Commit graph

932,869 commits

Author SHA1 Message Date
Thomas Gleixner
5999bbe7a6 Documentation: Add MDS vulnerability documentation
Add the initial MDS vulnerability documentation.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:16 +01:00
Thomas Gleixner
65fd4cb65b Documentation: Move L1TF to separate directory
Move L!TF to a separate directory so the MDS stuff can be added at the
side. Otherwise the all hardware vulnerabilites have their own top level
entry. Should have done that right away.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:15 +01:00
Thomas Gleixner
22dd836508 x86/speculation/mds: Add mitigation mode VMWERV
In virtualized environments it can happen that the host has the microcode
update which utilizes the VERW instruction to clear CPU buffers, but the
hypervisor is not yet updated to expose the X86_FEATURE_MD_CLEAR CPUID bit
to guests.

Introduce an internal mitigation mode VMWERV which enables the invocation
of the CPU buffer clearing even if X86_FEATURE_MD_CLEAR is not set. If the
system has no updated microcode this results in a pointless execution of
the VERW instruction wasting a few CPU cycles. If the microcode is updated,
but not exposed to a guest then the CPU buffers will be cleared.

That said: Virtual Machines Will Eventually Receive Vaccine

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:15 +01:00
Thomas Gleixner
8a4b06d391 x86/speculation/mds: Add sysfs reporting for MDS
Add the sysfs reporting file for MDS. It exposes the vulnerability and
mitigation state similar to the existing files for the other speculative
hardware vulnerabilities.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:14 +01:00
Thomas Gleixner
bc1241700a x86/speculation/mds: Add mitigation control for MDS
Now that the mitigations are in place, add a command line parameter to
control the mitigation, a mitigation selector function and a SMT update
mechanism.

This is the minimal straight forward initial implementation which just
provides an always on/off mode. The command line parameter is:

  mds=[full|off]

This is consistent with the existing mitigations for other speculative
hardware vulnerabilities.

The idle invocation is dynamically updated according to the SMT state of
the system similar to the dynamic update of the STIBP mitigation. The idle
mitigation is limited to CPUs which are only affected by MSBDS and not any
other variant, because the other variants cannot be mitigated on SMT
enabled systems.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:14 +01:00
Thomas Gleixner
07f07f55a2 x86/speculation/mds: Conditionally clear CPU buffers on idle entry
Add a static key which controls the invocation of the CPU buffer clear
mechanism on idle entry. This is independent of other MDS mitigations
because the idle entry invocation to mitigate the potential leakage due to
store buffer repartitioning is only necessary on SMT systems.

Add the actual invocations to the different halt/mwait variants which
covers all usage sites. mwaitx is not patched as it's not available on
Intel CPUs.

The buffer clear is only invoked before entering the C-State to prevent
that stale data from the idling CPU is spilled to the Hyper-Thread sibling
after the Store buffer got repartitioned and all entries are available to
the non idle sibling.

When coming out of idle the store buffer is partitioned again so each
sibling has half of it available. Now CPU which returned from idle could be
speculatively exposed to contents of the sibling, but the buffers are
flushed either on exit to user space or on VMENTER.

When later on conditional buffer clearing is implemented on top of this,
then there is no action required either because before returning to user
space the context switch will set the condition flag which causes a flush
on the return to user path.

Note, that the buffer clearing on idle is only sensible on CPUs which are
solely affected by MSBDS and not any other variant of MDS because the other
MDS variants cannot be mitigated when SMT is enabled, so the buffer
clearing on idle would be a window dressing exercise.

This intentionally does not handle the case in the acpi/processor_idle
driver which uses the legacy IO port interface for C-State transitions for
two reasons:

 - The acpi/processor_idle driver was replaced by the intel_idle driver
   almost a decade ago. Anything Nehalem upwards supports it and defaults
   to that new driver.

 - The legacy IO port interface is likely to be used on older and therefore
   unaffected CPUs or on systems which do not receive microcode updates
   anymore, so there is no point in adding that.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:13 +01:00
Thomas Gleixner
650b68a062 x86/kvm/vmx: Add MDS protection when L1D Flush is not active
CPUs which are affected by L1TF and MDS mitigate MDS with the L1D Flush on
VMENTER when updated microcode is installed.

If a CPU is not affected by L1TF or if the L1D Flush is not in use, then
MDS mitigation needs to be invoked explicitly.

For these cases, follow the host mitigation state and invoke the MDS
mitigation before VMENTER.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:13 +01:00
Thomas Gleixner
04dcbdb805 x86/speculation/mds: Clear CPU buffers on exit to user
Add a static key which controls the invocation of the CPU buffer clear
mechanism on exit to user space and add the call into
prepare_exit_to_usermode() and do_nmi() right before actually returning.

Add documentation which kernel to user space transition this covers and
explain why some corner cases are not mitigated.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:13 +01:00
Thomas Gleixner
6a9e529272 x86/speculation/mds: Add mds_clear_cpu_buffers()
The Microarchitectural Data Sampling (MDS) vulernabilities are mitigated by
clearing the affected CPU buffers. The mechanism for clearing the buffers
uses the unused and obsolete VERW instruction in combination with a
microcode update which triggers a CPU buffer clear when VERW is executed.

Provide a inline function with the assembly magic. The argument of the VERW
instruction must be a memory operand as documented:

  "MD_CLEAR enumerates that the memory-operand variant of VERW (for
   example, VERW m16) has been extended to also overwrite buffers affected
   by MDS. This buffer overwriting functionality is not guaranteed for the
   register operand variant of VERW."

Documentation also recommends to use a writable data segment selector:

  "The buffer overwriting occurs regardless of the result of the VERW
   permission check, as well as when the selector is null or causes a
   descriptor load segment violation. However, for lowest latency we
   recommend using a selector that indicates a valid writable data
   segment."

Add x86 specific documentation about MDS and the internal workings of the
mitigation.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:12 +01:00
Andi Kleen
6c4dbbd147 x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
X86_FEATURE_MD_CLEAR is a new CPUID bit which is set when microcode
provides the mechanism to invoke a flush of various exploitable CPU buffers
by invoking the VERW instruction.

Hand it through to guests so they can adjust their mitigations.

This also requires corresponding qemu changes, which are available
separately.

[ tglx: Massaged changelog ]

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:12 +01:00
Thomas Gleixner
e261f209c3 x86/speculation/mds: Add BUG_MSBDS_ONLY
This bug bit is set on CPUs which are only affected by Microarchitectural
Store Buffer Data Sampling (MSBDS) and not by any other MDS variant.

This is important because the Store Buffers are partitioned between
Hyper-Threads so cross thread forwarding is not possible. But if a thread
enters or exits a sleep state the store buffer is repartitioned which can
expose data from one thread to the other. This transition can be mitigated.

That means that for CPUs which are only affected by MSBDS SMT can be
enabled, if the CPU is not affected by other SMT sensitive vulnerabilities,
e.g. L1TF. The XEON PHI variants fall into that category. Also the
Silvermont/Airmont ATOMs, but for them it's not really relevant as they do
not support SMT, but mark them for completeness sake.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:11 +01:00
Andi Kleen
ed5194c273 x86/speculation/mds: Add basic bug infrastructure for MDS
Microarchitectural Data Sampling (MDS), is a class of side channel attacks
on internal buffers in Intel CPUs. The variants are:

 - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)
 - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)
 - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127)

MSBDS leaks Store Buffer Entries which can be speculatively forwarded to a
dependent load (store-to-load forwarding) as an optimization. The forward
can also happen to a faulting or assisting load operation for a different
memory address, which can be exploited under certain conditions. Store
buffers are partitioned between Hyper-Threads so cross thread forwarding is
not possible. But if a thread enters or exits a sleep state the store
buffer is repartitioned which can expose data from one thread to the other.

MFBDS leaks Fill Buffer Entries. Fill buffers are used internally to manage
L1 miss situations and to hold data which is returned or sent in response
to a memory or I/O operation. Fill buffers can forward data to a load
operation and also write data to the cache. When the fill buffer is
deallocated it can retain the stale data of the preceding operations which
can then be forwarded to a faulting or assisting load operation, which can
be exploited under certain conditions. Fill buffers are shared between
Hyper-Threads so cross thread leakage is possible.

MLDPS leaks Load Port Data. Load ports are used to perform load operations
from memory or I/O. The received data is then forwarded to the register
file or a subsequent operation. In some implementations the Load Port can
contain stale data from a previous operation which can be forwarded to
faulting or assisting loads under certain conditions, which again can be
exploited eventually. Load ports are shared between Hyper-Threads so cross
thread leakage is possible.

All variants have the same mitigation for single CPU thread case (SMT off),
so the kernel can treat them as one MDS issue.

Add the basic infrastructure to detect if the current CPU is affected by
MDS.

[ tglx: Rewrote changelog ]

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:11 +01:00
Thomas Gleixner
36ad35131a x86/speculation: Consolidate CPU whitelists
The CPU vulnerability whitelists have some overlap and there are more
whitelists coming along.

Use the driver_data field in the x86_cpu_id struct to denote the
whitelisted vulnerabilities and combine all whitelists into one.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:10 +01:00
Thomas Gleixner
d8eabc3731 x86/msr-index: Cleanup bit defines
Greg pointed out that speculation related bit defines are using (1 << N)
format instead of BIT(N). Aside of that (1 << N) is wrong as it should use
1UL at least.

Clean it up.

[ Josh Poimboeuf: Fix tools build ]

Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Jon Masters <jcm@redhat.com>
Tested-by: Jon Masters <jcm@redhat.com>
2019-03-06 21:52:10 +01:00
Harry Wentland
59d3191f14 drm/amd/display: don't call dm_pp_ function from an fpu block
Powerplay functions called from dm_pp_* functions tend to do a
mutex_lock which isn't safe to do inside a kernel_fpu_begin/end block as
those will disable/enable preemption.

Rearrange the dm_pp_get_clock_levels_by_type_with_voltage calls to make
sure they happen outside of kernel_fpu_begin/end.

