an array of pointers, the worker thread processing the work would need to read lesser data since it does not need to deal with large rcu_head(s) any longer. Torture tests follow in the next patch and show improvements of around 5x reduction in number of grace periods on a 16 CPU system. More details and test data are in that patch. There is an implication with rcu_barrier() with this patch. Since the kfree_rcu() calls can be batched, and may not be handed yet to the RCU machinery in fact, the monitor may not have even run yet to do the queue_rcu_work(), there seems no easy way of implementing rcu_barrier() to wait for those kfree_rcu()s that are already made. So this means a kfree_rcu() followed by an rcu_barrier() does not imply that memory will be freed once rcu_barrier() returns. Another implication is higher active memory usage (although not run-away..) until the kfree_rcu() flooding ends, in comparison to without batching. More details about this are in the second patch which adds an rcuperf test. Finally, in the near future we will get rid of kfree_rcu() special casing within RCU such as in rcu_do_batch and switch everything to just batching. Currently we don't do that since timer subsystem is not yet up and we cannot schedule the kfree_rcu() monitor as the timer subsystem's lock are not initialized. That would also mean getting rid of kfree_call_rcu_nobatch() entirely. [1] http://lore.kernel.org/lkml/20190723035725-mutt-send-email-mst@kernel.org [2] https://lkml.org/lkml/2017/12/19/824 Cc: kernel-team@android.com Cc: kernel-team@lge.com Co-developed-by: Byungchul Park Signed-off-by: Byungchul Park Signed-off-by: Joel Fernandes (Google) [ paulmck: Applied 0day and Paul Walmsley feedback on ->monitor_todo. ] [ paulmck: Make it work during early boot. ] [ paulmck: Add a crude early boot self-test. ] [ paulmck: Style adjustments and experimental docbook structure header. ] Link: https://lore.kernel.org/lkml/alpine.DEB.2.21.9999.1908161931110.32497@viisi.sifive.com/T/#me9956f66cb611b95d26ae92700e1d901f46e8c59 Signed-off-by: Paul E. McKenney commit 80f2388afa6ef985f9c5c228e36705c4d4db4756 Author: Eric Biggers Date: Thu Jan 23 20:15:49 2020 -0800 f2fs: fix race conditions in ->d_compare() and ->d_hash() Since ->d_compare() and ->d_hash() can be called in RCU-walk mode, ->d_parent and ->d_inode can be concurrently modified, and in particular, ->d_inode may be changed to NULL. For f2fs_d_hash() this resulted in a reproducible NULL dereference if a lookup is done in a directory being deleted, e.g. with: int main() { if (fork()) { for (;;) { mkdir("subdir", 0700); rmdir("subdir"); } } else { for (;;) access("subdir/file", 0); } } ... or by running the 't_encrypted_d_revalidate' program from xfstests. Both repros work in any directory on a filesystem with the encoding feature, even if the directory doesn't actually have the casefold flag. I couldn't reproduce a crash in f2fs_d_compare(), but it appears that a similar crash is possible there. Fix these bugs by reading ->d_parent and ->d_inode using READ_ONCE() and falling back to the case sensitive behavior if the inode is NULL. Reported-by: Al Viro Fixes: 2c2eb7a300cd ("f2fs: Support case-insensitive file name lookups") Cc: # v5.4+ Signed-off-by: Eric Biggers Signed-off-by: Jaegeuk Kim commit 5515eae647426169e4b7969271fb207881eba7f6 Author: Eric Biggers Date: Thu Jan 23 20:15:48 2020 -0800 f2fs: fix dcache lookup of !casefolded directories Do the name comparison for non-casefolded directories correctly. This is analogous to ext4's commit 66883da1eee8 ("ext4: fix dcache lookup of !casefolded directories"). Fixes: 2c2eb7a300cd ("f2fs: Support case-insensitive file name lookups") Cc: # v5.4+ Signed-off-by: Eric Biggers Signed-off-by: Jaegeuk Kim commit 600c39b34369e2a1bf78eb67afb99ce550f271cc Author: Sibi Sankar Date: Thu Jan 23 18:42:36 2020 +0530 remoteproc: qcom: q6v5-mss: Improve readability of reset_assert Define AXI_GATING_VALID_OVERRIDE and fixup comments to improve readability of Q6 modem reset sequence on SC7180 SoCs. Reviewed-by: Evan Green Signed-off-by: Sibi Sankar Link: https://lore.kernel.org/r/20200123131236.1078-3-sibis@codeaurora.org Signed-off-by: Bjorn Andersson commit 01bf3fec38e9188846f6755cd29da515f5852bc5 Author: Sibi Sankar Date: Thu Jan 23 18:42:35 2020 +0530 remoteproc: qcom: q6v5-mss: Use regmap_read_poll_timeout Replace the loop for HALT_ACK detection with regmap_read_poll_timeout. Reviewed-by: Evan Green Signed-off-by: Sibi Sankar Link: https://lore.kernel.org/r/20200123131236.1078-2-sibis@codeaurora.org Signed-off-by: Bjorn Andersson commit 06b9c269938ba1e9356b74584cd1ff738c0cf4de Author: Lukas Bulwahn Date: Sat Jan 18 16:36:20 2020 +0100 docs: nvdimm: use ReST notation for subsection The ACPI Device Specific Methods (_DSM) paragraph is intended to be a subsection of the Submit Checklist Addendum section. Dan Williams however used Markdown notation for this subsection, which does not parse as intended in a ReST documentation. Change the markup to ReST notation, as described in the Specific guidelines for the kernel documentation section in Documentation/doc-guide/sphinx.rst. Fixes: 47843401e3a0 ("libnvdimm, MAINTAINERS: Maintainer Entry Profile") Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20200118153620.8276-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet commit e91440ddfbf4a5d7c541aed8c55c0ec76d9b26c7 Author: Nathan Chancellor Date: Fri Jan 24 08:57:50 2020 -0700 ASoC: rt1015: Remove unnecessary const Clang warns: ../sound/soc/codecs/rt1015.c:392:14: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier] static const SOC_ENUM_SINGLE_DECL(rt1015_boost_mode_enum, 0, 0, ^ ../include/sound/soc.h:355:2: note: expanded from macro 'SOC_ENUM_SINGLE_DECL' SOC_ENUM_DOUBLE_DECL(name, xreg, xshift, xshift, xtexts) ^ ../include/sound/soc.h:352:2: note: expanded from macro 'SOC_ENUM_DOUBLE_DECL' const struct soc_enum name = SOC_ENUM_DOUBLE(xreg, xshift_l, xshift_r, \ ^ 1 warning generated. Remove the const after static to fix it. Fixes: df31007400c3 ("ASoC: rt1015: add rt1015 amplifier driver") Link: https://github.com/ClangBuiltLinux/linux/issues/845 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20200124155750.33753-1-natechancellor@gmail.com Signed-off-by: Mark Brown commit 3a6adf3263f43593c0df66a62ffed9daea562bfd Author: Marek Szyprowski Date: Thu Jan 23 14:40:46 2020 +0100 ASoC: max98090: silence lockdep warning Commit 08df0d9a00f7 ("ASoC: max98090: revert "ASoC: max98090: fix lockdep warning"") provided a good rationale for removing separate lock for the SHDN register access. However it restored the lockdep warning during the system boot. To silence the lockdep warning, mark the mutex taken in the max98090_shdn_save() function with the lockdep class dedicated for the runtime DAPM operations: SND_SOC_DAPM_CLASS_RUNTIME. This finally fixes the following lockdep warning observed on Exynos4412-based Odroid U3 board: ====================================================== WARNING: possible circular locking dependency detected 5.5.0-rc7-next-20200123 #7329 Not tainted ------------------------------------------------------ alsactl/1105 is trying to acquire lock: ed4f7cf4 (&card->dapm_mutex){+.+.}, at: max98090_shdn_save+0x1c/0x28 but task is already holding lock: edb8d49c (&card->controls_rwsem){++++}, at: snd_ctl_ioctl+0xcc/0xbb8 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&card->controls_rwsem){++++}: snd_ctl_add_replace+0x3c/0x84 dapm_create_or_share_kcontrol+0x24c/0x2e0 snd_soc_dapm_new_widgets+0x308/0x594 snd_soc_bind_card+0x834/0xa94 devm_snd_soc_register_card+0x34/0x6c odroid_audio_probe+0x288/0x34c platform_drv_probe+0x6c/0xa4 really_probe+0x200/0x48c driver_probe_device+0x78/0x1f8 bus_for_each_drv+0x74/0xb8 __device_attach+0xd4/0x16c bus_probe_device+0x88/0x90 deferred_probe_work_func+0x3c/0xd0 process_one_work+0x230/0x7bc worker_thread+0x44/0x524 kthread+0x130/0x164 ret_from_fork+0x14/0x20 0x0 -> #0 (&card->dapm_mutex){+.+.}: lock_acquire+0xe8/0x270 __mutex_lock+0x9c/0xb18 mutex_lock_nested+0x1c/0x24 max98090_shdn_save+0x1c/0x28 max98090_put_enum_double+0x20/0x40 snd_ctl_ioctl+0x190/0xbb8 ksys_ioctl+0x484/0xb10 ret_fast_syscall+0x0/0x28 0xbede0564 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&card->controls_rwsem); lock(&card->dapm_mutex); lock(&card->controls_rwsem); lock(&card->dapm_mutex); *** DEADLOCK *** 1 lock held by alsactl/1105: #0: edb8d49c (&card->controls_rwsem){++++}, at: snd_ctl_ioctl+0xcc/0xbb8 stack backtrace: CPU: 2 PID: 1105 Comm: alsactl Not tainted 5.5.0-rc7-next-20200123 #7329 Hardware name: Samsung Exynos (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xb4/0xe0) [] (dump_stack) from [] (check_noncircular+0x1ec/0x208) [] (check_noncircular) from [] (__lock_acquire+0x1210/0x25ec) [] (__lock_acquire) from [] (lock_acquire+0xe8/0x270) [] (lock_acquire) from [] (__mutex_lock+0x9c/0xb18) [] (__mutex_lock) from [] (mutex_lock_nested+0x1c/0x24) [] (mutex_lock_nested) from [] (max98090_shdn_save+0x1c/0x28) [] (max98090_shdn_save) from [] (max98090_put_enum_double+0x20/0x40) [] (max98090_put_enum_double) from [] (snd_ctl_ioctl+0x190/0xbb8) [] (snd_ctl_ioctl) from [] (ksys_ioctl+0x484/0xb10) [] (ksys_ioctl) from [] (ret_fast_syscall+0x0/0x28) Exception stack(0xed331fa8 to 0xed331ff0) ... Fixes: 08df0d9a00f7 ("ASoC: max98090: revert "ASoC: max98090: fix lockdep warning"") Signed-off-by: Marek Szyprowski Reviewed-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200123134046.9769-1-m.szyprowski@samsung.com Signed-off-by: Mark Brown commit 5871023c3a316e8fe8c03e7bad1d35057e69ab40 Author: Yue Hu Date: Mon Jan 20 18:29:49 2020 +0800 zram: correct documentation about sysfs node of huge page writeback sysfs node for huge page writeback is writeback rather than write. Signed-off-by: Yue Hu Acked-by: Minchan Kim Link: https://lore.kernel.org/r/20200120102949.12132-1-zbestahu@gmail.com Signed-off-by: Jonathan Corbet commit a3e1c56a0b8f3b83807d67db4c3bdb6292a54dce Author: Randy Dunlap Date: Mon Jan 20 14:51:41 2020 -0800 Documentation: zram: various fixes in zram.rst Fix various items in zram.rst: - typos/spellos - punctuation - grammar - shell syntax - indentation - sysfs file names Signed-off-by: Randy Dunlap Acked-by: Minchan Kim Link: https://lore.kernel.org/r/77000e12-677a-62f6-9f78-343be5bd6630@infradead.org Signed-off-by: Jonathan Corbet commit 53b7f3aa411bb812c7a4f8af1ab9e0d2288b56cf Author: Jonathan Corbet Date: Wed Jan 22 16:05:43 2020 -0700 Add a maintainer entry profile for documentation Documentation should lead by example, so here's a basic maintainer entry profile for this subsystem. Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Jonathan Corbet commit d96574b0b49d6c93f148333bd36d541281fc4636 Author: Jonathan Corbet Date: Wed Jan 22 10:34:11 2020 -0700 Add a document on how to contribute to the documentation This is mostly a collection of thoughts for how people who want to help out can make the docs better. Hopefully the world will respond with a flurry of useful patches. Acked-by: Jani Nikula Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet commit bcac386f3d3940354e76ab6309e4279134848424 Author: Jonathan Corbet Date: Wed Jan 22 16:06:28 2020 -0700 docs: Keep up with the location of NoUri Sphinx 2.1 moved sphinx.environment.NoUri into sphinx.errors; that produced this warning in the docs build: /usr/lib/python3.7/site-packages/sphinx/registry.py:473: RemovedInSphinx30Warning: sphinx.environment.NoUri is deprecated. Grab NoUri from the right place and make the warning go away. That symbol was only added to sphinx.errors in 2.1, so we must still import it from the old location when running in older versions. Signed-off-by: Jonathan Corbet commit 1a980b8cbf0059a5308eea61522f232fd03002e2 Author: Murphy Zhou Date: Fri Jan 17 20:49:29 2020 +0800 ovl: add splice file read write helper Now overlayfs falls back to use default file splice read and write, which is not compatiple with overlayfs, returning EFAULT. xfstests generic/591 can reproduce part of this. Tested this patch with xfstests auto group tests. Signed-off-by: Murphy Zhou Signed-off-by: Miklos Szeredi commit e3b5ee0cfb65646f4a915643fe53e0a51829d891 Merge: 8c17bbf6c8f7 6855d1ba7537 154e3a65f404 857f081426e5 c11738cf9d29 Author: Joerg Roedel Date: Fri Jan 24 15:39:39 2020 +0100 Merge branches 'iommu/fixes', 'arm/smmu', 'x86/amd', 'x86/vt-d' and 'core' into next commit 154e3a65f404cfd5fbb7f49df01905d4ad025264 Author: Adrian Huang Date: Wed Jan 22 22:36:29 2020 +0800 iommu/amd: Remove the unnecessary assignment The assignment of the global variable 'iommu_detected' has been moved from amd_iommu_init_dma_ops() to amd_iommu_detect(), so this patch removes the assignment in amd_iommu_init_dma_ops(). Signed-off-by: Adrian Huang Signed-off-by: Joerg Roedel commit 857f081426e5aa38313426c13373730f1345fe95 Author: Lu Baolu Date: Thu Jan 16 09:52:36 2020 +0800 iommu/vt-d: Remove unnecessary WARN_ON_ONCE() Address field in device TLB invalidation descriptor is qualified by the S field. If S field is zero, a single page at page address specified by address [63:12] is requested to be invalidated. If S field is set, the least significant bit in the address field with value 0b (say bit N) indicates the invalidation address range. The spec doesn't require the address [N - 1, 0] to be cleared, hence remove the unnecessary WARN_ON_ONCE(). Otherwise, the caller might set "mask = MAX_AGAW_PFN_WIDTH" in order to invalidating all the cached mappings on an endpoint, and below overflow error will be triggered. [...] UBSAN: Undefined behaviour in drivers/iommu/dmar.c:1354:3 shift exponent 64 is too large for 64-bit type 'long long unsigned int' [...] Reported-and-tested-by: Frank Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit b89b6605b85f13b0cf41a047aa5759ea0a5663ec Author: Lu Baolu Date: Wed Jan 15 11:03:59 2020 +0800 iommu/vt-d: Unnecessary to handle default identity domain The iommu default domain framework has been designed to take care of setting identity default domain type. It's unnecessary to handle this again in the VT-d driver. Hence, remove it. Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 9235cb13d7d17baba0b3a9277381258361e95c16 Author: Lu Baolu Date: Wed Jan 15 11:03:58 2020 +0800 iommu/vt-d: Allow devices with RMRRs to use identity domain Since commit ea2447f700cab ("intel-iommu: Prevent devices with RMRRs from being placed into SI Domain"), the Intel IOMMU driver doesn't allow any devices with RMRR locked to use the identity domain. This was added to to fix the issue where the RMRR info for devices being placed in and out of the identity domain gets lost. This identity maps all RMRRs when setting up the identity domain, so that devices with RMRRs could also use it. Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit ce4cc52b51dfaefff65c6d2f31f169122a8659d4 Author: Barret Rhoden Date: Wed Jan 15 11:03:57 2020 +0800 iommu/vt-d: Add RMRR base and end addresses sanity check The VT-d spec specifies requirements for the RMRR entries base and end (called 'Limit' in the docs) addresses. This commit will cause the DMAR processing to mark the firmware as tainted if any RMRR entries that do not meet these requirements. Signed-off-by: Barret Rhoden Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit f5a68bb0752e0cf77c06f53f72258e7beb41381b Author: Barret Rhoden Date: Wed Jan 15 11:03:56 2020 +0800 iommu/vt-d: Mark firmware tainted if RMRR fails sanity check RMRR entries describe memory regions that are DMA targets for devices outside the kernel's control. RMRR entries that fail the sanity check are pointing to regions of memory that the firmware did not tell the kernel are reserved or otherwise should not be used. Instead of aborting DMAR processing, this commit marks the firmware as tainted. These RMRRs will still be identity mapped, otherwise, some devices, e.x. graphic devices, will not work during boot. Signed-off-by: Barret Rhoden Signed-off-by: Lu Baolu Fixes: f036c7fa0ab60 ("iommu/vt-d: Check VT-d RMRR region in BIOS is reported as reserved") Signed-off-by: Joerg Roedel commit 0552e05fdfea191a2cf3a0abd33574b5ef9ca818 Author: Rafael J. Wysocki Date: Thu Jan 23 00:11:24 2020 +0100 PM: core: Fix handling of devices deleted during system-wide resume If a device is deleted by one of its system-wide resume callbacks (for example, because it does not appear to be present or accessible any more) along with its children, the resume of the children may continue leading to use-after-free errors and other issues (potentially). Namely, if the device's children are resumed asynchronously, their resume may have been scheduled already before the device's callback runs and so the device may be deleted while dpm_wait_for_superior() is being executed for them. The memory taken up by the parent device object may be freed then while dpm_wait() is waiting for the parent's resume callback to complete, which leads to a use-after-free. Moreover, the resume of the children is really not expected to continue after they have been unregistered, so it must be terminated right away in that case. To address this problem, modify dpm_wait_for_superior() to check if the target device is still there in the system-wide PM list of devices and if so, to increment its parent's reference counter, both under dpm_list_mtx which prevents device_del() running for the child from dropping the parent's reference counter prematurely. If the device is not present in the system-wide PM list of devices any more, the resume of it cannot continue, so check that again after dpm_wait() returns, which means that the parent's callback has been completed, and pass the result of that check to the caller of dpm_wait_for_superior() to allow it to abort the device's resume if it is not there any more. Link: https://lore.kernel.org/linux-pm/1579568452-27253-1-git-send-email-chanho.min@lge.com Reported-by: Chanho Min Cc: All applicable Signed-off-by: Rafael J. Wysocki Acked-by: Greg Kroah-Hartman commit 08a45c59f16efe33ca715e894231a9b7afd3b7b4 Merge: 23f4eacdd24a 8ab183deb26a Author: David S. Miller Date: Fri Jan 24 13:44:08 2020 +0100 Merge branch 'mptcp-part-two' Christoph Paasch says: ==================== Multipath TCP part 2: Single subflow & RFC8684 support v2 -> v3: Added RFC8684-style handshake (see below fore more details) and some minor fixes v1 -> v2: Rebased on latest "Multipath TCP: Prerequisites" v3 series This set adds MPTCP connection establishment, writing & reading MPTCP options on data packets, a sysctl to allow MPTCP per-namespace, and self tests. This is sufficient to establish and maintain a connection with a MPTCP peer, but will not yet allow or initiate establishment of additional MPTCP subflows. We also add the necessary code for the RFC8684-style handshake. RFC8684 obsoletes the experimental RFC6824 and makes MPTCP move-on to version 1. Originally our plan was to submit single-subflow and RFC8684 support in two patchsets, but to simplify the merging-process and ensure that a coherent MPTCP-version lands in Linux we decided to merge the two sets into a single one. The MPTCP patchset exclusively supports RFC 8684. Although all MPTCP deployments are currently based on RFC 6824, future deployments will be migrating to MPTCP version 1. 3GPP's 5G standardization also solely supports RFC 8684. In addition, we believe that this initial submission of MPTCP will be cleaner by solely supporting RFC 8684. If later on support for the old MPTCP-version is required it can always be added in the future. The major difference between RFC 8684 and RFC 6824 is that it has a better support for servers using TCP SYN-cookies by reliably retransmitting the MP_CAPABLE option. Before ending this cover letter with some refs, it is worth mentioning that we promise David Miller that merging this series will be rewarded by Twitter dopamine hits :-D Clone/fetch: https://github.com/multipath-tcp/mptcp_net-next.git (tag: netdev-v3-part2) Browse: https://github.com/multipath-tcp/mptcp_net-next/tree/netdev-v3-part2 Thank you for your review. You can find us at mptcp@lists.01.org and https://is.gd/mptcp_upstream ==================== Signed-off-by: David S. Miller commit 8ab183deb26a3b79f8021afa9e83cc1bbd812031 Author: Paolo Abeni Date: Tue Jan 21 16:56:33 2020 -0800 mptcp: cope with later TCP fallback With MPTCP v1, passive connections can fallback to TCP after the subflow becomes established: syn + MP_CAPABLE -> <- syn, ack + MP_CAPABLE ack, seq = 3 -> // OoO packet is accepted because in-sequence // passive socket is created, is in ESTABLISHED // status and tentatively as MP_CAPABLE ack, seq = 2 -> // no MP_CAPABLE opt, subflow should fallback to TCP We can't use the 'subflow' socket fallback, as we don't have it available for passive connection. Instead, when the fallback is detected, replace the mptcp socket with the underlying TCP subflow. Beyond covering the above scenario, it makes a TCP fallback socket as efficient as plain TCP ones. Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Paolo Abeni Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit d22f4988ffecbe284e4d00e897525adbd0edd801 Author: Christoph Paasch Date: Tue Jan 21 16:56:32 2020 -0800 mptcp: process MP_CAPABLE data option This patch implements the handling of MP_CAPABLE + data option, as per RFC 6824 bis / RFC 8684: MPTCP v1. On the server side we can receive the remote key after that the connection is established. We need to explicitly track the 'missing remote key' status and avoid emitting a mptcp ack until we get such info. When a late/retransmitted/OoO pkt carrying MP_CAPABLE[+data] option is received, we have to propagate the mptcp seq number info to the msk socket. To avoid ABBA locking issue, explicitly check for that in recvmsg(), where we own msk and subflow sock locks. The above also means that an established mp_capable subflow - still waiting for the remote key - can be 'downgraded' to plain TCP. Such change could potentially block a reader waiting for new data forever - as they hook to msk, while later wake-up after the downgrade will be on subflow only. The above issue is not handled here, we likely have to get rid of msk->fallback to handle that cleanly. Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit cc7972ea1932335e0a0ee00ac8a24b3e8304630d Author: Christoph Paasch Date: Tue Jan 21 16:56:31 2020 -0800 mptcp: parse and emit MP_CAPABLE option according to v1 spec This implements MP_CAPABLE options parsing and writing according to RFC 6824 bis / RFC 8684: MPTCP v1. Local key is sent on syn/ack, and both keys are sent on 3rd ack. MP_CAPABLE messages len are updated accordingly. We need the skbuff to correctly emit the above, so we push the skbuff struct as an argument all the way from tcp code to the relevant mptcp callbacks. When processing incoming MP_CAPABLE + data, build a full blown DSS-like map info, to simplify later processing. On child socket creation, we need to record the remote key, if available. Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 65492c5a6ab5df5091a77562dbcca2d2dc3877c0 Author: Paolo Abeni Date: Tue Jan 21 16:56:30 2020 -0800 mptcp: move from sha1 (v0) to sha256 (v1) For simplicity's sake use directly sha256 primitives (and pull them as a required build dep). Add optional, boot-time self-tests for the hmac function. Signed-off-by: Paolo Abeni Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 048d19d444be1e42abca19a6b969343954ae4e17 Author: Florian Westphal Date: Tue Jan 21 16:56:29 2020 -0800 mptcp: add basic kselftest for mptcp Add mptcp_connect tool: xmit two files back and forth between two processes, several net namespaces including some adding delays, losses and reordering. Wrapper script tests that data was transmitted without corruption. The "-c" command line option for mptcp_connect.sh is there for debugging: The script will use tcpdump to create one .pcap file per test case, named according to the namespaces, protocols, and connect address in use. For example, the first test case writes the capture to ns1-ns1-MPTCP-MPTCP-10.0.1.1.pcap. The stderr output from tcpdump is printed after the test completes to show tcpdump's "packets dropped by kernel" information. Also check that userspace can't create MPTCP sockets when mptcp.enabled sysctl is off. The "-b" option allows to tune/lower send buffer size. "-m mmap" can be used to test blocking io. Default is non-blocking io using read/write/poll. Will run automatically on "make kselftest". Note that the default timeout of 45 seconds is used even if there is a "settings" changing it to 450. 45 seconds should be enough in most cases but this depends on the machine running the tests. A fix to correctly read the "settings" file has been proposed upstream but not applied yet. It is not blocking the execution of these new tests but it would be nice to have it: https://patchwork.kernel.org/patch/11204935/ Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Co-developed-by: Mat Martineau Signed-off-by: Mat Martineau Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Signed-off-by: Florian Westphal Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 784325e9f037e5f7a7f9a46ecbb27384128f8b6e Author: Matthieu Baerts Date: Tue Jan 21 16:56:28 2020 -0800 mptcp: new sysctl to control the activation per NS New MPTCP sockets will return -ENOPROTOOPT if MPTCP support is disabled for the current net namespace. We are providing here a way to control access to the feature for those that need to turn it on or off. The value of this new sysctl can be different per namespace. We can then restrict the usage of MPTCP to the selected NS. In case of serious issues with MPTCP, administrators can now easily turn MPTCP off. Co-developed-by: Peter Krystad Signed-off-by: Peter Krystad Signed-off-by: Matthieu Baerts Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 57040755a3e43a1ee2d4ce9c83e87de27b570104 Author: Paolo Abeni Date: Tue Jan 21 16:56:27 2020 -0800 mptcp: allow collapsing consecutive sendpages on the same substream If the current sendmsg() lands on the same subflow we used last, we can try to collapse the data. Signed-off-by: Paolo Abeni Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 7a6a6cbc3e592e339ad23e4e8ede9a3f6160bda8 Author: Paolo Abeni Date: Tue Jan 21 16:56:26 2020 -0800 mptcp: recvmsg() can drain data from multiple subflows With the previous patch in place, the msk can detect which subflow has the current map with a simple walk, let's update the main loop to always select the 'current' subflow. The exit conditions now closely mirror tcp_recvmsg() to get expected timeout and signal behavior. Co-developed-by: Peter Krystad Signed-off-by: Peter Krystad Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Mat Martineau Signed-off-by: Mat Martineau Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Paolo Abeni Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 1891c4a07672b300b3160ceec59755063b20222b Author: Florian Westphal Date: Tue Jan 21 16:56:25 2020 -0800 mptcp: add subflow write space signalling and mptcp_poll Add new SEND_SPACE flag to indicate that a subflow has enough space to accept more data for transmission. It gets cleared at the end of mptcp_sendmsg() in case ssk has run below the free watermark. It is (re-set) from the wspace callback. This allows us to use msk->flags to determine the poll mask. Co-developed-by: Peter Krystad Signed-off-by: Peter Krystad Signed-off-by: Florian Westphal Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Author: Mat Martineau Date: Tue Jan 21 16:56:24 2020 -0800 mptcp: Implement MPTCP receive path Parses incoming DSS options and populates outgoing MPTCP ACK fields. MPTCP fields are parsed from the TCP option header and placed in an skb extension, allowing the upper MPTCP layer to access MPTCP options after the skb has gone through the TCP stack. The subflow implements its own data_ready() ops, which ensures that the pending data is in sequence - according to MPTCP seq number - dropping out-of-seq skbs. The DATA_READY bit flag is set if this is the case. This allows the MPTCP socket layer to determine if more data is available without having to consult the individual subflows. It additionally validates the current mapping and propagates EoF events to the connection socket. Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Co-developed-by: Peter Krystad Signed-off-by: Peter Krystad Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Mat Martineau Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 6d0060f600adfddaa43fefb96b6b12643331961e Author: Mat Martineau Date: Tue Jan 21 16:56:23 2020 -0800 mptcp: Write MPTCP DSS headers to outgoing data packets Per-packet metadata required to write the MPTCP DSS option is written to the skb_ext area. One write to the socket may contain more than one packet of data, which is copied to page fragments and mapped in to MPTCP DSS segments with size determined by the available page fragments and the maximum mapping length allowed by the MPTCP specification. If do_tcp_sendpages() splits a DSS segment in to multiple skbs, that's ok - the later skbs can either have duplicated DSS mapping information or none at all, and the receiver can handle that. The current implementation uses the subflow frag cache and tcp sendpages to avoid excessive code duplication. More work is required to ensure that it works correctly under memory pressure and to support MPTCP-level retransmissions. The MPTCP DSS checksum is not yet implemented. Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Co-developed-by: Peter Krystad Signed-off-by: Peter Krystad Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Mat Martineau Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 717e79c867ca5f27815578815feafa3f3944f06b Author: Peter Krystad Date: Tue Jan 21 16:56:22 2020 -0800 mptcp: Add setsockopt()/getsockopt() socket operations set/getsockopt behaviour with multiple subflows is undefined. Therefore, for now, we return -EOPNOTSUPP unless we're in fallback mode. Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 214984901aaf50cc52eebeabf14017edeb3a845f Author: Peter Krystad Date: Tue Jan 21 16:56:21 2020 -0800 mptcp: Add shutdown() socket operation Call shutdown on all subflows in use on the given socket, or on the fallback socket. Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 79c0949e9a09f6a14a6dd18dc8396029423f9b68 Author: Peter Krystad Date: Tue Jan 21 16:56:20 2020 -0800 mptcp: Add key generation and token tree Generate the local keys, IDSN, and token when creating a new socket. Introduce the token tree to track all tokens in use using a radix tree with the MPTCP token itself as the index. Override the rebuild_header callback in inet_connection_sock_af_ops for creating the local key on a new outgoing connection. Override the init_req callback of tcp_request_sock_ops for creating the local key on a new incoming connection. Will be used to obtain the MPTCP parent socket to handle incoming joins. Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be Author: Peter Krystad Date: Tue Jan 21 16:56:19 2020 -0800 mptcp: Create SUBFLOW socket for incoming connections Add subflow_request_sock type that extends tcp_request_sock and add an is_mptcp flag to tcp_request_sock distinguish them. Override the listen() and accept() methods of the MPTCP socket proto_ops so they may act on the subflow socket. Override the conn_request() and syn_recv_sock() handlers in the inet_connection_sock to handle incoming MPTCP SYNs and the ACK to the response SYN. Add handling in tcp_output.c to add MP_CAPABLE to an outgoing SYN-ACK response for a subflow_request_sock. Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit cec37a6e41aae7bf3df9a3da783380a4d9325fd8 Author: Peter Krystad Date: Tue Jan 21 16:56:18 2020 -0800 mptcp: Handle MP_CAPABLE options for outgoing connections Add hooks to tcp_output.c to add MP_CAPABLE to an outgoing SYN request, to capture the MP_CAPABLE in the received SYN-ACK, to add MP_CAPABLE to the final ACK of the three-way handshake. Use the .sk_rx_dst_set() handler in the subflow proto to capture when the responding SYN-ACK is received and notify the MPTCP connection layer. Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 2303f994b3e187091fd08148066688b08f837efc Author: Peter Krystad Date: Tue Jan 21 16:56:17 2020 -0800 mptcp: Associate MPTCP context with TCP socket Use ULP to associate a subflow_context structure with each TCP subflow socket. Creating these sockets requires new bind and connect functions to make sure ULP is set up immediately when the subflow sockets are created. Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit eda7acddf8080bb2d022a8d4b8b2345eb80c63ec Author: Peter Krystad Date: Tue Jan 21 16:56:16 2020 -0800 mptcp: Handle MPTCP TCP options Add hooks to parse and format the MP_CAPABLE option. This option is handled according to MPTCP version 0 (RFC6824). MPTCP version 1 MP_CAPABLE (RFC6824bis/RFC8684) will be added later in coordination with related code changes. Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Co-developed-by: Davide Caratti Signed-off-by: Davide Caratti Signed-off-by: Peter Krystad Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit f870fa0b5768842cb4690c1c11f19f28b731ae6d Author: Mat Martineau Date: Tue Jan 21 16:56:15 2020 -0800 mptcp: Add MPTCP socket stubs Implements the infrastructure for MPTCP sockets. MPTCP sockets open one in-kernel TCP socket per subflow. These subflow sockets are only managed by the MPTCP socket that owns them and are not visible from userspace. This commit allows a userspace program to open an MPTCP socket with: sock = socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); The resulting socket is simply a wrapper around a single regular TCP socket, without any of the MPTCP protocol implemented over the wire. Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Co-developed-by: Peter Krystad Signed-off-by: Peter Krystad Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Christoph Paasch Signed-off-by: David S. Miller commit 23f4eacdd24a64e7792bdee7327d32876e14cd51 Merge: 9bbc8be29d66 a580c76d534c Author: David S. Miller Date: Fri Jan 24 12:58:14 2020 +0100 Merge branch 'net-bridge-add-per-vlan-state-option' Nikolay Aleksandrov says: ==================== net: bridge: add per-vlan state option This set adds the first per-vlan option - state, which uses the new vlan infrastructure that was recently added. It gives us forwarding control on per-vlan basis. The first 3 patches prepare the vlan code to support option dumping and modification. We still compress vlan ranges which have equal options, each new option will have to add its own equality check to br_vlan_opts_eq(). The vlans are created in forwarding state by default to be backwards compatible and vlan state is considered only when the port state is forwarding (more info in patch 4). I'll send the selftest for the vlan state with the iproute2 patch-set. v2: patch 3: do full (all-vlan) notification only on vlan create/delete, otherwise use the per-vlan notifications only, rework how option change ranges are detected, add more verbose error messages when setting options and add checks if a vlan should be used. ==================== Signed-off-by: David S. Miller commit a580c76d534c7360ba68042b19cb255e8420e987 Author: Nikolay Aleksandrov Date: Fri Jan 24 13:40:22 2020 +0200 net: bridge: vlan: add per-vlan state The first per-vlan option added is state, it is needed for EVPN and for per-vlan STP. The state allows to control the forwarding on per-vlan basis. The vlan state is considered only if the port state is forwarding in order to avoid conflicts and be consistent. br_allowed_egress is called only when the state is forwarding, but the ingress case is a bit more complicated due to the fact that we may have the transition between port:BR_STATE_FORWARDING -> vlan:BR_STATE_LEARNING which should still allow the bridge to learn from the packet after vlan filtering and it will be dropped after that. Also to optimize the pvid state check we keep a copy in the vlan group to avoid one lookup. The state members are modified with *_ONCE() to annotate the lockless access. Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit a5d29ae226812ae620f58a0726525d8af9b1d751 Author: Nikolay Aleksandrov Date: Fri Jan 24 13:40:21 2020 +0200 net: bridge: vlan: add basic option setting support This patch adds support for option modification of single vlans and ranges. It allows to only modify options, i.e. skip create/delete by using the BRIDGE_VLAN_INFO_ONLY_OPTS flag. When working with a range option changes we try to pack the notifications as much as possible. v2: do full port (all vlans) notification only when creating/deleting vlans for compatibility, rework the range detection when changing options, add more verbose extack errors and check if a vlan should be used (br_vlan_should_use checks) Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 7a53e718c551752924416b33235bf338729b5115 Author: Nikolay Aleksandrov Date: Fri Jan 24 13:40:20 2020 +0200 net: bridge: vlan: add basic option dumping support We'll be dumping the options for the whole range if they're equal. The first range vlan will be used to extract the options. The commit doesn't change anything yet it just adds the skeleton for the support. The dump will happen when the first option is added. Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit ac0e932d0e2988c125be251715d83e95839cdae3 Author: Nikolay Aleksandrov Date: Fri Jan 24 13:40:19 2020 +0200 net: bridge: check port state before br_allowed_egress If we make sure that br_allowed_egress is called only when we have BR_STATE_FORWARDING state then we can avoid a test later when we add per-vlan state. Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 533a6cfe08f96a7b5c65e06d20916d552c11b256 Author: Ulf Hansson Date: Wed Jan 22 15:27:47 2020 +0100 mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() All callers of __mmc_switch() should now be specifying a valid timeout for the CMD6 command. However, just to be sure, let's print a warning and default to use the generic_cmd6_time in case the provided timeout_ms argument is zero. In this context, let's also simplify some of the corresponding code and clarify some related comments. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200122142747.5690-4-ulf.hansson@linaro.org commit ad91619aa9d78ab1c6d4a969c3db68bc331ae76c Author: Ulf Hansson Date: Wed Jan 22 15:27:46 2020 +0100 mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD The INAND_CMD38_ARG_EXT_CSD is a vendor specific EXT_CSD register, which is used to prepare an erase/trim operation. However, it doesn't make sense to use a timeout of 10 minutes while updating the register, which becomes the case when the timeout_ms argument for mmc_switch() is set to zero. Instead, let's use the generic_cmd6_time, as that seems like a reasonable timeout to use for these cases. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200122142747.5690-3-ulf.hansson@linaro.org commit 24ed3bd01d6a844fd5e8a75f48d0a3d10ed71bf9 Author: Ulf Hansson Date: Wed Jan 22 15:27:45 2020 +0100 mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC The timeout values used while waiting for a CMD6 for BKOPS or a CACHE_FLUSH to complete, are not defined by the eMMC spec. However, a timeout of 10 minutes as is currently being used, is just silly for both of these cases. Instead, let's specify more reasonable timeouts, 120s for BKOPS and 30s for CACHE_FLUSH. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200122142747.5690-2-ulf.hansson@linaro.org commit 1d45a3f47c0be28989cdbace166e4f73214ff88c Author: Masahiro Yamada Date: Tue Jan 21 19:58:58 2020 +0900 mmc: sdhci-cadence: remove unneeded 'inline' marker 'static inline' in .c files does not make much sense because functions may or may not be inlined irrespective of the 'inline' marker. It is just a hint. This function is quite small, so very likely to be inlined by the compiler's optimization (-O2 or -Os), but it is up to the compiler after all. Signed-off-by: Masahiro Yamada Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20200121105858.13325-1-yamada.masahiro@socionext.com Signed-off-by: Ulf Hansson commit be28d4da7c73f51d4ccd5c3f9cd215d0858bc8c8 Author: Benoit Parrot Date: Wed Dec 11 08:05:58 2019 -0600 arm64: dts: ti: k3-am654-base-board: Add CSI2 OV5640 camera Add support for the OV5640 CSI camera: - add the OV5640 nodes - add the CAL node linkage - enable CAL node Signed-off-by: Benoit Parrot Signed-off-by: Tero Kristo commit e98a0424817a08e2e62bdb1cc49de8da38bf6a3d Author: Benoit Parrot Date: Wed Dec 11 08:05:57 2019 -0600 arm64: dts: ti: k3-am65-main Add CAL node Add CAL dtsi node for AM654 device. Including proper power-domains and clock properties. Signed-off-by: Benoit Parrot Signed-off-by: Tero Kristo commit c389b0035f0cda5f59f2514303feb9586b6f493a Author: Johan Jonker Date: Thu Jan 16 16:22:30 2020 +0100 dt-bindings: mmc: rockchip-dw-mshc: add description for rk3308 The description below is already in use for rk3308.dtsi, but was somehow never added to a document, so add "rockchip,rk3308-dw-mshc", "rockchip,rk3288-dw-mshc" for mmc nodes on a rk3308 platform to rockchip-dw-mshc.yaml. Signed-off-by: Johan Jonker Acked-by: Rob Herring Link: https://lore.kernel.org/r/20200116152230.29831-3-jbx6244@gmail.com Signed-off-by: Ulf Hansson commit 1eece23dba3230572d9c64fd530167aac8ada2f7 Author: Johan Jonker Date: Thu Jan 16 16:22:29 2020 +0100 dt-bindings: mmc: convert rockchip dw-mshc bindings to yaml Current dts files with 'dwmmc' nodes are manually verified. In order to automate this process rockchip-dw-mshc.txt has to be converted to yaml. In the new setup rockchip-dw-mshc.yaml will inherit properties from mmc-controller.yaml and synopsys-dw-mshc-common.yaml. 'dwmmc' will no longer be a valid name for a node and should be changed to 'mmc'. Signed-off-by: Johan Jonker Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20200116152230.29831-2-jbx6244@gmail.com Signed-off-by: Ulf Hansson commit 8655ff21c8ce6e6332166d518c2444652f0b99b6 Author: Johan Jonker Date: Thu Jan 16 16:22:28 2020 +0100 dt-bindings: mmc: convert synopsys dw-mshc bindings to yaml Current dts files with 'dwmmc' nodes are manually verified. In order to automate this process synopsys-dw-mshc.txt has to be converted to yaml. In the new setup synopsys-dw-mshc.yaml will inherit properties from mmc-controller.yaml and synopsys-dw-mshc-common.yaml. 'dwmmc' will no longer be a valid name for a node and should be changed to 'mmc'. Signed-off-by: Johan Jonker Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20200116152230.29831-1-jbx6244@gmail.com Signed-off-by: Ulf Hansson commit 87a8df0dce6ad0af14c08858fa51dfcc8c509ab3 Author: Ritesh Harjani Date: Thu Jan 16 22:33:11 2020 +0530 mmc: sdhci-msm: Add CQHCI support for sdhci-msm This adds CQHCI support for sdhci-msm platforms. Signed-off-by: Ritesh Harjani Signed-off-by: Veerabhadrarao Badiganti Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/1579194192-7942-3-git-send-email-vbadigan@codeaurora.org Signed-off-by: Ulf Hansson commit a663f64bf18dea0816642ff343c5e3bf8fb22fca Author: Veerabhadrarao Badiganti Date: Mon Jan 20 20:08:38 2020 +0530 mmc: sdhci: Let a vendor driver supply and update ADMA descriptor size Let a vendor driver supply the maximum descriptor size that it can operate on. ADMA descriptor table would be allocated using this supplied size. If any SD Host controller is of version prior to v4.10 spec but supports 16byte descriptor, this change allows them to supply correct descriptor size for ADMA table allocation. Also let a vendor driver update the descriptor size by overriding sdhc_host->desc_size if it has to operates on a different descriptor sizes in different conditions. Suggested-by: Adrian Hunter Signed-off-by: Veerabhadrarao Badiganti Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/1579531122-28341-1-git-send-email-vbadigan@codeaurora.org Signed-off-by: Ulf Hansson commit 41258289a8e9e3e110bab316e0aeded25fa8beb6 Author: Andrii Nakryiko Date: Thu Jan 23 21:43:17 2020 -0800 bpftool: Print function linkage in BTF dump Add printing out BTF_KIND_FUNC's linkage. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20200124054317.2459436-1-andriin@fb.com commit 03506297d205e5fa25b5ead0f6338b5a4a996a93 Author: Andrii Nakryiko Date: Thu Jan 23 21:41:48 2020 -0800 selftests/bpf: Improve bpftool changes detection Detect when bpftool source code changes and trigger rebuild within selftests/bpf Makefile. Also fix few small formatting problems. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20200124054148.2455060-1-andriin@fb.com commit 1a6fa10640d97e16d4184fa1c24aa8c3337d4653 Author: John Sperbeck Date: Thu Jan 23 15:51:44 2020 -0800 selftests/bpf: Initialize duration variable before using The 'duration' variable is referenced in the CHECK() macro, and there are some uses of the macro before 'duration' is set. The clang compiler (validly) complains about this. Sample error: .../selftests/bpf/prog_tests/fexit_test.c:23:6: warning: variable 'duration' is uninitialized when used here [-Wuninitialized] if (CHECK(err, "prog_load sched cls", "err %d errno %d\n", err, errno)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .../selftests/bpf/test_progs.h:134:25: note: expanded from macro 'CHECK' if (CHECK(err, "prog_load sched cls", "err %d errno %d\n", err, errno)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _CHECK(condition, tag, duration, format) ^~~~~~~~ Signed-off-by: John Sperbeck Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20200123235144.93610-1-sdf@google.com commit fc157998b8257fb9cfe753e7f4af1411da995c9b Author: Christian Gromm Date: Thu Jan 23 16:38:23 2020 +0100 staging: most: usb: check for NULL device Check if the dci structer has been allocated before trying to release it. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-8-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit f9e6b51a998da782cfc201dc9309d3a3d8579fef Author: Christian Gromm Date: Thu Jan 23 16:38:22 2020 +0100 staging: next: configfs: fix release link The functions link_destroy and link_release are both deleting list items. link_release, however, does not check whether a certain link has already been deleted from the list by function link_destroy. By fixing this this patch prevents a kernel crash when removing the configuration directory of a link that already has been destroyed. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-7-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit b7935e52dd98696a8c1379f5b67b0c344ee3bc35 Author: Christian Gromm Date: Thu Jan 23 16:38:21 2020 +0100 staging: most: core: fix logging messages This patch fixes the module's logging messages. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-6-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit d693e90d897854b09b9267350920cda964a66c11 Author: Christian Gromm Date: Thu Jan 23 16:38:20 2020 +0100 staging: most: core: remove container struct This patch declares and initializes the bus, bus driver and the component list without a container struct, as it introduces an unnecessary level of abstraction. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-5-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit 6a82c7758129441e7450703e6887d6cde003ff85 Author: Christian Gromm Date: Thu Jan 23 16:38:19 2020 +0100 staging: most: remove struct device core driver This patch removes the device from the MOST core driver and uses the device from the adapter driver. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-4-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit 2485055394be272d098ca7dd63193d5041fb8140 Author: Christian Gromm Date: Thu Jan 23 16:38:18 2020 +0100 staging: most: core: drop device reference This patch drops the device reference added by function bus_find_device_by_name. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-3-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c Author: Christian Gromm Date: Thu Jan 23 16:38:17 2020 +0100 staging: most: remove device from interface structure This patch makes the adapter drivers use their own device structures when registering a most interface with the core module. With this the module that actually operates the physical device is the owner of the device. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1579793906-5054-2-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit 85db1cde825344cc1419d3adadaf4187154ad687 Author: Hans de Goede Date: Wed Jan 15 17:35:47 2020 +0100 firmware: Rename FW_OPT_NOFALLBACK to FW_OPT_NOFALLBACK_SYSFS This is a preparation patch for adding a new platform fallback mechanism, which will have its own enable/disable FW_OPT_xxx option. Note this also fixes a typo in one of the re-wordwrapped comments: enfoce -> enforce. Acked-by: Luis Chamberlain Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200115163554.101315-4-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit 2406a307ac7ddfd7effeeaff6947149ec6a95b4e Author: Jiufei Xue Date: Wed Nov 20 17:45:26 2019 +0800 ovl: implement async IO routines A performance regression was observed since linux v4.19 with aio test using fio with iodepth 128 on overlayfs. The queue depth of the device was always 1 which is unexpected. After investigation, it was found that commit 16914e6fc7e1 ("ovl: add ovl_read_iter()") and commit 2a92e07edc5e ("ovl: add ovl_write_iter()") resulted in vfs_iter_{read,write} being called on underlying filesystem, which always results in syncronous IO. Implement async IO for stacked reading and writing. This resolves the performance regresion. This is implemented by allocating a new kiocb for submitting the AIO request on the underlying filesystem. When the request is completed, the new kiocb is freed and the completion callback is called on the original iocb. Signed-off-by: Jiufei Xue Signed-off-by: Miklos Szeredi commit 5dcdc43e24a1810d3c3f4959af3d0c8e0026d863 Author: Jiufei Xue Date: Wed Nov 20 17:45:25 2019 +0800 vfs: add vfs_iocb_iter_[read|write] helper functions This doesn't cause any behavior changes and will be used by overlay async IO implementation. Signed-off-by: Jiufei Xue Signed-off-by: Miklos Szeredi commit 1346416564f06444ca59778c05607bedb91a991a Author: Miklos Szeredi Date: Fri Jan 24 09:46:45 2020 +0100 ovl: layer is const The ovl_layer struct is never modified except at initialization. Signed-off-by: Miklos Szeredi commit b7bf9908e17c4dc4b80876f299ac03ddf188efd9 Author: Amir Goldstein Date: Tue Jan 14 22:17:25 2020 +0200 ovl: fix corner case of non-constant st_dev;st_ino On non-samefs overlay without xino, non pure upper inodes should use a pseudo_dev assigned to each unique lower fs, but if lower layer is on the same fs and upper layer, it has no pseudo_dev assigned. In this overlay layers setup: - two filesystems, A and B - upper layer is on A - lower layer 1 is also on A - lower layer 2 is on B Non pure upper overlay inode, whose origin is in layer 1 will have the st_dev;st_ino values of the real lower inode before copy up and the st_dev;st_ino values of the real upper inode after copy up. Fix this inconsitency by assigning a unique pseudo_dev also for upper fs, that will be used as st_dev value along with the lower inode st_dev for overlay inodes in the case above. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 1b81dddd354cf304574d79004400a6385613ae4e Author: Amir Goldstein Date: Sat Nov 16 18:52:20 2019 +0200 ovl: fix corner case of conflicting lower layer uuid This fixes ovl_lower_uuid_ok() to correctly detect the corner case: - two filesystems, A and B, both have null uuid - upper layer is on A - lower layer 1 is also on A - lower layer 2 is on B In this case, bad_uuid would not have been set for B, because the check only involved the list of lower fs. Hence we'll try to decode a layer 2 origin on layer 1 and fail. We check for conflicting (and null) uuid among all lower layers, including those layers that are on the same fs as the upper layer. Reported-by: Miklos Szeredi Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 07f1e59637a8e5a8bddba5da7567d46635da510f Author: Amir Goldstein Date: Tue Jan 14 21:59:22 2020 +0200 ovl: generalize the lower_fs[] array Rename lower_fs[] array to fs[], extend its size by one and use index fsid (instead of fsid-1) to access the fs[] array. Initialize fs[0] with upper fs values. fsid 0 is reserved even with lower only overlay, so fs[0] remains null in this case. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 0f831ec85eda1ae27490baba106aba632c1d8e94 Author: Amir Goldstein Date: Sat Nov 16 18:14:41 2019 +0200 ovl: simplify ovl_same_sb() helper No code uses the sb returned from this helper, so make it retrun a boolean and rename it to ovl_same_fs(). The xino mode is irrelevant when all layers are on same fs, so instead of describing samefs with mode OVL_XINO_OFF, use a new xino_mode state, which is 0 in the case of samefs, -1 in the case of xino=off and > 0 with xino enabled. Create a new helper ovl_same_dev(), to use instead of the common check for (ovl_same_fs() || xinobits). Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 880082666c8d08909bca0a3ea0d7162781f22786 Author: Peter Chen Date: Thu Jan 16 11:28:53 2020 +0800 Doc: ABI: add usb charger uevent When the USB charger is inserted or removed, the users could get USB charger state and type through the uevent. Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/1579145333-1657-2-git-send-email-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit 3bdcfe6c1d90b343c3de5fffdc83d988e76f8679 Author: Peter Chen Date: Thu Jan 16 11:28:52 2020 +0800 usb: phy: show USB charger type for user Current USB charger framework only shows charger state for user, but the user may also need charger type for further use, add support for it. Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/1579145333-1657-1-git-send-email-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit c120431347246fe481b73026cad49920f705e92f Author: Colin Ian King Date: Wed Jan 22 23:44:37 2020 +0000 usb: cdns3: fix spelling mistake and rework grammar in text The text contains a spelling mistake, "to" should be "too" so fix this and re-work the grammar to make it more readable. Signed-off-by: Colin Ian King Acked-by: Felipe Balbi Link: https://lore.kernel.org/r/20200122234437.2829803-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 0db4a15d4c2787b1112001790d4f95bd2c5fed6f Author: Tomas Winkler Date: Fri Jan 24 02:14:55 2020 +0200 mei: me: add jasper point DID Add Jasper Point (Jasper Lake) device id for MEI Signed-off-by: Tomas Winkler Cc: stable Link: https://lore.kernel.org/r/20200124001455.24176-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 4543bdc08857e8026475a477e7ba88e461f38271 Author: Sean Christopherson Date: Wed Dec 18 13:55:14 2019 -0800 KVM: Introduce kvm_vcpu_destroy() Add kvm_vcpu_destroy() and wire up all architectures to call the common function instead of their arch specific implementation. The common destruction function will be used by future patches to move allocation and initialization of vCPUs to common KVM code, i.e. to free resources that are allocated by arch agnostic code. No functional change intended. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit d2423b347de46657c306d4c58f2e08feba4a19c4 Author: Sean Christopherson Date: Wed Dec 18 13:55:13 2019 -0800 KVM: x86: Invoke kvm_vcpu_uninit() immediately prior to freeing vcpu Move the call to kvm_vcpu_uninit() in kvm_arch_vcpu_destroy() down a few lines so that it is invoked immediately prior to freeing the vCPU. This paves the way for moving the uninit and free sequence to common KVM code without an associated functional change. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit aaf532c57927982b2523994698f994255a722f5f Author: Sean Christopherson Date: Wed Dec 18 13:55:12 2019 -0800 KVM: MIPS: Invoke kvm_vcpu_uninit() immediately prior to freeing vcpu Move the call to kvm_vcpu_uninit() in kvm_arch_vcpu_destroy() down a few lines so that it is invoked immediately prior to freeing the vCPU. This paves the way for moving the uninit and free sequence to common KVM code without an associated functional change. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a2017f17fa175b812ce7de302316f67e8f2b7db0 Author: Sean Christopherson Date: Wed Dec 18 13:55:11 2019 -0800 KVM: s390: Invoke kvm_vcpu_init() before allocating sie_page Now that s390's implementation of kvm_arch_vcpu_init() is empty, move the call to kvm_vcpu_init() above the allocation of the sie_page. This paves the way for moving vcpu allocation and initialization into common KVM code without any associated functional change. Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 321f8ee559d697d69efa81e8b6d4ea1e487c8bcc Author: Sean Christopherson Date: Wed Dec 18 13:55:10 2019 -0800 KVM: s390: Move guts of kvm_arch_vcpu_init() into kvm_arch_vcpu_create() Move all of kvm_arch_vcpu_init(), which is invoked at the very end of kvm_vcpu_init(), into kvm_arch_vcpu_create() in preparation of moving the call to kvm_vcpu_init(). Moving kvm_vcpu_init() is itself a preparatory step for moving allocation and initialization to common KVM code. No functional change inteded. Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit 897cc38eaab96d006ab17edd0f50a2f432f584cf Author: Sean Christopherson Date: Wed Dec 18 13:55:09 2019 -0800 KVM: Add kvm_arch_vcpu_precreate() to handle pre-allocation issues Add a pre-allocation arch hook to handle checks that are currently done by arch specific code prior to allocating the vCPU object. This paves the way for moving the allocation to common KVM code. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini commit fe931f12277186d1a9d38ba6729b42e8edb68988 Author: Sean Christopherson Date: Wed Dec 18 13:55:08 2019 -0800 KVM: Remove kvm_arch_vcpu_free() declaration Remove KVM's declaration of kvm_arch_vcpu_free() now that the function is gone from all architectures (several architectures were relying on the forward declaration). Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 50b143e1b3cfb71c38bdd20dd64c98aa3528117f Author: Sean Christopherson Date: Wed Dec 18 13:55:07 2019 -0800 KVM: x86: Drop kvm_arch_vcpu_free() Remove the superfluous kvm_arch_vcpu_free() as it is no longer called from commmon KVM code. Note, kvm_arch_vcpu_destroy() *is* called from common code, i.e. choosing which function to whack is not completely arbitrary. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 208050dac5ef4de5cb83ffcafa78499c94d0b5ad Author: Sean Christopherson Date: Wed Dec 18 13:55:06 2019 -0800 KVM: x86: Remove spurious clearing of async #PF MSR Remove a bogus clearing of apf.msr_val from kvm_arch_vcpu_destroy(). apf.msr_val is only set to a non-zero value by kvm_pv_enable_async_pf(), which is only reachable by kvm_set_msr_common(), i.e. by writing MSR_KVM_ASYNC_PF_EN. KVM does not autonomously write said MSR, i.e. can only be written via KVM_SET_MSRS or KVM_RUN. Since KVM_SET_MSRS and KVM_RUN are vcpu ioctls, they require a valid vcpu file descriptor. kvm_arch_vcpu_destroy() is only called if KVM_CREATE_VCPU fails, and KVM declares KVM_CREATE_VCPU successful once the vcpu fd is installed and thus visible to userspace. Ergo, apf.msr_val cannot be non-zero when kvm_arch_vcpu_destroy() is called. Fixes: 344d9588a9df0 ("KVM: Add PV MSR to enable asynchronous page faults delivery.") Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 9d979c7e6ff43ca3200ffcb74f57415fd633a2da Author: Sean Christopherson Date: Wed Dec 18 13:55:05 2019 -0800 KVM: x86: Remove spurious kvm_mmu_unload() from vcpu destruction path x86 does not load its MMU until KVM_RUN, which cannot be invoked until after vCPU creation succeeds. Given that kvm_arch_vcpu_destroy() is called if and only if vCPU creation fails, it is impossible for the MMU to be loaded. Note, the bogus kvm_mmu_unload() call was added during an unrelated refactoring of vCPU allocation, i.e. was presumably added as an opportunstic "fix" for a perceived leak. Fixes: fb3f0f51d92d1 ("KVM: Dynamically allocate vcpus") Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 4b8fff780b07570993a966475b7500b6964cd91e Author: Sean Christopherson Date: Wed Dec 18 13:55:04 2019 -0800 KVM: arm: Drop kvm_arch_vcpu_free() Remove the superfluous kvm_arch_vcpu_free() as it is no longer called from commmon KVM code. Note, kvm_arch_vcpu_destroy() *is* called from common code, i.e. choosing which function to whack is not completely arbitrary. Acked-by: Christoffer Dall Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d5279f3a882c3c5b57703b602d872d3bc7ffa51d Author: Sean Christopherson Date: Wed Dec 18 13:55:03 2019 -0800 KVM: PPC: Drop kvm_arch_vcpu_free() Remove the superfluous kvm_arch_vcpu_free() as it is no longer called from commmon KVM code. Note, kvm_arch_vcpu_destroy() *is* called from common code, i.e. choosing which function to whack is not completely arbitrary. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 47d51e5eb5fe0bd7440cf7f1217936e2d85c63cf Author: Sean Christopherson Date: Wed Dec 18 13:55:02 2019 -0800 KVM: MIPS: Drop kvm_arch_vcpu_free() Remove the superfluous kvm_arch_vcpu_free() as it is no longer called from commmon KVM code. Note, kvm_arch_vcpu_destroy() *is* called from common code, i.e. choosing which function to whack is not completely arbitrary. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 5233009fab8e0a037c38a8c2b28ba4b3df203935 Author: Sean Christopherson Date: Wed Dec 18 13:55:01 2019 -0800 KVM: MIPS: Use kvm_vcpu_cache to allocate vCPUs For reasons unknown, MIPS configures the vCPU allocation cache but allocates vCPUs via kzalloc(). Allocate from the vCPU cache in preparation for moving vCPU allocation to common KVM code. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit ff030fdf55732266c2d35b1a4a0baaf9ce49e9dd Author: Sean Christopherson Date: Wed Dec 18 13:55:00 2019 -0800 KVM: PPC: Move kvm_vcpu_init() invocation to common code Move the kvm_cpu_{un}init() calls to common PPC code as an intermediate step towards removing kvm_cpu_{un}init() altogether. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 4dbf6fec78868ef02e8bf32834f16b22f58723f5 Author: Sean Christopherson Date: Wed Dec 18 13:54:59 2019 -0800 KVM: PPC: e500mc: Move reset of oldpir below call to kvm_vcpu_init() Move the initialization of oldpir so that the call to kvm_vcpu_init() is at the top of kvmppc_core_vcpu_create_e500mc(). oldpir is only use when loading/putting a vCPU, which currently cannot be done until after kvm_arch_vcpu_create() completes. Reording the call to kvm_vcpu_init() paves the way for moving the invocation to common PPC code. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d30769522294fbbd182659614bda16b5da231413 Author: Sean Christopherson Date: Wed Dec 18 13:54:58 2019 -0800 KVM: PPC: Book3S PR: Allocate book3s and shadow vcpu after common init Call kvm_vcpu_init() in kvmppc_core_vcpu_create_pr() prior to allocating the book3s and shadow_vcpu objects in preparation of moving said call to common PPC code. Although kvm_vcpu_init() has an arch callback, the callback is empty for Book3S PR, i.e. barring unseen black magic, moving the allocation has no real functional impact. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit c50bfbdc38ec56cf8e53afb4f9ebb600dfcabd49 Author: Sean Christopherson Date: Wed Dec 18 13:54:57 2019 -0800 KVM: PPC: Allocate vcpu struct in common PPC code Move allocation of all flavors of PPC vCPUs to common PPC code. All variants either allocate 'struct kvm_vcpu' directly, or require that the embedded 'struct kvm_vcpu' member be located at offset 0, i.e. guarantee that the allocation can be directly interpreted as a 'struct kvm_vcpu' object. Remove the message from the build-time assertion regarding placement of the struct, as compatibility with the arch usercopy region is no longer the sole dependent on 'struct kvm_vcpu' being at offset zero. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 3ec8ca29647078db11a820ab22855dd64d9a4897 Author: Sean Christopherson Date: Wed Dec 18 13:54:56 2019 -0800 KVM: PPC: e500mc: Add build-time assert that vcpu is at offset 0 In preparation for moving vcpu allocation to common PPC code, add an explicit, albeit redundant, build-time assert to ensure the vcpu member is located at offset 0. The assert is redundant in the sense that kvmppc_core_vcpu_create_e500() contains a functionally identical assert. The motiviation for adding the extra assert is to provide visual confirmation of the correctness of moving vcpu allocation to common code. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 987b2594ed5d128c95c5255a9c7755f7480bf407 Author: Sean Christopherson Date: Wed Dec 18 13:54:55 2019 -0800 KVM: x86: Move kvm_vcpu_init() invocation to common code Move the kvm_cpu_{un}init() calls to common x86 code as an intermediate step to removing kvm_cpu_{un}init() altogether. Note, VMX'x alloc_apic_access_page() and init_rmode_identity_map() are per-VM allocations and are intentionally kept if vCPU creation fails. They are freed by kvm_arch_destroy_vm(). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d813a8ba54f94fd6a0276230bdf53c97b36c2101 Author: Sean Christopherson Date: Wed Dec 18 13:54:54 2019 -0800 KVM: x86: Move allocation of pio_data page down a few lines Allocate the pio_data page after creating the MMU and local APIC so that all direct memory allocations are grouped together. This allows setting the return value to -ENOMEM prior to starting the allocations instead of setting it in the fail path for every allocation. The pio_data page is only consumed when KVM_RUN is invoked, i.e. moving its allocation has no real functional impact. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit fc6e2a1845abfcfa335aef5ffaac664e104d72ca Author: Sean Christopherson Date: Wed Dec 18 13:54:53 2019 -0800 KVM: x86: Move FPU allocation to common x86 code The allocation of FPU structs is identical across VMX and SVM, move it to common x86 code. Somewhat arbitrarily place the allocation so that it resides directly above the associated initialization via fx_init(), e.g. instead of retaining its position with respect to the overall vcpu creation flow. Although the names names kvm_arch_vcpu_create() and kvm_arch_vcpu_init() might suggest otherwise, x86 does not have a clean split between 'create' and 'init'. Allocating the struct immediately prior to the first use arguably improves readability *now*, and will yield even bigger improvements when kvm_arch_vcpu_init() is removed in a future patch. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a9dd6f09d7e54d3f58be32d7d051196f7a00e69e Author: Sean Christopherson Date: Wed Dec 18 13:54:52 2019 -0800 KVM: x86: Allocate vcpu struct in common x86 code Move allocation of VMX and SVM vcpus to common x86. Although the struct being allocated is technically a VMX/SVM struct, it can be interpreted directly as a 'struct kvm_vcpu' because of the pre-existing requirement that 'struct kvm_vcpu' be located at offset zero of the arch/vendor vcpu struct. Remove the message from the build-time assertions regarding placement of the struct, as compatibility with the arch usercopy region is no longer the sole dependent on 'struct kvm_vcpu' being at offset zero. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 7f27179a88a693f2d357860fddef65704578edf5 Author: Sean Christopherson Date: Wed Dec 18 13:54:51 2019 -0800 KVM: SVM: Use direct vcpu pointer during vCPU create/free Capture the vcpu pointer in a local varaible and replace '&svm->vcpu' references with a direct reference to the pointer in anticipation of moving bits of the code to common x86 and passing the vcpu pointer into svm_create_vcpu(), i.e. eliminate unnecessary noise from future patches. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 34109c0476f10c033945b630a58c087e9d0ef8a0 Author: Sean Christopherson Date: Wed Dec 18 13:54:50 2019 -0800 KVM: VMX: Use direct vcpu pointer during vCPU create/free Capture the vcpu pointer in a local varaible and replace '&vmx->vcpu' references with a direct reference to the pointer in anticipation of moving bits of the code to common x86 and passing the vcpu pointer into vmx_create_vcpu(), i.e. eliminate unnecessary noise from future patches. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 034d8e2cb929ed73e32e2dba98cb8067eab85964 Author: Sean Christopherson Date: Wed Dec 18 13:54:49 2019 -0800 KVM: VMX: Allocate VPID after initializing VCPU Do VPID allocation after calling the common kvm_vcpu_init() as a step towards doing vCPU allocation (via kmem_cache_zalloc()) and calling kvm_vcpu_init() back-to-back. Squishing allocation and initialization together will eventually allow the sequence to be moved to arch-agnostic creation code. Note, the VPID is not consumed until KVM_RUN, slightly delaying its allocation should have no real function impact. VPID allocation was arbitrarily placed in the original patch, commit 2384d2b326408 ("KVM: VMX: Enable Virtual Processor Identification (VPID)"). Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 16be9ddea268ad841457a59109963fff8c9de38d Author: Sean Christopherson Date: Wed Dec 18 13:54:48 2019 -0800 KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails Free the vCPU's wbinvd_dirty_mask if vCPU creation fails after kvm_arch_vcpu_init(), e.g. when installing the vCPU's file descriptor. Do the freeing by calling kvm_arch_vcpu_free() instead of open coding the freeing. This adds a likely superfluous, but ultimately harmless, call to kvmclock_reset(), which only clears vcpu->arch.pv_time_enabled. Using kvm_arch_vcpu_free() allows for additional cleanup in the future. Fixes: f5f48ee15c2ee ("KVM: VMX: Execute WBINVD to keep data consistency with assigned devices") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit cb10bf9194f4d2c5d830eddca861f7ca0fecdbb4 Author: Sean Christopherson Date: Wed Dec 18 13:54:47 2019 -0800 KVM: PPC: Book3S PR: Free shared page if mmu initialization fails Explicitly free the shared page if kvmppc_mmu_init() fails during kvmppc_core_vcpu_create(), as the page is freed only in kvmppc_core_vcpu_free(), which is not reached via kvm_vcpu_uninit(). Fixes: 96bc451a15329 ("KVM: PPC: Introduce shared page") Cc: stable@vger.kernel.org Reviewed-by: Greg Kurz Signed-off-by: Sean Christopherson Acked-by: Paul Mackerras Signed-off-by: Paolo Bonzini commit 1a978d9d3e72ddfa40ac60d26301b154247ee0bc Author: Sean Christopherson Date: Wed Dec 18 13:54:46 2019 -0800 KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails Call kvm_vcpu_uninit() if vcore creation fails to avoid leaking any resources allocated by kvm_vcpu_init(), i.e. the vcpu->run page. Fixes: 371fefd6f2dc4 ("KVM: PPC: Allow book3s_hv guests to use SMT processor modes") Cc: stable@vger.kernel.org Reviewed-by: Greg Kurz Signed-off-by: Sean Christopherson Acked-by: Paul Mackerras Signed-off-by: Paolo Bonzini commit 6441fa6178f5456d1d4b512c08798888f99db185 Author: Paolo Bonzini Date: Mon Jan 20 16:33:06 2020 +0100 KVM: x86: avoid incorrect writes to host MSR_IA32_SPEC_CTRL If the guest is configured to have SPEC_CTRL but the host does not (which is a nonsensical configuration but these are not explicitly forbidden) then a host-initiated MSR write can write vmx->spec_ctrl (respectively svm->spec_ctrl) and trigger a #GP when KVM tries to restore the host value of the MSR. Add a more comprehensive check for valid bits of SPEC_CTRL, covering host CPUID flags and, since we are at it and it is more correct that way, guest CPUID flags too. For AMD, remove the unnecessary is_guest_mode check around setting the MSR interception bitmap, so that the code looks the same as for Intel. Cc: Jim Mattson Signed-off-by: Paolo Bonzini commit 6a24f567af4accef6d73b0be407227c537b94a1f Author: Orson Zhai Date: Tue Jan 21 15:09:38 2020 +0800 mfd: syscon: Add arguments support for syscon reference There are a lot of similar global registers being used across multiple SoCs from Unisoc. But most of these registers are assigned with different offset for different SoCs. It is hard to handle all of them in an all-in-one kernel image. Add a helper function to get regmap with arguments where we could put some extra information such as the offset value. Signed-off-by: Orson Zhai Tested-by: Baolin Wang Reviewed-by: Arnd Bergmann Signed-off-by: Lee Jones commit 2f3dc25c0118de03a00ddc88b61f7216854f534d Author: Andreas Kemnade Date: Fri Jan 17 22:59:22 2020 +0100 mfd: rn5t618: Mark ADC control register volatile There is a bit which gets cleared after conversion. Fixes: 9bb9e29c78f8 ("mfd: Add Ricoh RN5T618 PMIC core driver") Signed-off-by: Andreas Kemnade Signed-off-by: Lee Jones commit aac5d8fec9cae8bcdf1eaf0e9733f8839c8a72b4 Author: Claudiu Beznea Date: Fri Jan 17 13:58:29 2020 +0200 dt-bindings: atmel-usart: Add microchip,sam9x60-{usart, dbgu} Add microchip,sam9x60-usart and add microchip,sam9x60-dbgu to DT bindings documentation. Signed-off-by: Claudiu Beznea Signed-off-by: Lee Jones commit 8334240fa0a63d4e4a872a1a011bbd6138d9dbd0 Author: Claudiu Beznea Date: Fri Jan 17 13:58:28 2020 +0200 dt-bindings: atmel-usart: Remove wildcard Remove chip whildcard and introduce the list of compatibles instead. Signed-off-by: Claudiu Beznea Signed-off-by: Lee Jones commit 4602dce0361ebc67b9bfbed9338eee588e3c7e7e Author: Prashant Malani Date: Tue Jan 14 15:22:20 2020 -0800 mfd: cros_ec: Add cros-usbpd-notify subdevice Add the cros-usbpd-notify driver as a subdevice on platforms that support the EC_FEATURE_USB_PD EC feature flag and don't have the ACPI PD notification device defined. This driver allows other cros-ec devices to receive PD event notifications from the Chrome OS Embedded Controller (EC) via a notification chain. Signed-off-by: Prashant Malani Reviewed-by: Benson Leung Signed-off-by: Lee Jones commit 1112ba02ff1190ca9c15a912f9269e54b46d2d82 Author: Marco Felsch Date: Wed Jan 8 10:57:02 2020 +0100 mfd: da9062: Fix watchdog compatible string The watchdog driver compatible is "dlg,da9062-watchdog" and not "dlg,da9062-wdt". Therefore the mfd-core can't populate the of_node and fwnode. As result the watchdog driver can't parse the devicetree. Fixes: 9b40b030c4ad ("mfd: da9062: Supply core driver") Signed-off-by: Marco Felsch Acked-by: Guenter Roeck Reviewed-by: Adam Thomson Signed-off-by: Lee Jones commit 003035b3eb7085ee7d85f7ed063f10acf66b56d4 Author: Charles Keepax Date: Tue Jan 14 15:10:48 2020 +0000 mfd: madera: Allow more time for hardware reset Both manual and power on resets have a brief period where the chip will not be accessible immediately afterwards. Extend the time allowed for this from a minimum of 1mS to 2mS based on newer evaluation of the hardware and ensure this reset happens in all reset conditions. Whilst making the change also remove the redundant NULL checks in the reset functions as the GPIO functions already check for this. Signed-off-by: Charles Keepax Signed-off-by: Lee Jones commit e9f47591793e9c9abf340077daf3bafbcb0daad0 Author: Charles Keepax Date: Tue Jan 14 15:10:46 2020 +0000 mfd: cs47l15: Add missing register default Accessory detect mode 1 is missing a default, add one to the table. Signed-off-by: Charles Keepax Signed-off-by: Lee Jones commit 7f6d869846eca3800bf0a7fe080260bcc6439c2c Author: Charles Keepax Date: Mon Jan 6 10:28:34 2020 +0000 mfd: madera: Wait for boot done before accessing any other registers It is advised to wait for the boot done bit to be set before reading any other register, update the driver to respect this. Signed-off-by: Charles Keepax Signed-off-by: Lee Jones commit 5e2540c17feb7df510244c1374329d7322392d1c Author: Krzysztof Kozlowski Date: Sat Jan 4 16:21:05 2020 +0100 mfd: Kconfig: Rename Samsung to lowercase Fix up inconsistent usage of upper and lowercase letters in "Samsung" name. "SAMSUNG" is not an abbreviation but a regular trademarked name. Therefore it should be written with lowercase letters starting with capital letter. Although advertisement materials usually use uppercase "SAMSUNG", the lowercase version is used in all legal aspects (e.g. on Wikipedia and in privacy/legal statements on https://www.samsung.com/semiconductor/privacy-global/). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 7ad2915f7a83184e8d492d0b88015a817e772d5d Author: yu kuai Date: Fri Jan 3 20:09:25 2020 +0800 mfd: tqmx86: remove set but not used variable 'i2c_ien' Fixes gcc '-Wunused-but-set-variable' warning: drivers/mfd/tqmx86.c: In function ‘tqmx86_probe’: drivers/mfd/tqmx86.c:161:29: warning: variable ‘i2c_ien’ set but not used I[-Wunused-but-set-variable] It is never used, and so can be removed. Signed-off-by: yu kuai Signed-off-by: Lee Jones commit 2cce09eb11228386260a1b73133aee41f4bb33b1 Author: Linus Walleij Date: Sat Dec 28 23:26:15 2019 +0100 mfd: dbx500-prcmu: Drop DSI pll clock functions The DSI PLLs are handled by the generic clock framework since ages, this code is completely unused and misleading. Delete it. Cc: Stephan Gerhold Cc: Ulf Hansson Signed-off-by: Linus Walleij Signed-off-by: Lee Jones commit f41810921bdca37161a63f689cdcb36155f0fad6 Author: Linus Walleij Date: Sat Dec 28 23:26:14 2019 +0100 mfd: dbx500-prcmu: Drop set_display_clocks() The display clocks are handled by the generic clock framework since ages, this code is completely unused and misleading. Delete it. Cc: Stephan Gerhold Cc: Ulf Hansson Signed-off-by: Linus Walleij Signed-off-by: Lee Jones commit cb7a374a5e7a5af3f8c839f74439193add6d0589 Author: Bartosz Golaszewski Date: Fri Jan 3 12:41:56 2020 +0100 mfd: max77650: Select REGMAP_IRQ in Kconfig MAX77650 MFD driver uses regmap_irq API but doesn't select the required REGMAP_IRQ option in Kconfig. This can cause the following build error if regmap irq is not enabled implicitly by someone else: ld: drivers/mfd/max77650.o: in function `max77650_i2c_probe': max77650.c:(.text+0xcb): undefined reference to `devm_regmap_add_irq_chip' ld: max77650.c:(.text+0xdb): undefined reference to `regmap_irq_get_domain' make: *** [Makefile:1079: vmlinux] Error 1 Fix it by adding the missing option. Fixes: d0f60334500b ("mfd: Add new driver for MAX77650 PMIC") Reported-by: Paul Gazzillo Signed-off-by: Bartosz Golaszewski Signed-off-by: Lee Jones commit dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 Author: Samuel Holland Date: Sat Jan 4 19:24:08 2020 -0600 mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile On AXP288 and newer PMICs, bit 7 of AXP20X_VBUS_IPSOUT_MGMT can be set to prevent using the VBUS input. However, when the VBUS unplugged and plugged back in, the bit automatically resets to zero. We need to set the register as volatile to prevent regmap from caching that bit. Otherwise, regcache will think the bit is already set and not write the register. Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges") Cc: stable@vger.kernel.org Signed-off-by: Samuel Holland Reviewed-by: Chen-Yu Tsai Signed-off-by: Lee Jones commit 702204c22c53f94b2e25a3bdcda759cce7b26305 Author: Linus Walleij Date: Wed Dec 11 12:46:39 2019 +0100 mfd: ab8500: Fix ab8500-clk typo Commit f4d41ad84433 ("mfd: ab8500: Example using new OF_MFD_CELL MACRO") has a typo error renaming "ab8500-clk" to "abx500-clk" with the result att ALSA SoC audio broke as the clock driver was not probing anymore. Fixed it up. Fixes: f4d41ad84433 ("mfd: ab8500: Example using new OF_MFD_CELL MACRO") Signed-off-by: Linus Walleij Reviewed-by: Stephan Gerhold Signed-off-by: Lee Jones commit 57b89dd220be5e48bdbf0352a673db5ef4bc905e Author: Andy Shevchenko Date: Mon Dec 9 16:15:07 2019 +0200 mfd: intel-lpss: Add Intel Jasper Lake PCI IDs Intel Jasper Lake has the same LPSS than Intel Ice Lake. Add the new IDs to the list of supported devices. Signed-off-by: Andy Shevchenko Signed-off-by: Lee Jones commit 9b98662e25721e5b1b65937ca803ed51975650cb Author: Matheus Castello Date: Thu Dec 5 12:44:08 2019 -0300 dt-bindings: mfd: max14577: Add reference to max14040_battery.txt descriptions max77836 MFD has a fuel gauge that has a low SOC alert feature that is described in: Documentation/devicetree/bindings/power/supply/max17040_battery.txt Adding the reference to the documentation here. Signed-off-by: Matheus Castello Acked-by: Rob Herring Reviewed-by: Krzysztof Kozlowski [Lee: Fix relative path] Signed-off-by: Lee Jones commit 1c0769d2093518b192a36eebab9134d597d4bc02 Author: Stephan Gerhold Date: Sun Nov 17 23:10:53 2019 +0100 mfd: ab8500-core: Add device tree support for AB8505 AB8505 support was never fully converted to the device tree. Most of the MFD cells for AB8505 lack an "of_compatible", which prevents them from being configured through the device tree. Align the definition of the AB8505 MFD cells with the ones for AB8500, and add device tree compatibles. Except for GPIO and regulators the compatibles are equal to those used for AB8500 because the hardware does not differ much. Finally, change db8500_prcmu_register_ab8500() to check for the AB8505 device tree node additionally, and probe it if it is found. Signed-off-by: Stephan Gerhold Reviewed-by: Linus Walleij Signed-off-by: Lee Jones commit 1c2f57d3391d32469cf1bcd2d29206107842dadd Author: Stephan Gerhold Date: Sun Nov 17 23:10:52 2019 +0100 dt-bindings: mfd: ab8500: Document AB8505 bindings AB8505 can now be configured from the device tree. The configuration is almost identical to AB8500, so just add a note for the nodes/compatibles that differ between the two revisions. Signed-off-by: Stephan Gerhold Reviewed-by: Linus Walleij Reviewed-by: Rob Herring Signed-off-by: Lee Jones commit 2b091ce1f62a7ab592fb3ede53e71c348225a721 Author: Paul Kocialkowski Date: Thu Nov 28 16:54:35 2019 +0100 dt-bindings: mfd: Document the Xylon LogiCVC multi-function device The LogiCVC is a display engine which also exposes GPIO functionality. For this reason, it is described as a multi-function device that is expected to provide register access to its children nodes for gpio and display. Signed-off-by: Paul Kocialkowski Reviewed-by: Rob Herring Signed-off-by: Lee Jones commit c5f45619cfe62539739a2a0860799937a30a750e Author: Marco Felsch Date: Thu Dec 12 17:04:11 2019 +0100 dt-bindings: mfd: da9062: add gpio bindings Add gpio device documentation to make the da9062 gpios available for users. Signed-off-by: Marco Felsch Reviewed-by: Adam Thomson Signed-off-by: Lee Jones commit 1ea9bd88eeffd4e4505f3f93102bd4dad9f2471d Author: Marco Felsch Date: Thu Dec 12 17:04:12 2019 +0100 mfd: da9062: add support for the DA9062 GPIOs in the core Currently the da9062 GPIO's aren't available. The patch adds the support to make these available by adding a gpio device with the corresponding irq resources. Furthermore the patch fixes a minor style issue for the onkey device. Signed-off-by: Marco Felsch Acked-by: Linus Walleij Reviewed-by: Adam Thomson Signed-off-by: Lee Jones commit 2b8bd606b1e60ca28c765f69c1eedd7d2a2e9dca Author: Oliver Neukum Date: Thu Nov 21 11:28:10 2019 +0100 mfd: dln2: More sanity checking for endpoints It is not enough to check for the number of endpoints. The types must also be correct. Reported-and-tested-by: syzbot+48a2851be24583b864dc@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Reviewed-by: Greg Kroah-Hartman Signed-off-by: Lee Jones commit b88aa8509828b56919b3cb0901803354fc156320 Author: Chuhong Yuan Date: Sat Nov 16 23:13:08 2019 +0800 mfd: sm501: Fix mismatches of request_mem_region This driver misuses release_resource + kfree to match request_mem_region, which is incorrect. The right way is to use release_mem_region. Replace the mismatched calls with the right ones to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: Lee Jones commit f2a19c5b78670af5986ab0a625631f8f8a6adac1 Author: Andy Shevchenko Date: Fri Nov 15 10:49:30 2019 +0200 mfd: syscon: Re-use resource_size() to count max_register Instead of open coded variant use resource_size() and replace weird '- 3' to more understandable '- 4'. Signed-off-by: Andy Shevchenko Acked-by: Arnd Bergmann Signed-off-by: Lee Jones commit 18490cdb9e321a62a9c2cac6fb506843cbc84926 Merge: 10f916766436 c31f625d06c9 Author: Lee Jones Date: Fri Jan 24 07:33:25 2020 +0000 Merge branches 'ib-mfd-drm-5.6' and 'ib-mfd-clk-gpio-regulator-rtc-5.6' into ibs-for-mfd-merged commit 1c4d35265fb2945c1c4bf2628c81cbc8231afe7f Author: Peter Ujfalusi Date: Thu Jan 23 13:45:28 2020 +0200 arm64: dts: ti: k3-j721e-main: Add McASP nodes Add the nodes for McASP 0-11 and keep them disabled because several required properties are not present as they are board specific. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 9bcb631e9953bb434e58a414ee1f5ae93924735e Author: Peter Ujfalusi Date: Thu Jan 23 13:45:27 2020 +0200 arm64: dts: ti: k3-am654-main: Add McASP nodes Add the nodes for McASP 0-2 and keep them disabled because several required properties are not present as they are board specific. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 6f73c1e599c422e9c3d21287e7b991216798078d Author: Peter Ujfalusi Date: Thu Jan 23 13:45:26 2020 +0200 arm64: dts: ti: k3-j721e: DMA support Add the ringacc and udmap nodes for main and mcu NAVSS. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 515c034013542b892fd8468b3b1df8a9bb036978 Author: Peter Ujfalusi Date: Thu Jan 23 13:45:25 2020 +0200 arm64: dts: ti: k3-j721e-main: Move secure proxy and smmu under main_navss Secure proxy (NAVSS0_SEC_PROXY0) and smmu (NAVSS0_TCU) is part of the Navigator Subsystem. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit ab641f2811dd9f142c140745da42dc2076d5069e Author: Peter Ujfalusi Date: Thu Jan 23 13:45:24 2020 +0200 arm64: dts: ti: k3-j721e-main: Correct main NAVSS representation NAVSS is a subsystem containing different IPs, it is not really a bus. Change the compatible from "simple-bus" to "simple-mfd" to reflect that. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 8c0deacaf40b523820419ac749cd955bfd66c6c7 Author: Peter Ujfalusi Date: Thu Jan 23 13:45:23 2020 +0200 arm64: dts: ti: k3-j721e: Correct the address for MAIN NAVSS On am654 the MAIN NAVSS base address was 0x30800000, but in j721e it is at 0x30000000 Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 3d6230548c308c5fcb10f567ff44e6f23567f719 Author: Peter Ujfalusi Date: Thu Jan 23 13:45:22 2020 +0200 arm64: dts: ti: k3-am65: DMA support Add the ringacc and udmap nodes for main and mcu NAVSS. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 12f207003c53edeefeb8afd383e988d354eca76e Author: Peter Ujfalusi Date: Thu Jan 23 13:45:21 2020 +0200 arm64: dts: ti: k3-am65-main: Move secure proxy under cbass_main_navss Secure proxy (NAVSS0_SEC_PROXY0) is part of the Navigator Subsystem. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 2daaa180148602e16eb7ec0ab5dde0ad666659dc Author: Peter Ujfalusi Date: Thu Jan 23 13:45:20 2020 +0200 arm64: dts: ti: k3-am65-main: Correct main NAVSS representation NAVSS is a subsystem containing different IPs, it is not really a bus. Change the compatible from "simple-bus" to "simple-mfd" to reflect that. Signed-off-by: Peter Ujfalusi Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit c31f625d06c9166f753a2f21ac9c3f859647ca9f Author: Matti Vaittinen Date: Mon Jan 20 15:47:37 2020 +0200 gpio: bd71828: Initial support for ROHM BD71828 PMIC GPIOs ROHM BD71828 PMIC contains 4 pins which can be configured by OTP to be used for general purposes. First 3 can be used as outputs and 4.th pin can be used as input. Allow them to be controlled via GPIO framework. The driver assumes all of the pins are configured as GPIOs and trusts that the reserved pins in other OTP configurations are excluded from control using "gpio-reserved-ranges" device tree property (or left untouched by GPIO users). Typical use for 4.th pin (input) is to use it as HALL sensor input so that this pin state is toggled when HALL sensor detects LID position change (from close to open or open to close). PMIC HW implements some extra logic which allows PMIC to power-up the system when this pin is toggled. Please see the data sheet for details of GPIO options which can be selected by OTP settings. Signed-off-by: Matti Vaittinen Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Signed-off-by: Lee Jones commit fe5a591b7814ffbc90aff661aeb8264937002f54 Author: Matti Vaittinen Date: Mon Jan 20 15:45:36 2020 +0200 rtc: bd70528: add BD71828 support ROHM BD71828 PMIC RTC block is from many parts similar to one on BD70528. Support BD71828 RTC using BD70528 RTC driver and avoid re-inventing the wheel. Signed-off-by: Matti Vaittinen Acked-by: Alexandre Belloni Signed-off-by: Lee Jones commit 6c883472e1c11cb05561b6dd0c28bb037c2bf2de Author: Matti Vaittinen Date: Mon Jan 20 15:45:11 2020 +0200 mfd: bd70528: Fix hour register mask When RTC is used in 24H mode (and it is by this driver) the maximum hour value is 24 in BCD. This occupies bits [5:0] - which means correct mask for HOUR register is 0x3f not 0x1f. Fix the mask Fixes: 32a4a4ebf768 ("rtc: bd70528: Initial support for ROHM bd70528 RTC") Signed-off-by: Matti Vaittinen Acked-by: Alexandre Belloni Signed-off-by: Lee Jones commit 21b72156ede8b7da0367c6338574c1bc40439157 Author: Matti Vaittinen Date: Mon Jan 20 15:44:45 2020 +0200 regulator: bd718x7: Split driver to common and bd718x7 specific parts Few ROHM PMICs allow setting the voltage states for different system states like RUN, IDLE, SUSPEND and LPSR. States are then changed via SoC specific mechanisms. bd718x7 driver implemented device-tree parsing functions for these state specific voltages. The parsing functions can be re-used by other ROHM chip drivers like bd71828. Split the generic functions from bd718x7-regulator.c to rohm-regulator.c and export them for other modules to use. Signed-off-by: Matti Vaittinen Acked-by: Mark Brown Signed-off-by: Lee Jones commit ae866dec742687b0bff407013b91badba524f7ee Author: Matti Vaittinen Date: Mon Jan 20 15:44:19 2020 +0200 clk: bd718x7: Support ROHM BD71828 clk block BD71828GW is a single-chip power management IC for battery-powered portable devices. Add support for controlling BD71828 clk using bd718x7 driver. Signed-off-by: Matti Vaittinen Acked-by: Stephen Boyd Signed-off-by: Lee Jones commit e795bf725dabc918298e74cb29303ea6783f1874 Author: Matti Vaittinen Date: Mon Jan 20 15:43:55 2020 +0200 mfd: bd71828: Add power-key support Use gpio_keys to send power input-event to user-space when power button (short) press is detected. Signed-off-by: Matti Vaittinen Signed-off-by: Lee Jones commit 1c743ad523bb2f77a43a740a43c3b5bb9cbd82cd Author: Matti Vaittinen Date: Mon Jan 20 15:43:28 2020 +0200 mfd: bd71828: Support ROHM BD71828 PMIC - core BD71828GW is a single-chip power management IC for battery-powered portable devices. The IC integrates 7 buck converters, 7 LDOs, and a 1500 mA single-cell linear charger. Also included is a Coulomb counter, a real-time clock (RTC), 3 GPO/regulator control pins, HALL input and a 32.768 kHz clock gate. Add MFD core driver providing interrupt controller facilities and i2c access to sub device drivers. Signed-off-by: Matti Vaittinen Signed-off-by: Lee Jones commit 8c352e68dd2e50570afe6177d57484366a1cb615 Author: Matti Vaittinen Date: Mon Jan 20 15:43:01 2020 +0200 mfd: bd718x7: Add compatible for BD71850 ROHM BD71850 PMIC is almost identical to BD71847. Main difference is some initial voltage values for regulators. The BD71850 can be handled by BD71847 driver but adding own compatible makes it clearer for one who creates the DT for board containing this PMIC and allows SW to be differentiating PMICs if needed. Signed-off-by: Matti Vaittinen Signed-off-by: Lee Jones commit 1b1c26b24a6e75d96967515e55fba6c9954d4009 Author: Matti Vaittinen Date: Mon Jan 20 15:42:38 2020 +0200 mfd: Rohm PMICs: Use platform_device_id to match MFD sub-devices Thanks to Stephen Boyd I today learned we can use platform_device_id to do device and module matching for MFD sub-devices! Do device matching using the platform_device_id instead of using explicit module_aliases to load modules and custom parent-data field to do module loading and sub-device matching. Cc: Stephen Boyd Signed-off-by: Matti Vaittinen Acked-by: Mark Brown Signed-off-by: Lee Jones commit 1af5332fcf7c7f29eef55a2304b9ca4e5d09050c Author: Matti Vaittinen Date: Mon Jan 20 15:41:12 2020 +0200 dt-bindings: mfd: Document ROHM BD71828 bindings ROHM BD71828 Power management IC integrates 7 buck converters, 7 LDOs, a real-time clock (RTC), 3 GPO/regulator control pins, HALL input and a 32.768 kHz clock gate. Document the dt bindings drivers are using. Signed-off-by: Matti Vaittinen Reviewed-by: Rob Herring Signed-off-by: Lee Jones commit 873e443dd25ae7a9388d634543f8490a987c2095 Author: Matti Vaittinen Date: Mon Jan 20 15:40:47 2020 +0200 dt-bindings: leds: ROHM BD71282 PMIC LED driver Document ROHM BD71828 PMIC LED driver device tree bindings. Signed-off-by: Matti Vaittinen Reviewed-by: Rob Herring Acked-by: Pavel Machek Signed-off-by: Lee Jones commit 71723a96b8b1367fefc18f60025dae792477d602 Author: Geert Uytterhoeven Date: Fri Jan 17 16:30:56 2020 +0100 dmaengine: Create symlinks between DMA channels and slaves Currently it is not easy to find out which DMA channels are in use, and which slave devices are using which channels. Fix this by creating two symlinks between the DMA channel and the actual slave device when a channel is requested: 1. A "slave" symlink from DMA channel to slave device, 2. A "dma:" symlink slave device to DMA channel. When the channel is released, the symlinks are removed again. The latter requires keeping track of the slave device and the channel name in the dma_chan structure. Note that this is limited to channel request functions for requesting an exclusive slave channel that take a device pointer (dma_request_chan() and dma_request_slave_channel*()). Signed-off-by: Geert Uytterhoeven Tested-by: Niklas Söderlund Link: https://lore.kernel.org/r/20200117153056.31363-1-geert+renesas@glider.be Signed-off-by: Vinod Koul commit e9f08b65250d73ab70e79e194813f52b8d306784 Author: Zhou Wang Date: Thu Jan 16 14:10:57 2020 +0800 dmaengine: hisilicon: Add Kunpeng DMA engine support This patch adds a driver for HiSilicon Kunpeng DMA engine. This DMA engine which is an PCIe iEP offers 30 channels, each channel has a send queue, a complete queue and an interrupt to help to do tasks. This DMA engine can do memory copy between memory blocks or between memory and device buffer. Signed-off-by: Zhou Wang Signed-off-by: Zhenfa Qiu Link: https://lore.kernel.org/r/1579155057-80523-1-git-send-email-wangzhou1@hisilicon.com Signed-off-by: Vinod Koul commit 42d279f9137ab7d5503836baec2739284b278d8f Author: Dave Jiang Date: Tue Jan 21 16:44:29 2020 -0700 dmaengine: idxd: add char driver to expose submission portal to userland Create a char device region that will allow acquisition of user portals in order to allow applications to submit DMA operations. A char device will be created per work queue that gets exposed. The workqueue type "user" is used to mark a work queue for user char device. For example if the workqueue 0 of DSA device 0 is marked for char device, then a device node of /dev/dsa/wq0.0 will be created. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965026985.73301.976523230037106742.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 8f47d1a5e545f903cd049c42da31a3be36178447 Author: Dave Jiang Date: Tue Jan 21 16:44:23 2020 -0700 dmaengine: idxd: connect idxd to dmaengine subsystem Add plumbing for dmaengine subsystem connection. The driver register a DMA device per DSA device. The channels are dynamically registered when a workqueue is configured to be "kernel:dmanegine" type. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965026376.73301.13867988830650740445.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit d1dfe5b8ac644a0ffccfe7af22abed7c80b34702 Author: Dave Jiang Date: Tue Jan 21 16:44:17 2020 -0700 dmaengine: idxd: add descriptor manipulation routines This commit adds helper functions for DSA descriptor allocation, submission, and free operations. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965025757.73301.12692876585357550065.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit b131ad593884cb3decc4950f807af2faffc05a3c Author: Jing Lin Date: Tue Jan 21 16:44:11 2020 -0700 dmaengine: idxd: add sysfs ABI for idxd driver Add the sysfs ABI information for idxd driver in Documentation/ABI/stable directory. Signed-off-by: Jing Lin Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965025170.73301.13428570530450446901.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit c52ca478233c172b2d322b5241d6279a8661cbba Author: Dave Jiang Date: Tue Jan 21 16:44:05 2020 -0700 dmaengine: idxd: add configuration component of driver The device is left unconfigured when the driver is loaded. Various components are configured via the driver sysfs attributes. Once configuration is done, the device can be enabled by writing the device name to the bind attribute of the device driver sysfs. Disabling can be done similarly. Also the individual work queues can also be enabled and disabled through the bind/unbind attributes. A constructed hierarchy is created through the struct device framework in order to provide appropriate configuration points and device state and status. This hierarchy is presented off the virtual DSA bus. i.e. /sys/bus/dsa/... Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965024585.73301.6431413676230150589.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit bfe1d56091c1a404b3d4ce7e9809d745fc4453bb Author: Dave Jiang Date: Tue Jan 21 16:43:59 2020 -0700 dmaengine: idxd: Init and probe for Intel data accelerators The idxd driver introduces the Intel Data Stream Accelerator [1] that will be available on future Intel Xeon CPUs. One of the kernel access point for the driver is through the dmaengine subsystem. It will initially provide the DMA copy service to the kernel. Some of the main functionality introduced with this accelerator are: shared virtual memory (SVM) support, and descriptor submission using Intel CPU instructions movdir64b and enqcmds. There will be additional accelerator devices that share the same driver with variations to capabilities. This commit introduces the probe and initialization component of the driver. [1]: https://software.intel.com/en-us/download/intel-data-streaming-accelerator-preliminary-architecture-specification Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965023991.73301.6186843973135311580.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit e81274cd6b5264809384066e09a5253708822522 Author: Dave Jiang Date: Tue Jan 21 16:43:53 2020 -0700 dmaengine: add support to dynamic register/unregister of channels With the channel registration routines broken out, now add support code to allow independent registering and unregistering of channels in a hotplug fashion. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965023364.73301.7821862091077299040.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit d2fb0a0438384fee08a418025f743913020033ce Author: Dave Jiang Date: Tue Jan 21 16:43:47 2020 -0700 dmaengine: break out channel registration In preparation for dynamic channel registration, the code segment that does the channel registration is broken out to its own function. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/157965022778.73301.8929944324898985438.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 232bb01bb8ad2f88aefbd88b0d3fe3f9a253502b Author: Dave Jiang Date: Tue Jan 21 16:43:41 2020 -0700 x86/asm: add iosubmit_cmds512() based on MOVDIR64B CPU instruction With the introduction of MOVDIR64B instruction, there is now an instruction that can write 64 bytes of data atomically. Quoting from Intel SDM: "There is no atomicity guarantee provided for the 64-byte load operation from source address, and processor implementations may use multiple load operations to read the 64-bytes. The 64-byte direct-store issued by MOVDIR64B guarantees 64-byte write-completion atomicity. This means that the data arrives at the destination in a single undivided 64-byte write transaction." We have identified at least 3 different use cases for this instruction in the format of func(dst, src, count): 1) Clear poison / Initialize MKTME memory @dst is normal memory. @src in normal memory. Does not increment. (Copy same line to all targets) @count (to clear/init multiple lines) 2) Submit command(s) to new devices @dst is a special MMIO region for a device. Does not increment. @src is normal memory. Increments. @count usually is 1, but can be multiple. 3) Copy to iomem in big chunks @dst is iomem and increments @src in normal memory and increments @count is number of chunks to copy Add support for case #2 to support device that will accept commands via this instruction. We provide a @count in order to submit a batch of preprogrammed descriptors in virtually contiguous memory. This allows the caller to submit multiple descriptors to a device with a single submission. The special device requires the entire 64bytes descriptor to be written atomically and will accept MOVDIR64B instruction. Signed-off-by: Dave Jiang Acked-by: Borislav Petkov Link: https://lore.kernel.org/r/157965022175.73301.10174614665472962675.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit b3531f5fc16d4df2b12567bce48cd9f3ab5f9131 Author: YueHaibing Date: Thu Jan 23 21:22:49 2020 -0800 xfs: remove unused variable 'done' fs/xfs/xfs_inode.c: In function 'xfs_itruncate_extents_flags': fs/xfs/xfs_inode.c:1523:8: warning: unused variable 'done' [-Wunused-variable] commit 4bbb04abb4ee ("xfs: truncate should remove all blocks, not just to the end of the page cache") left behind this, so remove it. Fixes: 4bbb04abb4ee ("xfs: truncate should remove all blocks, not just to the end of the page cache") Reported-by: Hulk Robot Reported-by: Stephen Rothwell Signed-off-by: YueHaibing Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 54027a49938bbee1af62fad191139b14d4ee5cd2 Author: Darrick J. Wong Date: Thu Jan 23 07:54:09 2020 -0800 xfs: fix uninitialized variable in xfs_attr3_leaf_inactive Dan Carpenter pointed out that error is uninitialized. While there never should be an attr leaf block with zero entries, let's not leave that logic bomb there. Fixes: 0bb9d159bd01 ("xfs: streamline xfs_attr3_leaf_inactive") Reported-by: Dan Carpenter Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Eric Sandeen commit 122ce22cb37b087e7e28ebb16044a622b0a22233 Author: Charles Keepax Date: Wed Jan 22 11:11:50 2020 +0000 pinctrl: madera: Remove extra blank line Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20200122111150.11033-1-ckeepax@opensource.cirrus.com Signed-off-by: Linus Walleij commit 1d44616e7549d0154c1224a3eee3c407029294dc Author: Stephen Boyd Date: Tue Jan 21 10:09:50 2020 -0800 pinctrl: qcom: Don't lock around irq_set_irq_wake() We don't need to hold the local pinctrl lock here to set irq wake on the summary irq line. Doing so only leads to lockdep warnings instead of protecting us from anything. Remove the locking. WARNING: possible circular locking dependency detected 5.4.11 #2 Tainted: G W ------------------------------------------------------ cat/3083 is trying to acquire lock: ffffff81f4fa58c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94 but task is already holding lock: ffffff81f4880c18 (&pctrl->lock){-.-.}, at: msm_gpio_irq_set_wake+0x48/0x7c which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&pctrl->lock){-.-.}: _raw_spin_lock_irqsave+0x64/0x80 msm_gpio_irq_ack+0x68/0xf4 __irq_do_set_handler+0xe0/0x180 __irq_set_handler+0x60/0x9c irq_domain_set_info+0x90/0xb4 gpiochip_hierarchy_irq_domain_alloc+0x110/0x200 __irq_domain_alloc_irqs+0x130/0x29c irq_create_fwspec_mapping+0x1f0/0x300 irq_create_of_mapping+0x70/0x98 of_irq_get+0xa4/0xd4 spi_drv_probe+0x4c/0xb0 really_probe+0x138/0x3f0 driver_probe_device+0x70/0x140 __device_attach_driver+0x9c/0x110 bus_for_each_drv+0x88/0xd0 __device_attach+0xb0/0x160 device_initial_probe+0x20/0x2c bus_probe_device+0x34/0x94 device_add+0x35c/0x3f0 spi_add_device+0xbc/0x194 of_register_spi_devices+0x2c8/0x408 spi_register_controller+0x57c/0x6fc spi_geni_probe+0x260/0x328 platform_drv_probe+0x90/0xb0 really_probe+0x138/0x3f0 driver_probe_device+0x70/0x140 device_driver_attach+0x4c/0x6c __driver_attach+0xcc/0x154 bus_for_each_dev+0x84/0xcc driver_attach+0x2c/0x38 bus_add_driver+0x108/0x1fc driver_register+0x64/0xf8 __platform_driver_register+0x4c/0x58 spi_geni_driver_init+0x1c/0x24 do_one_initcall+0x1a4/0x3e8 do_initcall_level+0xb4/0xcc do_basic_setup+0x30/0x48 kernel_init_freeable+0x124/0x1a8 kernel_init+0x14/0x100 ret_from_fork+0x10/0x18 -> #0 (&irq_desc_lock_class){-.-.}: __lock_acquire+0xeb4/0x2388 lock_acquire+0x1cc/0x210 _raw_spin_lock_irqsave+0x64/0x80 __irq_get_desc_lock+0x64/0x94 irq_set_irq_wake+0x40/0x144 msm_gpio_irq_set_wake+0x5c/0x7c set_irq_wake_real+0x40/0x5c irq_set_irq_wake+0x70/0x144 cros_ec_rtc_suspend+0x38/0x4c platform_pm_suspend+0x34/0x60 dpm_run_callback+0x64/0xcc __device_suspend+0x310/0x41c dpm_suspend+0xf8/0x298 dpm_suspend_start+0x84/0xb4 suspend_devices_and_enter+0xbc/0x620 pm_suspend+0x210/0x348 state_store+0xb0/0x108 kobj_attr_store+0x14/0x24 sysfs_kf_write+0x4c/0x64 kernfs_fop_write+0x15c/0x1fc __vfs_write+0x54/0x18c vfs_write+0xe4/0x1a4 ksys_write+0x7c/0xe4 __arm64_sys_write+0x20/0x2c el0_svc_common+0xa8/0x160 el0_svc_handler+0x7c/0x98 el0_svc+0x8/0xc other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pctrl->lock); lock(&irq_desc_lock_class); lock(&pctrl->lock); lock(&irq_desc_lock_class); *** DEADLOCK *** 7 locks held by cat/3083: #0: ffffff81f06d1420 (sb_writers#7){.+.+}, at: vfs_write+0xd0/0x1a4 #1: ffffff81c8935680 (&of->mutex){+.+.}, at: kernfs_fop_write+0x12c/0x1fc #2: ffffff81f4c322f0 (kn->count#337){.+.+}, at: kernfs_fop_write+0x134/0x1fc #3: ffffffe89a641d60 (system_transition_mutex){+.+.}, at: pm_suspend+0x108/0x348 #4: ffffff81f190e970 (&dev->mutex){....}, at: __device_suspend+0x168/0x41c #5: ffffff81f183d8c0 (lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94 #6: ffffff81f4880c18 (&pctrl->lock){-.-.}, at: msm_gpio_irq_set_wake+0x48/0x7c stack backtrace: CPU: 4 PID: 3083 Comm: cat Tainted: G W 5.4.11 #2 Hardware name: Google Cheza (rev3+) (DT) Call trace: dump_backtrace+0x0/0x174 show_stack+0x20/0x2c dump_stack+0xc8/0x124 print_circular_bug+0x2ac/0x2c4 check_noncircular+0x1a0/0x1a8 __lock_acquire+0xeb4/0x2388 lock_acquire+0x1cc/0x210 _raw_spin_lock_irqsave+0x64/0x80 __irq_get_desc_lock+0x64/0x94 irq_set_irq_wake+0x40/0x144 msm_gpio_irq_set_wake+0x5c/0x7c set_irq_wake_real+0x40/0x5c irq_set_irq_wake+0x70/0x144 cros_ec_rtc_suspend+0x38/0x4c platform_pm_suspend+0x34/0x60 dpm_run_callback+0x64/0xcc __device_suspend+0x310/0x41c dpm_suspend+0xf8/0x298 dpm_suspend_start+0x84/0xb4 suspend_devices_and_enter+0xbc/0x620 pm_suspend+0x210/0x348 state_store+0xb0/0x108 kobj_attr_store+0x14/0x24 sysfs_kf_write+0x4c/0x64 kernfs_fop_write+0x15c/0x1fc __vfs_write+0x54/0x18c vfs_write+0xe4/0x1a4 ksys_write+0x7c/0xe4 __arm64_sys_write+0x20/0x2c el0_svc_common+0xa8/0x160 el0_svc_handler+0x7c/0x98 el0_svc+0x8/0xc Fixes: 6aced33f4974 ("pinctrl: msm: drop wake_irqs bitmap") Cc: Douglas Anderson Cc: Brian Masney Cc: Lina Iyer Cc: Maulik Shah Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20200121180950.36959-1-swboyd@chromium.org Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit fd8bdb23b91876ac1e624337bb88dc1dcc21d67e Author: Guenter Roeck Date: Wed Jan 22 18:41:18 2020 -0800 hwmon: (k10temp) Display up to eight sets of CCD temperatures In HWiNFO, we see support for Tccd1, Tccd3, Tccd5, and Tccd7 temperature sensors on Zen2 based Threadripper CPUs. Checking register maps on Threadripper 3970X confirms SMN register addresses and values for those sensors. Register values observed in an idle system: 0x059950: 00000000 00000abc 00000000 00000ad8 0x059960: 00000000 00000ade 00000000 00000ae4 Under load: 0x059950: 00000000 00000c02 00000000 00000c14 0x059960: 00000000 00000c30 00000000 00000c22 More analysis shows that EPYC CPUs support up to 8 CCD temperature sensors. EPYC 7601 supports three CCD temperature sensors. Unlike Zen2 CPUs, the register space in Zen1 CPUs supports a maximum of four sensors, so only search for a maximum of four sensors on Zen1 CPUs. On top of that, in thm_10_0_sh_mask.h in the Linux kernel, we find definitions for THM_DIE{1-3}_TEMP__VALID_MASK, set to 0x00000800, as well as matching SMN addresses. This lets us conclude that bit 11 of the respective registers is a valid bit. With this assumption, the temperature offset is now 49 degrees C. This conveniently matches the documented temperature offset for Tdie, again suggesting that above registers indeed report temperatures sensor values. Assume that bit 11 is indeed a valid bit, and add support for the additional sensors. With this patch applied, output from 3970X (idle) looks as follows: k10temp-pci-00c3 Adapter: PCI adapter Tdie: +55.9°C Tctl: +55.9°C Tccd1: +39.8°C Tccd3: +43.8°C Tccd5: +43.8°C Tccd7: +44.8°C Tested-by: Michael Larabel Signed-off-by: Guenter Roeck commit d95f20c4f07020ebc605f3b46af4b6db9eb5fc99 Author: Dongdong Liu Date: Thu Jan 23 16:26:31 2020 +0800 PCI/AER: Initialize aer_fifo Previously we did not call INIT_KFIFO() for aer_fifo. This leads to kfifo_put() sometimes returning 0 (queue full) when in fact it is not. It is easy to reproduce the problem by using aer-inject: $ aer-inject -s :82:00.0 multiple-corr-nonfatal The content of the multiple-corr-nonfatal file is as below: AER COR RCVR HL 0 1 2 3 AER UNCOR POISON_TLP HL 4 5 6 7 Fixes: 27c1ce8bbed7 ("PCI/AER: Use kfifo for tracking events instead of reimplementing it") Link: https://lore.kernel.org/r/1579767991-103898-1-git-send-email-liudongdong3@huawei.com Signed-off-by: Dongdong Liu Signed-off-by: Bjorn Helgaas commit 8d077c3ce0109c406c265cafc334258caee47e6d Author: Bjorn Helgaas Date: Fri Dec 13 16:46:05 2019 -0600 PCI/AER: Factor message prefixes with dev_fmt() Define dev_fmt() with the common prefix of log messages so we don't have to repeat it in every printk. No functional change intended. Link: https://lore.kernel.org/r/20191213225709.GA213811@google.com Signed-off-by: Bjorn Helgaas commit 01daacfb9035e5b86d43a01f11a0614648f306c1 Author: Yicong Yang Date: Fri Dec 13 19:44:34 2019 +0800 PCI/AER: Log which device prevents error recovery PCI error recovery will fail if any device under the Root Port doesn't have an error_detected callback. Currently only the failure result is printed, which is not enough to identify the driver that lacks the callback. Log a message to identify the device with no error_detected callback. [bhelgaas: tweak log message] Link: https://lore.kernel.org/r/1576237474-32021-1-git-send-email-yangyicong@hisilicon.com Signed-off-by: Yicong Yang Signed-off-by: Bjorn Helgaas commit d54e17b4066612d88c4ef3e5fb3115f12733763d Merge: 5c7bac9fb2c5 5b3014b95272 Author: Mimi Zohar Date: Thu Jan 23 17:24:35 2020 -0500 Merge branch 'next-integrity.defer-measuring-keys' into next-integrity From patch set cover letter: The IMA subsystem supports measuring asymmetric keys when the key is created or updated[1]. But keys created or updated before a custom IMA policy is loaded are currently not measured. This includes keys added, for instance, to either the .ima or .builtin_trusted_keys keyrings, which happens early in the boot process. Measuring the early boot keys, by design, requires loading a custom IMA policy. This change adds support for queuing keys created or updated before a custom IMA policy is loaded. The queued keys are processed when a custom policy is loaded. Keys created or updated after a custom policy is loaded are measured immediately (not queued). In the case when a custom policy is not loaded within 5 minutes of IMA initialization, the queued keys are freed. [1] https://lore.kernel.org/linux-integrity/20191211164707.4698-1-nramas@linux.microsoft.com/ commit 485ec2ea9cf556e9c120e07961b7b459d776a115 Author: Amol Grover Date: Thu Jan 23 17:34:38 2020 +0530 bpf, devmap: Pass lockdep expression to RCU lists head is traversed using hlist_for_each_entry_rcu outside an RCU read-side critical section but under the protection of dtab->index_lock. Hence, add corresponding lockdep expression to silence false-positive lockdep warnings, and harden RCU lists. Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index") Signed-off-by: Amol Grover Signed-off-by: Daniel Borkmann Acked-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20200123120437.26506-1-frextrite@gmail.com commit 34bbe036170785bd288d8a74573ee8ad7946f4a1 Author: Tejas Patel Date: Wed Dec 4 22:35:59 2019 -0800 clk: zynqmp: Add support for clock with CLK_DIVIDER_POWER_OF_TWO flag Existing clock divider functions is not checking for base of divider. So, if any clock divider is power of 2 then clock rate calculation will be wrong. Add support to calculate divider value for the clocks with CLK_DIVIDER_POWER_OF_TWO flag. Signed-off-by: Tejas Patel Signed-off-by: Radhey Shyam Pandey Signed-off-by: Rajan Vaja Link: https://lkml.kernel.org/r/1575527759-26452-7-git-send-email-rajan.vaja@xilinx.com Signed-off-by: Stephen Boyd commit 4ebd92d2e228ceb33bafa273fd9cb2b16615cdd4 Author: Rajan Vaja Date: Wed Dec 4 22:35:58 2019 -0800 clk: zynqmp: Fix divider calculation zynqmp_clk_divider_round_rate() returns actual divider value after calculating from parent rate and desired rate, even though that rate is not supported by single divider of hardware. It is also possible that such divisor value can be achieved through 2 different dividers. As, Linux tries to set such divisor value(out of range) in single divider set divider is getting failed. Fix the same by computing best possible combination of two divisors which provides more accurate clock rate. Signed-off-by: Michal Simek Signed-off-by: Tejas Patel Signed-off-by: Rajan Vaja Link: https://lkml.kernel.org/r/1575527759-26452-6-git-send-email-rajan.vaja@xilinx.com Signed-off-by: Stephen Boyd commit e942171bbb762977afaa1eb24a312c3bd56386a5 Author: Rajan Vaja Date: Wed Dec 4 22:35:57 2019 -0800 clk: zynqmp: Add support for get max divider To achieve best possible rate, maximum limit of divider is required while computation. Get maximum supported divisor from firmware. To maintain backward compatibility assign maximum possible value(0xFFFF) if query for max divisor is not successful. Signed-off-by: Rajan Vaja Link: https://lkml.kernel.org/r/1575527759-26452-5-git-send-email-rajan.vaja@xilinx.com Acked-by: Michal Simek [sboyd@kernel.org: Remove else return and just return] Signed-off-by: Stephen Boyd commit df2a4d94f1720e24643a9870a01a1c2895d13b20 Author: Rajan Vaja Date: Wed Dec 4 22:35:56 2019 -0800 clk: zynqmp: Warn user if clock user are more than allowed Warn user if clock is used by more than allowed devices. This check is done by firmware and returns respective error code. Upon receiving error code for excessive user, warn user for the same. This change is done to restrict VPLL use count. It is assumed that VPLL is used by one user only. Signed-off-by: Michal Simek Signed-off-by: Rajan Vaja Link: https://lkml.kernel.org/r/1575527759-26452-4-git-send-email-rajan.vaja@xilinx.com Acked-by: Michal Simek Signed-off-by: Stephen Boyd commit c1e846b8ee5eee78765242fe204f566596c52ad1 Author: Rajan Vaja Date: Wed Dec 4 22:35:55 2019 -0800 clk: zynqmp: Extend driver for versal Add Versal compatible string to support Versal binding. Signed-off-by: Jolly Shah Signed-off-by: Michal Simek Signed-off-by: Rajan Vaja Link: https://lkml.kernel.org/r/1575527759-26452-3-git-send-email-rajan.vaja@xilinx.com Signed-off-by: Stephen Boyd commit 352546805a44871b68affea09a2fbd5a48e452d0 Author: Rajan Vaja Date: Wed Dec 4 22:35:54 2019 -0800 dt-bindings: clock: Add bindings for versal clock driver Add documentation to describe Xilinx Versal clock driver bindings. Signed-off-by: Rajan Vaja Reviewed-by: Rob Herring Link: https://lkml.kernel.org/r/1575527759-26452-2-git-send-email-rajan.vaja@xilinx.com Signed-off-by: Stephen Boyd commit 9243f296916794d86dfcabd802b4dac1ac1448a9 Author: Rob Herring Date: Tue Nov 19 13:31:20 2019 -0600 dt-bindings: leds: Convert gpio-leds to DT schema Convert the gpio-leds binding to DT schema format. Drop the last example as the node name collides when built, and it doesn't add much value. Cc: Pavel Machek Cc: Dan Murphy Acked-by: Jacek Anaszewski Signed-off-by: Rob Herring commit 24a71afe05a8859f1b490fc59f0023a890db16f0 Author: Rob Herring Date: Tue Nov 19 11:25:53 2019 -0600 dt-bindings: leds: Convert common LED binding to schema Convert the common LEDs properties bindings to a schema. As trigger source providers are different nodes, we need to split trigger source properties to a separate file. Bindings for LED controllers can reference the common schema for the LED child nodes: patternProperties: "^led@[0-4]": type: object allOf: - $ref: common.yaml# Cc: Pavel Machek Cc: Dan Murphy Cc: linux-leds@vger.kernel.org Acked-by: Jacek Anaszewski Signed-off-by: Rob Herring commit 9c4a38f19ed2bda2df2765e98ed661daf61b2cb2 Author: Guenter Roeck Date: Tue Jan 21 21:33:54 2020 -0800 hwmon: (k10temp) Add debugfs support Show thermal and SVI registers for Family 17h CPUs. Tested-by: Sebastian Reichel Signed-off-by: Guenter Roeck commit 70831c8a91845434c3792b0c3ef966dc30741ec0 Author: Guenter Roeck Date: Fri Jan 17 06:43:20 2020 -0800 hwmon: (k10temp) Don't show temperature limits on Ryzen (Zen) CPUs The maximum Tdie or Tctl is not published for Ryzen CPUs. What is known, however, is that the traditional value of 70 degrees C is no longer correct. On top of that, the limit applies to Tctl, not to Tdie. Displaying it in either context is meaningless, confusing, and wrong. Stop doing it. Tested-by: Brad Campbell Tested-by: Holger Kiehl Tested-by: Michael Larabel Tested-by: Jonathan McDowell Tested-by: Ken Moffat Signed-off-by: Guenter Roeck commit b00647c46c9d7f6ee1ff6aaf335906101755e614 Author: Guenter Roeck Date: Tue Jan 14 17:54:05 2020 -0800 hwmon: (k10temp) Show core and SoC current and voltages on Ryzen CPUs Ryzen CPUs report core and SoC voltages and currents. Add support for it to the k10temp driver. For the time being, only report voltages and currents for Ryzen CPUs. Threadripper and EPYC appear to use a different mechanism. Tested-by: Brad Campbell Tested-by: Bernhard Gebetsberger Tested-by: Holger Kiehl Tested-by: Michael Larabel Tested-by: Jonathan McDowell Tested-by: Ken Moffat Tested-by: Darren Salt Signed-off-by: Guenter Roeck commit c757938929c9e1de52e31400f673fac02e1f26bb Author: Guenter Roeck Date: Tue Jan 14 17:40:12 2020 -0800 hwmon: (k10temp) Report temperatures per CPU die Zen2 reports reporting temperatures per CPU die (called Core Complex Dies, or CCD, by AMD). Add support for it to the k10temp driver. Tested-by: Brad Campbell Tested-by: Bernhard Gebetsberger Tested-by: Holger Kiehl Tested-by: Michael Larabel Tested-by: Jonathan McDowell Tested-by: Ken Moffat Tested-by: Darren Salt Signed-off-by: Guenter Roeck commit d547552a1bf1deb321e787a6e6e2a9774573a35f Author: Guenter Roeck Date: Tue Dec 24 07:20:55 2019 -0800 hmon: (k10temp) Convert to use devm_hwmon_device_register_with_info Convert driver to use devm_hwmon_device_register_with_info to simplify the code and to reduce its size. Old size (x86_64): text data bss dec hex filename 8247 4488 64 12799 31ff drivers/hwmon/k10temp.o New size: text data bss dec hex filename 6778 2792 64 9634 25a2 drivers/hwmon/k10temp.o Tested-by: Brad Campbell Tested-by: Bernhard Gebetsberger Tested-by: Holger Kiehl Tested-by: Michael Larabel Tested-by: Jonathan McDowell Tested-by: Ken Moffat Tested-by: Darren Salt Signed-off-by: Guenter Roeck commit a6d210da1a01cb5c3fd4d2dd7b5920642f66677c Author: Guenter Roeck Date: Sun Apr 29 08:39:24 2018 -0700 hwmon: (k10temp) Use bitops Using bitops makes bit masks and shifts easier to read. Tested-by: Brad Campbell Tested-by: Bernhard Gebetsberger Tested-by: Holger Kiehl Tested-by: Michael Larabel Tested-by: Jonathan McDowell Tested-by: Ken Moffat Tested-by: Darren Salt Signed-off-by: Guenter Roeck commit 7992db7cb9d133bc6d3d1731fcd72fe2bec944d4 Author: Akinobu Mita Date: Tue Jan 21 00:32:24 2020 +0900 hwmon: (pwm-fan) stop fan on shutdown The pwm-fan driver stops the fan in suspend but leaves the fan on in shutdown. It seems strange to leave the fan on in shutdown because there is no use case in my mind and the gpio-fan driver on the other hand stops in shutdown. This change turns off the fan in shutdown. If anyone complains then we'll add an optional property to switch the behavior. Cc: Rob Herring Cc: Mark Rutland Cc: Kamil Debski Cc: Bartlomiej Zolnierkiewicz Cc: Guenter Roeck Cc: Thierry Reding Cc: Uwe Kleine-König Signed-off-by: Akinobu Mita Link: https://lore.kernel.org/r/1579534344-11694-1-git-send-email-akinobu.mita@gmail.com Signed-off-by: Guenter Roeck commit 05592bea7a8684e6e5e7c75a6083506b8e534d9f Author: Beniamin Bia Date: Tue Jan 14 13:21:59 2020 +0200 MAINTAINERS: add entry for ADM1177 driver Add Beniamin Bia and Michael Hennerich as a maintainer for ADM1177 ADC. Signed-off-by: Beniamin Bia Link: https://lore.kernel.org/r/20200114112159.25998-3-beniamin.bia@analog.com Signed-off-by: Guenter Roeck commit 7866716170dbf5719839b5e829f825779c277b30 Author: Beniamin Bia Date: Tue Jan 14 13:21:58 2020 +0200 dt-binding: hwmon: Add documentation for ADM1177 Documentation for ADM1177 was added. Signed-off-by: Beniamin Bia Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20200114112159.25998-2-beniamin.bia@analog.com Signed-off-by: Guenter Roeck commit 09b08ac9e8d5869c1840de423cd361161964fe8e Author: Beniamin Bia Date: Tue Jan 14 13:21:57 2020 +0200 hwmon: (adm1177) Add ADM1177 Hot Swap Controller and Digital Power Monitor driver ADM1177 is a Hot Swap Controller and Digital Power Monitor with Soft Start Pin. Datasheet: Link: https://www.analog.com/media/en/technical-documentation/data-sheets/ADM1177.pdf Signed-off-by: Beniamin Bia Link: https://lore.kernel.org/r/20200114112159.25998-1-beniamin.bia@analog.com Signed-off-by: Guenter Roeck commit 971dfd8cdcd60fcf78566e3d1e20d865fc4073b5 Author: Vadim Pasternak Date: Mon Jan 13 15:08:41 2020 +0000 docs: hwmon: Include 'xdpe12284.rst' into docs Add documentation for 'xdpe122' devices. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20200113150841.17670-7-vadimp@mellanox.com [groeck: Added to index.rst] Signed-off-by: Guenter Roeck commit aaafb7c8eb1c53d50ac1857f3b997baeac383378 Author: Vadim Pasternak Date: Mon Jan 13 15:08:39 2020 +0000 hwmon: (pmbus) Add support for Infineon Multi-phase xdpe122 family controllers Add support for devices XDPE12254, XDPE12284. All these device support two pages. The below lists of VOUT_MODE command readout with their related VID protocols, Digital to Analog Converter steps, supported by these devices: VR12.0 mode, 5-mV DAC - 0x01; VR12.5 mode, 10-mV DAC - 0x02; IMVP9 mode, 5-mV DAC - 0x03; AMD mode 6.25mV - 0x10. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20200113150841.17670-5-vadimp@mellanox.com [groeck: Added missing break statement] Signed-off-by: Guenter Roeck commit 583dc921275c5a0cc7f657550cbf0caae7bf49c3 Author: Vadim Pasternak Date: Mon Jan 13 15:08:38 2020 +0000 hwmon: (pmbus/tps53679) Extend device list supported by driver Extends driver with support of the additional devices: Texas Instruments Dual channel DCAP+ multiphase controllers: TPS53688. Extend Kconfig with added device. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20200113150841.17670-4-vadimp@mellanox.com Signed-off-by: Guenter Roeck commit 9d72340b6ade9457fc79c7059fcc62e5b888f9a5 Author: Vadim Pasternak Date: Mon Jan 13 15:08:37 2020 +0000 hwmon: (pmbus/core) Add support for Intel IMVP9 and AMD 6.25mV modes Extend "vrm_version" with the type for Intel IMVP9 and AMD 6.25mV VID modes. Add calculation for those types. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20200113150841.17670-3-vadimp@mellanox.com Signed-off-by: Guenter Roeck commit b9fa0a3acfd86c7d02cf0aac5105c0297bf3c5b0 Author: Vadim Pasternak Date: Mon Jan 13 15:08:36 2020 +0000 hwmon: (pmbus/core) Add support for vid mode detection per page bases Add support for VID protocol detection per page bases, instead of detecting it based on "PMBU_VOUT" readout from page 0 for all the pages supported by particular device. The reason that some devices allows to configure different VID modes per page within the same device. Patch modifies the field "vrm_version" within the structure "pmbus_driver_info" to be per page array. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20200113150841.17670-2-vadimp@mellanox.com Signed-off-by: Guenter Roeck commit d9c8ae69b9962197883f79c7df3fd562cc52b21a Author: Eddie James Date: Tue Jan 7 09:40:40 2020 -0600 hwmon: (pmbus/ibm-cffps) Prevent writing on_off_config with bad data If the user write parameters resulted in no bytes being written to the temporary buffer, then ON_OFF_CONFIG will be written with uninitialized data. Prevent this by bailing out in this case. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/1578411640-16929-1-git-send-email-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit 392923715d8b0bbb7e72567fd4090e92bd5a9a3b Author: YueHaibing Date: Wed Jan 8 03:45:14 2020 +0000 hwmon: (w83627ehf) Remove set but not used variable 'fan4min' Fixes gcc '-Wunused-but-set-variable' warning: drivers/hwmon/w83627ehf.c: In function 'w83627ehf_check_fan_inputs': drivers/hwmon/w83627ehf.c:1296:24: warning: variable 'fan4min' set but not used [-Wunused-but-set-variable] commit 62000264cfa8 ("hwmon: (w83627ehf) remove nct6775 and nct6776 support") left behind this unused variable. Reported-by: Hulk Robot Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20200108034514.50130-1-yuehaibing@huawei.com Signed-off-by: Guenter Roeck commit 5b46903d8bf372e563bf2150d46b87fff197a109 Author: Guenter Roeck Date: Thu Nov 28 21:34:40 2019 -0800 hwmon: Driver for disk and solid state drives with temperature sensors Reading the temperature of ATA drives has been supported for years by userspace tools such as smarttools or hddtemp. The downside of such tools is that they need to run with super-user privilege, that the temperatures are not reported by standard tools such as 'sensors' or 'libsensors', and that drive temperatures are not available for use in the kernel's thermal subsystem. This driver solves this problem by adding support for reading the temperature of ATA drives from the kernel using the hwmon API and by adding a temperature zone for each drive. With this driver, the hard disk temperature can be read using the unprivileged 'sensors' application: $ sensors drivetemp-scsi-1-0 drivetemp-scsi-1-0 Adapter: SCSI adapter temp1: +23.0°C or directly from sysfs: $ grep . /sys/class/hwmon/hwmon9/{name,temp1_input} /sys/class/hwmon/hwmon9/name:drivetemp /sys/class/hwmon/hwmon9/temp1_input:23000 If the drive supports SCT transport and reports temperature limits, those are reported as well. drivetemp-scsi-0-0 Adapter: SCSI adapter temp1: +27.0°C (low = +0.0°C, high = +60.0°C) (crit low = -41.0°C, crit = +85.0°C) (lowest = +23.0°C, highest = +34.0°C) The driver attempts to use SCT Command Transport to read the drive temperature. If the SCT Command Transport feature set is not available, or if it does not report the drive temperature, drive temperatures may be readable through SMART attributes. Since SMART attributes are not well defined, this method is only used as fallback mechanism. Cc: Chris Healy Cc: Linus Walleij Cc: Martin K. Petersen Cc: Bart Van Assche Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Guenter Roeck commit 74a71a831bea81ebb3feb379e62c8accbbec5476 Author: Eddie James Date: Thu Dec 19 14:50:07 2019 -0600 hwmon: (pmbus/ibm-cffps) Fix the LED behavior when turned off The driver should remain in control of the LED on the PSU, even while off, not the PSU firmware as previously indicated. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/1576788607-13567-4-git-send-email-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit 1952d79a0d2635c9130a48a598dd2f1eea70c45b Author: Eddie James Date: Thu Dec 19 14:50:06 2019 -0600 hwmon: (pmbus/ibm-cffps) Add the VMON property for version 2 Version 2 of the PSU supports reading an auxiliary voltage. Use the pmbus VMON property and associated virtual register to read it. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/1576788607-13567-3-git-send-email-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit abe508b66d23cf2ed18c991c200b957e92f4bfbc Author: Eddie James Date: Thu Dec 19 14:50:05 2019 -0600 hwmon: (pmbus/ibm-cffps) Add new manufacturer debugfs entries Add support for a number of manufacturer-specific registers in the debugfs entries, as well as support to read and write the PMBUS_ON_OFF_CONFIG register through debugfs. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/1576788607-13567-2-git-send-email-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit cce209581a61d01f2b7309bed68d22fd8af34ee4 Author: Guenter Roeck Date: Thu Dec 5 20:26:24 2019 -0800 hwmon: (pmbus) Driver for MAX20730, MAX20734, and MAX20743 Add support for Maxim MAX20730, MAX20734, MAX20743 Integrated, Step-Down Switching Regulators with PMBus support. Signed-off-by: Guenter Roeck commit 931f397bc6243f2def1f2c147d415cfcd83a3df5 Author: Dr. David Alan Gilbert Date: Wed Dec 25 02:32:25 2019 +0000 hwmon: (w83627ehf) Now only one intrusion channel The 2nd intrusion channel was only used on the nct6776 Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20191225023225.2785-4-linux@treblig.org Signed-off-by: Guenter Roeck commit 695955028a42793fd09c3149727cbb8085ec6905 Author: Dr. David Alan Gilbert Date: Wed Dec 25 02:32:24 2019 +0000 hwmon: (w83627ehf) Remove code not needed after nct677* removal Now the nct677* are gone, we can clean up some flags that are always the same now and simplify some code. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20191225023225.2785-3-linux@treblig.org Signed-off-by: Guenter Roeck commit 3207408ab4cbe242d48471ce4e10047022a65232 Author: Dr. David Alan Gilbert Date: Wed Dec 25 02:32:23 2019 +0000 hwmon: (w83627ehf) remove nct6775 and nct6776 support The nct6775 and nct6776 are supported by the separate nct6775.c driver, so remove the code from the w83627ehf driver. Suggested-by: Guenter Roeck Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20191225023225.2785-2-linux@treblig.org Signed-off-by: Guenter Roeck commit 1a1ea120afdff06174c62101020005949e0b2056 Author: Guenter Roeck Date: Fri Dec 13 13:36:36 2019 -0800 hwmon: (pmbus) Add MAX20796 to devices supported by generic pmbus driver MAX20796 is a dual-phase scalable integrated voltage regulator with PMBus interface. Signed-off-by: Guenter Roeck commit 8f77203587f5bee21b344f743dbac407871067a3 Author: Chen Zhou Date: Fri Dec 13 09:56:05 2019 +0800 hwmon: (w83627ehf) make sensor_dev_attr_##_name variables static Fix sparse warning: drivers/hwmon/w83627ehf.c:1202:1: warning: symbol 'sensor_dev_attr_pwm1_target' was not declared. Should it be static? and many more similar messages. Reported-by: Hulk Robot Signed-off-by: Chen Zhou Link: https://lore.kernel.org/r/20191213015605.172472-1-chenzhou10@huawei.com [groeck: Dropped all but one log message from description] Signed-off-by: Guenter Roeck commit 9e347728c4fe0f0661194243384ac9f61d7a5c73 Author: Guenter Roeck Date: Thu Dec 12 09:14:34 2019 -0800 hwmon: (pmbus) Detect if chip is write protected If a chip is write protected, we can not change any limits, and we can not clear status flags. This may be the reason why clearing status flags is reported to not work for some chips. Detect the condition in the pmbus core. If the chip is write protected, set limit attributes as read-only, and set the flag indicating that the status flag should be ignored. Signed-off-by: Guenter Roeck commit d21ed22ba7b110746315dff56f62d76352ac5437 Author: Guenter Roeck Date: Sat Nov 23 11:11:26 2019 -0800 hwmon: Driver for MAX31730 MAX31730 is a 3-Channel Remote Temperature Sensor. Signed-off-by: Guenter Roeck commit 002c6b545b85676539add33add8aa7f1f49cbfff Author: Guenter Roeck Date: Tue Jul 17 10:17:19 2018 -0700 hwmon: Add support for enable attributes to hwmon core The hwmon ABI supports enable attributes since commit fb41a710f84e ("hwmon: Document the sensor enable attribute"), but did not add support for those attributes to the hwmon core. Do that now. Since the enable attributes are logically the most important attributes, they are added as first attribute to the attribute list. Move hwmon_in_enable from last to first place for consistency. Signed-off-by: Guenter Roeck commit 266cd5835947d08b7c963b6d9d9f15d9e481bd0a Author: Dr. David Alan Gilbert Date: Sun Nov 24 20:20:30 2019 +0000 hwmon: (w83627ehf) convert to with_info interface Convert the old hwmon_device_register code to devm_hwmon_device_register_with_info. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20191124202030.45360-3-linux@treblig.org Signed-off-by: Guenter Roeck commit a470f11c5ba2febbbba941167e106c726bc1297b Author: Jim Wright Date: Thu Dec 5 17:24:11 2019 -0600 hwmon: (pmbus/ucd9000) Add support for UCD90320 Power Sequencer Add support for the UCD90320 chip and its expanded set of GPIO pins. Signed-off-by: Jim Wright Link: https://lore.kernel.org/r/20191205232411.21492-3-wrightj@linux.vnet.ibm.com Signed-off-by: Guenter Roeck commit 8a36e38d8b0fbb92609e837a67f919202ec7ec51 Author: Jim Wright Date: Thu Dec 5 17:24:10 2019 -0600 dt-bindings: hwmon/pmbus: Add ti,ucd90320 power sequencer Document the UCD90320 device tree binding. Signed-off-by: Jim Wright Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20191205232411.21492-2-wrightj@linux.vnet.ibm.com Signed-off-by: Guenter Roeck commit 4413405f931ef97ab1263ae3588e6f656ec220b7 Author: Dr. David Alan Gilbert Date: Sun Nov 24 20:20:29 2019 +0000 hwmon: Add intrusion templates Add templates for intrusion%d_alarm and intrusion%d_beep. Note, these start at 0. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20191124202030.45360-2-linux@treblig.org Signed-off-by: Guenter Roeck commit e1ac611f57c9315e79c4ca9fb2a21c81106d3680 Author: Rob Herring Date: Fri Nov 8 13:18:29 2019 -0600 dt-bindings: PCI: Convert generic host binding to DT schema Convert the generic PCI host binding to DT schema. The derivative Juno, PLDA XpressRICH3-AXI, and Designware ECAM bindings all just vary in their compatible strings. The simplest way to convert those to schema is just add them into the common generic PCI host schema. The HiSilicon ECAM and Cavium ThunderX PEM bindings have an additional 'reg' entry, but are otherwise the same binding as well. Cc: Bjorn Helgaas Cc: Lorenzo Pieralisi Cc: Andrew Murray Cc: Zhou Wang Cc: Will Deacon Cc: David Daney Signed-off-by: Rob Herring commit 919ba6e739eb76d7a99284795b72c45e096c9aa0 Author: Rob Herring Date: Fri Nov 8 13:18:29 2019 -0600 dt-bindings: PCI: Convert Arm Versatile binding to DT schema Convert the Arm Versatile PCI host binding to a DT schema. Cc: Bjorn Helgaas Cc: Lorenzo Pieralisi Cc: Andrew Murray Acked-by: Linus Walleij Signed-off-by: Rob Herring commit 7dcde0f337c3225ebe25ba070bd244d291219627 Author: Linus Walleij Date: Thu Oct 31 10:06:02 2019 +0100 dt-bindings: Be explicit about installing deps Make sure the reader of the document is aware that some active installation of the libyaml development package is required and provide two examples. Signed-off-by: Linus Walleij Signed-off-by: Rob Herring commit 11183ac07a7460b93acb4b5860528bf30f4d319f Author: Olivier Moysan Date: Thu Jan 23 09:34:31 2020 +0100 dt-bindings: stm32: convert dfsdm to json-schema Convert the STM32 DFSDM bindings to DT schema format using json-schema. Signed-off-by: Olivier Moysan Signed-off-by: Rob Herring commit af1c2d81695b1a565069619f7c0d3f2d0dec8e74 Author: Benjamin Gaignard Date: Wed Jan 22 10:55:58 2020 +0100 dt-bindings: serial: Convert STM32 UART to json-schema Convert STM32 UART bindings to json-schema. Signed-off-by: Benjamin Gaignard Signed-off-by: Rob Herring commit d50f974c4f7fef1b2d1d010f4f81d40e1ad09f8a Author: Benjamin Gaignard Date: Wed Jan 22 10:55:57 2020 +0100 dt-bindings: serial: Convert rs485 bindings to json-schema Convert rs485 binding to yaml style file. Signed-off-by: Benjamin Gaignard Signed-off-by: Rob Herring commit c5c689d3221e5fc82525db454021b1adcb33d855 Author: Douglas Anderson Date: Fri Jan 17 15:53:26 2020 -0800 dt-bindings: timer: Use non-empty ranges in example On many arm64 qcom device trees, running `make dtbs_check` yells: timer@17c20000: #size-cells:0:0: 1 was expected It appears that someone was trying to assert the fact that sub-nodes describing frames would never have a size that's more than 32-bits big. That does indeed appear to be true for all cases I could find. Currently many arm64 qcom device tree files have a #address-cells and about in commit bede7d2dc8f3 ("arm64: dts: qcom: sdm845: Increase address and size cells for soc"). That means the only way we can shrink them down is to use a non-empty ranges. Since forever it has said in "writing-bindings.txt" to "DO use non-empty 'ranges' to limit the size of child buses/devices". I guess we should start listening to it. I believe (but am not certain) that this also means that we should use "ranges" to simplify the "reg" of our sub devices by specifying an offset. Let's update the example in the bindings to make this obvious. Signed-off-by: Douglas Anderson Signed-off-by: Rob Herring commit 9bbc8be29d66cc34b650510f2c67b5c55235fe5d Merge: 790e01149a11 7c453526dc50 Author: David S. Miller Date: Thu Jan 23 21:27:23 2020 +0100 Merge tag 'mlx5-updates-2020-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2020-01-22 This series provides updates to mlx5 driver. 1) Misc small cleanups 2) Some SW steering updates including header copy support 3) Full ethtool statistics support for E-Switch uplink representor Some refactoring was required to share the bare-metal NIC ethtool stats with the Uplink representor. On Top of this Vlad converts the ethtool stats support in E-Swtich vports representors to use the mlx5e "stats groups" infrastructure and then applied all applicable stats to the uplink representor netdev. ==================== Signed-off-by: David S. Miller commit 790e01149a115f77f5aa075e4ea0f81e45961523 Merge: 6d9f6e6790e7 2ace13e10dbd Author: David S. Miller Date: Thu Jan 23 21:21:12 2020 +0100 Merge branch 'Add-PHY-IDs-for-DP83825-6' Dan Murphy says: ==================== Add PHY IDs for DP83825/6 Adding new PHY IDs for the DP83825 and DP83826 TI Ethernet PHYs to the DP83822 PHY driver. ==================== Signed-off-by: David S. Miller commit 2ace13e10dbd1c8c5c9f118e5d4d0e0a77b152c7 Author: Dan Murphy Date: Wed Jan 22 09:34:55 2020 -0600 net: phy: DP83822: Add support for additional DP83825 devices Add PHY IDs for the DP83825CS, DP83825CM and the DP83825S devices to the DP83822 driver. Signed-off-by: Dan Murphy Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 783da36bb90cbf45be7fa82a0d0d3910f1f6fcc7 Author: Dan Murphy Date: Wed Jan 22 09:34:54 2020 -0600 phy: dp83826: Add phy IDs for DP83826N and 826NC Add phy IDs to the DP83822 phy driver for the DP83826N and the DP83826NC devices. The register map and features are the same for basic enablement. Signed-off-by: Dan Murphy Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 987f028b8637cfa7658aa456ae73f8f21a7a7f6f Author: Gustavo A. R. Silva Date: Mon Jan 20 17:53:26 2020 -0600 char: hpet: Use flexible-array member Old code in the kernel uses 1-byte and 0-byte arrays to indicate the presence of a "variable length array": struct something { int length; u8 data[1]; }; struct something *instance; instance = kmalloc(sizeof(*instance) + size, GFP_KERNEL); instance->length = size; memcpy(instance->data, source, size); There is also 0-byte arrays. Both cases pose confusion for things like sizeof(), CONFIG_FORTIFY_SOURCE, etc.[1] Instead, the preferred mechanism to declare variable-length types such as the one above is a flexible array member[2] which need to be the last member of a structure and empty-sized: struct something { int stuff; u8 data[]; }; Also, by making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being unadvertenly introduced[3] to the codebase from now on. [1] https://github.com/KSPP/linux/issues/21 [2] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200120235326.GA29231@embeddedor.com Signed-off-by: Greg Kroah-Hartman commit 5336da37a5eac761611352707c3890a3cf857aa6 Author: Colin Ian King Date: Thu Jan 23 00:29:21 2020 +0000 partitions/ldm: fix spelling mistake "to" -> "too" There is a spelling mistake in a ldm_error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Jens Axboe commit 45fc24e89b7cc2e227b2f03d99dda0a2204bf383 Author: Dave Hansen Date: Thu Jan 23 10:41:20 2020 -0800 x86/mpx: remove MPX from arch/x86 From: Dave Hansen MPX is being removed from the kernel due to a lack of support in the toolchain going forward (gcc). This removes all the remaining (dead at this point) MPX handling code remaining in the tree. The only remaining code is the XSAVE support for MPX state which is currently needd for KVM to handle VMs which might use MPX. Cc: Peter Zijlstra (Intel) Cc: Andy Lutomirski Cc: x86@kernel.org Cc: Linus Torvalds Cc: Andrew Morton Signed-off-by: Dave Hansen commit 42222eae17f7c930833dfda7896ef280879de94a Author: Dave Hansen Date: Thu Jan 23 10:41:16 2020 -0800 mm: remove arch_bprm_mm_init() hook From: Dave Hansen MPX is being removed from the kernel due to a lack of support in the toolchain going forward (gcc). arch_bprm_mm_init() is used at execve() time. The only non-stub implementation is on x86 for MPX. Remove the hook entirely from all architectures and generic code. Cc: Peter Zijlstra (Intel) Cc: Andy Lutomirski Cc: x86@kernel.org Cc: Linus Torvalds Cc: linux-arch@vger.kernel.org Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Cc: Guan Xuetao Cc: Andrew Morton Signed-off-by: Dave Hansen commit aa9ccb7b47f909e2e7206ebb47e4c63e477199fc Author: Dave Hansen Date: Thu Jan 23 10:41:15 2020 -0800 x86/mpx: remove bounds exception code From: Dave Hansen MPX is being removed from the kernel due to a lack of support in the toolchain going forward (gcc). Remove the other user-visible ABI: signal handling. This code should basically have been inactive after the prctl()s were removed, but there may be some small ABI remnants from this code. Remove it. Cc: Peter Zijlstra (Intel) Cc: Andy Lutomirski Cc: x86@kernel.org Cc: Linus Torvalds Cc: Andrew Morton Signed-off-by: Dave Hansen commit 4ba68d00055774308ede6c4c2133e5a8b70a2ab8 Author: Dave Hansen Date: Thu Jan 23 10:41:14 2020 -0800 x86/mpx: remove build infrastructure From: Dave Hansen MPX is being removed from the kernel due to a lack of support in the toolchain going forward (gcc). Remove the Kconfig option and the Makefile line. This makes arch/x86/mm/mpx.c and anything under an #ifdef for X86_INTEL_MPX dead code. Cc: Peter Zijlstra (Intel) Cc: Andy Lutomirski Cc: x86@kernel.org Cc: Linus Torvalds Cc: Andrew Morton Signed-off-by: Dave Hansen commit 3a1255396b5aba40299d5dd5bde67b160a44117f Author: Dave Hansen Date: Thu Jan 23 10:41:13 2020 -0800 x86/alternatives: add missing insn.h include From: Dave Hansen While testing my MPX removal series, Borislav noted compilation failure with an allnoconfig build. Turned out to be a missing include of insn.h in alternative.c. With MPX, it got it implicitly from: asm/mmu_context.h -> asm/mpx.h -> asm/insn.h Fixes: c3d6324f841b ("x86/alternatives: Teach text_poke_bp() to emulate instructions") Reported-by: Borislav Petkov Cc: Peter Zijlstra (Intel) Cc: Andy Lutomirski Cc: x86@kernel.org Cc: Linus Torvalds Cc: Andrew Morton Signed-off-by: Dave Hansen commit 6435f773d81f02193228685a7e3fe65c983c5de0 Author: Zong Li Date: Thu Jan 2 11:12:39 2020 +0800 riscv: mm: add support for CONFIG_DEBUG_VIRTUAL This patch implements CONFIG_DEBUG_VIRTUAL to do additional checks on virt_to_phys and __pa_symbol calls. virt_to_phys used for linear mapping check, and __pa_symbol used for kernel symbol check. In current RISC-V, kernel image maps to linear mapping area. If CONFIG_DEBUG_VIRTUAL is disable, these two functions calculate the offset on the address feded directly without any checks. The result of test_debug_virtual as follows: [ 0.358456] ------------[ cut here ]------------ [ 0.358738] virt_to_phys used for non-linear address: (____ptrval____) (0xffffffd000000000) [ 0.359174] WARNING: CPU: 0 PID: 1 at arch/riscv/mm/physaddr.c:16 __virt_to_phys+0x3c/0x50 [ 0.359409] Modules linked in: [ 0.359630] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.5.0-rc3-00002-g5133c5c0ca13 #57 [ 0.359861] epc: ffffffe000253d1a ra : ffffffe000253d1a sp : ffffffe03aa87da0 [ 0.360019] gp : ffffffe000ae03b0 tp : ffffffe03aa88000 t0 : ffffffe000af2660 [ 0.360175] t1 : 0000000000000064 t2 : 00000000000000b7 s0 : ffffffe03aa87dc0 [ 0.360330] s1 : ffffffd000000000 a0 : 000000000000004f a1 : 0000000000000000 [ 0.360492] a2 : 0000000000000000 a3 : 0000000000000000 a4 : ffffffe000a84358 [ 0.360672] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.360876] s2 : ffffffe000ae0600 s3 : ffffffe00000fc7c s4 : ffffffe0000224b0 [ 0.361067] s5 : ffffffe000030890 s6 : ffffffe000022470 s7 : 0000000000000008 [ 0.361267] s8 : ffffffe0000002c4 s9 : ffffffe000ae0640 s10: ffffffe000ae0630 [ 0.361453] s11: 0000000000000000 t3 : 0000000000000000 t4 : 000000000001e6d0 [ 0.361636] t5 : ffffffe000ae0a18 t6 : ffffffe000aee54e [ 0.361806] status: 0000000000000120 badaddr: 0000000000000000 cause: 0000000000000003 [ 0.362056] ---[ end trace aec0bf78d4978122 ]--- [ 0.362404] PA: 0xfffffff080200000 for VA: 0xffffffd000000000 [ 0.362607] PA: 0x00000000baddd2d0 for VA: 0xffffffe03abdd2d0 Signed-off-by: Zong Li Reviewed-by: Paul Walmsley Tested-by: Paul Walmsley Signed-off-by: Palmer Dabbelt commit e3de04469a49ee09c89e80bf821508df458ccee6 Author: Coly Li Date: Fri Jan 24 01:01:42 2020 +0800 bcache: reap from tail of c->btree_cache in bch_mca_scan() When shrink btree node cache from c->btree_cache in bch_mca_scan(), no matter the selected node is reaped or not, it will be rotated from the head to the tail of c->btree_cache list. But in bcache journal code, when flushing the btree nodes with oldest journal entry, btree nodes are iterated and slected from the tail of c->btree_cache list in btree_flush_write(). The list_rotate_left() in bch_mca_scan() will make btree_flush_write() iterate more nodes in c->btree_list in reverse order. This patch just reaps the selected btree node cache, and not move it from the head to the tail of c->btree_cache list. Then bch_mca_scan() will not mess up c->btree_cache list to btree_flush_write(). Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit d5c9c470b01177e4d90cdbf178b8c7f37f5b8795 Author: Coly Li Date: Fri Jan 24 01:01:41 2020 +0800 bcache: reap c->btree_cache_freeable from the tail in bch_mca_scan() In order to skip the most recently freed btree node cahce, currently in bch_mca_scan() the first 3 caches in c->btree_cache_freeable list are skipped when shrinking bcache node caches in bch_mca_scan(). The related code in bch_mca_scan() is, 737 list_for_each_entry_safe(b, t, &c->btree_cache_freeable, list) { 738 if (nr <= 0) 739 goto out; 740 741 if (++i > 3 && 742 !mca_reap(b, 0, false)) { lines free cache memory 746 } 747 nr--; 748 } The problem is, if virtual memory code calls bch_mca_scan() and the calculated 'nr' is 1 or 2, then in the above loop, nothing will be shunk. In such case, if slub/slab manager calls bch_mca_scan() for many times with small scan number, it does not help to shrink cache memory and just wasts CPU cycles. This patch just selects btree node caches from tail of the c->btree_cache_freeable list, then the newly freed host cache can still be allocated by mca_alloc(), and at least 1 node can be shunk. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 125d98edd11464c8e0ec9eaaba7d682d0f832686 Author: Coly Li Date: Fri Jan 24 01:01:40 2020 +0800 bcache: remove member accessed from struct btree The member 'accessed' of struct btree is used in bch_mca_scan() when shrinking btree node caches. The original idea is, if b->accessed is set, clean it and look at next btree node cache from c->btree_cache list, and only shrink the caches whose b->accessed is cleaned. Then only cold btree node cache will be shrunk. But when I/O pressure is high, it is very probably that b->accessed of a btree node cache will be set again in bch_btree_node_get() before bch_mca_scan() selects it again. Then there is no chance for bch_mca_scan() to shrink enough memory back to slub or slab system. This patch removes member accessed from struct btree, then once a btree node ache is selected, it will be immediately shunk. By this change, bch_mca_scan() may release btree node cahce more efficiently. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit d44330b7f13e7f243f7d0e0426741219708ff7de Author: Guoju Fang Date: Fri Jan 24 01:01:38 2020 +0800 bcache: print written and keys in trace_bcache_btree_write It's useful to dump written block and keys on btree write, this patch add them into trace_bcache_btree_write. Signed-off-by: Guoju Fang Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 2aa8c529387c25606fdc1484154b92f8bfbc5746 Author: Coly Li Date: Fri Jan 24 01:01:37 2020 +0800 bcache: avoid unnecessary btree nodes flushing in btree_flush_write() the commit 91be66e1318f ("bcache: performance improvement for btree_flush_write()") was an effort to flushing btree node with oldest btree node faster in following methods, - Only iterate dirty btree nodes in c->btree_cache, avoid scanning a lot of clean btree nodes. - Take c->btree_cache as a LRU-like list, aggressively flushing all dirty nodes from tail of c->btree_cache util the btree node with oldest journal entry is flushed. This is to reduce the time of holding c->bucket_lock. Guoju Fang and Shuang Li reported that they observe unexptected extra write I/Os on cache device after applying the above patch. Guoju Fang provideed more detailed diagnose information that the aggressive btree nodes flushing may cause 10x more btree nodes to flush in his workload. He points out when system memory is large enough to hold all btree nodes in memory, c->btree_cache is not a LRU-like list any more. Then the btree node with oldest journal entry is very probably not- close to the tail of c->btree_cache list. In such situation much more dirty btree nodes will be aggressively flushed before the target node is flushed. When slow SATA SSD is used as cache device, such over- aggressive flushing behavior will cause performance regression. After spending a lot of time on debug and diagnose, I find the real condition is more complicated, aggressive flushing dirty btree nodes from tail of c->btree_cache list is not a good solution. - When all btree nodes are cached in memory, c->btree_cache is not a LRU-like list, the btree nodes with oldest journal entry won't be close to the tail of the list. - There can be hundreds dirty btree nodes reference the oldest journal entry, before flushing all the nodes the oldest journal entry cannot be reclaimed. When the above two conditions mixed together, a simply flushing from tail of c->btree_cache list is really NOT a good idea. Fortunately there is still chance to make btree_flush_write() work better. Here is how this patch avoids unnecessary btree nodes flushing, - Only acquire c->journal.lock when getting oldest journal entry of fifo c->journal.pin. In rested locations check the journal entries locklessly, so their values can be changed on other cores in parallel. - In loop list_for_each_entry_safe_reverse(), checking latest front point of fifo c->journal.pin. If it is different from the original point which we get with locking c->journal.lock, it means the oldest journal entry is reclaim on other cores. At this moment, all selected dirty nodes recorded in array btree_nodes[] are all flushed and clean on other CPU cores, it is unncessary to iterate c->btree_cache any longer. Just quit the list_for_each_entry_safe_reverse() loop and the following for-loop will skip all the selected clean nodes. - Find a proper time to quit the list_for_each_entry_safe_reverse() loop. Check the refcount value of orignial fifo front point, if the value is larger than selected node number of btree_nodes[], it means more matching btree nodes should be scanned. Otherwise it means no more matching btee nodes in rest of c->btree_cache list, the loop can be quit. If the original oldest journal entry is reclaimed and fifo front point is updated, the refcount of original fifo front point will be 0, then the loop will be quit too. - Not hold c->bucket_lock too long time. c->bucket_lock is also required for space allocation for cached data, hold it for too long time will block regular I/O requests. When iterating list c->btree_cache, even there are a lot of maching btree nodes, in order to not holding c->bucket_lock for too long time, only BTREE_FLUSH_NR nodes are selected and to flush in following for-loop. With this patch, only btree nodes referencing oldest journal entry are flushed to cache device, no aggressive flushing for unnecessary btree node any more. And in order to avoid blocking regluar I/O requests, each time when btree_flush_write() called, at most only BTREE_FLUSH_NR btree nodes are selected to flush, even there are more maching btree nodes in list c->btree_cache. At last, one more thing to explain: Why it is safe to read front point of c->journal.pin without holding c->journal.lock inside the list_for_each_entry_safe_reverse() loop ? Here is my answer: When reading the front point of fifo c->journal.pin, we don't need to know the exact value of front point, we just want to check whether the value is different from the original front point (which is accurate value because we get it while c->jouranl.lock is held). For such purpose, it works as expected without holding c->journal.lock. Even the front point is changed on other CPU core and not updated to local core, and current iterating btree node has identical journal entry local as original fetched fifo front point, it is still safe. Because after holding mutex b->write_lock (with memory barrier) this btree node can be found as clean and skipped, the loop will quite latter when iterate on next node of list c->btree_cache. Fixes: 91be66e1318f ("bcache: performance improvement for btree_flush_write()") Reported-by: Guoju Fang Reported-by: Shuang Li Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 7a0bc2a8966040d54289b64842d55e2cf4343ad9 Author: Coly Li Date: Fri Jan 24 01:01:36 2020 +0800 bcache: add code comments for state->pool in __btree_sort() To explain the pages allocated from mempool state->pool can be swapped in __btree_sort(), because state->pool is a page pool, which allocates pages by alloc_pages() indeed. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 0e0c12316d8a645e7b1880e135837ee78d18aed9 Author: Ben Dooks (Codethink) Date: Fri Jan 24 01:01:35 2020 +0800 lib: crc64: include for 'crc64_be' The crc64_be() is declared in so include this where the symbol is defined to avoid the following warning: lib/crc64.c:43:12: warning: symbol 'crc64_be' was not declared. Should it be static? Signed-off-by: Ben Dooks (Codethink) Reviewed-by: Andy Shevchenko Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 6321bef028de43724c47cfa7f9dee69ecb783796 Author: Christoph Hellwig Date: Fri Jan 24 01:01:34 2020 +0800 bcache: use read_cache_page_gfp to read the superblock Avoid a pointless dependency on buffer heads in bcache by simply open coding reading a single page. Also add a SB_OFFSET define for the byte offset of the superblock instead of using magic numbers. Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 475389ae5c08656f8bb5cc3adc88a531c7c4877f Author: Christoph Hellwig Date: Fri Jan 24 01:01:33 2020 +0800 bcache: store a pointer to the on-disk sb in the cache and cached_dev structures This allows to properly build the superblock bio including the offset in the page using the normal bio helpers. This fixes writing the superblock for page sizes larger than 4k where the sb write bio would need an offset in the bio_vec. Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit cfa0c56db9c087227988f6af2c7b9888d24a3b16 Author: Christoph Hellwig Date: Fri Jan 24 01:01:32 2020 +0800 bcache: return a pointer to the on-disk sb from read_super Returning the properly typed actual data structure insteaf of the containing struct page will save the callers some work going forward. Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit fc8f19cc5dce183cde4fecb9a1da07d81fa6ea8d Author: Christoph Hellwig Date: Fri Jan 24 01:01:31 2020 +0800 bcache: transfer the sb_page reference to register_{bdev,cache} Avoid an extra reference count roundtrip by transferring the sb_page ownership to the lower level register helpers. Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit ae3cd299919af6eb670d5af0bc9d7ba14086bd8e Author: Coly Li Date: Fri Jan 24 01:01:30 2020 +0800 bcache: fix use-after-free in register_bcache() The patch "bcache: rework error unwinding in register_bcache" introduces a use-after-free regression in register_bcache(). Here are current code, 2510 out_free_path: 2511 kfree(path); 2512 out_module_put: 2513 module_put(THIS_MODULE); 2514 out: 2515 pr_info("error %s: %s", path, err); 2516 return ret; If some error happens and the above code path is executed, at line 2511 path is released, but referenced at line 2515. Then KASAN reports a use- after-free error message. This patch changes line 2515 in the following way to fix the problem, 2515 pr_info("error %s: %s", path?path:"", err); Signed-off-by: Coly Li Cc: Christoph Hellwig Signed-off-by: Jens Axboe commit 29cda393bcaad160c4bf3676ddd99855adafc72f Author: Coly Li Date: Fri Jan 24 01:01:29 2020 +0800 bcache: properly initialize 'path' and 'err' in register_bcache() Patch "bcache: rework error unwinding in register_bcache" from Christoph Hellwig changes the local variables 'path' and 'err' in undefined initial state. If the code in register_bcache() jumps to label 'out:' or 'out_module_put:' by goto, these two variables might be reference with undefined value by the following line, out_module_put: module_put(THIS_MODULE); out: pr_info("error %s: %s", path, err); return ret; Therefore this patch initializes these two local variables properly in register_bcache() to avoid such issue. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 50246693f81fe887f4db78bf7089051d7f1894cc Author: Christoph Hellwig Date: Fri Jan 24 01:01:28 2020 +0800 bcache: rework error unwinding in register_bcache Split the successful and error return path, and use one goto label for each resource to unwind. This also fixes some small errors like leaking the module reference count in the reboot case (which seems entirely harmless) or printing the wrong warning messages for early failures. Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit a702a692cd7559053ea573f4e2c84828f0e62824 Author: Christoph Hellwig Date: Fri Jan 24 01:01:27 2020 +0800 bcache: use a separate data structure for the on-disk super block Split out an on-disk version struct cache_sb with the proper endianness annotations. This fixes a fair chunk of sparse warnings, but there are some left due to the way the checksum is defined. Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit e8547d42095e58bee658f00fef8e33d2a185c927 Author: Liang Chen Date: Fri Jan 24 01:01:26 2020 +0800 bcache: cached_dev_free needs to put the sb page Same as cache device, the buffer page needs to be put while freeing cached_dev. Otherwise a page would be leaked every time a cached_dev is stopped. Signed-off-by: Liang Chen Signed-off-by: Christoph Hellwig Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 1306cc0a30910d92314d18b17a947cd6294ee4af Author: Jiaxun Yang Date: Mon Jan 13 18:15:01 2020 +0800 MIPS: Loongson64: Disable exec hazard Loongson64 has hardware mechanism to prevent hazard issue, so we can simply disable exec hazard in cpu-features. Signed-off-by: Jiaxun Yang Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: chenhc@lemote.com Cc: paul.burton@mips.com Cc: linux-kernel@vger.kernel.org commit 51522217f65f1f937f421d9f417cf0e714ef3c02 Author: Jiaxun Yang Date: Mon Jan 13 18:15:00 2020 +0800 MIPS: Loongson64: Bump ISA level to MIPSR2 Despite early sample of Loongson-3A1000, the whole Loongson64 family have implemented all the features required by MIPS64 Release2. Thus we decide to bump the ISA option to R2. Signed-off-by: Jiaxun Yang Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: chenhc@lemote.com Cc: paul.burton@mips.com Cc: linux-kernel@vger.kernel.org commit ba9196d2e005a07dc616a044a57b47665efe133d Author: Jiaxun Yang Date: Mon Jan 13 18:14:59 2020 +0800 MIPS: Make DIEI support as a config option DI(Disable Interrupt) and EI(Enable Interrupt) instructions is required by MIPSR2/MIPSR6, however, it appears to be buggy on some processors such as Loongson-3A1000. Thus we make it as a config option to allow disable it at compile time with CPU_MIPSR2 selected. Signed-off-by: Jiaxun Yang Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: chenhc@lemote.com Cc: paul.burton@mips.com Cc: linux-kernel@vger.kernel.org commit 85f4c95172d606dd66f7ee1fa50c45a245535ffd Author: Gustavo A. R. Silva Date: Tue Jan 21 11:21:38 2020 -0600 tty: n_hdlc: Use flexible-array member and struct_size() helper Old code in the kernel uses 1-byte and 0-byte arrays to indicate the presence of a "variable length array": struct something { int length; u8 data[1]; }; struct something *instance; instance = kmalloc(sizeof(*instance) + size, GFP_KERNEL); instance->length = size; memcpy(instance->data, source, size); There is also 0-byte arrays. Both cases pose confusion for things like sizeof(), CONFIG_FORTIFY_SOURCE, etc.[1] Instead, the preferred mechanism to declare variable-length types such as the one above is a flexible array member[2] which need to be the last member of a structure and empty-sized: struct something { int stuff; u8 data[]; }; Also, by making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertenly introduced[3] to the codebase from now on. Lastly, make use of the struct_size() helper to safely calculate the allocation size for instances of struct n_hdlc_buf and avoid any potential type mistakes[4][5]. [1] https://github.com/KSPP/linux/issues/21 [2] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") [4] https://lore.kernel.org/lkml/60e14fb7-8596-e21c-f4be-546ce39e7bdb@embeddedor.com/ [5] commit 553d66cb1e86 ("iommu/vt-d: Use struct_size() helper") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20200121172138.GA3162@embeddedor Signed-off-by: Greg Kroah-Hartman commit 636e9d23dd45ec7d637c2c2ca63c38d9aa5c5fbd Author: Colin Ian King Date: Thu Jan 23 00:54:22 2020 +0000 MIPS: OCTEON: octeon-irq: fix spelling mistake "to" -> "too" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: linux-mips@vger.kernel.org Cc: kernel-janitors@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 3e86460ebe2340df6a33b35a55312cc369bdcbd0 Author: Wang Xuerui Date: Thu Jan 23 12:04:09 2020 +0800 MIPS: asm: local: add barriers for Loongson Somehow these LL/SC usages are not taken care of, breaking Loongson builds. Add the SYNCs appropriately. Signed-off-by: Wang Xuerui Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Huacai Chen Cc: Jiaxun Yang Cc: # v5.5+ commit fdabc466f335bc3cbda8eca2270a8af783cae7eb Author: Linus Walleij Date: Thu Jan 23 16:50:13 2020 +0100 usb: phy: phy-gpio-vbus-usb: Convert to GPIO descriptors Instead of using the legacy GPIO API and keeping track on polarity inversion semantics in the driver, switch to use GPIO descriptors for this driver and change all consumers in the process. This makes it possible to retire platform data completely: the only remaining platform data member was "wakeup" which was intended to make the vbus interrupt wakeup capable, but was not set by any users and thus remained unused. VBUS was not waking any devices up. Leave a comment about it so later developers using the platform can consider setting it to always enabled so plugging in USB wakes up the platform. Cc: Daniel Mack Cc: Haojian Zhuang Acked-by: Robert Jarzmik Acked-by: Felipe Balbi Acked-by: Sylwester Nawrocki Acked-by: Philipp Zabel Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20200123155013.93249-1-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman commit 2893c678321904722dd588d91efa074e24828c6f Author: Colin Ian King Date: Thu Jan 23 01:03:44 2020 +0000 staging: comedi: drivers: fix spelling mistake "to" -> "too" There is a spelling mistake in a deb_dbg message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20200123010344.2834618-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 52b0c4709d23ad018a6acf34ca194fa60c71814b Author: Tetsuhiro Kohada Date: Thu Jan 23 19:24:45 2020 +0900 staging: exfat: remove fs_func struct. Remove 'fs_func struct' and change indirect calls to direct calls. The following issues are described in exfat's TODO. > Create helper function for exfat_set_entry_time () and > exfat_set_entry_type () because it's sort of ugly to be calling the same functionn directly and other code calling through the fs_func struc ponters ... The fs_func struct was used for switching the helper functions of fat16/fat32/exfat. Now, it has lost the role of switching, just making the code less readable. Signed-off-by: Tetsuhiro Kohada Link: https://lore.kernel.org/r/20200123102445.123033-1-Kohada.Tetsuhiro@dc.MitsubishiElectric.co.jp Signed-off-by: Greg Kroah-Hartman commit bd4217cb9d54171a109fe63d0ac801cc7a18edb9 Author: Ajay Singh Date: Thu Jan 23 12:50:49 2020 +0000 staging: wilc1000: avoid mutex unlock without lock in wilc_wlan_handle_txq() In wilc_wlan_handle_txq(), mutex unlock was called without acquiring it. Also error code for full VMM condition was incorrect as discussed in [1]. Now used a proper code to indicate VMM is full, for which transfer to VMM is required again. 'wilc_wlan_handle_txq()' should be called again if the VMM space was full earlier or otherwise based on 'txq_event' signal. 1. https://lore.kernel.org/driverdev-devel/20191113183322.a54mh2w6dulklgsd@kili.mountain/ Signed-off-by: Ajay Singh Link: https://lore.kernel.org/r/20200123182129.4053-2-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman commit 7a80aa23d0f0f52478339840577137f556bf9121 Author: Ajay Singh Date: Thu Jan 23 12:50:47 2020 +0000 staging: wilc1000: return zero on success and non-zero on function failure Some of the HIF layer API's return zero for failure and non-zero for success condition. Now, modified the functions to return zero for success and non-zero for failure as its recommended approach suggested in [1]. 1. https://lore.kernel.org/driverdev-devel/20191113183322.a54mh2w6dulklgsd@kili.mountain/ Signed-off-by: Ajay Singh Link: https://lore.kernel.org/r/20200123182129.4053-1-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman commit 2256e6f68c9e02524182640ba9584d978d490145 Author: Tony Lindgren Date: Sun Jan 19 11:56:59 2020 -0800 ARM: dts: omap4-droid4: Enable hdq for droid4 ds250x 1-wire battery nvmem With "[PATCHv3] w1: omap-hdq: Simplify driver with PM runtime autosuspend" we can read the droid4 battery information over 1-wire with this patch with something like: # modprobe omap_hdq # hd /sys/bus/w1/devices/89-*/89-*/nvmem ... Unfortunately the format of the battery data seems to be Motorola specific and is currently unusable for battery charger unless somebody figures out what it means. Note that currently keeping omap_hdq module loaded will cause extra power consumption as it seems to scan devices periodically. Cc: Merlijn Wajer Cc: Pavel Machek Acked-by: Pavel Machek Signed-off-by: Tony Lindgren commit 36f808f2f1e9edb6fb129002a5ae71551b925225 Author: Tony Lindgren Date: Sun Jan 19 11:45:01 2020 -0800 ARM: dts: motorola-cpcap-mapphone: Configure calibration interrupt We added coulomb counter calibration support With commit 0cb90f071f73 ("power: supply: cpcap-battery: Add basic coulomb counter calibrate support"), but we also need to configure the related interrupt. Without the interrupt calibration happens based on a timeout after two seconds, with the interrupt the calibration just gets done a bit faster. Cc: Merlijn Wajer Cc: Pavel Machek Acked-by: Pavel Machek Signed-off-by: Tony Lindgren commit a5ebccc822d8f84cd899e3e64f770f2bd4d7951b Author: Tony Lindgren Date: Fri Nov 8 13:31:25 2019 -0800 ARM: dts: Configure interconnect target module for am437x sgx This seems to be similar to what we have for am335x. The following can be tested via sysfs with the to ensure the SGX module gets enabled and disabled properly: # echo on > /sys/bus/platform/devices/5600fe00.target-module/power/control # rwmem 0x5600fe00 # revision register 0x5600fe00 = 0x40000000 # echo auto > /sys/bus/platform/devices/5600fe00.target-module/power/control # rwmem 0x5000fe00 Bus error Note that this patch depends on the PRM rstctrl driver that has been recently posted. If the child device driver(s) need to prevent rstctrl reset on PM runtime suspend, the drivers need to increase the usecount for the shared rstctrl reset that can be mapped also for the child device(s) or accessed via dev->parent. Cc: Adam Ford Cc: Filip Matijević Cc: "H. Nikolaus Schaller" Cc: Ivaylo Dimitrov Cc: moaz korena Cc: Merlijn Wajer Cc: Paweł Chmiel Cc: Philipp Rossak Cc: Tomi Valkeinen Signed-off-by: Tony Lindgren commit 45e118b7805e618db39a2b1b85bd50d8c8614643 Author: Tony Lindgren Date: Fri Nov 1 09:31:23 2019 -0700 ARM: dts: Configure sgx for dra7 I've tested that the interconnect target module enables and idles just fine when probed with ti-sysc with PM runtime control via sys: # echo on > $(find /sys -name control | grep \/5600) # rwmem 0x5600fe00 # OCP Revision 0x5600fe00 = 0x40000000 # echo auto > $(find /sys -name control | grep \/5600) Cc: "H. Nikolaus Schaller" Cc: Robert Nelson Cc: Tomi Valkeinen Signed-off-by: Tony Lindgren commit c3fb99f46efdd34ea84c1968065aaa15164d4500 Author: Tony Lindgren Date: Wed Aug 14 06:14:08 2019 -0700 ARM: dts: Configure rstctrl reset for am335x SGX The following can be tested via sysfs with the following to ensure the SGX module gets enabled and disabled properly: # echo on > /sys/bus/platform/devices/5600fe00.target-module/power/control # rwmem 0x5600fe00 # revision register 0x5600fe00 = 0x40000000 # echo auto > /sys/bus/platform/devices/5600fe00.target-module/power/control # rwmem 0x5000fe00 Bus error Note that this patch depends on the PRM rstctrl driver that has been recently posted. If the child device driver(s) need to prevent rstctrl reset on PM runtime suspend, the drivers need to increase the usecount for the shared rstctrl reset that can be mapped also for the child device(s) or accessed via dev->parent. Cc: Adam Ford Cc: Filip Matijević Cc: "H. Nikolaus Schaller" Cc: Ivaylo Dimitrov Cc: moaz korena Cc: Merlijn Wajer Cc: Paweł Chmiel Cc: Philipp Rossak Cc: Tomi Valkeinen Signed-off-by: Tony Lindgren commit d7a9d45d5f060aec1e1909e3d57da5635a1bac97 Merge: 6bcc319fc619 1a2095160594 Author: Tony Lindgren Date: Thu Jan 23 09:59:29 2020 -0800 Merge branch 'omap-for-v5.6/ti-sysc-dt-cam' into omap-for-v5.6/dt commit 1a2095160594f52ce8fecca634038f1deeb3577c Author: Benoit Parrot Date: Wed Dec 11 08:08:10 2019 -0600 ARM: dts: dra7: Add ti-sysc node for VPE Add VPE node as a child of l4 interconnect in order for it to probe using ti-sysc. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit 79312524dbf1c3b24226e1804235c2578422c86d Author: Benoit Parrot Date: Wed Dec 11 08:08:09 2019 -0600 ARM: dts: dra7: add vpe clkctrl node Add clkctrl nodes for VPE module. Note that because of the current dts node name dependency for mapping to clock domain, we must still use "vpe-clkctrl@" naming instead of generic "clock@" naming for the node. And because of this, it's probably best to apply the dts node addition together along with the other clock changes. Signed-off-by: Benoit Parrot Acked-by: Tony Lindgren Signed-off-by: Tony Lindgren commit d916ab415b5f4583e79ecd6ecc17b0bd414abcc3 Author: Benoit Parrot Date: Wed Dec 11 08:07:20 2019 -0600 ARM: dts: am43x-epos-evm: Add VPFE and OV2659 entries Add VPFE device nodes entries. Add OmniVision OV2659 sensor device nodes and linkage. Since Rev1.2a on this board the sensor source clock (xvclk) has a dedicated 12Mhz oscillator instead of using clkout1. Add 'audio_mstrclk' fixed clock object to represent it. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit f8404f159515eae8495ec042ab964660fcc165ce Author: Benoit Parrot Date: Wed Dec 11 08:07:19 2019 -0600 ARM: dts: am437x-sk-evm: Add VPFE and OV2659 entries Add VPFE device nodes entries. Add OmniVision OV2659 sensor device nodes and linkage. The sensor clock (xvclk) is sourced from clkout1. Add clock entries to properly select clkout1 and set its parent clock to sys_clkin_ck. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit 01053dadb79d63b65f7b353e68b4b6ccf4effedb Author: Tero Kristo Date: Wed Dec 11 08:07:18 2019 -0600 ARM: dts: am43xx: add support for clkout1 clock clkout1 clock node and its generation tree was missing. Add this based on the data on TRM and PRCM functional spec. commit 664ae1ab2536 ("ARM: dts: am43xx: add clkctrl nodes") effectively reverted this commit 8010f13a40d3 ("ARM: dts: am43xx: add support for clkout1 clock") which is needed for the ov2659 camera sensor clock definition hence it is being re-applied here. Note that because of the current dts node name dependency for mapping to clock domain, we must still use "clkout1-*ck" naming instead of generic "clock@" naming for the node. And because of this, it's probably best to apply the dts node addition together along with the other clock changes. Fixes: 664ae1ab2536 ("ARM: dts: am43xx: add clkctrl nodes") Signed-off-by: Tero Kristo Tested-by: Benoit Parrot Acked-by: Tony Lindgren Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit fc7100ea2a52fcf200be75421bfd32652827d287 Author: Hridya Valsaraju Date: Wed Jan 22 10:51:16 2020 -0800 f2fs: Add f2fs stats to sysfs Currently f2fs stats are only available from /d/f2fs/status. This patch adds some of the f2fs stats to sysfs so that they are accessible even when debugfs is not mounted. The following sysfs nodes are added: -/sys/fs/f2fs//free_segments -/sys/fs/f2fs//cp_foreground_calls -/sys/fs/f2fs//cp_background_calls -/sys/fs/f2fs//gc_foreground_calls -/sys/fs/f2fs//gc_background_calls -/sys/fs/f2fs//moved_blocks_foreground -/sys/fs/f2fs//moved_blocks_background -/sys/fs/f2fs//avg_vblocks Signed-off-by: Hridya Valsaraju [Jaegeuk Kim: allow STAT_FS without DEBUG_FS] Signed-off-by: Jaegeuk Kim commit 831d2fa25ab8e27592b1b0268dae6f2dfaf7cc43 Author: Filipe Manana Date: Mon Dec 16 18:26:56 2019 +0000 Btrfs: make deduplication with range including the last block work Since btrfs was migrated to use the generic VFS helpers for clone and deduplication, it stopped allowing for the last block of a file to be deduplicated when the source file size is not sector size aligned (when eof is somewhere in the middle of the last block). There are two reasons for that: 1) The generic code always rounds down, to a multiple of the block size, the range's length for deduplications. This means we end up never deduplicating the last block when the eof is not block size aligned, even for the safe case where the destination range's end offset matches the destination file's size. That rounding down operation is done at generic_remap_check_len(); 2) Because of that, the btrfs specific code does not expect anymore any non-aligned range length's for deduplication and therefore does not work if such nona-aligned length is given. This patch addresses that second part, and it depends on a patch that fixes generic_remap_check_len(), in the VFS, which was submitted ealier and has the following subject: "fs: allow deduplication of eof block into the end of the destination file" These two patches address reports from users that started seeing lower deduplication rates due to the last block never being deduplicated when the file size is not aligned to the filesystem's block size. Link: https://lore.kernel.org/linux-btrfs/2019-1576167349.500456@svIo.N5dq.dFFD/ CC: stable@vger.kernel.org # 5.1+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a5e6ea18e3d132be4716eb5fdd520c2c234e3003 Author: Filipe Manana Date: Mon Dec 16 18:26:55 2019 +0000 fs: allow deduplication of eof block into the end of the destination file We always round down, to a multiple of the filesystem's block size, the length to deduplicate at generic_remap_check_len(). However this is only needed if an attempt to deduplicate the last block into the middle of the destination file is requested, since that leads into a corruption if the length of the source file is not block size aligned. When an attempt to deduplicate the last block into the end of the destination file is requested, we should allow it because it is safe to do it - there's no stale data exposure and we are prepared to compare the data ranges for a length not aligned to the block (or page) size - in fact we even do the data compare before adjusting the deduplication length. After btrfs was updated to use the generic helpers from VFS (by commit 34a28e3d77535e ("Btrfs: use generic_remap_file_range_prep() for cloning and deduplication")) we started to have user reports of deduplication not reflinking the last block anymore, and whence users getting lower deduplication scores. The main use case is deduplication of entire files that have a size not aligned to the block size of the filesystem. We already allow cloning the last block to the end (and beyond) of the destination file, so allow for deduplication as well. Link: https://lore.kernel.org/linux-btrfs/2019-1576167349.500456@svIo.N5dq.dFFD/ CC: stable@vger.kernel.org # 5.1+ Reviewed-by: Josef Bacik Reviewed-by: Darrick J. Wong Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6080d608eeff7cb5090a2ddbaf723bfb0ff133fc Author: Madhuparna Bhowmik Date: Wed Jan 22 22:34:47 2020 +0530 module.h: Annotate mod_kallsyms with __rcu This patch fixes the following sparse errors: kernel/module.c:3623:9: error: incompatible types in comparison expression kernel/module.c:4060:41: error: incompatible types in comparison expression kernel/module.c:4203:28: error: incompatible types in comparison expression kernel/module.c:4225:41: error: incompatible types in comparison expression Signed-off-by: Madhuparna Bhowmik Signed-off-by: Jessica Yu commit 3bd7b487a6dd3e43475bb473ecb8b9c5203a0de1 Author: Benoit Parrot Date: Wed Dec 11 08:05:56 2019 -0600 arm: dts: dra76-evm: Add CAL and OV5640 nodes Add device nodes for CSI2 camera board OV5640. Add the CAL port nodes with the necessary linkage to the ov5640 nodes. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit 807276375ff44bdd5f94d26021ae630b5ed64bfc Author: Benoit Parrot Date: Wed Dec 11 08:05:55 2019 -0600 arm: dtsi: dra76x: Add CAL dtsi node Add the required dtsi node to support the Camera Adaptation Layer (CAL) for the DRA76 family of devices. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit 414dc3d33b912fb1a98b0d2df05e16e359705fd3 Author: Benoit Parrot Date: Wed Dec 11 08:05:54 2019 -0600 arm: dts: dra72-evm-common: Add entries for the CSI2 cameras Add device nodes for CSI2 camera board OV5640. Add the CAL port nodes with the necessary linkage to the ov5640 nodes. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit 86a7e226dd73f8676f2bee6dccf5a705f649521a Author: Benoit Parrot Date: Wed Dec 11 08:05:53 2019 -0600 ARM: dts: DRA72: Add CAL dtsi node This patch adds the required dtsi node to support the Camera Adaptation Layer (CAL) for the DRA72 family of devices. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit b31617258977ff1e63c8c3582fb27207f8ec292d Author: Benoit Parrot Date: Wed Dec 11 08:05:52 2019 -0600 ARM: dts: dra7-l4: Add ti-sysc node for CAM Add CAM nodes as a child of l4 interconnect in order for it to probe using ti-sysc. Signed-off-by: Benoit Parrot Signed-off-by: Tony Lindgren commit 2baee0c5b359a4ce76f56b06c6cc4d7d642537a9 Author: Benoit Parrot Date: Wed Dec 11 08:05:51 2019 -0600 ARM: OMAP: DRA7xx: Make CAM clock domain SWSUP only Both CAL and VIP rely on this clock domain. But CAL DPHY require LVDSRX_96M_GFCLK to be active. When this domain is set to HWSUP the LVDSRX_96M_GFCLK is on;y active when VIP1 clock is also active. If only CAL on DRA72x (which uses the VIP2 clkctrl) probes the CAM domain is enabled but the LVDSRX_96M_GFCLK is left gated. Since LVDSRX_96M_GFCLK is sourcing the input clock to the DPHY then actual frame capture cannot start as the phy are inactive. So we either have to also enabled VIP1 even if we don't intend on using it or we need to set the CAM domain to use SWSUP only. This patch implements the latter. Signed-off-by: Benoit Parrot Acked-by: Tony Lindgren Signed-off-by: Tony Lindgren commit 215d103f36626da36c424aa7309ae1b5e7e38d14 Author: Benoit Parrot Date: Wed Dec 11 08:05:50 2019 -0600 ARM: dts: dra7: add cam clkctrl node Add clkctrl nodes for CAM domain. Note that because of the current dts node name dependency for mapping to clock domain, we must still use "cam-clkctrl@" naming instead of generic "clock@" naming for the node. And because of this, it's probably best to apply the dts node addition together along with the other clock changes. Signed-off-by: Benoit Parrot Acked-by: Tony Lindgren Signed-off-by: Tony Lindgren commit 4068664e3cd2312610ceac05b74c4cf1853b8325 Author: Dmitry Monakhov Date: Wed Nov 6 12:25:02 2019 +0000 ext4: fix extent_status fragmentation for plain files Extents are cached in read_extent_tree_block(); as a result, extents are not cached for inodes with depth == 0 when we try to find the extent using ext4_find_extent(). The result of the lookup is cached in ext4_map_blocks() but is only a subset of the extent on disk. As a result, the contents of extents status cache can get very badly fragmented for certain workloads, such as a random 4k read workload. File size of /mnt/test is 33554432 (8192 blocks of 4096 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 8191: 40960.. 49151: 8192: last,eof $ perf record -e 'ext4:ext4_es_*' /root/bin/fio --name=t --direct=0 --rw=randread --bs=4k --filesize=32M --size=32M --filename=/mnt/test $ perf script | grep ext4_es_insert_extent | head -n 10 fio 131 [000] 13.975421: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [494/1) mapped 41454 status W fio 131 [000] 13.975939: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6064/1) mapped 47024 status W fio 131 [000] 13.976467: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6907/1) mapped 47867 status W fio 131 [000] 13.976937: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3850/1) mapped 44810 status W fio 131 [000] 13.977440: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3292/1) mapped 44252 status W fio 131 [000] 13.977931: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [6882/1) mapped 47842 status W fio 131 [000] 13.978376: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [3117/1) mapped 44077 status W fio 131 [000] 13.978957: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [2896/1) mapped 43856 status W fio 131 [000] 13.979474: ext4:ext4_es_insert_extent: dev 253,0 ino 12 es [7479/1) mapped 48439 status W Fix this by caching the extents for inodes with depth == 0 in ext4_find_extent(). [ Renamed ext4_es_cache_extents() to ext4_cache_extents() since this newly added function is not in extents_cache.c, and to avoid potential visual confusion with ext4_es_cache_extent(). -TYT ] Signed-off-by: Dmitry Monakhov Link: https://lore.kernel.org/r/20191106122502.19986-1-dmonakhov@gmail.com Signed-off-by: Theodore Ts'o commit 885d21e4956dd70fcd84ed653a8368c9729cfb3e Merge: a25e29bd0fe9 ddf664da3b9c Author: Tony Lindgren Date: Thu Jan 23 08:38:34 2020 -0800 Merge branch 'omap-for-v5.6/ti-sysc-omap45-rng' into omap-for-v5.6/ti-sysc-drop-pdata commit ddf664da3b9c6d5c31e0d0c6e5aeb3e65250fdff Author: Tony Lindgren Date: Thu Dec 12 09:46:14 2019 -0800 ARM: OMAP2+: Drop legacy platform data for omap4 des We can now probe devices with ti-sysc interconnect driver and dts data. Let's drop the related platform data and custom ti,hwmods dts property. As we're just dropping data, and the early platform data init is based on the custom ti,hwmods property, we want to drop both the platform data and ti,hwmods property in a single patch. Cc: Tero Kristo Signed-off-by: Tony Lindgren commit bea5e904728e797fce2fb21e119f3831aa640d07 Author: Tony Lindgren Date: Thu Dec 12 09:46:13 2019 -0800 ARM: OMAP2+: Drop legacy platform data for omap4 sham We can now probe devices with ti-sysc interconnect driver and dts data. Let's drop the related platform data and custom ti,hwmods dts property. As we're just dropping data, and the early platform data init is based on the custom ti,hwmods property, we want to drop both the platform data and ti,hwmods property in a single patch. Cc: Tero Kristo Signed-off-by: Tony Lindgren commit 814b253877345d01d78ea4786ad246c16e537378 Author: Tony Lindgren Date: Thu Dec 12 09:46:13 2019 -0800 ARM: OMAP2+: Drop legacy platform data for omap4 aes We can now probe devices with ti-sysc interconnect driver and dts data. Let's drop the related platform data and custom ti,hwmods dts property. As we're just dropping data, and the early platform data init is based on the custom ti,hwmods property, we want to drop both the platform data and ti,hwmods property in a single patch. Cc: Tero Kristo Signed-off-by: Tony Lindgren commit 23673f17358ac2bb4d3b33dad3f5645b54937344 Author: Tony Lindgren Date: Thu Dec 12 09:46:13 2019 -0800 ARM: dts: Configure interconnect target module for omap4 des We can now probe devices with device tree only configuration using ti-sysc interconnect target module driver. Let's configure the module, but keep the legacy "ti,hwmods" peroperty to avoid new boot time warnings. The legacy property will be removed in later patches together with the legacy platform data. Cc: Tero Kristo Signed-off-by: Tony Lindgren commit 316a418e28b6a4c72b991eebdd191c44ad5c2215 Author: Tony Lindgren Date: Thu Dec 12 09:46:12 2019 -0800 ARM: dts: Configure interconnect target module for omap4 aes We can now probe devices with device tree only configuration using ti-sysc interconnect target module driver. Let's configure the module, but keep the legacy "ti,hwmods" peroperty to avoid new boot time warnings. The legacy property will be removed in later patches together with the legacy platform data. Cc: Tero Kristo Signed-off-by: Tony Lindgren commit 4e19443da1941050b346f8fc4c368aa68413bc88 Author: Josef Bacik Date: Tue Jan 21 09:17:06 2020 -0500 btrfs: free block groups after free'ing fs trees Sometimes when running generic/475 we would trip the WARN_ON(cache->reserved) check when free'ing the block groups on umount. This is because sometimes we don't commit the transaction because of IO errors and thus do not cleanup the tree logs until at umount time. These blocks are still reserved until they are cleaned up, but they aren't cleaned up until _after_ we do the free block groups work. Fix this by moving the free after free'ing the fs roots, that way all of the tree logs are cleaned up and we have a properly cleaned fs. A bunch of loops of generic/475 confirmed this fixes the problem. CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1362089d2ad7e20d16371b39d3c11990d4ec23e4 Author: Nikolay Borisov Date: Fri Jan 10 14:11:35 2020 +0200 btrfs: Fix split-brain handling when changing FSID to metadata uuid Current code doesn't correctly handle the situation which arises when a file system that has METADATA_UUID_INCOMPAT flag set and has its FSID changed to the one in metadata uuid. This causes the incompat flag to disappear. In case of a power failure we could end up in a situation where part of the disks in a multi-disk filesystem are correctly reverted to METADATA_UUID_INCOMPAT flag unset state, while others have METADATA_UUID_INCOMPAT set and CHANGING_FSID_V2_IN_PROGRESS. This patch corrects the behavior required to handle the case where a disk of the second type is scanned first, creating the necessary btrfs_fs_devices. Subsequently, when a disk which has already completed the transition is scanned it should overwrite the data in btrfs_fs_devices. Reported-by: Su Yue Reviewed-by: Josef Bacik Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 05840710149c7d1a78ea85a2db5723f706e97d8f Author: Nikolay Borisov Date: Fri Jan 10 14:11:34 2020 +0200 btrfs: Handle another split brain scenario with metadata uuid feature There is one more cases which isn't handled by the original metadata uuid work. Namely, when a filesystem has METADATA_UUID incompat bit and the user decides to change the FSID to the original one e.g. have metadata_uuid and fsid match. In case of power failure while this operation is in progress we could end up in a situation where some of the disks have the incompat bit removed and the other half have both METADATA_UUID_INCOMPAT and FSID_CHANGING_IN_PROGRESS flags. This patch handles the case where a disk that has successfully changed its FSID such that it equals METADATA_UUID is scanned first. Subsequently when a disk with both METADATA_UUID_INCOMPAT/FSID_CHANGING_IN_PROGRESS flags is scanned find_fsid_changed won't be able to find an appropriate btrfs_fs_devices. This is done by extending find_fsid_changed to correctly find btrfs_fs_devices whose metadata_uuid/fsid are the same and they match the metadata_uuid of the currently scanned device. Fixes: cc5de4e70256 ("btrfs: Handle final split-brain possibility during fsid change") Reviewed-by: Josef Bacik Reported-by: Su Yue Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit c6730a0e5778bf2d83189f97ab5e3efe61f6aad1 Author: Su Yue Date: Fri Jan 10 14:11:33 2020 +0200 btrfs: Factor out metadata_uuid code from find_fsid. find_fsid became rather hairy with the introduction of metadata uuid changing feature. Alleviate this by factoring out the metadata uuid specific code in a dedicated function which deals with finding correct fsid for a device with changed uuid. Reviewed-by: Josef Bacik Signed-off-by: Su Yue Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit c0d81c7cb236782d674ae5701d1a237949e47a7a Author: Su Yue Date: Fri Jan 10 14:11:32 2020 +0200 btrfs: Call find_fsid from find_fsid_inprogress Since find_fsid_inprogress should also handle the case in which an fs didn't change its FSID make it call find_fsid directly. This makes the code in device_list_add simpler by eliminating a conditional call of find_fsid. No functional changes. Reviewed-by: Josef Bacik Signed-off-by: Su Yue Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit b5e4ff9d465da1233a2d9a47ebce487c70d8f4ab Author: Filipe Manana Date: Wed Jan 15 13:21:35 2020 +0000 Btrfs: fix infinite loop during fsync after rename operations Recently fsstress (from fstests) sporadically started to trigger an infinite loop during fsync operations. This turned out to be because support for the rename exchange and whiteout operations was added to fsstress in fstests. These operations, unlike any others in fsstress, cause file names to be reused, whence triggering this issue. However it's not necessary to use rename exchange and rename whiteout operations trigger this issue, simple rename operations and file creations are enough to trigger the issue. The issue boils down to when we are logging inodes that conflict (that had the name of any inode we need to log during the fsync operation), we keep logging them even if they were already logged before, and after that we check if there's any other inode that conflicts with them and then add it again to the list of inodes to log. Skipping already logged inodes fixes the issue. Consider the following example: $ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt $ mkdir /mnt/testdir # inode 257 $ touch /mnt/testdir/zz # inode 258 $ ln /mnt/testdir/zz /mnt/testdir/zz_link $ touch /mnt/testdir/a # inode 259 $ sync # The following 3 renames achieve the same result as a rename exchange # operation ( /mnt/testdir/zz_link to /mnt/testdir/a). $ mv /mnt/testdir/a /mnt/testdir/a/tmp $ mv /mnt/testdir/zz_link /mnt/testdir/a $ mv /mnt/testdir/a/tmp /mnt/testdir/zz_link # The following rename and file creation give the same result as a # rename whiteout operation ( zz to a2). $ mv /mnt/testdir/zz /mnt/testdir/a2 $ touch /mnt/testdir/zz # inode 260 $ xfs_io -c fsync /mnt/testdir/zz --> results in the infinite loop The following steps happen: 1) When logging inode 260, we find that its reference named "zz" was used by inode 258 in the previous transaction (through the commit root), so inode 258 is added to the list of conflicting indoes that need to be logged; 2) After logging inode 258, we find that its reference named "a" was used by inode 259 in the previous transaction, and therefore we add inode 259 to the list of conflicting inodes to be logged; 3) After logging inode 259, we find that its reference named "zz_link" was used by inode 258 in the previous transaction - we add inode 258 to the list of conflicting inodes to log, again - we had already logged it before at step 3. After logging it again, we find again that inode 259 conflicts with him, and we add again 259 to the list, etc - we end up repeating all the previous steps. So fix this by skipping logging of conflicting inodes that were already logged. Fixes: 6b5fc433a7ad67 ("Btrfs: fix fsync after succession of renames of different files") CC: stable@vger.kernel.org # 5.1+ Signed-off-by: Filipe Manana Reviewed-by: Josef Bacik Signed-off-by: David Sterba commit d62b23c94952e78211a383b7d90ef0afbd9a3717 Author: Josef Bacik Date: Fri Jan 17 08:57:51 2020 -0500 btrfs: set trans->drity in btrfs_commit_transaction If we abort a transaction we have the following sequence if (!trans->dirty && list_empty(&trans->new_bgs)) return; WRITE_ONCE(trans->transaction->aborted, err); The idea being if we didn't modify anything with our trans handle then we don't really need to abort the whole transaction, maybe the other trans handles are fine and we can carry on. However in the case of create_snapshot we add a pending_snapshot object to our transaction and then commit the transaction. We don't actually modify anything. sync() behaves the same way, attach to an existing transaction and commit it. This means that if we have an IO error in the right places we could abort the committing transaction with our trans->dirty being not set and thus not set transaction->aborted. This is a problem because in the create_snapshot() case we depend on pending->error being set to something, or btrfs_commit_transaction returning an error. If we are not the trans handle that gets to commit the transaction, and we're waiting on the commit to happen we get our return value from cur_trans->aborted. If this was not set to anything because sync() hit an error in the transaction commit before it could modify anything then cur_trans->aborted would be 0. Thus we'd return 0 from btrfs_commit_transaction() in create_snapshot. This is a problem because we then try to do things with pending_snapshot->snap, which will be NULL because we didn't create the snapshot, and then we'll get a NULL pointer dereference like the following "BUG: kernel NULL pointer dereference, address: 00000000000001f0" RIP: 0010:btrfs_orphan_cleanup+0x2d/0x330 Call Trace: ? btrfs_mksubvol.isra.31+0x3f2/0x510 btrfs_mksubvol.isra.31+0x4bc/0x510 ? __sb_start_write+0xfa/0x200 ? mnt_want_write_file+0x24/0x50 btrfs_ioctl_snap_create_transid+0x16c/0x1a0 btrfs_ioctl_snap_create_v2+0x11e/0x1a0 btrfs_ioctl+0x1534/0x2c10 ? free_debug_processing+0x262/0x2a3 do_vfs_ioctl+0xa6/0x6b0 ? do_sys_open+0x188/0x220 ? syscall_trace_enter+0x1f8/0x330 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4a/0x1b0 In order to fix this we need to make sure anybody who calls commit_transaction has trans->dirty set so that they properly set the trans->transaction->aborted value properly so any waiters know bad things happened. This was found while I was running generic/475 with my modified fsstress, it reproduced within a few runs. I ran with this patch all night and didn't see the problem again. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 889bfa39086e86b52fcfaa04d72c95eaeb12f9a5 Author: Josef Bacik Date: Fri Jan 17 09:12:45 2020 -0500 btrfs: drop log root for dropped roots If we fsync on a subvolume and create a log root for that volume, and then later delete that subvolume we'll never clean up its log root. Fix this by making switch_commit_roots free the log for any dropped roots we encounter. The extra churn is because we need a btrfs_trans_handle, not the btrfs_transaction. CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 668e48af7a94985be7cf3b97a860d9819271d8bf Author: Anand Jain Date: Mon Jan 6 19:38:31 2020 +0800 btrfs: sysfs, add devid/dev_state kobject and device attributes New sysfs attributes that track the filesystem status of devices, stored in the per-filesystem directory in /sys/fs/btrfs/FSID/devinfo . There's a directory for each device, with name corresponding to the numerical device id. in_fs_metadata - device is in the list of fs metadata missing - device is missing (no device node or block device) replace_target - device is target of replace writeable - writes from fs are allowed These attributes reflect the state of the device::dev_state and created at mount time. Sample output: $ pwd /sys/fs/btrfs/6e1961f1-5918-4ecc-a22f-948897b409f7/devinfo/1/ $ ls in_fs_metadata missing replace_target writeable $ cat missing 0 The output from these attributes are 0 or 1. 0 indicates unset and 1 indicates set. These attributes are readonly. It is observed that the device delete thread and sysfs read thread will not race because the delete thread calls sysfs kobject_put() which in turn waits for existing sysfs read to complete. Note for device replace devid swap: During the replace the target device temporarily assumes devid 0 before assigning the devid of the soruce device. In btrfs_dev_replace_finishing() we remove source sysfs devid using the function btrfs_sysfs_remove_devices_attr(), so after that call kobject_rename() to update the devid in the sysfs. This adds and calls btrfs_sysfs_update_devid() helper function to update the device id. Signed-off-by: Anand Jain Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit 1776ad172e1ff09d4aa57daac74c56b4e1b0c636 Author: Nikolay Borisov Date: Tue Nov 19 14:05:53 2019 +0200 btrfs: Refactor btrfs_rmap_block to improve readability Move variables to appropriate scope. Remove last BUG_ON in the function and rework error handling accordingly. Make the duplicate detection code more straightforward. Use in_range macro. And give variables more descriptive name by explicitly distinguishing between IO stripe size (size recorded in the chunk item) and data stripe size (the size of an actual stripe, constituting a logical chunk/block group). Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit bf2e2eb060fa29dd892fa42dd0a03f130815acf0 Author: Nikolay Borisov Date: Tue Dec 10 20:00:45 2019 +0200 btrfs: Add self-tests for btrfs_rmap_block Add RAID1 and single testcases to verify that data stripes are excluded from super block locations and that the address mapping is valid. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit b3ad2c17fd80f2db3b824c28691adaaa4ffa2fc4 Author: Nikolay Borisov Date: Tue Nov 19 14:05:51 2019 +0200 btrfs: selftests: Add support for dummy devices Add basic infrastructure to create and link dummy btrfs_devices. This will be used in the pending btrfs_rmap_block test which deals with the block groups. Calling btrfs_alloc_dummy_device will link the newly created device to the passed fs_info and the test framework will free them once the test is finished. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 96a14336bd8fc13cc3db036a5745acdf3bc185f4 Author: Nikolay Borisov Date: Tue Dec 10 19:57:51 2019 +0200 btrfs: Move and unexport btrfs_rmap_block It's used only during initial block group reading to map physical address of super block to a list of logical ones. Make it private to block-group.c, add proper kernel doc and ensure it's exported only for tests. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 68c467cbb2f389b6c933e235bce0d1756fc8cc34 Author: David Sterba Date: Mon Dec 16 20:00:48 2019 +0100 btrfs: separate definition of assertion failure handlers There's a report where objtool detects unreachable instructions, eg.: fs/btrfs/ctree.o: warning: objtool: btrfs_search_slot()+0x2d4: unreachable instruction This seems to be a false positive due to compiler version. The cause is in the ASSERT macro implementation that does the conditional check as IS_DEFINED(CONFIG_BTRFS_ASSERT) and not an #ifdef. To avoid that, use the ifdefs directly. There are still 2 reports that aren't fixed: fs/btrfs/extent_io.o: warning: objtool: __set_extent_bit()+0x71f: unreachable instruction fs/btrfs/relocation.o: warning: objtool: find_data_references()+0x4e0: unreachable instruction Co-developed-by: Josh Poimboeuf Signed-off-by: Josh Poimboeuf Reported-by: Randy Dunlap Signed-off-by: David Sterba commit 18c48e6d5bb21558ea7f9bcc8e263b83fbad127a Author: Tony Lindgren Date: Thu Dec 12 09:46:12 2019 -0800 ARM: dts: Configure interconnect target module for omap4 sham We can now probe devices with device tree only configuration using ti-sysc interconnect target module driver. Let's configure the module, but keep the legacy "ti,hwmods" peroperty to avoid new boot time warnings. The legacy property will be removed in later patches together with the legacy platform data. Cc: Tero Kristo Signed-off-by: Tony Lindgren commit 30c2d7ca3fbcee7920979097b2d9bd5b0114ff68 Author: Tony Lindgren Date: Thu Dec 12 09:46:11 2019 -0800 ARM: dts: Configure omap5 rng to probe with ti-sysc This is similar to dra7 and omap4 with different clock naming and module address. Cc: devicetree@vger.kernel.org Cc: Rob Herring Signed-off-by: Tony Lindgren commit fbb8bb8370f6fdaaaccf85201f4ee2a665aae42d Author: Tony Lindgren Date: Thu Dec 12 09:46:11 2019 -0800 ARM: dts: Configure omap4 rng to probe with ti-sysc Add RNG interconnect data for omap4 similar to what dra7 has. The clock is OMAP4_CM_L4SEC_RNG_CLKCTRL_OFFSET at offset address 0x01c0, which matches what dra7 also has with DRA7_L4SEC_CLKCTRL_INDEX(0x1c0). Note that we need to also add the related l4_secure clock entries. I've only added RNG, the others can be added as they get tested. They are probably very similar to what we already have for dra7 in dra7_l4sec_clkctrl_regs[]. With the clock tagged CLKF_SOC_NONSEC, clock is set disabled for secure devices and clk_get() will fail. Additionally we disable the RNG target module on droid4 to avoid introducing new boot time warnings. Cc: devicetree@vger.kernel.org Cc: Rob Herring Signed-off-by: Tony Lindgren commit 723a567f43b8ffa8089009bc8a260cc6f963661e Author: Tony Lindgren Date: Thu Dec 12 09:46:10 2019 -0800 ARM: dts: Add missing omap5 secure clocks The secure clocks on omap5 are similar to what we already have for dra7 with dra7_l4sec_clkctrl_regs and documented in the omap5432 TRM in "Table 3-1044. CORE_CM_CORE Registers Mapping Summary". The secure clocks are part of the l4per clock manager. As the l4per clock manager has now two clock domains as children, let's also update the l4per clockdomain node name to follow the "clock" node naming with a domain specific compatible property. Compared to omap4, omap5 has more clocks working in hardare autogating mode. Cc: devicetree@vger.kernel.org Cc: Rob Herring Acked-by: Stephen Boyd Signed-off-by: Tony Lindgren commit cfcbc2dbb70826b91aa45ae37168b2db2aac1803 Author: Tony Lindgren Date: Thu Dec 12 09:46:10 2019 -0800 ARM: dts: Add missing omap4 secure clocks The secure clocks on omap4 are similar to what we already have for dra7 in dra7_l4sec_clkctrl_regs and documented in the omap4460 TRM "Table 3-1346 L4PER_CM2 Registers Mapping Summary". The secure clocks are part of the l4_per clock manager. As the l4_per clock manager has now two clock domains as children, let's also update the l4_per clockdomain node name to follow the "clock" node naming with a domain specific compatible property. Cc: devicetree@vger.kernel.org Cc: Rob Herring Acked-by: Stephen Boyd Signed-off-by: Tony Lindgren commit 3543d7ddd55fe12c37e8a9db846216c51846015b Author: Marc Zyngier Date: Thu Jan 23 14:51:12 2020 +0000 arm64: dts: fast models: Fix FVP PCI interrupt-map property The interrupt map for the FVP's PCI node is missing the parent-unit-address cells for each of the INTx entries, leading to the kernel code failing to parse the entries correctly. Add the missing zero cells, which are pretty useless as far as the GIC is concerned, but that the spec requires. This allows INTx to be usable on the model, and VFIO to work correctly. Fixes: fa083b99eb28 ("arm64: dts: fast models: Add DTS fo Base RevC FVP") Signed-off-by: Marc Zyngier Signed-off-by: Sudeep Holla commit c37baa06f8a970e4a533d41f7d33e5e57de5ad25 Author: Andrew F. Davis Date: Wed Jan 22 12:20:17 2020 -0500 ARM: OMAP2+: Fix undefined reference to omap_secure_init omap_secure_init() is now called from all OMAP2+ platforms during their init_early() call. This function is in omap-secure.o so include that in the build for these platforms. Fixes: db711893eac8 ("ARM: OMAP2+: Add omap_secure_init callback hook for secure initialization") Reported-by: Dan Murphy Signed-off-by: Andrew F. Davis Tested-by: Dan Murphy Signed-off-by: Tony Lindgren commit 81563bed1e11a184a753148c0e7dfc5e26a71981 Author: Ooi, Joyce Date: Sat Jan 4 01:01:55 2020 +0800 MAINTAINERS: Replace Tien Hock Loh as Altera PIO maintainer This patch is to replace Tien Hock Loh as Altera PIO maintainer as he has moved to a different role. Signed-off-by: Ooi, Joyce Link: https://lore.kernel.org/r/20200103170155.100743-1-joyce.ooi@intel.com Acked-by: Tien Hock Loh Signed-off-by: Linus Walleij commit 207270dd0b2d593a8b92043c9bcdabb42111fcc3 Author: Dan Callaghan Date: Tue Jan 21 10:12:17 2020 +1000 gpiolib: hold gpio devices lock until ->descs array is initialised If a driver consuming the GPIO chip is being probed at the same time as the GPIO driver is registering the chip, it is possible for the consuming driver to see the ->descs array in an uninitialised state. For example, the gpio-keys-polled driver can fail like this: kernel: gpiod_request: invalid GPIO (no device) kernel: gpio-keys-polled PRP0001:07: failed to get gpio: -22 kernel: gpio-keys-polled: probe of PRP0001:07 failed with error -22 This patch makes gpiochip_add() hold the lock protecting gpio_devices until it has finished setting desc->gdev on the newly inserted list entry. Signed-off-by: Dan Callaghan Link: https://lore.kernel.org/r/20200121001216.15964-1-dan.callaghan@opengear.com Signed-off-by: Linus Walleij commit 0d311d8b93cfc8ab36aa11f09e15a5fe87147c02 Author: Sachin agarwal Date: Sat Jan 18 16:23:19 2020 +0530 gpio: aspeed-sgpio: fixed typos This fixes some various typos. Signed-off-by: Sachin Agarwal Link: https://lore.kernel.org/r/20200118105319.68637-1-sachinagarwal@sachins-MacBook-2.local Signed-off-by: Linus Walleij commit 06e26b75f5e613b400116fdb7ff6206a681ab271 Author: Peng Fan Date: Wed Dec 18 12:43:53 2019 +0000 pinctrl: mvebu: armada-37xx: use use platform api platform_irq_count() and platform_get_irq() is the more generic way (independent of device trees) to determine the count of available interrupts. So use this instead. As platform_irq_count() might return an error code (which of_irq_count doesn't) some additional handling is necessary. Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/1576672860-14420-1-git-send-email-peng.fan@nxp.com Signed-off-by: Linus Walleij commit 322e929d196c27fa1bd50b389b800e9c30419bde Merge: 18451f9f9e58 c052bf82c6b0 Author: Rafael J. Wysocki Date: Thu Jan 23 16:00:56 2020 +0100 Merge back new material related to system-wide PM for v5.6. commit 72780ce5f1a4189f3c8dcfb1c596c65146452668 Author: Linus Walleij Date: Mon Jan 13 23:08:00 2020 +0100 gpio: Drop the chained IRQ handler assign function gpiochip_set_chained_irqchip() would assign a chained handler to a GPIO chip. We now populate struct gpio_irq_chip for all chained GPIO irqchips so drop this function. Cc: Andy Shevchenko Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20200113220800.77817-1-linus.walleij@linaro.org Signed-off-by: Linus Walleij commit d5331ec2cc6e8b79b8b0027091d1ebb395e833b5 Author: Maxim Kiselev Date: Wed Jan 15 10:38:11 2020 +0300 gpio: mvebu: clear irq in edge cause register before unmask edge irq When input GPIO set from 0 to 1, the interrupt bit asserted in the GPIO Interrupt Cause Register (ICR) even if the corresponding interrupt masked in the GPIO Interrupt Mask Register. Because interrupt mask register only affects assertion of the interrupt bits in Main Interrupt Cause Register and it does not affect the setting of bits in the GPIO ICR. So, there is problem, when we unmask interrupt with already asserted bit in the GPIO ICR, then false interrupt immediately occurs even if GPIO don't change their value since last unmask. Signed-off-by: Maxim Kiselev Link: https://lore.kernel.org/r/20200115073811.24438-1-bigunclemax@gmail.com Signed-off-by: Linus Walleij commit 1697d98124819aab09b86602978bd4f50e101e2d Author: Bingbu Cao Date: Sun Jan 19 05:26:55 2020 +0100 media: staging/intel-ipu3: remove TODO item about acronyms The Imgu acronyms are moved from header file into Document by previous commit b8726aea59de ("media: ipu3: update meta format documentation"), so the item can be removed from TODO list now. [Sakari Ailus: Use commit [0-9a-f]{12} plus subject] Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 5adf3edde812e1eeef2492893b0e88224695ba03 Author: Sakari Ailus Date: Mon Oct 21 09:29:26 2019 +0200 media: v4l2-fwnode: Print the node name while parsing endpoints Print the node name during endpoint parsing for better debuggability. Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit eec6d97d6da400226529f4748fb8998bb69a5bbf Author: Anson Huang Date: Wed Jan 15 09:39:07 2020 +0800 pinctrl: freescale: Add i.MX8MP pinctrl driver support Add the pinctrl driver support for i.MX8MP. Signed-off-by: Anson Huang Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/1579052348-32167-2-git-send-email-Anson.Huang@nxp.com Reviewed-by: Fabio Estevam Signed-off-by: Linus Walleij commit 0b09f98987568842422610f6622068c14e79b707 Author: Bingbu Cao Date: Fri Jan 17 09:18:30 2020 +0100 media: Revert "media: staging/intel-ipu3: make imgu use fixed running mode" This reverts commit e878742c83ec26ef256ebb6b36a4d44644548f25. Imgu should still keep the capability and flexibility to allow user to run 2 video pipes, as the user may use the video pipe to capture still frames with less system load and power than still pipe. Suggested-by: Tomasz Figa Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 364efd0db7c336c6defc885e077e73e83daca999 Author: Anson Huang Date: Wed Jan 15 09:39:06 2020 +0800 dt-bindings: imx: Add pinctrl binding doc for i.MX8MP Add binding doc for i.MX8MP pinctrl driver. Signed-off-by: Anson Huang Reviewed-by: Abel Vesa Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/1579052348-32167-1-git-send-email-Anson.Huang@nxp.com Signed-off-by: Linus Walleij commit a03003c528e6996b90de5b60ee2864565a917186 Author: Julia Lawall Date: Wed Jan 1 08:43:24 2020 +0100 media: mt9v111: constify copied structure The mt9v111_def_fmt structure is only copied into another structure, so make it const. The opportunity for this change was found using Coccinelle. Signed-off-by: Julia Lawall Acked-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 366950eeb6ee7ba6693129899452e0ba890cbe4d Author: Kevin Hao Date: Mon Jan 20 17:56:25 2020 +0800 gpiolib: Lower verbosity when allocating hierarchy irq In the current codes, the following 3 lines would be output to the console for each irq line. gpio gpiochip0: (gpio_thunderx): allocate IRQ 10, hwirq 0 gpio gpiochip0: (gpio_thunderx): found parent hwirq 245784 gpio gpiochip0: (gpio_thunderx): alloc_irqs_parent for 10 parent hwirq 245784 In general, there are about tens of irq lines for each gpio chip, and then it would emit so many insignificant log in the boot process. These infos are more suitable for the dbg purpose. So change these to the dbg level. With this change, about 200 lines are suppressed on my Marvell cn96xx board. Signed-off-by: Kevin Hao Link: https://lore.kernel.org/r/20200120095625.25164-1-haokexin@gmail.com Signed-off-by: Linus Walleij commit a1dd4bfb145e88bdc8374a506409f95916bae368 Merge: 783e998653b4 cd0a32371db7 Author: Linus Walleij Date: Thu Jan 23 15:44:29 2020 +0100 Merge tag 'intel-pinctrl-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v5.6-1 * Tiger Lake appears to have _HID enumeration, thus driver has been updated * Coffee Lake-S has the same IP as Sunrisepoint, thus ID has been added * Baytrail has got more clean ups and bug fixes, such as direct IRQ handling * Lynxpoint GPIO has been converted to true pin control driver * The common driver now uses IRQ chip enumeration via GPIO chip The following is an automated git shortlog grouped by driver: baytrail: - Replace WARN with dev_info_once when setting direct-irq pin to output - Do not clear IRQ flags on direct-irq enabled pins - Reuse struct intel_pinctrl in the driver - Use local variable to keep device pointer - Keep pointer to struct device instead of its container - Use GPIO direction definitions - Move IRQ valid mask initialization to a dedicated callback - Group GPIO IRQ chip initialization - Allocate IRQ chip dynamic cherryview: - Use GPIO direction definitions intel: - Pass irqchip when adding gpiochip - Add GPIO <-> pin mapping ranges via callback - Share struct intel_pinctrl for wider use - Use GPIO direction definitions lynxpoint: - Update summary in the driver - Switch to pin control API - Add GPIO <-> pin mapping ranges via callback - Implement ->pin_dbg_show() - Add pin control operations - Reuse struct intel_pinctrl in the driver - Add pin control data structures - Implement intel_gpio_get_direction callback - Implement ->irq_ack() callback - Move ownership check to IRQ chip - Move lp_irq_type() closer to IRQ related routines - Move ->remove closer to ->probe() - Extract lp_gpio_acpi_use() for future use - Convert unsigned to unsigned int - Switch to memory mapped IO accessors - Keep pointer to struct device instead of its container - Relax GPIO request rules - Assume 2 bits for mode selector - Use standard pattern for memory allocation - Use %pR to print IO resource - Drop useless assignment - Correct amount of pins - Use raw_spinlock for locking - Move GPIO driver to pin controller folder sunrisepoint: - Add Coffee Lake-S ACPI ID - Add missing Interrupt Status register offset tigerlake: - Tiger Lake uses _HID enumeration commit 5b3014b95272a432b7705142f7081967fc1547f9 Author: Lakshmi Ramasubramanian Date: Wed Jan 22 17:32:06 2020 -0800 IMA: Defined delayed workqueue to free the queued keys Keys queued for measurement should be freed if a custom IMA policy was not loaded. Otherwise, the keys will remain queued forever consuming kernel memory. This patch defines a delayed workqueue to handle the above scenario. The workqueue handler is setup to execute 5 minutes after IMA initialization is completed. If a custom IMA policy is loaded before the workqueue handler is scheduled to execute, the workqueue task is cancelled and any queued keys are processed for measurement. But if a custom policy was not loaded then the queued keys are just freed when the delayed workqueue handler is run. Signed-off-by: Lakshmi Ramasubramanian Reported-by: kernel test robot # sleeping function called from invalid context Reported-by: kbuild test robot # redefinition of ima_init_key_queue() function. Signed-off-by: Mimi Zohar commit 754a36a58c29718bf5e28b8789b17bffbb60e8a6 Merge: 7265e8fc5108 a5362b84bdff Author: Mark Brown Date: Thu Jan 23 12:37:18 2020 +0000 Merge branch 'spi-5.6' into spi-next commit 7265e8fc51081f08728cc7528fd4640a81ec6768 Merge: def9d2780727 29d7e05c5f75 Author: Mark Brown Date: Thu Jan 23 12:37:15 2020 +0000 Merge branch 'spi-5.5' into spi-linus commit ebe0bdf9cfb97afc5ef4ef85e4f05d0585291ebf Merge: 9909f7986a81 0468e667a5be Author: Mark Brown Date: Thu Jan 23 12:37:08 2020 +0000 Merge remote-tracking branch 'regulator/topic/equal' into regulator-next commit 9909f7986a8159200eaa8320ea081f337ebdd940 Merge: f7abb7e33b29 53ba2f1aa386 Author: Mark Brown Date: Thu Jan 23 12:37:06 2020 +0000 Merge branch 'regulator-5.6' into regulator-next commit f7abb7e33b295a3556b7e86ba3dbb7390e7880af Merge: def9d2780727 3d7610e8da99 Author: Mark Brown Date: Thu Jan 23 12:37:04 2020 +0000 Merge branch 'regulator-5.5' into regulator-linus commit a7196caf83ea9e9b56c5c8c95fbfe0d45acec46b Merge: 20230620b445 d8e2e0d2491e Author: Mark Brown Date: Thu Jan 23 12:36:45 2020 +0000 Merge branch 'asoc-5.6' into asoc-next commit 20230620b44510ce968a719a1d6ee7483583178d Merge: def9d2780727 8ce1cbd6ce0b Author: Mark Brown Date: Thu Jan 23 12:36:42 2020 +0000 Merge branch 'asoc-5.5' into asoc-linus commit 450d0fd515648dcd90a9940b498f9913ed69566b Author: Lakshmi Ramasubramanian Date: Wed Jan 22 17:32:05 2020 -0800 IMA: Call workqueue functions to measure queued keys Measuring keys requires a custom IMA policy to be loaded. Keys should be queued for measurement if a custom IMA policy is not yet loaded. Keys queued for measurement, if any, should be processed when a custom policy is loaded. This patch updates the IMA hook function ima_post_key_create_or_update() to queue the key if a custom IMA policy has not yet been loaded. And, ima_update_policy() function, which is called when a custom IMA policy is loaded, is updated to process queued keys. Signed-off-by: Lakshmi Ramasubramanian Signed-off-by: Mimi Zohar commit 9f81a2eda488fef4c4e33a3965ae1759eb7db280 Author: Lakshmi Ramasubramanian Date: Wed Jan 22 17:32:04 2020 -0800 IMA: Define workqueue for early boot key measurements Measuring keys requires a custom IMA policy to be loaded. Keys created or updated before a custom IMA policy is loaded should be queued and will be processed after a custom policy is loaded. This patch defines a workqueue for queuing keys when a custom IMA policy has not yet been loaded. An intermediate Kconfig boolean option namely IMA_QUEUE_EARLY_BOOT_KEYS is used to declare the workqueue functions. A flag namely ima_process_keys is used to check if the key should be queued or should be processed immediately. Signed-off-by: Lakshmi Ramasubramanian Signed-off-by: Mimi Zohar commit d8e2e0d2491e78f3f7b451c3a93ba29950efe2cf Author: Kuninori Morimoto Date: Wed Jan 22 09:45:00 2020 +0900 ASoC: soc-core: remove null_snd_soc_ops All rtd->dai_link callback functions are controlled by soc_rtd_xxxx(), and checking rtd->dai_link->ops. We don't need to have null_snd_soc_ops anymore. This patch removes it. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87zhegl3oz.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit ad2bf9f252d667b385df606b4b762c26151bee78 Author: Kuninori Morimoto Date: Wed Jan 22 09:44:56 2020 +0900 ASoC: soc-pcm: add soc_rtd_trigger() Add soc_rtd_trigger() to make the code easier to read Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/871rrsmi9j.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 49f020e5714d2c48c8ed9a89169ef6a058e54c2f Author: Kuninori Morimoto Date: Wed Jan 22 09:44:52 2020 +0900 ASoC: soc-pcm: add soc_rtd_hw_free() Add soc_rtd_hw_free() to make the code easier to read Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/8736c8mi9n.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit de9ad990284f16a435675e4e73c7ffaaea9ee4b2 Author: Kuninori Morimoto Date: Wed Jan 22 09:44:48 2020 +0900 ASoC: soc-pcm: add soc_rtd_hw_params() Add soc_rtd_hw_params() to make the code easier to read Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/874kwomi9r.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 44c1a75b0d889b3a5faff9edc837d972806bb46a Author: Kuninori Morimoto Date: Wed Jan 22 09:44:44 2020 +0900 ASoC: soc-pcm: add soc_rtd_prepare() Add soc_rtd_prepare() to make the code easier to read Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/875zh4mi9v.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 0be429f9fcfccfbbbcdb40e154a5c2328da17ca9 Author: Kuninori Morimoto Date: Wed Jan 22 09:44:40 2020 +0900 ASoC: soc-pcm: add soc_rtd_shutdown() Add soc_rtd_shutdown() to make the code easier to read Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/877e1kmi9z.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit f183f9277a0f16e340bbcb28bf30834652ef10e1 Author: Kuninori Morimoto Date: Wed Jan 22 09:44:35 2020 +0900 ASoC: soc-pcm: add soc_rtd_startup() Add soc_rtd_startup() to make the code easier to read Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/878sm0mia4.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 29951078bb5be1f2105c2841a4ac119f1b81531b Author: Maoguang Meng Date: Mon Jan 13 04:52:02 2020 +0100 media: platform: VIDEO_MEDIATEK_JPEG can also depend on MTK_IOMMU mediatek jpeg codec driver can depend on MTK_IOMMU or MTK_IOMMU_V1 Signed-off-by: Maoguang Meng Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 1dd2e8f942574e2be18374ebb81751082d8d467c Author: Sergey Zakharchenko Date: Thu Oct 3 11:31:23 2019 +0200 media: uvcvideo: Add a quirk to force GEO GC6500 Camera bits-per-pixel value This device does not function correctly in raw mode in kernel versions validating buffer sizes in bulk mode. It erroneously announces 16 bits per pixel instead of 12 for NV12 format, so it needs this quirk to fix computed frame size and avoid legitimate frames getting discarded. [Move info and div variables to local scope] Signed-off-by: Sergey Zakharchenko Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 68035c80e129c4cfec659aac4180354530b26527 Author: Will Deacon Date: Fri Nov 8 16:48:38 2019 +0100 media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors Way back in 2017, fuzzing the 4.14-rc2 USB stack with syzkaller kicked up the following WARNING from the UVC chain scanning code: | list_add double add: new=ffff880069084010, prev=ffff880069084010, | next=ffff880067d22298. | ------------[ cut here ]------------ | WARNING: CPU: 1 PID: 1846 at lib/list_debug.c:31 __list_add_valid+0xbd/0xf0 | Modules linked in: | CPU: 1 PID: 1846 Comm: kworker/1:2 Not tainted | 4.14.0-rc2-42613-g1488251d1a98 #238 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 | Workqueue: usb_hub_wq hub_event | task: ffff88006b01ca40 task.stack: ffff880064358000 | RIP: 0010:__list_add_valid+0xbd/0xf0 lib/list_debug.c:29 | RSP: 0018:ffff88006435ddd0 EFLAGS: 00010286 | RAX: 0000000000000058 RBX: ffff880067d22298 RCX: 0000000000000000 | RDX: 0000000000000058 RSI: ffffffff85a58800 RDI: ffffed000c86bbac | RBP: ffff88006435dde8 R08: 1ffff1000c86ba52 R09: 0000000000000000 | R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069084010 | R13: ffff880067d22298 R14: ffff880069084010 R15: ffff880067d222a0 | FS: 0000000000000000(0000) GS:ffff88006c900000(0000) knlGS:0000000000000000 | CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | CR2: 0000000020004ff2 CR3: 000000006b447000 CR4: 00000000000006e0 | Call Trace: | __list_add ./include/linux/list.h:59 | list_add_tail+0x8c/0x1b0 ./include/linux/list.h:92 | uvc_scan_chain_forward.isra.8+0x373/0x416 | drivers/media/usb/uvc/uvc_driver.c:1471 | uvc_scan_chain drivers/media/usb/uvc/uvc_driver.c:1585 | uvc_scan_device drivers/media/usb/uvc/uvc_driver.c:1769 | uvc_probe+0x77f2/0x8f00 drivers/media/usb/uvc/uvc_driver.c:2104 Looking into the output from usbmon, the interesting part is the following data packet: ffff880069c63e00 30710169 C Ci:1:002:0 0 143 = 09028f00 01030080 00090403 00000e01 00000924 03000103 7c003328 010204db If we drop the lead configuration and interface descriptors, we're left with an output terminal descriptor describing a generic display: /* Output terminal descriptor */ buf[0] 09 buf[1] 24 buf[2] 03 /* UVC_VC_OUTPUT_TERMINAL */ buf[3] 00 /* ID */ buf[4] 01 /* type == 0x0301 (UVC_OTT_DISPLAY) */ buf[5] 03 buf[6] 7c buf[7] 00 /* source ID refers to self! */ buf[8] 33 The problem with this descriptor is that it is self-referential: the source ID of 0 matches itself! This causes the 'struct uvc_entity' representing the display to be added to its chain list twice during 'uvc_scan_chain()': once via 'uvc_scan_chain_entity()' when it is processed directly from the 'dev->entities' list and then again immediately afterwards when trying to follow the source ID in 'uvc_scan_chain_forward()' Add a check before adding an entity to a chain list to ensure that the entity is not already part of a chain. Link: https://lore.kernel.org/linux-media/CAAeHK+z+Si69jUR+N-SjN9q4O+o5KFiNManqEa-PjUta7EOb7A@mail.gmail.com/ Cc: Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Reported-by: Andrey Konovalov Signed-off-by: Will Deacon Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit a5362b84bdff1def10c136e36ef2126f7f545b2c Author: Tomer Maimon Date: Wed Jan 15 18:23:00 2020 +0200 dt-binding: spi: add NPCM PSPI reset binding Add NPCM Peripheral SPI reset binding documentation, Removing unnecessary aliases use. Signed-off-by: Tomer Maimon Acked-by: Rob Herring Link: https://lore.kernel.org/r/20200115162301.235926-4-tmaimon77@gmail.com Signed-off-by: Mark Brown commit df31007400c3905ec15b1065241baf3864decbfa Author: Jack Yu Date: Wed Jan 15 19:25:19 2020 +0800 ASoC: rt1015: add rt1015 amplifier driver This is initial amplifier driver for rt1015. Signed-off-by: Jack Yu Link: https://lore.kernel.org/r/20200115112519.22050-1-jack.yu@realtek.com Signed-off-by: Mark Brown commit b2333f7fcd950854afe9c428377e105425d5083a Author: Charles Keepax Date: Wed Jan 22 10:45:59 2020 +0000 ASoC: madera: Correct some kernel doc Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20200122104559.17043-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 8ce1cbd6ce0b1bda0c980c64fee4c1e1378355f1 Author: Jaroslav Kysela Date: Wed Jan 22 20:07:52 2020 +0100 ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order The code which checks the return value for snd_soc_add_dai_link() call in soc_tplg_fe_link_create() moved the snd_soc_add_dai_link() call before link->dobj members initialization. While it does not affect the latest kernels, the old soc-core.c code in the stable kernels is affected. The snd_soc_add_dai_link() function uses the link->dobj.type member to check, if the link structure is valid. Reorder the link->dobj initialization to make things work again. It's harmless for the recent code (and the structure should be properly initialized before other calls anyway). The problem is in stable linux-5.4.y since version 5.4.11 when the upstream commit 76d270364932 was applied. Fixes: 76d270364932 ("ASoC: topology: Check return value for snd_soc_add_dai_link()") Cc: Dragos Tarcatu Cc: Pierre-Louis Bossart Cc: Ranjani Sridharan Cc: Mark Brown Cc: Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20200122190752.3081016-1-perex@perex.cz Signed-off-by: Mark Brown commit 15adb20f64c302b31e10ad50f22bb224052ce1df Author: Cezary Rojewski Date: Wed Jan 22 19:12:54 2020 +0100 ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug Definitions for idisp snd_soc_dai_links within skl_hda_dsp_common are missing platform component. Add it to address following bug reported by KASAN: [ 10.538502] BUG: KASAN: global-out-of-bounds in skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538509] Write of size 8 at addr ffffffffc0606840 by task systemd-udevd/299 (...) [ 10.538519] Call Trace: [ 10.538524] dump_stack+0x62/0x95 [ 10.538528] print_address_description+0x2f5/0x3b0 [ 10.538532] ? skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538535] __kasan_report+0x134/0x191 [ 10.538538] ? skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538542] ? skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538544] kasan_report+0x12/0x20 [ 10.538546] __asan_store8+0x57/0x90 [ 10.538550] skl_hda_audio_probe+0x13a/0x2b0 [snd_soc_skl_hda_dsp] [ 10.538553] platform_drv_probe+0x51/0xb0 [ 10.538556] really_probe+0x311/0x600 [ 10.538559] driver_probe_device+0x87/0x1b0 [ 10.538562] device_driver_attach+0x8f/0xa0 [ 10.538565] ? device_driver_attach+0xa0/0xa0 [ 10.538567] __driver_attach+0x102/0x1a0 [ 10.538569] ? device_driver_attach+0xa0/0xa0 [ 10.538572] bus_for_each_dev+0xe8/0x160 [ 10.538574] ? subsys_dev_iter_exit+0x10/0x10 [ 10.538577] ? preempt_count_sub+0x18/0xc0 [ 10.538580] ? _raw_write_unlock+0x1f/0x40 [ 10.538582] driver_attach+0x2b/0x30 [ 10.538585] bus_add_driver+0x251/0x340 [ 10.538588] driver_register+0xd3/0x1c0 [ 10.538590] __platform_driver_register+0x6c/0x80 [ 10.538592] ? 0xffffffffc03e8000 [ 10.538595] skl_hda_audio_init+0x1c/0x1000 [snd_soc_skl_hda_dsp] [ 10.538598] do_one_initcall+0xd0/0x36a [ 10.538600] ? trace_event_raw_event_initcall_finish+0x160/0x160 [ 10.538602] ? kasan_unpoison_shadow+0x36/0x50 [ 10.538605] ? __kasan_kmalloc+0xcc/0xe0 [ 10.538607] ? kasan_unpoison_shadow+0x36/0x50 [ 10.538609] ? kasan_poison_shadow+0x2f/0x40 [ 10.538612] ? __asan_register_globals+0x65/0x80 [ 10.538615] do_init_module+0xf9/0x36f [ 10.538619] load_module+0x398e/0x4590 [ 10.538625] ? module_frob_arch_sections+0x20/0x20 [ 10.538628] ? __kasan_check_write+0x14/0x20 [ 10.538630] ? kernel_read+0x9a/0xc0 [ 10.538632] ? __kasan_check_write+0x14/0x20 [ 10.538634] ? kernel_read_file+0x1d3/0x3c0 [ 10.538638] ? cap_capable+0xca/0x110 [ 10.538642] __do_sys_finit_module+0x190/0x1d0 [ 10.538644] ? __do_sys_finit_module+0x190/0x1d0 [ 10.538646] ? __x64_sys_init_module+0x50/0x50 [ 10.538649] ? expand_files+0x380/0x380 [ 10.538652] ? __kasan_check_write+0x14/0x20 [ 10.538654] ? fput_many+0x20/0xc0 [ 10.538658] __x64_sys_finit_module+0x43/0x50 [ 10.538660] do_syscall_64+0xce/0x700 [ 10.538662] ? syscall_return_slowpath+0x230/0x230 [ 10.538665] ? __do_page_fault+0x51e/0x640 [ 10.538668] ? __kasan_check_read+0x11/0x20 [ 10.538670] ? prepare_exit_to_usermode+0xc7/0x200 [ 10.538673] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: a78959f407e6 ("ASoC: Intel: skl_hda_dsp_common: use modern dai_link style") Signed-off-by: Cezary Rojewski Reviewed-by: Kai Vehmanen Link: https://lore.kernel.org/r/20200122181254.22801-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit ca34fa860fd34b0b22ff829aeb51884429a3a753 Author: Charles Keepax Date: Wed Jan 22 10:41:43 2020 +0000 ASoC: madera: Correct DMIC only input hook ups Both the data and clock should be connected to both the left and right inputs for DMIC only inputs, add the missing routes. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20200122104143.16725-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit d239aa00fe7bb40175822da4b4300c140877fe06 Author: Jonas Karlman Date: Sun Jan 12 14:34:24 2020 +0100 media: hantro: fix post-processing NULL pointer dereference The RK3399 variant does not have postproc_regs declared, this can cause a NULL pointer dereference trying to decode: [ 89.331359] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 89.352804] Call trace: [ 89.353191] hantro_postproc_disable+0x20/0xe8 [hantro_vpu] [ 89.354056] hantro_start_prepare_run+0x58/0x68 [hantro_vpu] [ 89.354923] hantro_h264_dec_prepare_run+0x30/0x6f0 [hantro_vpu] [ 89.355846] rk3399_vpu_h264_dec_run+0x1c/0x14a8 [hantro_vpu] [ 89.356748] device_run+0xa4/0xb8 [hantro_vpu] Fix this by adding a NULL check in hantro_postproc_enable/disable. Fixes: 8c2d66b036c7 ("media: hantro: Support color conversion via post-processing") Signed-off-by: Jonas Karlman Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 1fd4d9cb739bd47b74840f8933616cc75341db05 Author: Niklas Söderlund Date: Wed Dec 4 18:57:59 2019 +0100 media: rcar-vin: Use correct pixel format when aligning format When aligning the format the pixel format that is being processed shall be used to figure out alignment constraints, not the currently active pixel format. The alignment might be part of a try operation and shall not be effected by the active format. Fix this by looking at the correct pixel format. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit cd5676db0574cc1c0b234bc3b17565b07290aa72 Author: Bibby Hsieh Date: Thu Jan 23 12:52:57 2020 +0100 misc: eeprom: at24: support pm_runtime control Although in the most platforms, the power of eeprom are alway on, some platforms disable the eeprom power in order to meet low power request. This patch add the pm_runtime ops to control power to support all platforms. Signed-off-by: Bibby Hsieh [Bartosz: rebased on top of current at24/for-next] Signed-off-by: Bartosz Golaszewski commit c6cadc7538bb6df746f1613ee317b646230b2f5e Author: Bibby Hsieh Date: Thu Jan 16 10:56:34 2020 +0800 dt-binding: eeprom: at24: add vcc-supply property In some platforms, they disable the power-supply of eeprom due to power consumption reduction. This patch add vcc-supply property. Signed-off-by: Bibby Hsieh Reviewed-by: Rob Herring Signed-off-by: Bartosz Golaszewski commit 6c0157be02f02c490dbe74af0d469ed1ddc30b1e Author: Colin Ian King Date: Wed Jan 22 09:38:18 2020 +0000 dmaengine: ti: k3-udma: fix spelling mistake "limted" -> "limited" There are spelling mistakes in dev_err messages. Fix them. Signed-off-by: Colin Ian King Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200122093818.2800743-1-colin.king@canonical.com Signed-off-by: Vinod Koul commit e606c8b9d751e593b71bdcb636ac3392c62c1c50 Author: Colin Ian King Date: Wed Jan 22 23:52:37 2020 +0000 dmaengine: s3c24xx-dma: fix spelling mistake "to" -> "too" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20200122235237.2830344-1-colin.king@canonical.com Signed-off-by: Vinod Koul commit a009310fade9165483483b235360458f1286f32a Author: Krzysztof Kozlowski Date: Tue Jan 7 09:12:59 2020 +0100 i2c: exynos: Update Kconfig documentation Update the help text to reflect current support devices: 1. The Exynos high speed I2C driver supports Exynos5 (ARMv7), Exynos5433 and Exynos7 (both ARMv8) SoCs, 2. The S3C I2C driver supports S3C, S5Pv210 and Exynos{3,4,5} SoCs. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 4a2d5f663dab6614772d8e28ca190b127ba46d9d Author: Krzysztof Kozlowski Date: Tue Jan 7 09:12:58 2020 +0100 i2c: Enable compile testing for more drivers Some of the I2C bus drivers can be compile tested to increase build coverage. This requires also: 1. Adding dependencies on COMMON_CLK for BCM2835 and Meson I2C controllers, 2. Adding 'if' conditional to 'default y' so they will not get enabled by default on all other architectures, 3. Limiting few compile test options to supported architectures (which provide the readsX()/writesX() primitives). Signed-off-by: Krzysztof Kozlowski [wsa: revert chunk for ZX2967. it needs more preparation] Signed-off-by: Wolfram Sang commit 183ef7adf4ed638ac0fb0c3c9a71fc00e8512b61 Author: Arvind Sankar Date: Tue Jan 7 14:44:34 2020 -0500 x86/boot: Simplify calculation of output address Condense the calculation of decompressed kernel start a little. Committer notes: before: ebp = ebx - (init_size - _end) after: eax = (ebx + _end) - init_size where in both ebx contains the temporary address the kernel is moved to for in-place decompression. The before and after difference in register state is %eax and %ebp but that is immaterial because the compressed image is not built with -mregparm, i.e., all arguments of the following extract_kernel() call are passed on the stack. Signed-off-by: Arvind Sankar Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20200107194436.2166846-1-nivedita@alum.mit.edu commit 6d9f6e6790e794461ff3a16e4f3778f01ff6cca2 Merge: fd786fb1d2ca ec97ecf1ebe4 Author: David S. Miller Date: Thu Jan 23 11:38:31 2020 +0100 Merge branch 'net-sched-add-Flow-Queue-PIE-packet-scheduler' Gautam Ramakrishnan says: ==================== net: sched: add Flow Queue PIE packet scheduler Flow Queue PIE packet scheduler This patch series implements the Flow Queue Proportional Integral controller Enhanced (FQ-PIE) active queue Management algorithm. It is an enhancement over the PIE algorithm. It integrates the PIE aqm with a deficit round robin scheme. FQ-PIE is implemented over the latest version of PIE which uses timestamps to calculate queue delay with an additional option of using average dequeue rate to calculate the queue delay. This patch also adds a memory limit of all the packets across all queues to a default value of 32Mb. - Patch #1 - Creates pie.h and moves all small functions and structures common to PIE and FQ-PIE here. The functions are all made inline. - Patch #2 - #8 - Addresses code formatting, indentation, comment changes and rearrangement of structure members. - Patch #9 - Refactors sch_pie.c by changing arguments to calculate_probability(), [pie_]drop_early() and pie_process_dequeue() to make it generic enough to be used by sch_fq_pie.c. These functions are exported to be used by sch_fq_pie.c. - Patch #10 - Adds the FQ-PIE Qdisc. For more information: https://tools.ietf.org/html/rfc8033 Changes from v6 to v7 - Call tcf_block_put() when destroying the Qdisc as suggested by Jakub Kicinski. Changes from v5 to v6 - Rearranged struct members according to their access pattern and to remove holes. Changes from v4 to v5 - This patch series breaks down patch 1 of v4 into separate logical commits as suggested by David Miller. Changes from v3 to v4 - Used non deprecated version of nla_parse_nested - Used SZ_32M macro - Removed an unused variable - Code cleanup All suggested by Jakub and Toke. Changes from v2 to v3 - Exported drop_early, pie_process_dequeue and calculate_probability functions from sch_pie as suggested by Stephen Hemminger. Changes from v1 ( and RFC patch) to v2 - Added timestamp to calculate queue delay as recommended by Dave Taht - Packet memory limit implemented as recommended by Toke. - Added external classifier as recommended by Toke. - Used NET_XMIT_CN instead of NET_XMIT_DROP as the return value in the fq_pie_qdisc_enqueue function. ==================== Signed-off-by: David S. Miller commit ec97ecf1ebe485a17cd8395a5f35e6b80b57665a Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:33 2020 +0530 net: sched: add Flow Queue PIE packet scheduler Principles: - Packets are classified on flows. - This is a Stochastic model (as we use a hash, several flows might be hashed to the same slot) - Each flow has a PIE managed queue. - Flows are linked onto two (Round Robin) lists, so that new flows have priority on old ones. - For a given flow, packets are not reordered. - Drops during enqueue only. - ECN capability is off by default. - ECN threshold (if ECN is enabled) is at 10% by default. - Uses timestamps to calculate queue delay by default. Usage: tc qdisc ... fq_pie [ limit PACKETS ] [ flows NUMBER ] [ target TIME ] [ tupdate TIME ] [ alpha NUMBER ] [ beta NUMBER ] [ quantum BYTES ] [ memory_limit BYTES ] [ ecnprob PERCENTAGE ] [ [no]ecn ] [ [no]bytemode ] [ [no_]dq_rate_estimator ] defaults: limit: 10240 packets, flows: 1024 target: 15 ms, tupdate: 15 ms (in jiffies) alpha: 1/8, beta : 5/4 quantum: device MTU, memory_limit: 32 Mb ecnprob: 10%, ecn: off bytemode: off, dq_rate_estimator: off Signed-off-by: Mohit P. Tahiliani Signed-off-by: Sachin D. Patil Signed-off-by: V. Saicharan Signed-off-by: Mohit Bhasi Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 5205ea00cda1ac23cebfb97dfccca84722d58dfe Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:32 2020 +0530 net: sched: pie: export symbols to be reused by FQ-PIE This patch makes the drop_early(), calculate_probability() and pie_process_dequeue() functions generic enough to be used by both PIE and FQ-PIE (to be added in a future commit). The major change here is in the way the functions take in arguments. This patch exports these functions and makes FQ-PIE dependent on sch_pie. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 00ea2fb7274f568cd982a5958c66cab578aada25 Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:31 2020 +0530 net: sched: pie: fix alignment in struct instances Make the alignment in the initialization of the struct instances consistent in the file. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 55f780c4a6c3046461352f4081427b077f8d06ed Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:30 2020 +0530 net: sched: pie: fix commenting Fix punctuation and logical mistakes in the comments. The logical mistake was that "dequeue_rate" is no longer the default way to calculate queuing delay and is not needed. The default way to calculate queue delay was changed in commit cec2975f2b70 ("net: sched: pie: enable timestamp based delay calculation"). Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit b42a3d7c7cfff3555d7057c20dbbe57fe75d77c0 Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:29 2020 +0530 pie: improve comments and commenting style Improve the comments along with the commenting style used to describe the members of the structures and their initial values in the init functions. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 2dfb1952a9a1fde0b515f58605c11902e69415bf Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:28 2020 +0530 pie: rearrange structure members and their initializations Rearrange the members of the structure such that closely referenced members appear together and/or fit in the same cacheline. Also, change the order of their initializations to match the order in which they appear in the structure. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 1dbfc5e071db3f5acc3c7c87a564bf57b838cf49 Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:27 2020 +0530 pie: use u8 instead of bool in pie_vars Linux best practice recommends using u8 for true/false values in structures. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit cf4eeee5ff56180b525bfb6a204071216ca4000a Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:26 2020 +0530 pie: rearrange macros in order of length Rearrange macros in order of length and align the values to improve readability. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 805a5a23a4c4ee126e781bd14a1deb242395e817 Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:25 2020 +0530 pie: use U64_MAX to denote (2^64 - 1) Use the U64_MAX macro to denote the constant (2^64 - 1). Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 84bf557fb02f5924c109a21a160ffc353d878487 Author: Mohit P. Tahiliani Date: Wed Jan 22 23:52:24 2020 +0530 net: sched: pie: move common code to pie.h This patch moves macros, structures and small functions common to PIE and FQ-PIE (to be added in a future commit) from the file net/sched/sch_pie.c to the header file include/net/pie.h. All the moved functions are made inline. Signed-off-by: Mohit P. Tahiliani Signed-off-by: Leslie Monis Signed-off-by: Gautam Ramakrishnan Signed-off-by: David S. Miller commit 21aecdbd7f3ab02c9b82597dc733ee759fb8b274 Author: James Morse Date: Tue Jan 21 12:33:56 2020 +0000 KVM: arm: Make inject_abt32() inject an external abort instead KVM's inject_abt64() injects an external-abort into an aarch64 guest. The KVM_CAP_ARM_INJECT_EXT_DABT is intended to do exactly this, but for an aarch32 guest inject_abt32() injects an implementation-defined exception, 'Lockdown fault'. Change this to external abort. For non-LPAE we now get the documented: | Unhandled fault: external abort on non-linefetch (0x008) at 0x9c800f00 and for LPAE: | Unhandled fault: synchronous external abort (0x210) at 0x9c800f00 Fixes: 74a64a981662a ("KVM: arm/arm64: Unify 32bit fault injection") Reported-by: Beata Michalska Signed-off-by: James Morse Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200121123356.203000-3-james.morse@arm.com commit 018f22f95e8a6c3e27188b7317ef2c70a34cb2cd Author: James Morse Date: Tue Jan 21 12:33:55 2020 +0000 KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests Beata reports that KVM_SET_VCPU_EVENTS doesn't inject the expected exception to a non-LPAE aarch32 guest. The host intends to inject DFSR.FS=0x14 "IMPLEMENTATION DEFINED fault (Lockdown fault)", but the guest receives DFSR.FS=0x04 "Fault on instruction cache maintenance". This fault is hooked by do_translation_fault() since ARMv6, which goes on to silently 'handle' the exception, and restart the faulting instruction. It turns out, when TTBCR.EAE is clear DFSR is split, and FS[4] has to shuffle up to DFSR[10]. As KVM only does this in one place, fix up the static values. We now get the expected: | Unhandled fault: lock abort (0x404) at 0x9c800f00 Fixes: 74a64a981662a ("KVM: arm/arm64: Unify 32bit fault injection") Reported-by: Beata Michalska Signed-off-by: James Morse Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200121123356.203000-2-james.morse@arm.com commit cf2d23e0bac9f6b5cd1cba8898f5f05ead40e530 Author: Gavin Shan Date: Tue Jan 21 16:56:59 2020 +1100 KVM: arm/arm64: Fix young bit from mmu notifier kvm_test_age_hva() is called upon mmu_notifier_test_young(), but wrong address range has been passed to handle_hva_to_gpa(). With the wrong address range, no young bits will be checked in handle_hva_to_gpa(). It means zero is always returned from mmu_notifier_test_young(). This fixes the issue by passing correct address range to the underly function handle_hva_to_gpa(), so that the hardware young (access) bit will be visited. Fixes: 35307b9a5f7e ("arm/arm64: KVM: Implement Stage-2 page aging") Signed-off-by: Gavin Shan Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200121055659.19560-1-gshan@redhat.com commit 6645d8542ef922486b733d415d2bec3b0622c27e Author: Mark Brown Date: Mon Jan 20 12:47:06 2020 +0000 arm64: KVM: Annotate guest entry/exit as a single function In an effort to clarify and simplify the annotations of assembly functions in the kernel new macros have been introduced replacing ENTRY and ENDPROC. There are separate annotations SYM_FUNC_ for normal C functions and SYM_CODE_ for other code. Currently __guest_enter and __guest_exit are annotated as standard functions but this is not entirely correct as the former doesn't do a normal return and the latter is not entered in a normal fashion. From the point of view of the hypervisor the guest entry/exit may be viewed as a single function which happens to have an eret in the middle of it so let's annotate it as such. Suggested-by: Mark Rutland Signed-off-by: Mark Brown Signed-off-by: Marc Zyngier Acked-by: Will Deacon Link: https://lore.kernel.org/r/20200120124706.8681-1-broonie@kernel.org commit 290a6bb06de9ec24cecbb11bf4be35411d0b2625 Author: Andrew Jones Date: Mon Jan 20 14:08:25 2020 +0100 arm64: KVM: Add UAPI notes for swapped registers Two UAPI system register IDs do not derive their values from the ARM system register encodings. This is because their values were accidentally swapped. As the IDs are API, they cannot be changed. Add WARNING notes to point them out. Suggested-by: Marc Zyngier Signed-off-by: Andrew Jones [maz: turned XXX into WARNING] Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20200120130825.28838-1-drjones@redhat.com commit 0e20f5e25556c00ee813469d373b00abcf298708 Author: Marc Zyngier Date: Fri Dec 13 13:25:25 2019 +0000 KVM: arm/arm64: Cleanup MMIO handling Our MMIO handling is a bit odd, in the sense that it uses an intermediate per-vcpu structure to store the various decoded information that describe the access. But the same information is readily available in the HSR/ESR_EL2 field, and we actually use this field to populate the structure. Let's simplify the whole thing by getting rid of the superfluous structure and save a (tiny) bit of space in the vcpu structure. [32bit fix courtesy of Olof Johansson ] Signed-off-by: Marc Zyngier commit b059c63620fbba8a5da60f01d99d003681447e3c Author: Greg Kurz Date: Fri Nov 15 19:10:58 2019 +0100 powerpc/xive: Drop extern qualifiers from header function prototypes As reported by ./scripts/checkpatch.pl --strict: CHECK: extern prototypes should be avoided in .h files Signed-off-by: Greg Kurz Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/157384145834.181768.944827793193636924.stgit@bahia.lan commit 6a3163212f311daaf2ca3b676db2e11cfd81c6b3 Author: Greg Kurz Date: Thu Jul 4 00:03:19 2019 +0200 KVM: PPC: Book3S HV: XIVE: Fix typo in comment Signed-off-by: Greg Kurz Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/156219139988.578018.1046848908285019838.stgit@bahia.lan commit 25dd118f4b2773490df12b9d190c1956cf3250c3 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:41:15 2019 +0800 macintosh: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191120134115.14918-1-krzk@kernel.org commit 173bf44bdfc768af3c07cd0aeeb6ad8d1331b77d Author: Laurentiu Tudor Date: Tue Jan 14 11:00:25 2020 +0000 MAINTAINERS: Add myself as maintainer of ehv_bytechan tty driver Michael Ellerman made a call for volunteers from NXP to maintain this driver and I offered myself. Signed-off-by: Laurentiu Tudor Acked-by: Timur Tabi Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200114110012.17351-1-laurentiu.tudor@nxp.com commit 946743d035bd2cfff059ae79012ab22148caeac2 Author: Oliver O'Halloran Date: Fri Jan 10 18:02:07 2020 +1100 powernv/pci: Move pnv_pci_dma_bus_setup() to pci-ioda.c This is only used in pci-ioda.c so move it there and rename it to match. Signed-off-by: Oliver O'Halloran Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200110070207.439-6-oohall@gmail.com commit 0a25d9c40161269067c47f6c09a12d76cfe72581 Author: Oliver O'Halloran Date: Fri Jan 10 18:02:06 2020 +1100 powernv/pci: Fold pnv_pci_dma_dev_setup() into the pci-ioda.c version pnv_pci_dma_dev_setup() does nothing but call the phb->dma_dev_setup() callback, if one exists. That callback is only set for normal PCIe PHBs so we can remove the layer of indirection and use the ioda version in the pci_controller_ops. Signed-off-by: Oliver O'Halloran Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200110070207.439-5-oohall@gmail.com commit 965c94f309be58fbcc6c8d3e4f123376c5970d79 Author: Oliver O'Halloran Date: Fri Jan 10 18:02:05 2020 +1100 powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov() An ioda_pe for each VF is allocated in pnv_pci_sriov_enable() before the pci_dev for the VF is created. We need to set the pe->pdev pointer at some point after the pci_dev is created. Currently we do that in: pcibios_bus_add_device() pnv_pci_dma_dev_setup() (via phb->ops.dma_dev_setup) /* fixup is done here */ pnv_pci_ioda_dma_dev_setup() (via pnv_phb->dma_dev_setup) The fixup needs to be done before setting up DMA for for the VF's PE, but there's no real reason to delay it until this point. Move the fixup into pnv_pci_ioda_fixup_iov() so the ordering is: pcibios_add_device() pnv_pci_ioda_fixup_iov() (via ppc_md.pcibios_fixup_sriov) pcibios_bus_add_device() ... This isn't strictly required, but it's a slightly more logical place to do the fixup and it simplifies pnv_pci_dma_dev_setup(). Signed-off-by: Oliver O'Halloran Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200110070207.439-4-oohall@gmail.com commit ac1172019593f80818a2fdc406d3d30d8bbb05f2 Author: Oliver O'Halloran Date: Fri Jan 10 18:02:04 2020 +1100 powernv/pci: Remove dma_dev_setup() for NPU PHBs The pnv_pci_dma_dev_setup() only does something when: 1) There PHB contains VFs, or 2) The PHB defines a dma_dev_setup() callback in the pnv_phb structure. Neither is true for NPU PHBs so there's no reason to set the callback. Reviewed-by: Alexey Kardashevskiy Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200110070207.439-3-oohall@gmail.com commit 3ab3f3c9df348324029e3fbdf381f551b1df8f1e Author: Oliver O'Halloran Date: Fri Jan 10 18:02:03 2020 +1100 powerpc/pci: Fold pcibios_setup_device() into pcibios_bus_add_device() pcibios_bus_add_device() is the only caller of pcibios_setup_device(). Fold them together since there's no real reason to keep them separate. Signed-off-by: Oliver O'Halloran Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200110070207.439-2-oohall@gmail.com commit 37f6f8e88caef5f69774b82117ca35bdc4a985d8 Author: Oliver O'Halloran Date: Fri Nov 1 19:55:22 2019 +1100 powerpc/powernv: Allow manually invoking special reboots OPAL provides several different kinds of reboot for the kernel to use, namely forcing a full reboot, platform error reboot and MPIPL. Right now triggering the alternative resets requires some ad-hoc method such as triggering a kernel crash and hoping the stars align. It's sometimes handy to be able to trigger one of these resets directly, so add a way to do that. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191101085522.3055-2-oohall@gmail.com commit 2d9b332d99b24f27f77e9ba38ce3c8beb11a81c0 Author: Oliver O'Halloran Date: Fri Nov 1 19:55:21 2019 +1100 powerpc/xmon: Allow passing an argument to ppc_md.restart() On PowerNV a few different kinds of reboot are supported. We'd like to be able to exercise these from xmon so allow 'zr' to take an argument, and pass that to the ppc_md.restart() function. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191101085522.3055-1-oohall@gmail.com commit 846a17a53aeeee426cbc1252f517a6660eab1427 Author: Oliver O'Halloran Date: Fri Nov 1 17:26:11 2019 +1100 powerpc/powernv: Use common code for the symbol_map export Long before we had a generic way for firmware to export memory ranges of interest we added a special case for the skiboot symbol map. The code is pretty much identical to the generic export so re-use the code. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191101062611.32610-2-oohall@gmail.com commit db93361260e2411f854514e8b54b6c31a5b2d5bd Author: Oliver O'Halloran Date: Fri Nov 1 17:26:10 2019 +1100 powerpc/powernv: Rework exports to support subnodes Originally we only had a handful of exported memory ranges, but we'd to export the per-core trace buffers. This results in a lot of files in the exports directory which is a but unfortunate. We can clean things up a bit by turning subnodes into subdirectories of the exports directory. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191101062611.32610-1-oohall@gmail.com commit 4e0942c0302b5ad76b228b1a7b8c09f658a1d58a Author: Oliver O'Halloran Date: Wed Oct 16 12:25:36 2019 +1100 powerpc/eeh: Only dump stack once if an MMIO loop is detected Many drivers don't check for errors when they get a 0xFFs response from an MMIO load. As a result after an EEH event occurs a driver can get stuck in a polling loop unless it some kind of internal timeout logic. Currently EEH tries to detect and report stuck drivers by dumping a stack trace after eeh_dev_check_failure() is called EEH_MAX_FAILS times on an already frozen PE. The value of EEH_MAX_FAILS was chosen so that a dump would occur every few seconds if the driver was spinning in a loop. This results in a lot of spurious stack traces in the kernel log. Fix this by limiting it to printing one stack trace for each PE freeze. If the driver is truely stuck the kernel's hung task detector is better suited to reporting the probelm anyway. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Tested-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191016012536.22588-1-oohall@gmail.com commit 18697d2b08622b35278fc4312e86e6b5d3cd758d Author: Oliver O'Halloran Date: Thu Sep 12 15:29:45 2019 +1000 powernv/pci: Add a debugfs entry to dump PHB's IODA PE state Add a debugfs entry to dump the state of the active IODA PEs. The IODA PE state reflects how the PHB's internal concept of a PE is configured. This is separate to the EEH PE state and is managed power the PowerNV PCI backend rather than the EEH core. Signed-off-by: Oliver O'Halloran Reviewed-by: Alexey Kardashevskiy [mpe: Use DEFINE_DEBUGFS_ATTRIBUTE] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190912052945.12589-3-oohall@gmail.com commit c13a17b73eb0b30070a347111b8c386f4e6a844e Author: Oliver O'Halloran Date: Thu Sep 12 15:29:44 2019 +1000 powernv/pci: Allow any write trigger the diag dump Make the dump trigger off any input rather than just '1'. This allows you to write "echo 1> dump_diag_data" and it'll do what you want rather than erroring out pointlessly. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190912052945.12589-2-oohall@gmail.com commit 22ba7289079be12c85895fee41602139e9553c93 Author: Oliver O'Halloran Date: Thu Sep 12 15:29:43 2019 +1000 powernv/pci: Use pnv_phb as the private data for debugfs entries Use the pnv_phb structure as the private data pointer for the debugfs files. This lets us delete some code and an open-coded use of hose->private_data. Signed-off-by: Oliver O'Halloran Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190912052945.12589-1-oohall@gmail.com commit a4af49f34f76f1e6125b22b50d18580426d935e0 Author: Oliver O'Halloran Date: Wed Aug 21 16:26:55 2019 +1000 powerpc/pcidn: Warn when sriov pci_dn management is used incorrectly These functions can only be used on a SR-IOV capable physical function and they're only called in pcibios_sriov_enable / disable. Make them emit a warning in the future if they're used incorrectly and remove the dead code that checks if the device is a VF. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190821062655.19735-3-oohall@gmail.com commit 8cd6aacc640116213f9373808a627ecd3728accc Author: Oliver O'Halloran Date: Wed Aug 21 16:26:54 2019 +1000 powerpc/pcidn: Make VF pci_dn management CONFIG_PCI_IOV specific The powerpc PCI code requires that a pci_dn structure exists for all devices in the system. This is fine for real devices since at boot a pci_dn is created for each PCI device in the DT and it's fine for hotplugged devices since the hotplug slot driver will manage the pci_dn's devices in hotplug slots. For SR-IOV, we need the platform / pcibios to manage the pci_dn for virtual functions since firmware is unaware of VFs, and they aren't "hot plugged" in the traditional sense. Management of the pci_dn is handled by the, poorly named, functions: add_pci_dev_data() and remove_pci_dev_data(). The entire body of these functions is #ifdef`ed around CONFIG_PCI_IOV and they cannot be used in any other context, so make them only available when CONFIG_PCI_IOV is selected, and rename them to reflect their actual usage rather than having them masquerade as generic code. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190821062655.19735-2-oohall@gmail.com commit 1fb4124ca9d456656a324f1ee29b7bf942f59ac8 Author: Oliver O'Halloran Date: Wed Aug 21 16:26:53 2019 +1000 powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV When disabling virtual functions on an SR-IOV adapter we currently do not correctly remove the EEH state for the now-dead virtual functions. When removing the pci_dn that was created for the VF when SR-IOV was enabled we free the corresponding eeh_dev without removing it from the child device list of the eeh_pe that contained it. This can result in crashes due to the use-after-free. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Tested-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190821062655.19735-1-oohall@gmail.com commit 3489cdc417b20d929b33eff4d8312b4dd1f39ca1 Author: Oliver O'Halloran Date: Mon Jul 15 18:56:12 2019 +1000 powerpc/eeh_sysfs: Make clearing EEH_DEV_SYSFS saner The eeh_sysfs_remove_device() function is supposed to clear the EEH_DEV_SYSFS flag since it indicates the EEH sysfs entries have been added for a pci_dev. When the sysfs files are removed eeh_remove_device() the eeh_dev and the pci_dev have already been de-associated. This then causes the pci_dev_to_eeh_dev() call in eeh_sysfs_remove_device() to return NULL so the flag can't be cleared from the still-live eeh_dev. This problem is worked around in the caller by clearing the flag manually. However, this behaviour doesn't make a whole lot of sense, so this patch fixes it by: a) Re-ordering eeh_remove_device() so that eeh_sysfs_remove_device() is called before de-associating the pci_dev and eeh_dev. b) Making eeh_sysfs_remove_device() emit a warning if there's no corresponding eeh_dev for a pci_dev. The paths where the sysfs files are only reachable if EEH was setup for the device for the device in the first place so hitting this warning indicates a programming error. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Tested-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190715085612.8802-6-oohall@gmail.com commit 758b423275f0738fa4d382057c03f3d45c12905d Author: Oliver O'Halloran Date: Mon Jul 15 18:56:11 2019 +1000 powerpc/eeh_sysfs: Remove double pci_dn lookup. In eeh_notify_resume_show() the pci_dn for the device is looked up once in the declaration block and then once after checking for a NULL eeh_dev. Remove the second lookup since it's pointless. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Tested-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190715085612.8802-5-oohall@gmail.com commit 4107248c5615ab20b64073f2dd5917b3961239dc Author: Oliver O'Halloran Date: Mon Jul 15 18:56:10 2019 +1000 powerpc/eeh_sysfs: ifdef pseries sr-iov sysfs properties There are several EEH sysfs properties that only exists when the "ibm,is-open-sriov-pf" property appears in the device tree node of the PCI device. This used on pseries to indicate to the guest that the hypervisor allows the guest to configure the SR-IOV capability. Doing this requires some handshaking between the guest, hypervisor and userspace when a VF is EEH frozen which is why these properties exist. This is all dead code on non-pseries platforms so wrap it in an #ifdef CONFIG_PPC_PSERIES to make the dependency clearer. Signed-off-by: Oliver O'Halloran Tested-by: Sam Bobroff Reviewed-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190715085612.8802-4-oohall@gmail.com commit 89f51839bd75b1aa8fa062a5f2b4bbcde560f6e2 Author: Oliver O'Halloran Date: Mon Jul 15 18:56:09 2019 +1000 powerpc/eeh_sysfs: Fix incorrect comment The EEH_ATTR_SHOW() helper is used to display fields from struct eeh_dev not struct pci_dn. Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190715085612.8802-3-oohall@gmail.com commit b1268f4cdba71c0cd40b533778812340d36de8ae Author: Oliver O'Halloran Date: Mon Jul 15 18:56:08 2019 +1000 powerpc/eeh_cache: Don't use pci_dn when inserting new ranges At the point where we start inserting ranges into the EEH address cache the binding between pci_dev and eeh_dev has already been set up. Instead of consulting the pci_dn tree we can retrieve the eeh_dev directly using pci_dev_to_eeh_dev(). Signed-off-by: Oliver O'Halloran Reviewed-by: Sam Bobroff Tested-by: Sam Bobroff Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190715085612.8802-2-oohall@gmail.com commit 49ce94b8677c7d7a15c4d7cbbb9ff1cd8387827b Author: Frederic Barrat Date: Thu Nov 21 14:49:18 2019 +0100 ocxl: Add PCI hotplug dependency to Kconfig The PCI hotplug framework is used to update the devices when a new image is written to the FPGA. Reviewed-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-12-fbarrat@linux.ibm.com commit 748ac391ab9acd8d7f3c93cbf3e63c773c0b2638 Author: Frederic Barrat Date: Thu Nov 21 14:49:17 2019 +0100 pci/hotplug/pnv-php: Wrap warnings in macro An opencapi slot doesn't have an associated bridge device. It's not needed for operation, but any warning is displayed through pci_warn() which uses the pci_dev struct of the assocated bridge device. So wrap those warning so that a different trace mechanism can be used if it's an opencapi slot. Reviewed-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-11-fbarrat@linux.ibm.com commit be1611e043de63948c21cc7dd27ea6798ffd6fa4 Author: Frederic Barrat Date: Thu Nov 21 14:49:16 2019 +0100 pci/hotplug/pnv-php: Relax check when disabling slot The driver only allows to disable a slot in the POPULATED state. However, if an error occurs while enabling the slot, say because the link couldn't be trained, then the POPULATED state may not be reached, yet the power state of the slot is on. So allow to disable a slot in the REGISTERED state. Removing the devices will do nothing since it's not populated, and we'll set the power state of the slot back to off. Reviewed-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-10-fbarrat@linux.ibm.com commit ea53919b15bf1e821b034b9c89758008de521437 Author: Frederic Barrat Date: Thu Nov 21 14:49:15 2019 +0100 pci/hotplug/pnv-php: Register opencapi slots Add the opencapi PHBs to the list of PHBs being scanned to look for slots. Signed-off-by: Frederic Barrat Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-9-fbarrat@linux.ibm.com commit 323c2a26ff43500a96799250330fab68903d776f Author: Frederic Barrat Date: Thu Nov 21 14:49:14 2019 +0100 pci/hotplug/pnv-php: Improve error msg on power state change failure When changing the slot state, if opal hits an error and tells as such in the asynchronous reply, the warning "Wrong msg" is logged, which is rather confusing. Instead we can reuse the better message which is already used when we couldn't submit the asynchronous opal request initially. Reviewed-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-8-fbarrat@linux.ibm.com commit 658ab186dd22060408d94f5c5a6d02d809baba44 Author: Frederic Barrat Date: Thu Nov 21 14:49:13 2019 +0100 pci/hotplug/pnv-php: Remove erroneous warning On powernv, when removing a device through hotplug, the following warning is logged: Invalid refcount <.> on <...> It may be incorrect, the refcount may be set to a higher value than 1 and be valid. of_detach_node() can drop more than one reference. As it doesn't seem trivial to assert the correct value, let's remove the warning. Reviewed-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-7-fbarrat@linux.ibm.com commit bbb789046084d18fff1a32a7bcdeca36dfa0ac14 Author: Frederic Barrat Date: Thu Nov 21 14:49:12 2019 +0100 powerpc/powernv/ioda: Find opencapi slot for a device node Unlike real PCI slots, opencapi slots are directly associated to the (virtual) opencapi PHB, there's no intermediate bridge. So when looking for a slot ID, we must start the search from the device node itself and not its parent. Also, the slot ID is not attached to a specific bdfn, so let's build it from the PHB ID, like skiboot. Signed-off-by: Frederic Barrat Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-6-fbarrat@linux.ibm.com commit f724385fea0136af31a850fbcff01a6e8cf8c889 Author: Frederic Barrat Date: Thu Nov 21 14:49:11 2019 +0100 powerpc/powernv/ioda: Release opencapi device With hotplug, an opencapi device can now go away. It needs to be released, mostly to clean up its PE state. We were previously not defining any device callback. We can reuse the standard PCI release callback, it does a bit too much for an opencapi device, but it's harmless, and only needs minor tuning. Also separate the undo of the PELT-V code in a separate function, it is not needed for NPU devices and it improves a bit the readability of the code. Signed-off-by: Frederic Barrat Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-5-fbarrat@linux.ibm.com commit c1a2feade085fb4213e2823dabaa2401626843c8 Author: Frederic Barrat Date: Thu Nov 21 14:49:10 2019 +0100 powerpc/powernv/ioda: set up PE on opencapi device when enabling The PE for an opencapi device was set as part of a late PHB fixup operation, when creating the PHB. To use the PCI hotplug framework, this is not going to work, as the PHB stays the same, it's only the devices underneath which are updated. For regular PCI devices, it is done as part of the reconfiguration of the bridge, but for opencapi PHBs, we don't have an intermediate bridge. So let's define the PE when the device is enabled. PEs are meaningless for opencapi, the NPU doesn't define them and opal is not doing anything with them. Reviewed-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-4-fbarrat@linux.ibm.com commit 80f1ff83fa113aa718ff4009684981386c574954 Author: Frederic Barrat Date: Thu Nov 21 14:49:09 2019 +0100 powerpc/powernv/ioda: Protect PE list Protect the PHB's list of PE. Probably not needed as long as it was populated during PHB creation, but it feels right and will become required once we can add/remove opencapi devices on hotplug. Reviewed-by: Andrew Donnellan Signed-off-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-3-fbarrat@linux.ibm.com commit 05dd7da76986937fb288b4213b1fa10dbe0d1b33 Author: Frederic Barrat Date: Thu Nov 21 14:49:08 2019 +0100 powerpc/powernv/ioda: Fix ref count for devices with their own PE The pci_dn structure used to store a pointer to the struct pci_dev, so taking a reference on the device was required. However, the pci_dev pointer was later removed from the pci_dn structure, but the reference was kept for the npu device. See commit 902bdc57451c ("powerpc/powernv/idoa: Remove unnecessary pcidev from pci_dn"). We don't need to take a reference on the device when assigning the PE as the struct pnv_ioda_pe is cleaned up at the same time as the (physical) device is released. Doing so prevents the device from being released, which is a problem for opencapi devices, since we want to be able to remove them through PCI hotplug. Now the ugly part: nvlink npu devices are not meant to be released. Because of the above, we've always leaked a reference and simply removing it now is dangerous and would likely require more work. There's currently no release device callback for nvlink devices for example. So to be safe, this patch leaks a reference on the npu device, but only for nvlink and not opencapi. Signed-off-by: Frederic Barrat Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191121134918.7155-2-fbarrat@linux.ibm.com commit bfc2eae0ad72a43d2a270acce2581c065223aa12 Author: Christophe Leroy Date: Mon Dec 2 07:57:35 2019 +0000 powerpc/vdso32: miscellaneous optimisations Various optimisations by inverting branches and removing redundant instructions. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b4e79f963845545bcce1459cd6fcfe46bdde7863.1575273217.git.christophe.leroy@c-s.fr commit e33ffc956b086675551b86f5f83cf50ca47aa71c Author: Christophe Leroy Date: Mon Dec 2 07:57:33 2019 +0000 powerpc/vdso32: implement clock_getres entirely clock_getres returns hrtimer_res for all clocks but coarse ones for which it returns KTIME_LOW_RES. return EINVAL for unknown clocks. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/37f94e47c91070b7606fb3ec3fe6fd2302a475a0.1575273217.git.christophe.leroy@c-s.fr commit 6e2f9e9cfd560f5d9ce86503e5ae66330ccb97fc Author: Christophe Leroy Date: Mon Dec 2 07:57:32 2019 +0000 powerpc/vdso32: use LOAD_REG_IMMEDIATE() Use LOAD_REG_IMMEDIATE() to load registers with immediate value. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/36f111437e66e601929308f5d5dce230e1ce472f.1575273217.git.christophe.leroy@c-s.fr commit 2c29eef9fc6f61cfb81b54683be8f116dac80e7a Author: Christophe Leroy Date: Mon Dec 2 07:57:31 2019 +0000 powerpc/vdso32: Don't read cache line size from the datapage on PPC32. On PPC32, the cache lines have a fixed size known at build time. Don't read it from the datapage. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/dfa7b35e27e01964fcda84bf1ed8b2b31cf93826.1575273217.git.christophe.leroy@c-s.fr commit ec0895f08f99515194e9fcfe1338becf6f759d38 Author: Christophe Leroy Date: Mon Dec 2 07:57:30 2019 +0000 powerpc/vdso32: inline __get_datapage() __get_datapage() is only a few instructions to retrieve the address of the page where the kernel stores data to the VDSO. By inlining this function into its users, a bl/blr pair and a mflr/mtlr pair is avoided, plus a few reg moves. The improvement is noticeable (about 55 nsec/call on an 8xx) vdsotest before the patch: gettimeofday: vdso: 731 nsec/call clock-gettime-realtime-coarse: vdso: 668 nsec/call clock-gettime-monotonic-coarse: vdso: 745 nsec/call vdsotest after the patch: gettimeofday: vdso: 677 nsec/call clock-gettime-realtime-coarse: vdso: 613 nsec/call clock-gettime-monotonic-coarse: vdso: 690 nsec/call Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c39ef7f3dfa25356b01e211d539671f279086c09.1575273217.git.christophe.leroy@c-s.fr commit 654abc69ef2e69712e6d4e8a6cb9292b97a4aa39 Author: Christophe Leroy Date: Mon Dec 2 07:57:28 2019 +0000 powerpc/vdso32: Add support for CLOCK_{REALTIME/MONOTONIC}_COARSE This is copied and adapted from commit 5c929885f1bb ("powerpc/vdso64: Add support for CLOCK_{REALTIME/MONOTONIC}_COARSE") from Santosh Sivaraj Benchmark from vdsotest-all: clock-gettime-realtime: syscall: 3601 nsec/call clock-gettime-realtime: libc: 1072 nsec/call clock-gettime-realtime: vdso: 931 nsec/call clock-gettime-monotonic: syscall: 4034 nsec/call clock-gettime-monotonic: libc: 1213 nsec/call clock-gettime-monotonic: vdso: 1076 nsec/call clock-gettime-realtime-coarse: syscall: 2722 nsec/call clock-gettime-realtime-coarse: libc: 805 nsec/call clock-gettime-realtime-coarse: vdso: 668 nsec/call clock-gettime-monotonic-coarse: syscall: 2949 nsec/call clock-gettime-monotonic-coarse: libc: 882 nsec/call clock-gettime-monotonic-coarse: vdso: 745 nsec/call Additional test passed with: vdsotest -d 30 clock-gettime-monotonic-coarse verify Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://github.com/linuxppc/issues/issues/41 Link: https://lore.kernel.org/r/d1d24a376e396540194eeb85a2efe481e92ade24.1575273217.git.christophe.leroy@c-s.fr commit 902137ba8e469ed07c7f120a390161937a6288fb Author: Christophe Leroy Date: Mon Dec 2 07:57:27 2019 +0000 powerpc/32: Add VDSO version of getcpu on non SMP Commit 18ad51dd342a ("powerpc: Add VDSO version of getcpu") added getcpu() for PPC64 only, by making use of a user readable general purpose SPR. PPC32 doesn't have any such SPR. For non SMP, just return CPU id 0 from the VDSO directly. PPC32 doesn't support CONFIG_NUMA so NUMA node is always 0. Before the patch, vdsotest reported: getcpu: syscall: 1572 nsec/call getcpu: libc: 1787 nsec/call getcpu: vdso: not tested Now, vdsotest reports: getcpu: syscall: 1582 nsec/call getcpu: libc: 502 nsec/call getcpu: vdso: 187 nsec/call Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/eaac4b6494ecff1811220fccc895bf282aab884a.1575273217.git.christophe.leroy@c-s.fr commit 8c452a889821ca0cd2a5f2e3e87fbc01e56408cb Author: Christophe Leroy Date: Thu Nov 28 12:16:35 2019 +0000 powerpc/devicetrees: Change 'gpios' to 'cs-gpios' on fsl, spi nodes Since commit 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors"), the prefered way to define chipselect GPIOs is using 'cs-gpios' property instead of the legacy 'gpios' property. Signed-off-by: Christophe Leroy Reviewed-by: Linus Walleij Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/7556683b57d8ce100855857f03d1cd3d2903d045.1574943062.git.christophe.leroy@c-s.fr commit a426ea9bb3889b3ce3bec52f2467c1becdcc330a Author: Christophe Leroy Date: Tue Nov 26 17:43:30 2019 +0000 selftests/powerpc: Enable range tests on 8xx in ptrace-hwbreak.c selftest 8xx is now able to support any range length so range tests can be enabled. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/081e3b4e3a17a8ec9fdac46b505e3a29ca15f209.1574790198.git.christophe.leroy@c-s.fr commit 39413ae009674c6ba745850515b551bbb9d6374b Author: Christophe Leroy Date: Tue Nov 26 17:43:29 2019 +0000 powerpc/hw_breakpoints: Rewrite 8xx breakpoints to allow any address range size. Unlike standard powerpc, Powerpc 8xx doesn't have SPRN_DABR, but it has a breakpoint support based on a set of comparators which allow more flexibility. Commit 4ad8622dc548 ("powerpc/8xx: Implement hw_breakpoint") implemented breakpoints by emulating the DABR behaviour. It did this by setting one comparator the match 4 bytes at breakpoint address and the other comparator to match 4 bytes at breakpoint address + 4. Rewrite 8xx hw_breakpoint to make breakpoints match all addresses defined by the breakpoint address and length by making full use of comparators. Now, comparator E is set to match any address greater than breakpoint address minus one. Comparator F is set to match any address lower than breakpoint address plus breakpoint length. Addresses are aligned to 32 bits. When the breakpoint range starts at address 0, the breakpoint is set to match comparator F only. When the breakpoint range end at address 0xffffffff, the breakpoint is set to match comparator E only. Otherwise the breakpoint is set to match comparator E and F. At the same time, use registers bit names instead of hardcoded values. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/05105deeaf63bc02151aea2cdeaf525534e0e9d4.1574790198.git.christophe.leroy@c-s.fr commit 991d656d722dbc783481f408d6e4cbcce2e8bb78 Author: Christophe Leroy Date: Tue Nov 26 13:16:50 2019 +0000 powerpc/8xx: Fix permanently mapped IMMR region. When not using large TLBs, the IMMR region is still mapped as a whole block in the FIXMAP area. Properly report that the IMMR region is block-mapped even when not using large TLBs. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/45f4f414bcd7198b0755cf4287ff216fbfc24b9d.1574774187.git.christophe.leroy@c-s.fr commit f509247b08f2dcf7754d9ed85ad69a7972aa132b Author: Christophe Leroy Date: Tue Jan 14 08:13:10 2020 +0000 powerpc/ptdump: Only enable PPC_CHECK_WX with STRICT_KERNEL_RWX ptdump_check_wx() is called from mark_rodata_ro() which only exists when CONFIG_STRICT_KERNEL_RWX is selected. Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/922d4939c735c6b52b4137838bcc066fffd4fc33.1578989545.git.christophe.leroy@c-s.fr commit d80ae83f1f932ab7af47b54d0d3bef4f4dba489f Author: Christophe Leroy Date: Tue Jan 14 08:13:09 2020 +0000 powerpc/ptdump: Fix W+X verification Verification cannot rely on simple bit checking because on some platforms PAGE_RW is 0, checking that a page is not W means checking that PAGE_RO is set instead of checking that PAGE_RW is not set. Use pte helpers instead of checking bits. Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/0d894839fdbb19070f0e1e4140363be4f2bb62fc.1578989540.git.christophe.leroy@c-s.fr commit e26ad936dd89d79f66c2b567f700e0c2a7103070 Author: Christophe Leroy Date: Tue Jan 14 08:13:08 2020 +0000 powerpc/ptdump: Fix W+X verification call in mark_rodata_ro() ptdump_check_wx() also have to be called when pages are mapped by blocks. Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/37517da8310f4457f28921a4edb88fb21d27b62a.1578989531.git.christophe.leroy@c-s.fr commit 1e1c8b2cc37afb333c1829e8e0360321813bf220 Author: Christophe Leroy Date: Tue Jan 14 07:14:40 2020 +0000 powerpc/ptdump: don't entirely rebuild kernel when selecting CONFIG_PPC_DEBUG_WX Selecting CONFIG_PPC_DEBUG_WX only impacts ptdump and pgtable_32/64 init calls. Declaring related functions in asm/pgtable.h implies rebuilding almost everything. Move ptdump_check_wx() declaration in mm/mmu_decl.h Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/bf34fd9dca61eadf9a134a9f89ebbc162cfd5f86.1578986011.git.christophe.leroy@c-s.fr commit fd786fb1d2cad70b9aaba8c73872cbf63262bd58 Author: Heiner Kallweit Date: Tue Jan 21 22:09:33 2020 +0100 net: convert suitable drivers to use phy_do_ioctl_running Convert suitable drivers to use new helper phy_do_ioctl_running. Signed-off-by: Heiner Kallweit Acked-by: Timur Tabi Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 4425f567b0dd2cb5ad2b16ce03a8951d0ccf935d Author: Paolo Bonzini Date: Mon Jan 20 16:14:37 2020 +0100 KVM: async_pf: drop kvm_arch_async_page_present wrappers The wrappers make it less clear that the position of the call to kvm_arch_async_page_present depends on the architecture, and that only one of the two call sites will actually be active. Remove them. Cc: Andy Lutomirski Cc: Christian Borntraeger Signed-off-by: Paolo Bonzini commit 99634e3ec0d4e0df28ae465b10f3613a4ceee58b Author: Paolo Bonzini Date: Mon Jan 20 14:22:55 2020 +0100 KVM: x86: list MSR_IA32_UCODE_REV as an emulated MSR Even if it's read-only, it can still be written to by userspace. Let them know by adding it to KVM_GET_MSR_INDEX_LIST. Signed-off-by: Paolo Bonzini commit 5fcf3a55a62afb0760ccb6f391d62f20bce4a42f Author: Gavin Shan Date: Tue Dec 10 15:48:29 2019 +1100 tools/kvm_stat: Fix kvm_exit filter name The filter name is fixed to "exit_reason" for some kvm_exit events, no matter what architect we have. Actually, the filter name ("exit_reason") is only applicable to x86, meaning it's broken on other architects including aarch64. This fixes the issue by providing various kvm_exit filter names, depending on architect we're on. Afterwards, the variable filter name is picked and applied through ioctl(fd, SET_FILTER). Reported-by: Andrew Jones Signed-off-by: Gavin Shan Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 56871d444bc4d7ea66708775e62e2e0926384dbc Author: Paolo Bonzini Date: Sat Jan 18 20:09:03 2020 +0100 KVM: x86: fix overlap between SPTE_MMIO_MASK and generation The SPTE_MMIO_MASK overlaps with the bits used to track MMIO generation number. A high enough generation number would overwrite the SPTE_SPECIAL_MASK region and cause the MMIO SPTE to be misinterpreted. Likewise, setting bits 52 and 53 would also cause an incorrect generation number to be read from the PTE, though this was partially mitigated by the (useless if it weren't for the bug) removal of SPTE_SPECIAL_MASK from the spte in get_mmio_spte_generation. Drop that removal, and replace it with a compile-time assertion. Fixes: 6eeb4ef049e7 ("KVM: x86: assign two bits to track SPTE kinds") Reported-by: Ben Gardon Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 5396c4bd9fd8429050f6191663b6c491e6402da2 Author: Colin Ian King Date: Thu Jan 23 00:00:50 2020 +0000 ALSA: cs46xx: fix spelling mistake "to" -> "too" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20200123000050.2831088-1-colin.king@canonical.com Signed-off-by: Takashi Iwai commit 19c64e7354e50d19e7b5ddf94bfb5fa24d69594c Author: Colin Ian King Date: Wed Jan 22 23:39:55 2020 +0000 USB: serial: cyberjack: fix spelling mistake "To" -> "Too" There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Johan Hovold commit a1c91c1036397f2f7074aa4f5df8a2412e94ab97 Author: Johan Hovold Date: Wed Jan 22 11:15:30 2020 +0100 USB: serial: ir-usb: simplify endpoint check Simplify the endpoint sanity check by letting core verify that the required endpoints are present. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit e7542bc382f8ca2eae25adaa444044513e474925 Author: Johan Hovold Date: Wed Jan 22 11:15:29 2020 +0100 USB: serial: ir-usb: make set_termios synchronous Use a synchronous usb_bulk_msg() when switching link speed in set_termios(). This way we do not need to keep track of outstanding URBs in order to be able to stop them at close. Note that there's no need to set URB_ZERO_PACKET as the one-byte transfer will always be short. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 38c0d5bdf4973f9f5a888166e9d3e9ed0d32057a Author: Johan Hovold Date: Wed Jan 22 11:15:28 2020 +0100 USB: serial: ir-usb: fix IrLAP framing Commit f4a4cbb2047e ("USB: ir-usb: reimplement using generic framework") switched to using the generic write implementation which may combine multiple write requests into larger transfers. This can break the IrLAP protocol where end-of-frame is determined using the USB short packet mechanism, for example, if multiple frames are sent in rapid succession. Fixes: f4a4cbb2047e ("USB: ir-usb: reimplement using generic framework") Cc: stable # 2.6.35 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 17a0184ca17e288decdca8b2841531e34d49285f Author: Johan Hovold Date: Wed Jan 22 11:15:27 2020 +0100 USB: serial: ir-usb: fix link-speed handling Commit e0d795e4f36c ("usb: irda: cleanup on ir-usb module") added a USB IrDA header with common defines, but mistakingly switched to using the class-descriptor baud-rate bitmask values for the outbound header. This broke link-speed handling for rates above 9600 baud, but a device would also be able to operate at the default 9600 baud until a link-speed request was issued (e.g. using the TCGETS ioctl). Fixes: e0d795e4f36c ("usb: irda: cleanup on ir-usb module") Cc: stable # 2.6.27 Cc: Felipe Balbi Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 2988a8ae7476fe9535ab620320790d1714bdad1d Author: Johan Hovold Date: Wed Jan 22 11:15:26 2020 +0100 USB: serial: ir-usb: add missing endpoint sanity check Add missing endpoint sanity check to avoid dereferencing a NULL-pointer on open() in case a device lacks a bulk-out endpoint. Note that prior to commit f4a4cbb2047e ("USB: ir-usb: reimplement using generic framework") the oops would instead happen on open() if the device lacked a bulk-in endpoint and on write() if it lacked a bulk-out endpoint. Fixes: f4a4cbb2047e ("USB: ir-usb: reimplement using generic framework") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 7af43a76695db71a57203793fb9dd3c81a5783b1 Author: Chen Zhou Date: Wed Jan 22 09:32:40 2020 +0800 backlight: qcom-wled: Fix unsigned comparison to zero Fixes coccicheck warning: ./drivers/video/backlight/qcom-wled.c:1104:5-15: WARNING: Unsigned expression compared with zero: string_len > 0 The unsigned variable string_len is assigned a return value from the call to of_property_count_elems_of_size(), which may return negative error code. Fixes: 775d2ffb4af6 ("backlight: qcom-wled: Restructure the driver for WLED3") Signed-off-by: Chen Zhou Reviewed-by: Bjorn Andersson Reviewed-by: Daniel Thompson Reviewed-by: Kiran Gunda Signed-off-by: Lee Jones commit 954b3c4397792c8614aa4aaf25030ae87ece8307 Merge: c5d19a6ecfce 85cc12f85138 Author: David S. Miller Date: Thu Jan 23 08:10:16 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Alexei Starovoitov says: ==================== pull-request: bpf-next 2020-01-22 The following pull-request contains BPF updates for your *net-next* tree. We've added 92 non-merge commits during the last 16 day(s) which contain a total of 320 files changed, 7532 insertions(+), 1448 deletions(-). The main changes are: 1) function by function verification and program extensions from Alexei. 2) massive cleanup of selftests/bpf from Toke and Andrii. 3) batched bpf map operations from Brian and Yonghong. 4) tcp congestion control in bpf from Martin. 5) bulking for non-map xdp_redirect form Toke. 6) bpf_send_signal_thread helper from Yonghong. ==================== Signed-off-by: David S. Miller commit 7c453526dc50460c63ff28df7673570dd057c5d0 Author: Vlad Buslov Date: Tue Jan 21 20:08:42 2020 +0200 net/mlx5e: Enable all available stats for uplink reps Extend stats group array of uplink representor with all stats that are available for PF in legacy mode, besides ipsec and TLS which are not supported. Don't output vport stats for uplink representor because they are already handled by 802_3 group (with different names: {tx|rx}_{bytes|packets}_phy). Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 8520fa57a4e934eff631883cf80744d3a84c734b Author: Vlad Buslov Date: Tue Jan 21 21:36:40 2020 +0200 net/mlx5e: Create q counters on uplink representors Q counters were disabled for all types of representors to prevent an issue where there is not enough resources to init q counters for 127 representor instances. Enable q counters only for uplink representors to support "rx_out_of_buffer", "rx_if_down_packets" counters in ethtool. Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 8a236b15144b29ce47f80c37bc55740a5388ecb1 Author: Vlad Buslov Date: Tue Jan 21 19:38:21 2020 +0200 net/mlx5e: Convert rep stats to mlx5e_stats_grp-based infra In order to support all of the supported stats that are available in legacy mode for switchdev uplink representors, convert rep stats infrastructure to reuse struct mlx5e_stats_grp that is already used when device is in legacy mode. Refactor rep code to use array of mlx5e_stats_grp structures (constructed using macros provided by stats infra) to fill/update stats, instead of fixed hardcoded set of values. This approach allows to easily extend representors with new stats types. Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 2a303f13f9cda5a8f5729ccb84b211c1ef6bed92 Author: Saeed Mahameed Date: Tue Jan 21 01:15:28 2020 -0800 net/mlx5e: IPoIB, use separate stats groups Don't copy all of the stats groups used for mlx5e ethernet NIC profile, have a separate stats groups for IPoIB with the set of the needed stats only. Signed-off-by: Saeed Mahameed commit f0ff8e8c7206886a5360eee7d3f664480ed473c9 Author: Saeed Mahameed Date: Tue Jan 21 00:54:00 2020 -0800 net/mlx5e: Convert stats groups array to array of group pointers Convert stats groups array to array of "stats group" pointers to allow sharing and individual selection of groups per profile as illustrated in the next patches. Signed-off-by: Saeed Mahameed Reviewed-by: Tariq Toukan commit 96b12796550d0f0a7613f03efa0140f39120946b Author: Saeed Mahameed Date: Tue Jan 21 00:24:53 2020 -0800 net/mlx5e: Declare stats groups via macro Introduce new macros to declare stats callbacks and groups, for better code reuse and for individual groups selection per profile which will be introduced in next patches. Signed-off-by: Saeed Mahameed Reviewed-by: Tariq Toukan commit 3460c184dfb0b41118b5000ad78dd997c034b2b5 Author: Saeed Mahameed Date: Mon Jan 20 22:32:12 2020 -0800 net/mlx5e: Profile specific stats groups Attach stats groups array to the profiles and make the stats utility functions (get_num, update, fill, fill_strings) generic and use the profile->stats_grps rather the hardcoded NIC stats groups. This will allow future extension to have per profile stats groups. In this patch mlx5e NIC and IPoIB will still share the same stats groups. Signed-off-by: Saeed Mahameed Reviewed-by: Tariq Toukan commit 29b598ddb8d2d401257013c2af5e9f003bf84ec4 Author: Roi Dayan Date: Wed Oct 23 09:59:36 2019 +0300 net/mlx5e: Move uplink rep init/cleanup code into own functions Clean up the code and allows to call uplink rep init/cleanup from different location later. To be used later for a new uplink representor mode. Signed-off-by: Roi Dayan Reviewed-by: Eli Britstein Signed-off-by: Saeed Mahameed commit 4c7cea2f31f1dde9c578e4729e0d34f340052037 Author: Yevgeny Kliteynik Date: Mon Jan 20 11:51:36 2020 +0200 net/mlx5: DR, Allow connecting flow table to a lower/same level table Allow connecting SW steering source table to a lower/same level destination table. Lifting this limitation is required to support Connection Tracking. Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit c21a49b360e16657f42f1a9269c3aa714738fec7 Author: Hamdan Igbaria Date: Thu Jan 9 13:27:16 2020 +0200 net/mlx5: DR, Modify header copy support Modify header supports ADD/SET and from this patch also COPY. Copy allows to copy header fields and metadata. Signed-off-by: Hamdan Igbaria Signed-off-by: Alex Vesker Signed-off-by: Saeed Mahameed commit a51dcc10a04ac476240befb875b0a21388a429cd Author: Hamdan Igbaria Date: Tue Dec 24 18:07:41 2019 +0200 net/mlx5: DR, Modify set action limitation extension Modify set actions are not supported on both tx and rx, added a check for that. Also refactored the code in a way that every modify action has his own functions, this needed so in the future we could add copy action more smoothly. Signed-off-by: Hamdan Igbaria Signed-off-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 6d65bc64e232896251daba7c43933f0f35859bc3 Author: wenxu Date: Tue Jan 7 17:16:06 2020 +0800 net/mlx5e: Add mlx5e_flower_parse_meta support In the flowtables offload all the devices in the flowtables share the same flow_block. An offload rule will be installed on all the devices. This scenario is not correct. It is no problem if there are only two devices in the flowtable, The rule with ingress and egress on the same device can be reject by driver. But more than two devices in the flowtable will install the wrong rules on hardware. For example: Three devices in a offload flowtables: dev_a, dev_b, dev_c A rule ingress from dev_a and egress to dev_b: The rule will install on device dev_a. The rule will try to install on dev_b but failed for ingress and egress on the same device. The rule will install on dev_c. This is not correct. The flowtables offload avoid this case through restricting the ingress dev with FLOW_DISSECTOR_KEY_META. So the mlx5e driver also should support the FLOW_DISSECTOR_KEY_META parse. Signed-off-by: wenxu Acked-by: Roi Dayan Signed-off-by: Saeed Mahameed commit e15cf98ee8a76472144a19a24ca73d26fefa5237 Author: Chen Wandun Date: Mon Jan 20 20:41:53 2020 +0800 net/mlx5: make the symbol 'ESW_POOLS' static Fix the following sparse warning: drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_chains.c:35:20: warning: symbol 'ESW_POOLS' was not declared. Should it be static? Fixes: 39ac237ce009 ("net/mlx5: E-Switch, Refactor chains and priorities") Signed-off-by: Chen Wandun Acked-by: Paul Blakey Signed-off-by: Saeed Mahameed commit a1718505d7f67ee0ab051322f1cbc7ac42b5da82 Author: Davide Caratti Date: Thu Jan 9 12:07:59 2020 +0100 net/mlx5e: allow TSO on VXLAN over VLAN topologies since mlx5 hardware can segment correctly TSO packets on VXLAN over VLAN topologies, CPU usage can improve significantly if we enable tunnel offloads in dev->vlan_features, like it was done in the past with other NIC drivers (e.g. mlx4, be2net and ixgbe). Signed-off-by: Davide Caratti Signed-off-by: Saeed Mahameed commit ca9c74ae9be5e78541c2058db9a754947a7d4a9b Author: Olof Johansson Date: Thu Dec 19 16:15:17 2019 -0800 net/mlx5e: Fix printk format warning Use "%zu" for size_t. Seen on ARM allmodconfig: drivers/net/ethernet/mellanox/mlx5/core/wq.c: In function 'mlx5_wq_cyc_wqe_dump': include/linux/kern_levels.h:5:18: warning: format '%ld' expects argument of type 'long int', but argument 5 has type 'size_t' {aka 'unsigned int'} [-Wformat=] Fixes: 130c7b46c93d ("net/mlx5e: TX, Dump WQs wqe descriptors on CQE with error events") Signed-off-by: Olof Johansson Signed-off-by: Saeed Mahameed commit f5fa7c8bb6307624b2177dfedc67da8dbc3a7a52 Author: Hridya Valsaraju Date: Wed Jan 22 10:49:20 2020 -0800 f2fs: delete duplicate information on sysfs nodes This patch merges the sysfs node documentation present in Documentation/filesystems/f2fs.txt and Documentation/ABI/testing/sysfs-fs-f2fs and deletes the duplicate information from Documentation/filesystems/f2fs.txt. This is to prevent having to update both files when a new sysfs node is added for f2fs. The patch also makes minor formatting changes to Documentation/ABI/testing/sysfs-fs-f2fs. Signed-off-by: Hridya Valsaraju Signed-off-by: Jaegeuk Kim commit a9eeb0e61128ed6cdd0b910eab2df7b2729d7d15 Merge: 31a7d26fbc51 af15a11b9046 Author: Olof Johansson Date: Wed Jan 22 16:41:24 2020 -0800 Merge tag 'samsung-soc-5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/soc Samsung mach/soc changes for v5.6, part 2 1. Switch from legacy to atomic pwm API in rx1950 (s3c24xx), 2. Cleanups of unneeded selects in Kconfig. * tag 'samsung-soc-5.6-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: s3c64xx: Drop unneeded select of TIMER_OF ARM: exynos: Drop unneeded select of MIGHT_HAVE_CACHE_L2X0 ARM: s3c24xx: Switch to atomic pwm API in rx1950 Link: https://lore.kernel.org/r/20200122172649.3143-1-krzk@kernel.org Signed-off-by: Olof Johansson commit 85cc12f85138f2ce3edf24833edd2179690306db Merge: 1b2fd38de9fc 6de4a9c430b5 Author: Alexei Starovoitov Date: Wed Jan 22 16:30:11 2020 -0800 Merge branch 'bpf_cubic' Martin KaFai Lau says: ==================== This set adds bpf_cubic.c example. It was separated from the earlier BPF STRUCT_OPS series. Some highlights since the last post: 1. It is based on EricD recent fixes to the kernel tcp_cubic. [1] 2. The bpf jiffies reading helper is inlined by the verifier. Different from the earlier version, it only reads jiffies alone and does not do usecs/jiffies conversion. 3. The bpf .kconfig map is used to read CONFIG_HZ. [1]: https://patchwork.ozlabs.org/cover/1215066/ v3: - Remove __weak from CONFIG_HZ in patch 3. (Andrii) v2: - Move inlining to fixup_bpf_calls() in patch 1. (Daniel) - It is inlined for 64 BITS_PER_LONG and jit_requested as the map_gen_lookup(). Other cases could be considered together with map_gen_lookup() if needed. - Use usec resolution in bictcp_update() calculation in patch 3. usecs_to_jiffies() is then removed(). (Eric) ==================== Signed-off-by: Alexei Starovoitov commit 6de4a9c430b57c6ebbccd2a1725f42e9be75f592 Author: Martin KaFai Lau Date: Wed Jan 22 15:36:58 2020 -0800 bpf: tcp: Add bpf_cubic example This patch adds a bpf_cubic example. Some highlights: 1. CONFIG_HZ .kconfig map is used. 2. In bictcp_update(), calculation is changed to use usec resolution (i.e. USEC_PER_JIFFY) instead of using jiffies. Thus, usecs_to_jiffies() is not used in the bpf_cubic.c. 3. In bitctcp_update() [under tcp_friendliness], the original "while (ca->ack_cnt > delta)" loop is changed to the equivalent "ca->ack_cnt / delta" operation. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200122233658.903774-1-kafai@fb.com commit 0a49c1a8e26266ad505704f54f9fdaf2ae14cbdb Author: Martin KaFai Lau Date: Wed Jan 22 15:36:52 2020 -0800 bpf: Sync uapi bpf.h to tools/ This patch sync uapi bpf.h to tools/. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200122233652.903348-1-kafai@fb.com commit 5576b991e9c1a11d2cc21c4b94fc75ec27603896 Author: Martin KaFai Lau Date: Wed Jan 22 15:36:46 2020 -0800 bpf: Add BPF_FUNC_jiffies64 This patch adds a helper to read the 64bit jiffies. It will be used in a later patch to implement the bpf_cubic.c. The helper is inlined for jit_requested and 64 BITS_PER_LONG as the map_gen_lookup(). Other cases could be considered together with map_gen_lookup() if needed. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200122233646.903260-1-kafai@fb.com commit c9444384f0d5cfdbd4ed165b17e53e1537e109cc Author: Jiaxun Yang Date: Mon Jan 13 18:16:12 2020 +0800 MIPS: Loongson64: Select mac2008 only feature Some Loongson-64 processor didn't set MAC2008 bit in fcsr, but actually all Loongson64 processors are MAC2008 only. Signed-off-by: Jiaxun Yang Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: chenhc@lemote.com Cc: paul.burton@mips.com Cc: linux-kernel@vger.kernel.org commit ece276de2a1f90b6a7836d388c372b9025345469 Author: Jiaxun Yang Date: Mon Jan 13 18:16:11 2020 +0800 MIPS: Add MAC2008 Support MAC2008 means the processor implemented IEEE754 style Fused MADD instruction. It was introduced in Release3 but removed in Release5. The toolchain support of MAC2008 have never landed except for Loongson processors. This patch aimed to disabled the MAC2008 if it's optional. For MAC2008 only processors, we corrected math-emu behavior to align with actual hardware behavior. Signed-off-by: Jiaxun Yang [paulburton@kernel.org: Fixup MIPSr2-r5 check in cpu_set_fpu_2008.] Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: chenhc@lemote.com Cc: paul.burton@mips.com Cc: linux-kernel@vger.kernel.org commit 1250c1a568ca33e9c9b586b99a763277684c6899 Author: Alexandre Oliva Date: Tue Jan 21 09:30:45 2020 -0300 cpufreq: loongson2_cpufreq: adjust cpufreq uses of LOONGSON_CHIPCFG The post-fork cleanup of loongson2ef from loongson64 changed LOONGSON_CHIPCFG from a single-argument functional macro to a non-functional macro with an mmio address in loongson2ef, but loongson2_cpufreq still uses the notation of a functional macro call expecting it to be an lvalue. Fixed based on loongson_suspend_enter. Signed-off-by: Alexandre Oliva Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit c689b069916c69c0afd2f72a9bbcd910bba7e590 Merge: a04616a30a51 ee8642162a9e Author: Dave Airlie Date: Thu Jan 23 09:39:02 2020 +1000 Merge branch 'linux-5.6' of git://github.com/skeggsb/linux into drm-next Just a couple of fixes to GP10x ACR support after the work, and a (fairly severe if you're running piglit a lot) memory leak fix. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Fri Jan 17 11:46:24 2020 +0100 intel_idle: Clean up irtl_2_usec() Move the irtl_ns_units[] definition into irtl_2_usec() which is the only user of it, use div_u64() for the division in there (as the divisor is small enough) and use the NSEC_PER_USEC symbol for the divisor. Also convert the irtl_2_usec() comment to a proper kerneldo one. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit 1aefbd7aeb7695c1a9e6ece9a1612ee88e1ea3f8 Author: Rafael J. Wysocki Date: Fri Jan 10 11:52:32 2020 +0100 intel_idle: Move 3 functions closer to their callers Move intel_idle_verify_cstate(), auto_demotion_disable() and c1e_promotion_disable() closer to their callers. While at it, annotate intel_idle_verify_cstate() with __init, as it is only used during the initialization of the driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit 095928ae484b9f765fb4967c6cf76a2f86fc9787 Author: Rafael J. Wysocki Date: Fri Jan 10 11:51:22 2020 +0100 intel_idle: Annotate initialization code and data structures Annotate the functions that are only used at the initialization time with __init and the data structures used by them with __initdata or __initconst. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit 0755a9bd9963ec3d611129cf2cdbb3e041ccbd6a Author: Rafael J. Wysocki Date: Fri Jan 10 11:49:58 2020 +0100 intel_idle: Move and clean up intel_idle_cpuidle_devices_uninit() Move intel_idle_cpuidle_devices_uninit() closer to its caller, intel_idle_init(), add the __init modifier to its header, drop a redundant local variable from it and fix up its kerneldoc comment. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit 3d3a1ae9b4bedc3e8c88ff4baeb0a195cb447fa1 Author: Rafael J. Wysocki Date: Fri Jan 10 11:48:25 2020 +0100 intel_idle: Rearrange intel_idle_cpuidle_driver_init() Notice that intel_idle_state_table_update() only needs to be called if icpu is not NULL, so fold it into intel_idle_init_cstates_icpu(), and pass a pointer to the driver object to intel_idle_cpuidle_driver_init() as an argument instead of referencing it locally in there. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit 533da74a8c8d75af7958f4aa1abc944f061d1d85 Author: Rafael J. Wysocki Date: Fri Jan 10 11:45:49 2020 +0100 intel_idle: Clean up NULL pointer check in intel_idle_init() Instead of comparing intel_idle_cpuidle_devices with NULL apply the "!" (not) operator to it when checking it against NULL. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit a6c86e336282c67a0b04f64b3b5574794249e3e1 Author: Rafael J. Wysocki Date: Fri Jan 10 11:44:58 2020 +0100 intel_idle: Fold intel_idle_probe() into intel_idle_init() There is no particular reason why intel_idle_probe() needs to be a separate function and folding it into intel_idle_init() causes the code to be somewhat easier to follow, so do just that. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit cbd2c4c25d7e0ba7afe42f2397865b164d1109eb Author: Rafael J. Wysocki Date: Fri Jan 10 11:43:23 2020 +0100 intel_idle: Eliminate __setup_broadcast_timer() The __setup_broadcast_timer() static function is only called in one place and "true" is passed to it as the argument in there, so effectively it is a wrapper arround tick_broadcast_enable(). To simplify the code, call tick_broadcast_enable() directly instead of __setup_broadcast_timer() and drop the latter. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit e6cf623ba3f83118b0f75be2cc1675931e21c887 Merge: cefb9409ff99 a32991822163 Author: Rafael J. Wysocki Date: Thu Jan 23 00:35:50 2020 +0100 Merge branch 'intel_idle+acpi' Merge changes updating the ACPI processor driver in order to export acpi_processor_evaluate_cst() to the code outside of it and adding ACPI support to the intel_idle driver based on that. * intel_idle+acpi: Documentation: admin-guide: PM: Add intel_idle document intel_idle: Use ACPI _CST on server systems intel_idle: Add module parameter to prevent ACPI _CST from being used intel_idle: Allow ACPI _CST to be used for selected known processors cpuidle: Allow idle states to be disabled by default intel_idle: Use ACPI _CST for processor models without C-state tables intel_idle: Refactor intel_idle_cpuidle_driver_init() ACPI: processor: Export acpi_processor_evaluate_cst() ACPI: processor: Make ACPI_PROCESSOR_CSTATE depend on ACPI_PROCESSOR ACPI: processor: Clean up acpi_processor_evaluate_cst() ACPI: processor: Introduce acpi_processor_evaluate_cst() ACPI: processor: Export function to claim _CST control commit a04616a30a515e6659c198b82d2925e4aabd3a99 Merge: 61ff410faefc c0bf499f6f84 Author: Dave Airlie Date: Thu Jan 23 09:32:54 2020 +1000 Merge tag 'exynos-drm-next-for-v5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next Change Exynos DRM specific callback function names - it changes enable and disable callback functions names of struct exynos_drm_crtc_ops to atomic_enable and atomic_disable for consistency. Modify "EXYNOS" prefix to "Exynos" - "Exynos" name is a regular trademarked name promoted by its manufacturer, Samsung Electronics Co., Ltd.. This patch corrects the name. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/1579567970-4467-1-git-send-email-inki.dae@samsung.com commit cefb9409ff995fcc98ce44a07b549ba1b827c31b Author: Benjamin Gaignard Date: Tue Jan 21 09:27:58 2020 +0100 cpuidle: fix cpuidle_find_deepest_state() kerneldoc warnings Fix cpuidle_find_deepest_state() kernel documentation to avoid warnings when compiling with W=1. Signed-off-by: Benjamin Gaignard Acked-by: Randy Dunlap Signed-off-by: Rafael J. Wysocki commit a09da3fbc17f36feac00fea37a225596ae302360 Author: Benjamin Gaignard Date: Mon Jan 20 14:33:59 2020 +0100 cpuidle: sysfs: fix warnings when compiling with W=1 Fix kernel documentation comments to remove warnings when compiling with W=1. Signed-off-by: Benjamin Gaignard Signed-off-by: Rafael J. Wysocki commit 32014c86d4e1639b430d1f833f0848b99638ca39 Author: Benjamin Gaignard Date: Mon Jan 20 14:24:08 2020 +0100 cpuidle: coupled: fix warnings when compiling with W=1 Fix warnings that show up when compiling with W=1 Signed-off-by: Benjamin Gaignard Signed-off-by: Rafael J. Wysocki commit 786c87cd312ad2ec774bc4606834b06844dada6c Author: yu kuai Date: Mon Jan 20 09:23:31 2020 +0800 PNP: isapnp: remove defined but not used function 'isapnp_checksum' Fix gcc '-Wunused-function' warnning: drivers/pnp/isapnp/core.c:752:29: warning: 'isapnp_checksum' defined but not used [-Wunused-function] 752 | static unsigned char __init isapnp_checksum(unsigned char *data) Commit 04c589f35bc5 ("PNP: isapnp: remove set but not used variable 'checksum'") removes the last caller of the function. It is never used and so can be removed. Fixes: 04c589f35bc5 ("PNP: isapnp: remove set but not used variable 'checksum'") Signed-off-by: yu kuai Signed-off-by: Rafael J. Wysocki commit 61ff410faefc97866ba0fd86113d072b1e2acc9d Merge: d7ca2d19c751 b20414252068 Author: Dave Airlie Date: Mon Jan 20 14:16:32 2020 +1000 Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next vmwgfx updates + new logging uapi https://patchwork.freedesktop.org/patch/349809/ is appropriate userpsace patch. Signed-off-by: Dave Airlie From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m=20=28VMware=29?= Link: https://patchwork.freedesktop.org/patch/msgid/20200116092934.5276-1-thomas_os@shipmail.org commit ee8642162a9edd40daafd3fb894e3fd3f909e361 Author: Chen Zhou Date: Thu Jan 16 20:50:10 2020 +0800 drm/nouveau: fix build error without CONFIG_IOMMU_API If CONFIG_IOMMU_API is n, build fails: vers/gpu/drm/nouveau/nvkm/subdev/ltc/gp10b.c:37:9: error: implicit declaration of function dev_iommu_fwspec_get; did you mean iommu_fwspec_free? [-Werror=implicit-function-declaration] spec = dev_iommu_fwspec_get(device->dev); ^~~~~~~~~~~~~~~~~~~~ iommu_fwspec_free drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gp10b.c:37:7: warning: assignment makes pointer from integer without a cast [-Wint-conversion] spec = dev_iommu_fwspec_get(device->dev); ^ drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gp10b.c:39:17: error: struct iommu_fwspec has no member named ids u32 sid = spec->ids[0] & 0xffff; Seletc IOMMU_API under config DRM_NOUVEAU to fix this. Reported-by: Hulk Robot Signed-off-by: Chen Zhou Signed-off-by: Ben Skeggs commit 67d52f0f1379e93d1052c459b5e56ad50e98e74d Author: YueHaibing Date: Fri Jan 17 10:01:02 2020 +0800 drm/nouveau/kms/nv04: remove set but not used variable 'width' drivers/gpu/drm/nouveau/dispnv04/arb.c: In function nv04_calc_arb: drivers/gpu/drm/nouveau/dispnv04/arb.c:56:21: warning: variable width set but not used [-Wunused-but-set-variable] 'width' is never used, so remove it. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Ben Skeggs commit 39496368ba96b40b1dca07315418e473998eef15 Author: YueHaibing Date: Fri Jan 17 11:36:42 2020 +0800 drm/nouveau/kms/nv50: remove set but not unused variable 'nv_connector' drivers/gpu/drm/nouveau/dispnv50/disp.c: In function nv50_pior_enable: drivers/gpu/drm/nouveau/dispnv50/disp.c:1672:28: warning: variable nv_connector set but not used [-Wunused-but-set-variable] commit ac2d9275f371 ("drm/nouveau/kms/nv50-: Store the bpc we're using in nv50_head_atom") left behind this. Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Lyude Paul Signed-off-by: Ben Skeggs commit 35e4909b6a2b4005ced3c4238da60d926b78fdea Author: Ben Skeggs Date: Thu Jan 23 08:23:06 2020 +1000 drm/nouveau/mmu: fix comptag memory leak Signed-off-by: Ben Skeggs commit 90e2e96ea37745ae18a1ff7b322e3321731828e4 Author: Thierry Reding Date: Wed Jan 15 15:07:56 2020 +0100 drm/nouveau/gr/gp10b: Use gp100_grctx and gp100_gr_zbc gp10b doesn't have all the registers that gp102_gr_zbc wants to access, which causes IBUS MMIO faults to occur. Avoid this by using the gp100 variants of grctx and gr_zbc. Signed-off-by: Thierry Reding Signed-off-by: Ben Skeggs commit 89b34254bb61d0ad5c701413572cf3d993c9bff8 Author: Thierry Reding Date: Wed Jan 15 15:06:13 2020 +0100 drm/nouveau/pmu/gm20b,gp10b: Fix Falcon bootstrapping The low-level Falcon bootstrapping callbacks are expected to return 0 on success or a negative error code on failure. However, the implementation on Tegra returns the ID or mask of the Falcons that were bootstrapped on success, thus breaking the calling code, which treats this as failure. Fix this by making sure we only return 0 or a negative error code, just like the code for discrete GPUs does. Fixes: 86ce2a71539c ("drm/nouveau/flcn/cmdq: move command generation to subdevs") Signed-off-by: Thierry Reding Signed-off-by: Ben Skeggs commit edc440e3d27fb31e6f9663cf413fad97d714c060 Author: Daniel Rosenberg Date: Mon Jan 20 14:32:01 2020 -0800 fscrypt: improve format of no-key names When an encrypted directory is listed without the key, the filesystem must show "no-key names" that uniquely identify directory entries, are at most 255 (NAME_MAX) bytes long, and don't contain '/' or '\0'. Currently, for short names the no-key name is the base64 encoding of the ciphertext filename, while for long names it's the base64 encoding of the ciphertext filename's dirhash and second-to-last 16-byte block. This format has the following problems: - Since it doesn't always include the dirhash, it's incompatible with directories that will use a secret-keyed dirhash over the plaintext filenames. In this case, the dirhash won't be computable from the ciphertext name without the key, so it instead must be retrieved from the directory entry and always included in the no-key name. Casefolded encrypted directories will use this type of dirhash. - It's ambiguous: it's possible to craft two filenames that map to the same no-key name, since the method used to abbreviate long filenames doesn't use a proper cryptographic hash function. Solve both these problems by switching to a new no-key name format that is the base64 encoding of a variable-length structure that contains the dirhash, up to 149 bytes of the ciphertext filename, and (if any bytes remain) the SHA-256 of the remaining bytes of the ciphertext filename. This ensures that each no-key name contains everything needed to find the directory entry again, contains only legal characters, doesn't exceed NAME_MAX, is unambiguous unless there's a SHA-256 collision, and that we only take the performance hit of SHA-256 on very long filenames. Note: this change does *not* address the existing issue where users can modify the 'dirhash' part of a no-key name and the filesystem may still accept the name. Signed-off-by: Daniel Rosenberg [EB: improved comments and commit message, fixed checking return value of base64_decode(), check for SHA-256 error, continue to set disk_name for short names to keep matching simpler, and many other cleanups] Link: https://lore.kernel.org/r/20200120223201.241390-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit aec992aab890b2dece2c5c95dbd6953aeecd45cb Author: Eric Biggers Date: Mon Jan 20 14:32:00 2020 -0800 ubifs: allow both hash and disk name to be provided in no-key names In order to support a new dirhash method that is a secret-keyed hash over the plaintext filenames (which will be used by encrypted+casefolded directories on ext4 and f2fs), fscrypt will be switching to a new no-key name format that always encodes the dirhash in the name. UBIFS isn't happy with this because it has assertions that verify that either the hash or the disk name is provided, not both. Change it to use the disk name if one is provided, even if a hash is available too; else use the hash. Link: https://lore.kernel.org/r/20200120223201.241390-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f0d07a98a070bb5e443df19c3aa55693cbca9341 Author: Eric Biggers Date: Mon Jan 20 14:31:59 2020 -0800 ubifs: don't trigger assertion on invalid no-key filename If userspace provides an invalid fscrypt no-key filename which encodes a hash value with any of the UBIFS node type bits set (i.e. the high 3 bits), gracefully report ENOENT rather than triggering ubifs_assert(). Test case with kvm-xfstests shell: . fs/ubifs/config . ~/xfstests/common/encrypt dev=$(__blkdev_to_ubi_volume /dev/vdc) ubiupdatevol $dev -t mount $dev /mnt -t ubifs mkdir /mnt/edir xfs_io -c set_encpolicy /mnt/edir rm /mnt/edir/_,,,,,DAAAAAAAAAAAAAAAAAAAAAAAAAA With the bug, the following assertion fails on the 'rm' command: [ 19.066048] UBIFS error (ubi0:0 pid 379): ubifs_assert_failed: UBIFS assert failed: !(hash & ~UBIFS_S_KEY_HASH_MASK), in fs/ubifs/key.h:170 Fixes: f4f61d2cc6d8 ("ubifs: Implement encrypted filenames") Cc: # v4.10+ Link: https://lore.kernel.org/r/20200120223201.241390-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f592efe735a29c764e0d473307dab0f59665f02b Author: Eric Biggers Date: Mon Jan 20 14:31:58 2020 -0800 fscrypt: clarify what is meant by a per-file key Now that there's sometimes a second type of per-file key (the dirhash key), clarify some function names, macros, and documentation that specifically deal with per-file *encryption* keys. Link: https://lore.kernel.org/r/20200120223201.241390-4-ebiggers@kernel.org Reviewed-by: Daniel Rosenberg Signed-off-by: Eric Biggers commit aa408f835d025a839033988d3f5a2866314414ef Author: Daniel Rosenberg Date: Mon Jan 20 14:31:57 2020 -0800 fscrypt: derive dirhash key for casefolded directories When we allow indexed directories to use both encryption and casefolding, for the dirhash we can't just hash the ciphertext filenames that are stored on-disk (as is done currently) because the dirhash must be case insensitive, but the stored names are case-preserving. Nor can we hash the plaintext names with an unkeyed hash (or a hash keyed with a value stored on-disk like ext4's s_hash_seed), since that would leak information about the names that encryption is meant to protect. Instead, if we can accept a dirhash that's only computable when the fscrypt key is available, we can hash the plaintext names with a keyed hash using a secret key derived from the directory's fscrypt master key. We'll use SipHash-2-4 for this purpose. Prepare for this by deriving a SipHash key for each casefolded encrypted directory. Make sure to handle deriving the key not only when setting up the directory's fscrypt_info, but also in the case where the casefold flag is enabled after the fscrypt_info was already set up. (We could just always derive the key regardless of casefolding, but that would introduce unnecessary overhead for people not using casefolding.) Signed-off-by: Daniel Rosenberg [EB: improved commit message, updated fscrypt.rst, squashed with change that avoids unnecessarily deriving the key, and many other cleanups] Link: https://lore.kernel.org/r/20200120223201.241390-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6e1918cfb263acacd3fc9239127732b69de64695 Author: Daniel Rosenberg Date: Mon Jan 20 14:31:56 2020 -0800 fscrypt: don't allow v1 policies with casefolding Casefolded encrypted directories will use a new dirhash method that requires a secret key. If the directory uses a v2 encryption policy, it's easy to derive this key from the master key using HKDF. However, v1 encryption policies don't provide a way to derive additional keys. Therefore, don't allow casefolding on directories that use a v1 policy. Specifically, make it so that trying to enable casefolding on a directory that has a v1 policy fails, trying to set a v1 policy on a casefolded directory fails, and trying to open a casefolded directory that has a v1 policy (if one somehow exists on-disk) fails. Signed-off-by: Daniel Rosenberg [EB: improved commit message, updated fscrypt.rst, and other cleanups] Link: https://lore.kernel.org/r/20200120223201.241390-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1b3b827ee5230a73c8ed1b2cd8d53b4bd001268b Author: Eric Biggers Date: Sun Jan 19 23:17:36 2020 -0800 fscrypt: add "fscrypt_" prefix to fname_encrypt() fname_encrypt() is a global function, due to being used in both fname.c and hooks.c. So it should be prefixed with "fscrypt_", like all the other global functions in fs/crypto/. Link: https://lore.kernel.org/r/20200120071736.45915-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 13a10da94615d81087e718517794f2868a8b3fab Author: Eric Biggers Date: Sun Jan 19 22:07:32 2020 -0800 fscrypt: don't print name of busy file when removing key When an encryption key can't be fully removed due to file(s) protected by it still being in-use, we shouldn't really print the path to one of these files to the kernel log, since parts of this path are likely to be encrypted on-disk, and (depending on how the system is set up) the confidentiality of this path might be lost by printing it to the log. This is a trade-off: a single file path often doesn't matter at all, especially if it's a directory; the kernel log might still be protected in some way; and I had originally hoped that any "inode(s) still busy" bugs (which are security weaknesses in their own right) would be quickly fixed and that to do so it would be super helpful to always know the file path and not have to run 'find dir -inum $inum' after the fact. But in practice, these bugs can be hard to fix (e.g. due to asynchronous process killing that is difficult to eliminate, for performance reasons), and also not tied to specific files, so knowing a file path doesn't necessarily help. So to be safe, for now let's just show the inode number, not the path. If someone really wants to know a path they can use 'find -inum'. Fixes: b1c0ec3599f4 ("fscrypt: add FS_IOC_REMOVE_ENCRYPTION_KEY ioctl") Cc: # v5.4+ Link: https://lore.kernel.org/r/20200120060732.390362-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1b2fd38de9fcc73d6994f8f6c7c23ee3435b6a12 Merge: 2a67a6ccb01f 7805fe843964 Author: Daniel Borkmann Date: Wed Jan 22 23:04:53 2020 +0100 Merge branch 'bpf-dynamic-relinking' Alexei Starovoitov says: ==================== The last few month BPF community has been discussing an approach to call chaining, since exiting bpt_tail_call() mechanism used in production XDP programs has plenty of downsides. The outcome of these discussion was a conclusion to implement dynamic re-linking of BPF programs. Where rootlet XDP program attached to a netdevice can programmatically define a policy of execution of other XDP programs. Such rootlet would be compiled as normal XDP program and provide a number of placeholder global functions which later can be replaced with future XDP programs. BPF trampoline, function by function verification were building blocks towards that goal. The patch 1 is a final building block. It introduces dynamic program extensions. A number of improvements like more flexible function by function verification and better libbpf api will be implemented in future patches. v1->v2: - addressed Andrii's comments - rebase ==================== Signed-off-by: Daniel Borkmann commit 7805fe843964f81f98592bf580b9cd736ac4ad4c Author: Alexei Starovoitov Date: Mon Jan 20 16:53:48 2020 -0800 selftests/bpf: Add tests for program extensions Add program extension tests that build on top of fexit_bpf2bpf tests. Replace three global functions in previously loaded test_pkt_access.c program with three new implementations: int get_skb_len(struct __sk_buff *skb); int get_constant(long val); int get_skb_ifindex(int val, struct __sk_buff *skb, int var); New function return the same results as original only if arguments match. new_get_skb_ifindex() demonstrates that 'skb' argument doesn't have to be first and only argument of BPF program. All normal skb based accesses are available. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Andrii Nakryiko Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20200121005348.2769920-4-ast@kernel.org commit 2db6eab18b9778d55f48c804f8efebd7097e7958 Author: Alexei Starovoitov Date: Mon Jan 20 16:53:47 2020 -0800 libbpf: Add support for program extensions Add minimal support for program extensions. bpf_object_open_opts() needs to be called with attach_prog_fd = target_prog_fd and BPF program extension needs to have in .c file section definition like SEC("freplace/func_to_be_replaced"). libbpf will search for "func_to_be_replaced" in the target_prog_fd's BTF and will pass it in attach_btf_id to the kernel. This approach works for tests, but more compex use case may need to request function name (and attach_btf_id that kernel sees) to be more dynamic. Such API will be added in future patches. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Andrii Nakryiko Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20200121005348.2769920-3-ast@kernel.org commit be8704ff07d2374bcc5c675526f95e70c6459683 Author: Alexei Starovoitov Date: Mon Jan 20 16:53:46 2020 -0800 bpf: Introduce dynamic program extensions Introduce dynamic program extensions. The users can load additional BPF functions and replace global functions in previously loaded BPF programs while these programs are executing. Global functions are verified individually by the verifier based on their types only. Hence the global function in the new program which types match older function can safely replace that corresponding function. This new function/program is called 'an extension' of old program. At load time the verifier uses (attach_prog_fd, attach_btf_id) pair to identify the function to be replaced. The BPF program type is derived from the target program into extension program. Technically bpf_verifier_ops is copied from target program. The BPF_PROG_TYPE_EXT program type is a placeholder. It has empty verifier_ops. The extension program can call the same bpf helper functions as target program. Single BPF_PROG_TYPE_EXT type is used to extend XDP, SKB and all other program types. The verifier allows only one level of replacement. Meaning that the extension program cannot recursively extend an extension. That also means that the maximum stack size is increasing from 512 to 1024 bytes and maximum function nesting level from 8 to 16. The programs don't always consume that much. The stack usage is determined by the number of on-stack variables used by the program. The verifier could have enforced 512 limit for combined original plus extension program, but it makes for difficult user experience. The main use case for extensions is to provide generic mechanism to plug external programs into policy program or function call chaining. BPF trampoline is used to track both fentry/fexit and program extensions because both are using the same nop slot at the beginning of every BPF function. Attaching fentry/fexit to a function that was replaced is not allowed. The opposite is true as well. Replacing a function that currently being analyzed with fentry/fexit is not allowed. The executable page allocated by BPF trampoline is not used by program extensions. This inefficiency will be optimized in future patches. Function by function verification of global function supports scalars and pointer to context only. Hence program extensions are supported for such class of global functions only. In the future the verifier will be extended with support to pointers to structures, arrays with sizes, etc. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Andrii Nakryiko Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20200121005348.2769920-2-ast@kernel.org commit d478667253f988dbd6215734a11e35f6953b540d Author: Wenjing Liu Date: Mon Jan 13 17:05:42 2020 -0500 drm/amd/display: use odm combine for YCbCr420 timing with h_active greater than 4096 [why] FMT has limitation to support YCbCr420 with h_active greater than 4096. [how] Use odm combine to overcome the limitation. Signed-off-by: Wenjing Liu Reviewed-by: Dmytro Laktyushkin Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 09f6dd6e6d4305cf199443bb7d099f4f64dc374b Author: Lewis Huang Date: Tue Jan 14 11:08:34 2020 +0800 drm/amd/display: init hw i2c speed [Why] Driver didn't init hw i2c speed cause hdcp hw cannot send command, because the default value of speed register is 0x2. [How] Restore the default speed when release i2c engine Signed-off-by: Lewis Huang Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 947daab2a2d1813a8d973c59551545e44bdf1549 Author: Isabel Zhang Date: Thu Jan 9 12:05:21 2020 -0500 drm/amd/display: changed max_downscale_src_width to 4096. [Why] MPO isn't enabled on some 4k videos due to video source width is 4096 and the current limit is 3840. [How] Changed the limit to 4096. Signed-off-by: Isabel Zhang Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 23bc5f3404de2e8b3adaedf33507409fda6f5528 Author: Wenjing Liu Date: Wed Jan 8 16:59:23 2020 -0500 drm/amd/display: support VSC SDP update on video test pattern request [why] MSA will be deprecated in the future. Need to support VSC during DP test automation. [how] Do not disable VSC during DP test automation. TODO - need to add VSC update on DM side on test request. Signed-off-by: Wenjing Liu Reviewed-by: Nikola Cornij Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit e5f0b5214beea71bd25584da451897300742795e Author: Nicholas Kazlauskas Date: Mon Jan 13 09:00:46 2020 -0500 drm/amd/display: Check hw_init state when determining if DMCUB is initialized [Why] CW2 may already be programmed when coming back from S4. In this case we want to unconditionally replace whatever DMCUB version is currently enabled with the latest. [How] Check the hw_init flag to know whether or not we've previously executed the initliazed routine. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit a7da96fbccc682a67bcc15f3461cdd60a622ffaf Author: Nicholas Kazlauskas Date: Mon Jan 13 08:58:00 2020 -0500 drm/amd/display: Reset inbox rptr/wptr when resetting DMCUB [Why] These logically make sense more to be set after the DMCUB has been reset rather than when we setup the inbox. [How] Move them into the reset callback. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit cc934031dc2a0be9535477dbef4b0e94c9f06ecd Author: Nicholas Kazlauskas Date: Sat Jan 11 13:43:39 2020 -0500 drm/amd/display: Call ATOM_INIT instead of ATOM_ENABLE for DMCUB [Why] DMCUB command table doesn't support ATOM_ENABLE/ATOM_DISABLE anymore so we never end up calling the DCN init path in DMCUB. [How] Map ATOM_ENABLE to ATOM_INIT only for DMCUB command table offloading. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 0167da498d57dddf31eb30516d1fae0f31ddecb6 Author: Nicholas Kazlauskas Date: Thu Jan 9 14:41:22 2020 -0500 drm/amd/display: Add hardware reset interface for DMUB service [Why] We'll need this to perform a clean shutdown before unloading the driver. [How] It will call reset internally and set hw_init to false. It won't do anything if the hardware isn't initialized. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 7527791e1fbd595a294cf6e6f41999d8acf6c43f Author: Roman Li Date: Mon Jan 13 10:26:19 2020 -0500 drm/amd/display: Fix update type for multiple planes [Why] determine_update_type_for_commit() uses pointers to single instance of local variable to fill scaling/color info for all planes updates. This is a bug, that leads to incorrect update type for commit in case of multiple planes per crtc. Each plane should refer to separate scaling/color data. [How] Use arrays for plane properties. Bundle all properties into a single structure to simplify memory allocation. Signed-off-by: Roman Li Reviewed-by: Nicholas Kazlauskas Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 022205ffbb8fc48bb12c7941f07c6e19bdf11155 Author: Brandon Syu Date: Thu Jan 9 14:19:20 2020 +0800 drm/amd/display: fix rotation_angle to use enum values [Why] Hardcoded fixed values are not proper. [How] Use enum values instead of fixed numbers. Signed-off-by: Brandon Syu Reviewed-by: Eric Yang Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 2c61704bcaeed3b51dd48f97003533f40dbf3050 Author: Aric Cyr Date: Mon Jan 13 08:40:00 2020 -0500 drm/amd/display: 3.2.69 Signed-off-by: Aric Cyr Reviewed-by: Aric Cyr Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 9eeec26a13392d6efb5215c26b5e9965ef7ac2af Author: Lewis Huang Date: Sat Jan 11 00:51:15 2020 +0800 drm/amd/display: Refine i2c frequency calculating sequence [Why] In HG mode, vbios didn't call DispController_Init to program NV1x XTAL_REF_DIV value when ASIC_INIT, but driver read XTAL_REF_DIV to calculate i2c reference frequency. it cause i2c frequency change from 100kHz to 200kHz. [How] remove get_speed function and calculate reference frequency at set_speed functiton. Signed-off-by: Lewis Huang Reviewed-by: Jun Lei Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 887ff121987d1bf56ce7c126731a396d4e29a53c Author: Anthony Koo Date: Fri Jan 10 14:44:28 2020 -0500 drm/amd/display: Refactor to remove diags specific rgam func [Why] It has duplicate code for building regamma curve [How] Remove the duplicate code and use the same function for building regamma Signed-off-by: Anthony Koo Reviewed-by: Aric Cyr Reviewed-by: Krunoslav Kovac Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 819d4b3fbfaf40b4537e80b01aef612e4140a91b Author: Jerry (Fangzhi) Zuo Date: Thu Dec 12 10:37:35 2019 -0500 drm/amd/display: Fix DML dummyinteger types mismatch [Why] The types for dummyinteger1 and dummyinteger2 are unsigned as part of the DML spec. They should not be long. [How] Make them unsigned int instead of long. Signed-off-by: Jerry (Fangzhi) Zuo Reviewed-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit bb6785c1212988c76c21cd1d4647c31545231e8b Author: Nicholas Kazlauskas Date: Fri Jan 10 09:17:58 2020 -0500 drm/amd/display: Do DMCUB hw_init before DC [Why] For DMCUB enabled hardware DC has a dependency on DMCUB already being running. Command table offloading will fail on first modeset if DMCUB isn't initialized first. [How] Perform DMCUB hardware initialization before DC. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Hersen Wu Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 5ea3985098048ba6850547c816208e5c2a40bef4 Author: Haiyi Zhou Date: Thu Jan 9 11:08:33 2020 -0500 drm/amd/display: Fixed comment styling Switched to C-style comments for consistency Signed-off-by: Haiyi Zhou Reviewed-by: Reza Amini Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 14ae7665e70a982b3653f2aa024251d69d89f81c Author: Paul Hsieh Date: Thu Jan 9 15:11:06 2020 +0800 drm/amd/display: check pipe_ctx is split pipe or not [Why] Driver use pipe_ctx to reallocate payload may cause allocate payload twice on same sink with split pipe. [How] Drvier must to check pipe_ctx is split pipe or not to avoid reallocate payload twice on same sink. Signed-off-by: Paul Hsieh Reviewed-by: Tony Cheng Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 830821a64db63026a8b7414b2b539f262821ad23 Author: Nicholas Kazlauskas Date: Mon Jan 6 13:21:48 2020 -0500 drm/amd/display: Fallback to DMCUB when command table is missing [Why] If the command table isn't available then we can fallback to DMCUB offloading if it's enabled and available. [How] Instead of assigning NULL for supported command table functions we can fallback to the DMCUB when it's available. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Wesley Chalmers Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 153ca760219277997e2c3146ae9a15c979c50520 Author: Nicholas Kazlauskas Date: Mon Jan 6 10:29:13 2020 -0500 drm/amd/display: Get fb base and fb offset for DMUB from registers [Why] Under some hardware initialization sequences the fb base/fb offset provided can be zero or hardwareinit can happen too late. We want to ensure that we always have the correct fb_base/fb_offset when performing DMCUB hardware initialization so we can do DMCUB command table offloading during first dc hardware init. [How] Read from the DCN registers. VBIOS already filled these in for us. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Wesley Chalmers Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 07d4f905329438b8e4daf7f58f5afea7d781a9b2 Author: Wenjing Liu Date: Tue Jan 7 16:33:32 2020 -0500 drm/amd/display: Add debug option to disable DSC support [how] Empty dsc enc caps when debug option is set to disable DSC. Signed-off-by: Wenjing Liu Reviewed-by: Nikola Cornij Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 50d2c6027ef4d09d7c2a9d12b2a7957576c0fa3c Author: Sung Lee Date: Fri Jan 3 14:03:52 2020 -0500 drm/amd/display: Do not send training pattern if VS Different [Why] The DP 1.4a Spec requires that training pattern only under certain specific conditions. Currently driver will re-send training pattern every time voltage swing value changes, but that should not be the case. [How] Do not re-send training pattern every time VS values are different. Only send it on the first iteration. Signed-off-by: Sung Lee Reviewed-by: Tony Cheng Acked-by: Abdoulaye Berthe Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 43563bc2e6a769502d23f4ec9cd590e4636cf0ea Author: Wenjing Liu Date: Mon Dec 23 16:02:13 2019 -0500 drm/amd/display: update MSA and VSC SDP on video test pattern request [why] On video test pattern request we need to update MSA and VSC so it will match the requested test pattern dynamic range field. [how] Update dynamic range field in MSA and disable VSC as updating VSC info packet is complicated and not required for test pattern purpose. Signed-off-by: Wenjing Liu Reviewed-by: Nikola Cornij Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 63e3ab9a8226c0271e823f32fc1c3de67d142c78 Author: Nirmoy Das Date: Tue Jan 21 13:29:20 2020 +0100 drm/amdgpu: individualize fence allocation per entity Allocate fences for each entity and remove ctx->fences reference as fences should be bound to amdgpu_ctx_entity instead amdgpu_ctx. Signed-off-by: Nirmoy Das Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 7db1d560a4fab1e4668b1964e77f52cefce9e9c7 Author: Tianci.Yin Date: Mon Jan 20 17:20:10 2020 +0800 Revert "drm/amdgpu: fix modprobe failure of the secondary GPU when GDDR6 training enabled(V5)" This reverts commit 9e441478623fd913d4340654682b19f0c24e629d. The patch will be replaced with a better solution, revert it. Reviewed-by: Christian König Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher commit 240c811ccde49ad336b23c582018c6001690f19d Author: Tianci.Yin Date: Mon Jan 20 15:08:35 2020 +0800 drm/amdgpu: fix VRAM partially encroached issue in GDDR6 memory training(V2) [why] In GDDR6 BIST training, a certain mount of bottom VRAM will be encroached by UMC, that causes problems(like GTT corrupted and page fault observed). [how] Saving the content of this bottom VRAM to system memory before training, and restoring it after training to avoid VRAM corruption. Acked-by: Christian König Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher commit a9d4fe2fd6529c3129ec6883b8649ea5c7eee4d3 Author: Nirmoy Das Date: Mon Jan 20 13:54:30 2020 +0100 drm/amdgpu: remove unnecessary conversion to bool Better clean that up before some automation starts to complain about it Signed-off-by: Nirmoy Das Acked-by: Christian König Signed-off-by: Alex Deucher commit 4c461d89db4f8f40509b044b0daf3ac6edf4fbd7 Author: Dennis Li Date: Thu Jan 16 13:40:52 2020 +0800 drm/amdgpu: add RAS support for the gfx block of Arcturus Implement functions to do the RAS error injection and query EDC counter. Signed-off-by: Dennis Li Reviewed-by: Guchun Chen Reviewed-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 19cf0dd4b9d2771015fc9d74ec1b0b9203cf8c5a Author: Dennis Li Date: Thu Jan 16 12:30:33 2020 +0800 drm/amdgpu: add EDC counter registers of gc for Arcturus add reg headers to gc includes v2: remove unused registers and fields in this patch set Signed-off-by: Dennis Li Reviewed-by: Guchun Chen Reviewed-by: Tao Zhou Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 504c5e72d781e48946c32bf427c665ed15d532d0 Author: Dennis Li Date: Thu Jan 16 11:25:08 2020 +0800 drm/amdgpu: abstract EDC counter clear to a separated function 1. Add IP prefix for the IP related codes. 2. Refactor the code to clear EDC counter. Signed-off-by: Dennis Li Reviewed-by: Guchun Chen Reviewed-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5e66403e4d709decacf2b53e55deb55d8f6e6982 Author: Dennis Li Date: Thu Jan 16 11:07:55 2020 +0800 drm/amdgpu: refine the security check for RAS functions To avoid calling RAS related functions when RAS feature isn't supported in hardware. Change to check supported features, instead of checking asic type. v2: reuse amdgpu_ras_is_supported function, instead of introducing a new flag for hardware ras feature. Signed-off-by: Dennis Li Reviewed-by: Guchun Chen Reviewed-by: Hawking Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 39aa0ef1638ad7722e8182331c61deae8da97105 Author: Dennis Li Date: Mon Jan 13 17:03:53 2020 +0800 drm/amdgpu: enable RAS feature for more mmhub sub-blocks of Acrturus Compared with Vg20, the size of mmhub range is changed from 2 to 8. Signed-off-by: Dennis Li Reviewed-by: Guchun Chen Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit f519cd13c23e8c884011295b205c1463babbf416 Author: Dennis Li Date: Mon Jan 13 16:15:38 2020 +0800 drm/amdgpu: update mmhub 9.4.1 header files for Acrturus Add mask & shift definition of MAM_D(0~3)MEM for all mmhub ranges. Signed-off-by: Dennis Li Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e3cd03603dbe0e972196f12db75b6917b4db049c Author: chen gong Date: Tue Jan 14 14:28:48 2020 +0800 drm/amdgpu: read gfx register using RREG32_KIQ macro Reading CP_MEM_SLP_CNTL register with RREG32_SOC15 macro will lead to hang when GPU is in "gfxoff" state. I do a uniform substitution here. Signed-off-by: chen gong Reviewed-by: Alex Deucher Acked-by: Christian König Signed-off-by: Alex Deucher commit c68dbcd8f9b0aa01e0459a5841716cb6a2f447b9 Author: chen gong Date: Wed Jan 15 14:44:43 2020 +0800 drm/amdgpu: add kiq version interface for RREG32/WREG32 Reading some registers by mmio will result in hang when GPU is in "gfxoff" state.This problem can be solved by GPU in "ring command packages" way. Signed-off-by: chen gong Reviewed-by: Alex Deucher Acked-by: Christian König Signed-off-by: Alex Deucher commit d33a99c4b63643d3d7a85d4dfb2ac5afb01eebca Author: chen gong Date: Wed Jan 15 14:32:00 2020 +0800 drm/amdgpu: provide a generic function interface for reading/writing register by KIQ Move amdgpu_virt_kiq_rreg/amdgpu_virt_kiq_wreg function to amdgpu_gfx.c, and rename them to amdgpu_kiq_rreg/amdgpu_kiq_wreg.Make it generic and flexible. Signed-off-by: chen gong Reviewed-by: Alex Deucher Reviewed-by: Huang Rui Acked-by: Christian König Signed-off-by: Alex Deucher commit a6c44d2538c469f412c3fded0de2290494d762d7 Author: John Clements Date: Fri Jan 17 12:18:00 2020 +0800 drm/amdgpu: added support to get mGPU DRAM base resolves issue with RAS error injection in mGPU configuration Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 36a1707afda9abc704543d6b419a998c64df41ca Author: Alex Sierra Date: Mon Jan 13 21:27:56 2020 -0600 drm/amdgpu: modify packet size for pm4 flush tlbs [Why] PM4 packet size for flush message was oversized. [How] Packet size adjusted to allocate flush + fence packets. Signed-off-by: Alex Sierra Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 19e0663ff9bce2efb87be8b30f9e46b7843600f3 Author: Trond Myklebust Date: Mon Jan 6 13:40:37 2020 -0500 nfsd: Ensure sampling of the write verifier is atomic with the write When doing an unstable write, we need to ensure that we sample the write verifier before releasing the lock, and allowing a commit to the same file to proceed. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 524ff1af226ce0f6348d48b413849b2bd16c5b60 Author: Trond Myklebust Date: Mon Jan 6 13:40:36 2020 -0500 nfsd: Ensure sampling of the commit verifier is atomic with the commit When we have a successful commit, ensure we sample the commit verifier before releasing the lock. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 809fe3c533789ebb51c1873b80c7dafbad9dbf19 Author: Trond Myklebust Date: Mon Jan 6 13:40:35 2020 -0500 sunrpc: clean up cache entry add/remove from hashtable Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 1d82163714c16ebe09c7a8c9cd3cef7abcc16208 Author: Trond Myklebust Date: Mon Jan 6 13:40:34 2020 -0500 sunrpc: Fix potential leaks in sunrpc_cache_unhash() When we unhash the cache entry, we need to handle any pending upcalls by calling cache_fresh_unlocked(). Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 1b28d756b2eaee03e838390465754e431389e483 Author: Trond Myklebust Date: Mon Jan 6 13:40:33 2020 -0500 nfsd: Ensure exclusion between CLONE and WRITE errors Ensure that we can distinguish between synchronous CLONE and WRITE errors, and that we can assign them correctly. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit b66ae6dd0c30c750cbc5c633dea08712203abc03 Author: Trond Myklebust Date: Mon Jan 6 13:40:32 2020 -0500 nfsd: Pass the nfsd_file as arguments to nfsd4_clone_file_range() Needed in order to fix exclusion w.r.t. writes. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 7bf94c6ba9fb291bd28fac3228553cb305bfc92a Author: Trond Myklebust Date: Mon Jan 6 13:40:31 2020 -0500 nfsd: Update the boot verifier on stable writes too. We don't know if the error returned by the fsync() call is exclusive to the data written by the stable write, so play it safe. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 5011af4c698a95b4dc4e374b1ce3acd122a9170f Author: Trond Myklebust Date: Mon Jan 6 13:40:30 2020 -0500 nfsd: Fix stable writes Strictly speaking, a stable write error needs to reflect the write + the commit of that write (and only that write). To ensure that we don't pick up the write errors from other writebacks, add a rw_semaphore to provide exclusion. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 16f8f894108270fd99667f06bae6ebcdd0f4e4bf Author: Trond Myklebust Date: Mon Jan 6 13:40:29 2020 -0500 nfsd: Allow nfsd_vfs_write() to take the nfsd_file as an argument Needed in order to fix stable writes. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 90d2f1da832fd23290ef0c0d964d97501e5e8553 Author: Trond Myklebust Date: Mon Jan 6 13:20:47 2020 -0500 nfsd: Fix a soft lockup race in nfsd_file_mark_find_or_create() If nfsd_file_mark_find_or_create() keeps winning the race for the nfsd_file_fsnotify_group->mark_mutex against nfsd_file_mark_put() then it can soft lock up, since fsnotify_add_inode_mark() ends up always finding an existing entry. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit b6669305d35a3459877afef6e9f68e81bef92972 Author: Trond Myklebust Date: Mon Jan 6 13:18:08 2020 -0500 nfsd: Reduce the number of calls to nfsd_file_gc() Don't call nfsd_file_gc() on every put of the reference in nfsd_file_put(). Instead, do it only when we're expecting the refcount to go to 1. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 55f84cc47f73bdc84ef73b702c23051b426505a4 Author: Trond Myklebust Date: Mon Jan 6 13:18:07 2020 -0500 nfsd: Schedule the laundrette regularly irrespective of file errors Emsure we schedule the laundrette even if the struct file is carrying file errors. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit bd6e1cece834f1b1322c85269b93379f8092077f Author: Trond Myklebust Date: Mon Jan 6 13:18:06 2020 -0500 nfsd: Remove unused constant NFSD_FILE_LRU_RESCAN Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 9542e6a643fc69d528dfb3303f145719c61d3050 Author: Trond Myklebust Date: Mon Jan 6 13:18:05 2020 -0500 nfsd: Containerise filecache laundrette Ensure that if the filecache laundrette gets stuck, it only affects the knfsd instances of one container. The notifier callbacks can be called from various contexts so avoid using synchonous filesystem operations that might deadlock. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 36ebbdb96b694dd9c6b25ad98f2bbd263d022b63 Author: Trond Myklebust Date: Mon Jan 6 13:18:04 2020 -0500 nfsd: cleanup nfsd_file_lru_dispose() Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 28c7d86bb6172ffbb1a1237c6388e77f9fe5f181 Author: Trond Myklebust Date: Mon Jan 6 13:18:03 2020 -0500 nfsd: fix filecache lookup If the lookup keeps finding a nfsd_file with an unhashed open file, then retry once only. Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org Fixes: 65294c1f2c5e "nfsd: add a new struct file caching facility to nfsd" Signed-off-by: J. Bruce Fields commit fc76324fa27fa4cab2cf115460d3a1d8e7e201ee Author: Olof Johansson Date: Mon Jan 6 15:20:24 2020 -0800 riscv: keep 32-bit kernel to 32-bit phys_addr_t While rv32 technically has 34-bit physical addresses, no current platforms use it and it's likely to shake out driver bugs. Let's keep 64-bit phys_addr_t off on 32-bit builds until one shows up, since other work will be needed to make such a system useful anyway. PHYS_ADDR_T_64BIT is def_bool 64BIT, so just remove the select. Signed-off-by: Olof Johansson Signed-off-by: Palmer Dabbelt commit ea01ce67326d75e243afc8b5f6d5b21322183e97 Author: Nick Hu Date: Mon Oct 28 10:41:01 2019 +0800 kasan: Add riscv to KASAN documentation. Add riscv to the KASAN documentation to mention that riscv is supporting generic kasan now. Signed-off-by: Nick Hu Signed-off-by: Palmer Dabbelt commit 8ad8b72721d0f07fa02dbe71f901743f9c71c8e6 Author: Nick Hu Date: Mon Jan 6 10:38:32 2020 -0800 riscv: Add KASAN support This patch ports the feature Kernel Address SANitizer (KASAN). Note: The start address of shadow memory is at the beginning of kernel space, which is 2^64 - (2^39 / 2) in SV39. The size of the kernel space is 2^38 bytes so the size of shadow memory should be 2^38 / 8. Thus, the shadow memory would not overlap with the fixmap area. There are currently two limitations in this port, 1. RV64 only: KASAN need large address space for extra shadow memory region. 2. KASAN can't debug the modules since the modules are allocated in VMALLOC area. We mapped the shadow memory, which corresponding to VMALLOC area, to the kasan_early_shadow_page because we don't have enough physical space for all the shadow memory corresponding to VMALLOC area. Signed-off-by: Nick Hu Reported-by: Greentime Hu Signed-off-by: Palmer Dabbelt commit 57ee58e39321ab4ac3f2949b90117786726cb216 Author: Nick Hu Date: Mon Oct 28 10:40:59 2019 +0800 kasan: No KASAN's memmove check if archs don't have it. If archs don't have memmove then the C implementation from lib/string.c is used, and then it's instrumented by compiler. So there is no need to add KASAN's memmove to manual checks. Signed-off-by: Nick Hu Acked-by: Dmitry Vyukov Acked-by: Andrey Ryabinin Signed-off-by: Palmer Dabbelt commit 86a761f81ec87a96572214f5db606f60d36aaf08 Author: Pavel Begunkov Date: Wed Jan 22 23:09:36 2020 +0300 io_uring: honor IOSQE_ASYNC for linked reqs REQ_F_FORCE_ASYNC is checked only for the head of a link. Fix it. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 1118591ab883f46df4ab614cc976bc4c8e04a464 Author: Pavel Begunkov Date: Wed Jan 22 23:09:35 2020 +0300 io_uring: prep req when do IOSQE_ASYNC Whenever IOSQE_ASYNC is set, requests will be punted to async without getting into io_issue_req() and without proper preparation done (e.g. io_req_defer_prep()). Hence they will be left uninitialised. Prepare them before punting. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6613babaf662cfbd283fcd0abdd758e338dd181d Author: Alain Michaud Date: Wed Jan 22 19:47:44 2020 +0000 Bluetooth: fix appearance typo in mgmt.c This change addresses a typo in the set_appearance handler. Signed-off-by: Alain Michaud Signed-off-by: Marcel Holtmann commit 5c7bac9fb2c5929a3b8600c45a972aabf9f410b5 Author: Lakshmi Ramasubramanian Date: Thu Jan 16 18:18:21 2020 -0800 IMA: pre-allocate buffer to hold keyrings string ima_match_keyring() is called while holding rcu read lock. Since this function executes in atomic context, it should not call any function that can sleep (such as kstrdup()). This patch pre-allocates a buffer to hold the keyrings string read from the IMA policy and uses that to match the given keyring. Signed-off-by: Lakshmi Ramasubramanian Fixes: e9085e0ad38a ("IMA: Add support to limit measuring keys") Signed-off-by: Mimi Zohar commit 483ec26eed42bf050931d9a5c5f9f0b5f2ad5f3b Author: Janne Karhunen Date: Wed Jan 15 17:42:30 2020 +0200 ima: ima/lsm policy rule loading logic bug fixes Keep the ima policy rules around from the beginning even if they appear invalid at the time of loading, as they may become active after an lsm policy load. However, loading a custom IMA policy with unknown LSM labels is only safe after we have transitioned from the "built-in" policy rules to a custom IMA policy. Patch also fixes the rule re-use during the lsm policy reload and makes some prints a bit more human readable. Changelog: v4: - Do not allow the initial policy load refer to non-existing lsm rules. v3: - Fix too wide policy rule matching for non-initialized LSMs v2: - Fix log prints Fixes: b16942455193 ("ima: use the lsm policy update notifier") Cc: Casey Schaufler Reported-by: Mimi Zohar Signed-off-by: Janne Karhunen Signed-off-by: Konsta Karsisto Signed-off-by: Mimi Zohar commit 6beea7afcc72b86986080ea1d228a42f2000f2a9 Author: Florent Revest Date: Mon Jan 13 10:42:44 2020 +0100 ima: add the ability to query the cached hash of a given file This allows other parts of the kernel (perhaps a stacked LSM allowing system monitoring, eg. the proposed KRSI LSM [1]) to retrieve the hash of a given file from IMA if it's present in the iint cache. It's true that the existence of the hash means that it's also in the audit logs or in /sys/kernel/security/ima/ascii_runtime_measurements, but it can be difficult to pull that information out for every subsequent exec. This is especially true if a given host has been up for a long time and the file was first measured a long time ago. It should be kept in mind that this function gives access to cached entries which can be removed, for instance on security_inode_free(). This is based on Peter Moody's patch: https://sourceforge.net/p/linux-ima/mailman/message/33036180/ [1] https://lkml.org/lkml/2019/9/10/393 Signed-off-by: Florent Revest Reviewed-by: KP Singh Signed-off-by: Mimi Zohar commit 5350ceb0b7befba9f607fd4c09b1a424e117fe1c Author: Clay Chang Date: Sun Jan 5 09:18:13 2020 +0800 ima: Add a space after printing LSM rules for readability When reading ima_policy from securityfs, there is a missing space between output string of LSM rules and the remaining rules. Signed-off-by: Clay Chang Signed-off-by: Mimi Zohar commit c5d19a6ecfce72d0352191d75f03eea4748a8c45 Author: Heiner Kallweit Date: Tue Jan 21 22:05:14 2020 +0100 net: convert additional drivers to use phy_do_ioctl The first batch of driver conversions missed a few cases where we can use phy_do_ioctl too. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 94375f9d5103c2eb2f905381993a2fb70c297364 Author: Amir Goldstein Date: Fri Nov 15 14:12:40 2019 +0200 ovl: generalize the lower_layers[] array Rename lower_layers[] array to layers[], extend its size by one and initialize layers[0] with upper layer values. Lower layers are now addressed with index 1..numlower. layers[0] is reserved even with lower only overlay. [SzM: replace ofs->numlower with ofs->numlayer, the latter's value is incremented by one] Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit b504c6540d1752c73e16548062c49bc9f447cb12 Author: Chengguang Xu Date: Fri Nov 1 20:35:51 2019 +0800 ovl: improving copy-up efficiency for big sparse file Current copy-up is not efficient for big sparse file, It's not only slow but also wasting more disk space when the target lower file has huge hole inside. This patch tries to recognize file hole and skip it during copy-up. Detail logic of hole detection as below: When we detect next data position is larger than current position we will skip that hole, otherwise we copy data in the size of OVL_COPY_UP_CHUNK_SIZE. Actually, it may not recognize all kind of holes and sometimes only skips partial of hole area. However, it will be enough for most of the use cases. Additionally, this optimization relies on lseek(2) SEEK_DATA implementation, so for some specific filesystems which do not support this feature will behave as before on copy-up. Reviewed-by: Amir Goldstein Signed-off-by: Chengguang Xu Signed-off-by: Miklos Szeredi commit b1f9d3858f724ed45b279b689fb5b400d91352e3 Author: Amir Goldstein Date: Sat Dec 21 11:42:29 2019 +0200 ovl: use ovl_inode_lock in ovl_llseek() In ovl_llseek() we use the overlay inode rwsem to protect against concurrent modifications to real file f_pos, because we copy the overlay file f_pos to/from the real file f_pos. This caused a lockdep warning of locking order violation when the ovl_llseek() operation was called on a lower nested overlay layer while the upper layer fs sb_writers is held (with patch improving copy-up efficiency for big sparse file). Use the internal ovl_inode_lock() instead of the overlay inode rwsem in those cases. It is meant to be used for protecting against concurrent changes to overlay inode internal state changes. The locking order rules are documented to explain this case. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 1bd0a3aea4357e1dce8b3f0f889fd3fe756353e6 Author: lijiazi Date: Mon Dec 16 19:12:32 2019 +0800 ovl: use pr_fmt auto generate prefix Use pr_fmt auto generate "overlayfs: " prefix. Signed-off-by: lijiazi Signed-off-by: Miklos Szeredi commit 4c37e71b713ecffe81f8e6273c6835e54306d412 Author: Amir Goldstein Date: Sun Dec 22 22:47:54 2019 +0200 ovl: fix wrong WARN_ON() in ovl_cache_update_ino() The WARN_ON() that child entry is always on overlay st_dev became wrong when we allowed this function to update d_ino in non-samefs setup with xino enabled. It is not true in case of xino bits overflow on a non-dir inode. Leave the WARN_ON() only for directories, where assertion is still true. Fixes: adbf4f7ea834 ("ovl: consistent d_ino for non-samefs with xino") Cc: # v4.17+ Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 4942dc6638b07b5326b6d2faa142635c559e7cd5 Author: Andrew Murray Date: Fri Jan 17 13:43:24 2020 +0000 KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE On VHE systems arch.mdcr_el2 is written to mdcr_el2 at vcpu_load time to set options for self-hosted debug and the performance monitors extension. Unfortunately the value of arch.mdcr_el2 is not calculated until kvm_arm_setup_debug() in the run loop after the vcpu has been loaded. This means that the initial brief iterations of the run loop use a zero value of mdcr_el2 - until the vcpu is preempted. This also results in a delay between changes to vcpu->guest_debug taking effect. Fix this by writing to mdcr_el2 in kvm_arm_setup_debug() on VHE systems when a change to arch.mdcr_el2 has been detected. Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions") Cc: # 4.17.x- Suggested-by: James Morse Acked-by: Will Deacon Reviewed-by: Marc Zyngier Signed-off-by: Andrew Murray Signed-off-by: Catalin Marinas commit 0a3d5b577784e93ae1b21aff4c1f150eca25813a Author: Alexander Lobakin Date: Wed Jan 22 13:58:52 2020 +0300 Revert "MIPS: Add custom serial.h with BASE_BAUD override for generic kernel" This reverts commit c8ec2041f549e7f2dee0c34d25381be6f7805f99. There's no more need to set BASE_BAUD to 0 to make earlycon work properly on DTS-based boards since such cases were handled in commit 182ead3e418a ("earlycon: Remove hardcoded port->uartclk initialization in of_setup_earlycon"). earlycon no longer initializes port->uartclk with a value of BASE_BAUD * 16 when starting from FDT/OF. Signed-off-by: Alexander Lobakin Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: Alexandre Belloni Cc: Microchip Linux Driver Support Cc: Will Deacon Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Paul Walmsley Cc: Michal Simek Cc: Allison Randal Cc: Thomas Gleixner Cc: Eric W. Biederman Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 34c01e41b24785f5bdd9cb36cc4ca74518463590 Author: Alexander Lobakin Date: Wed Jan 22 13:58:51 2020 +0300 MIPS: sort MIPS and MIPS_GENERIC Kconfig selects alphabetically (again) Cycles "sort selects alphabetically -> add new options at the end or at random place -> repeat" go on and on. Please double-check when adding new options and make sure that they don't break the existing order to prevent dumb commits like this one from appearing. Signed-off-by: Alexander Lobakin Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: Alexandre Belloni Cc: Microchip Linux Driver Support Cc: Will Deacon Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Paul Walmsley Cc: Michal Simek Cc: Allison Randal Cc: Thomas Gleixner Cc: Eric W. Biederman Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 18d84e2e55b6abe1e5b8a658ad078796122899fb Author: Alexander Lobakin Date: Wed Jan 22 13:58:50 2020 +0300 MIPS: make CPU_HAS_LOAD_STORE_LR opt-out CPU_HAS_LOAD_STORE_LR was introduced in 932afdeec18b ("MIPS: Add Kconfig variable for CPUs with unaligned load/store instructions") to make code in kernel/unaligned.c and lib/mem{cpy,set}.S more intuitive and give a possibility to easily add new CPUs without these instruction sets in future. Hovewer, this variant is not optimal for mainly two reasons: * For now, we have 20+ CPUs with such instructions and only two (MIPS R6) without. It will obviously be more effective and straightforward to have an option for these two rather than for the rest. * You can easily miss the fact that you need to select this option when adding a new CPU, while all processors lacking these sets are well-known, so the probability of missing something is way much lower. We can address both points by turning CPU_HAS_LOAD_STORE_LR into opt-out CPU_NO_LOAD_STORE_LR. This also makes MIPS root Kconfig more clear and understandable. Signed-off-by: Alexander Lobakin Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: Alexandre Belloni Cc: Microchip Linux Driver Support Cc: Will Deacon Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Paul Walmsley Cc: Michal Simek Cc: Allison Randal Cc: Thomas Gleixner Cc: Eric W. Biederman Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 7de86604bbe4ecb3da0c8c40d4e4b1549e879f92 Author: Alexander Lobakin Date: Wed Jan 22 13:58:49 2020 +0300 MIPS: generic: don't unconditionally select PINCTRL CONFIG_PINCTRL was converted from hidden selectable to a visible option with commit d219b924611a ("pinctrl: change Kconfig PINCTRL variable to a menuconfig"). Remove unconditional select and enable this symbol in Ocelot config, which currently is the only user among generic boards. Signed-off-by: Alexander Lobakin Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: Alexandre Belloni Cc: Microchip Linux Driver Support Cc: Will Deacon Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Paul Walmsley Cc: Michal Simek Cc: Allison Randal Cc: Thomas Gleixner Cc: Eric W. Biederman Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 7c8f13790958d1cfec120a3dafc4a57be7012c9b Author: Alexander Lobakin Date: Wed Jan 22 13:58:48 2020 +0300 MIPS: don't explicitly select LIBFDT in Kconfig It gets selected anyway through USE_OF -> OF_EARLY_FLATTREE -> OF_FLATTREE -> LIBFDT, no need to double-check. Signed-off-by: Alexander Lobakin Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: Alexandre Belloni Cc: Microchip Linux Driver Support Cc: Will Deacon Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Paul Walmsley Cc: Michal Simek Cc: Allison Randal Cc: Thomas Gleixner Cc: Eric W. Biederman Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 0956be29a96c1ce879b6a8fad1cc61f53c140ec8 Author: Sergey Korolev Date: Wed Jan 22 15:39:08 2020 +0300 MIPS: sync-r4k: do slave counter synchronization with disabled HW interrupts synchronise_count_slave() called with an enabled in mips_clockevent_init() timer interrupt which may decrease synchronization precision. Signed-off-by: Sergey Korolev Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Ralf Baechle Cc: James Hogan Cc: linux-kernel@vger.kernel.org commit c0e79fd89749b0cda1c72049e2772dd2eeada86f Author: Thomas Bogendoerfer Date: Wed Jan 22 14:13:34 2020 +0100 MIPS: SGI-IP30: Check for valid pointer before using it Fix issue detected by Smatch: ./arch/mips/sgi-ip30/ip30-irq.c:236 heart_domain_free() warn: variable dereferenced before check 'irqd' (see line 235) Fixes: 7505576d1c1a ("MIPS: add support for SGI Octane (IP30)") Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: # v5.5+ commit 273db8f03509619cd570a4b1225b399f8fb4b0b7 Author: Thomas Bogendoerfer Date: Wed Jan 22 09:59:24 2020 -0800 Input: add IOC3 serio driver This patch adds a platform driver for supporting keyboard and mouse interface of SGI IOC3 chips. Signed-off-by: Thomas Bogendoerfer Link: https://lore.kernel.org/r/20200122135220.22354-1-tbogendoerfer@suse.de Signed-off-by: Dmitry Torokhov commit 554d21efb0d2e102a14f8c4b6bdfbcfbe54b3c65 Author: Wen Yang Date: Mon Jan 20 18:04:43 2020 +0800 block, bfq: improve arithmetic division in bfq_delta() do_div() does a 64-by-32 division. Use div64_ul() instead of it if the divisor is unsigned long, to avoid truncation to 32-bit. And as a nice side effect also cleans up the function a bit. Signed-off-by: Wen Yang Cc: Paolo Valente Cc: Jens Axboe Cc: linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jens Axboe commit 7e053d3e820bedd7ea4dad598d40bfc7639428c6 Author: Alex Shi Date: Tue Jan 21 16:48:49 2020 +0800 ata/acard_ahci: remove unused variable n_elem No one care the varible acard_ahci in func acard_ahci_qc_prep. better to remove it. Signed-off-by: Alex Shi Cc: Jens Axboe Cc: linux-ide@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jens Axboe commit ffa302efe84ed8aa84aaf061ec4448036880b934 Author: Chen Zhou Date: Tue Jan 21 09:28:27 2020 +0800 ata: pata_macio: fix comparing pointer to 0 Fixes coccicheck warning: ./drivers/ata/pata_macio.c:982:31-32: WARNING comparing pointer to 0, suggest !E Compare pointer-typed values to NULL rather than 0. Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Chen Zhou Signed-off-by: Jens Axboe commit b7f22d993f51c64d79b7fd7ad2c060e3fdc006c0 Author: Alex Shi Date: Tue Jan 21 16:48:54 2020 +0800 block/bfq: remove unused bfq_class_rt which never used This macro is never used after introduced from commit aee69d78dec0 ("block, bfq: introduce the BFQ-v0 I/O scheduler as an extra scheduler") Better to remove it. Signed-off-by: Alex Shi Cc: Paolo Valente Cc: Jens Axboe Cc: linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jens Axboe commit ef7d84caa5928b40b1c93a26dbe5a3f12737c6ab Author: Peter Große Date: Wed Jan 22 19:01:06 2020 +0100 ALSA: hda - Add docking station support for Lenovo Thinkpad T420s Lenovo Thinkpad T420s uses the same codec as T420, so apply the same quirk to enable audio output on a docking station. Signed-off-by: Peter Große Link: https://lore.kernel.org/r/20200122180106.9351-1-pegro@friiks.de Signed-off-by: Takashi Iwai commit 2a67a6ccb01f21b854715d86ff6432a18b97adb3 Author: Chris Down Date: Wed Jan 22 00:01:10 2020 +0000 bpf, btf: Always output invariant hit in pahole DWARF to BTF transform When trying to compile with CONFIG_DEBUG_INFO_BTF enabled, I got this error: % make -s Failed to generate BTF for vmlinux Try to disable CONFIG_DEBUG_INFO_BTF make[3]: *** [vmlinux] Error 1 Compiling again without -s shows the true error (that pahole is missing), but since this is fatal, we should show the error unconditionally on stderr as well, not silence it using the `info` function. With this patch: % make -s BTF: .tmp_vmlinux.btf: pahole (pahole) is not available Failed to generate BTF for vmlinux Try to disable CONFIG_DEBUG_INFO_BTF make[3]: *** [vmlinux] Error 1 Signed-off-by: Chris Down Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20200122000110.GA310073@chrisdown.name commit cf85e7c7f437cb4e378bddbdb366477096714819 Author: Mika Westerberg Date: Wed Jan 22 19:46:19 2020 +0300 platform/x86: intel_pmc_ipc: Switch to use driver->dev_groups The driver core provides support for adding additional attributes for devices via new ->dev_groups member of struct device_driver. Convert the driver to use that instead of adding the attributes manually. Suggested-by: Andy Shevchenko Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit fc07ac64499702ca217e857e3ef924f30e0506bd Author: Mika Westerberg Date: Wed Jan 22 19:46:18 2020 +0300 platform/x86: intel_pmc_ipc: Propagate error from kstrtoul() kstrtoul() already returns negative error if the input was not valid so return it directly. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 1e3872ccda65b6a2ae81ed19f746115d6fbfe562 Author: Mika Westerberg Date: Wed Jan 22 19:46:17 2020 +0300 platform/x86: intel_pmc_ipc: Use octal permissions in sysfs attributes This is the current preferred way so replace the S_IWUSR with the corresponding octal value. While there move the attributes to follow directly their store functions. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 63d91d815ddd7ccd7ea8ec61f8f313d00c05eecf Author: Mika Westerberg Date: Wed Jan 22 19:46:16 2020 +0300 platform/x86: intel_pmc_ipc: Get rid of unnecessary includes There is no point including headers that are not needed in the driver so drop them. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 09874a3acdc7dc560594a77933e8ca672b442cdb Author: Mika Westerberg Date: Wed Jan 22 19:46:15 2020 +0300 platform/x86: intel_pmc_ipc: Drop ipc_data_readb() This function is not used anywhere so drop it completely. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit a97368b314efc7ea4b88c881de6c2bd22d9a08cd Author: Mika Westerberg Date: Wed Jan 22 19:46:14 2020 +0300 platform/x86: intel_pmc_ipc: Drop intel_pmc_gcr_read() and intel_pmc_gcr_write() These functions are not used anywhere so drop them completely. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit f827e5300da460f55673b0b7f1d3cd8434b6d64c Author: Mika Westerberg Date: Wed Jan 22 19:46:13 2020 +0300 platform/x86: intel_pmc_ipc: Make intel_pmc_ipc_raw_cmd() static This function is not called outside of intel_pmc_ipc.c so we can make it static instead. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 3f751ba58499b4aa535319d32a3a310e5d9c74fd Author: Mika Westerberg Date: Wed Jan 22 19:46:12 2020 +0300 platform/x86: intel_pmc_ipc: Make intel_pmc_ipc_simple_command() static This function is not called outside of intel_pmc_ipc.c so we can make it static instead. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit e1f461631123fa808ff1d1fca5f39cee21085143 Author: Mika Westerberg Date: Wed Jan 22 19:46:11 2020 +0300 platform/x86: intel_pmc_ipc: Make intel_pmc_gcr_update() static This function is not called outside of intel_pmc_ipc.c so we can make it static instead. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 8b236565600833a6bd7bc76b3aacb101ac720313 Author: Mika Westerberg Date: Wed Jan 22 19:28:13 2020 +0300 platform/x86: intel_scu_ipc: Reformat kernel-doc comments of exported functions Format kernel-doc comments of the exported functions to follow the typical format that does not have tab indentation. Also capitalize parameter descriptions and add a missing period. No functional changes intended. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 4907898873a0c7eebbf01c66c7541800c8e7cbe4 Author: Mika Westerberg Date: Wed Jan 22 19:28:12 2020 +0300 platform/x86: intel_scu_ipc: Drop intel_scu_ipc_raw_command() There is no user for this function so we can drop it from the driver. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit b7380a16268975443f394a3213f2ab6bb48ae940 Author: Mika Westerberg Date: Wed Jan 22 19:28:11 2020 +0300 platform/x86: intel_scu_ipc: Drop intel_scu_ipc_io[read|write][8|16]() There are no users for these so we can remove them. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 59aa78e325d890ddbd2aa6f3522704621c1a6d0f Author: Mika Westerberg Date: Wed Jan 22 19:28:10 2020 +0300 platform/x86: intel_scu_ipc: Drop unused macros These macros are not used anywhere in the driver so drop them. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit a5f04a2e5e3324ba1ebab7e3a0315682fb54b127 Author: Mika Westerberg Date: Wed Jan 22 19:28:09 2020 +0300 platform/x86: intel_scu_ipc: Drop unused prototype intel_scu_ipc_fw_update() There is no implementation for that anymore so drop the prototype. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit e7b7ab3847c9e727e14ba724024506beb156993c Author: Mika Westerberg Date: Wed Jan 22 19:28:08 2020 +0300 platform/x86: intel_scu_ipc: Sleeping is fine when polling There is no reason why the driver would need to block other threads from running the CPU while it is waiting for the SCU IPC to complete its work. For this reason switch the driver to use usleep_range() instead with a bit more relaxed polling loop. Also add constant for the timeout and use the same value for both polling and interrupt modes. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 74e9748b9b218e7863711b8c0dffb181154e4a23 Author: Mika Westerberg Date: Wed Jan 22 19:28:07 2020 +0300 platform/x86: intel_scu_ipc: Drop intel_scu_ipc_i2c_cntrl() There are no existing users for this functionality so drop it from the driver completely. This also means we don't need to keep the struct intel_scu_ipc_pdata_t around anymore so remove that as well. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit b47018a778c1a18cbc98b4a11936dec4f8c4bb7b Author: Mika Westerberg Date: Wed Jan 22 19:28:06 2020 +0300 platform/x86: intel_scu_ipc: Remove Lincroft support Moorestown support was removed years ago with by the commit 1a8359e411eb ("x86/mid: Remove Intel Moorestown"). Lincroft is the CPU side chip of Moorestown and not supported anymore so remove the code from the driver. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 19e2d350aeaa5aac4b5cfc121d596ec205a9c530 Author: Mika Westerberg Date: Wed Jan 22 19:28:05 2020 +0300 platform/x86: intel_scu_ipc: Add constants for register offsets This makes the code more readable. These are taken from intel_pmc_ipc.c which implements the same thing. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit e48b72a568bbd641c91dad354138d3c17d03ee6f Author: Mika Westerberg Date: Wed Jan 22 19:28:04 2020 +0300 platform/x86: intel_scu_ipc: Fix interrupt support Currently the driver has disabled interrupt support for Tangier but actually interrupt works just fine if the command is not written twice in a row. Also we need to ack the interrupt in the handler. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko commit 298ef70f3ae5f00eda1f8f6d388c06151ce0b4d0 Author: Mika Westerberg Date: Wed Jan 22 19:18:43 2020 +0300 platform/x86: intel_scu_ipcutil: Remove default y from Kconfig This driver is by no means essential for system to boot up so remove default y from it. Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 5e0c94d3aeeecc68c573033f08d9678fecf253bd Author: Mika Westerberg Date: Wed Jan 22 19:05:20 2020 +0300 platform/x86: intel_mid_powerbtn: Take a copy of ddata The driver gets driver_data from memory that is marked as const (which is probably put to read-only memory) and it then modifies it. This likely causes some sort of fault to happen. Fix this by taking a copy of the structure. Fixes: c94a8ff14de3 ("platform/x86: intel_mid_powerbtn: make mid_pb_ddata const") Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andy Shevchenko commit 1222653cc0489fa9304a36f7d9593ecaeb51efe1 Author: Daniel Díaz Date: Wed Jan 22 17:44:24 2020 +0100 selftests/bpf: Build urandom_read with LDFLAGS and LDLIBS During cross-compilation, it was discovered that LDFLAGS and LDLIBS were not being used while building binaries, leading to defaults which were not necessarily correct. OpenEmbedded reported this kind of problem: ERROR: QA Issue: No GNU_HASH in the ELF binary [...], didn't pass LDFLAGS? Signed-off-by: Daniel Díaz Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Acked-by: John Fastabend commit bdf2aca703e83eeecac2b492494687d5009a694e Author: Alain Michaud Date: Wed Jan 22 16:09:16 2020 +0000 Bluetooth: adding missing const decoration to mgmt_status_table This change simply adds a missing const decoration to the mtmt_status_table definition. Signed-off-by: Alain Michaud Signed-off-by: Marcel Holtmann commit 11ea68f553e244851d15793a7fa33a97c46d8271 Author: Ming Lei Date: Mon Jan 20 17:16:25 2020 +0800 genirq, sched/isolation: Isolate from handling managed interrupts The affinity of managed interrupts is completely handled in the kernel and cannot be changed via the /proc/irq/* interfaces from user space. As the kernel tries to spread out interrupts evenly accross CPUs on x86 to prevent vector exhaustion, it can happen that a managed interrupt whose affinity mask contains both isolated and housekeeping CPUs is routed to an isolated CPU. As a consequence IO submitted on a housekeeping CPU causes interrupts on the isolated CPU. Add a new sub-parameter 'managed_irq' for 'isolcpus' and the corresponding logic in the interrupt affinity selection code. The subparameter indicates to the interrupt affinity selection logic that it should try to avoid the above scenario. This isolation is best effort and only effective if the automatically assigned interrupt mask of a device queue contains isolated and housekeeping CPUs. If housekeeping CPUs are online then such interrupts are directed to the housekeeping CPU so that IO submitted on the housekeeping CPU cannot disturb the isolated CPU. If a queue's affinity mask contains only isolated CPUs then this parameter has no effect on the interrupt routing decision, though interrupts are only happening when tasks running on those isolated CPUs submit IO. IO submitted on housekeeping CPUs has no influence on those queues. If the affinity mask contains both housekeeping and isolated CPUs, but none of the contained housekeeping CPUs is online, then the interrupt is also routed to an isolated CPU. Interrupts are only delivered when one of the isolated CPUs in the affinity mask submits IO. If one of the contained housekeeping CPUs comes online, the CPU hotplug logic migrates the interrupt automatically back to the upcoming housekeeping CPU. Depending on the type of interrupt controller, this can require that at least one interrupt is delivered to the isolated CPU in order to complete the migration. [ tglx: Removed unused parameter, added and edited comments/documentation and rephrased the changelog so it contains more details. ] Signed-off-by: Ming Lei Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20200120091625.17912-1-ming.lei@redhat.com commit eda4eabf86fd6806eaabc23fb90dd056fdac037b Author: Juergen Gross Date: Fri Jan 17 14:49:31 2020 +0100 xen/balloon: Support xend-based toolstack take two Commit 3aa6c19d2f38be ("xen/balloon: Support xend-based toolstack") tried to fix a regression with running on rather ancient Xen versions. Unfortunately the fix was based on the assumption that xend would just use another Xenstore node, but in reality only some downstream versions of xend are doing that. The upstream xend does not write that Xenstore node at all, so the problem must be fixed in another way. The easiest way to achieve that is to fall back to the behavior before commit 96edd61dcf4436 ("xen/balloon: don't online new memory initially") in case the static memory maximum can't be read. This is achieved by setting static_max to the current number of memory pages known by the system resulting in target_diff becoming zero. Fixes: 3aa6c19d2f38be ("xen/balloon: Support xend-based toolstack") Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Cc: # 4.13 Signed-off-by: Boris Ostrovsky commit db735fc4036bbe1fbe606819b5f0ff26cc76cdff Author: Sean Paul Date: Tue Jan 21 11:18:48 2020 -0800 drm/msm: Set dma maximum segment size for mdss Turning on CONFIG_DMA_API_DEBUG_SG results in the following error: [ 12.078665] msm ae00000.mdss: DMA-API: mapping sg segment longer than device claims to support [len=3526656] [max=65536] [ 12.089870] WARNING: CPU: 6 PID: 334 at /mnt/host/source/src/third_party/kernel/v4.19/kernel/dma/debug.c:1301 debug_dma_map_sg+0x1dc/0x318 [ 12.102655] Modules linked in: joydev [ 12.106442] CPU: 6 PID: 334 Comm: frecon Not tainted 4.19.0 #2 [ 12.112450] Hardware name: Google Cheza (rev3+) (DT) [ 12.117566] pstate: 60400009 (nZCv daif +PAN -UAO) [ 12.122506] pc : debug_dma_map_sg+0x1dc/0x318 [ 12.126995] lr : debug_dma_map_sg+0x1dc/0x318 [ 12.131487] sp : ffffff800cc3ba80 [ 12.134913] x29: ffffff800cc3ba80 x28: 0000000000000000 [ 12.140395] x27: 0000000000000004 x26: 0000000000000004 [ 12.145868] x25: ffffff8008e55b18 x24: 0000000000000000 [ 12.151337] x23: 00000000ffffffff x22: ffffff800921c000 [ 12.156809] x21: ffffffc0fa75b080 x20: ffffffc0f7195090 [ 12.162280] x19: ffffffc0f1c53280 x18: 0000000000000000 [ 12.167749] x17: 0000000000000000 x16: 0000000000000000 [ 12.173218] x15: 0000000000000000 x14: 0720072007200720 [ 12.178689] x13: 0720072007200720 x12: 0720072007200720 [ 12.184161] x11: 0720072007200720 x10: 0720072007200720 [ 12.189641] x9 : ffffffc0f1fc6b60 x8 : 0000000000000000 [ 12.195110] x7 : ffffff8008132ce0 x6 : 0000000000000000 [ 12.200585] x5 : 0000000000000000 x4 : ffffff8008134734 [ 12.206058] x3 : ffffff800cc3b830 x2 : ffffffc0f1fc6240 [ 12.211532] x1 : 25045a74f48a7400 x0 : 25045a74f48a7400 [ 12.217006] Call trace: [ 12.219535] debug_dma_map_sg+0x1dc/0x318 [ 12.223671] get_pages+0x19c/0x20c [ 12.227177] msm_gem_fault+0x64/0xfc [ 12.230874] __do_fault+0x3c/0x140 [ 12.234383] __handle_mm_fault+0x70c/0xdb8 [ 12.238603] handle_mm_fault+0xac/0xc4 [ 12.242473] do_page_fault+0x1bc/0x3d4 [ 12.246342] do_translation_fault+0x54/0x88 [ 12.250652] do_mem_abort+0x60/0xf0 [ 12.254250] el0_da+0x20/0x24 [ 12.257317] irq event stamp: 67260 [ 12.260828] hardirqs last enabled at (67259): [] console_unlock+0x214/0x608 [ 12.269693] hardirqs last disabled at (67260): [] do_debug_exception+0x5c/0x178 [ 12.278820] softirqs last enabled at (67256): [] __do_softirq+0x4d4/0x520 [ 12.287510] softirqs last disabled at (67249): [] irq_exit+0xa8/0x100 [ 12.295742] ---[ end trace e63cfc40c313ffab ]--- The root of the problem is that the default segment size for sgt is (UINT_MAX & PAGE_MASK), and the default segment size for device dma is 64K. As such, if you compare the 2, you would deduce that the sg segment will overflow the device's capacity. In reality, the hardware can accommodate the larger sg segments, it's just not initializing its max segment properly. This patch initializes the max segment size for the mdss device, which gets rid of that pesky warning. Reported-by: Stephen Boyd Tested-by: Stephen Boyd Tested-by: Sai Prakash Ranjan Reviewed-by: Rob Clark Signed-off-by: Sean Paul Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20200121111813.REPOST.1.I92c66a35fb13f368095b05287bdabdbe88ca6922@changeid commit eb5a4d0a9ee976008d1add75e3d64545399e80a3 Author: Jules Irenge Date: Mon Jan 20 22:43:47 2020 +0000 hrtimer: Add missing sparse annotation for __run_timer() Sparse reports a warning at __run_hrtimer() |warning: context imbalance in __run_hrtimer() - unexpected unlock Add the missing must_hold() annotation. Signed-off-by: Jules Irenge Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20200120224347.51843-1-jbi.octave@gmail.com commit e533dbe9dcb199bb637a2c465f3a6e70564994fe Author: Mark Rutland Date: Wed Jan 22 12:45:46 2020 +0000 arm64: acpi: fix DAIF manipulation with pNMI Since commit: d44f1b8dd7e66d80 ("arm64: KVM/mm: Move SEA handling behind a single 'claim' interface") ... the top-level APEI SEA handler has the shape: 1. current_flags = arch_local_save_flags() 2. local_daif_restore(DAIF_ERRCTX) 3. 4. local_daif_restore(current_flags) However, since commit: 4a503217ce37e1f4 ("arm64: irqflags: Use ICC_PMR_EL1 for interrupt masking") ... when pseudo-NMIs (pNMIs) are in use, arch_local_save_flags() will save the PMR value rather than the DAIF flags. The combination of these two commits means that the APEI SEA handler will erroneously attempt to restore the PMR value into DAIF. Fix this by factoring local_daif_save_flags() out of local_daif_save(), so that we can consistently save DAIF in step #1, regardless of whether pNMIs are in use. Both commits were introduced concurrently in v5.0. Cc: Fixes: 4a503217ce37e1f4 ("arm64: irqflags: Use ICC_PMR_EL1 for interrupt masking") Fixes: d44f1b8dd7e66d80 ("arm64: KVM/mm: Move SEA handling behind a single 'claim' interface") Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: James Morse Cc: Julien Thierry Cc: Will Deacon Signed-off-by: Will Deacon commit 72a9cc952f123948ca1d1011a12e5e1312140b68 Author: Rasmus Villemoes Date: Wed Jan 15 19:41:53 2020 +0100 devtmpfs: factor out common tail of devtmpfs_{create,delete}_node There's some common boilerplate in devtmpfs_{create,delete}_node, put that in a little helper. Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20200115184154.3492-6-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman commit fad1db8a351cc913bbfb9ee4fe7ca4939cb19f2e Author: Rasmus Villemoes Date: Wed Jan 15 19:41:52 2020 +0100 devtmpfs: initify a bit devtmpfs_mount() is only called from prepare_namespace() in init/do_mounts.c, which is an __init function, so devtmpfs_mount() can also be moved to .init.text. Then the mount_dev static variable is only referenced from __init functions (devtmpfs_mount and its initializer function mount_param). Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20200115184154.3492-5-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman commit 21766d11d151c82eb41c09338c8e149da6019a8b Author: Rasmus Villemoes Date: Wed Jan 15 19:41:51 2020 +0100 devtmpfs: simplify initialization of mount_dev Avoid a bit of ifdeffery by using the IS_ENABLED() helper. Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20200115184154.3492-4-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman commit 0ff0e95e9909e6ddefc8caa3948f20c0cb3dd6fb Author: Rasmus Villemoes Date: Wed Jan 15 19:41:50 2020 +0100 devtmpfs: factor out setup part of devtmpfsd() Factor out the setup part of devtmpfsd() to make it a bit easier to see that we always call setup_done() exactly once (provided of course the kthread is succesfully created). Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20200115184154.3492-3-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman commit c9d6b287d786db3a6bf3d99c1d99cd7e1d639485 Author: Rasmus Villemoes Date: Wed Jan 15 19:41:49 2020 +0100 devtmpfs: fix theoretical stale pointer deref in devtmpfsd() After complete(&setup_done), devtmpfs_init proceeds and may actually return, invalidating the *err pointer, before devtmpfsd() proceeds to reading back *err. This is of course completely theoretical since the error conditions never trigger in practice, and even if they did, nobody cares about the exit value from a kernel thread, so it doesn't matter if we happen to read back some garbage from some other stack frame. Still, this isn't a pattern that should be copy-pasted, so fix it. Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20200115184154.3492-2-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman commit 0707cfa5c3ef58effb143db9db6d6e20503f9dec Author: Colin Ian King Date: Thu Jan 16 17:57:58 2020 +0000 driver core: platform: fix u32 greater or equal to zero comparison Currently the check that a u32 variable i is >= 0 is always true because the unsigned variable will never be negative, causing the loop to run forever. Fix this by changing the pre-decrement check to a zero check on i followed by a decrement of i. Addresses-Coverity: ("Unsigned compared against 0") Fixes: 39cc539f90d0 ("driver core: platform: Prevent resouce overflow from causing infinite loops") Signed-off-by: Colin Ian King Reviewed-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20200116175758.88396-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit f4a81f5a853e0b7c38bfad3afd6d0365d654e777 Author: Marc Zyngier Date: Tue Dec 24 11:10:38 2019 +0000 irqchip/gic-v4.1: Allow direct invalidation of VLPIs Just like for INVALL, GICv4.1 has grown a VPE-aware INVLPI register. Let's plumb it in and make use of the DirectLPI code in that case. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-16-maz@kernel.org commit 3858d4dfdfb845e51ee8b4045f61ccba2c3111ee Author: Marc Zyngier Date: Tue Dec 24 11:10:37 2019 +0000 irqchip/gic-v4.1: Suppress per-VLPI doorbell Since GICv4.1 gives us a per-VPE doorbell, avoid programming anything else on VMOVI/VMAPI/VMAPTI and on any other action that would have otherwise resulted in a per-VLPI doorbell to be programmed. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-15-maz@kernel.org commit b4a4bd0f2629ec2ece7690de1b4721529da29871 Author: Marc Zyngier Date: Tue Dec 24 11:10:36 2019 +0000 irqchip/gic-v4.1: Add VPE INVALL callback GICv4.1 redistributors have a VPE-aware INVALL register. Progress! We can now emulate a guest-requested INVALL without emiting a VINVALL command. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-14-maz@kernel.org commit e64fab1a1477dbf0c355691914511612ba312932 Author: Marc Zyngier Date: Tue Dec 24 11:10:35 2019 +0000 irqchip/gic-v4.1: Add VPE eviction callback When descheduling a VPE, special care must be taken to tell the GIC about whether we want to receive a doorbell or not. This is a major improvement on GICv4.0, where the doorbell had to be separately enabled/disabled. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-13-maz@kernel.org commit 91bf6395f7b8614a5a9934a0ae9c8b5312d77b29 Author: Marc Zyngier Date: Tue Dec 24 11:10:34 2019 +0000 irqchip/gic-v4.1: Add VPE residency callback Making a VPE resident on GICv4.1 is pretty simple, as it is just a single write to the local redistributor. We just need extra information about which groups to enable, which the KVM code will have to provide. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-12-maz@kernel.org commit d97c97baa214486cc3d64c996a2214475f6cc83c Author: Marc Zyngier Date: Tue Dec 24 11:10:33 2019 +0000 irqchip/gic-v4.1: Add mask/unmask doorbell callbacks masking/unmasking doorbells on GICv4.1 relies on a new INVDB command, which broadcasts the invalidation to all RDs. Implement the new command as well as the masking callbacks, and plug the whole thing into the v4.1 VPE irqchip. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-11-maz@kernel.org commit 29c647f3b5ae1a20221d477442dcdf058cea4a21 Author: Marc Zyngier Date: Tue Dec 24 11:10:32 2019 +0000 irqchip/gic-v4.1: Plumb skeletal VPE irqchip Just like for GICv4.0, each VPE has its own doorbell interrupt, and thus an irqchip that manages them. Since the doorbell management is quite different on GICv4.1, let's introduce an almost empty irqchip the will get populated over the next new patches. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-10-maz@kernel.org commit dd3f050a216ef7c8ce21ba48fd3b2ece2155382f Author: Marc Zyngier Date: Tue Dec 24 11:10:31 2019 +0000 irqchip/gic-v4.1: Implement the v4.1 flavour of VMOVP With GICv4.1, VMOVP is extended to allow a default doorbell to be specified, as well as a validity bit for this doorbell. As an added bonus, VMOVP isn't required anymore of moving a VPE between redistributors that share the same affinity. Let's add this support to the VMOVP builder, and make sure we don't issue the command if we don't really need to. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-9-maz@kernel.org commit 0684c7046590dd1e8047e187aaf4c7910cc35bce Author: Marc Zyngier Date: Tue Dec 24 11:10:30 2019 +0000 irqchip/gic-v4.1: Don't use the VPE proxy if RVPEID is set The infamous VPE proxy device isn't used with GICv4.1 because: - we can invalidate any LPI from the DirectLPI MMIO interface - the ITS and redistributors understand the life cycle of the doorbell, so we don't need to enable/disable it all the time So let's escape early from the proxy related functions. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-8-maz@kernel.org commit 64edfaa9a2342a3ce34f8cb982c2c2df84db4de3 Author: Marc Zyngier Date: Tue Dec 24 11:10:29 2019 +0000 irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP The ITS VMAPP command gains some new fields with GICv4.1: - a default doorbell, which allows a single doorbell to be used for all the VLPIs routed to a given VPE - a pointer to the configuration table (instead of having it in a register that gets context switched) - a flag indicating whether this is the first map or the last unmap for this particular VPE - a flag indicating whether the pending table is known to be zeroed, or not Plumb in the new fields in the VMAPP builder, and add the map/unmap refcounting so that the ITS can do the right thing. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-7-maz@kernel.org commit 5e5168461c22c8738d31d4ee12a5cbc2ab0aa440 Author: Marc Zyngier Date: Tue Dec 24 11:10:28 2019 +0000 irqchip/gic-v4.1: VPE table (aka GICR_VPROPBASER) allocation GICv4.1 defines a new VPE table that is potentially shared between both the ITSs and the redistributors, following complicated affinity rules. To make things more confusing, the programming of this table at the redistributor level is reusing the GICv4.0 GICR_VPROPBASER register for something completely different. The code flow is somewhat complexified by the need to respect the affinities required by the HW, meaning that tables can either be inherited from a previously discovered ITS or redistributor. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-6-maz@kernel.org commit f2d834092ee276610ccb6637e5109b61fc79ab89 Author: Marc Zyngier Date: Tue Dec 24 11:10:25 2019 +0000 irqchip/gic-v3: Add GICv4.1 VPEID size discovery While GICv4.0 mandates 16 bit worth of VPEIDs, GICv4.1 allows smaller implementations to be built. Add the required glue to dynamically compute the limit. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-3-maz@kernel.org commit b25319d279b63781b972c4966b4082193e69afac Author: Marc Zyngier Date: Tue Dec 24 11:10:24 2019 +0000 irqchip/gic-v3: Detect GICv4.1 supporting RVPEID GICv4.1 supports the RVPEID ("Residency per vPE ID"), which allows for a much efficient way of making virtual CPUs resident (to allow direct injection of interrupts). The functionnality needs to be discovered on each and every redistributor in the system, and disabled if the settings are inconsistent. Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20191224111055.11836-2-maz@kernel.org commit 093bf439fee0d40ade7e309c1288b409cdc3b38f Author: Marc Zyngier Date: Wed Jan 22 13:53:44 2020 +0000 irqchip/gic-v3-its: Fix get_vlpi_map() breakage with doorbells When updating an LPI configuration, get_vlpi_map() may be passed a irq_data structure relative to an ITS domain (the normal case) or one that is relative to the core GICv3 domain in the case of a GICv4 doorbell. In the latter case, special care must be take not to dereference the irq_chip data as an its_dev structure, as that isn't what is stored there. Instead, check *first* whether the IRQ is forwarded to a vcpu, and only then try to obtain the vlpi mapping. Fixes: c1d4d5cd203c ("irqchip/gic-v3-its: Add its_vlpi_map helpers") Signed-off-by: Marc Zyngier Reported-by: Zenghui Yu Link: https://lore.kernel.org/r/20200122085609.658-1-yuzenghui@huawei.com commit eb143f8756e77c8fcfc4d574922ae9efd3a43ca9 Author: Martin Fuzzey Date: Fri Jan 10 16:44:01 2020 +0100 binder: fix log spam for existing debugfs file creation. Since commit 43e23b6c0b01 ("debugfs: log errors when something goes wrong") debugfs logs attempts to create existing files. However binder attempts to create multiple debugfs files with the same name when a single PID has multiple contexts, this leads to log spamming during an Android boot (17 such messages during boot on my system). Fix this by checking if we already know the PID and only create the debugfs entry for the first context per PID. Do the same thing for binderfs for symmetry. Signed-off-by: Martin Fuzzey Acked-by: Todd Kjos Fixes: 43e23b6c0b01 ("debugfs: log errors when something goes wrong") Cc: stable Link: https://lore.kernel.org/r/1578671054-5982-1-git-send-email-martin.fuzzey@flowbird.group Signed-off-by: Greg Kroah-Hartman commit 4144fddbd3932b59370e6e279002991c3e2b2fc6 Author: Mateusz Nosek Date: Sat Jan 18 18:11:43 2020 +0100 x86/tsc: Remove redundant assignment Previously, the assignment to the local variable 'now' took place before the for loop. The loop is unconditional so it will be entered at least once. The variable 'now' is reassigned in the loop and is not used before reassigning. Therefore, the assignment before the loop is unnecessary and can be removed. No code changed: # arch/x86/kernel/tsc_sync.o: text data bss dec hex filename 3569 198 44 3811 ee3 tsc_sync.o.before 3569 198 44 3811 ee3 tsc_sync.o.after md5: 36216de29b208edbcd34fed9fe7f7b69 tsc_sync.o.before.asm 36216de29b208edbcd34fed9fe7f7b69 tsc_sync.o.after.asm [ bp: Massage commit message. ] Signed-off-by: Mateusz Nosek Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20200118171143.25178-1-mateusznosek0@gmail.com commit 659ded30272d67a04b3692f0bfa12263be20d790 Author: Alex Shi Date: Tue Jan 21 13:54:35 2020 +0800 trace/kprobe: Remove unused MAX_KPROBE_CMDLINE_SIZE This limitation are never lunched from introduce commit 970988e19eb0 ("tracing/kprobe: Add kprobe_event= boot parameter") Could we remove it if no intention to implement it? Link: http://lkml.kernel.org/r/1579586075-45132-1-git-send-email-alex.shi@linux.alibaba.com Acked-by: Masami Hiramatsu Signed-off-by: Alex Shi Signed-off-by: Steven Rostedt (VMware) commit 17248ea0367465f4aaef728f6af661ed38e38cf1 Author: Sven Schnelle Date: Wed Jan 15 13:42:27 2020 +0100 s390: fix __EMIT_BUG() macro Setting a kprobe on getname_flags() failed: $ echo 'p:tmr1 getname_flags +0(%r2):ustring' > kprobe_events -bash: echo: write error: Invalid argument Debugging the kprobes code showed that the address of getname_flags() is contained in the __bug_table. Kprobes doesn't allow to set probes at BUG() locations. $ objdump -j __bug_table -x build/fs/namei.o [..] 0000000000000108 R_390_PC32 .text+0x00000000000075a8 000000000000010c R_390_PC32 .L223+0x0000000000000004 I was expecting getname_flags() to start with a BUG(), but: 7598: e3 20 10 00 00 04 lg %r2,0(%r1) 759e: c0 f4 00 00 00 00 jg 759e 75a0: R_390_PLT32DBL kmem_cache_free+0x2 75a4: a7 f4 00 01 j 75a6 00000000000075a8 : 75a8: c0 04 00 00 00 00 brcl 0,75a8 75ae: eb 6f f0 48 00 24 stmg %r6,%r15,72(%r15) 75b4: b9 04 00 ef lgr %r14,%r15 75b8: e3 f0 ff a8 ff 71 lay %r15,-88(%r15) So the BUG() is actually the last opcode of the previous function. Fix this by switching to using the MONITOR CALL (MC) instruction, and set the entry in __bug_table to the beginning of that MC. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik commit 45f7a0da600d3c409b5ad8d5ddddacd98ddc8840 Author: Vasily Gorbik Date: Tue Dec 10 14:33:39 2019 +0100 s390/ftrace: generate traced function stack frame Currently backtrace from ftraced function does not contain ftraced function itself. e.g. for "path_openat": arch_stack_walk+0x15c/0x2d8 stack_trace_save+0x50/0x68 stack_trace_call+0x15e/0x3d8 ftrace_graph_caller+0x0/0x1c <-- ftrace code do_filp_open+0x7c/0xe8 <-- ftraced function caller do_open_execat+0x76/0x1b8 open_exec+0x52/0x78 load_elf_binary+0x180/0x1160 search_binary_handler+0x8e/0x288 load_script+0x2a8/0x2b8 search_binary_handler+0x8e/0x288 __do_execve_file.isra.39+0x6fa/0xb40 __s390x_sys_execve+0x56/0x68 system_call+0xdc/0x2d8 Ftraced function is expected in the backtrace by ftrace kselftests, which are now failing. It would also be nice to have it for clarity reasons. "ftrace_caller" itself is called without stack frame allocated for it and does not store its caller (ftraced function). Instead it simply allocates a stack frame for "ftrace_trace_function" and sets backchain to point to ftraced function stack frame (which contains ftraced function caller in saved r14). To fix this issue make "ftrace_caller" allocate a stack frame for itself just to store ftraced function for the stack unwinder. As a result backtrace looks like the following: arch_stack_walk+0x15c/0x2d8 stack_trace_save+0x50/0x68 stack_trace_call+0x15e/0x3d8 ftrace_graph_caller+0x0/0x1c <-- ftrace code path_openat+0x6/0xd60 <-- ftraced function do_filp_open+0x7c/0xe8 <-- ftraced function caller do_open_execat+0x76/0x1b8 open_exec+0x52/0x78 load_elf_binary+0x180/0x1160 search_binary_handler+0x8e/0x288 load_script+0x2a8/0x2b8 search_binary_handler+0x8e/0x288 __do_execve_file.isra.39+0x6fa/0xb40 __s390x_sys_execve+0x56/0x68 system_call+0xdc/0x2d8 Reported-by: Sven Schnelle Tested-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 253b3c4b2920e07ce9e2b18800b9b65245e2fafa Author: Vasily Gorbik Date: Wed Jan 8 14:46:00 2020 +0100 s390: adjust -mpacked-stack support check for clang 10 clang 10 introduces -mpacked-stack compiler option implementation. At the same time currently it does not support a combination of -mpacked-stack and -mbackchain. This leads to the following build error: clang: error: unsupported option '-mpacked-stack with -mbackchain' for target 's390x-ibm-linux' If/when clang adds support for a combination of -mpacked-stack and -mbackchain it would also require -msoft-float (like gcc does). According to Ulrich Weigand "stack slot assigned to the kernel backchain overlaps the stack slot assigned to the FPR varargs (both are required to be placed immediately after the saved r15 slot if present)." Extend -mpacked-stack compiler option support check to include all 3 options -mpacked-stack -mbackchain -msoft-float which must present to support -mpacked-stack with -mbackchain. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit c4e5c229b610ac974f284c760e47c40e651258f2 Author: Vasily Gorbik Date: Wed Dec 25 14:13:32 2019 +0100 s390/jump_label: use "i" constraint for clang Currently kernel build fails under clang if jump labels are enabled. The problem is "X" constraint usage "Any operand whatsoever is allowed", for which clang produces the following: .pushsection __jump_table,"aw" .balign 8 .long 0b-.,.Ltmp577-. .quad %r0+0-. # %r0 is not allowed here .popsection Under gcc constraints "X" or "jdd" (gcc > 9) are used for static keys. Ideally, we'd have used "i" for gcc, but it doesn't work in all cases with -fPIC code. This is gcc-specific problem that doesn't exist in llvm. Since clang does not have "jdd" simply always use "i" constraint for it. Suggested-by: Ulrich Weigand Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ee09c91480b10f306bfd1856776f673b4efe68a5 Author: Thomas Richter Date: Fri Jan 3 11:37:12 2020 +0100 s390/cpum_sf: Use DIV_ROUND_UP Use macro DIV_ROUND_UP() for calculation of number of SDBT SDBT pages required for index pages. This macro is already used throughout the file. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 32dab6828c42f087439d3e2617dc7283546bd8f7 Author: Thomas Richter Date: Thu Dec 19 14:56:13 2019 +0100 s390/cpum_sf: Use kzalloc and minor changes Use kzalloc() to allocate auxiliary buffer structure initialized with all zeroes to avoid random value in trace output. Avoid double access to SBD hardware flags. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit ee5c4ccfd51d5dbaa9b9ddeed97c8d5526e55f17 Author: Thomas Richter Date: Tue Dec 17 15:07:35 2019 +0100 s390/cpum_sf: Convert debug trace to common layout Convert debug traces to print the head/alert/empty marks consistently as decimal numbers. Add some trace statements to enable easier debugging during auxiliary tracing. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 576c75e36c689bec6a940e807bae27291ab0c0de Author: Niklas Schnelle Date: Thu Dec 19 09:16:59 2019 +0100 s390/pci: Fix possible deadlock in recover_store() With zpci_disable() working, lockdep detected a potential deadlock (lockdep output at the end). The deadlock is between recovering a PCI function via the /sys/bus/pci/devices//recover attribute vs powering it off via /sys/bus/pci/slots//power. The fix is analogous to the changes in commit 0ee223b2e1f6 ("scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock") that fixed a potential deadlock on removing a SCSI device via sysfs. [ 204.830107] ====================================================== [ 204.830109] WARNING: possible circular locking dependency detected [ 204.830111] 5.5.0-rc2-06072-gbc03ecc9a672 #6 Tainted: G W [ 204.830112] ------------------------------------------------------ [ 204.830113] bash/1034 is trying to acquire lock: [ 204.830115] 0000000192a1a610 (kn->count#200){++++}, at: kernfs_remove_by_name_ns+0x5c/0xa8 [ 204.830122] but task is already holding lock: [ 204.830123] 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48 [ 204.830128] which lock already depends on the new lock. [ 204.830129] the existing dependency chain (in reverse order) is: [ 204.830130] -> #1 (pci_rescan_remove_lock){+.+.}: [ 204.830134] validate_chain+0x93a/0xd08 [ 204.830136] __lock_acquire+0x4ae/0x9d0 [ 204.830137] lock_acquire+0x114/0x280 [ 204.830140] __mutex_lock+0xa2/0x960 [ 204.830142] mutex_lock_nested+0x32/0x40 [ 204.830145] recover_store+0x4c/0xa8 [ 204.830147] kernfs_fop_write+0xe6/0x218 [ 204.830151] vfs_write+0xb0/0x1b8 [ 204.830152] ksys_write+0x6c/0xf8 [ 204.830154] system_call+0xd8/0x2d8 [ 204.830155] -> #0 (kn->count#200){++++}: [ 204.830187] check_noncircular+0x1e6/0x240 [ 204.830189] check_prev_add+0xfc/0xdb0 [ 204.830190] validate_chain+0x93a/0xd08 [ 204.830192] __lock_acquire+0x4ae/0x9d0 [ 204.830193] lock_acquire+0x114/0x280 [ 204.830194] __kernfs_remove.part.0+0x2e4/0x360 [ 204.830196] kernfs_remove_by_name_ns+0x5c/0xa8 [ 204.830198] remove_files.isra.0+0x4c/0x98 [ 204.830199] sysfs_remove_group+0x66/0xc8 [ 204.830201] sysfs_remove_groups+0x46/0x68 [ 204.830204] device_remove_attrs+0x52/0x90 [ 204.830207] device_del+0x182/0x418 [ 204.830208] pci_remove_bus_device+0x8a/0x130 [ 204.830210] pci_stop_and_remove_bus_device_locked+0x3a/0x48 [ 204.830212] disable_slot+0x68/0x100 [ 204.830213] power_write_file+0x7c/0x130 [ 204.830215] kernfs_fop_write+0xe6/0x218 [ 204.830217] vfs_write+0xb0/0x1b8 [ 204.830218] ksys_write+0x6c/0xf8 [ 204.830220] system_call+0xd8/0x2d8 [ 204.830221] other info that might help us debug this: [ 204.830223] Possible unsafe locking scenario: [ 204.830224] CPU0 CPU1 [ 204.830225] ---- ---- [ 204.830226] lock(pci_rescan_remove_lock); [ 204.830227] lock(kn->count#200); [ 204.830229] lock(pci_rescan_remove_lock); [ 204.830231] lock(kn->count#200); [ 204.830233] *** DEADLOCK *** [ 204.830234] 4 locks held by bash/1034: [ 204.830235] #0: 00000001b6fbc498 (sb_writers#4){.+.+}, at: vfs_write+0x158/0x1b8 [ 204.830239] #1: 000000018c9f5090 (&of->mutex){+.+.}, at: kernfs_fop_write+0xaa/0x218 [ 204.830242] #2: 00000001f7da0810 (kn->count#235){.+.+}, at: kernfs_fop_write+0xb6/0x218 [ 204.830245] #3: 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48 [ 204.830248] stack backtrace: [ 204.830250] CPU: 2 PID: 1034 Comm: bash Tainted: G W 5.5.0-rc2-06072-gbc03ecc9a672 #6 [ 204.830252] Hardware name: IBM 8561 T01 703 (LPAR) [ 204.830253] Call Trace: [ 204.830257] [<00000000c05e10c0>] show_stack+0x88/0xf0 [ 204.830260] [<00000000c112dca4>] dump_stack+0xa4/0xe0 [ 204.830261] [<00000000c0694c06>] check_noncircular+0x1e6/0x240 [ 204.830263] [<00000000c0695bec>] check_prev_add+0xfc/0xdb0 [ 204.830264] [<00000000c06971da>] validate_chain+0x93a/0xd08 [ 204.830266] [<00000000c06994c6>] __lock_acquire+0x4ae/0x9d0 [ 204.830267] [<00000000c069867c>] lock_acquire+0x114/0x280 [ 204.830269] [<00000000c09ca15c>] __kernfs_remove.part.0+0x2e4/0x360 [ 204.830270] [<00000000c09cb5c4>] kernfs_remove_by_name_ns+0x5c/0xa8 [ 204.830272] [<00000000c09cee14>] remove_files.isra.0+0x4c/0x98 [ 204.830274] [<00000000c09cf2ae>] sysfs_remove_group+0x66/0xc8 [ 204.830276] [<00000000c09cf356>] sysfs_remove_groups+0x46/0x68 [ 204.830278] [<00000000c0e3dfe2>] device_remove_attrs+0x52/0x90 [ 204.830280] [<00000000c0e40382>] device_del+0x182/0x418 [ 204.830281] [<00000000c0dcfd7a>] pci_remove_bus_device+0x8a/0x130 [ 204.830283] [<00000000c0dcfe92>] pci_stop_and_remove_bus_device_locked+0x3a/0x48 [ 204.830285] [<00000000c0de7190>] disable_slot+0x68/0x100 [ 204.830286] [<00000000c0de6514>] power_write_file+0x7c/0x130 [ 204.830288] [<00000000c09cc846>] kernfs_fop_write+0xe6/0x218 [ 204.830290] [<00000000c08f3480>] vfs_write+0xb0/0x1b8 [ 204.830291] [<00000000c08f378c>] ksys_write+0x6c/0xf8 [ 204.830293] [<00000000c1154374>] system_call+0xd8/0x2d8 [ 204.830294] INFO: lockdep is turned off. Signed-off-by: Niklas Schnelle Reviewed-by: Peter Oberparleiter Signed-off-by: Vasily Gorbik commit 17cdec960cf776b20b1fb08c622221babe591d51 Author: Niklas Schnelle Date: Tue Dec 17 09:34:46 2019 +0100 s390/pci: Recover handle in clp_set_pci_fn() When we try to recover a PCI function using echo 1 > /sys/bus/pci/devices//recover or manually with echo 1 > /sys/bus/pci/devices//remove echo 0 > /sys/bus/pci/slots//power echo 1 > /sys/bus/pci/slots//power clp_disable_fn() / clp_enable_fn() call clp_set_pci_fn() to first disable and then reenable the function. When the function is already in the requested state we may be left with an invalid function handle. To get a new valid handle we do a clp_list_pci() call. For this we need both the function ID and function handle in clp_set_pci_fn() so pass the zdev and get both. To simplify things also pull setting the refreshed function handle into clp_set_pci_fn() Signed-off-by: Niklas Schnelle Reviewed-by: Peter Oberparleiter Signed-off-by: Vasily Gorbik commit 34423f250a372d71346922edf2b84a19d811a311 Author: Steven Rostedt (VMware) Date: Wed Jan 22 06:44:50 2020 -0500 tracing: Fix uninitialized buffer var on early exit to trace_vbprintk() If we exit due to a bad input to trace_printk() (highly unlikely), then the buffer variable will not be initialized when we unnest the ring buffer. Reported-by: kbuild test robot Signed-off-by: Steven Rostedt (VMware) commit bc206065944e2d6bd917e719dc897ffff8dbbca8 Merge: ab3906c53144 2e8e1ea88cbc Author: Will Deacon Date: Wed Jan 22 11:38:53 2020 +0000 Merge branch 'for-next/rng' into for-next/core * for-next/rng: (2 commits) arm64: Use v8.5-RNG entropy for KASLR seed ... commit ab3906c53144837f1a192b5c3ba71ec2f938c187 Merge: aa246c056c43 275fa0ea2cf7 Author: Will Deacon Date: Wed Jan 22 11:35:05 2020 +0000 Merge branch 'for-next/errata' into for-next/core * for-next/errata: (3 commits) arm64: Workaround for Cortex-A55 erratum 1530923 ... commit aa246c056c43d41140c26706e519b498f056de8a Merge: 4f6cdf296cc4 73d6890fe8ff Author: Will Deacon Date: Wed Jan 22 11:34:21 2020 +0000 Merge branch 'for-next/asm-annotations' into for-next/core * for-next/asm-annotations: (6 commits) arm64: kernel: Correct annotation of end of el0_sync ... commit 4f6cdf296cc4b5b25c85bd04a84b59e562ce234b Merge: 3c23b83a88d0 8e3747beff8c c2c24edb1d9c e717d93b1c3f 3e3934176a4f d7bbd6c1b01c 1595fe299eb5 3751e728cef2 108eae2d4d10 52f73c383b24 9ee68b314e9a 500d14affdf7 Author: Will Deacon Date: Wed Jan 22 11:32:31 2020 +0000 Merge branches 'for-next/acpi', 'for-next/cpufeatures', 'for-next/csum', 'for-next/e0pd', 'for-next/entry', 'for-next/kbuild', 'for-next/kexec/cleanup', 'for-next/kexec/file-kdump', 'for-next/misc', 'for-next/nofpsimd', 'for-next/perf' and 'for-next/scs' into for-next/core * for-next/acpi: ACPI/IORT: Fix 'Number of IDs' handling in iort_id_map() * for-next/cpufeatures: (2 commits) arm64: Introduce ID_ISAR6 CPU register ... * for-next/csum: (2 commits) arm64: csum: Fix pathological zero-length calls ... * for-next/e0pd: (7 commits) arm64: kconfig: Fix alignment of E0PD help text ... * for-next/entry: (5 commits) arm64: entry: cleanup sp_el0 manipulation ... * for-next/kbuild: (4 commits) arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean' ... * for-next/kexec/cleanup: (11 commits) Revert "arm64: kexec: make dtb_mem always enabled" ... * for-next/kexec/file-kdump: (2 commits) arm64: kexec_file: add crash dump support ... * for-next/misc: (12 commits) arm64: entry: Avoid empty alternatives entries ... * for-next/nofpsimd: (7 commits) arm64: nofpsmid: Handle TIF_FOREIGN_FPSTATE flag cleanly ... * for-next/perf: (2 commits) perf/imx_ddr: Fix cpu hotplug state cleanup ... * for-next/scs: (6 commits) arm64: kernel: avoid x18 in __cpu_soft_restart ... commit e717d93b1c3f5e263c6c43b6ff0835a1279cb6fc Author: Will Deacon Date: Wed Jan 22 11:23:54 2020 +0000 arm64: kconfig: Fix alignment of E0PD help text Remove the additional space. Signed-off-by: Will Deacon commit 8b7e20a7ba54836076ff35a28349dabea4cec48f Author: Masami Hiramatsu Date: Wed Jan 22 13:11:54 2020 +0900 x86/decoder: Add TEST opcode to Group3-2 Add TEST opcode to Group3-2 reg=001b as same as Group3-1 does. Commit 12a78d43de76 ("x86/decoder: Add new TEST instruction pattern") added a TEST opcode assignment to f6 XX/001/XXX (Group 3-1), but did not add f7 XX/001/XXX (Group 3-2). Actually, this TEST opcode variant (ModRM.reg /1) is not described in the Intel SDM Vol2 but in AMD64 Architecture Programmer's Manual Vol.3, Appendix A.2 Table A-6. ModRM.reg Extensions for the Primary Opcode Map. Without this fix, Randy found a warning by insn_decoder_test related to this issue as below. HOSTCC arch/x86/tools/insn_decoder_test HOSTCC arch/x86/tools/insn_sanity TEST posttest arch/x86/tools/insn_decoder_test: warning: Found an x86 instruction decoder bug, please report this. arch/x86/tools/insn_decoder_test: warning: ffffffff81000bf1: f7 0b 00 01 08 00 testl $0x80100,(%rbx) arch/x86/tools/insn_decoder_test: warning: objdump says 6 bytes, but insn_get_length() says 2 arch/x86/tools/insn_decoder_test: warning: Decoded and checked 11913894 instructions with 1 failures TEST posttest arch/x86/tools/insn_sanity: Success: decoded and checked 1000000 random instructions with 0 errors (seed:0x871ce29c) To fix this error, add the TEST opcode according to AMD64 APM Vol.3. [ bp: Massage commit message. ] Reported-by: Randy Dunlap Signed-off-by: Masami Hiramatsu Signed-off-by: Borislav Petkov Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lkml.kernel.org/r/157966631413.9580.10311036595431878351.stgit@devnote2 commit f59bbfc2f6099e8655f9e8f585e10ffde17176d0 Author: Alexei Starovoitov Date: Tue Jan 21 18:41:38 2020 -0800 bpf: Fix error path under memory pressure Restore the 'if (env->cur_state)' check that was incorrectly removed during code move. Under memory pressure env->cur_state can be freed and zeroed inside do_check(). Hence the check is necessary. Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification") Reported-by: syzbot+b296579ba5015704d9fa@syzkaller.appspotmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20200122024138.3385590-1-ast@kernel.org commit 216bbaa337bf240dc8c2ac413f0a0f3cf08ee338 Author: Andrew Murray Date: Wed Jan 22 10:18:31 2020 +0000 MAINTAINERS: Update my email address I will lose access to my @arm.com email address next week, so let's update the MAINTAINERS file and map it correctly in .mailmap Signed-off-by: Andrew Murray Signed-off-by: Lorenzo Pieralisi commit 05d57f1793fb250c85028c9952c3720010baa853 Author: Alexei Starovoitov Date: Mon Jan 20 19:22:31 2020 -0800 bpf: Fix trampoline usage in preempt Though the second half of trampoline page is unused a task could be preempted in the middle of the first half of trampoline and two updates to trampoline would change the code from underneath the preempted task. Hence wait for tasks to voluntarily schedule or go to userspace. Add similar wait before freeing the trampoline. Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline") Reported-by: Jann Horn Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Paul E. McKenney Link: https://lore.kernel.org/bpf/20200121032231.3292185-1-ast@kernel.org commit 2e8e1ea88cbcb19a77b7acb67f6ffe39cc15740c Author: Mark Brown Date: Tue Jan 21 12:58:53 2020 +0000 arm64: Use v8.5-RNG entropy for KASLR seed When seeding KALSR on a system where we have architecture level random number generation make use of that entropy, mixing it in with the seed passed by the bootloader. Since this is run very early in init before feature detection is complete we open code rather than use archrandom.h. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Reviewed-by: Ard Biesheuvel Signed-off-by: Will Deacon commit 1a50ec0b3b2e9a83f1b1245ea37a853aac2f741c Author: Richard Henderson Date: Tue Jan 21 12:58:52 2020 +0000 arm64: Implement archrandom.h for ARMv8.5-RNG Expose the ID_AA64ISAR0.RNDR field to userspace, as the RNG system registers are always available at EL0. Implement arch_get_random_seed_long using RNDR. Given that the TRNG is likely to be a shared resource between cores, and VMs, do not explicitly force re-seeding with RNDRRS. In order to avoid code complexity and potential issues with hetrogenous systems only provide values after cpufeature has finalized the system capabilities. Signed-off-by: Richard Henderson [Modified to only function after cpufeature has finalized the system capabilities and move all the code into the header -- broonie] Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Reviewed-by: Ard Biesheuvel [will: Advertise HWCAP via /proc/cpuinfo] Signed-off-by: Will Deacon commit 1ddeb5a74ab6941dfd310b73c8554c393c70c2ef Author: Andy Shevchenko Date: Thu Jan 16 00:41:24 2020 +0200 tty: baudrate: SPARC supports few more baud rates According to termbits.h SPARC supports few more baud rates than currently defined in tty_baudrate.c. Append supported ones to baud_table[] and baud_bits[]. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20200115224124.74684-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6ada6064b239f5e8e3d4dae0717d3ced437d0527 Author: Andy Shevchenko Date: Thu Jan 16 00:41:23 2020 +0200 tty: baudrate: Synchronise baud_table[] and baud_bits[] Synchronize baud rate tables baud_table and baud_bits with each other for better readability. This makes clear what is being used for SPARC. No functional change intended. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20200115224124.74684-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8412ba1db8250087eb5d6e3525254df3be79dc3e Author: Julien Masson Date: Tue Jan 21 18:22:52 2020 +0100 tty: serial: meson_uart: Add support for kernel debugger The kgdb invokes the poll_put_char and poll_get_char when communicating with the host. This patch implement the serial polling hooks for the meson_uart to be used for KGDB debugging over serial line. Signed-off-by: Julien Masson Link: https://lore.kernel.org/r/867e1klo48.fsf@julienm-fedora-R90NQGV9.i-did-not-set--mail-host-address--so-tickle-me Signed-off-by: Greg Kroah-Hartman commit 101aa46bd221b768dfff8ef3745173fc8dbb85ee Author: Uwe Kleine-König Date: Tue Jan 21 08:17:02 2020 +0100 serial: imx: fix a race condition in receive path The main irq handler function starts by first masking disabled interrupts in the status register values to ensure to only handle enabled interrupts. This is important as when the RX path in the hardware is disabled reading the RX fifo results in an external abort. This checking must be done under the port lock, otherwise the following can happen: CPU1 | CPU2 | irq triggers as there are chars | in the RX fifo | | grab port lock imx_uart_int finds RRDY enabled | and calls imx_uart_rxint which | has to wait for port lock | | disable RX (e.g. because we're | using RS485 with !RX_DURING_TX) | | release port lock read from RX fifo with RX | disabled => exception | So take the port lock only once in imx_uart_int() instead of in the functions called from there. Reported-by: Andre Renaud Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20200121071702.20150-1-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit 48d414a3f2ecd995b65e52df3f8d6b5d0e8d026b Author: Lukas Wunner Date: Thu Jan 16 13:14:06 2020 +0100 serial: 8250_bcm2835aux: Document struct bcm2835aux_data Document the driver private data of the BCM2835 auxiliary UART so that upcoming commits may add further members with proper kerneldoc. Signed-off-by: Lukas Wunner Reviewed-by: Matthias Brugger Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/aea363c27fd541dba96d2ebfeee4f596c6d34932.1579175223.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit 644d776c7729e7a9cc04ee0587a82fe0d83252f0 Author: Lukas Wunner Date: Thu Jan 16 13:14:05 2020 +0100 serial: 8250_bcm2835aux: Use generic remapping code On probe the bcm2835aux UART driver misreports the register base address as 0x0: ttyS0 at MMIO 0x0 (irq = 53, base_baud = 50000000) is a 16550 That's because the driver remaps the registers itself. Take advantage of the generic remapping code in serial8250_request_std_resource() to get a message with the correct address and to simplify the driver. Signed-off-by: Lukas Wunner Cc: Martin Sperl Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/7d1a9bdb05090d8e465fd15cd26d6e81538d07f9.1579175223.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit 8c3cde5dd639afc7a17fb1e78f4579735a1c95e6 Author: Lukas Wunner Date: Thu Jan 16 13:14:04 2020 +0100 serial: 8250_bcm2835aux: Allocate uart_8250_port on stack The bcm2835aux UART driver stores a struct uart_8250_port in its private data even though it's only passed once to serial8250_register_8250_port() (which copies all relevant data) and becomes obsolete afterwards. Allocate the struct on the stack instead for simplicity and to conserve memory. The driver also initializes a spinlock in the struct which is never used. Drop that as well. Signed-off-by: Lukas Wunner Cc: Martin Sperl Reviewed-by: Matthias Brugger Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/421d3aed4c34cc8447ac9c26c320961f1b787f11.1579175223.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit e2f2a994ad7ce98f01e833a778e22b1813eb5586 Author: Lukas Wunner Date: Thu Jan 16 13:14:03 2020 +0100 serial: 8250_bcm2835aux: Suppress register_port error on -EPROBE_DEFER Suppress a gratuitous error message if serial8250_register_8250_port() returns -EPROBE_DEFER. Signed-off-by: Lukas Wunner Reviewed-by: Matthias Brugger Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/6aea0eacf3bfa73fe2d81082cc723265413410c8.1579175223.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit 324c0a1432110bf1bb778c03b52e5bcb3b8aa228 Author: Phil Elwell Date: Thu Jan 16 13:14:02 2020 +0100 serial: 8250_bcm2835aux: Suppress clk_get error on -EPROBE_DEFER Suppress a gratuitous error message if devm_clk_get() returns -EPROBE_DEFER. Signed-off-by: Phil Elwell [lukas: extend commit message] Signed-off-by: Lukas Wunner Reviewed-by: Matthias Brugger Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/deafc13cdfd7a31c6a81b0db95adcd3599accc26.1579175223.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit dc76697d7e933d5e299116f219c890568785ea15 Author: Lukas Wunner Date: Thu Jan 16 13:14:01 2020 +0100 serial: 8250_bcm2835aux: Fix line mismatch on driver unbind Unbinding the bcm2835aux UART driver raises the following error if the maximum number of 8250 UARTs is set to 1 (via the 8250.nr_uarts module parameter or CONFIG_SERIAL_8250_RUNTIME_UARTS): (NULL device *): Removing wrong port: a6f80333 != fa20408b That's because bcm2835aux_serial_probe() retrieves UART line number 1 from the devicetree and stores it in data->uart.port.line, while serial8250_register_8250_port() instead uses UART line number 0, which is stored in data->line. On driver unbind, bcm2835aux_serial_remove() uses data->uart.port.line, which contains the wrong number. Fix it. The issue does not occur if the maximum number of 8250 UARTs is >= 2. Fixes: bdc5f3009580 ("serial: bcm2835: add driver for bcm2835-aux-uart") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.6+ Cc: Martin Sperl Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/912ccf553c5258135c6d7e8f404a101ef320f0f4.1579175223.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit eb7a3bb8c955b3694e0e0998413ce1563c02f90c Author: Thomas Hebb Date: Mon Jan 20 06:09:06 2020 -0800 usb: typec: fusb302: fix "op-sink-microwatt" default that was in mW commit 8f6244055bd3 ("usb: typec: fusb302: Always provide fwnode for the port") didn't convert this value from mW to uW when migrating to a new specification format like it should have. Fixes: 8f6244055bd3 ("usb: typec: fusb302: Always provide fwnode for the port") Cc: stable@vger.kernel.org Signed-off-by: Thomas Hebb Reviewed-by: Heikki Krogerus Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/0da564559af75ec829c6c7e3aa4024f857c91bee.1579529334.git.tommyhebb@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0e64350bf4668d0fbbfec66fd8e637b971b4e976 Author: Thomas Hebb Date: Mon Jan 20 06:09:05 2020 -0800 usb: typec: wcove: fix "op-sink-microwatt" default that was in mW commit 4c912bff46cc ("usb: typec: wcove: Provide fwnode for the port") didn't convert this value from mW to uW when migrating to a new specification format like it should have. Fixes: 4c912bff46cc ("usb: typec: wcove: Provide fwnode for the port") Cc: stable@vger.kernel.org Signed-off-by: Thomas Hebb Reviewed-by: Heikki Krogerus Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/d8be32512efd31995ad7d65b27df9d443131b07c.1579529334.git.tommyhebb@gmail.com Signed-off-by: Greg Kroah-Hartman commit f5ae8869095552e3396ee3e404f9586cc6a828f0 Author: Heikki Krogerus Date: Fri Jan 17 12:30:33 2020 +0300 usb: dwc3: pci: add ID for the Intel Comet Lake -V variant There is one more Comet Lake PCH variant, CML-V, that has its own PCI ID. Signed-off-by: Heikki Krogerus Cc: stable Link: https://lore.kernel.org/r/20200117093033.48616-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3ba76256fc4e2a0d7fb26cc95459041ea0e88972 Author: Jun Li Date: Mon Jan 20 06:43:19 2020 +0000 usb: typec: tcpci: mask event interrupts when remove driver This is to prevent any possible events generated while unregister tpcm port. Fixes: 74e656d6b055 ("staging: typec: Type-C Port Controller Interface driver (tcpci)") Signed-off-by: Li Jun Reviewed-by: Heikki Krogerus Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1579502333-4145-1-git-send-email-jun.li@nxp.com Signed-off-by: Greg Kroah-Hartman commit 943063b65d93fb396cab55764e1075e50e1cd331 Author: Stephen Boyd Date: Tue Jan 21 16:49:58 2020 -0800 platform/chrome: cros_ec: Drop unaligned.h include This include isn't used. Remove it. Signed-off-by: Stephen Boyd Signed-off-by: Enric Balletbo i Serra commit 60fb8a8e93ca94e752a509bb3f6f74068ccca739 Author: Stephen Boyd Date: Tue Jan 21 17:24:34 2020 -0800 platform/chrome: wilco_ec: Allow wilco to be compiled in COMPILE_TEST Enable this Kconfig on COMPILE_TEST enabled configs so we can get more build coverage. Signed-off-by: Stephen Boyd Signed-off-by: Enric Balletbo i Serra commit a532149c992eed9f8523d4ed5960b0068f213cd7 Author: Stephen Boyd Date: Tue Jan 21 16:40:32 2020 -0800 platform/chrome: wilco_ec: Add newlines to printks printk messages all require newlines, or it looks very odd in the log when messages are not on different lines. Add them. Cc: Nick Crews Cc: Daniel Campello Cc: Enric Balletbo i Serra Signed-off-by: Stephen Boyd Signed-off-by: Enric Balletbo i Serra commit e1f236efd9c579a29d7df75aa052127d0d975267 Author: Peter Robinson Date: Mon Jan 20 14:19:10 2020 +0000 usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 Set the MODULE_FIRMWARE for tegra186, it's registered for 124/210 and ensures the firmware is available at the appropriate time such as in the initrd, else if the firmware is unavailable the driver fails with the following errors: tegra-xusb 3530000.usb: Direct firmware load for nvidia/tegra186/xusb.bin failed with error -2 tegra-xusb 3530000.usb: failed to request firmware: -2 tegra-xusb 3530000.usb: failed to load firmware: -2 tegra-xusb: probe of 3530000.usb failed with error -2 Fixes: 5f9be5f3f899 ("usb: host: xhci-tegra: Add Tegra186 XUSB support") Signed-off-by: Peter Robinson Acked-by: Thierry Reding Cc: stable Link: https://lore.kernel.org/r/20200120141910.116097-1-pbrobinson@gmail.com Signed-off-by: Greg Kroah-Hartman commit 10d3e38c7923853967cea97513213bba923dde64 Merge: 3634a4a80f3d 30c8fa3ec61a Author: Greg Kroah-Hartman Date: Wed Jan 22 10:04:39 2020 +0100 Merge tag 'icc-5.6-rc1' of https://git.linaro.org/people/georgi.djakov/linux into char-misc-next Georgi writes: interconnect patches for 5.6 Here are the interconnect patches for the 5.6-rc1 merge window. - New core helper functions for some common functionalities in drivers. - Improvements in the information exposed via debugfs. - Basic tracepoints support. - New interconnect driver for msm8916 platforms. - Misc fixes. Signed-off-by: Georgi Djakov * tag 'icc-5.6-rc1' of https://git.linaro.org/people/georgi.djakov/linux: interconnect: qcom: Add MSM8916 interconnect provider driver dt-bindings: interconnect: Add Qualcomm MSM8916 DT bindings interconnect: Check for valid path in icc_set_bw() interconnect: Print the tag in the debugfs summary interconnect: Add interconnect_graph file to debugfs interconnect: qcom: Use the standard aggregate function interconnect: Add a common standard aggregate function interconnect: Add basic tracepoints interconnect: Add a name to struct icc_path interconnect: Move internal structs into a separate file interconnect: qcom: Use the new common helper for node removal interconnect: Add a common helper for removing all nodes commit 3634a4a80f3d3d89545f04dd0145736a50c53659 Merge: 559e575a8946 28910cee898c Author: Greg Kroah-Hartman Date: Wed Jan 22 10:02:45 2020 +0100 Merge tag 'fpga-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-next Moritz writes: Here is the first set of FPGA changes for 5.6 The first two patches are minor cleanups to the DFL drivers, that remove unused warnings. The third patch removes a redundant error message to the ts73xx driver. The last patch removes a confusing print in case a call to devm_clk_get returns -EPROBE_DEFER. All patches have been reviewed on the mailing list and have been in the last couple of linux-next releases without issues. Signed-off-by: Moritz Fischer * tag 'fpga-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga: fpga: xilinx-pr-decoupler: Remove clk_get error message for probe defer fpga: remove redundant dev_err message fpga: dfl: afu: remove set but not used variable 'afu' fpga: dfl: fme: remove set but not used variable 'fme' commit 559e575a8946a6561dfe8880de341d4ef78d5994 Author: Tomas Winkler Date: Sun Jan 19 11:42:29 2020 +0200 mei: me: add comet point (lake) H device ids Add Comet Point device IDs for Comet Lake H platforms. Cc: Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20200119094229.20116-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 0443b3f4436321e1098fdf74432c8867016339da Author: Quentin Deslandes Date: Tue Jan 21 10:40:24 2020 +0000 staging: axis-fifo: replace spinlock with mutex Following the device's documentation guidance, reading a packet from the device or writing a packet to it must be atomic. Previously, only reading device's vacancy (before writing on it) or occupancy (before reading from it) was locked. Hence, effectively reading the packet or writing the packet wasn't locked at all. However, reading a packet (and writing one, to a lesser extent) requires to read 3 different registers in a specific order, without missing one or else we should reset the device. This patch fixes the device's locking mechanism on the FIFO character device. As the device was using copy_from_user() and copy_to_user(), we need to replace spinlocks with mutexes. Signed-off-by: Quentin Deslandes Link: https://lore.kernel.org/r/20200121103958.12941-1-quentin.deslandes@itdev.co.uk Signed-off-by: Greg Kroah-Hartman commit b17028d289d37e828a66a6cfd614cd4723334ace Author: Ajay Singh Date: Fri Jan 17 10:31:27 2020 +0000 staging: wilc1000: remove unused code prior to throughput enhancement in SPI The firmware now uses throughput enhancement code by default for SPI so remove the previous implementation as its not used anymore. Removed the use of 'has_thrpt_enh' element as its always true. Signed-off-by: Ajay Singh Link: https://lore.kernel.org/r/20200117160157.8706-5-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman commit 1d58fec42fdf6098d8e34c679d3377bb87866add Author: Ajay Singh Date: Fri Jan 17 10:31:26 2020 +0000 staging: wilc1000: added 'wilc_' prefix for 'struct assoc_resp' name Use 'wilc_' prefix for 'assoc_resp' struct to have proper naming convention. Signed-off-by: Ajay Singh Link: https://lore.kernel.org/r/20200117160157.8706-4-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman commit c5295d1a41fe2f1bd0877f74817a3b63b989b10e Author: Ajay Singh Date: Fri Jan 17 10:31:25 2020 +0000 staging: wilc1000: move firmware API struct's to separate header file It's recommended to keep the 'struct' used for passing data to firmware in separate header file. So added 'fw.h' header file to keep struct's used to pass data to firmware. Signed-off-by: Ajay Singh Link: https://lore.kernel.org/r/20200117160157.8706-3-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman commit 9d442d2b9add140ddc2c5de6a0ac93050dfaef16 Author: Ajay Singh Date: Fri Jan 17 10:31:23 2020 +0000 staging: wilc1000: remove use of infinite loop conditions Avoid the use of 'while (1)' infinite loop conditions. It's not recommended to have infinite loop in kernel code because a small bug can cause never ending loops so use terminator condition as suggested in full driver review [1]. [1]. https://lore.kernel.org/linux-wireless/20191023100313.52B3F606CF@smtp.codeaurora.org/ Signed-off-by: Ajay Singh Link: https://lore.kernel.org/r/20200117160157.8706-2-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman commit b5909c6d16fd4e3972b0cd48dedde08d55575342 Author: Jerry Lin Date: Tue Jan 21 10:46:21 2020 +0800 staging: kpc2000: rename variables with kpc namespace Some namings in kpc2000_i2c are too ambiguous that may causing confusion to the readers. Rename some variable, function and struct name to prefix with 'kpc_i2c' to eliminate confusions. Signed-off-by: Jerry Lin Link: https://lore.kernel.org/r/20200121024620.GA10842@compute1 Signed-off-by: Greg Kroah-Hartman commit 747a64bd01f869f8b987e17992bba1db8108161a Author: Malcolm Priestley Date: Sun Jan 19 12:04:34 2020 +0000 staging: vt6656: Remove memory buffer from vnt_download_firmware. The memory buffer is being done twice here as vnt_control_out passes it straight to kmemdup. Remove buffer and add const to the variable in vnt_control_out to pass the pointer to it. Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/be025ed0-204d-e957-4bc9-963e841fcb2c@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1ca9c731057994e5b1f98e9869127af61f3c0cd3 Author: Malcolm Priestley Date: Sun Jan 19 12:04:05 2020 +0000 staging: vt6656: Just check NEWRSR_DECRYPTOK for RX_FLAG_DECRYPTED. At present the driver does a number of checks for RX_FLAG_DECRYPTED. Remove all these and just pass check NEWRSR_DECRYPTOK mac80211 will handle the processing of the sk_buff and dispose of it. This means that mac80211 can do unsupported encryption modes on stack. Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/75bbaa08-2465-b057-64ce-b67933409bc6@gmail.com Signed-off-by: Greg Kroah-Hartman commit b653174327e989cbc97f545ce33d30e1fe9de532 Author: Malcolm Priestley Date: Sun Jan 19 12:03:41 2020 +0000 staging: vt6656: Use vnt_rx_tail struct for tail variables. Place tsf_time, sq, new_rsr, rssi, rsr and sq3 packed in the structure. Unused variables are removed along with skb_data and structure is placed beyond vnt_rx_header + pay_load_with_padding on skb->data. Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/6ac6eae0-7b71-fefe-9230-da3b345b634b@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8902ecd70b3e3f13370af9f9e0134ad16e46fb50 Author: Malcolm Priestley Date: Sun Jan 19 12:02:56 2020 +0000 staging: vt6656: create vnt rx header for sk_buff. vnt_rx_header contains the structure of the original variables wbk_status, rx_sts, rx_rate and pay_load_len packed. Replace all the old variables for the ones in this. Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/094ee227-b114-ee75-67f7-bf07f8de099f@gmail.com Signed-off-by: Greg Kroah-Hartman commit 743b2b7e08c76d3090373e9cd354edef6a0822b7 Author: Malcolm Priestley Date: Sun Jan 19 12:02:24 2020 +0000 staging: vt6656: Simplify RX finding bit rates The bit rate can be found by multiplying the rate value by 5. Use rx_bitrate to compared to sband bitrates removing the need to find it by hw_value. Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/50d3c4b8-6d17-4fae-ce9c-88a50614450f@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4d1356ac12f4d5180d0df345d85ff0ee42b89c72 Author: Andrey Shvetsov Date: Thu Jan 16 18:22:39 2020 +0100 staging: most: net: fix buffer overflow If the length of the socket buffer is 0xFFFFFFFF (max size for an unsigned int), then payload_len becomes 0xFFFFFFF1 after subtracting 14 (ETH_HLEN). Then, mdp_len is set to payload_len + 16 (MDP_HDR_LEN) which overflows and results in a value of 2. These values for payload_len and mdp_len will pass current buffer size checks. This patch checks if derived from skb->len sum may overflow. The check is based on the following idea: For any `unsigned V1, V2` and derived `unsigned SUM = V1 + V2`, `V1 + V2` overflows iif `SUM < V1`. Reported-by: Greg Kroah-Hartman Signed-off-by: Andrey Shvetsov Cc: stable Link: https://lore.kernel.org/r/20200116172238.6046-1-andrey.shvetsov@microchip.com Signed-off-by: Greg Kroah-Hartman commit 7084eddf6be94e73f8298c1a28078b91536f2975 Author: Jerry Snitselaar Date: Wed Oct 30 15:58:43 2019 -0700 tpm: Add tpm_version_major sysfs file Easily determining what TCG version a tpm device implements has been a pain point for userspace for a long time, so add a sysfs file to report the TCG major version of a tpm device. Also add an entry to Documentation/ABI/stable/sysfs-class-tpm describing the new file. Cc: Jarkko Sakkinen Cc: Mimi Zohar Cc: Peter Huewe Cc: Jason Gunthorpe Cc: linux-integrity@vger.kernel.org Signed-off-by: Jerry Snitselaar Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 3063da91ca569ccafd6d07cd877d6d3588b2c85a Author: Michael Straube Date: Sat Jan 18 20:53:05 2020 +0100 staging: rtl8712: simplify evm_db2percentage() Use clamp() to simplify function evm_db2percentage() and reduce object file size. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20200118195305.16685-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 38c03040e24f7066cfa5b1718d07f0700ecb400b Author: Michael Straube Date: Sat Jan 18 20:53:04 2020 +0100 staging: rtl8192u: simplify rtl819x_evm_dbtopercentage() Use clamp() to simplify function rtl819x_evm_dbtopercentage() and reduce object file size. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20200118195305.16685-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 05ecd1038b0c06c4546e28fbe67732c3fa28ae10 Author: Michael Straube Date: Sat Jan 18 20:53:03 2020 +0100 staging: rtl8192e: simplify rtl92e_evm_db_to_percent() Use clamp() to simplify function rtl92e_evm_db_to_percent() and reduce object file size. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20200118195305.16685-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3cdab8823a50c208dbacaa8f1fb4a82ed2227ad9 Author: Michael Straube Date: Sat Jan 18 18:33:43 2020 +0100 staging: rtl8188eu: remove unused enum and defines IQK_BB_REG_NUM_MAX, RTL8711_RF_MAX_SENS, RTL8711_RF_DEF_SENS, NUM_REGULATORYS and enum _RTL8712_RF_MIMO_CONFIG_ are not used in the driver code, remove them. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20200118173343.32405-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2dda0602859350b3868367601253d29eeccfd50a Author: Michael Straube Date: Sat Jan 18 18:33:42 2020 +0100 staging: rtl8188eu: remove redundant defines Remove redundant defines from hal8188e_phy_cfg.h and rtl8188e_dm.h. All of them are defined in odm.h with the same values. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20200118173343.32405-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0b4d1d0da7e16f6faa572a8c7f865ff82e097819 Author: Michael Straube Date: Sat Jan 18 18:33:41 2020 +0100 staging: rtl8188eu: remove else after break or return Remove unnecessary else after break or return to improve readability and clear checkpatch warnings. WARNING: else is not generally useful after a break or return Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20200118173343.32405-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 27f391a5d628f860e2245f59f97461cbd22433f1 Author: Felipe Cardoso Resende Date: Thu Jan 16 21:42:14 2020 -0300 Staging: kpc2000: Remove warning: "dubious: x | !y" detected by sparse Sparse complains about "dubious: x | !y". This patch adds some macros to make it clear if a flag will be enabled or not so Sparse stops complaining about dubious code construct. Signed-off-by: Felipe Cardoso Resende Link: https://lore.kernel.org/r/20200117004214.GA1800@felipe-pc Signed-off-by: Greg Kroah-Hartman commit c269e876c5affd4d240d5fc85b29e9c9942d8465 Author: Jerry Snitselaar Date: Fri Oct 25 12:36:28 2019 -0700 tpm: Update mailing list contact information in sysfs-class-tpm All of the entries in Documentation/ABI/stable/sysfs-class-tpm point to the old tpmdd-devel mailing list. This patch updates the entries to point to linux-intergrity. Cc: Jarkko Sakkinen Cc: Peter Huewe Cc: Jason Gunthorpe Cc: linux-integrity@vger.kernel.org Signed-off-by: Jerry Snitselaar Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0bc81767c5bd9d005fae1099fb39eb3688370cb1 Author: Ard Biesheuvel Date: Fri Jan 17 17:43:18 2020 +0100 crypto: arm/chacha - fix build failured when kernel mode NEON is disabled When the ARM accelerated ChaCha driver is built as part of a configuration that has kernel mode NEON disabled, we expect the compiler to propagate the build time constant expression IS_ENABLED(CONFIG_KERNEL_MODE_NEON) in a way that eliminates all the cross-object references to the actual NEON routines, which allows the chacha-neon-core.o object to be omitted from the build entirely. Unfortunately, this fails to work as expected in some cases, and we may end up with a build error such as chacha-glue.c:(.text+0xc0): undefined reference to `chacha_4block_xor_neon' caused by the fact that chacha_doneon() has not been eliminated from the object code, even though it will never be called in practice. Let's fix this by adding some IS_ENABLED(CONFIG_KERNEL_MODE_NEON) tests that are not strictly needed from a logical point of view, but should help the compiler infer that the NEON code paths are unreachable in those cases. Fixes: b36d8c09e710c71f ("crypto: arm/chacha - remove dependency on generic ...") Reported-by: Russell King Cc: Arnd Bergmann Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7e2b89fb4a2e636ad94fe47b76257c3cc0234666 Author: Horia Geantă Date: Fri Jan 17 16:35:13 2020 +0200 crypto: caam - add support for i.MX8M Plus Add support for the crypto engine used in i.mx8mp (i.MX 8M "Plus"), which is very similar to the one used in i.mx8mq, i.mx8mm, i.mx8mn. Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu commit f9e7fe32a792726186301423ff63a465d63386e1 Author: Jason A. Donenfeld Date: Fri Jan 17 11:42:22 2020 +0100 crypto: x86/poly1305 - emit does base conversion itself The emit code does optional base conversion itself in assembly, so we don't need to do that here. Also, neither one of these functions uses simd instructions, so checking for that doesn't make sense either. Signed-off-by: Jason A. Donenfeld Signed-off-by: Herbert Xu commit 2203d3f7971d28a2bcd8e2439bcead9069089e9a Author: Colin Ian King Date: Fri Jan 17 09:28:19 2020 +0000 crypto: hisilicon - fix spelling mistake "disgest" -> "digest" There is a spelling mistake in an error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Herbert Xu commit 72c7943792c9e7788ddd182337bcf8f650cf56f5 Author: Jason A. Donenfeld Date: Thu Jan 16 21:26:34 2020 +0100 crypto: chacha20poly1305 - add back missing test vectors and test chunking When this was originally ported, the 12-byte nonce vectors were left out to keep things simple. I agree that we don't need nor want a library interface for 12-byte nonces. But these test vectors were specially crafted to look at issues in the underlying primitives and related interactions. Therefore, we actually want to keep around all of the test vectors, and simply have a helper function to test them with. Secondly, the sglist-based chunking code in the library interface is rather complicated, so this adds a developer-only test for ensuring that all the book keeping is correct, across a wide array of possibilities. Signed-off-by: Jason A. Donenfeld Signed-off-by: Herbert Xu commit 1f6868995326cc82102049e349d8dbd116bdb656 Author: Jason A. Donenfeld Date: Thu Jan 16 18:23:55 2020 +0100 crypto: x86/poly1305 - fix .gitignore typo Admist the kbuild robot induced changes, the .gitignore file for the generated file wasn't updated with the non-clashing filename. This commit adjusts that. Signed-off-by: Jason A. Donenfeld Signed-off-by: Herbert Xu commit 48d625e4c4cec813cdd1e439864a8ffc0b5081f1 Author: Colin Ian King Date: Thu Jan 16 15:48:52 2020 +0000 tee: fix memory allocation failure checks on drv_data and amdtee Currently the memory allocation failure checks on drv_data and amdtee are using IS_ERR rather than checking for a null pointer. Fix these checks to use the conventional null pointer check. Addresses-Coverity: ("Dereference null return") Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Signed-off-by: Colin Ian King Reviewed-by: Rijo Thomas Acked-by: Jens Wiklander Signed-off-by: Herbert Xu commit 38c0d0abf2685bf77a844e00f104038dd07257a6 Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:46 2020 +0200 crypto: ccree - erase unneeded inline funcs These inline versions of PM function for the case of CONFIG_PM is not set are never used. Erase them. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu commit bc88606ac030c4d89976e4dd8f00f31ba1640f2f Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:45 2020 +0200 crypto: ccree - make cc_pm_put_suspend() void cc_pm_put_suspend() return value was never checked and is not useful. Turn it into a void functions. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu commit 33c4b310981f351ce8fde485a8450177e4f3d133 Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:44 2020 +0200 crypto: ccree - split overloaded usage of irq field We were using the irq field of the drvdata struct in an overloaded fahsion - saving the IRQ number during init and then storing the pending itnerrupt sources during interrupt in the same field. This worked because these usage are mutually exclusive but are confusing. So simplify the code and change the init use case to use a simple local variable. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu commit 15fd2566bf54ee4d4781d8f170acfc9472a1541f Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:43 2020 +0200 crypto: ccree - fix PM race condition The PM code was racy, possibly causing the driver to submit requests to a powered down device. Fix the race and while at it simplify the PM code. Signed-off-by: Gilad Ben-Yossef Fixes: 1358c13a48c4 ("crypto: ccree - fix resume race condition on init") Cc: stable@kernel.org # v4.20 Signed-off-by: Herbert Xu commit 5c83e8ec4d51ac4cc58482ed04297e6882b32a09 Author: Ofir Drang Date: Thu Jan 16 12:14:42 2020 +0200 crypto: ccree - fix FDE descriptor sequence In FDE mode (xts, essiv and bitlocker) the cryptocell hardware requires that the the XEX key will be loaded after Key1. Signed-off-by: Ofir Drang Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu commit 8b0c4366cb08d5064b882e82e31b025da8b36c87 Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:41 2020 +0200 crypto: ccree - cc_do_send_request() is void func cc_do_send_request() cannot fail and always returns -EINPROGRESS. Turn it into a void function and simplify code. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu commit cedca59fae5834af8445b403c66c9953754375d7 Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:40 2020 +0200 crypto: ccree - fix pm wrongful error reporting pm_runtime_get_sync() can return 1 as a valid (none error) return code. Treat it as such. Signed-off-by: Gilad Ben-Yossef Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Herbert Xu commit c7b31c88da242153b3c2a2afe8486ae5c5f36556 Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:39 2020 +0200 crypto: ccree - turn errors to debug msgs We have several loud error log messages that are already reported via the normal return code mechanism and produce a lot of noise when the new testmgr extra test are enabled. Turn these into debug only messages Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu commit 2a6bc713f1cef32e39e3c4e6f2e1a9849da6379c Author: Gilad Ben-Yossef Date: Thu Jan 16 12:14:38 2020 +0200 crypto: ccree - fix AEAD decrypt auth fail On AEAD decryption authentication failure we are suppose to zero out the output plaintext buffer. However, we've missed skipping the optional associated data that may prefix the ciphertext. This commit fixes this issue. Signed-off-by: Gilad Ben-Yossef Fixes: e88b27c8eaa8 ("crypto: ccree - use std api sg_zero_buffer") Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu commit 684cf266eb04911825a6de10dadd188cf801d063 Author: Hadar Gat Date: Thu Jan 16 12:14:37 2020 +0200 crypto: ccree - fix typo in comment Fixed a typo in a commnet. Signed-off-by: Hadar Gat Signed-off-by: Herbert Xu commit 509f2885a2d216e1cfe7d995ce39ede120ddebc0 Author: Hadar Gat Date: Thu Jan 16 12:14:36 2020 +0200 crypto: ccree - fix typos in error msgs Fixed typos in ccree error msgs. Signed-off-by: Hadar Gat Signed-off-by: Herbert Xu commit b46f36c05ab40d8339ec08809f89e45b1817cf86 Author: Tudor Ambarus Date: Wed Jan 15 12:53:53 2020 +0000 crypto: atmel-{aes,sha,tdes} - Retire crypto_platform_data These drivers no longer need it as they are only probed via DT. crypto_platform_data was allocated but unused, so remove it. This is a follow up for: commit 45a536e3a7e0 ("crypto: atmel-tdes - Retire dma_request_slave_channel_compat()") commit db28512f48e2 ("crypto: atmel-sha - Retire dma_request_slave_channel_compat()") commit 62f72cbdcf02 ("crypto: atmel-aes - Retire dma_request_slave_channel_compat()") Signed-off-by: Tudor Ambarus Signed-off-by: Herbert Xu commit 41419a289010836bd759bf7e254fe041a3dc52d2 Author: Kees Cook Date: Tue Jan 14 19:57:29 2020 -0800 crypto: x86/sha - Eliminate casts on asm implementations In order to avoid CFI function prototype mismatches, this removes the casts on assembly implementations of sha1/256/512 accelerators. The safety checks from BUILD_BUG_ON() remain. Additionally, this renames various arguments for clarity, as suggested by Eric Biggers. Signed-off-by: Kees Cook Signed-off-by: Herbert Xu commit e0437dc6470c46a116aeb65769698dbc1487ed16 Author: Vinay Kumar Yadav Date: Tue Jan 14 17:58:48 2020 +0530 crypto: chtls - Fixed listen fail when max stid range reached Do not return error when max stid reached, to Fallback to nic mode. Signed-off-by: Vinay Kumar Yadav Signed-off-by: Herbert Xu commit c9f0d33c367fb4b8fd71ea70fc7fa22552d824a0 Author: Vinay Kumar Yadav Date: Tue Jan 14 17:58:47 2020 +0530 crypto: chtls - Corrected function call context corrected function call context and moved t4_defer_reply to apropriate location. Signed-off-by: Vinay Kumar Yadav Signed-off-by: Herbert Xu commit 53146d152510584c2034c62778a7cbca25743ce9 Author: Horia Geantă Date: Mon Jan 13 10:54:35 2020 +0200 crypto: caam/qi2 - fix typo in algorithm's driver name Fixes: 8d818c105501 ("crypto: caam/qi2 - add DPAA2-CAAM driver") Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu commit fd2d11cc8af46f50a71b16590275d5bad550c504 Merge: c20c76acf6ec def9d2780727 Author: Greg Kroah-Hartman Date: Wed Jan 22 09:08:01 2020 +0100 Merge 5.5-rc7 into char-misc-next We need the char-misc fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit c318f074d9fdeae16e19cbb2ed53b50d2bcdfdb8 Merge: 7b2d7faa09fc def9d2780727 Author: Greg Kroah-Hartman Date: Wed Jan 22 09:05:34 2020 +0100 Merge 5.5-rc7 into staging-next We want the staging fixes in here as well Signed-off-by: Greg Kroah-Hartman commit 0779221e7166c6865555bb6d29bf6af76fc316bd Author: Ard Biesheuvel Date: Sat Jan 18 17:57:05 2020 +0100 efi/x86: Disallow efi=old_map in mixed mode Before: 1f299fad1e31: ("efi/x86: Limit EFI old memory map to SGI UV machines") enabling the old EFI memory map on mixed mode systems disabled EFI runtime services altogether. Given that efi=old_map is a debug feature designed to work around firmware problems related to EFI runtime services, and disabling them can be achieved more straightforwardly using 'noefi' or 'efi=noruntime', it makes more sense to ignore efi=old_map on mixed mode systems. Currently, we do neither, and try to use the old memory map in combination with mixed mode routines, which results in crashes, so let's fix this by making efi=old_map functional on native systems only. Signed-off-by: Ard Biesheuvel Signed-off-by: Ingo Molnar commit 8728497895794d1f207a836e02dae762ad175d56 Author: Josh Poimboeuf Date: Mon Jan 20 12:14:09 2020 -0600 objtool: Skip samples subdirectory The code in the 'samples' subdirectory isn't part of the kernel, so there's no need to validate it. Reported-by: Randy Dunlap Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/c4cb4ef635ec606454ab834cb49fc3e9381fb1b1.1579543924.git.jpoimboe@redhat.com commit 8580bed7e751e6d4f17881e059daf3cb37ba4717 Author: Shile Zhang Date: Mon Jan 20 12:14:08 2020 -0600 objtool: Fix ARCH=x86_64 build error Building objtool with ARCH=x86_64 fails with: $make ARCH=x86_64 -C tools/objtool ... CC arch/x86/decode.o arch/x86/decode.c:10:22: fatal error: asm/insn.h: No such file or directory #include ^ compilation terminated. mv: cannot stat ‘arch/x86/.decode.o.tmp’: No such file or directory make[2]: *** [arch/x86/decode.o] Error 1 ... The root cause is that the command-line variable 'ARCH' cannot be overridden. It can be replaced by 'SRCARCH', which is defined in 'tools/scripts/Makefile.arch'. Signed-off-by: Shile Zhang Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Reviewed-by: Kamalesh Babulal Link: https://lore.kernel.org/r/d5d11370ae116df6c653493acd300ec3d7f5e925.1579543924.git.jpoimboe@redhat.com commit 6ec14aa7a58a1c2fb303692f8cb1ff82d9abd10a Author: Olof Johansson Date: Mon Jan 20 12:14:07 2020 -0600 objtool: Silence build output The sync-check.sh script prints out the path due to a "cd -" at the end of the script, even on silent builds. This isn't even needed, since the script is executed in our build instead of sourced (so it won't change the working directory of the surrounding build anyway). Just remove the cd to make the build silent. Fixes: 2ffd84ae973b ("objtool: Update sync-check.sh from perf's check-headers.sh") Signed-off-by: Olof Johansson Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/cb002857fafa8186cfb9c3e43fb62e4108a1bab9.1579543924.git.jpoimboe@redhat.com commit 9d69cd82fe02619ec68e5d770283576712188874 Author: Jun Li Date: Wed Jan 22 01:47:02 2020 +0000 usb: chipidea: add inline for ci_hdrc_host_driver_init if host is not defined Otherwise, there is a build warning if this header file is included by non host source file, eg, otg.c. Signed-off-by: Jun Li Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/20200122014639.22667-3-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit 27bf5be8fbe0b60b1f1aa13083198dac64fc4249 Author: Jun Li Date: Wed Jan 22 01:46:59 2020 +0000 usb: chipidea: handle single role for usb role class If usb port is configed to be single role, but usb role class is trying to set unavailable role, don't try to do role change. Signed-off-by: Jun Li Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/20200122014639.22667-2-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit 734b188136faed64b528a5a5559a32a2b8294c39 Author: Samuel Holland Date: Tue Jan 21 22:04:00 2020 -0800 Input: axp20x-pek - enable wakeup for all AXP variants There are many devices, including several mobile battery-powered devices, using other AXP variants as their PMIC. Allow them to use the power key as a wakeup source. Reviewed-by: Hans de Goede Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20200115051253.32603-3-samuel@sholland.org Signed-off-by: Dmitry Torokhov commit fe77f9bb1185e6986fd0246cf16f02954d7a09bf Author: Samuel Holland Date: Tue Jan 21 22:03:14 2020 -0800 Input: axp20x-pek - respect userspace wakeup configuration Unlike most other power button drivers, this driver unconditionally enables its wakeup IRQ. It should be using device_may_wakeup() to respect the userspace configuration of wakeup sources. Because the AXP20x MFD device uses regmap-irq, the AXP20x PEK IRQs are nested off of regmap-irq's threaded interrupt handler. The device core ignores such interrupts, so to actually disable wakeup, we must explicitly disable all non-wakeup interrupts during suspend. Signed-off-by: Samuel Holland Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20200115051253.32603-2-samuel@sholland.org Signed-off-by: Dmitry Torokhov commit 3bed1b7b9d79ca40e41e3af130931a3225e951a3 Author: Masahiro Yamada Date: Sat Jan 18 02:14:35 2020 +0900 kbuild: use -S instead of -E for precise cc-option test in Kconfig Currently, -E (stop after the preprocessing stage) is used to check whether the given compiler flag is supported. While it is faster than -S (or -c), it can be false-positive. You need to run the compilation proper to check the flag more precisely. For example, -E and -S disagree about the support of "--param asan-instrument-allocas=1". $ gcc -Werror --param asan-instrument-allocas=1 -E -x c /dev/null -o /dev/null $ echo $? 0 $ gcc -Werror --param asan-instrument-allocas=1 -S -x c /dev/null -o /dev/null cc1: error: invalid --param name ‘asan-instrument-allocas’; did you mean ‘asan-instrument-writes’? $ echo $? 1 Signed-off-by: Masahiro Yamada commit 660b94e0d8fecc54478384e0e43c3f8fe931957c Merge: e42617b825f8 6c3090520554 Author: Stephen Boyd Date: Tue Jan 21 16:18:11 2020 -0800 Merge tag 'ti-clk-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux into clk-ti Pull TI clk driver updates from Tero Kristo: - cam, vpe and sgx clock support for dra7 - fix gmac main clock for dra7 - aess clock support for omap5 - move dra7-atl clock header to correct location - fix hidden node name dependency on clkctrl clocks * tag 'ti-clk-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux: clk: ti: clkctrl: Fix hidden dependency to node name clk: ti: add clkctrl data dra7 sgx clk: ti: omap5: Add missing AESS clock clk: ti: dra7: fix parent for gmac_clkctrl clk: ti: dra7: add vpe clkctrl data clk: ti: dra7: add cam clkctrl data dt-bindings: clock: Move ti-dra7-atl.h to dt-bindings/clock commit cb36017a8b1b582bcb7063e44c598c3e36aa0228 Author: Baolin Wang Date: Wed Jan 8 11:23:46 2020 +0800 hwspinlock: sirf: Use devm_hwspin_lock_register() to register hwlock controller Use devm_hwspin_lock_register() to register the hwlock controller instead of unregistering the hwlock controller explicitly when removing the device. Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/8f94e67b5f9af20a93418a2fc9cc71b194f1285c.1578453662.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit 8f2a0dc87dad7f5c644fc9210a1efb4617acd6a1 Author: Baolin Wang Date: Wed Jan 8 11:23:45 2020 +0800 hwspinlock: sirf: Remove redundant PM runtime functions Since the hwspinlock core has changed the PM runtime to be optional, and the SIRF hardware spinlock has no pm runtime requirement, thus remove these redundant PM runtime functions. Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/c921e391aa2a652d8d6ae0e4041202cec9d917e7.1578453662.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit 77d99a6a9df2ac3d1832b408123e48549d1e01fd Author: Baolin Wang Date: Wed Jan 8 11:23:44 2020 +0800 hwspinlock: sirf: Change to use devm_platform_ioremap_resource() Use the new helper that wraps the calls to platform_get_resource() and devm_ioremap_resource() together, which can simpify the code. Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/dfa043f317c609a6172468ac11598968dd751bce.1578453662.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit 498e165274f3296246bf5fd2dfa0d55b623866c1 Merge: e42617b825f8 9c140d992676 Author: Stephen Boyd Date: Tue Jan 21 16:14:48 2020 -0800 Merge tag 'imx-clk-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-imx Pull i.MX clk driver updates from Shawn Guo: - A series from Abel Vesa to do some trivial cleanups which will be helpful for i.MX clock driver switching to clk_hw based API - A series from Anson Huang to add i.MX8MP clock driver support - Disable non-functional divider between pll4_audio_div and pll4_post_div on imx6q - Fix watchdog2 clock name typo in imx7ulp clock driver - A couple of patches from Leonard Crestez to set CLK_GET_RATE_NOCACHE flag for DRAM related clocks on i.MX8M SoCs - Suppress bind attrs for i.MX8M clock driver to avoid the possibility of reloading the driver at runtime - Add a big comment in imx8qxp-lpcg driver to tell why devm_platform_ioremap_resource() shouldn't be used for the driver - A correction on i.MX8MN usb1_ctrl parent clock setting - A couple of trivial cleanup on clk-divider-gate driver - A series from Peng Fan to convert i.MX8M clock drivers to clk_hw based API * tag 'imx-clk-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (32 commits) clk: imx: Add support for i.MX8MP clock driver dt-bindings: imx: Add clock binding doc for i.MX8MP clk: imx: gate4: Switch imx_clk_gate4_flags() to clk_hw based API clk: imx: imx8mq: Switch to clk_hw based API clk: imx: imx8mm: Switch to clk_hw based API clk: imx: imx8mn: Switch to clk_hw based API clk: imx: Remove __init for imx_obtain_fixed_clk_hw() API clk: imx: gate3: Switch to clk_hw based API clk: imx: add hw API imx_clk_hw_mux2_flags clk: imx: add imx_unregister_hw_clocks clk: imx: clk-composite-8m: Switch to clk_hw based API clk: imx: clk-pll14xx: Switch to clk_hw based API clk: imx7up: Rename the clks to hws clk: imx: Rename the imx_clk_divider_gate to imply it's clk_hw based clk: imx: Rename the imx_clk_pfdv2 to imply it's clk_hw based clk: imx: Rename the imx_clk_pllv4 to imply it's clk_hw based clk: imx: Rename sccg and frac pll register to suggest clk_hw clk: imx: imx7ulp composite: Rename to show is clk_hw based clk: imx: pllv2: Switch to clk_hw based API clk: imx: pllv1: Switch to clk_hw based API ... commit 42f291ebfdd83a5bf04254f6bdc169f6e5a4152b Author: Baolin Wang Date: Wed Jan 8 11:14:00 2020 +0800 hwspinlock: omap: Use devm_kzalloc() to allocate memory Use devm_kzalloc() to allocate memory, which can simplify the error handling. Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/c066ad704c1a5fd52c3002cac80ddd59b3901b01.1578453062.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit fa9ae3057d7aa46bba99fe43e53fee8ce3617125 Merge: e42617b825f8 9c232d324bfa Author: Stephen Boyd Date: Tue Jan 21 16:11:18 2020 -0800 Merge tag 'sunxi-clk-for-5.6' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Maxime Ripard: Our usual set of patches for sunxi, with a bunch of them required to enable the MBUS controller, and two patches to enable cpufreq on the A64. * tag 'sunxi-clk-for-5.6' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi: a23/a33: Export the MIPI PLL clk: sunxi: a31: Export the MIPI PLL clk: sunxi-ng: a64: export CLK_CPUX clock for DVFS clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock clk: sunxi-ng: r40: Export MBUS clock clk: sunxi: use of_device_get_match_data commit bf2740068a87e258ccc695d366c8a2c05b46de71 Author: Baolin Wang Date: Wed Jan 8 11:13:59 2020 +0800 hwspinlock: omap: Change to use devm_platform_ioremap_resource() Use the new helper that wraps the calls to platform_get_resource() and devm_ioremap_resource() together, which can simpify the code. Meanwhile renaming the error label to make more sense after removing iounmap(). Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/6c09c5034a7e68fdfc22d2cb5daa375bccb33a66.1578453062.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit ed0611a604297a642c3fbec86d3482d580b4f764 Author: Baolin Wang Date: Wed Jan 8 11:09:11 2020 +0800 hwspinlock: qcom: Use devm_hwspin_lock_register() to register hwlock controller Use devm_hwspin_lock_register() to register the hwlock controller instead of unregistering the hwlock controller explicitly when removing the device. Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/d69ad8611a68b0cac3c927d19901f3c113c5435c.1578452735.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit 98ec52ad814013042e0ed386dcfb0c571782e844 Author: Baolin Wang Date: Wed Jan 8 11:09:10 2020 +0800 hwspinlock: qcom: Remove redundant PM runtime functions Since the hwspinlock core has changed the PM runtime to be optional, and the Qualcomm hardware spinlock has no pm runtime requirement, thus remove these redundant PM runtime functions. Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/e0bb751feb7af709f92e52a07d0e8ebcf1ee44ff.1578452735.git.baolin.wang7@gmail.com Signed-off-by: Bjorn Andersson commit 532f49a6f19a153e202b5a174f8556fd50c36dd4 Author: Dan Carpenter Date: Fri Jan 17 08:30:07 2020 +0300 tracing/boot: Fix an IS_ERR() vs NULL bug The trace_array_get_by_name() function doesn't return error pointers, it returns NULL on error. Link: http://lkml.kernel.org/r/20200117053007.5h2juv272pokqhtq@kili.mountain Fixes: 4f712a4d04a4 ("tracing/boot: Add instance node support") Acked-by: Masami Hiramatsu Signed-off-by: Dan Carpenter Signed-off-by: Steven Rostedt (VMware) commit 141597204ea2dc173668c8cd7202c4bac2b0c476 Author: Alex Shi Date: Tue Jan 21 13:54:46 2020 +0800 tracing: Remove unused TRACE_SEQ_BUF_USED This macro isn't used from commit 3a161d99c43c ("tracing: Create seq_buf layer in trace_seq"). so no needs to keep it. Link: http://lkml.kernel.org/r/1579586086-45543-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Signed-off-by: Steven Rostedt (VMware) commit b83479482ff6f856b1308a17768f228be779543a Author: Alex Shi Date: Tue Jan 21 13:54:40 2020 +0800 ring-buffer: Remove abandoned macro RB_MISSED_FLAGS This macro isn't used since commit d325c402964e ("ring-buffer: Remove unused function ring_buffer_page_len()"), so better to remove it. Link: http://lkml.kernel.org/r/1579586080-45300-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Signed-off-by: Steven Rostedt (VMware) commit 0c2caf75aa40b2622900ed47ff59cf342a4b5b09 Author: Sibi Sankar Date: Fri Jan 17 19:21:29 2020 +0530 remoteproc: qcom: q6v5-mss: Rename boot status timeout Rename the FSM timeout on SC7180 to BOOT_STATUS_TIMEOUT_US. Reviewed-by: Evan Green Signed-off-by: Sibi Sankar Link: https://lore.kernel.org/r/20200117135130.3605-4-sibis@codeaurora.org Signed-off-by: Bjorn Andersson commit 7e0f8688798c72ba29c50abb7156c40c72954290 Author: Sibi Sankar Date: Fri Jan 17 19:21:28 2020 +0530 remoteproc: qcom: q6v5-mss: Improve readability across clk handling Define CLKEN and CLKOFF for improving readability of Q6SS clock handling. Reviewed-by: Evan Green Signed-off-by: Sibi Sankar Link: https://lore.kernel.org/r/20200117135130.3605-3-sibis@codeaurora.org Signed-off-by: Bjorn Andersson commit bcc717ed95dea6c6b87013e97f39ee393aed0487 Author: Colin Ian King Date: Thu Jan 16 09:22:06 2020 +0000 tools: bootconfig: Fix spelling mistake "faile" -> "failed" There are two spelling mistakes in printf statements, fix these. Link: http://lkml.kernel.org/r/20200116092206.52192-1-colin.king@canonical.com Acked-by: Masami Hiramatsu Signed-off-by: Colin Ian King Signed-off-by: Steven Rostedt (VMware) commit b8381ce7aa8ef1ab5a79bf710508e504c494acf7 Author: Masami Hiramatsu Date: Mon Jan 20 12:23:23 2020 +0900 Documentation: tracing: Fix typos in boot-time tracing documentation Fix typos in boottime-trace.rst according to Randy's suggestions. Link: http://lkml.kernel.org/r/157949060335.25888.13153184562531693684.stgit@devnote2 Suggested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit a4798eb42a261ff39d991b198a09b840c11010d5 Author: Masami Hiramatsu Date: Mon Jan 20 12:23:12 2020 +0900 Documentation: bootconfig: Fix typos in bootconfig documentation Fix typos in bootconfig.rst according to Randy's suggestions. Link: http://lkml.kernel.org/r/157949059219.25888.16939971423610233631.stgit@devnote2 Suggested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 0947db01d9b9fd77a627e501fe563bdaf4c724a1 Author: Masami Hiramatsu Date: Mon Jan 20 12:23:00 2020 +0900 bootconfig: Fix Kconfig help message for BOOT_CONFIG Fix Kconfig help message since the bootconfig file is only available to be appended to initramfs. And also add a reference to the documentation. Link: http://lkml.kernel.org/r/157949058031.25888.18399447161895787505.stgit@devnote2 Reported-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 43a825afc91e2b06af1e8e7422198e759c2c5e20 Author: Björn Töpel Date: Mon Jan 20 10:29:17 2020 +0100 xsk, net: Make sock_def_readable() have external linkage XDP sockets use the default implementation of struct sock's sk_data_ready callback, which is sock_def_readable(). This function is called in the XDP socket fast-path, and involves a retpoline. By letting sock_def_readable() have external linkage, and being called directly, the retpoline can be avoided. Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200120092917.13949-1-bjorn.topel@gmail.com commit 9b0b308a1586f620a49c50605ae8abf509190661 Merge: 498f2a4be634 02a93929e3e4 Author: Olof Johansson Date: Tue Jan 21 15:07:31 2020 -0800 Merge tag 'zynq-dt-for-v5.6-v2' of https://github.com/Xilinx/linux-xlnx into arm/dt ARM: dts: zynq: DT changes for v5.6 v2 - Enable coresight topology for Zynq * tag 'zynq-dt-for-v5.6-v2' of https://github.com/Xilinx/linux-xlnx: ARM: dts: zynq: enablement of coresight topology Link: https://lore.kernel.org/r/5db334df-89b5-1d07-3884-93f77b0f4e60@monstr.eu Signed-off-by: Olof Johansson commit 31a7d26fbc51a39292bf9911f9e9efdf6d8e22b2 Merge: 21473e16b116 6c6b3f1f260b Author: Olof Johansson Date: Tue Jan 21 15:07:03 2020 -0800 Merge tag 'zynq-soc-for-v5.6' of https://github.com/Xilinx/linux-xlnx into arm/soc ARM: Xilinx Zynq SoC patches for v5.6 - Fix cpuid handling logic in platform SMP startup code * tag 'zynq-soc-for-v5.6' of https://github.com/Xilinx/linux-xlnx: ARM: zynq: use physical cpuid in zynq_slcr_cpu_stop/start Link: https://lore.kernel.org/r/50dec3cf-5f80-69be-c3d1-cc14b9bce5ff@monstr.eu Signed-off-by: Olof Johansson commit 498f2a4be634d93a53fee825082dfd20982fbb77 Merge: c14e723e4074 5a25e646902f Author: Olof Johansson Date: Tue Jan 21 15:06:09 2020 -0800 Merge tag 'zynqmp-dt-for-v5.6' of https://github.com/Xilinx/linux-xlnx into arm/dt arm64: dts: zynqmp: DT changes for v5.6 - Switch from fixed to firmware based clock driver - Wire power domain driver - Wire all ina226 chips through IIO and IIO hwmon drivers - Add missing dr_mode property to usb nodes - Use gpio-line-names property instead of comments - Use clock-output-names for si570 differentiation - Minor DT fixes * tag 'zynqmp-dt-for-v5.6' of https://github.com/Xilinx/linux-xlnx: (21 commits) arm64: zynqmp: Add label property to all ina226 on zcu106 arm64: zynqmp: Enable iio-hwmon for ina226 on zcu106 arm64: zynqmp: Add label property to all ina226 on zcu102 arm64: zynqmp: Enable iio-hwmon for ina226 on zcu102 arm64: zynqmp: Add label property to all ina226 on zcu111 arm64: zynqmp: Enable iio-hwmon for ina226 on zcu111 arm64: zynqmp: Enable iio-hwmon for ina226 on zcu100 arm64: zynqmp: Setup default number of chipselects for zcu100 arm64: zynqmp: Remove broken-cd from zcu100-revC arm64: zynqmp: Fix the si570 clock frequency on zcu111 arm64: zynqmp: Setup clock-output-names for si570 chips arm64: zynqmp: Turn comment to gpio-line-names arm64: zynqmp: Fix address for tca6416_u97 chip on zcu104 arm64: zynqmp: Remove addition number in node name arm64: zynqmp: Use ethernet-phy as node name for ethernet phys arm64: dts: xilinx: Add the power nodes for zynqmp arm64: dts: xilinx: Remove dtsi for fixed clock arm64: dts: xilinx: Add the clock nodes for zynqmp arm64: zynqmp: Add dr_mode property to usb node arm64: dts: zynqmp: Use decimal values for drm-clock properties ... Link: https://lore.kernel.org/r/c70d2efa-9ee2-a764-5248-0e5bfbf29f8a@monstr.eu Signed-off-by: Olof Johansson commit 88b4750151a2739761bb1af7fedeae1ff5d9aed9 Merge: 684415d0de30 ffdbae28d9d1 Author: Olof Johansson Date: Tue Jan 21 15:05:13 2020 -0800 Merge tag 'zynqmp-soc-for-v5.6' of https://github.com/Xilinx/linux-xlnx into arm/drivers arm64: soc: ZynqMP SoC changes for v5.6 - Extend firmware interface for feature checking - Use mailbox for communication with firmware for power management * tag 'zynqmp-soc-for-v5.6' of https://github.com/Xilinx/linux-xlnx: drivers: soc: xilinx: Use mailbox IPI callback dt-bindings: power: reset: xilinx: Add bindings for ipi mailbox drivers: firmware: xilinx: Add support for feature check Link: https://lore.kernel.org/r/f6fb26f8-b00d-a3e8-bf7d-c7ff2a8483b1@monstr.eu Signed-off-by: Olof Johansson commit b87121dd3fa0a4d2636c0ad02a3b3fc5161fa26b Author: Al Viro Date: Mon Jan 20 23:28:58 2020 +0000 bpf: don't bother with getname/kern_path - use user_path_at kernel/bpf/inode.c misuses kern_path...() - it's much simpler (and more efficient, on top of that) to use user_path...() counterparts rather than bothering with doing getname() manually. Signed-off-by: Al Viro Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200120232858.GF8904@ZenIV.linux.org.uk commit aff4866db56e5cc5601dcd896e056160e07ca361 Author: Alex Shi Date: Tue Jan 21 13:54:23 2020 +0800 ftrace: Remove NR_TO_INIT macro This macro isn't used from commit cb7be3b2fc2c ("ftrace: remove daemon"). So no needs to keep it. Link: http://lkml.kernel.org/r/1579586063-44984-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Signed-off-by: Steven Rostedt (VMware) commit 9a09cd74e7dc6c2ac34b39ea6e74440ceb4c501e Author: Alex Shi Date: Tue Jan 21 13:50:07 2020 +0800 ftrace: Remove abandoned macros These 2 macros aren't used from commit eee8ded131f1 ("ftrace: Have the function probes call their own function"), so remove them. Link: http://lkml.kernel.org/r/1579585807-43316-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Signed-off-by: Steven Rostedt (VMware) commit d8cacecf36e33c3a6fb9ffd88eb5c01c0c74004a Author: Peng Fan Date: Tue Jan 14 06:41:49 2020 +0000 dt-bindings: arm-boards: typo fix Typo fix, "withe" -> "with". Signed-off-by: Peng Fan Signed-off-by: Rob Herring commit af15a11b9046722f831588eff8fc423d28a1df44 Author: Geert Uytterhoeven Date: Tue Jan 21 11:37:21 2020 +0100 ARM: s3c64xx: Drop unneeded select of TIMER_OF Support for Samsung S3C64XX systems depends on ARCH_MULTI_V6, and thus on ARCH_MULTIPLATFORM. As the latter selects TIMER_OF, there is no need for MACH_S3C64XX_DT to select TIMER_OF. Signed-off-by: Geert Uytterhoeven Signed-off-by: Krzysztof Kozlowski commit 21829ec37e1b9356e442729fcdd7e189fc28d63b Author: Geert Uytterhoeven Date: Tue Jan 21 11:37:12 2020 +0100 ARM: exynos: Drop unneeded select of MIGHT_HAVE_CACHE_L2X0 Support for Samsung Exynos SoCs depends on ARCH_MULTI_V7, which selects ARCH_MULTI_V6_V7. As the latter selects MIGHT_HAVE_CACHE_L2X0, there is no need for ARCH_EXYNOS4 to select MIGHT_HAVE_CACHE_L2X0. Signed-off-by: Geert Uytterhoeven Signed-off-by: Krzysztof Kozlowski commit 5ec6fd39f5f23278c6c2f528b412dcff6a29eb59 Author: Uwe Kleine-König Date: Mon Jan 20 20:33:28 2020 +0100 ARM: s3c24xx: Switch to atomic pwm API in rx1950 Stop using the legacy PWM API which only still exists because there are some users left. Note this change make use of the fact that the value of struct pwm_state::duty_cycle doesn't matter for a disabled PWM and so its value can stay constant simplifying the code a bit. A side effect of the conversion is that the pwm isn't stopped in rx1950_backlight_init() by the call to pwm_apply_args() just before reenabling it when rx1950_lcd_power(1) is called. Signed-off-by: Uwe Kleine-König Reviewed-by: Vasily Khoruzhick Signed-off-by: Krzysztof Kozlowski commit d85339d9ea2660b550f12aca8bd040be4395c963 Author: Miquel Raynal Date: Mon Dec 30 18:31:03 2019 +0100 mtd: onenand: Rename omap2 driver to avoid a build warning As previously reported by Sudip Mukherjee for the Samsung driver, the omap2 onenand driver is called omap2.c in our directory and omap2.c in the tty/serial/ directory. If both drivers are compiled as modules, it would produce the following warning: warning: same module names found: drivers/tty/serial/omap2.ko drivers/mtd/nand/onenand/omap2.ko Rename the onenand omap2 driver so that it fits the folder's convention: onenand_omap2.c. Signed-off-by: Miquel Raynal commit 446b6dc8d87482af53fa30d29780a78bbae1e9b8 Author: Miquel Raynal Date: Mon Dec 30 18:31:02 2019 +0100 mtd: onenand: Use a better name for samsung driver Commit 55ed51fff224 ("{tty: serial, nand: onenand}: samsung: rename to fix build warning") has changed the samsung.c driver to be samsung_mtd.c in order to avoid a conflict in module names with the tty driver. Since the *_mtd suffix is very undescriptive, rename it to onenand_samsung.c, following the folder's convention. Same will be applied to the omap2 onenand driver. Signed-off-by: Miquel Raynal commit 7a95a72e052a7d15333de932e0a89b4934ce6085 Author: Dmitry Torokhov Date: Sat Jan 4 12:27:23 2020 -0800 mtd: rawnand: atmel: switch to using devm_fwnode_gpiod_get() devm_fwnode_get_index_gpiod_from_child() is going away as the name is too unwieldy, let's switch to using the new devm_fwnode_gpiod_get(). Signed-off-by: Dmitry Torokhov Signed-off-by: Miquel Raynal commit 9ee0f956cfbb87b19dfbbb9d588fef282eb5e95e Author: Robert Marko Date: Fri Jan 3 17:14:27 2020 +0100 mtd: spinand: add support for Toshiba TC58CVG2S0HRAIJ Toshiba recently launched new revisions of their serial SLC NAND series. TC58CVG2S0HRAIJ is a refresh of previous series with minor improvements. Basic parameters are same so lets add support for this new revision. Datasheet: https://business.kioxia.com/info/docget.jsp?did=58601&prodName=TC58CVG2S0HRAIJ Tested under kernel 5.4.7. Signed-off-by: Robert Marko Cc: Luka Perkov Signed-off-by: Miquel Raynal commit db7b6aeca2a7cc500a3f31d8dd1625272771f36b Author: YueHaibing Date: Tue Dec 31 09:36:48 2019 +0800 mtd: rawnand: macronix: Use match_string() helper to simplify the code match_string() returns the array index of a matching string. Use it instead of the open-coded implementation. Signed-off-by: YueHaibing Signed-off-by: Miquel Raynal commit f33113b542219448fa02d77ca1c6f4265bd7f130 Author: YueHaibing Date: Mon Dec 30 11:29:45 2019 +0800 mtd: sharpslpart: Fix unsigned comparison to zero The unsigned variable log_num is being assigned a return value from the call to sharpsl_nand_get_logical_num that can return -EINVAL. Detected using Coccinelle: ./drivers/mtd/parsers/sharpslpart.c:207:6-13: WARNING: Unsigned expression compared with zero: log_num > 0 Fixes: 8a4580e4d298 ("mtd: sharpslpart: Add sharpslpart partition parser") Signed-off-by: YueHaibing Signed-off-by: Miquel Raynal commit 05a5a6e57e6aebdab588d47acc8643e566c170fa Author: Krzysztof Kozlowski Date: Sun Dec 29 19:36:12 2019 +0100 mtd: onenand: Enable compile testing of OMAP and Samsung drivers OMAP and Samsung OneNAND drivers can be compile tested. The OMAP drivers still depends on mach header so limit the compile testing to ARMv7. Signed-off-by: Krzysztof Kozlowski Reported-by: kbuild test robot Signed-off-by: Miquel Raynal commit 440c24535caf9a2ae393a555b2e23854037d65e2 Author: Krzysztof Kozlowski Date: Sun Dec 29 19:36:11 2019 +0100 mtd: onenand: samsung: Fix printing format for size_t on 64-bit Print size_t as %zu to fix -Wformat warnings when compiling on 64-bit platform (e.g. with COMPILE_TEST): drivers/mtd/nand/onenand/samsung_mtd.c: In function ‘s5pc110_read_bufferram’: drivers/mtd/nand/onenand/samsung_mtd.c:661:16: warning: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘size_t {aka long unsigned int}’ [-Wformat=] dev_err(dev, "Couldn't map a %d byte buffer for DMA\n", count); Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 14b292adcc780b2a319862f22a60054fe72e382f Author: Krzysztof Kozlowski Date: Sun Dec 29 19:36:10 2019 +0100 mtd: onenand: samsung: Fix pointer cast -Wpointer-to-int-cast warnings on 64 bit iomem pointers should be casted to unsigned long to avoid -Wpointer-to-int-cast warnings when compiling on 64-bit platform (e.g. with COMPILE_TEST): drivers/mtd/nand/onenand/samsung_mtd.c: In function ‘s3c_onenand_readw’: drivers/mtd/nand/onenand/samsung_mtd.c:251:6: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] if ((unsigned int) addr < ONENAND_DATARAM && onenand->bootram_command) { ^ Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit a3b839e4e061c60c5f9abf4f3af638f712bf4285 Author: Masahiro Yamada Date: Fri Dec 20 20:31:55 2019 +0900 mtd: rawnand: denali: remove hard-coded DENALI_DEFAULT_OOB_SKIP_BYTES As commit 0d55c668b218 (mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset") says, there were three solutions discussed: [1] Add a DT property to specify the skipped bytes in OOB [2] Associate the preferred value with compatible [3] Hard-code the default value in the driver At that time, [3] was chosen because I did not have enough information about the other platforms than UniPhier. That commit also says "The preferred value may vary by platform. If so, please trade up to a different solution." My intention was to replace [3] with [2], not keep both [2] and [3]. Now that we have switched to [2] for SOCFPGA's SPARE_AREA_SKIP_BYTES=2, [3] should be removed. This should be OK because denali_pci.c just gets back to the original behavior. Signed-off-by: Masahiro Yamada Signed-off-by: Miquel Raynal commit 711fafc287e1be25b4420752062f852930e4c1d2 Author: Masahiro Yamada Date: Fri Dec 20 20:31:54 2019 +0900 mtd: rawnand: denali_dt: add reset controlling According to the Denali NAND Flash Memory Controller User's Guide, this IP has two reset signals. rst_n: reset most of FFs in the controller core reg_rst_n: reset all FFs in the register interface, and in the initialization sequencer This commit supports controlling those reset signals. It is possible to control them separately from the IP point of view although they might be often tied up together in actual SoC integration. The IP spec says, asserting only the reg_rst_n without asserting rst_n will cause unpredictable behavior in the controller. So, the driver deasserts ->rst_reg and ->rst in this order. Another thing that should be kept in mind is the automated initialization sequence (a.k.a. 'bootstrap' process) is kicked off when reg_rst_n is deasserted. When the reset is deasserted, the controller issues a RESET command to the chip select 0, and attempts to read out the chip ID, and further more, ONFI parameters if it is an ONFI-compliant device. Then, the controller sets up the relevant registers based on the detected device parameters. This process might be useful for tiny boot firmware, but is redundant for Linux Kernel because nand_scan_ident() probes devices and sets up parameters accordingly. Rather, this hardware feature is annoying because it ends up with misdetection due to bugs. So, commit 0615e7ad5d52 ("mtd: nand: denali: remove Toshiba and Hynix specific fixup code") changed the driver to not rely on it. However, there is no way to prevent it from running. The IP provides the 'bootstrap_inhibit_init' port to suppress this sequence, but it is usually out of software control, and dependent on SoC implementation. As for the Socionext UniPhier platform, LD4 always enables it. For the later SoCs, the bootstrap sequence runs depending on the boot mode. I added usleep_range() to make the driver wait until the sequence finishes. Otherwise, the driver would fail to detect the chip due to the race between the driver and hardware-controlled sequence. Signed-off-by: Masahiro Yamada Reviewed-by: Philipp Zabel Signed-off-by: Miquel Raynal commit 48aad493e353db386ea8fc82f082220342e7e633 Author: Masahiro Yamada Date: Fri Dec 20 20:31:53 2019 +0900 dt-bindings: mtd: denali_dt: document reset property According to the Denali NAND Flash Memory Controller User's Guide, this IP has two reset signals. rst_n: reset most of FFs in the controller core reg_rst_n: reset all FFs in the register interface, and in the initialization sequencer This commit specifies these reset signals. It is possible to control them separately from the IP point of view although they might be often tied up together in actual SoC integration. At least for the upstream platforms, Altera/Intel SOCFPGA and Socionext UniPhier, the reset controller seems to provide only 1-bit control for the NAND controller. If it is the case, the resets property should reference to the same phandles for "nand" and "reg" resets, like this: resets = <&nand_rst>, <&nand_rst>; reset-names = "nand", "reg"; Signed-off-by: Masahiro Yamada Acked-by: Rob Herring Signed-off-by: Miquel Raynal commit f5561a7c42d690b51151d955d0a6a80fa3ad6689 Author: Marek Vasut Date: Fri Dec 20 20:31:52 2019 +0900 mtd: rawnand: denali_dt: Add support for configuring SPARE_AREA_SKIP_BYTES The SPARE_AREA_SKIP_BYTES register is reset when the controller reset signal is toggled. Yet, this register must be configured to match the content of the NAND OOB area. The current default value is always set to 8 and is programmed into the hardware in case the hardware was not programmed before (e.g. in a bootloader) with a different value. This however does not work when the block is reset properly by Linux. On Altera SoCFPGA CycloneV, ArriaV and Arria10, which are the SoCFPGA platforms which support booting from NAND, the SPARE_AREA_SKIP_BYTES value must be set to 2. On Socionext Uniphier, the value is 8. This patch adds support for preconfiguring the default value and handles the special SoCFPGA case by setting the default to 2 on all SoCFPGA platforms, while retaining the original behavior and default value of 8 on all the other platforms. Signed-off-by: Marek Vasut Cc: Miquel Raynal Cc: Richard Weinberger Cc: Vignesh Raghavendra To: linux-mtd@lists.infradead.org Reviewed-by: Tudor Ambarus Acked-by: Masahiro Yamada Signed-off-by: Miquel Raynal commit 82348201384d4481ab92beecfbca7c195120670e Author: Masahiro Yamada Date: Fri Dec 20 20:31:51 2019 +0900 mtd: rawnand: denali_dt: error out if platform has no associated data denali->ecc_caps is a mandatory parameter. If it were left unset, nand_ecc_choose_conf() would end up with NULL pointer access. So, every compatible must be associated with proper denali_dt_data. If of_device_get_match_data() returns NULL, let it fail immediately. Signed-off-by: Masahiro Yamada Signed-off-by: Miquel Raynal commit 393947e5823fdfe96bd290e5d6311d5b08d03aa7 Author: Florian Fainelli Date: Tue Dec 17 16:56:35 2019 -0800 mtd: rawnand: brcmnand: Set appropriate DMA mask NAND controllers >= 7.0 with FLASH_DMA support physical addresses up to 40-bit, set an appropriate DMA mask for that purpose. Signed-off-by: Florian Fainelli Signed-off-by: Miquel Raynal commit 0e7ca83e82d021c928dadf4c13c137d57337540d Author: Nathan Chancellor Date: Mon Dec 9 14:44:23 2019 -0700 mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock Clang warns: ../drivers/mtd/nand/onenand/onenand_base.c:1269:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] while (!ret) { ^ ../drivers/mtd/nand/onenand/onenand_base.c:1266:2: note: previous statement is here if (column + thislen > writesize) ^ 1 warning generated. This warning occurs because there is a space before the tab of the while loop. There are spaces at the beginning of a lot of the lines in this block, remove them so that the indentation is consistent with the Linux kernel coding style and clang no longer warns. Fixes: a8de85d55700 ("[MTD] OneNAND: Implement read-while-load") Link: https://github.com/ClangBuiltLinux/linux/issues/794 Signed-off-by: Nathan Chancellor Signed-off-by: Miquel Raynal commit 73b265ae7bdbb5f4ce13b2afc53afa7c14cd0980 Author: zhengbin Date: Thu Nov 28 11:14:12 2019 +0800 mtd: rawnand: mpc5121: Remove unneeded semicolon Fixes coccicheck warning: drivers/mtd/nand/raw/mpc5121_nfc.c:441:2-3: Unneeded semicolon Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Miquel Raynal commit 75b3ff79c5656d75b18501c56610f79596dd1441 Author: Chen Wandun Date: Fri Nov 22 20:08:54 2019 +0800 mtd: onenand: samsung: remove set but not used variable Fixes gcc '-Wunused-but-set-variable' warning: drivers/mtd/nand/onenand/samsung_mtd.c: In function s3c_onenand_check_lock_status: drivers/mtd/nand/onenand/samsung_mtd.c:731:6: warning: variable tmp set but not used [-Wunused-but-set-variable] Signed-off-by: Chen Wandun Signed-off-by: Miquel Raynal commit 296a32b54a73898ad8828630423b399b5d1cb3d7 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:50 2019 +0800 mtd: onenand: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 1e31d3caa262cffa728e007ad209fb8e72b276a8 Author: Colin Ian King Date: Fri Jan 17 09:31:24 2020 +0000 usb: musb: fix spelling mistake: "periperal" -> "peripheral" There is a spelling mistake in a dev_err error message. Fix it. Signed-off-by: Colin Ian King Acked-by: Bin Liu Link: https://lore.kernel.org/r/20200117093124.97965-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit dd7d99dc688d0fc448976f52f8517fbdeccdccda Merge: 42bbdd99221b def9d2780727 Author: Greg Kroah-Hartman Date: Tue Jan 21 19:36:59 2020 +0100 Merge 5.5-rc7 into usb-next We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit f289e55c6eeb4391101a42334e8c69bf8c9fe987 Author: Jeff Chang Date: Thu Jan 16 13:46:37 2020 +0800 ASoC: Add MediaTek MT6660 Speaker Amp Driver The MT6660 is a boosted BTL class-D amplifier with V/I sensing. A built-in DC-DC step-up converter is used to provide efficient power for class-D amplifier with multi-level class-G operation. The digital audio interface supports I2S, left-justified, right-justified, TDM and DSP A/B format for audio in with a data out used for chip information like voltage sense and current sense, which are able to be monitored via DATAO through proper Signed-off-by: Jeff Chang Link: https://lore.kernel.org/r/1579153597-23286-1-git-send-email-richtek.jeff.chang@gmail.com Signed-off-by: Mark Brown commit ea87683909bcda665527a828505c5e9c6a625429 Merge: def9d2780727 2e31aab08bad Author: Mark Brown Date: Tue Jan 21 17:29:48 2020 +0000 Merge branch 'regmap-5.6' into regmap-next commit 29d7e05c5f75fc2ebf3608743b6809aa0ff56800 Author: Lubomir Rintel Date: Sat Jan 18 10:40:31 2020 +0100 spi: pxa2xx: Avoid touching SSCR0_SSE on MMP2 A read from a Winbond W25Q32FV SPI NOR memory chip on my MMP2 returns wrong data. It seems like SSE doesn't do the right thing on MMP2 at all. After enabling the SPI port back again, the FIFO reads return garbage. Things can be brought back to order by telling the PMU to reset the block. Here's a good transaction with said chip: # busybox devmem 0xd4035000 32 0x00001987 # SSCR0 # echo 0 >/sys/class/gpio/gpio46/value # (assert CS) # busybox devmem 0xd4035010 32 0x0000009f # SSDR (read ID command) # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 # SSDR 0x000000ff # busybox devmem 0xd4035010 # SSDR 0x000000ef # Correct response # busybox devmem 0xd4035010 # SSDR 0x00000040 # busybox devmem 0xd4035010 # SSDR 0x00000016 # busybox devmem 0xd4035010 # SSDR 0x00000000 # busybox devmem 0xd4035010 # SSDR 0x00000000 # busybox devmem 0xd4035010 # SSDR 0x00000000 # echo 1 >/sys/class/gpio/gpio46/value # (deassert CS) # Flipping off an on SSE, then running another transaction: # busybox devmem 0xd4035000 32 0x00001907 # SSCR0, SSE off # busybox devmem 0xd4035000 32 0x00001987 # SSCR0, SSE on # echo 0 >/sys/class/gpio/gpio46/value # (assert CS) # busybox devmem 0xd4035010 32 0x0000009f # SSDR (read ID command) # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 32 0x00000000 # SSDR # busybox devmem 0xd4035010 # SSDR 0x000000ff # busybox devmem 0xd4035010 # SSDR 0x000000ff # Garbage! # busybox devmem 0xd4035010 # SSDR 0x000000ff # Oh no # busybox devmem 0xd4035010 # SSDR 0x000000ff # busybox devmem 0xd4035010 # SSDR 0x000000ff # busybox devmem 0xd4035010 # SSDR 0x000000ff # busybox devmem 0xd4035010 # SSDR 0x000000ff # echo 1 >/sys/class/gpio/gpio46/value # (deassert CS) # Sometimes the response is not just ones, but something that looks like bits of a response from a previous transaction. I can't see a fix other than not touching the SSE altogether after the device is first brought up. Signed-off-by: Lubomir Rintel Link: https://lore.kernel.org/r/20200118094031.327373-1-lkundrak@v3.sk Signed-off-by: Mark Brown commit 2e31aab08bad0d4ee3d3d890a7b74cb6293e0a41 Author: Ben Whitten Date: Sat Jan 18 20:56:24 2020 +0000 regmap: fix writes to non incrementing registers When checking if a register block is writable we must ensure that the block does not start with or contain a non incrementing register. Fixes: 8b9f9d4dc511 ("regmap: verify if register is writeable before writing operations") Signed-off-by: Ben Whitten Link: https://lore.kernel.org/r/20200118205625.14532-1-ben.whitten@gmail.com Signed-off-by: Mark Brown commit 26aa19174f0d1837cb268b744f6dcb013265ab03 Author: Matthias Brugger Date: Tue Jan 14 16:01:50 2020 +0100 ASoC: dt-bindings: rt5645: add suppliers The rt5645 and rt5650 have two suppliers, document them. Signed-off-by: Matthias Brugger Link: https://lore.kernel.org/r/20200114150151.8537-1-matthias.bgg@kernel.org Signed-off-by: Mark Brown commit 294b7380ffe88d4a0626af1fee5843a3db0c913c Author: Tzung-Bi Shih Date: Fri Jan 17 15:38:14 2020 +0800 ASoC: max98090: fix deadlock in max98090_dapm_put_enum_double() Commit 62d5ae4cafb7 ("ASoC: max98090: save and restore SHDN when changing sensitive registers SHDN bit") uses dapm_mutex to protect SHDN bit. However, snd_soc_dapm_put_enum_double() in max98090_dapm_put_enum_double() acquires the dapm_mutex again which cause a deadlock. Use snd_soc_dapm_put_enum_double_locked() instead to fix the deadlock. Fixes: 62d5ae4cafb7 ("ASoC: max98090: save and restore SHDN when changing sensitive registers SHDN bit") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200117073814.82441-4-tzungbi@google.com Signed-off-by: Mark Brown commit 839284e794822ebc8b66f32006a5d4cad863e1fb Author: Tzung-Bi Shih Date: Fri Jan 17 15:38:13 2020 +0800 ASoC: dapm: add snd_soc_dapm_put_enum_double_locked Adds snd_soc_dapm_put_enum_double_locked() for those use cases if dapm_mutex has already locked. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200117073814.82441-3-tzungbi@google.com Signed-off-by: Mark Brown commit 08df0d9a00f7ca07511614dd3b137fadd2de56fc Author: Tzung-Bi Shih Date: Fri Jan 17 15:38:12 2020 +0800 ASoC: max98090: revert "ASoC: max98090: fix lockdep warning" Commit 2dc98af62c32 ("ASoC: max98090: fix lockdep warning") introduced a helpful-less small lock: shdn_lock. Reverts the commit. Reasons: 1. Lockdep should not be happy by either the original or current code. From lockdep's point of view, there is a lock inversion anyway. Let d = dapm_mutex, c = controls_rwsem, s = shdn_lock, From the reported calling stack: lock acquisition order of snd_soc_register_card() is: d -> c. > snd_ctl_add_replace+0x3c/0x84 > dapm_create_or_share_kcontrol+0x24c/0x2e0 > snd_soc_dapm_new_widgets+0x308/0x594 > snd_soc_bind_card+0x80c/0xad4 > devm_snd_soc_register_card+0x34/0x6c If calling snd_soc_dapm_put_enum_double() in kcontrol's put (e.g. SOC_DAPM_ENUM_EXT), lock acquisition order is: c -> d. Note that, snd_soc_dapm_put_enum_double() acquires d. The possible lock inversion is always there if registering sound card and putting mixer control happen at the same time. In fact, it never happens because the control device don't show up to the userspace until the sound card build success. Commit 2dc98af62c32 ("ASoC: max98090: fix lockdep warning") changes the order to: c -> s -> d. The lock inversion is still there. 2. Commit 62d5ae4cafb7 ("ASoC: max98090: save and restore SHDN when changing sensitive registers SHDN bit") designed to use dapm_mutex to protect SHDN bit. Use a separate lock breaks the protection. DAPM changes SHDN bit automatically when it finds the path. Thus, any code wants to change the SHDN bit, need to acquire the dapm_mutex first. > SND_SOC_DAPM_SUPPLY("SHDN", M98090_REG_DEVICE_SHUTDOWN, > M98090_SHDNN_SHIFT, 0, NULL, 0), Fixes: 2dc98af62c32 ("ASoC: max98090: fix lockdep warning") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20200117073814.82441-2-tzungbi@google.com Signed-off-by: Mark Brown commit b0177aca7aea7e8917d4e463334b51facb293d02 Author: Michael Walle Date: Tue Jan 14 16:46:13 2020 +0100 spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations Make use of a core helper to ensure the desired width is respected when calling spi-mem operators. Otherwise only the SPI controller will be matched with the flash chip, which might lead to wrong widths. Also consider the width specified by the user in the device tree. Fixes: 84d043185dbe ("spi: Add a driver for the Freescale/NXP QuadSPI controller") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20200114154613.8195-1-michael@walle.cc Signed-off-by: Mark Brown commit 250a15cf575a655097151ad887cea02dd0977136 Author: Kuninori Morimoto Date: Mon Jan 20 10:05:07 2020 +0900 ASoC: soc-core: remove bus_control Now, snd_soc_dai_driver::bus_control is used for how to resume. But, no driver which has bus_control has DAI driver suspend/resume support. This patch removes pointless bus_control from ALSA SoC. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87pnffx7i4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 450312b640f9c6caeeaf4bd8d4130f86ea27f456 Author: Kuninori Morimoto Date: Mon Jan 20 10:05:03 2020 +0900 ASoC: soc-core: remove DAI suspend/resume Historically, CPU and Codec were implemented different, but now it is merged as Component. ALSA SoC is supporting suspend/resume at DAI and Component level. The method is like below. 1) Suspend/Resume all CPU DAI if bus-control was 0 2) Suspend/Resume all Component 3) Suspend/Resume all CPU DAI if bus-control was 1 Historically 2) was Codec special operation. Because CPU and Codec were merged into Component, CPU suspend/resume has 3 chance to suspend(= 1/2/3), but Codec suspend/resume has 1 chance (= 2). Here, DAI side suspend/resume is caring bus-control, but no driver which is supporting suspend/resume is setting bus-control. This means 3) was never used. Here, used parameter for suspend/resume component->dev and dai->dev are same pointer. For that reason, we can merge DAI and Component suspend/resume. One note is that we should use 2), because it is caring BIAS level. This patch removes 1) and 3). Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87r1zvx7i8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0b1c89944207975dac17a176052b92780642b90b Author: Kuninori Morimoto Date: Mon Jan 20 10:04:59 2020 +0900 ASoC: pxa: pxa2xx-i2s: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87sgkbx7ic.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2c55f0be586a14a35f67baf76df4d5c7782ed36a Author: Kuninori Morimoto Date: Mon Jan 20 10:04:52 2020 +0900 ASoC: pxa: pxa-ssp: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can swtcih all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87tv4rx7ij.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2db023cdb386874c51f4219508bd2d5f0caa7ffa Author: Kuninori Morimoto Date: Mon Jan 20 10:04:47 2020 +0900 ASoC: ux500: ux500_msp_dai: remove unused DAI .suspend/.resume This patch removes unused DAI driver .suspend/.resume Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87v9p7x7io.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 21385a4faa8469b129af56a8c5a9405e3189c787 Author: Kuninori Morimoto Date: Mon Jan 20 10:04:42 2020 +0900 ASoC: samsung: i2s: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87wo9nx7it.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ef20061a34e0e6822cbfd20c11667ae23a96798d Author: Kuninori Morimoto Date: Mon Jan 20 10:04:37 2020 +0900 ASoC: dwc: dwc-i2s: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87y2u3x7iy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9b79b1cd164f4ec64dc0847b03297095e39cdee9 Author: Kuninori Morimoto Date: Mon Jan 20 10:04:31 2020 +0900 ASoC: uniphier: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87zhejx7j4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 78dbafbd04ddcc3a21879c4403c57d979689a3fe Author: Kuninori Morimoto Date: Mon Jan 20 10:04:26 2020 +0900 ASoC: ti: omap-mcpdm: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/871rrvym3p.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4a58fb71b5799328ea4ec84f3caee2fd4419404d Author: Kuninori Morimoto Date: Mon Jan 20 10:04:18 2020 +0900 ASoC: sti: sti_uniperif: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/8736cbym3x.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 79a5cf90f8719c3f69a0dc53efebb38da654512f Author: Kuninori Morimoto Date: Mon Jan 20 10:04:13 2020 +0900 ASoC: samsung: spdif: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/874kwrym42.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 45cfa792f6608dc1b3e0fdc354716e87a40a747d Author: Kuninori Morimoto Date: Mon Jan 20 10:04:07 2020 +0900 ASoC: samsung: s3c24xx-i2s: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/875zh7ym48.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7ec6b43125c070fadf389b80083d939014e13ac9 Author: Kuninori Morimoto Date: Mon Jan 20 10:04:01 2020 +0900 ASoC: mediatek: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/877e1nym4e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit aa3c4765b3e8931e2e3c70894b717a993f96fff5 Author: Kuninori Morimoto Date: Mon Jan 20 10:03:56 2020 +0900 ASoC: jz4740: jz4740-i2s: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/878sm3ym4j.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7b6e7b137e2ae5f789d2c8ab7df9f3650b5deaf1 Author: Kuninori Morimoto Date: Mon Jan 20 10:03:50 2020 +0900 ASoC: cirrus: ep93xx-i2s: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87a76jym4p.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e4f8bb37efae2b2be51f4d872fffcd09001c1f75 Author: Kuninori Morimoto Date: Mon Jan 20 10:03:36 2020 +0900 ASoC: atmel: atmel_ssc_dai: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87d0bfym53.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7307d33a280b300f69c00580be9fa210f8587039 Author: Kuninori Morimoto Date: Mon Jan 20 10:03:43 2020 +0900 ASoC: bcm: cygnus-ssp: move .suspend/.resume to component There is no big difference at implementation for .suspend/.resume between DAI driver and Component driver. But because some driver is using DAI version, thus ALSA SoC needs to keep supporting it, hence, framework becoming verbose. If we can switch all DAI driver .suspend/.resume to Component driver, we can remove verbose code from ALSA SoC. Driver is getting its private data via dai->dev. But dai->dev and component->dev are same dev, thus, we can convert these. For same reason, we can convert dai->active to component->active if necessary. This patch moves DAI driver .suspend/.resume to Component driver Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87blqzym4w.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 130128098a4e5ce9a0dfbdf9a7e27a43579901fd Author: Shengjiu Wang Date: Mon Jan 20 15:28:06 2020 +0800 ASoC: soc-generic-dmaengine-pcm: Fix error handling Remove the return value checking, that is to align with the code before adding snd_dmaengine_pcm_refine_runtime_hwparams function. Otherwise it causes a regression on the HiKey board: [ 17.721424] hi6210_i2s f7118000.i2s: ASoC: can't open component f7118000.i2s: -6 Fixes: e957204e732b ("ASoC: pcm_dmaengine: Extract snd_dmaengine_pcm_refine_runtime_hwparams") Signed-off-by: Shengjiu Wang Reported-by: John Stultz Link: https://lore.kernel.org/r/1579505286-32085-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit af4bac11531fbc0b5955fdccbe3f5ea265cd7374 Author: Sameer Pujar Date: Sun Jan 19 19:49:23 2020 +0530 ASoC: soc-pcm: crash in snd_soc_dapm_new_dai Crash happens in snd_soc_dapm_new_dai() when substream->private_data access is made and substream is NULL here. This is seen for DAIs where only playback or capture stream is defined. This seems to be happening for codec2codec DAI link. Both playback and capture are 0 during soc_new_pcm(). This is probably happening because cpu_dai and codec_dai are both validated either for SNDRV_PCM_STREAM_PLAYBACK or SNDRV_PCM_STREAM_CAPTURE. Shouldn't be playback = 1 when, - playback stream is available for codec_dai AND - capture stream is available for cpu_dai and vice-versa for capture = 1? Signed-off-by: Sameer Pujar Link: https://lore.kernel.org/r/1579443563-12287-1-git-send-email-spujar@nvidia.com Signed-off-by: Mark Brown commit b0de922af53eede340986a2d05b6cd4b6d6efa43 Author: Kishon Vijay Abraham I Date: Tue Jan 21 17:27:34 2020 +0530 PCI: keystone: Fix error handling when "num-viewport" DT property is not populated Fix error handling when "num-viewport" DT property is not populated. Fixes: 23284ad677a9 ("PCI: keystone: Add support for PCIe EP in AM654x Platforms") Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org # v5.2+ commit d7bbd6c1b01cb5dd13c245d4586a83145c1d5f52 Author: Dirk Behme Date: Tue Jan 21 16:54:39 2020 +0100 arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean' Since v4.3-rc1 commit 0723c05fb75e44 ("arm64: enable more compressed Image formats"), it is possible to build Image.