812948 Commits

Author SHA1 Message Date
Linus Torvalds
32c0ac3af4 regulator: Updates for v5.1
The bulk of the standout changes in this release are cleanups, with the
 core work being a combination of factoring out common code into helpers
 and the completion of the conversion of the core to use GPIO
 descriptors.
 
  - Addition of helper functions for current limits and conversion of
    drivers to use them by Axel Lin.
  - Lots and lots of cleanups from Axel Lin.
  - Conversion of the core to use GPIO descriptors rather than numbers by
    Linus Walleij.
  - New drivers for Maxim MAX77650 and ROHM BD70528.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAlx9UosTHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0DR7B/4x2fjnrnlvDqwzr20jcWH0BTiOCN+s
 JpWNn2HxoeNNOn2w52bo0WNBvXElWj5+Lik8xljlj9DWXCgSdys0z5XEOpOmg3Eg
 +7AhyHmYBYf2igHWqw3dvL79n2MqdUY6mpbVtbf9kfJ3M5CwkwBUuXYNJLKZhLsm
 r06wIaEmCDT9mQNxl7r1tbDUpN8Rjg43W4dNFMYEUnZPpd9zhdwSnTRFxqhpF+K+
 GTli4yv3Z2IzZWGvG838/UBETffTfZv/lnuF7f/fagihGnhsp4RSp+3/PYvIV7/v
 BIvPUywSXQFiC/NqqtRBkqRKEGclv0itZzZy39hl+zp/k+Im2jzH0gkP
 =7lqn
 -----END PGP SIGNATURE-----

Merge tag 'regulator-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator updates from Mark Brown:
 "The bulk of the standout changes in this release are cleanups, with
  the core work being a combination of factoring out common code into
  helpers and the completion of the conversion of the core to use GPIO
  descriptors.

  Summary:

   - Addition of helper functions for current limits and conversion of
     drivers to use them by Axel Lin.

   - Lots and lots of cleanups from Axel Lin.

   - Conversion of the core to use GPIO descriptors rather than numbers
     by Linus Walleij.

   - New drivers for Maxim MAX77650 and ROHM BD70528"

* tag 'regulator-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (131 commits)
  regulator: mc13xxx: Constify regulator_ops variables
  regulator: palmas: Constify palmas_smps_ramp_delay array
  regulator: wm831x-dcdc: Convert to use regulator_set/get_current_limit_regmap
  regulator: pv88090: Convert to use regulator_set/get_current_limit_regmap
  regulator: pv88080: Convert to use regulator_set/get_current_limit_regmap
  regulator: pv88060: Convert to use regulator_set/get_current_limit_regmap
  regulator: max77650: Convert to use regulator_set/get_current_limit_regmap
  regulator: lp873x: Convert to use regulator_set/get_current_limit_regmap
  regulator: lp872x: Convert to use regulator_set/get_current_limit_regmap
  regulator: da9210: Convert to use regulator_set/get_current_limit_regmap
  regulator: da9055: Convert to use regulator_set/get_current_limit_regmap
  regulator: core: Add set/get_current_limit helpers for regmap users
  regulator: Fix comment for csel_reg and csel_mask
  regulator: stm32-vrefbuf: add power management support
  regulator: 88pm8607: Remove unused fields from struct pm8607_regulator_info
  regulator: 88pm8607: Simplify pm8607_list_voltage implementation
  regulator: cpcap: Constify omap4_regulators and xoom_regulators
  regulator: cpcap: Remove unused vsel_shift from struct cpcap_regulator
  dt-bindings: regulator: tps65218: rectify units of LS3
  dt-bindings: regulator: add LS2 load switch documentation
  ...
2019-03-04 19:20:52 -08:00
Linus Torvalds
e48b044e4f regmap: Changes for v5.1
There's only two changes here, one fix for conflicting attributes on the
 rbtree node structure and the implementation of main status register
 support in the interrupt code which supports chips that have a register
 to cut down on the number of per-interrupt status registers that need to
 be checked when handling interrupts.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAlx9T5kTHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0JRLB/4+Te73Gvb0fFoVzZIxSjuLlxRul97K
 6gLgUyxdXrPovBsNIN9r5lG5A0PstfdTs3vrDZfvGmOwQ2eG/Ae7TEb4pt/gF/Rs
 KDIYQ6McygEzCEspr4xyR/MV6jIPTr/01YhvA8KsbyhB6kw50WA+QJX/dkrUdyUb
 /MwluSWkbUQWHr+iJeLROxhyu2jF2X7Ymu66MVLXR8DHlkm3E5fKu1xPbqIvSA7n
 el2j2pJYy4OJ3PQ/5LfASJr4+hEFERPZ1umcQRjXku/og03ZZXp72tyLp4Uz3cGA
 Pel2ZF5fB6Lp0CkAXM1DqAALGchiHU6JNEnls3Brnjcovz2pS0nmDUuM
 =rFCT
 -----END PGP SIGNATURE-----

Merge tag 'regmap-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap updates from Mark Brown:
 "There are only two changes here:

   - fix for conflicting attributes on the rbtree node structure

   - implementation of main status register support in the interrupt
     code which supports chips that have a register to cut down on the
     number of per-interrupt status registers that need to be checked
     when handling interrupts"

* tag 'regmap-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Remove attribute packed from struct 'regcache_rbtree_node'
  regmap: regmap-irq: Add main status register support
2019-03-04 19:16:09 -08:00
Linus Torvalds
42eaf1851e MMC core:
- mmc: core: Fixup max_discard/trim calculations
  - mmc: core: Announce SD specs greater than 4.0
  - mmc: core: Add discard support for SD cards
  - mmc: core: Don't do retries for CMD6 (SWITCH command)
  - mmc: core: Various cleanups and re-structuring
 