Cc: stable@vger.kernel.org
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2019-03-06 15:31:20 -05:00
Ville Syrjälä
37fbbd4905 drm/i915: Populate pipe_offsets[] & co. accurately
At some point people have started to assume that
pipe_offsets[] & co. are only populated for pipes and whatnot
that actually exist. That is in fact not currently true, but
we can easily make it so.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190305192905.7140-1-ville.syrjala@linux.intel.com
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
2019-03-06 22:06:55 +02:00
Jens Axboe
21b4aa5d20 io_uring: add a few test tools
This adds two test programs in tools/io_uring/ that demonstrate both
the raw io_uring API (and all features) through a small benchmark
app, io_uring-bench, and the liburing exposed API in a simplified
cp(1) implementation through io_uring-cp.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-03-06 13:00:16 -07:00
Jens Axboe
31b5151064 io_uring: allow workqueue item to handle multiple buffered requests
Right now we punt any buffered request that ends up triggering an
-EAGAIN to an async workqueue. This works fine in terms of providing
async execution of them, but it also can create quite a lot of work
queue items. For sequentially buffered IO, it's advantageous to
serialize the issue of them. For reads, the first one will trigger a
read-ahead, and subsequent request merely end up waiting on later pages
to complete. For writes, devices usually respond better to streamed
sequential writes.

Add state to track the last buffered request we punted to a work queue,
and if the next one is sequential to the previous, attempt to get the
previous work item to handle it. We limit the number of sequential
add-ons to the a multiple (8) of the max read-ahead size of the file.
This should be a good number for both reads and wries, as it defines the
max IO size the device can do directly.

This drastically cuts down on the number of context switches we need to
handle buffered sequential IO, and a basic test case of copying a big
file with io_uring sees a 5x speedup.

Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-03-06 13:00:16 -07:00
Jens Axboe
221c5eb233 io_uring: add support for IORING_OP_POLL
This is basically a direct port of bfe4037e72, which implements a
one-shot poll command through aio. Description below is based on that
commit as well. However, instead of adding a POLL command and relying
on io_cancel(2) to remove it, we mimic the epoll(2) interface of
having a command to add a poll notification, IORING_OP_POLL_ADD,
and one to remove it again, IORING_OP_POLL_REMOVE.

To poll for a file descriptor the application should submit an sqe of
type IORING_OP_POLL. It will poll the fd for the events specified in the
poll_events field.

Unlike poll or epoll without EPOLLONESHOT this interface always works in
one shot mode, that is once the sqe is completed, it will have to be
resubmitted.

Reviewed-by: Hannes Reinecke <hare@suse.com>
Based-on-code-from: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-03-06 13:00:12 -07:00
Moni Shoua
fca22e7e59 net/mlx5: ODP support for XRC transport is not enabled by default in FW
ODP support for XRC transport is not enabled by default in FW, so we need
separate ODP checks to enable/disable it.

While that, rewrite the set of ODP SRQ support capabilities in way that
tests each field separately for clearness, which is not needed for current
FW, but better to have it separated.

Signed-off-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2019-03-06 15:53:09 -04:00
Arnd Bergmann
041a15744a time: Make VIRT_CPU_ACCOUNTING_GEN depend on GENERIC_CLOCKEVENTS
Moving the CONTEXT_TRACKING Kconfig option into kernel/time/Kconfig added
an implicit dependency on the surrounding GENERIC_CLOCKEVENTS option, but
this is not always enabled when it is possible to select
VIRT_CPU_ACCOUNTING_GEN:

WARNING: unmet direct dependencies detected for CONTEXT_TRACKING
  Depends on [n]: GENERIC_CLOCKEVENTS [=n]
  Selected by [y]:
  - VIRT_CPU_ACCOUNTING_GEN [=y] && <choice> && HAVE_CONTEXT_TRACKING [=y] && HAVE_VIRT_CPU_ACCOUNTING_GEN [=y]

Platforms without GENERIC_CLOCKEVENTS are rare enough so that corner case
can be just ignored. Make it a dependency for VIRT_CPU_ACCOUNTING_GEN to
simplify the configuration.

Fixes: a4cffdad73 ("time: Move CONTEXT_TRACKING to kernel/time/Kconfig")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: "Paul E . McKenney" <paulmck@linux.ibm.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Link: https://lkml.kernel.org/r/20190304200202.1163250-1-arnd@arndb.de
2019-03-06 20:43:08 +01:00
Arnaldo Carvalho de Melo
bc3bb79534 perf annotate: Calculate the max instruction name, align column to that
We were hardcoding '6' as the max instruction name, and we have lots
that are longer than that, see the diff from two 'P' printed TUI
annotations for a libc function that uses instructions with long names,
such as 'vpmovmskb' with its 9 chars:

  --- __strcmp_avx2.annotation.before	2019-03-06 16:31:39.368020425 -0300
  +++ __strcmp_avx2.annotation	2019-03-06 16:32:12.079450508 -0300
  @@ -2,284 +2,284 @@
   Event: cycles:ppp

   Percent        endbr64
  -  0.10         mov    %edi,%eax
  +  0.10         mov        %edi,%eax
  -               xor    %edx,%edx
  +               xor        %edx,%edx
  -  3.54         vpxor  %ymm7,%ymm7,%ymm7
  +  3.54         vpxor      %ymm7,%ymm7,%ymm7
  -               or     %esi,%eax
  +               or         %esi,%eax
  -               and    $0xfff,%eax
  +               and        $0xfff,%eax
  -               cmp    $0xf80,%eax
  +               cmp        $0xf80,%eax
  -             ↓ jg     370
  +             ↓ jg         370
  - 27.07         vmovdqu (%rdi),%ymm1
  + 27.07         vmovdqu    (%rdi),%ymm1
  -  7.97         vpcmpeqb (%rsi),%ymm1,%ymm0
  +  7.97         vpcmpeqb   (%rsi),%ymm1,%ymm0
  -  2.15         vpminub %ymm1,%ymm0,%ymm0
  +  2.15         vpminub    %ymm1,%ymm0,%ymm0
  -  4.09         vpcmpeqb %ymm7,%ymm0,%ymm0
  +  4.09         vpcmpeqb   %ymm7,%ymm0,%ymm0
  -  0.43         vpmovmskb %ymm0,%ecx
  +  0.43         vpmovmskb  %ymm0,%ecx
  -  1.53         test   %ecx,%ecx
  +  1.53         test       %ecx,%ecx
  -             ↓ je     b0
  +             ↓ je         b0
  -  5.26         tzcnt  %ecx,%edx
  +  5.26         tzcnt      %ecx,%edx
  - 18.40         movzbl (%rdi,%rdx,1),%eax
  + 18.40         movzbl     (%rdi,%rdx,1),%eax
  -  7.09         movzbl (%rsi,%rdx,1),%edx
  +  7.09         movzbl     (%rsi,%rdx,1),%edx
  -  3.34         sub    %edx,%eax
  +  3.34         sub        %edx,%eax
     2.37         vzeroupper
                ← retq
                  nop
  -         50:   tzcnt  %ecx,%edx
  +         50:   tzcnt      %ecx,%edx
  -               movzbl 0x20(%rdi,%rdx,1),%eax
  +               movzbl     0x20(%rdi,%rdx,1),%eax
  -               movzbl 0x20(%rsi,%rdx,1),%edx
  +               movzbl     0x20(%rsi,%rdx,1),%edx
  -               sub    %edx,%eax
  +               sub        %edx,%eax
                  vzeroupper
                ← retq
  -               data16 nopw %cs:0x0(%rax,%rax,1)
  +               data16     nopw %cs:0x0(%rax,%rax,1)

Reported-by: Travis Downs <travis.downs@gmail.com>
LPU-Reference: CAOBGo4z1KfmWeOm6Et0cnX5Z6DWsG2PQbAvRn1MhVPJmXHrc5g@mail.gmail.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lkml.kernel.org/n/tip-89wsdd9h9g6bvq52sgp6d0u4@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2019-03-06 16:40:15 -03:00
Josh Poimboeuf
f76a16adc4 x86/unwind/orc: Fix ORC unwind table alignment
The .orc_unwind section is a packed array of 6-byte structs.  It's
currently aligned to 6 bytes, which is causing warnings in the LLD
linker.

Six isn't a power of two, so it's not a valid alignment value.  The
actual alignment doesn't matter much because it's an array of packed
structs.  An alignment of two is sufficient.  In reality it always gets
aligned to four bytes because it comes immediately after the
4-byte-aligned .orc_unwind_ip section.

Fixes: ee9f8fce99 ("x86/unwind: Add the ORC unwinder")
Reported-by: Nick Desaulniers <ndesaulniers@google.com>
Reported-by: Dmitry Golovin <dima@golovin.in>
Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://github.com/ClangBuiltLinux/linux/issues/218
Link: https://lkml.kernel.org/r/d55027ee95fe73e952dcd8be90aebd31b0095c45.1551892041.git.jpoimboe@redhat.com
2019-03-06 20:36:32 +01:00
Soheil Hassas Yeganeh
6466e71565 tcp: do not report TCP_CM_INQ of 0 for closed connections
Returning 0 as inq to userspace indicates there is no more data to
read, and the application needs to wait for EPOLLIN. For a connection
that has received FIN from the remote peer, however, the application
must continue reading until getting EOF (return value of 0
from tcp_recvmsg) or an error, if edge-triggered epoll (EPOLLET) is
being used. Otherwise, the application will never receive a new
EPOLLIN, since there is no epoll edge after the FIN.

Return 1 when there is no data left on the queue but the
connection has received FIN, so that the applications continue
reading.

Fixes: b75eba76d3 (tcp: send in-queue bytes in cmsg upon read)
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 11:00:50 -08:00
Mao Wenan
6caabe7f19 net: hsr: fix memory leak in hsr_dev_finalize()
If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to
add port, it directly returns res and forgets to free the node
that allocated in hsr_create_self_node(), and forgets to delete
the node->mac_list linked in hsr->self_node_db.