{bz2,lz4,lzma,lzo} AArch64 images. However, the commit missed adding support for removing those images on 'make ARCH=arm64 (dist)clean'. Fix this by adding them to the target list. Make sure to match the order of the recipes in the makefile. Cc: stable@vger.kernel.org # v4.3+ Fixes: 0723c05fb75e44 ("arm64: enable more compressed Image formats") Signed-off-by: Dirk Behme Signed-off-by: Eugeniu Rosca Reviewed-by: Masahiro Yamada Signed-off-by: Will Deacon commit 154a4dcfc95f9dfcb2fda3ddf24c0602060d1120 Author: Alex Shi Date: Tue Jan 21 18:25:38 2020 +0800 fs/reiserfs: remove unused macros these macros are never used from introduced. better to remove them. Link: https://lore.kernel.org/r/1579602338-57079-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Cc: Andrew Morton Cc: Jan Kara Cc: Bharath Vedartham Cc: Hariprasad Kelam Cc: Jason Yan Cc: zhengbin Cc: Jia-Ju Bai Cc: reiserfs-devel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jan Kara commit ed21c58eefa7a2f95c87c37677b51d5b480759b6 Author: Alex Shi Date: Tue Jan 21 18:25:34 2020 +0800 fs/quota: remove unused macro __QUOTA_V2_PARANOIA macro is never used. better to remove it. Link: https://lore.kernel.org/r/1579602334-57039-1-git-send-email-alex.shi@linux.alibaba.com Signed-off-by: Alex Shi Cc: Jan Kara Cc: linux-kernel@vger.kernel.org Signed-off-by: Jan Kara commit 802a5017ffb27ade616d0fe605f699a3c6303aa3 Author: Alex Shi Date: Tue Jan 21 16:49:20 2020 +0800 jfs: remove unused MAXL2PAGES This has never been used. Signed-off-by: Alex Shi Signed-off-by: Dave Kleikamp Cc: jfs-discussion@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org commit 1a7f0a34ea7d05d1ffcd32c9b1b4e07ac0687538 Author: Michał Mirosław Date: Tue Jan 14 19:11:26 2020 +0100 builddeb: allow selection of .deb compressor Select deb compression using KDEB_COMPRESS make variable. This allows to use gzip compression for local or test builds, and that's way faster than now-default xz compression. Signed-off-by: Michał Mirosław Signed-off-by: Masahiro Yamada commit 2b5072b9dfab1bc9e4f605bba19b4470e429c60c Author: Bjorn Helgaas Date: Fri Jan 17 10:18:22 2020 -0600 kconfig: fix documentation typos Fix a couple typos in kconfig-language documentation. Signed-off-by: Bjorn Helgaas Signed-off-by: Masahiro Yamada commit e8b3a426fb4a9e2856a69b6e19de044c7416c316 Merge: eaad647e5cc2 b2dfc6765e45 Author: Jason Gunthorpe Date: Tue Jan 21 09:55:04 2020 -0400 Merge tag 'rds-odp-for-5.5' into rdma.git for-next From https://git.kernel.org/pub/scm/linux/kernel/git/leon/linux-rdma Leon Romanovsky says: ==================== Use ODP MRs for kernel ULPs The following series extends MR creation routines to allow creation of user MRs through kernel ULPs as a proxy. The immediate use case is to allow RDS to work over FS-DAX, which requires ODP (on-demand-paging) MRs to be created and such MRs were not possible to create prior this series. The first part of this patchset extends RDMA to have special verb ib_reg_user_mr(). The common use case that uses this function is a userspace application that allocates memory for HCA access but the responsibility to register the memory at the HCA is on an kernel ULP. This ULP acts as an agent for the userspace application. The second part provides advise MR functionality for ULPs. This is integral part of ODP flows and used to trigger pagefaults in advance to prepare memory before running working set. The third part is actual user of those in-kernel APIs. ==================== * tag 'rds-odp-for-5.5': net/rds: Use prefetch for On-Demand-Paging MR net/rds: Handle ODP mr registration/unregistration net/rds: Detect need of On-Demand-Paging memory registration RDMA/mlx5: Fix handling of IOVA != user_va in ODP paths IB/mlx5: Mask out unsupported ODP capabilities for kernel QPs RDMA/mlx5: Don't fake udata for kernel path IB/mlx5: Add ODP WQE handlers for kernel QPs IB/core: Add interface to advise_mr for kernel users IB/core: Introduce ib_reg_user_mr IB: Allow calls to ib_umem_get from kernel ULPs Signed-off-by: Jason Gunthorpe commit 09cbcef6c60e77af11c3f27e62ea3f291a5d436c Author: Milan Pandurov Date: Fri Dec 13 14:07:21 2019 +0100 kvm: Refactor handling of VM debugfs files We can store reference to kvm_stats_debugfs_item instead of copying its values to kvm_stat_data. This allows us to remove duplicated code and usage of temporary kvm_stat_data inside vm_stat_get et al. Signed-off-by: Milan Pandurov Reviewed-by: Alexander Graf Signed-off-by: Paolo Bonzini commit e30a7d623dccdb3f880fbcad980b0cb589a1da45 Author: Sean Christopherson Date: Tue Jan 7 16:12:10 2020 -0800 KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM Remove the bogus 64-bit only condition from the check that disables MMIO spte optimization when the system supports the max PA, i.e. doesn't have any reserved PA bits. 32-bit KVM always uses PAE paging for the shadow MMU, and per Intel's SDM: PAE paging translates 32-bit linear addresses to 52-bit physical addresses. The kernel's restrictions on max physical addresses are limits on how much memory the kernel can reasonably use, not what physical addresses are supported by hardware. Fixes: ce88decffd17 ("KVM: MMU: mmio page fault support") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a4d956b9390418623ae5d07933e2679c68b6f83c Author: Miaohe Lin Date: Sat Dec 28 14:25:24 2019 +0800 KVM: nVMX: vmread should not set rflags to specify success in case of #PF In case writing to vmread destination operand result in a #PF, vmread should not call nested_vmx_succeed() to set rflags to specify success. Similar to as done in VMPTRST (See handle_vmptrst()). Reviewed-by: Liran Alon Signed-off-by: Miaohe Lin Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit b5c3c1b3c6e95cc67910e27a1e7603d838c2ebed Author: Sean Christopherson Date: Thu Jan 9 15:06:40 2020 -0800 KVM: x86/mmu: Micro-optimize nEPT's bad memptype/XWR checks Rework the handling of nEPT's bad memtype/XWR checks to micro-optimize the checks as much as possible. Move the check to a separate helper, __is_bad_mt_xwr(), which allows the guest_rsvd_check usage in paging_tmpl.h to omit the check entirely for paging32/64 (bad_mt_xwr is always zero for non-nEPT) while retaining the bitwise-OR of the current code for the shadow_zero_check in walk_shadow_page_get_mmio_spte(). Add a comment for the bitwise-OR usage in the mmio spte walk to avoid future attempts to "fix" the code, which is what prompted this optimization in the first place[*]. Opportunistically remove the superfluous '!= 0' and parantheses, and use BIT_ULL() instead of open coding its equivalent. The net effect is that code generation is largely unchanged for walk_shadow_page_get_mmio_spte(), marginally better for ept_prefetch_invalid_gpte(), and significantly improved for paging32/64_prefetch_invalid_gpte(). Note, walk_shadow_page_get_mmio_spte() can't use a templated version of the memtype/XRW as it works on the host's shadow PTEs, e.g. checks that KVM hasn't borked its EPT tables. Even if it could be templated, the benefits of having a single implementation far outweight the few uops that would be saved for NPT or non-TDP paging, e.g. most compilers inline it all the way to up kvm_mmu_page_fault(). [*] https://lkml.kernel.org/r/20200108001859.25254-1-sean.j.christopherson@intel.com Cc: Jim Mattson Cc: David Laight Cc: Arvind Sankar Signed-off-by: Sean Christopherson Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit f8052a053a7af2a53288901d27d6419e100ad8e2 Author: Sean Christopherson Date: Thu Jan 9 15:06:39 2020 -0800 KVM: x86/mmu: Reorder the reserved bit check in prefetch_invalid_gpte() Move the !PRESENT and !ACCESSED checks in FNAME(prefetch_invalid_gpte) above the call to is_rsvd_bits_set(). For a well behaved guest, the !PRESENT and !ACCESSED are far more likely to evaluate true than the reserved bit checks, and they do not require additional memory accesses. Before: Dump of assembler code for function paging32_prefetch_invalid_gpte: 0x0000000000044240 <+0>: callq 0x44245 0x0000000000044245 <+5>: mov %rcx,%rax 0x0000000000044248 <+8>: shr $0x7,%rax 0x000000000004424c <+12>: and $0x1,%eax 0x000000000004424f <+15>: lea 0x0(,%rax,4),%r8 0x0000000000044257 <+23>: add %r8,%rax 0x000000000004425a <+26>: mov %rcx,%r8 0x000000000004425d <+29>: and 0x120(%rsi,%rax,8),%r8 0x0000000000044265 <+37>: mov 0x170(%rsi),%rax 0x000000000004426c <+44>: shr %cl,%rax 0x000000000004426f <+47>: and $0x1,%eax 0x0000000000044272 <+50>: or %rax,%r8 0x0000000000044275 <+53>: jne 0x4427c 0x0000000000044277 <+55>: test $0x1,%cl 0x000000000004427a <+58>: jne 0x4428a 0x000000000004427c <+60>: mov %rdx,%rsi 0x000000000004427f <+63>: callq 0x44080 0x0000000000044284 <+68>: mov $0x1,%eax 0x0000000000044289 <+73>: retq 0x000000000004428a <+74>: xor %eax,%eax 0x000000000004428c <+76>: and $0x20,%ecx 0x000000000004428f <+79>: jne 0x44289 0x0000000000044291 <+81>: mov %rdx,%rsi 0x0000000000044294 <+84>: callq 0x44080 0x0000000000044299 <+89>: mov $0x1,%eax 0x000000000004429e <+94>: jmp 0x44289 End of assembler dump. After: Dump of assembler code for function paging32_prefetch_invalid_gpte: 0x0000000000044240 <+0>: callq 0x44245 0x0000000000044245 <+5>: test $0x1,%cl 0x0000000000044248 <+8>: je 0x4424f 0x000000000004424a <+10>: test $0x20,%cl 0x000000000004424d <+13>: jne 0x4425d 0x000000000004424f <+15>: mov %rdx,%rsi 0x0000000000044252 <+18>: callq 0x44080 0x0000000000044257 <+23>: mov $0x1,%eax 0x000000000004425c <+28>: retq 0x000000000004425d <+29>: mov %rcx,%rax 0x0000000000044260 <+32>: mov (%rsi),%rsi 0x0000000000044263 <+35>: shr $0x7,%rax 0x0000000000044267 <+39>: and $0x1,%eax 0x000000000004426a <+42>: lea 0x0(,%rax,4),%r8 0x0000000000044272 <+50>: add %r8,%rax 0x0000000000044275 <+53>: mov %rcx,%r8 0x0000000000044278 <+56>: and 0x120(%rsi,%rax,8),%r8 0x0000000000044280 <+64>: mov 0x170(%rsi),%rax 0x0000000000044287 <+71>: shr %cl,%rax 0x000000000004428a <+74>: and $0x1,%eax 0x000000000004428d <+77>: mov %rax,%rcx 0x0000000000044290 <+80>: xor %eax,%eax 0x0000000000044292 <+82>: or %rcx,%r8 0x0000000000044295 <+85>: je 0x4425c 0x0000000000044297 <+87>: mov %rdx,%rsi 0x000000000004429a <+90>: callq 0x44080 0x000000000004429f <+95>: mov $0x1,%eax 0x00000000000442a4 <+100>: jmp 0x4425c End of assembler dump. Signed-off-by: Sean Christopherson Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 52918ed5fcf05d97d257f4131e19479da18f5d16 Author: Tom Lendacky Date: Thu Jan 9 17:42:16 2020 -0600 KVM: SVM: Override default MMIO mask if memory encryption is enabled The KVM MMIO support uses bit 51 as the reserved bit to cause nested page faults when a guest performs MMIO. The AMD memory encryption support uses a CPUID function to define the encryption bit position. Given this, it is possible that these bits can conflict. Use svm_hardware_setup() to override the MMIO mask if memory encryption support is enabled. Various checks are performed to ensure that the mask is properly defined and rsvd_bits() is used to generate the new mask (as was done prior to the change that necessitated this patch). Fixes: 28a1f3ac1d0c ("kvm: x86: Set highest physical address bits in non-present/reserved SPTEs") Suggested-by: Sean Christopherson Reviewed-by: Sean Christopherson Signed-off-by: Tom Lendacky Signed-off-by: Paolo Bonzini commit d8010a779a2f3f92fb10d617b8aa1ddd772e987c Author: Miaohe Lin Date: Sat Dec 14 14:48:45 2019 +0800 KVM: vmx: delete meaningless nested_vmx_prepare_msr_bitmap() declaration The function nested_vmx_prepare_msr_bitmap() declaration is below its implementation. So this is meaningless and should be removed. Signed-off-by: Miaohe Lin Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 87382003e3555926017228452dae7e7064b0f915 Author: Sean Christopherson Date: Tue Dec 17 13:32:42 2019 -0800 KVM: x86: Refactor and rename bit() to feature_bit() macro Rename bit() to __feature_bit() to give it a more descriptive name, and add a macro, feature_bit(), to stuff the X68_FEATURE_ prefix to keep line lengths manageable for code that hardcodes the bit to be retrieved. No functional change intended. Cc: Jim Mattson Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a7c48c3f56db8d18d15ee6d8c2c5e2da447c77cc Author: Sean Christopherson Date: Tue Dec 17 13:32:41 2019 -0800 KVM: x86: Expand build-time assertion on reverse CPUID usage Add build-time checks to ensure KVM isn't trying to do a reverse CPUID lookup on Linux-defined feature bits, along with comments to explain the gory details of X86_FEATUREs and bit(). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit daa0d8c3a48732e5f64c69cca4c597cab1dfd455 Author: Sean Christopherson Date: Tue Dec 17 13:32:40 2019 -0800 KVM: x86: Add CPUID_7_1_EAX to the reverse CPUID table Add an entry for CPUID_7_1_EAX in the reserve_cpuid array in preparation for incorporating the array in bit() build-time assertions, specifically to avoid an assertion on F(AVX512_BF16) in do_cpuid_7_mask(). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a0a2260c12d8658e522f21ed8ece72bbdede58fd Author: Sean Christopherson Date: Tue Dec 17 13:32:39 2019 -0800 KVM: x86: Move bit() helper to cpuid.h Move bit() to cpuid.h in preparation for incorporating the reverse_cpuid array in bit() build-time assertions. Opportunistically use the BIT() macro instead of open-coding the shift. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 5ae78e95ed0c771935d0d24291d221312524830c Author: Sean Christopherson Date: Tue Dec 17 13:32:38 2019 -0800 KVM: x86: Add dedicated emulator helpers for querying CPUID features Add feature-specific helpers for querying guest CPUID support from the emulator instead of having the emulator do a full CPUID and perform its own bit tests. The primary motivation is to eliminate the emulator's usage of bit() so that future patches can add more extensive build-time assertions on the usage of bit() without having to expose yet more code to the emulator. Note, providing a generic guest_cpuid_has() to the emulator doesn't work due to the existing built-time assertions in guest_cpuid_has(), which require the feature being checked to be a compile-time constant. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 345599f9a292899bf5474651f3cea9b7a0576436 Author: Sean Christopherson Date: Tue Dec 10 14:44:16 2019 -0800 KVM: x86: Add macro to ensure reserved cr4 bits checks stay in sync Add a helper macro to generate the set of reserved cr4 bits for both host and guest to ensure that adding a check on guest capabilities is also added for host capabilities, and vice versa. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 96be4e069c938e4a5fc7125de7e1cc7089b1adef Author: Sean Christopherson Date: Tue Dec 10 14:44:15 2019 -0800 KVM: x86: Drop special XSAVE handling from guest_cpuid_has() Now that KVM prevents setting host-reserved CR4 bits, drop the dedicated XSAVE check in guest_cpuid_has() in favor of open coding similar checks in the SVM/VMX XSAVES enabling flows. Note, checking boot_cpu_has(X86_FEATURE_XSAVE) in the XSAVES flows is technically redundant with respect to the CR4 reserved bit checks, e.g. XSAVES #UDs if CR4.OSXSAVE=0 and arch.xsaves_enabled is consumed if and only if CR4.OXSAVE=1 in guest. Keep (add?) the explicit boot_cpu_has() checks to help document KVM's usage of arch.xsaves_enabled. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit f1cdecf5807b1a91829a2dc4f254bfe6bafd4776 Author: Sean Christopherson Date: Tue Dec 10 14:44:14 2019 -0800 KVM: x86: Ensure all logical CPUs have consistent reserved cr4 bits Check the current CPU's reserved cr4 bits against the mask calculated for the boot CPU to ensure consistent behavior across all CPUs. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit b11306b53b2540c6ba068c4deddb6a17d9f8d95b Author: Sean Christopherson Date: Tue Dec 10 14:44:13 2019 -0800 KVM: x86: Don't let userspace set host-reserved cr4 bits Calculate the host-reserved cr4 bits at runtime based on the system's capabilities (using logic similar to __do_cpuid_func()), and use the dynamically generated mask for the reserved bit check in kvm_set_cr4() instead using of the static CR4_RESERVED_BITS define. This prevents userspace from "enabling" features in cr4 that are not supported by the system, e.g. by ignoring KVM_GET_SUPPORTED_CPUID and specifying a bogus CPUID for the vCPU. Allowing userspace to set unsupported bits in cr4 can lead to a variety of undesirable behavior, e.g. failed VM-Enter, and in general increases KVM's attack surface. A crafty userspace can even abuse CR4.LA57 to induce an unchecked #GP on a WRMSR. On a platform without LA57 support: KVM_SET_CPUID2 // CPUID_7_0_ECX.LA57 = 1 KVM_SET_SREGS // CR4.LA57 = 1 KVM_SET_MSRS // KERNEL_GS_BASE = 0x0004000000000000 KVM_RUN leads to a #GP when writing KERNEL_GS_BASE into hardware: unchecked MSR access error: WRMSR to 0xc0000102 (tried to write 0x0004000000000000) at rIP: 0xffffffffa00f239a (vmx_prepare_switch_to_guest+0x10a/0x1d0 [kvm_intel]) Call Trace: kvm_arch_vcpu_ioctl_run+0x671/0x1c70 [kvm] kvm_vcpu_ioctl+0x36b/0x5d0 [kvm] do_vfs_ioctl+0xa1/0x620 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4c/0x170 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fc08133bf47 Note, the above sequence fails VM-Enter due to invalid guest state. Userspace can allow VM-Enter to succeed (after the WRMSR #GP) by adding a KVM_SET_SREGS w/ CR4.LA57=0 after KVM_SET_MSRS, in which case KVM will technically leak the host's KERNEL_GS_BASE into the guest. But, as KERNEL_GS_BASE is a userspace-defined value/address, the leak is largely benign as a malicious userspace would simply be exposing its own data to the guest, and attacking a benevolent userspace would require multiple bugs in the userspace VMM. Cc: stable@vger.kernel.org Cc: Jun Nakajima Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit e348ac7c9e34bb2109facaafd3eea65f47314a9d Author: Sean Christopherson Date: Tue Dec 10 15:24:33 2019 -0800 KVM: VMX: Add helper to consolidate up PT/RTIT WRMSR fault logic Add a helper to consolidate the common checks for writing PT MSRs, and opportunistically clean up the formatting of the affected code. No functional change intended. Cc: Chao Peng Cc: Luwei Kang Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit fe6ed369fca98e99df55c932b85782a5687526b5 Author: Sean Christopherson Date: Tue Dec 10 15:24:32 2019 -0800 KVM: VMX: Add non-canonical check on writes to RTIT address MSRs Reject writes to RTIT address MSRs if the data being written is a non-canonical address as the MSRs are subject to canonical checks, e.g. KVM will trigger an unchecked #GP when loading the values to hardware during pt_guest_enter(). Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 311497e0c5565e7d9cf7b0987d17626b228b8fec Author: Miaohe Lin Date: Wed Dec 11 14:26:25 2019 +0800 KVM: Fix some writing mistakes Fix some writing mistakes in the comments. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 2f9f5cddb29b4fbdf2d328c7a6326d53227e6329 Author: Miaohe Lin Date: Wed Dec 11 14:26:24 2019 +0800 KVM: hyperv: Fix some typos in vcpu unimpl info Fix some typos in vcpu unimpl info. It should be unhandled rather than uhandled. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 00116795aa87ca309a4cf1eaa3d82614807c8668 Author: Miaohe Lin Date: Wed Dec 11 14:26:23 2019 +0800 KVM: Fix some grammar mistakes Fix some grammar mistakes in the comments. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 67b0ae43df179fb095f32a011446e7a883758877 Author: Miaohe Lin Date: Wed Dec 11 14:26:22 2019 +0800 KVM: Fix some comment typos and missing parentheses Fix some typos and add missing parentheses in the comments. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 4d516fe7d38555e8fa08de5d68168b011a144fcb Author: Miaohe Lin Date: Wed Dec 11 14:26:21 2019 +0800 KVM: Fix some out-dated function names in comment Since commit b1346ab2afbe ("KVM: nVMX: Rename prepare_vmcs02_*_full to prepare_vmcs02_*_rare"), prepare_vmcs02_full has been renamed to prepare_vmcs02_rare. nested_vmx_merge_msr_bitmap is renamed to nested_vmx_prepare_msr_bitmap since commit c992384bde84 ("KVM: vmx: speed up MSR bitmap merge"). Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 668effb63de8962e931196e4ebeae8387bfe6d3c Author: Miaohe Lin Date: Wed Dec 11 14:26:20 2019 +0800 KVM: Fix some wrong function names in comment Fix some wrong function names in comment. mmu_check_roots is a typo for mmu_check_root, vmcs_read_any should be vmcs12_read_any and so on. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit cad23e72b7742578fad2e4ec8856d376ec8db923 Author: Miaohe Lin Date: Sat Dec 7 17:25:22 2019 +0800 KVM: x86: check kvm_pit outside kvm_vm_ioctl_reinject() check kvm_pit outside kvm_vm_ioctl_reinject() to keep codestyle consistent with other kvm_pit func and prepare for futher cleanups. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit dfd146fcae8974d40ef6dcfc047d7a1631e064d9 Author: Wanpeng Li Date: Thu Nov 21 11:17:12 2019 +0800 KVM: LAPIC: micro-optimize fixed mode ipi delivery This patch optimizes redundancy logic before fixed mode ipi is delivered in the fast path, broadcast handling needs to go slow path, so the delivery mode repair can be delayed to before slow path. Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 1e9e2622a149e88bd636c9f8fb346a6e6aefeae0 Author: Wanpeng Li Date: Thu Nov 21 11:17:11 2019 +0800 KVM: VMX: FIXED+PHYSICAL mode single target IPI fastpath ICR and TSCDEADLINE MSRs write cause the main MSRs write vmexits in our product observation, multicast IPIs are not as common as unicast IPI like RESCHEDULE_VECTOR and CALL_FUNCTION_SINGLE_VECTOR etc. This patch introduce a mechanism to handle certain performance-critical WRMSRs in a very early stage of KVM VMExit handler. This mechanism is specifically used for accelerating writes to x2APIC ICR that attempt to send a virtual IPI with physical destination-mode, fixed delivery-mode and single target. Which was found as one of the main causes of VMExits for Linux workloads. The reason this mechanism significantly reduce the latency of such virtual IPIs is by sending the physical IPI to the target vCPU in a very early stage of KVM VMExit handler, before host interrupts are enabled and before expensive operations such as reacquiring KVM’s SRCU lock. Latency is reduced even more when KVM is able to use APICv posted-interrupt mechanism (which allows to deliver the virtual IPI directly to target vCPU without the need to kick it to host). Testing on Xeon Skylake server: The virtual IPI latency from sender send to receiver receive reduces more than 200+ cpu cycles. Reviewed-by: Liran Alon Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Sean Christopherson Cc: Vitaly Kuznetsov Cc: Liran Alon Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 9167bd96346473de5b61124f4589949fdf3026cf Author: Arvind Sankar Date: Wed Jan 15 11:07:50 2020 -0500 sparc/console: kill off obsolete declarations commit 09d3f3f0e02c ("sparc: Kill PROM console driver.") missed removing the declarations of the deleted prom_con structure and prom_con_init function from console.h. Kill them off now. Signed-off-by: Arvind Sankar Signed-off-by: David S. Miller commit 34ca70ef7d3a9fa7e89151597db5e37ae1d429b4 Author: Arnd Bergmann Date: Tue Jan 14 14:26:14 2020 +0100 sparc32: fix struct ipc64_perm type definition As discussed in the strace issue tracker, it appears that the sparc32 sysvipc support has been broken for the past 11 years. It was however working in compat mode, which is how it must have escaped most of the regular testing. The problem is that a cleanup patch inadvertently changed the uid/gid fields in struct ipc64_perm from 32-bit types to 16-bit types in uapi headers. Both glibc and uclibc-ng still use the original types, so they should work fine with compat mode, but not natively. Change the definitions to use __kernel_uid32_t and __kernel_gid32_t again. Fixes: 83c86984bff2 ("sparc: unify ipcbuf.h") Link: https://github.com/strace/strace/issues/116 Cc: # v2.6.29 Cc: Sam Ravnborg Cc: "Dmitry V . Levin" Cc: Rich Felker Cc: libc-alpha@sourceware.org Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit e2b9fc2dd6911b730279352a676251e70e51643b Author: Andreas Larsson Date: Mon Jan 13 17:01:47 2020 +0100 sparc32, leon: Stop adding vendor and device id to prom ambapp path components These extra fields before the @ are not handled in of_node_name_eq, making commit b3e46d1a0590500335f0b95e669ad6d84b12b03a break node name comparisons for ambapp path components, thereby making LEON systems unable to boot. As there is no need for the tacked on vendor and device ID fields in the path component, resolve this situation by removing them. Signed-off-by: Andreas Larsson Signed-off-by: David S. Miller commit 4f2c17e0f3324b3b82a3e0985245aefd6dcc5495 Merge: d84b99ff69c1 e27cca96cd68 Author: David S. Miller Date: Tue Jan 21 12:18:20 2020 +0100 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2020-01-21 1) Add support for TCP encapsulation of IKE and ESP messages, as defined by RFC 8229. Patchset from Sabrina Dubroca. Please note that there is a merge conflict in: net/unix/af_unix.c between commit: 3c32da19a858 ("unix: Show number of pending scm files of receive queue in fdinfo") from the net-next tree and commit: b50b0580d27b ("net: add queue argument to __skb_wait_for_more_packets and __skb_{,try_}recv_datagram") from the ipsec-next tree. The conflict can be solved as done in linux-next. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit d84b99ff69c14a03d76e7fdf9c04895848e6aece Author: Chen Zhou Date: Tue Jan 21 17:24:55 2020 +0800 drivers: net: declance: fix comparing pointer to 0 Fixes coccicheck warning: ./drivers/net/ethernet/amd/declance.c:611:14-15: WARNING comparing pointer to 0 Replace "skb == 0" with "!skb". Signed-off-by: Chen Zhou Signed-off-by: David S. Miller commit aeaec7bcebd9c85372191fb42a4478d21972d99e Author: Alex Shi Date: Tue Jan 21 16:50:07 2020 +0800 tcp/ipv4: remove AF_INET_FAMILY After commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table") the macro isn't used anymore. remove it. Signed-off-by: Alex Shi Cc: "David S. Miller" Cc: Alexey Kuznetsov Cc: Hideaki YOSHIFUJI Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller commit 339821f7d2d890a61cebeb9d085643668d4df6e4 Author: Alex Shi Date: Tue Jan 21 16:49:53 2020 +0800 net/hsr: remove seq_nr_after_or_eq It's never used after introduced. So maybe better to remove. Signed-off-by: Alex Shi Cc: Arvid Brodin Cc: "David S. Miller" Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller commit e09538eac996e11d36027cb546a9ac50d07edeb1 Author: David S. Miller Date: Tue Jan 21 12:02:25 2020 +0100 hdlx_x25: Fix backwards compat test. drivers/net/wan/hdlc_x25.c: In function ‘x25_ioctl’: drivers/net/wan/hdlc_x25.c:256:7: warning: suggest parentheses around assignment used as truth value [-Wparentheses] 256 | if (ifr->ifr_settings.size = 0) { | ^~~ Signed-off-by: David S. Miller commit 0159984796dc66ab6dc1a7cbd891e8f6bca640dd Merge: 953c4a08dfc9 60df7e91cc3e Author: David S. Miller Date: Tue Jan 21 11:46:21 2020 +0100 Merge branch 'hns3-next' Huazhong Tan says: ==================== net: hns3: misc updates for -net-next This series includes some misc updates for the HNS3 ethernet driver. [patch 1] adds a limitation for the error log in the hns3_clean_tx_ring(). [patch 2] adds a check for pfmemalloc flag before reusing pages since these pages may be used some special case. [patch 3] assigns a default reset type 'HNAE3_NONE_RESET' to VF's reset_type after initializing or reset. [patch 4] unifies macro HCLGE_DFX_REG_TYPE_CNT's definition into header file. [patch 5] refines the parameter 'size' of snprintf() in the hns3_init_module(). [patch 6] rewrites a debug message in hclge_put_vector(). [patch 7~9] adds some cleanups related to coding style. ==================== Signed-off-by: David S. Miller commit 60df7e91cc3efa141802dffad3a82b95c2ec479e Author: Huazhong Tan Date: Tue Jan 21 16:42:13 2020 +0800 net: hns3: cleanup some coding style issue This patch removes some unnecessary return value assignments, some duplicated printing in the caller, refines the judgment of 0 and uses le16_to_cpu to replace __le16_to_cpu. Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 322cb97c0734555d7a10299954624363de370c9c Author: Huazhong Tan Date: Tue Jan 21 16:42:12 2020 +0800 net: hns3: remove redundant print on ENOMEM All kmalloc-based functions print enough information on failures. So this patch removes the log in hclge_get_dfx_reg() when returns ENOMEM. Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit e31053298408dc1fbb33ad2fdc9a114e70a9dfd6 Author: Guangbin Huang Date: Tue Jan 21 16:42:11 2020 +0800 net: hns3: delete unnecessary blank line and space for cleanup This patch deletes some unnecessary blank lines and spaces to clean up code, and in hclgevf_set_vlan_filter() moves the comment to the front of hclgevf_send_mbx_msg(). Signed-off-by: Guangbin Huang Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 6f8e330d27464a7ff436f2944b84d640e42e5e6e Author: Yonglong Liu Date: Tue Jan 21 16:42:10 2020 +0800 net: hns3: rewrite a log in hclge_put_vector() When gets vector fails, hclge_put_vector() should print out the vector instead of vector_id in the log and return the wrong vector_id to its caller. Signed-off-by: Yonglong Liu Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit cdc37385e3abaf2704adf8bb15a2c14f04762d3d Author: Guojia Liao Date: Tue Jan 21 16:42:09 2020 +0800 net: hns3: refine the input parameter 'size' for snprintf() The function snprintf() writes at most size bytes (including the terminating null byte ('\0') to str. Now, We can guarantee that the parameter of size is lager than the length of str to be formatting including its terminating null byte. So it's unnecessary to minus 1 for the input parameter 'size'. Signed-off-by: Guojia Liao Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 9027d043fc31145918b40b7a68956eaff4ddb5de Author: Guojia Liao Date: Tue Jan 21 16:42:08 2020 +0800 net: hns3: move duplicated macro definition into header Macro HCLGE_GET_DFX_REG_TYPE_CNT in hclge_dbg_get_dfx_bd_num() and macro HCLGE_DFX_REG_BD_NUM in hclge_get_dfx_reg_bd_num() have the same meaning, so just defines HCLGE_GET_DFX_REG_TYPE_CNT in hclge_main.h. Signed-off-by: Guojia Liao Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit afb6afdb8dc67988d17e4926df8c8fe248ea555a Author: Huazhong Tan Date: Tue Jan 21 16:42:07 2020 +0800 net: hns3: set VF's default reset_type to HNAE3_NONE_RESET reset_type means what kind of reset the driver is handling now, so after initializing or reset, the reset_type of VF should be set to HNAE3_NONE_RESET, otherwise, this unknown default value may be a little misleading when the device is running. Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 08bb3857c6c2e2a62fe0cdc593af57215e9b95bc Author: Yunsheng Lin Date: Tue Jan 21 16:42:06 2020 +0800 net: hns3: do not reuse pfmemalloc pages HNS3 driver allocates pages for DMA with dev_alloc_pages(), which calls alloc_pages_node() with the __GFP_MEMALLOC flag. So, in case of OOM condition, HNS3 can get pages with pfmemalloc flag set. So do not reuse the pages with pfmemalloc flag set because those pages are reserved for special cases, such as low memory case. Signed-off-by: Yunsheng Lin Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 09783d448bccf1ec1c91d0b9e5443b0bcb034dbb Author: Yunsheng Lin Date: Tue Jan 21 16:42:05 2020 +0800 net: hns3: limit the error logging in the hns3_clean_tx_ring() The error log printed by netdev_err() in the hns3_clean_tx_ring() may spam the kernel log. This patch uses hns3_rl_err() to ratelimit the error log in the hns3_clean_tx_ring(). Signed-off-by: Yunsheng Lin Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 953c4a08dfc9ffe763a8340ac10f459d6c6cc4eb Author: Martin Schiller Date: Tue Jan 21 07:00:34 2020 +0100 wan/hdlc_x25: fix skb handling o call skb_reset_network_header() before hdlc->xmit() o change skb proto to HDLC (0x0019) before hdlc->xmit() o call dev_queue_xmit_nit() before hdlc->xmit() This changes make it possible to trace (tcpdump) outgoing layer2 (ETH_P_HDLC) packets Additionally call skb_reset_network_header() after each skb_push() / skb_pull(). Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit f362e5fe0f1f9774b28c5b4c9b07b0168575cf6e Author: Martin Schiller Date: Tue Jan 21 07:00:33 2020 +0100 wan/hdlc_x25: make lapb params configurable This enables you to configure mode (DTE/DCE), Modulo, Window, T1, T2, N2 via sethdlc (which needs to be patched as well). Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit 29237d22bc45d340792be217f40fb728ca48b6e6 Author: Hans Wippel Date: Tue Jan 21 01:04:46 2020 +0100 net/smc: allow unprivileged users to read pnet table The current flags of the SMC_PNET_GET command only allow privileged users to retrieve entries from the pnet table via netlink. The content of the pnet table may be useful for all users though, e.g., for debugging smc connection problems. This patch removes the GENL_ADMIN_PERM flag so that unprivileged users can read the pnet table. Signed-off-by: Hans Wippel Signed-off-by: David S. Miller commit c04f2e0dd5309607dbc425f02b5ac076b395f19d Author: Alex Shi Date: Tue Jan 21 16:49:17 2020 +0800 gfs2: remove unused LBIT macros Since commit 223b2b889f37 ("GFS2: Fix alignment issue and tidy gfs2_bitfit"), these 3 macros aren't used anymore, so remove them. Signed-off-by: Alex Shi Signed-off-by: Andreas Gruenbacher commit b3ca4e447dba6c30c7867a1353712e3507dc5110 Author: Alex Shi Date: Tue Jan 21 16:49:12 2020 +0800 fs/gfs2: remove unused IS_DINODE and IS_LEAF macros Since commit 1579343a73e3 ("GFS2: Remove dirent_first() function"), these macros aren't used any more, so remove them. Signed-off-by: Alex Shi Signed-off-by: Andreas Gruenbacher commit 108eae2d4d10cd29f7af75d45e38bc3bcde24a7c Author: Julien Thierry Date: Thu Jan 9 16:02:59 2020 +0000 arm64: entry: Avoid empty alternatives entries kernel_ventry will create alternative entries to potentially replace 0 instructions with 0 instructions for EL1 vectors. While this does not cause an issue, it pointlessly takes up some bytes in the alternatives section. Do not generate such entries. Acked-by: Mark Rutland Signed-off-by: Julien Thierry Signed-off-by: Will Deacon commit 3ccc897b228a08db741469e1d19812b38afe015e Merge: bea5416561b1 f1294617d2f3 Author: David S. Miller Date: Tue Jan 21 10:50:41 2020 +0100 Merge branch 'phy-add-new-version-of-phy_do_ioctl-and-convert-suitable-drivers' Heiner Kallweit says: ==================== net: phy: add new version of phy_do_ioctl and convert suitable drivers We just added phy_do_ioctl, but it turned out that we need another version of this function that doesn't check whether net_device is running. So rename phy_do_ioctl to phy_do_ioctl_running and add a new version of phy_do_ioctl. Eventually convert suitable drivers to use phy_do_ioctl. ==================== Signed-off-by: David S. Miller commit f1294617d2f38bd2b9f6cce516b0326858b61182 Author: Heiner Kallweit Date: Mon Jan 20 22:18:37 2020 +0100 net: convert suitable network drivers to use phy_do_ioctl Convert suitable network drivers to use phy_do_ioctl. Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit bbbf8430afe6906abbf879352fe10d24d380e588 Author: Heiner Kallweit Date: Mon Jan 20 22:17:11 2020 +0100 net: phy: add new version of phy_do_ioctl Add a new version of phy_do_ioctl that doesn't check whether net_device is running. It will typically be used if suitable drivers attach the PHY in probe already. Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 3231e5d2228a2078ce5982d63ea9a617e4972c00 Author: Heiner Kallweit Date: Mon Jan 20 22:16:07 2020 +0100 net: phy: rename phy_do_ioctl to phy_do_ioctl_running We just added phy_do_ioctl, but it turned out that we need another version of this function that doesn't check whether net_device is running. So rename phy_do_ioctl to phy_do_ioctl_running. Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit bea5416561b1b997adbe3a04a5665e647c589a13 Author: Chen Zhou Date: Mon Jan 20 20:50:33 2020 +0800 net: hns3: replace snprintf with scnprintf in hns3_update_strings snprintf returns the number of bytes that would be written, which may be greater than the the actual length to be written. Here use extra code to handle this. scnprintf returns the number of bytes that was actually written, just use scnprintf to simplify the code. Signed-off-by: Chen Zhou Signed-off-by: David S. Miller commit 49e211c0e357d8c5ccdc3c6c5fb8f94ab85d037f Author: Chen Zhou Date: Mon Jan 20 20:49:43 2020 +0800 net: hns3: replace snprintf with scnprintf in hns3_dbg_cmd_read The return value of snprintf may be greater than the size of HNS3_DBG_READ_LEN, use scnprintf instead in hns3_dbg_cmd_read. Signed-off-by: Chen Zhou Signed-off-by: David S. Miller commit ffdbae28d9d1af70b7d63ffd7827e9795cd8d0df Author: Tejas Patel Date: Mon Dec 2 02:38:51 2019 -0800 drivers: soc: xilinx: Use mailbox IPI callback Add support for init suspend callback through mailbox IPI callback. Signed-off-by: Tejas Patel Signed-off-by: Rajan Vaja Signed-off-by: Michal Simek commit a117daa83385be3876a6012eba459866586c94eb Author: Rajan Vaja Date: Mon Dec 2 02:38:50 2019 -0800 dt-bindings: power: reset: xilinx: Add bindings for ipi mailbox Add IPI mailbox property and its example in xilinx zynqmp-power documentation. Signed-off-by: Rajan Vaja Reviewed-by: Rob Herring Signed-off-by: Michal Simek commit c3c431de99c068e3f64d01335c1532b22e4b1d1b Author: Geert Uytterhoeven Date: Tue Jan 21 10:33:11 2020 +0100 dmaengine: Move dma_get_{,any_}slave_channel() to private dmaengine.h The functions dma_get_slave_channel() and dma_get_any_slave_channel() are called from DMA engine drivers only. Hence move their declarations from the public header file to the private header file drivers/dma/dmaengine.h. Signed-off-by: Geert Uytterhoeven Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20200121093311.28639-4-geert+renesas@glider.be Signed-off-by: Vinod Koul commit 71ca5b78235e79c36f774773491064d7921d1942 Author: Geert Uytterhoeven Date: Tue Jan 21 10:33:10 2020 +0100 dmaengine: Remove dma_request_slave_channel_compat() wrapper At its original introduction, dma_request_slave_channel_compat() used a wrapper, to accommodate filter functions that modify the mask passed. Filter functions can no longer modify masks, and the mask parameter was made const in commit a53e28da574a40bc ("dma: Make the 'mask' parameter of __dma_request_channel const") consecutively. Hence remove the wrapper, and rename __dma_request_slave_channel_compat() to dma_request_slave_channel_compat(), to get rid of one more function name starting with a double underscore. Signed-off-by: Geert Uytterhoeven Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20200121093311.28639-3-geert+renesas@glider.be Signed-off-by: Vinod Koul commit 69b1189ba2cd6643474312004f10685324e38f58 Author: Geert Uytterhoeven Date: Tue Jan 21 10:33:09 2020 +0100 dmaengine: Remove dma_device_satisfies_mask() wrapper Commit aa1e6f1a385eb2b0 ("dmaengine: kill struct dma_client and supporting infrastructure") removed the last user of the dma_device_satisfies_mask() wrapper. Remove the wrapper, and rename __dma_device_satisfies_mask() to dma_device_satisfies_mask(), to get rid of one more function starting with a double underscore. Signed-off-by: Geert Uytterhoeven Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20200121093311.28639-2-geert+renesas@glider.be Signed-off-by: Vinod Koul commit ad063075d406dd04d2d9bc1005161a5a08fb38c5 Merge: 17e10a15a796 b2dfc6765e45 Author: David S. Miller Date: Tue Jan 21 10:22:51 2020 +0100 Merge tag 'rds-odp-for-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/leon/linux-rdma Leon Romanovsky says: ==================== Use ODP MRs for kernel ULPs The following series extends MR creation routines to allow creation of user MRs through kernel ULPs as a proxy. The immediate use case is to allow RDS to work over FS-DAX, which requires ODP (on-demand-paging) MRs to be created and such MRs were not possible to create prior this series. The first part of this patchset extends RDMA to have special verb ib_reg_user_mr(). The common use case that uses this function is a userspace application that allocates memory for HCA access but the responsibility to register the memory at the HCA is on an kernel ULP. This ULP acts as an agent for the userspace application. The second part provides advise MR functionality for ULPs. This is integral part of ODP flows and used to trigger pagefaults in advance to prepare memory before running working set. The third part is actual user of those in-kernel APIs. ==================== Signed-off-by: David S. Miller commit d00fdf694b11f53f25b243bcbdb850e7c369a7d0 Author: Anson Huang Date: Mon Jan 13 13:33:16 2020 +0800 dt-bindings: fsl-imx-sdma: Add i.MX8MM/i.MX8MN/i.MX8MP compatible string Add imx8mm/imx8mn/imx8mp sdma support. Signed-off-by: Anson Huang Acked-by: Rob Herring Link: https://lore.kernel.org/r/1578893602-14395-1-git-send-email-Anson.Huang@nxp.com Signed-off-by: Vinod Koul commit cc88525ebffc757e00cc5a5d61da6271646c7f5f Author: Matthias Fend Date: Wed Jan 15 11:22:49 2020 +0100 dmaengine: zynqmp_dma: fix burst length configuration Since the dma engine expects the burst length register content as power of 2 value, the burst length needs to be converted first. Additionally add a burst length range check to avoid corrupting unrelated register bits. Signed-off-by: Matthias Fend Link: https://lore.kernel.org/r/20200115102249.24398-1-matthias.fend@wolfvision.net Signed-off-by: Vinod Koul commit 98346023365931948b78436ae761544b09035b3b Author: Vladimir Murzin Date: Mon Jan 20 10:36:02 2020 +0000 arm64: Kconfig: select HAVE_FUTEX_CMPXCHG arm64 provides always working implementation of futex_atomic_cmpxchg_inatomic(), so there is no need to check it runtime. Reported-by: Piyush swami Signed-off-by: Vladimir Murzin Signed-off-by: Will Deacon commit 1e4a295567949ee8e6896a7db70afd1b6246966e Author: Gao Xiang Date: Tue Jan 21 14:48:19 2020 +0800 erofs: clean up z_erofs_submit_queue() A label and extra variables will be eliminated, which is more cleaner. Link: https://lore.kernel.org/r/20200121064819.139469-1-gaoxiang25@huawei.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 587a67b77789f822930d8f5e65bdd161c82e6365 Author: Gao Xiang Date: Tue Jan 21 14:47:47 2020 +0800 erofs: fold in postsubmit_is_all_bypassed() No need to introduce such separated helper since cache strategy compile configs were changed into runtime options instead in v5.4. No logic changes. Link: https://lore.kernel.org/r/20200121064747.138987-1-gaoxiang25@huawei.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit ffc079a4accc2bd02758eb93cb8efcb3bfee1891 Author: Stefan Mavrodiev Date: Fri Jan 10 16:11:39 2020 +0200 dmaengine: sun4i: Add support for cyclic requests with dedicated DMA Currently the cyclic transfers can be used only with normal DMAs. They can be used by pcm_dmaengine module, which is required for implementing sound with sun4i-hdmi encoder. This is so because the controller can accept audio only from a dedicated DMA. This patch enables them, following the existing style for the scatter/gather type transfers. Signed-off-by: Stefan Mavrodiev Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20200110141140.28527-2-stefan@olimex.com Signed-off-by: Vinod Koul commit 4b048178854da11656596d36a107577d66fd1e08 Author: Chen Zhou Date: Mon Jan 20 20:58:43 2020 +0800 dmaengine: fsl-qdma: fix duplicated argument to && There is duplicated argument to && in function fsl_qdma_free_chan_resources, which looks like a typo, pointer fsl_queue->desc_pool also needs NULL check, fix it. Detected with coccinelle. Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") Signed-off-by: Chen Zhou Reviewed-by: Peng Ma Tested-by: Peng Ma Link: https://lore.kernel.org/r/20200120125843.34398-1-chenzhou10@huawei.com Signed-off-by: Vinod Koul commit 2bd8010a618c9181dd8d49097a1c72fd396c632e Author: Peter Ujfalusi Date: Tue Jan 21 09:01:04 2020 +0200 dmaengine: ti: k3-psil: make symbols static Fixe the following warnings by making these static drivers/dma/ti/k3-psil-j721e.c:62:16: warning: symbol 'j721e_src_ep_map' was not declared. Should it be static? drivers/dma/ti/k3-psil-j721e.c:172:16: warning: symbol 'j721e_dst_ep_map' was not declared. Should it be static? drivers/dma/ti/k3-psil-j721e.c:216:20: warning: symbol 'j721e_ep_map' was not declared. Should it be static? CC drivers/dma/ti/k3-psil-j721e.o drivers/dma/ti/k3-psil-am654.c:52:16: warning: symbol 'am654_src_ep_map' was not declared. Should it be static? drivers/dma/ti/k3-psil-am654.c:127:16: warning: symbol 'am654_dst_ep_map' was not declared. Should it be static? drivers/dma/ti/k3-psil-am654.c:169:20: warning: symbol 'am654_ep_map' was not declared. Should it be static? Reported-by: Vinod Koul Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20200121070104.4393-1-peter.ujfalusi@ti.com [vkoul: updated patch title] Signed-off-by: Vinod Koul commit 2928fa0a97ebb9549cb877fdc99aed9b95438c3a Author: Kai Vehmanen Date: Mon Jan 20 18:01:17 2020 +0200 ALSA: hda/hdmi - add retry logic to parse_intel_hdmi() The initial snd_hda_get_sub_node() can fail on certain devices (e.g. some Chromebook models using Intel GLK). The failure rate is very low, but as this is is part of the probe process, end-user impact is high. In observed cases, related hardware status registers have expected values, but the node query still fails. Retrying the node query does seem to help, so fix the problem by adding retry logic to the query. This does not impact non-Intel platforms. BugLink: https://github.com/thesofproject/linux/issues/1642 Signed-off-by: Kai Vehmanen Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20200120160117.29130-4-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit c31427d0d21e198c74d5d92082c4b8194b257f82 Author: Takashi Iwai Date: Mon Jan 20 13:44:23 2020 +0100 ALSA: hda: No preallocation on x86 platforms Like many other drivers, HD-audio drivers also do PCM buffer preallocation to assure the buffer pages allocated at the early boot stage. This step is useful for platforms that may fail to allocate the PCM hardware buffers -- which is mostly for either large continuous pages or with the specific DMA mask (like emu10k1). OTOH, when a buffer is allocated as SG-buffer and the DMA mask is either 32 or 64 bits, the allocation almost never fails unless it hits the real OOM situation. In such a case, we don't need the preallocation inevitably unlike the cases above. That said, we may drop the preallocation for HD-audio that does allocate via SG-buffers, and the patch achieves it. However, there is one caveat: the buffer allocation behavior depends on CONFIG_SND_DMA_SGBUF, and it falls back to the continuous pages when it's not set. And, currently this SG buffer allocation is enabled only on x86 platforms. So, covering those fall-outs, the patch adjusts CONFIG_SND_HDA_PREALLOC_SIZE depending on the condition, and keeps the old behavior as-is for non-x86 platforms. On x86, the kconfig item is no longer adjustable but always set to zero for disabling the preallocation. You can still enable the preallocation via procfs interface at any time later, too. Link: https://lore.kernel.org/r/20200120124423.11862-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit d4cfb30fce03093ad944e0b44bd8f40bdad5330e Author: Takashi Iwai Date: Mon Jan 20 13:44:22 2020 +0100 ALSA: pcm: Set per-card upper limit of PCM buffer allocations Currently, the available buffer allocation size for a PCM stream depends on the preallocated size; when a buffer has been preallocated, the max buffer size is set to that size, so that application won't re-allocate too much memory. OTOH, when no preallocation is done, each substream may allocate arbitrary size of buffers as long as snd_pcm_hardware.buffer_bytes_max allows -- which can be quite high, HD-audio sets 1GB there. It means that the system may consume a high amount of pages for PCM buffers, and they are pinned and never swapped out. This can lead to OOM easily. For avoiding such a situation, this patch adds the upper limit per card. Each snd_pcm_lib_malloc_pages() and _free_pages() calls are tracked and it will return an error if the total amount of buffers goes over the defined upper limit. The default value is set to 32MB, which should be really large enough for usual operations. If larger buffers are needed for any specific usage, it can be adjusted (also dynamically) via snd_pcm.max_alloc_per_card option. Setting zero there means no chceck is performed, and again, unlimited amount of buffers are allowed. Link: https://lore.kernel.org/r/20200120124423.11862-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d702419134133db1eab2067dc6ea5723467fd917 Author: Grygorii Strashko Date: Mon Dec 23 13:04:51 2019 +0200 dmaengine: ti: k3-udma: Add glue layer for non DMAengine users Certain users can not use right now the DMAengine API due to missing features in the core. Prime example is Networking. These users can use the glue layer interface to avoid misuse of DMAengine API and when the core gains the needed features they can be converted to use generic API. The most prominent features the glue layer clients are depending on: - most PSI-L native peripheral use extra rflow ranges on a receive channel and depending on the peripheral's configuration packets from a single free descriptor ring is going to be received to different receive ring - it is also possible to have different free descriptor rings per rflow and an rflow can also support 4 additional free descriptor ring based on the size of the incoming packet - out of order completion of descriptors on a channel - when we have several queues to handle different priority packets the descriptors will be completed 'out-of-order' - the notion of prep_slave_sg is not matching with what the streaming type of operation is demanding for networking - Streaming type of operation - Ability to fill the free descriptor ring with descriptors in anticipation of incoming traffic and when a packet arrives UDMAP will form a packet and gives it to the client driver - the descriptors are not backed with exact size data buffers as we don't know the size of the packet we will receive, but as a generic pool of buffers to be used by the receive channel - NAPI type of operation (polling instead of interrupt driven transfer) - without this we can not sustain gigabit speeds and we need to support NAPI - not to limit this to networking, but other high performance operations Signed-off-by: Grygorii Strashko Signed-off-by: Peter Ujfalusi Tested-by: Keerthy Link: https://lore.kernel.org/r/20191223110458.30766-12-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 25dcb5dd7b7ce5587c1df18f584ff78f51a68a94 Author: Peter Ujfalusi Date: Mon Dec 23 13:04:50 2019 +0200 dmaengine: ti: New driver for K3 UDMA Split patch for review containing: defines, structs, io and low level functions and interrupt callbacks. DMA driver for Texas Instruments K3 NAVSS Unified DMA – Peripheral Root Complex (UDMA-P) The UDMA-P is intended to perform similar (but significantly upgraded) functions as the packet-oriented DMA used on previous SoC devices. The UDMA-P module supports the transmission and reception of various packet types. The UDMA-P is architected to facilitate the segmentation and reassembly of SoC DMA data structure compliant packets to/from smaller data blocks that are natively compatible with the specific requirements of each connected peripheral. Multiple Tx and Rx channels are provided within the DMA which allow multiple segmentation or reassembly operations to be ongoing. The DMA controller maintains state information for each of the channels which allows packet segmentation and reassembly operations to be time division multiplexed between channels in order to share the underlying DMA hardware. An external DMA scheduler is used to control the ordering and rate at which this multiplexing occurs for Transmit operations. The ordering and rate of Receive operations is indirectly controlled by the order in which blocks are pushed into the DMA on the Rx PSI-L interface. The UDMA-P also supports acting as both a UTC and UDMA-C for its internal channels. Channels in the UDMA-P can be configured to be either Packet-Based or Third-Party channels on a channel by channel basis. The initial driver supports: - MEM_TO_MEM (TR mode) - DEV_TO_MEM (Packet / TR mode) - MEM_TO_DEV (Packet / TR mode) - Cyclic (Packet / TR mode) - Metadata for descriptors Signed-off-by: Peter Ujfalusi Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-11-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit d3cd299bb151c1c8579c782bf6ef2cb01ebf6e5e Author: Peter Ujfalusi Date: Mon Dec 23 13:04:49 2019 +0200 dt-bindings: dma: ti: Add document for K3 UDMA New binding document for Texas Instruments K3 NAVSS Unified DMA – Peripheral Root Complex (UDMA-P). UDMA-P is introduced as part of the K3 architecture and can be found in AM654 and j721e. Signed-off-by: Peter Ujfalusi Reviewed-by: Rob Herring Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-10-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 8c6bb62f6b4a24c446511e8f894251946dcc2ef1 Author: Peter Ujfalusi Date: Mon Dec 23 13:04:48 2019 +0200 dmaengine: ti: k3 PSI-L remote endpoint configuration In K3 architecture the DMA operates within threads. One end of the thread is UDMAP, the other is on the peripheral side. The UDMAP channel configuration depends on the needs of the remote endpoint and it can be differ from peripheral to peripheral. This patch adds database for am654 and j721e and small API to fetch the PSI-L endpoint configuration from the database which should only used by the DMA driver(s). Another API is added for native peripherals to give possibility to pass new configuration for the threads they are using, which is needed to be able to handle changes caused by different firmware loaded for the peripheral for example. Signed-off-by: Peter Ujfalusi Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-9-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 69bafc318560d02dc07e3b52af0d7cf5fc036bfe Author: Peter Ujfalusi Date: Mon Dec 23 13:04:47 2019 +0200 dmaengine: ti: Add cppi5 header for K3 NAVSS/UDMA The K3 DMA architecture uses CPPI5 (Communications Port Programming Interface) specified descriptors over PSI-L bus within NAVSS. The header provides helpers, macros to work with these descriptors in a consistent way. Signed-off-by: Peter Ujfalusi Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-8-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 816ebf48442eef1c61db26d2ec055f5c8ac83b21 Author: Peter Ujfalusi Date: Mon Dec 23 13:04:46 2019 +0200 dmaengine: Add helper function to convert direction value to text dmaengine_get_direction_text() can be useful when the direction is printed out. The text is easier to comprehend than the number. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20191223110458.30766-7-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 6755ec06d1333765d2b935e4e4a5bd011332bac6 Author: Peter Ujfalusi Date: Mon Dec 23 13:04:45 2019 +0200 dmaengine: Add support for reporting DMA cached data amount A DMA hardware can have big cache or FIFO and the amount of data sitting in the DMA fabric can be an interest for the clients. For example in audio we want to know the delay in the data flow and in case the DMA have significantly large FIFO/cache, it can affect the latenc/delay Signed-off-by: Peter Ujfalusi Reviewed-by: Tero Kristo Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-6-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 4db8fd32ed2be7cc510e51e43ec3349aa64074a9 Author: Peter Ujfalusi Date: Mon Dec 23 13:04:44 2019 +0200 dmaengine: Add metadata_ops for dma_async_tx_descriptor The metadata is best described as side band data or parameters traveling alongside the data DMAd by the DMA engine. It is data which is understood by the peripheral and the peripheral driver only, the DMA engine see it only as data block and it is not interpreting it in any way. The metadata can be different per descriptor as it is a parameter for the data being transferred. If the DMA supports per descriptor metadata it can implement the attach, get_ptr/set_len callbacks. Client drivers must only use either attach or get_ptr/set_len to avoid misconfiguration. Client driver can check if a given metadata mode is supported by the channel during probe time with dmaengine_is_metadata_mode_supported(chan, DESC_METADATA_CLIENT); dmaengine_is_metadata_mode_supported(chan, DESC_METADATA_ENGINE); and based on this information can use either mode. Wrappers are also added for the metadata_ops. To be used in DESC_METADATA_CLIENT mode: dmaengine_desc_attach_metadata() To be used in DESC_METADATA_ENGINE mode: dmaengine_desc_get_metadata_ptr() dmaengine_desc_set_metadata_len() Signed-off-by: Peter Ujfalusi Reviewed-by: Tero Kristo Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-5-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 7d083ae983573de16e3ab0bfd47486996d211417 Author: Peter Ujfalusi Date: Mon Dec 23 13:04:43 2019 +0200 dmaengine: doc: Add sections for per descriptor metadata support Update the provider and client documentation with details about the metadata support. Signed-off-by: Peter Ujfalusi Reviewed-by: Tero Kristo Tested-by: Keerthy Reviewed-by: Grygorii Strashko Link: https://lore.kernel.org/r/20191223110458.30766-4-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 5fe4beaac239816338b132517cf638d690f74d39 Merge: 4d3df16840a2 3277e8aa2504 Author: Vinod Koul Date: Tue Jan 21 11:01:09 2020 +0530 Merge TI ringacc driver from Santosh This is for dependency of new TI ringacc dmaengine drivers Merge tag 'drivers_soc_for_5.6' into topic/ti SOC: TI Keystone Ring Accelerator driver The Ring Accelerator (RINGACC or RA) provides hardware acceleration to enable straightforward passing of work between a producer and a consumer. There is one RINGACC module per NAVSS on TI AM65x SoCs. Signed-off-by: Vinod Koul commit 0dfed6dc24576f256782d5288537927c69256081 Author: Alexandru Ardelean Date: Fri Jan 10 15:38:15 2020 -0800 Input: ads7846 - use new `delay` structure for SPI transfer delays In a recent change to the SPI subsystem [1], a new `delay` struct was added to replace the `delay_usecs`. This change replaces the current `delay_usecs` with `delay` for this driver. The `spi_transfer_delay_exec()` function [in the SPI framework] makes sure that both `delay_usecs` & `delay` are used (in this order to preserve backwards compatibility). [1] commit bebcfd272df6485 ("spi: introduce `delay` field for `spi_transfer` + spi_transfer_delay_exec()") Signed-off-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20191210141103.15910-1-alexandru.ardelean@analog.com Signed-off-by: Dmitry Torokhov commit 76ed99d199f7b66b1f762392b19d115994d7e81b Author: Russell King Date: Mon Dec 9 11:11:43 2019 +0000 Documentation: update adfs filesystem documentation Add an introduction to adfs to its documentation detailing which formats are supported by the module. Signed-off-by: Russell King Signed-off-by: Al Viro commit 25e5d4df3b46a345dccc0a07f998ce443077b4ff Author: Russell King Date: Mon Dec 9 11:11:38 2019 +0000 fs/adfs: mostly divorse inode number from indirect disc address Avoid using the inode number as the indirect disc address, even though these currently have the same value. Signed-off-by: Russell King Signed-off-by: Al Viro commit 08ead1b8b98d90795bf934d93a718328d11f6ce6 Author: Russell King Date: Mon Dec 9 11:11:33 2019 +0000 fs/adfs: super: add support for E and E+ floppy image formats Add support for ADFS E and E+ floppy image formats, which, unlike their hard disk variants, do not have a filesystem boot block - they have a single map zone, with the map fragment stored at sector 0. Signed-off-by: Russell King Signed-off-by: Al Viro commit e3858e125bd57b827af52dfb38df6c8602559886 Author: Russell King Date: Mon Dec 9 11:11:28 2019 +0000 fs/adfs: super: extract filesystem block probe Separate the filesystem block probing from the superblock filling so we can support other ADFS filesystem formats, such as the single-zone E and E+ floppy image formats which do not have a boot block. Signed-off-by: Russell King Signed-off-by: Al Viro commit ccbc80a89d1399b79e43544cfbe44df964a29810 Author: Russell King Date: Mon Dec 9 11:11:23 2019 +0000 fs/adfs: dir: remove debug in adfs_dir_update() Remove the noisy debug in adfs_dir_update(). Signed-off-by: Russell King Signed-off-by: Al Viro commit f352064275adfeb6f88cb0fb25cc623750adf89f Author: Russell King Date: Mon Dec 9 11:11:18 2019 +0000 fs/adfs: super: fix inode dropping When we have write support enabled, we must not drop inodes before they have been written back, otherwise we lose updates to the filesystem on umount. Keep the inodes around unless we are built in read-only mode, or we are mounted read-only. Signed-off-by: Russell King Signed-off-by: Al Viro commit a464152f2e6dfd6d8be45c5e591cb8be20a97bdb Author: Russell King Date: Mon Dec 9 11:11:13 2019 +0000 fs/adfs: bigdir: implement directory update support Implement big directory entry update support in the same way that we do for new directories. Signed-off-by: Russell King Signed-off-by: Al Viro commit d79288b4f61b40976182786ba2cb05ed5f2b6945 Author: Russell King Date: Mon Dec 9 11:11:08 2019 +0000 fs/adfs: bigdir: calculate and validate directory checkbyte When reading a big directory, calculate the validate the directory checkbyte to ensure that the directory contents are valid. Signed-off-by: Russell King Signed-off-by: Al Viro commit aa3d4e015298fd523617c2bea392d02ea19eaa1a Author: Russell King Date: Mon Dec 9 11:11:02 2019 +0000 fs/adfs: bigdir: directory validation strengthening Strengthen the directory validation by ensuring that the header fields contain sensible values that fit inside the directory, and limit the directory size to 4MB as per RISC OS requirements. Signed-off-by: Russell King Signed-off-by: Al Viro commit 6674ecab9004dcc4d8a65744f581b9ccf1f17504 Author: Russell King Date: Mon Dec 9 11:10:57 2019 +0000 fs/adfs: bigdir: extract directory validation Extract the directory validation from the directory reading function as we will want to re-use this code. Signed-off-by: Russell King Signed-off-by: Al Viro commit 0db35a02a1c3f3abdfac9d56c1cee2fe23b66987 Author: Russell King Date: Mon Dec 9 11:10:52 2019 +0000 fs/adfs: bigdir: factor out directory entry offset calculation Factor out the directory entry byte offset calculation. Signed-off-by: Russell King Signed-off-by: Al Viro commit aacc954c1be8910a994e09a8f8757a2e3e231c37 Author: Russell King Date: Mon Dec 9 11:10:47 2019 +0000 fs/adfs: newdir: split out directory commit from update After changing a directory, we need to update the sequence numbers and calculate the new check byte before the directory is scheduled to be written back to the media. Since this needs to happen for any change to the directory, move this into a separate method. Signed-off-by: Russell King Signed-off-by: Al Viro commit cc625ccd0e6c2804cd0935743e3b51121a712562 Author: Russell King Date: Mon Dec 9 11:10:42 2019 +0000 fs/adfs: newdir: clean up adfs_f_update() __adfs_dir_put() and adfs_dir_find_entry() are only called from adfs_f_update(), so move them into this function, removing some unnecessary entry copying by doing so. Signed-off-by: Russell King Signed-off-by: Al Viro commit 9318731bec8d38bdbe701d395cf103157046831d Author: Russell King Date: Mon Dec 9 11:10:37 2019 +0000 fs/adfs: newdir: merge adfs_dir_read() into adfs_f_read() adfs_dir_read() is only called from adfs_f_read(), so merge it into that function. As new directories are always 2048 bytes in size, (which we rely on elsewhere) we can consolidate some of the code. Signed-off-by: Russell King Signed-off-by: Al Viro commit 7a0e4048bfd16848ac115b17f49a3df7993a2fac Author: Russell King Date: Mon Dec 9 11:10:32 2019 +0000 fs/adfs: newdir: improve directory validation Check that the lastmask and reserved fields are all zero, as per the documentation. Signed-off-by: Russell King Signed-off-by: Al Viro commit ffc8df347e4934c8bad776f7bdacb4842620b0c7 Author: Russell King Date: Mon Dec 9 11:10:27 2019 +0000 fs/adfs: newdir: factor out directory format validation We have two locations where we validate the new directory format, so factor this out to a helper. Signed-off-by: Russell King Signed-off-by: Al Viro commit 016936b32131d0b33328d8c109f83fabb56618a3 Author: Russell King Date: Mon Dec 9 11:10:21 2019 +0000 fs/adfs: dir: use pointers to access directory head/tails Add and use pointers in the adfs_dir structure to access the directory head and tail structures, which will always be contiguous in a buffer. This allows us to avoid memcpy()ing the data in the new directory code, making it slightly more efficient. Signed-off-by: Russell King Signed-off-by: Al Viro commit 4287e4deb1280633ffbda608f946d6d7c2d76d4a Author: Russell King Date: Mon Dec 9 11:10:16 2019 +0000 fs/adfs: dir: add more efficient iterate() per-format method Rather than using setpos + getnext to iterate through the directory entries, pass iterate() down to the dir format code to populate the dirents. Signed-off-by: Russell King Signed-off-by: Al Viro commit cdc46e99e1c9f50802c4f543f10151887e4c4e0e Author: Russell King Date: Mon Dec 9 11:10:11 2019 +0000 fs/adfs: dir: switch to iterate_shared method There is nothing in our readdir (aka iterate) method that relies on the directory inode being exclusively locked, so switch to using the iterate_shared() hook rather than iterate(). Signed-off-by: Russell King Signed-off-by: Al Viro commit 4a0a88b6660b48f773b6e7631e0be57b7f5048ed Author: Russell King Date: Mon Dec 9 11:10:06 2019 +0000 fs/adfs: dir: improve compiler coverage in adfs_dir_update Get rid of the ifdef, using IS_ENABLED() instead to detect whether the code should be callable. This allows the compiler to always parse the following code, reducing the chances of errors being missed. Signed-off-by: Russell King Signed-off-by: Al Viro commit f6075c79074378910e131bbebc9d1dab53fd9986 Author: Russell King Date: Mon Dec 9 11:10:01 2019 +0000 fs/adfs: dir: improve update failure handling When we update a directory, a number of errors may happen. If we failed to find the entry to update, we can just release the directory buffers as normal. However, if we have some other error, we may have partially updated the buffers, resulting in an invalid directory. In this case, we need to discard the buffers to avoid writing the contents back to the media, and later re-read the directory from the media. Signed-off-by: Russell King Signed-off-by: Al Viro commit ae5df41390eb1c40b9a5c220673d8c31a4cb57db Author: Russell King Date: Mon Dec 9 11:09:56 2019 +0000 fs/adfs: dir: modernise on-disk directory structures Use __u8 and pack the structures for on-disk directories. Signed-off-by: Russell King Signed-off-by: Al Viro commit deed1bfd150c7c71bcdc16419c90933096c1c75e Author: Russell King Date: Mon Dec 9 11:09:51 2019 +0000 fs/adfs: dir: update directory locking Update directory locking such that it covers the validation of the directory, which could fail if another thread is concurrently writing to the same directory. Since we may sleep, we need to use a rwsem rather than a rw spinlock. Signed-off-by: Russell King Signed-off-by: Al Viro commit c3c8149b3552b6656ded9ac86d53072f74771ba7 Author: Russell King Date: Mon Dec 9 11:09:45 2019 +0000 fs/adfs: dir: add helper to mark directory buffers dirty Provide a helper for marking directory buffers dirty so they get written back to disk. Signed-off-by: Russell King Signed-off-by: Al Viro commit 90011c7ad999c9565a5c97704cd5bda151ebe447 Author: Russell King Date: Mon Dec 9 11:09:40 2019 +0000 fs/adfs: dir: add helper to read directory using inode Add a helper to read a directory using the inode, which we do in two places. Signed-off-by: Russell King Signed-off-by: Al Viro commit 419a6e5e82ca0bdba0cc3624d969b65ae49d959b Author: Russell King Date: Mon Dec 9 11:09:35 2019 +0000 fs/adfs: dir: add generic directory reading Both directory formats code the mechanics of fetching the directory buffers using their own implementations. Consolidate these into one implementation. Signed-off-by: Russell King Signed-off-by: Al Viro commit a317120bf7f8306b594ee650ee14f08a0e599602 Author: Russell King Date: Mon Dec 9 11:09:30 2019 +0000 fs/adfs: dir: add generic copy functions Directories can span multiple buffers, and we currently open-code memcpy access to these buffers, including dealing with entries that are split across multiple buffers. Such code exists in both directory format implementations. Provide common functions to allow data to be copied from/to the directory buffers as if they were a contiguous set of buffers, and use them when accessing directories. Signed-off-by: Russell King Signed-off-by: Al Viro commit acf5f0be8a520c02bfed74cfc6735bf5fdd4a9e5 Author: Russell King Date: Mon Dec 9 11:09:25 2019 +0000 fs/adfs: dir: add common directory sync method adfs_fplus_sync() can be used for both directory formats since we now have a common way to access the buffer heads, so move it into dir.c and appropriately rename it. Remove the directory-format specific implementations. Signed-off-by: Russell King Signed-off-by: Al Viro commit 1dd9f5babfd95fea5a77b27bab48c04c29db1f5f Author: Russell King Date: Mon Dec 9 11:09:20 2019 +0000 fs/adfs: dir: add common directory buffer release method With the bhs pointer in place, we have no need for separate per-format free() methods, since a generic version will do. Provide a generic implementation, remove the format specific implementations and the method function pointer. Signed-off-by: Russell King Signed-off-by: Al Viro commit 95fbadbb5566e383f0cfe40d895e698ab38bdbc7 Author: Russell King Date: Mon Dec 9 11:09:15 2019 +0000 fs/adfs: dir: add common dir object initialisation Initialise the dir object before we pass it down to the directory format specific read handler. This allows us to get rid of the initialisation inside those handlers. Signed-off-by: Russell King Signed-off-by: Al Viro commit 71b2612776c1b9c34c460f79bcdaef46d0e77ed2 Author: Russell King Date: Mon Dec 9 11:09:10 2019 +0000 fs/adfs: dir: rename bh_fplus to bhs Rename bh_fplus to bhs in preparation to make some of the directory handling code sharable between implementations. Signed-off-by: Russell King Signed-off-by: Al Viro commit f93793fd73a629f4c86b0d91fd84fe175705aff9 Author: Russell King Date: Mon Dec 9 11:09:04 2019 +0000 fs/adfs: map: fix map scanning When scanning the map for a fragment id, we need to keep track of the free space links, so we don't inadvertently believe that the freespace link is a valid fragment id. Signed-off-by: Russell King Signed-off-by: Al Viro commit f6f14a0d71b0773a1d4147d1a3c33d537cd213ab Author: Russell King Date: Mon Dec 9 11:08:59 2019 +0000 fs/adfs: map: move map-specific sb initialisation to map.c Move map specific superblock initialisation to map.c, rather than having it spread into super.c. Signed-off-by: Russell King Signed-off-by: Al Viro commit 792314f8b223f77037b85e6242c67df15623cf75 Author: Russell King Date: Mon Dec 9 11:08:54 2019 +0000 fs/adfs: map: use find_next_bit_le() rather than open coding it Use find_next_bit_le() to find the end of a fragment in the map rather than open-coding this functionality. Signed-off-by: Russell King Signed-off-by: Al Viro commit 197ba3c519312a0bed91aeaf34095b2c09c6431a Author: Russell King Date: Mon Dec 9 11:08:49 2019 +0000 fs/adfs: map: incorporate map offsets into layout lookup_zone() and scan_free_map() cope in different ways with the location of the map data within a zone: 1. lookup_zone() adds a four byte offset to the map data pointer to skip over the check and free link bytes. 2. scan_free_map() needs to use the free link pointer, which is an offset from itself, so we end up adding a 32-bit offset to the end pointer (aka mapsize) which is really confusing. Rename mapsize to endbit as this is really what it is, and incorporate the 32-bit offset into the map layout. This means that both dm_startbit and dm_endbit are now bit offsets from the start of the buffer, rather than four bytes in to the buffer. Signed-off-by: Russell King Signed-off-by: Al Viro commit 7b1952676256d2cdc03d0415a4c0e6bfb64e00ff Author: Russell King Date: Mon Dec 9 11:08:44 2019 +0000 fs/adfs: map: factor out map cleanup We have several places which deal with releasing the map buffers and freeing the map array. Provide a helper for this. Signed-off-by: Russell King Signed-off-by: Al Viro commit 6092b6be304494e311b65935f5e09b510cbd57cc Author: Russell King Date: Mon Dec 9 11:08:39 2019 +0000 fs/adfs: map: break up adfs_read_map() Split up adfs_read_map() into separate helpers to layout the map, read the map, and release the map buffers. Signed-off-by: Russell King Signed-off-by: Al Viro commit e6160e469f56a23cb69e1dc37aa0d895bf29ac24 Author: Russell King Date: Mon Dec 9 11:08:34 2019 +0000 fs/adfs: map: rename adfs_map_free() to adfs_map_statfs() adfs_map_free() is not obvious whether it is freeing the map or returning the number of free blocks on the filesystem. Rename it to the more generic statfs() to make it clear that it's a statistic function. Signed-off-by: Russell King Signed-off-by: Al Viro commit f75d398d6ee61b04c16124e3eddd786526bc7d40 Author: Russell King Date: Mon Dec 9 11:08:28 2019 +0000 fs/adfs: map: move m