 MMC host:
  - cqhci: Add maintainers for eMMC CQHCI driver
  - sdhci: Consolidate WP GPIO code
  - sdhci: Add ADMA3 DMA support for V4 enabled host
  - sdhci-pci-o2micro: Fixup card detect support
  - sdhci-tegra: Add support for CMDQ
  - sdhci-tegra: Support SDMMC pads auto-calibration
  - sdhci-esdhc-imx: Add DCMD support and CMDQ support
  - sdhci-esdhc-imx: Add support for i.MX6ULL variant
  - sdhci-esdhc-imx: Fixup HS400 timing issue
  - sdhci-esdhc-imx: Add HS400_ES support for i.MX8QXP
  - renesas_sdhi: Avoid CRC errors by adjusting settings to speed mode
  - renesas_sdhi: Fixup card initialization for high speed mode
  - omap: Fixup timeout settings
  - atmel-mci: Enable 8 bits bus-width support
  - jz4740: Convert some legacy code to use modern APIs
  - mmci: Send a CMD12 to clear DPSM at errors for STM32 sdmmc
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAlx9H6IXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCmuXhAAvsaR7GvKGwuUNLN1aR+wHKA4
 toS8zG0bEF/mS+xDU/OYX6f96FBQ0rJURCr/LoskVVesw9Z7zU9sn1XQ3EogkM22
 EwhDJJ4yHkCMsF1GuCyx/ayeiV6ahMflJIMRJkujSD7S3XZdaAhWoHc0M/VvPM68
 2WLjFR185fZAshkvtfN1lLDDGOfsQL8Net/U560nNCVFU0QSPPQcXejfn2ikhtja
 P32XsUEVhll+zRAtbuU0IP2rJ0xx0Br5rKSE2fpfbtN51B8KN27BgQcj78IbZzLF
 MWqqDADLCXZMLMnN+U6RUKF65Bog6mxLhcuO1x+/GcMcIB5ypIF6DZP44mE+IVyp
 4M99Mm/07KxARfsJCwUTCCuVbI1C00T/fTmHiDHn7NhXXVmMq2s823Fvxxo3C59l
 5l23EXV/xEPw2doZP6fQp5Wi/uXG0guvWaXAeX7FMWOgatneRRfynOOnigk4zdfX
 LqQ17G7CNmNQR3NtP4pNQ0PQPVbQR3D9+Pn/Cecpg1tz5gvWGzJ5DUm3DxMhr66r
 CrR32+1PtmsM9SuwiMSADcXDV8H2Bg4OV/VFL6JKP82+2YkfeXYG/9W4FlemnM5L
 4zrT+cNuEHhDjQZDg15U7qcMVbNzFN9mUSSc6PLIZc1O5bIMl2NzlXXOHIsPrjb9
 TN8TINem5b65j43annE=
 =umka
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Fixup max_discard/trim calculations
   - Announce SD specs greater than 4.0
   - Add discard support for SD cards
   - Don't do retries for CMD6 (SWITCH command)
   - Various cleanups and re-structuring

  MMC host:
   - cqhci:
      * Add maintainers for eMMC CQHCI driver
   - sdhci:
      * Consolidate WP GPIO code
      * Add ADMA3 DMA support for V4 enabled host
      * Fixup card detect support in pci-o2micro driver
      * Add support for CMDQ and SDMMC pads auto-calibration in tegra
        driver
      * Add DCMD support and CMDQ support, support for i.MX6ULL variant,
        fixup HS400 timing issue and add HS400_ES support for i.MX8QXP
        to esdhc-imx driver
      * Avoid CRC errors by adjusting settings to speed mode and fixup
        card initialization for high speed mode in renesas_sdhi
      * Fixup timeout settings for omap
      * Enable 8 bits bus-width support in atmel-mci
      * Convert some legacy code in jz4740 driver to use modern APIs
      * Send a CMD12 to clear DPSM at errors for STM32 sdmmc mmci
        driver"

* tag 'mmc-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (69 commits)
  mmc:fix a bug when max_discard is 0
  mmc: core: Add a debug print when the card may have been replaced
  mmc: core: Add sd discard timeout
  mmc: core: Add discard support to sd
  mmc: sdhci-esdhc-imx: clear the HALT bit when enable CQE
  mmc: core: do not retry CMD6 in __mmc_switch()
  mmc: core: Convert mmc_align_data_size() into an SDIO specific function
  mmc: core: Move mmc_of_parse_voltage() to host.c
  mmc: core: Convert mmc_regulator_get_ocrmask() to static
  mmc: core: Move regulator helpers to separate file
  mmc: of_mmc_spi: Convert to mmc_of_parse_voltage()
  mmc: core: Drop retries as in-parameter to mmc_wait_for_app_cmd()
  mmc: core: Convert mmc_wait_for_app_cmd() to static
  mmc: renesas_sdhi: Change HW adjustment register according to speed mode
  mmc: mmci: Send a CMD12 to clear the DPSM at errors
  mmc: sdhci-xenon: Fixup already marked switch fall-through
  mmc: sdhci-tegra: drop ->get_ro() implementation
  mmc: sdhci-omap: drop ->get_ro() implementation
  mmc: sdhci: use WP GPIO in sdhci_check_ro()
  mmc: wmt-sdmmc: Drop unused include
  ...
2019-03-04 19:07:02 -08:00
Linus Torvalds
c8d950ab24 - Add a /* fall-through */ comment in the dw-i3c-master driver
- Update the I3C entries in MAINTAINERS to add an IRC chan
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcePoGAAoJEGXtNgF+CLcA5AkQAJqu55WdGQBgEd7q4ENQIRpi
 3Q23SL2FQ0UXxFUc2fYMA/WH1nNzMWBonOQLHFxMaGY0jIDF7HFMtY2FWSSoORHd
 ZBXEoTxGooOFr+x6xUfggeGHIK4Mfwni8/PNFmvSJ7l9dO/Wdv0mn+BPnNgdqZk1
 F2lFpeFLPyd4ijhvcMZkajyCuiV+Nld76GOtEJcgwqYyUJYuIL+rshOd0mIKas+o
 W2F+EcSh5A3In9/vRFXkz9vER59WOzPOM6ZbpBcX7ou5MKTMQtLIu0EygtsX2dwW
 A1yHecEDWIFhzbKBt9XW5ZNmbS/LlmCwA7qw63gR8P1kDKBF3hqxCdHwdDEhFrRx
 Np+Kgev3PQCLEZ0tmiVYIWRirSGXVZYH8RXjO/nEe0XDAMqK3x4NfQU8Ki0cRkDO
 aYIKMe8HMIqALiKoRg9RjXSR5rYUYVvF2vuTKx7Sfcc7WDm9VUvqpLC16wQytIcH
 we+73gUzy1ILmjbzKkjHjH9l+YafDzhxOP5mxeVY2uCCzinv123RMOw+phUeDhV7
 BR+gpaksEnQ0PbvmFCH0OG/4neE8iYGvG4ZkVvdqGAIZaAxEIsJJPxWax2n3oV8W
 l4n2vlB5LVpkGQN1OI/clfifbp05S2PHbqF4xBeuRSL46XXuCKCxeYPr1WnrwH+a
 AgC/crDxDmOQqc8JaiRf
 =Ijxi
 -----END PGP SIGNATURE-----