BUG: memory leak
unreferenced object 0xffff8881cfa0c780 (size 64):
  comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
  hex dump (first 32 bytes):
    e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de  ................
    00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff  ..I.............
  backtrace:
    [<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr]
    [<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr]
    [<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
    [<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
    [<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
    [<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
    [<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
    [<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
    [<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
    [<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline]
    [<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631
    [<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786
    [<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline]
    [<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline]
    [<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
    [<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
    [<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [<00000000e01dacb3>] 0xffffffffffffffff

Fixes: c5a7591172 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:57:05 -08:00
Vlad Buslov
ecb3dea400 net: sched: flower: insert new filter to idr after setting its mask
When adding new filter to flower classifier, fl_change() inserts it to
handle_idr before initializing filter extensions and assigning it a mask.
Normally this ordering doesn't matter because all flower classifier ops
callbacks assume rtnl lock protection. However, when filter has an action
that doesn't have its kernel module loaded, rtnl lock is released before
call to request_module(). During this time the filter can be accessed bu
concurrent task before its initialization is completed, which can lead to a
crash.

Example case of NULL pointer dereference in concurrent dump:

Task 1                           Task 2

tc_new_tfilter()
 fl_change()
  idr_alloc_u32(fnew)
  fl_set_parms()
   tcf_exts_validate()
    tcf_action_init()
     tcf_action_init_1()
      rtnl_unlock()
      request_module()
      ...                        rtnl_lock()
      				 tc_dump_tfilter()
      				  tcf_chain_dump()
				   fl_walk()
				    idr_get_next_ul()
				    tcf_node_dump()
				     tcf_fill_node()
				      fl_dump()
				       mask = &f->mask->key; <- NULL ptr
      rtnl_lock()

Extension initialization and mask assignment don't depend on fnew->handle
that is allocated by idr_alloc_u32(). Move idr allocation code after action
creation and mask assignment in fl_change() to prevent concurrent access
to not fully initialized filter when rtnl lock is released to load action
module.

Fixes: 01683a1469 ("net: sched: refactor flower walk to iterate over idr")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:52:16 -08:00
Vasily Averin
a10674bf24 tcp: detecting the misuse of .sendpage for Slab objects
sendpage was not designed for processing of the Slab pages,
in some situations it can trigger BUG_ON on receiving side.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:48:31 -08:00
Michael J. Ruhl
bc5add0976 IB/hfi1: Close race condition on user context disable and close
When disabling and removing a receive context, it is possible for an
asynchronous event (i.e IRQ) to occur.  Because of this, there is a race
between cleaning up the context, and the context being used by the
asynchronous event.

cpu 0  (context cleanup)
    rc->ref_count-- (ref_count == 0)
    hfi1_rcd_free()
cpu 1  (IRQ (with rcd index))
	rcd_get_by_index()
	lock
	ref_count+++     <-- reference count race (WARNING)
	return rcd
	unlock
cpu 0
    hfi1_free_ctxtdata() <-- incorrect free location
    lock
    remove rcd from array
    unlock
    free rcd

This race will cause the following WARNING trace:

WARNING: CPU: 0 PID: 175027 at include/linux/kref.h:52 hfi1_rcd_get_by_index+0x84/0xa0 [hfi1]
CPU: 0 PID: 175027 Comm: IMB-MPI1 Kdump: loaded Tainted: G OE ------------ 3.10.0-957.el7.x86_64 #1
Hardware name: Intel Corporation S2600KP/S2600KP, BIOS SE5C610.86B.11.01.0076.C4.111920150602 11/19/2015
Call Trace:
  dump_stack+0x19/0x1b
  __warn+0xd8/0x100
  warn_slowpath_null+0x1d/0x20
  hfi1_rcd_get_by_index+0x84/0xa0 [hfi1]
  is_rcv_urgent_int+0x24/0x90 [hfi1]
  general_interrupt+0x1b6/0x210 [hfi1]
  __handle_irq_event_percpu+0x44/0x1c0
  handle_irq_event_percpu+0x32/0x80
  handle_irq_event+0x3c/0x60
  handle_edge_irq+0x7f/0x150
  handle_irq+0xe4/0x1a0
  do_IRQ+0x4d/0xf0
  common_interrupt+0x162/0x162

The race can also lead to a use after free which could be similar to:

general protection fault: 0000 1 SMP
CPU: 71 PID: 177147 Comm: IMB-MPI1 Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.el7.x86_64 #1
Hardware name: Intel Corporation S2600KP/S2600KP, BIOS SE5C610.86B.11.01.0076.C4.111920150602 11/19/2015
task: ffff9962a8098000 ti: ffff99717a508000 task.ti: ffff99717a508000 __kmalloc+0x94/0x230
Call Trace:
  ? hfi1_user_sdma_process_request+0x9c8/0x1250 [hfi1]
  hfi1_user_sdma_process_request+0x9c8/0x1250 [hfi1]
  hfi1_aio_write+0xba/0x110 [hfi1]
  do_sync_readv_writev+0x7b/0xd0
  do_readv_writev+0xce/0x260
  ? handle_mm_fault+0x39d/0x9b0
  ? pick_next_task_fair+0x5f/0x1b0
  ? sched_clock_cpu+0x85/0xc0
  ? __schedule+0x13a/0x890
  vfs_writev+0x35/0x60
  SyS_writev+0x7f/0x110
  system_call_fastpath+0x22/0x27

Use the appropriate kref API to verify access.

Reorder context cleanup to ensure context removal before cleanup occurs
correctly.

Cc: stable@vger.kernel.org # v4.14.0+
Fixes: f683c80ca6 ("IB/hfi1: Resolve kernel panics by reference counting receive contexts")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2019-03-06 14:47:09 -04:00
Arnd Bergmann
7b83762376 appletalk: Add atalk.h header files to MAINTAINERS file
Add the path names here so that git-send-email can pick up the
netdev@vger.kernel.org Cc line automatically for a patch that
only touches the headers.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:46:43 -08:00
Arnd Bergmann
27da0d2ef9 appletalk: Fix compile regression
A bugfix just broke compilation of appletalk when CONFIG_SYSCTL
is disabled:

In file included from net/appletalk/ddp.c:65:
net/appletalk/ddp.c: In function 'atalk_init':
include/linux/atalk.h:164:34: error: expected expression before 'do'
 #define atalk_register_sysctl()  do { } while(0)
                                  ^~
net/appletalk/ddp.c:1934:7: note: in expansion of macro 'atalk_register_sysctl'
  rc = atalk_register_sysctl();

This is easier to avoid by using conventional inline functions
as stubs rather than macros. The header already has inline
functions for other purposes, so I'm changing over all the
macros for consistency.

Fixes: 6377f787ae ("appletalk: Fix use-after-free in atalk_proc_exit")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:46:29 -08:00
Alan Maguire
f4b3ec4e6a iptunnel: NULL pointer deref for ip_md_tunnel_xmit
Naresh Kamboju noted the following oops during execution of selftest
tools/testing/selftests/bpf/test_tunnel.sh on x86_64:

[  274.120445] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000000
[  274.128285] #PF error: [INSTR]
[  274.131351] PGD 8000000414a0e067 P4D 8000000414a0e067 PUD 3b6334067 PMD 0
[  274.138241] Oops: 0010 [#1] SMP PTI
[  274.141734] CPU: 1 PID: 11464 Comm: ping Not tainted
5.0.0-rc4-next-20190129 #1
[  274.149046] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
2.0b 07/27/2017
[  274.156526] RIP: 0010:          (null)
[  274.160280] Code: Bad RIP value.
[  274.163509] RSP: 0018:ffffbc9681f83540 EFLAGS: 00010286
[  274.168726] RAX: 0000000000000000 RBX: ffffdc967fa80a18 RCX: 0000000000000000
[  274.175851] RDX: ffff9db2ee08b540 RSI: 000000000000000e RDI: ffffdc967fa809a0
[  274.182974] RBP: ffffbc9681f83580 R08: ffff9db2c4d62690 R09: 000000000000000c
[  274.190098] R10: 0000000000000000 R11: ffff9db2ee08b540 R12: ffff9db31ce7c000
[  274.197222] R13: 0000000000000001 R14: 000000000000000c R15: ffff9db3179cf400
[  274.204346] FS:  00007ff4ae7c5740(0000) GS:ffff9db31fa80000(0000)
knlGS:0000000000000000
[  274.212424] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  274.218162] CR2: ffffffffffffffd6 CR3: 00000004574da004 CR4: 00000000003606e0
[  274.225292] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  274.232416] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  274.239541] Call Trace:
[  274.241988]  ? tnl_update_pmtu+0x296/0x3b0
[  274.246085]  ip_md_tunnel_xmit+0x1bc/0x520
[  274.250176]  gre_fb_xmit+0x330/0x390
[  274.253754]  gre_tap_xmit+0x128/0x180
[  274.257414]  dev_hard_start_xmit+0xb7/0x300
[  274.261598]  sch_direct_xmit+0xf6/0x290
[  274.265430]  __qdisc_run+0x15d/0x5e0
[  274.269007]  __dev_queue_xmit+0x2c5/0xc00
[  274.273011]  ? dev_queue_xmit+0x10/0x20
[  274.276842]  ? eth_header+0x2b/0xc0
[  274.280326]  dev_queue_xmit+0x10/0x20
[  274.283984]  ? dev_queue_xmit+0x10/0x20
[  274.287813]  arp_xmit+0x1a/0xf0
[  274.290952]  arp_send_dst.part.19+0x46/0x60
[  274.295138]  arp_solicit+0x177/0x6b0
[  274.298708]  ? mod_timer+0x18e/0x440
[  274.302281]  neigh_probe+0x57/0x70
[  274.305684]  __neigh_event_send+0x197/0x2d0
[  274.309862]  neigh_resolve_output+0x18c/0x210
[  274.314212]  ip_finish_output2+0x257/0x690
[  274.318304]  ip_finish_output+0x219/0x340
[  274.322314]  ? ip_finish_output+0x219/0x340
[  274.326493]  ip_output+0x76/0x240
[  274.329805]  ? ip_fragment.constprop.53+0x80/0x80
[  274.334510]  ip_local_out+0x3f/0x70
[  274.337992]  ip_send_skb+0x19/0x40
[  274.341391]  ip_push_pending_frames+0x33/0x40
[  274.345740]  raw_sendmsg+0xc15/0x11d0
[  274.349403]  ? __might_fault+0x85/0x90
[  274.353151]  ? _copy_from_user+0x6b/0xa0
[  274.357070]  ? rw_copy_check_uvector+0x54/0x130
[  274.361604]  inet_sendmsg+0x42/0x1c0
[  274.365179]  ? inet_sendmsg+0x42/0x1c0
[  274.368937]  sock_sendmsg+0x3e/0x50
[  274.372460]  ___sys_sendmsg+0x26f/0x2d0
[  274.376293]  ? lock_acquire+0x95/0x190
[  274.380043]  ? __handle_mm_fault+0x7ce/0xb70
[  274.384307]  ? lock_acquire+0x95/0x190
[  274.388053]  ? __audit_syscall_entry+0xdd/0x130
[  274.392586]  ? ktime_get_coarse_real_ts64+0x64/0xc0
[  274.397461]  ? __audit_syscall_entry+0xdd/0x130
[  274.401989]  ? trace_hardirqs_on+0x4c/0x100
[  274.406173]  __sys_sendmsg+0x63/0xa0
[  274.409744]  ? __sys_sendmsg+0x63/0xa0
[  274.413488]  __x64_sys_sendmsg+0x1f/0x30
[  274.417405]  do_syscall_64+0x55/0x190
[  274.421064]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  274.426113] RIP: 0033:0x7ff4ae0e6e87
[  274.429686] Code: 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 80 00
00 00 00 8b 05 ca d9 2b 00 48 63 d2 48 63 ff 85 c0 75 10 b8 2e 00 00
00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 53 48 89 f3 48 83 ec 10 48 89 7c
24 08
[  274.448422] RSP: 002b:00007ffcd9b76db8 EFLAGS: 00000246 ORIG_RAX:
000000000000002e
[  274.455978] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007ff4ae0e6e87
[  274.463104] RDX: 0000000000000000 RSI: 00000000006092e0 RDI: 0000000000000003
[  274.470228] RBP: 0000000000000000 R08: 00007ffcd9bc40a0 R09: 00007ffcd9bc4080
[  274.477349] R10: 000000000000060a R11: 0000000000000246 R12: 0000000000000003
[  274.484475] R13: 0000000000000016 R14: 00007ffcd9b77fa0 R15: 00007ffcd9b78da4
[  274.491602] Modules linked in: cls_bpf sch_ingress iptable_filter
ip_tables algif_hash af_alg x86_pkg_temp_thermal fuse [last unloaded:
test_bpf]
[  274.504634] CR2: 0000000000000000
[  274.507976] ---[ end trace 196d18386545eae1 ]---
[  274.512588] RIP: 0010:          (null)
[  274.516334] Code: Bad RIP value.
[  274.519557] RSP: 0018:ffffbc9681f83540 EFLAGS: 00010286
[  274.524775] RAX: 0000000000000000 RBX: ffffdc967fa80a18 RCX: 0000000000000000
[  274.531921] RDX: ffff9db2ee08b540 RSI: 000000000000000e RDI: ffffdc967fa809a0
[  274.539082] RBP: ffffbc9681f83580 R08: ffff9db2c4d62690 R09: 000000000000000c
[  274.546205] R10: 0000000000000000 R11: ffff9db2ee08b540 R12: ffff9db31ce7c000
[  274.553329] R13: 0000000000000001 R14: 000000000000000c R15: ffff9db3179cf400
[  274.560456] FS:  00007ff4ae7c5740(0000) GS:ffff9db31fa80000(0000)
knlGS:0000000000000000
[  274.568541] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  274.574277] CR2: ffffffffffffffd6 CR3: 00000004574da004 CR4: 00000000003606e0
[  274.581403] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  274.588535] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  274.595658] Kernel panic - not syncing: Fatal exception in interrupt
[  274.602046] Kernel Offset: 0x14400000 from 0xffffffff81000000
(relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[  274.612827] ---[ end Kernel panic - not syncing: Fatal exception in
interrupt ]---
[  274.620387] ------------[ cut here ]------------

I'm also seeing the same failure on x86_64, and it reproduces
consistently.

>From poking around it looks like the skb's dst entry is being used
to calculate the mtu in:

mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;

...but because that dst_entry  has an "ops" value set to md_dst_ops,
the various ops (including mtu) are not set:

crash> struct sk_buff._skb_refdst ffff928f87447700 -x
      _skb_refdst = 0xffffcd6fbf5ea590
crash> struct dst_entry.ops 0xffffcd6fbf5ea590
  ops = 0xffffffffa0193800
crash> struct dst_ops.mtu 0xffffffffa0193800
  mtu = 0x0
crash>

I confirmed that the dst entry also has dst->input set to
dst_md_discard, so it looks like it's an entry that's been
initialized via __metadata_dst_init alright.

I think the fix here is to use skb_valid_dst(skb) - it checks
for  DST_METADATA also, and with that fix in place, the
problem - which was previously 100% reproducible - disappears.

The below patch resolves the panic and all bpf tunnel tests pass
without incident.

Fixes: c8b34e680a ("ip_tunnel: Add tnl_update_pmtu in ip_md_tunnel_xmit")
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Reported-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Tested-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:43:06 -08:00
John Hubbard
0c507d8f84 RDMA/umem: Revert broken 'off by one' fix
The previous attempted bug fix overlooked the fact that
ib_umem_odp_map_dma_single_page() was doing a put_page() upon hitting an
error. So there was not really a bug there.

Therefore, this reverts the off-by-one change, but keeps the change to use
release_pages() in the error path.

Fixes: 75a3e6a3c1 ("RDMA/umem: minor bug fix in error handling path")
Suggested-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2019-03-06 14:42:37 -04:00
Linus Torvalds
8dcd175bc3 Merge branch 'akpm' (patches from Andrew)
Merge misc updates from Andrew Morton:

 - a few misc things

 - ocfs2 updates

 - most of MM

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (159 commits)
  tools/testing/selftests/proc/proc-self-syscall.c: remove duplicate include
  proc: more robust bulk read test
  proc: test /proc/*/maps, smaps, smaps_rollup, statm
  proc: use seq_puts() everywhere
  proc: read kernel cpu stat pointer once
  proc: remove unused argument in proc_pid_lookup()
  fs/proc/thread_self.c: code cleanup for proc_setup_thread_self()
  fs/proc/self.c: code cleanup for proc_setup_self()
  proc: return exit code 4 for skipped tests
  mm,mremap: bail out earlier in mremap_to under map pressure
  mm/sparse: fix a bad comparison
  mm/memory.c: do_fault: avoid usage of stale vm_area_struct
  writeback: fix inode cgroup switching comment
  mm/huge_memory.c: fix "orig_pud" set but not used
  mm/hotplug: fix an imbalance with DEBUG_PAGEALLOC
  mm/memcontrol.c: fix bad line in comment
  mm/cma.c: cma_declare_contiguous: correct err handling
  mm/page_ext.c: fix an imbalance with kmemleak
  mm/compaction: pass pgdat to too_many_isolated() instead of zone
  mm: remove zone_lru_lock() function, access ->lru_lock directly
  ...
2019-03-06 10:31:36 -08:00
Paolo Abeni
22c74764aa ipv4/route: fail early when inet dev is missing
If a non local multicast packet reaches ip_route_input_rcu() while
the ingress device IPv4 private data (in_dev) is NULL, we end up
doing a NULL pointer dereference in IN_DEV_MFORWARD().

Since the later call to ip_route_input_mc() is going to fail if
!in_dev, we can fail early in such scenario and avoid the dangerous
code path.

v1 -> v2:
 - clarified the commit message, no code changes

Reported-by: Tianhao Zhao <tizhao@redhat.com>
Fixes: e58e415968 ("net: Enable support for VRF with ipv4 multicast")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:23:18 -08:00
Linus Torvalds
afe6fe7036 ARM: SoC: late updates for linux-5.1
Here are two branches that came relatively late during the linux-5.0
 development cycle and have dependencies on the other branches:
 
 - On the TI OMAP platform, the CPSW Ethernet PHY mode selection driver
   is being replaced, this puts the final pieces in place
 
 - On the DaVinci platform, the interrupt handling code in arch/arm
   gets moved into a regular device driver in drivers/irqchip.
 
 Since they both had some time in linux-next after the 5.0-rc8
 release, I'm sending them along with the other updates.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcf9ZXAAoJEGCrR//JCVIn4NgP/0Q0+qP1QTmc/XL1yzSKhemg
 PVu42+EtoR/tyaTu+spf/aQyJiC/1E9NE7n9r9FvQqpxxlipv6XLxZbti89C83mL
 Ynk2D3Z2FjDZvVSl7WdgX9J/GoaJPXefTkfUr4ZZtcMNhLOCl2ATOO6ytuAXid7Q
 keTfHKI2rwUWFmu+ojGuONdyM3BA12hEYNH+B12rnXAcy8ylb70XMxitPx5JGkJX
 ZdhG58tGNM3EDdQh7mornlFA17IUqrYpt/daIBDZaPwwz3P8+vkMTl10IkEsvIcA
 soMmiAp75jYlnLec8A9awGFBzPznzxH7a9PdvPByW044kARSgfFDRbijmwAij6oA
 CHCEmmFP9LOm9zP8qqC0lsfwOBOnSL8b7pFXL2jTJQO897hfBLQSUTVFQ8K3Sznx
 p8CCv++YU2ZQT6rGg7qRIApvfjNtRimBykCyy0Nh03MDUUgNosfqff8EvSXMbsbs
 BwjBavM1QhF2E6trKrxEi3n3+WrHK1JjVL0JxP2rQlraifRrSUXQglqiAOXl4mN7
 GRIjwI5WYeRKMj7nqgj10MO/GBbDAmME482U2+0RvEX2pm/wUiVQjm/6zWOp5Be/
 cAcH61hEXxQbTXh0aVmzSKUHuFVCGl2FC75/JWVzRosdmval7C1MgILiucrXKUVe
 hhF12S1z45yfZRwY7sVD
 =0u1N
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC late updates from Arnd Bergmann:
 "Here are two branches that came relatively late during the linux-5.0
  development cycle and have dependencies on the other branches:

   - On the TI OMAP platform, the CPSW Ethernet PHY mode selection
     driver is being replaced, this puts the final pieces in place

   - On the DaVinci platform, the interrupt handling code in arch/arm
     gets moved into a regular device driver in drivers/irqchip.