Merge tag 'i3c/for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux

Pull i3c updates from Boris Brezillon:

 - Add a /* fall-through */ comment in the dw-i3c-master driver

 - Update the I3C entries in MAINTAINERS to add an IRC chan

* tag 'i3c/for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
  i3c: master: dw-i3c-master: mark expected switch fall-through
  MAINTAINERS: Add an IRC channel for the I3C subsystem
2019-03-04 19:05:02 -08:00
Linus Torvalds
811c16a2a2 MTD changes:
- Use struct_size() where appropriate
 - mtd_{read,write}() as wrappers around mtd_{read,write}_oob()
 - Fix misuse of PTR_ERR() in docg3
 - Coding style improvements in mtdcore.c
 
 SPI NOR changes:
   Core changes:
   - Add support of octal mode I/O transfer
   - Add a bunch of SPI NOR entries to the flash_info table
 
   SPI NOR controller driver changes:
   - cadence-quadspi:
     * Add support for Octal SPI controller
     * write upto 8-bytes data in STIG mode
   - mtk-quadspi:
     * rename config to a common one
     * add SNOR_HWCAPS_READ to spi_nor_hwcaps mask
   - Add Tudor as SPI-NOR co-maintainer
 
 NAND changes
   NAND core changes:
   - Fourth batch of fixes/cleanup to the raw NAND core impacting various
     controller drivers (Sunxi, Marvell, MTK, TMIO, OMAP2).
   - Checking the return code of nand_reset() and nand_readid_op().
   - Removing ->legacy.erase and single_erase().
   - Simplifying the locking.
   - Several implicit fall through annotations.
 
   Raw NAND controllers drivers changes:
   - Fixing various possible object reference leaks (MTK, JZ4780, Atmel).
   - ST:
     * Adding support for STM32 FMC2 NAND flash controller.
   - Meson:
     * Adding support for Amlogic NAND flash controller.
   - Denali:
     * Several cleanup patches.
   - Sunxi:
     * Several cleanup patches.
   - FSMC:
     * Disabling NAND on remove().
     * Resetting NAND timings on resume().
 
   SPI-NAND drivers changes:
   - Toshiba:
     * Adding support for all Toshiba products.
   - Macronix:
     * Fixing ECC status read.
   - Gigadevice:
     * Adding support for GD5F1GQ4UExxG.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcc6fZAAoJEGXtNgF+CLcAuJAQAMKmhbWs9j8+A/hLNkfiZv1g
 Yg1e4rs9AMCJcBAprw1nO6U8EJyAgNxY/WafR1Kqz8tvUAw8LjJxvhPQzyhfBKq5
 w/eR6C1sod7Ay6oNkpI7r2dM0spyLJUwP13FMthoMSM1heupe/HE6s8QXCS71WXW
 vi0C6LKDlokdo2VtArB8orA4x2794/+Mn2JHOhIqZcoLl8W6B3k/kckrv0MXd0po
 bCivqVx5jdQC0+khl+yT4CJvB10DQmmLRZ8Itd4GUP1mHoCEO+De8NDqjoddzKM2
 VCMI8dr5h/YjBsspLSPBfH1qnT+OxJnAnWRf+XCBraYG4bJP9xdmnhV6zDz9T0dS
 sxj62IRTrW41u+Izv8+Rus5EPuKsCATnfKTReQRwc3zDkyYYVzdi8XYvHknxkJ1Z
 0+wKjRGf4K/ETcenSXr8Tqx0IRz5PzXyTZdWyyk/cJKLhmYIJQQs0lwa+9PHJK45
 FIt9vFTJYOAFdrecnCNbhymeSHLAtDNdG8x9XzjgjF6R3aftVBGLjCNuwN7ECfyq
 LMJpqycWih5wiihaL5QXnvMnRHvHaolle2Rlvl5BR+y+LMBc4luw9TFtJ3Jwq/qy
 hHjFlugCCtQVk3TYRFNLhiidml6hDoUEL01JofgjnYZcBfmGfkNnPz1RrcoMW9QT
 J4ZQKXj0T01OVna/zme+
 =wIHY
 -----END PGP SIGNATURE-----

Merge tag 'mtd/for-5.1' of git://git.infradead.org/linux-mtd

Pull MTD updates from Boris Brezillon:
 "Core MTD changes:
   - Use struct_size() where appropriate
   - mtd_{read,write}() as wrappers around mtd_{read,write}_oob()
   - Fix misuse of PTR_ERR() in docg3
   - Coding style improvements in mtdcore.c

  SPI NOR changes:
    Core changes:
     - Add support of octal mode I/O transfer
     - Add a bunch of SPI NOR entries to the flash_info table

    SPI NOR controller driver changes:
     - cadence-quadspi:
        * Add support for Octal SPI controller
        * write upto 8-bytes data in STIG mode
     - mtk-quadspi:
        * rename config to a common one
        * add SNOR_HWCAPS_READ to spi_nor_hwcaps mask
     - Add Tudor as SPI-NOR co-maintainer

  NAND changes:
    NAND core changes:
     - Fourth batch of fixes/cleanup to the raw NAND core impacting
       various controller drivers (Sunxi, Marvell, MTK, TMIO, OMAP2).
     - Check the return code of nand_reset() and nand_readid_op().
     - Remove ->legacy.erase and single_erase().
     - Simplify the locking.
     - Several implicit fall through annotations.