  Since they both had some time in linux-next after the 5.0-rc8 release,
  I'm sending them along with the other updates"

* tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (38 commits)
  net: ethernet: ti: cpsw: deprecate cpsw-phy-sel driver
  ARM: davinci: remove intc related fields from davinci_soc_info
  irqchip: davinci-cp-intc: move the driver to drivers/irqchip
  ARM: davinci: cp-intc: remove redundant comments
  ARM: davinci: cp-intc: drop GPL license boilerplate
  ARM: davinci: cp-intc: use readl/writel_relaxed()
  ARM: davinci: cp-intc: unify error handling
  ARM: davinci: cp-intc: improve coding style
  ARM: davinci: cp-intc: request the memory region before remapping it
  ARM: davinci: cp-intc: use the new-style config structure
  ARM: davinci: cp-intc: convert all hex numbers to lowercase
  ARM: davinci: cp-intc: use a common prefix for all symbols
  ARM: davinci: cp-intc: add the new config structures for da8xx SoCs
  irqchip: davinci-cp-intc: add a new config structure
  ARM: davinci: cp-intc: add a wrapper around cp_intc_init()
  ARM: davinci: cp-intc: remove cp_intc.h
  irqchip: davinci-aintc: move the driver to drivers/irqchip
  ARM: davinci: aintc: remove unnecessary includes
  ARM: davinci: aintc: remove the timer-specific irq_set_handler()
  ARM: davinci: aintc: request memory region before remapping it
  ...
2019-03-06 10:22:26 -08:00
Dan Carpenter
f4772dee10 net: hns3: Fix a logical vs bitwise typo
There were a couple logical ORs accidentally mixed in with the bitwise
ORs.

Fixes: e8149933b1 ("net: hns3: remove hnae3_get_bit in data path")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:22:16 -08:00
Linus Torvalds
64b1b217f1 ARM: New SoC family support
Two new SoC families are added this time.
 
 Sugaya Taichi submitted support for the Milbeaut SoC family from
 Socionext and explains:
 
  "SC2000 is a SoC of the Milbeaut series. equipped with a DSP optimized for
   computer vision. It also features advanced functionalities such as 360-degree,
   real-time spherical stitching with multi cameras, image stabilization for
   without mechanical gimbals, and rolling shutter correction. More detail is
   below:
   https://www.socionext.com/en/products/assp/milbeaut/SC2000.html"
 
 Interestingly, this one has a history dating back to older chips
 made by Socionext and previously Matsushita/Panasonic based on their
 own mn10300 CPU architecture that was removed from the kernel last year.
 
 Manivannan Sadhasivam adds support for another SoC family, this is the
 Bitmain BM1880 chip used in the Sophon Edge TPU developer board.
 The chip is intended for Deep Learning applications, and comes
 with dual-core Arm Cortex-A53 to run Linux as well as a RISC-V
 microcontroller core to control the tensor unit.
 For the moment, the TPU is not accessible in mainline Linux, so
 we treat it as a generic Arm SoC.
 More information is available at https://www.sophon.ai/
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcf9USAAoJEGCrR//JCVIn8M8P/1+wpy+9PZynYOqIZvTAR0Pr
 wqZD20FIjzbEMBpbSMWpOSxg+KbSuf+K1s+1lF6hAGry5UW8CVgZ7DMQ2DyBZfzN
 NEcJ1MfchN1AblpD4L76C7PzLR4ZbmNHmXaGX5KQ3ItXFX50TI+PBNdlRMho1y2P
 NGD8SLD1K+erfGyx6CHY+Wf6el25I7tP739HZGvZfMR1SDSKp73fwbjmBBg8vg7/
 2kIwjU7msgtIh4xAgNnZ7+uNUovi04ibDpQnOMta4Urdc9WBJPVQrTmrNJU0loJr
 bffhrrK4adZgp40gtjajCqPR6F96shyZ2G7nYxe53FGE4whSsMCZuGb5aXJ9OtZq
 ez0w3Vy16+2uLLA55xVGgcsOv/4pwXnxuVnfw4D5lonU8Q5bbh5pBTVnvV6lFOea
 IOLaEcfwBCLKMAkZ//eHn9PIGg3RBko4MZniJwb+WLbHXWR+MriQ4+Pb+cvugOAo
 ky4I9iU/XAmUfJxVC1ShHZrzgz2kEoZXCsX0yqXR1eG4o1Ztbftrs4UOyvTxeqxl
 lvLXg3b0SDA5QBwQHUxL0G9HTqm4LdMs3lg98kI05gWofz6Bmk1aEi7U4uguhGKf
 KafuUZ6snVF5KGJAI745Q4IkLKelxjBymLEi+FVKk6y0KAejQXuSMpgXwC1SnIN3
 M69uqcDP+ICqCgDbwWCx
 =HQS8
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-newsoc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM new SoC family support from Arnd Bergmann:
 "Two new SoC families are added this time.

  Sugaya Taichi submitted support for the Milbeaut SoC family from
  Socionext and explains:

    "SC2000 is a SoC of the Milbeaut series. equipped with a DSP
     optimized for computer vision. It also features advanced
     functionalities such as 360-degree, real-time spherical stitching
     with multi cameras, image stabilization for without mechanical
     gimbals, and rolling shutter correction. More detail is below:

       https://www.socionext.com/en/products/assp/milbeaut/SC2000.html"

  Interestingly, this one has a history dating back to older chips made
  by Socionext and previously Matsushita/Panasonic based on their own
  mn10300 CPU architecture that was removed from the kernel last year.

  Manivannan Sadhasivam adds support for another SoC family, this is the
  Bitmain BM1880 chip used in the Sophon Edge TPU developer board.

  The chip is intended for Deep Learning applications, and comes with
  dual-core Arm Cortex-A53 to run Linux as well as a RISC-V
  microcontroller core to control the tensor unit. For the moment, the
  TPU is not accessible in mainline Linux, so we treat it as a generic
  Arm SoC.

  More information is available at

       https://www.sophon.ai/"

* tag 'armsoc-newsoc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  ARM: multi_v7_defconfig: add ARCH_MILBEAUT and ARCH_MILBEAUT_M10V
  ARM: configs: Add Milbeaut M10V defconfig
  ARM: dts: milbeaut: Add device tree set for the Milbeaut M10V board
  clocksource/drivers/timer-milbeaut: Introduce timer for Milbeaut SoCs
  dt-bindings: timer: Add Milbeaut M10V timer description
  ARM: milbeaut: Add basic support for Milbeaut m10v SoC
  dt-bindings: Add documentation for Milbeaut SoCs
  dt-bindings: arm: Add SMP enable-method for Milbeaut
  dt-bindings: sram: milbeaut: Add binding for Milbeaut smp-sram
  MAINTAINERS: Add entry for Bitmain SoC platform
  arm64: dts: bitmain: Add Sophon Egde board support
  arm64: dts: bitmain: Add BM1880 SoC support
  arm64: Add ARCH_BITMAIN platform
  dt-bindings: arm: Document Bitmain BM1880 SoC
2019-03-06 10:15:42 -08:00
Linus Torvalds
fb686ad25b ARM: SoC defconfig updates for 5.1
We regenerated the defconfig files for samsung, shmobile, lpc18xx,
 lpc32xx, omap2, and nhk8815.
 
 Lots of additional drivers added on samsung and nhk8815,
 as well as the new pl110 driver on all machines that have it.
 
 The remaining changes are mostly to enable newly added drivers,
 and in case of imx8mq together with the SoC getting merged.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcfoyyAAoJEGCrR//JCVIne4QP/RDU/fpL8br1Tqk3/dGoWdZd
 66//chb/N9a5zQN6wGrtSe1nPYluQUz6M5wze2X/ta8QwWL3na4ILgzLFx9pvH/B
 Wnen9dh0UwbmjQXzcuiL1hOZRlDD9ZwBcNFyYHb/szrnhI/ZnIpEHeWtSXyaHK0W
 tCHzFkxOk1X+OAYH2LOneZJPIP0PeD+aJkAO+lJCMTCpH0Llm2dDILXygSUFv3b6
 l+qst6VVIAwJiNrCMp3zRnrBRX3PobpxAbPOEWG53RDqHDbAx3noG7m/WtGxuOrf
 GgdWcClENjGkP+eQZzFJR1KOwCz5mfoAVW5pv3a6jcQwSxybbs/5ke4vDQaPVhz0
 tSmnoQ+QdpFJ26mnm+un1GdCrAchOe6nznVJWH7dpX3wRNtQscrX9dsQOTMqSOZC
 zQutsu63EYurj5XegnEgKoWqShlO3VUJDTMKs+AUDEmkKomfNsKGK2PMhpqTiCsR
 /VvjXEWvaO2vQS9yaa+//TdxLDgsEyPYJpPXaBr5qkg/Hm7H+yB28Zi7B50I7+Eq
 DhJxg1O3TnNNKuMQr8JlMN0lYoUh1U2NBYmcL+0jthA/CHF9Lf37msk3f02xA55I
 n/EQHi92ZknjKKpZhtKdXk8BswidCAQoS+9/NqdMZ9zSRBoc09IC5WaoXMeaYIqs
 Htxdm2cM0hfKjTUOylA7
 =YWHu
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC defconfig updates from Arnd Bergmann:
 "We regenerated the defconfig files for samsung, shmobile, lpc18xx,
  lpc32xx, omap2, and nhk8815.

  Lots of additional drivers added on samsung and nhk8815, as well as
  the new pl110 driver on all machines that have it.

  The remaining changes are mostly to enable newly added drivers, and in
  case of imx8mq together with the SoC getting merged"

* tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (47 commits)
  ARM: spear3xx_defconfig: Activate PL111 DRM driver
  ARM: nhk8815_defconfig: Add new options
  ARM: nhk8815_defconfig: Update defconfig
  ARM: pxa: remove CONFIG_SND_PXA2XX_AC97 in pxa_defconfig
  ARM: defconfig: integrator: Switch to DRM
  arm64: defconfig: Add IMX2+ watchdog
  arm64: defconfig: Enable PFUZE100 regulator
  arm64: defconfig: enable NXP FlexSPI driver
  arm64: defconfig: Add i.MX8MQ boot necessary configs
  arm64: defconfig: add imx8qxp support
  arm64: defconfig: add i.MX system controller RTC support
  arm64: defconfig: Enable Tegra TCU
  arm64: defconfig: Enable MAX8973 regulator
  ARM: socfpga_defconfig: enable BLK_DEV_LOOP config option
  ARM: defconfig: lpc32xx: enable DRM simple panel driver
  ARM: defconfig: lpc32xx: enable fixed voltage regulator support
  arm64: defconfig: Enable SUN6I Camera sensor interface
  arm64: defconfig: Enable I2C_GPIO
  ARM: omap2plus_defconfig: Update for moved options
  ARM: omap2plus_defconfig: Update for dropped options
  ...
2019-03-06 10:09:50 -08:00
Linus Torvalds
384d11fa0e ARM: SoC driver updates for 5.1
As usual, the drivers/tee and drivers/reset subsystems get merged
 here, with the expected set of smaller updates and some new hardware
 support. The tee subsystem now supports device drivers to be attached
 to a tee, the first example here is a random number driver with its
 implementation in the secure world.
 
 Three new power domain drivers get added for specific chip families:
  - Broadcom BCM283x chips (used in Raspberry Pi)
  - Qualcomm Snapdragon phone chips
  - Xilinx ZynqMP FPGA SoCs
 
 One new driver is added to talk to the BPMP firmware on NVIDIA
 Tegra210
 
 Existing drivers are extended for new SoC variants from NXP,
 NVIDIA, Amlogic and Qualcomm.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcfpKpAAoJEGCrR//JCVInMpYQANwKKWOTm5NHqtf7/ZKBzx6/
 Yk7Jj8QLGKrHScnuBZSBvTwv5Cc5O5Ye+tAuGVArOoD2ktXlLZmHZ/ZPFAudT3di
 aFYbA44RNhv+O/xOmToDCCjSHm176hwUY0Cs5bFnfx6TcMsdOYIQIG+XQKx/a9zg
 3ZBEv7wZqcBArLc0X2Z2/uiVrEIh3wWwXytvw+8TG8ifUfpbDxRUxDlj1JRDpjMu
 yX4q8JDhdQvi2FTXbXcEHTdQ6RT11svPM/YxQDxfULRK9aNKf4GZJ4QlwZy+SO7N
 cEFxDd4ML/iJ1LjalvtXGkR0xrw9/gOlO3vbB9Uw3EngBDUSQfHmqJet10a14l8q
 KcToe3teIB+Z1R+plrt+h5UDJTbVibgZXhU6wIdkDgtF6oTyg1moIbTqNKHgcA3b
 HLJv4gFejeluQzJ/3dZHBnkvJo1XFAvGFmFXle0bmJRFtDx73CKnf6MA9N82l2/x
 nTn4LTxXIJVKWTWAs1qkrFyIx1gOrpGhiHPQ2JiOPMZLstz3Sr6tiJuWOr+1Ex4/
 UlZsD/CrRb+SbPBonpkD+bvzSR+j0M72A7hGmfZcDzainciWgunyXglUlzO/MT24
 C6p4R9MZ2Fffoe8pESppabRNUItp8gNsNGI7CY1IK8pgpxLrujw8OnqykpV0VETo
 As+6dZrHfPNSuI7udJi5
 =+DOl
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC driver updates from Arnd Bergmann:
 "As usual, the drivers/tee and drivers/reset subsystems get merged
  here, with the expected set of smaller updates and some new hardware
  support. The tee subsystem now supports device drivers to be attached
  to a tee, the first example here is a random number driver with its
  implementation in the secure world.

  Three new power domain drivers get added for specific chip families:
   - Broadcom BCM283x chips (used in Raspberry Pi)
   - Qualcomm Snapdragon phone chips
   - Xilinx ZynqMP FPGA SoCs

  One new driver is added to talk to the BPMP firmware on NVIDIA
  Tegra210

  Existing drivers are extended for new SoC variants from NXP, NVIDIA,
  Amlogic and Qualcomm"

* tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (113 commits)
  tee: optee: update optee_msg.h and optee_smc.h to dual license
  tee: add cancellation support to client interface
  dpaa2-eth: configure the cache stashing amount on a queue
  soc: fsl: dpio: configure cache stashing destination
  soc: fsl: dpio: enable frame data cache stashing per software portal
  soc: fsl: guts: make fsl_guts_get_svr() static
  hwrng: make symbol 'optee_rng_id_table' static
  tee: optee: Fix unsigned comparison with less than zero
  hwrng: Fix unsigned comparison with less than zero
  tee: fix possible error pointer ctx dereferencing
  hwrng: optee: Initialize some structs using memset instead of braces
  tee: optee: Initialize some structs using memset instead of braces
  soc: fsl: dpio: fix memory leak of a struct qbman on error exit path
  clk: tegra: dfll: Make symbol 'tegra210_cpu_cvb_tables' static
  soc: qcom: llcc-slice: Fix typos
  qcom: soc: llcc-slice: Consolidate some code
  qcom: soc: llcc-slice: Clear the global drv_data pointer on error
  drivers: soc: xilinx: Add ZynqMP power domain driver
  firmware: xilinx: Add APIs to control node status/power
  dt-bindings: power: Add ZynqMP power domain bindings
  ...
2019-03-06 09:41:12 -08:00
Linus Torvalds
6ad63dec9c ARM: SoC device tree updates for 5.1
This is a smaller update than the past few times, but with just over
 500 non-merge changesets still dwarfes the rest of the SoC tree.
 
 Three new SoC platforms get added, each one a follow-up to an existing
 product, and added here in combination with a reference platform:
 
  - Renesas RZ/A2M (R7S9210) 32-bit Cortex-A9 Real-time imaging processor
    https://www.renesas.com/eu/en/products/microcontrollers-microprocessors/rz/rza/rza2m.html
 
  - Renesas RZ/G2E (r8a774c0) 64-bit Cortex-A53 SoC "for
    Rich Graphics Applications".
    https://www.renesas.com/eu/en/products/microcontrollers-microprocessors/rz/rzg/rzg2e.html
 
  - NXP i.MX8QuadXPlus 64-bit Cortex-A35 SoC
    https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/i.mx-applications-processors/i.mx-8-processors/i.mx-8x-family-arm-cortex-a35-3d-graphics-4k-video-dsp-error-correcting-code-on-ddr:i.MX8X
 
 These are actual commercial products we now support with an in-kernel
 device tree source file:
 
  - Bosch Guardian is a product made by Bosch Power
    Tools GmbH, based on the Texas Instruments AM335x chip
 
  - Winterland IceBoard is a Texas Instruments AM3874 based
    machine used in telescopes at the south pole and elsewhere, see commit
    d031773169 for some pointers:
 
  - Inspur on5263m5 is an x86 server platform with an Aspeed
    ast2500 baseboard management controller. This is for running on
    the BMC.
 
  - Zodiac Digital Tapping Unit, apparently a kind of ethernet
    switch used in airplanes.
 
  - Phicomm K3 is a WiFi router based on Broadcom bcm47094
 
  - Methode Electronics uDPU FTTdp distribution point unit
 
  - X96 Max, a generic TV box based on Amlogic G12a (S905X2)
 
  - NVIDIA Shield TV (Darcy) based on Tegra210
 
 And then there are several new SBC, evaluation, development or modular
 systems that we add:
 
  - Three new Rockchips rk3399 based boards:
     - FriendlyElec NanoPC-T4 and NanoPi M4
     - Radxa ROCK Pi 4
 
  - Five new i.MX6 family SoM modules and boards for industrial
    products:
     - Logic PD i.MX6QD SoM and evaluation baseboad
     - Y Soft IOTA Draco/Hydra/Ursa family boards based on i.MX6DL
     - Phytec phyCORE i.MX6 UltraLite SoM and evaluation module
 
  - MYIR Tech MYD-LPC4357 development based on the NXP lpc4357
    microcontroller
 
  - Chameleon96, an Intel/Altera Cyclone5 based FPGA development
    system in 96boards form factor
 
  - Arm Fixed Virtual Platforms(FVP) Base RevC, a purely
    virtual platform for corresponding to the latest "fast model"
 
  - Another Raspberry Pi variant: Model 3 A+, supported both
    in 32-bit and 64-bit mode.
 