    Raw NAND controllers drivers changes:
     - Fix various possible object reference leaks (MTK, JZ4780, Atmel)
     - ST:
        * Add support for STM32 FMC2 NAND flash controller
     - Meson:
        * Add support for Amlogic NAND flash controller
     - Denali:
        * Several cleanup patches
     - Sunxi:
        * Several cleanup patches
     - FSMC:
        * Disable NAND on remove()
        * Reset NAND timings on resume()

    SPI-NAND drivers changes:
     - Toshiba:
        * Add support for all Toshiba products.
     - Macronix:
        * Fix ECC status read.
     - Gigadevice:
        * Add support for GD5F1GQ4UExxG"

* tag 'mtd/for-5.1' of git://git.infradead.org/linux-mtd: (64 commits)
  mtd: spi-nor: Fix wrong abbreviation HWCPAS
  mtd: spi-nor: cadence-quadspi: fix spelling mistake: "Couldnt't" -> "Couldn't"
  mtd: spi-nor: Add support for en25qh64
  mtd: spi-nor: Add support for MX25V8035F
  mtd: spi-nor: Add support for EN25Q80A
  mtd: spi-nor: cadence-quadspi: Add support for Octal SPI controller
  dt-bindings: cadence-quadspi: Add new compatible for AM654 SoC
  mtd: spi-nor: split s25fl128s into s25fl128s0 and s25fl128s1
  mtd: spi-nor: cadence-quadspi: write upto 8-bytes data in STIG mode
  mtd: spi-nor: Add support for mx25u3235f
  mtd: rawnand: denali_dt: remove single anonymous clock support
  mtd: rawnand: mtk: fix possible object reference leak
  mtd: rawnand: jz4780: fix possible object reference leak
  mtd: rawnand: atmel: fix possible object reference leak
  mtd: rawnand: fsmc: Disable NAND on remove()
  mtd: rawnand: fsmc: Reset NAND timings on resume()
  mtd: spinand: Add support for GigaDevice GD5F1GQ4UExxG
  mtd: rawnand: denali: remove unused dma_addr field from denali_nand_info
  mtd: rawnand: denali: remove unused function argument 'raw'
  mtd: rawnand: denali: remove unneeded denali_reset_irq() call
  ...
2019-03-04 18:59:37 -08:00
Linus Torvalds
a83b04232c VFIO updates for v5.1-rc1
- Switch mdev to generic UUID API (Andy Shevchenko)
 
  - Fixup platform reset include paths (Masahiro Yamada)
 
  - Fix usage of MINORMASK (Chengguang Xu)
 
  - Remove noise from duplicate spapr table unsets (Alexey Kardashevskiy)
 
  - Restore device state after PM reset (Alex Williamson)
 
  - Ensure memory translation enabled for PCI ROM access (Eric Auger)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.14 (GNU/Linux)
 
 iQIcBAABAgAGBQJccCxQAAoJECObm247sIsiRBwQAIwGszzvz7688BRrbm6y6BA5
 z0jptLODKAecSfS/oQlIwNFsGOjfBK51C1u6+AgZbeizn9hCTUEKU8uFBZWmjLJX
 LjndZa4e3/x177K21FWRlmwON/ECclFbsfmUIrejulvMZMRYP+ruawm1WctQqdai
 GmNvggjqoP+yk1MHN+riULh+3uSRjQB9kOMFnlwxa8AgTlfUh85jvYe8tdGd04Lh
 if6ulyIZXHdMZbY0XUKQIUwEsKCHaC/p9E+gyq0dNaLyoXL86bR5iVWackGGBzCx
 nWvpBtpNIrvBekk5fEWGP3ItfxTIPE1TOuDSktUhQNkJrs1GQXu5K2cnuCECdHu7
 3ffNg4E3fhRtv+MzgNxx6tTelWUoZDZodHDFtim4i+FqxpjJnLjO3ztHKf+ZEYOv
 NB24WAE1uAqDEk28CMj4N/DWu2oBrwk4rfGtNc7SA2WL+CIdRr7aQwjxfXn2R+hx
 6kzicR3lsgwHiuw9SmNXlFspqnnNSby1CqauxqdVDbiQC2FDvh5Q8+7PxwvA4ULS
 49LKm7vzjiYE9eS4eZyWnmRQV2UwBvEv85HFjktyYGjEMcMtpZk07BjPxkeHCJwl
 rPYwY+1c16Jk11rfm69xCzztur/WLqTP+GhZ0nU7zOgS2jzWuIL6mURcmf82z433
 IDBNyZ2pUWGIWSIU6ZTt
 =9Ahg
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v5.1-rc1' of git://github.com/awilliam/linux-vfio

Pull VFIO updates from Alex Williamson:

 - Switch mdev to generic UUID API (Andy Shevchenko)

 - Fixup platform reset include paths (Masahiro Yamada)

 - Fix usage of MINORMASK (Chengguang Xu)

 - Remove noise from duplicate spapr table unsets (Alexey Kardashevskiy)

 - Restore device state after PM reset (Alex Williamson)

 - Ensure memory translation enabled for PCI ROM access (Eric Auger)

* tag 'vfio-v5.1-rc1' of git://github.com/awilliam/linux-vfio:
  vfio_pci: Enable memory accesses before calling pci_map_rom
  vfio/pci: Restore device state on PM transition
  vfio/spapr_tce: Skip unsetting already unset table
  samples/vfio-mdev/mtty: expand minor range when registering chrdev region
  samples/vfio-mdev/mdpy: expand minor range when registering chrdev region
  samples/vfio-mdev/mbochs: expand minor range when registering chrdev region
  vfio: expand minor range when registering chrdev region
  vfio: platform: reset: fix up include directives to remove ccflags-y
  vfio-mdev: Switch to use new generic UUID API
2019-03-04 18:56:36 -08:00
Slavomir Kaslev
ee5e001196 fs: Make splice() and tee() take into account O_NONBLOCK flag on pipes
The current implementation of splice() and tee() ignores O_NONBLOCK set
on pipe file descriptors and checks only the SPLICE_F_NONBLOCK flag for
blocking on pipe arguments.  This is inconsistent since splice()-ing
from/to non-pipe file descriptors does take O_NONBLOCK into
consideration.

Fix this by promoting O_NONBLOCK, when set on a pipe, to
SPLICE_F_NONBLOCK.

Some context for how the current implementation of splice() leads to
inconsistent behavior.  In the ongoing work[1] to add VM tracing
capability to trace-cmd we stream tracing data over named FIFOs or
vsockets from guests back to the host.

When we receive SIGINT from user to stop tracing, we set O_NONBLOCK on
the input file descriptor and set SPLICE_F_NONBLOCK for the next call to
splice().  If splice() was blocked waiting on data from the input FIFO,
after SIGINT splice() restarts with the same arguments (no
SPLICE_F_NONBLOCK) and blocks again instead of returning -EAGAIN when no
data is available.

This differs from the splice() behavior when reading from a vsocket or
when we're doing a traditional read()/write() loop (trace-cmd's
--nosplice argument).

With this patch applied we get the same behavior in all situations after
setting O_NONBLOCK which also matches the behavior of doing a
read()/write() loop instead of splice().

This change does have potential of breaking users who don't expect
EAGAIN from splice() when SPLICE_F_NONBLOCK is not set.  OTOH programs
that set O_NONBLOCK and don't anticipate EAGAIN are arguably buggy[2].

 [1] https://github.com/skaslev/trace-cmd/tree/vsock
 [2] d47e3da175/fs/read_write.c (L1425)

Signed-off-by: Slavomir Kaslev <kaslevs@vmware.com>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-03-04 16:10:17 -08:00
Linus Torvalds
4f9020ffde Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs fixes from Al Viro:
 "Assorted fixes that sat in -next for a while, all over the place"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  aio: Fix locking in aio_poll()
  exec: Fix mem leak in kernel_read_file
  copy_mount_string: Limit string length to PATH_MAX
  cgroup: saner refcounting for cgroup_root
  fix cgroup_do_mount() handling of failure exits
2019-03-04 13:24:27 -08:00
Linus Torvalds
736706bee3 get rid of legacy 'get_ds()' function
Every in-kernel use of this function defined it to KERNEL_DS (either as
an actual define, or as an inline function).  It's an entirely
historical artifact, and long long long ago used to actually read the
segment selector valueof '%ds' on x86.

Which in the kernel is always KERNEL_DS.

Inspired by a patch from Jann Horn that just did this for a very small
subset of users (the ones in fs/), along with Al who suggested a script.
I then just took it to the logical extreme and removed all the remaining
gunk.

Roughly scripted with

   git grep -l '(get_ds())' -- :^tools/ | xargs sed -i 's/(get_ds())/(KERNEL_DS)/'
   git grep -lw 'get_ds' -- :^tools/ | xargs sed -i '/^#define get_ds()/d'

plus manual fixups to remove a few unusual usage patterns, the couple of
inline function cases and to fix up a comment that had become stale.

The 'get_ds()' function remains in an x86 kvm selftest, since in user
space it actually does something relevant.

Inspired-by: Jann Horn <jannh@google.com>
Inspired-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-03-04 10:50:14 -08:00
Linus Torvalds
84c4e1f89f aio: simplify - and fix - fget/fput for io_submit()
Al Viro root-caused a race where the IOCB_CMD_POLL handling of
fget/fput() could cause us to access the file pointer after it had
already been freed:

 "In more details - normally IOCB_CMD_POLL handling looks so:

   1) io_submit(2) allocates aio_kiocb instance and passes it to
      aio_poll()

   2) aio_poll() resolves the descriptor to struct file by req->file =
      fget(iocb->aio_fildes)

   3) aio_poll() sets ->woken to false and raises ->ki_refcnt of that
      aio_kiocb to 2 (bumps by 1, that is).

   4) aio_poll() calls vfs_poll(). After sanity checks (basically,
      "poll_wait() had been called and only once") it locks the queue.
      That's what the extra reference to iocb had been for - we know we
      can safely access it.

   5) With queue locked, we check if ->woken has already been set to
      true (by aio_poll_wake()) and, if it had been, we unlock the
      queue, drop a reference to aio_kiocb and bugger off - at that
      point it's a responsibility to aio_poll_wake() and the stuff
      called/scheduled by it. That code will drop the reference to file
      in req->file, along with the other reference to our aio_kiocb.

   6) otherwise, we see whether we need to wait. If we do, we unlock the
      queue, drop one reference to aio_kiocb and go away - eventual
      wakeup (or cancel) will deal with the reference to file and with
      the other reference to aio_kiocb

   7) otherwise we remove ourselves from waitqueue (still under the
      queue lock), so that wakeup won't get us. No async activity will
      be happening, so we can safely drop req->file and iocb ourselves.

  If wakeup happens while we are in vfs_poll(), we are fine - aio_kiocb
  won't get freed under us, so we can do all the checks and locking
  safely. And we don't touch ->file if we detect that case.

  However, vfs_poll() most certainly *does* touch the file it had been
  given. So wakeup coming while we are still in ->poll() might end up
  doing fput() on that file. That case is not too rare, and usually we
  are saved by the still present reference from descriptor table - that
  fput() is not the final one.

  But if another thread closes that descriptor right after our fget()
  and wakeup does happen before ->poll() returns, we are in trouble -
  final fput() done while we are in the middle of a method:

Al also wrote a patch to take an extra reference to the file descriptor
to fix this, but I instead suggested we just streamline the whole file
pointer handling by submit_io() so that the generic aio submission code
simply keeps the file pointer around until the aio has completed.

Fixes: bfe4037e722e ("aio: implement IOCB_CMD_POLL")
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Reported-by: syzbot+503d4cc169fcec1cb18c@syzkaller.appspotmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-03-04 10:32:48 -08:00
Linus Torvalds
00c42373d3 x86-64: add warning for non-canonical user access address dereferences
This adds a warning (once) for any kernel dereference that has a user
exception handler, but accesses a non-canonical address.  It basically
is a simpler - and more limited - version of commit 9da3f2b74054
("x86/fault: BUG() when uaccess helpers fault on kernel addresses") that
got reverted.

Note that unlike that original commit, this only causes a warning,
because there are real situations where we currently can do this
(notably speculative argument fetching for uprobes etc).  Also, unlike
that original commit, this _only_ triggers for #GP accesses, so the
cases of valid kernel pointers that cross into a non-mapped page aren't
affected.

The intent of this is two-fold:

 - the uprobe/tracing accesses really do need to be more careful. In
   particular, from a portability standpoint it's just wrong to think
   that "a pointer is a pointer", and use the same logic for any random
   pointer value you find on the stack. It may _work_ on x86-64, but it
   doesn't necessarily work on other architectures (where the same
   pointer value can be either a kernel pointer _or_ a user pointer, and
   you really need to be much more careful in how you try to access it)

   The warning can hopefully end up being a reminder that just any
   random pointer access won't do.

 - Kees in particular wanted a way to actually report invalid uses of
   wild pointers to user space accessors, instead of just silently
   failing them. Automated fuzzers want a way to get reports if the
   kernel ever uses invalid values that the fuzzer fed it.

   The non-canonical address range is a fair chunk of the address space,
   and with this you can teach syzkaller to feed in invalid pointer
   values and find cases where we do not properly validate user
   addresses (possibly due to bad uses of "set_fs()").