  - Oxalis Evalkit V100 based on NXP Layerscape LS1012a,
    in 96Boards enterprise form factor
 
  - Elgin RV1108 R1 development board based on 32-bit Rockchips RV1108
 
 For already supported boards and SoCs, we often add support for new
 devices after merging the drivers. This time, the largest changes include
 updates for
 
  - STMicroelectronics stm32mp1, which was now formally
    launched last week
 
  - Qualcomm Snapdragon 845, a high-end phone and low-end laptop chip
 
  - Action Semi S700
 
  - TI AM654x, their recently merged 64-bit SoC from the OMAP family
 
  - Various Amlogic Meson SoCs
 
  - Mediatek MT2712
 
  - NVIDIA Tegra186 and Tegra210
 
  - The ancient NXP lpc32xx family
 
  - Samsung s5pv210, used in some older mobile phones
 
 Many other chips see smaller updates and bugfixes beyond that.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcf9c1AAoJEGCrR//JCVInvl8QAIgmK09QZr3VAD5WnKSoWwiX
 GP1+qgmr/cbIF9X+Kt/0Y2E+oIi9uxu7v5iwpYf0inzV4QOKwy9LvpeInd7s07bf
 hSPMN0wZ9bV5Ylk0YtlvGvOQTqys9oweeSEkHfjQ8Jm7aFkaRXQ1dt23d8KLILoB
 8GKk9A4ncn1AB1vu6xBqeqBiaQiqhMjb9paWkmjYrjhP22hHlVyGlMd8cwfG+A5a
 5Ft4lWkzvgrXPMwZgrCGU233OV5UHrn2A8ohiIUN5J6aSWxu8eMEryU+MF0poidl
 malJ+AHl2mK83YN3wYemxy/lEJzAW4PrjCVgY2bRDqwlOnI3+d+z7rVSfuMCzSKs
 TDTbv9VqPJhsZFr/GIkvB3iwnYfvP/mXrzM7gbw7rQqthEKOy+3HtZwmHAKF4QNK
 TT4wyngC/CwiyULEwtPCjbxZ/7yal6sygllioCo+M2OHeattIQEnqi/Yvc0vx/th
 th9Pepf26jUp/ZJNlxk0XDyBMPhUf6sHUvh7a+y6l6ZxZ6avbFdGPeJrQe5HF2Sp
 KM7BH3w/CpoNRSKs37mR7JpNdYNDSonItgaIm5xVJZk+Wr/BWgtcr6BbGD/vlT7N
 kIDDinyhczhvhpTmWs6QZdZNQmf6bASzTVeFv2+ES+kXt/AKhv0O5N4Pw/oU+VBv
 pD5+7YjjA0fMKcYae3gs
 =1goV
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC device tree updates from Arnd Bergmann:
 "This is a smaller update than the past few times, but with just over
  500 non-merge changesets still dwarfes the rest of the SoC tree.

  Three new SoC platforms get added, each one a follow-up to an existing
  product, and added here in combination with a reference platform:

   - Renesas RZ/A2M (R7S9210) 32-bit Cortex-A9 Real-time imaging
     processor:

       https://www.renesas.com/eu/en/products/microcontrollers-microprocessors/rz/rza/rza2m.html

   - Renesas RZ/G2E (r8a774c0) 64-bit Cortex-A53 SoC "for Rich Graphics
     Applications":

       https://www.renesas.com/eu/en/products/microcontrollers-microprocessors/rz/rzg/rzg2e.html

   - NXP i.MX8QuadXPlus 64-bit Cortex-A35 SoC:

       https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/i.mx-applications-processors/i.mx-8-processors/i.mx-8x-family-arm-cortex-a35-3d-graphics-4k-video-dsp-error-correcting-code-on-ddr:i.MX8X

  These are actual commercial products we now support with an in-kernel
  device tree source file:

   - Bosch Guardian is a product made by Bosch Power Tools GmbH, based
     on the Texas Instruments AM335x chip

   - Winterland IceBoard is a Texas Instruments AM3874 based machine
     used in telescopes at the south pole and elsewhere, see commit
     d031773169 for some pointers:

   - Inspur on5263m5 is an x86 server platform with an Aspeed ast2500
     baseboard management controller. This is for running on the BMC.

   - Zodiac Digital Tapping Unit, apparently a kind of ethernet switch
     used in airplanes.

   - Phicomm K3 is a WiFi router based on Broadcom bcm47094

   - Methode Electronics uDPU FTTdp distribution point unit

   - X96 Max, a generic TV box based on Amlogic G12a (S905X2)

   - NVIDIA Shield TV (Darcy) based on Tegra210

  And then there are several new SBC, evaluation, development or modular
  systems that we add:

   - Three new Rockchips rk3399 based boards:
       - FriendlyElec NanoPC-T4 and NanoPi M4
       - Radxa ROCK Pi 4

   - Five new i.MX6 family SoM modules and boards for industrial
     products:
       - Logic PD i.MX6QD SoM and evaluation baseboad
       - Y Soft IOTA Draco/Hydra/Ursa family boards based on i.MX6DL
       - Phytec phyCORE i.MX6 UltraLite SoM and evaluation module

   - MYIR Tech MYD-LPC4357 development based on the NXP lpc4357
     microcontroller

   - Chameleon96, an Intel/Altera Cyclone5 based FPGA development system
     in 96boards form factor

   - Arm Fixed Virtual Platforms(FVP) Base RevC, a purely virtual
     platform for corresponding to the latest "fast model"

   - Another Raspberry Pi variant: Model 3 A+, supported both in 32-bit
     and 64-bit mode.

   - Oxalis Evalkit V100 based on NXP Layerscape LS1012a, in 96Boards
     enterprise form factor

   - Elgin RV1108 R1 development board based on 32-bit Rockchips RV1108

  For already supported boards and SoCs, we often add support for new
  devices after merging the drivers. This time, the largest changes
  include updates for

   - STMicroelectronics stm32mp1, which was now formally launched last
     week

   - Qualcomm Snapdragon 845, a high-end phone and low-end laptop chip

   - Action Semi S700

   - TI AM654x, their recently merged 64-bit SoC from the OMAP family

   - Various Amlogic Meson SoCs

   - Mediatek MT2712

   - NVIDIA Tegra186 and Tegra210

   - The ancient NXP lpc32xx family

   - Samsung s5pv210, used in some older mobile phones

  Many other chips see smaller updates and bugfixes beyond that"

* tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (506 commits)
  ARM: dts: exynos: Fix max voltage for buck8 regulator on Odroid XU3/XU4
  dt-bindings: net: ti: deprecate cpsw-phy-sel bindings
  ARM: dts: am335x: switch to use phy-gmii-sel
  ARM: dts: am4372: switch to use phy-gmii-sel
  ARM: dts: dm814x: switch to use phy-gmii-sel
  ARM: dts: dra7: switch to use phy-gmii-sel
  arch: arm: dts: kirkwood-rd88f6281: Remove disabled marvell,dsa reference
  ARM: dts: exynos: Add support for secondary DAI to Odroid XU4
  ARM: dts: exynos: Add support for secondary DAI to Odroid XU3
  ARM: dts: exynos: Disable ARM PMU on Odroid XU3-lite
  ARM: dts: exynos: Add stdout path property to Arndale board
  ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
  ARM: dts: exynos: Enable ADC on Odroid HC1
  arm64: dts: sprd: Remove wildcard compatible string
  arm64: dts: sprd: Add SC27XX fuel gauge device
  arm64: dts: sprd: Add SC2731 charger device
  arm64: dts: sprd: Add ADC calibration support
  arm64: dts: sprd: Remove PMIC INTC irq trigger type
  arm64: dts: rockchip: Enable tsadc device on rock960
  ARM: dts: rockchip: add chosen node on veyron devices
  ...
2019-03-06 09:36:37 -08:00
Felipe Franciosi
3722e6a521 scsi: virtio_scsi: don't send sc payload with tmfs
The virtio scsi spec defines struct virtio_scsi_ctrl_tmf as a set of
device-readable records and a single device-writable response entry:

    struct virtio_scsi_ctrl_tmf
    {
        // Device-readable part
        le32 type;
        le32 subtype;
        u8 lun[8];
        le64 id;
        // Device-writable part
        u8 response;
    }

The above should be organised as two descriptor entries (or potentially
more if using VIRTIO_F_ANY_LAYOUT), but without any extra data after "le64
id" or after "u8 response".

The Linux driver doesn't respect that, with virtscsi_abort() and
virtscsi_device_reset() setting cmd->sc before calling virtscsi_tmf().  It
results in the original scsi command payload (or writable buffers) added to
the tmf.

This fixes the problem by leaving cmd->sc zeroed out, which makes
virtscsi_kick_cmd() add the tmf to the control vq without any payload.

Cc: stable@vger.kernel.org
Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2019-03-06 12:35:02 -05:00
Linus Torvalds
aebbfafc74 ARM: SoC platform updates for 5.1
The APM X-Gene platform is now maintained by folks from Ampere
 computing that took over the product line a while ago, this gets
 reflected in the MAINTAINERS file.
 
 Cleanups continue on the older mach-davinci and mach-pxa platform,
 to get them to be more like the modern ones. For pxa, we
 now remove the Raumfeld platform code as it now works with
 device tree based booting.
 
 i.MX adds a couple new features for the i.MX7ULP SoC
 
 Mediatek gains support for a new SoC: MT7629 is a new wireless
 router platform, following MT7623.
 
 Aside from those, there are the usual minor cleanups and bugfixes
 across several platforms.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcf+c8AAoJEGCrR//JCVInuUsQAK+F+7hrfkwCSLXzqVIPMYC1
 hFV11s7bgbHfzkSa6ZyFC0uuT737dZjJrOdvZOXFJ2VxDscxI62mj56jCrF8tr1x
 BQqIiDLGU55mLTkPiVtmVi8p79IXz2G/1dBeYrfyj/xec6DsjVkO1Cm2itQ3vg5Q
 ZM8DRmIxsKsUv6YSGRfwVNXso9jOh+LPxlfrGL5ijdHgzDxRr7gO+B+jxgx9Sf6s
 DNLj6M8L8DFo528eHp2pJNBL21pMywAaIrDELUJyg5P3XnDX18F8CjbSRgm7OG1+
 hkdmML9qQlpOjokPJ9eeitX2e+tvKoXLn+N9kq12Pn4fkvJpKlOVnZmU+Le/3By+
 agX7hE2A21nsZuoHQjq16QoO4X9mDee7tcDMzGwTrSq1M18m2dEJW57vivda0qKN
 wNJC3qwLmh2/wfxNpO2wS29hQni7cIrFgRvUPsB/u8KvzITbQ/PMGApNV+Kf7BiO
 mZjH8X+0IkX0veS11KLsFUCbq4ezpPCNxbul2mMIVcTIV0Oz6mQXNHAecNxCCqMk
 GAgi48+9KYNszG01Xqx++x79BFnIoUJp3+gIGIa8rTvdSSsF8DlQlSzXufD9Sb2h
 CS+M8kvgfymUrjaKZNyR5ouI1ae1Q16pbapkpS4B6ucoc4Qbqz2POiSVhex+eU/N
 IrEAFEhRg7iQ9NHUaWlx
 =vxwd
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC platform updates from Arnd Bergmann:
 "The APM X-Gene platform is now maintained by folks from Ampere
  computing that took over the product line a while ago, this gets
  reflected in the MAINTAINERS file.