Acked-by: Kees Cook <keescook@chromium.org>
Cc: Jann Horn <jannh@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-03-04 10:08:28 -08:00
Mark Brown
88f268a5bc
Merge branch 'regulator-5.1' into regulator-next 2019-03-04 15:32:43 +00:00
Mark Brown
c364098fe8
Merge branch 'regulator-5.0' into regulator-linus 2019-03-04 15:32:41 +00:00
Axel Lin
e5680c4de3
regulator: mc13xxx: Constify regulator_ops variables
These regulator_ops variables should never change, make them const.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-04 00:01:08 +00:00
Axel Lin
ad542a527c
regulator: palmas: Constify palmas_smps_ramp_delay array
The palmas_smps_ramp_delay array should never modify, make it const.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-04 00:00:47 +00:00
Axel Lin
20eb641e47
regulator: wm831x-dcdc: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-04 00:00:27 +00:00
Axel Lin
f4afd05ed6
regulator: pv88090: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>;
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-04 00:00:06 +00:00
Axel Lin
989a99bc64
regulator: pv88080: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:59:46 +00:00
Axel Lin
9a5b3e5b2f
regulator: pv88060: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:59:20 +00:00
Mark Brown
1aad9f2f79
Merge branch 'for-5.0' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator into regulator-5.1 2019-03-03 23:49:46 +00:00
Axel Lin
6c98ac2a34
regulator: max77650: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:47:26 +00:00
Axel Lin
be6230c319
regulator: lp873x: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:47:06 +00:00
Axel Lin
8918f06807
regulator: lp872x: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:46:45 +00:00
Axel Lin
8b3216c401
regulator: da9210: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:46:25 +00:00
Axel Lin
941666e298
regulator: da9055: Convert to use regulator_set/get_current_limit_regmap
Use regulator_set/get_current_limit_regmap helpers to save some code.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:46:04 +00:00
Axel Lin
a32e0c773b
regulator: core: Add set/get_current_limit helpers for regmap users
By setting curr_table, n_current_limits, csel_reg and csel_mask, the
regmap users can use regulator_set_current_limit_regmap and
regulator_get_current_limit_regmap for set/get_current_limit callbacks.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:45:27 +00:00
Axel Lin
35d838ff98
regulator: Fix comment for csel_reg and csel_mask
The csel_reg and csel_mask fields in struct regulator_desc needs to
be generic for drivers. Not just for TPS65218.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2019-03-03 23:44:53 +00:00
Linus Torvalds
1c163f4c7b Linux 5.0 2019-03-03 15:21:29 -08:00
Linus Torvalds
c027c7cf15 ARM: SoC fixes for v5.0
One more set of simple ARM platform fixes:
 
  - A boot regression on qualcomm msm8998
  - Gemini display controllers got turned off by accident
  - incorrect reference counting in optee
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJcewMjAAoJEGCrR//JCVInKmUP/0Cf2M4eekFEoEMSkCOlZlvP
 aDiFaejGOfGXVMkBX6f5dwc4hEzGTPMBEIcsMDOa6LDFo6wd1JW+XIFYOcyT8oVr
 ELTOQeLj0Ru+c4d4r2PrNLG4jpacoWfGgDXih8QNfKn7MbcHGyu8XN/UQZGx/Vw5
 Lebrc7yrMgHpYrP2Pwj/q+6PY+DhuQbV3YEtpN8YVKFHWkqBF+81ghTpaaoOi1Uu
 +cS6lmh3bVzsyX0SO1TXWqYXd9UWWhgnkdvIHbB7XRKHW6amzSwKBvc95TE42Ycu
 8nQOc+33ZDUki0bQB75gjVU8HY2L0nNEk9Atw8o+Y4ZCCpDYpcryYwoKrNdX2GMB
 H+55ENU9zn9V/H8xOZ84+Vmu3uIQIk0gymSAyMCkNLjw/D84oxDSVMRJLeWuILlF
 LcI7+1hcT0vcwpIIQqQbocK1D0XvkNSkNhukl5eM/JhMQVLOblDW8FSK88RIkPKp
 t0yE44DJbsaz2L8ab7S/84aHP5pxybrazNXrl2N3F8Xaj+DQZ1Bk8Q3cwVH4G6Km
 DdKAEsDpbe8f1bzfmIgM/tfpPKus3ETC39wJm4bK3Yt5znllUOCOOalitUtQZVj2
 AjI8MxbM/9ePr2ymMmiQVNap2lXfaGcvNNlX/JNnJv7KiaN7mZGxQ1Vrw6EHbMbm
 fuLi8Z/mtTaucWc67GM+
 =doMO
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC fixes from Arnd Bergmann:
 "One more set of simple ARM platform fixes:

   - A boot regression on qualcomm msm8998

   - Gemini display controllers got turned off by accident

   - incorrect reference counting in optee"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  tee: optee: add missing of_node_put after of_device_is_available
  arm64: dts: qcom: msm8998: Extend TZ reserved memory area
  ARM: dts: gemini: Re-enable display controller
2019-03-02 16:43:15 -08:00
Linus Torvalds
e7c42a89e9 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Thomas Gleixner:
 "Two last minute fixes:

   - Prevent value evaluation via functions happening in the user access
     enabled region of __put_user() (put another way: make sure to
     evaluate the value to be stored in user space _before_ enabling
     user space accesses)

   - Correct the definition of a Hyper-V hypercall constant"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/hyper-v: Fix definition of HV_MAX_FLUSH_REP_COUNT
  x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
2019-03-02 11:47:29 -08:00
Linus Torvalds
df49fd0ff8 SCSI fixes on 20190302
Nine small fixes.  The resume fix is a cosmetic removal of a warning
 with an incorrect condition causing it to alarm people wrongly.  The
 other eight patches correct a thinko in Christoph Hellwig's DMA
 conversion series.  Without it all these drivers end up with 32 bit
 DMA masks meaning they bounce any page over 4GB before sending it to
 the controller.  Nowadays, even laptops mostly have memory above 4GB,
 so this can lead to significant performance degradation with all the
 bouncing.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCXHql8CYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishQmvAQCSVQRf
 kx3ABDGnaj4Km4/Jzibj44aCYwh+ewwtLCWwFQD9GWaEaDxBkbxQDf/YndQKRhYg
 VJQjjj6a9VlNSmWoW28=
 =L9Fe
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Nine small fixes.

  The resume fix is a cosmetic removal of a warning with an incorrect
  condition causing it to alarm people wrongly.

  The other eight patches correct a thinko in Christoph Hellwig's DMA
  conversion series. Without it all these drivers end up with 32 bit DMA
  masks meaning they bounce any page over 4GB before sending it to the
  controller.

  Nowadays, even laptops mostly have memory above 4GB, so this can lead
  to significant performance degradation with all the bouncing"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: core: Avoid that system resume triggers a kernel warning
  scsi: hptiop: fix calls to dma_set_mask()
  scsi: hisi_sas: fix calls to dma_set_mask_and_coherent()
  scsi: csiostor: fix calls to dma_set_mask_and_coherent()
  scsi: bfa: fix calls to dma_set_mask_and_coherent()
  scsi: aic94xx: fix calls to dma_set_mask_and_coherent()
  scsi: 3w-sas: fix calls to dma_set_mask_and_coherent()
  scsi: 3w-9xxx: fix calls to dma_set_mask_and_coherent()
  scsi: lpfc: fix calls to dma_set_mask_and_coherent()
2019-03-02 11:39:54 -08:00
Linus Torvalds
c93d9218ea Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Fix refcount leak in act_ipt during replace, from Davide Caratti.

 2) Set task state properly in tun during blocking reads, from Timur
    Celik.

 3) Leaked reference in DSA, from Wen Yang.

 4) NULL deref in act_tunnel_key, from Vlad Buslov.

 5) cipso_v4_erro can reference the skb IPCB in inappropriate contexts
    thus referencing garbage, from Nazarov Sergey.

 6) Don't accept RTA_VIA and RTA_GATEWAY in contexts where those
    attributes make no sense.

 7) Fix hung sendto in tipc, from Tung Nguyen.

 8) Out-of-bounds access in netlabel, from Paul Moore.

 9) Grant reference leak in xen-netback, from Igor Druzhinin.

10) Fix tx stalls with lan743x, from Bryan Whitehead.

11) Fix interrupt storm with mv88e6xxx, from Hein Kallweit.

12) Memory leak in sit on device registry failure, from Mao Wenan.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
  net: sit: fix memory leak in sit_init_net()
  net: dsa: mv88e6xxx: Fix statistics on mv88e6161
  geneve: correctly handle ipv6.disable module parameter
  net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode
  bpf: fix sanitation rewrite in case of non-pointers
  ipv4: Add ICMPv6 support when parse route ipproto
  MIPS: eBPF: Fix icache flush end address
  lan743x: Fix TX Stall Issue
  net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
  net: aquantia: regression on cpus with high cores: set mode with 8 queues
  selftests: fixes for UDP GRO
  bpf: drop refcount if bpf_map_new_fd() fails in map_create()
  net: dsa: mv88e6xxx: power serdes on/off for 10G interfaces on 6390X
  net: dsa: mv88e6xxx: Fix u64 statistics
  xen-netback: don't populate the hash cache on XenBus disconnect
  xen-netback: fix occasional leak of grant ref mappings under memory pressure
  sctp: chunk.c: correct format string for size_t in printk
  net: netem: fix skb length BUG_ON in __skb_to_sgvec
  netlabel: fix out-of-bounds memory accesses
  ipv4: Pass original device to ip_rcv_finish_core
  ...
2019-03-02 08:46:34 -08:00
Linus Torvalds
fa3294c58c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull more crypto fixes from Herbert Xu:
 "This fixes a couple of issues in arm64/chacha that was introduced in
  5.0"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: arm64/chacha - fix hchacha_block_neon() for big endian
  crypto: arm64/chacha - fix chacha_4block_xor_neon() for big endian
2019-03-02 08:32:02 -08:00
Mao Wenan
07f12b26e2 net: sit: fix memory leak in sit_init_net()
If register_netdev() is failed to register sitn->fb_tunnel_dev,
it will go to err_reg_dev and forget to free netdev(sitn->fb_tunnel_dev).

BUG: memory leak
unreferenced object 0xffff888378daad00 (size 512):
  comm "syz-executor.1", pid 4006, jiffies 4295121142 (age 16.115s)
  hex dump (first 32 bytes):
    00 e6 ed c0 83 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace:
    [<00000000d6dcb63e>] kvmalloc include/linux/mm.h:577 [inline]
    [<00000000d6dcb63e>] kvzalloc include/linux/mm.h:585 [inline]
    [<00000000d6dcb63e>] netif_alloc_netdev_queues net/core/dev.c:8380 [inline]
    [<00000000d6dcb63e>] alloc_netdev_mqs+0x600/0xcc0 net/core/dev.c:8970
    [<00000000867e172f>] sit_init_net+0x295/0xa40 net/ipv6/sit.c:1848
    [<00000000871019fa>] ops_init+0xad/0x3e0 net/core/net_namespace.c:129
    [<00000000319507f6>] setup_net+0x2ba/0x690 net/core/net_namespace.c:314
    [<0000000087db4f96>] copy_net_ns+0x1dc/0x330 net/core/net_namespace.c:437
    [<0000000057efc651>] create_new_namespaces+0x382/0x730 kernel/nsproxy.c:107
    [<00000000676f83de>] copy_namespaces+0x2ed/0x3d0 kernel/nsproxy.c:165
    [<0000000030b74bac>] copy_process.part.27+0x231e/0x6db0 kernel/fork.c:1919
    [<00000000fff78746>] copy_process kernel/fork.c:1713 [inline]
    [<00000000fff78746>] _do_fork+0x1bc/0xe90 kernel/fork.c:2224
    [<000000001c2e0d1c>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
    [<00000000ec48bd44>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [<0000000039acff8a>] 0xffffffffffffffff

Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-02 00:53:23 -08:00
Andrew Lunn
a6da21bb0e net: dsa: mv88e6xxx: Fix statistics on mv88e6161
Despite what the datesheet says, the silicon implements the older way
of snapshoting the statistics. Change the op.

Reported-by: Chris.Healy@zii.aero
Tested-by: Chris.Healy@zii.aero
Fixes: 0ac64c394900 ("net: dsa: mv88e6xxx: mv88e6161 uses mv88e6320 stats snapshot")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-02 00:45:04 -08:00
Jiri Benc
cf1c9ccba7 geneve: correctly handle ipv6.disable module parameter
When IPv6 is compiled but disabled at runtime, geneve_sock_add returns
-EAFNOSUPPORT. For metadata based tunnels, this causes failure of the whole
operation of bringing up the tunnel.

Ignore failure of IPv6 socket creation for metadata based tunnels caused by
IPv6 not being available.

This is the same fix as what commit d074bf960044 ("vxlan: correctly handle
ipv6.disable module parameter") is doing for vxlan.