  Cleanups continue on the older mach-davinci and mach-pxa platform, to
  get them to be more like the modern ones. For pxa, we now remove the
  Raumfeld platform code as it now works with device tree based booting.

  i.MX adds a couple new features for the i.MX7ULP SoC

  Mediatek gains support for a new SoC: MT7629 is a new wireless router
  platform, following MT7623.

  Aside from those, there are the usual minor cleanups and bugfixes
  across several platforms"

* tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (49 commits)
  MAINTAINERS: Update Ampere email address
  usb: ohci-da8xx: remove unused callbacks from platform data
  ARM: davinci: da830-evm: remove legacy usb helpers
  ARM: davinci: omapl138-hawk: remove legacy usb helpers
  usb: ohci-da8xx: add vbus and overcurrent gpios
  ARM: davinci: da830-evm: use gpio lookup entries for usb gpios
  ARM: davinci: omapl138-hawk: use gpio lookup entries for usb gpios
  usb: ohci-da8xx: add a helper pointer to &pdev->dev
  usb: ohci-da8xx: add a new line after local variables
  arm64: meson: enable g12a clock controller
  MAINTAINERS: Add entry for uDPU board
  ARM: davinci: da850-evm: use GPIO hogs instead of the legacy API
  arm: mediatek: add MT7629 smp bring up code
  Revert "ARM: mediatek: add MT7623a smp bringup code"
  dt-bindings: soc: fix typo of MT8173 power dt-bindings
  ARM: meson: remove COMMON_CLK_AMLOGIC selection
  arm64: meson: remove COMMON_CLK_AMLOGIC selection
  ARM: lpc32xx: remove platform data of ARM PL111 LCD controller
  ARM: lpc32xx: remove platform data of ARM PL180 SD/MMC controller
  ARM: lpc32xx: Use kmemdup to replace duplicating its implementation
  ...
2019-03-06 09:33:05 -08:00
Erwan Velu
441b7195e2 scsi: smartpqi: Reporting 'logical unit failure'
When the HARDWARE_ERROR/0x3e/0x1 case is triggered, the logical volume
is offlined.  When reading the kernel log, the reason why the device
got offlined isn't reported to the user.  This situation makes it
difficult for admins to root cause.

Log a message when this condition occurs.

[mkp: tweaked commit message]

Signed-off-by: Erwan Velu <e.velu@criteo.com>
Acked-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2019-03-06 12:31:35 -05:00
Linus Torvalds
fa29f5ba42 asm-generic changes for v5.1
Only a few small changes this time:
 
 - Michael S. Tsirkin cleans up linux/mman.h
 - Mike Rapoport found a typo
 
 I had originally merged another cleanup series for I/O accessors from
 Hugo Lefeuvre as well, but dropped it after the discussion of the barrier
 semantics and some conflicts. I expect this series to get merged for a
 later release though.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcf9yrAAoJEGCrR//JCVInohIP+wcCZ3XEym0oyb9C5BgIdnMF
 qq69wbOT9ypAnB469PPjsvGhyCsqGo1Fm2Cludac0C/OfmB/lYJCqklAJrc6a7Cp
 jXD5rQkXQZGdmFHS81i24ejcNV9F5fh16vyDwqCgUQDCgg9MeDPirvwaDl958rhq
 5dUsoUu+CJRI35jZ8NPWbsSU5Wa2BpckWnuTs97PtlLnMH/RzEyxmSRysxtHNA7S
 PgYjvWBHbRK6mTNgcY/eojAoQuQmBgiOppYX1XTffHZgwY/VBIjYL3Wxwe1qbvSN
 vvLgE6nvvmRYjdq4VOoVbi9BOtWiCtXw29TWXfxSetN9CWCEwIQJdIm8lHn1CJRh
 6GnOdb8ADqAzraxo7GOf78kNsekl3mxh+QYN5gDaGS6eQASCNlGx70zUh7Y6JcE5
 6NJ8VMy0oEEFzHAsE0mxluu8LHL3F1hwS832D6mQ697Z71T+IoHgIcMT2jHqp9fw
 7/D2taoBAXdGqhToY3hhMMWsi4lFCvxjVVlxCxhp7Ik+cyOgW0O5vG2afLOHrtti
 vWEcn7M6nuKvb3MxBVjg8sK2ln6vIXNgZGjVmkxn70ZAmvZJX+KE+G1cvB2gMGc0
 S/ogtpbETMgMCwuAf2hdYgiBFJpZL725DEWFfS+p+02PTwjdKF+EWAS4swZM0sCE
 U1v1N7yCe/Wb/ijEm0M1
 =C9p7
 -----END PGP SIGNATURE-----

Merge tag 'asm-generic-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic updates from Arnd Bergmann:
 "Only a few small changes this time:

   - Michael S. Tsirkin cleans up linux/mman.h

   - Mike Rapoport found a typo

  I had originally merged another cleanup series for I/O accessors from
  Hugo Lefeuvre as well, but dropped it after the discussion of the
  barrier semantics and some conflicts. I expect this series to get
  merged for a later release though"

* tag 'asm-generic-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  asm-generic/page.h: fix typo in #error text requiring a real asm/page.h
  arch: move common mmap flags to linux/mman.h
  drm: tweak header name
  x86/mpx: tweak header name
2019-03-06 09:18:43 -08:00
Linus Torvalds
78e10b5e5a y2038: A build fix for compat mode
Here is one more patch on top of the y2038 changes already pulled
 for linux-5.1, for some reason this had escaped all testing.
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcf+C5AAoJEGCrR//JCVInRWkP/1YDi0/hDhmb8vRK+gDquo0a
 DW4NE/XUaC8mBS2o3Wjqhqf9E9IgJ4o0NFhtttdsAow4xFWk0+SRyBm3bBPei5fH
 CpX0/nfFZwpS67RMTHlX7Aq868mb+fNPnFdR+sP4u7oL7XCbxDAnKbERWMRi1JmU
 /QV10l/MpJl0uQebm+43xbKLS4vo4pUOBVYHZ6KkhLXXEE4jiDO9d+OYICFT1EzX
 GrCmNlc/+iMLKsZbZbrxDV5VSGhEudvv45SQM4QqnuaMPVsayf9ch5Rlq+uwAZtJ
 OmMpyusi0FVKhbh8FCNYmu4cESXc9/ovbwCytfF/MSrQWuvd30fxDgmyv+YtOo8x
 FDyfvTlK9wdzzKb/3K1D/ACsPw2dh3jxc0cZYsqjw4IDz7inMMtgQBpsbgNA62dr
 THsTYKoGFsfy5Zic+jO1TNQRyTkCPnsi46N2EoKSj1k9Ck4C+Sw20Sd9FXzbzKt0
 aTi+LjUjKlEAoifPaDnC+dIVyQv+GE9VjgCag4yxMEj/PBmUq1KgyGSwsNXOahpX
 KNiR77EzUih6RHbD6U7IguGt+gxxMYw5e5So+sPJj9/5RsgW55g5ySdehslRBNw1
 Crrih3iiMMhTi0CLBLt8/JxcqNEQvAWO7CVIWBeuRh0ojI+aUSbHO/waJyg+emgw
 w2x3DkhCRHzjsLPPte66
 =/MC2
 -----END PGP SIGNATURE-----

Merge tag 'y2038-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground

Pull y2038 build fix for compat mode from Arnd Bergmann:
 "Here is one more patch on top of the y2038 changes already pulled for
  linux-5.1, for some reason this had escaped all testing"

* tag 'y2038-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground:
  ipc: Fix building compat mode without sysvipc
2019-03-06 09:07:08 -08:00
Jonathan Corbet
4064174bec docs: Bring some order to filesystem documentation
Documentation/filesystems is, like much of the rest of the kernel's
documentation, a jumble of unorganized information.  Split the
documentation into categories and try to bring some order to the top-level
index.rst files.  No text changes other than a few section-introductory
blurbs; this is all just moving stuff around.

Cc: linux-fsdevel@vger.kernel.org
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2019-03-06 09:46:10 -07:00
Linus Torvalds
6ea98b4baa Merge branch 'x86-alternatives-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 alternative instruction updates from Ingo Molnar:
 "Small RDTSCP opimization, enabled by the newly added ALTERNATIVE_3(),
  and other small improvements"

* 'x86-alternatives-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/TSC: Use RDTSCP
  x86/alternatives: Add an ALTERNATIVE_3() macro
  x86/alternatives: Print containing function
  x86/alternatives: Add macro comments
2019-03-06 08:45:46 -08:00
Ming Lei
05b700ba60 block: fix segment calculation for passthrough IO
blk_recount_segments() can be called in bio_add_pc_page() for
calculating how many segments this bio will has after one page is added
to this bio. If the resulted segment number is beyond the queue limit,
the added page will be removed.

The try-and-fix policy requires blk_recount_segments(__blk_recalc_rq_segments)
to not consider the segment number limit. Unfortunately bvec_split_segs()
does check this limit, and causes small segment number returned to
bio_add_pc_page(), then page still may be added to the bio even though
segment number limit becomes broken.

Fixes this issue by not considering segment number limit when calcualting
bio's segment number.

Fixes: dcebd75592 ("block: use bio_for_each_bvec() to compute multi-page bvec count")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Omar Sandoval <osandov@fb.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-03-06 09:42:54 -07:00
Jens Axboe
e61750c847 Merge branch 'stable/for-jens-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-5.1/block-post
Pull two xen blkback fixes from Konrad.

* 'stable/for-jens-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront
  xen/blkback: add stack variable 'blkif' in connect_ring()
2019-03-06 09:41:54 -07:00
Arnd Bergmann
cfdbb4ed31 vhost: silence an unused-variable warning
On some architectures, the MMU can be disabled, leading to access_ok()
becoming an empty macro that does not evaluate its size argument,
which in turn produces an unused-variable warning:

drivers/vhost/vhost.c:1191:9: error: unused variable 's' [-Werror,-Wunused-variable]
        size_t s = vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;

Mark the variable as __maybe_unused to shut up that warning.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-03-06 11:32:37 -05:00