Note there's also commit c0a47e44c098 ("geneve: should not call rt6_lookup()
when ipv6 was disabled") which fixes a similar issue but for regular
tunnels, while this patch is needed for metadata based tunnels.

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 22:07:56 -08:00
David S. Miller
f08d6114b7 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Alexei Starovoitov says:

====================
pull-request: bpf 2019-03-01

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) fix sanitation rewrite, from Daniel.

2) fix error path on map_new_fd, from Peng.

3) fix icache flush address, from Paul.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 21:48:08 -08:00
Heiner Kallweit
ed8fe20205 net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode
When debugging another issue I faced an interrupt storm in this
driver (88E6390, port 9 in SGMII mode), consisting of alternating
link-up / link-down interrupts. Analysis showed that the driver
wanted to set a cmode that was set already. But so far
mv88e6390x_port_set_cmode() doesn't check this and powers down
SERDES, what causes the link to break, and eventually results in
the described interrupt storm.

Fix this by checking whether the cmode actually changes. We want
that the very first call to mv88e6390x_port_set_cmode() always
configures the registers, therefore initialize port.cmode with
a value that is different from any supported cmode value.
We have to take care that we only init the ports cmode once
chip->info->num_ports is set.

v2:
- add small helper and init the number of actual ports only

Fixes: 364e9d7776a3 ("net: dsa: mv88e6xxx: Power on/off SERDES on cmode change")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 21:37:05 -08:00
Daniel Borkmann
3612af783c bpf: fix sanitation rewrite in case of non-pointers
Marek reported that he saw an issue with the below snippet in that
timing measurements where off when loaded as unpriv while results
were reasonable when loaded as privileged:

    [...]
    uint64_t a = bpf_ktime_get_ns();
    uint64_t b = bpf_ktime_get_ns();
    uint64_t delta = b - a;
    if ((int64_t)delta > 0) {
    [...]

Turns out there is a bug where a corner case is missing in the fix
d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar
type from different paths"), namely fixup_bpf_calls() only checks
whether aux has a non-zero alu_state, but it also needs to test for
the case of BPF_ALU_NON_POINTER since in both occasions we need to
skip the masking rewrite (as there is nothing to mask).

Fixes: d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar type from different paths")
Reported-by: Marek Majkowski <marek@cloudflare.com>
Reported-by: Arthur Fabre <afabre@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/netdev/CAJPywTJqP34cK20iLM5YmUMz9KXQOdu1-+BZrGMAGgLuBWz7fg@mail.gmail.com/T/
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2019-03-01 21:24:08 -08:00
Hangbin Liu
5e1a99eae8 ipv4: Add ICMPv6 support when parse route ipproto
For ip rules, we need to use 'ipproto ipv6-icmp' to match ICMPv6 headers.
But for ip -6 route, currently we only support tcp, udp and icmp.

Add ICMPv6 support so we can match ipv6-icmp rules for route lookup.

v2: As David Ahern and Sabrina Dubroca suggested, Add an argument to
rtm_getroute_parse_ip_proto() to handle ICMP/ICMPv6 with different family.

Reported-by: Jianlin Shi <jishi@redhat.com>
Fixes: eacb9384a3fe ("ipv6: support sport, dport and ip_proto in RTM_GETROUTE")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 16:41:27 -08:00
Paul Burton
d1a2930d8a MIPS: eBPF: Fix icache flush end address
The MIPS eBPF JIT calls flush_icache_range() in order to ensure the
icache observes the code that we just wrote. Unfortunately it gets the
end address calculation wrong due to some bad pointer arithmetic.

The struct jit_ctx target field is of type pointer to u32, and as such
adding one to it will increment the address being pointed to by 4 bytes.
Therefore in order to find the address of the end of the code we simply
need to add the number of 4 byte instructions emitted, but we mistakenly
add the number of instructions multiplied by 4. This results in the call
to flush_icache_range() operating on a memory region 4x larger than
intended, which is always wasteful and can cause crashes if we overrun
into an unmapped page.

Fix this by correcting the pointer arithmetic to remove the bogus
multiplication, and use braces to remove the need for a set of brackets
whilst also making it obvious that the target field is a pointer.

Signed-off-by: Paul Burton <paul.burton@mips.com>
Fixes: b6bd53f9c4e8 ("MIPS: Add missing file for eBPF JIT.")
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: netdev@vger.kernel.org
Cc: bpf@vger.kernel.org
Cc: linux-mips@vger.kernel.org
Cc: stable@vger.kernel.org # v4.13+
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-03-02 00:04:15 +01:00
Bryan Whitehead
90490ef726 lan743x: Fix TX Stall Issue
It has been observed that tx queue stalls while downloading
from certain web sites (example www.speedtest.net)

The cause has been tracked down to a corner case where
dma descriptors where not setup properly. And there for a tx
completion interrupt was not signaled.

This fix corrects the problem by properly marking the end of
a multi descriptor transmission.

Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Bryan Whitehead <Bryan.Whitehead@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 11:34:09 -08:00
Heiner Kallweit
d25ed413d5 net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
When debugging an issue I found implausible values in state->pause.
Reason in that state->pause isn't initialized and later only single
bits are changed. Also the struct itself isn't initialized in
phylink_resolve(). So better initialize state->pause and other
not yet initialized fields.

v2:
- use right function name in subject
v3:
- initialize additional fields

Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 11:30:48 -08:00
Dmitry Bogdanov
15f3ddf53d net: aquantia: regression on cpus with high cores: set mode with 8 queues
Recently the maximum number of queues was increased up to 8, but
NIC was not fully configured for 8 queues. In setups with more than 4 CPU
cores parts of TX traffic gets lost if the kernel routes it to queues 4th-8th.

This patch sets a tx hw traffic mode with 8 queues.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202651

Fixes: 71a963cfc50b ("net: aquantia: increase max number of hw queues")
Reported-by: Nicholas Johnson <nicholas.johnson@outlook.com.au>
Signed-off-by: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 11:24:53 -08:00
Paolo Abeni
ada641ff6e selftests: fixes for UDP GRO
The current implementation for UDP GRO tests is racy: the receiver
may flush the RX queue while the sending is still transmitting and
incorrectly report RX errors, with a wrong number of packet received.

Add explicit timeouts to the receiver for both connection activation
(first packet received for UDP) and reception completion, so that
in the above critical scenario the receiver will wait for the
transfer completion.

Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-01 11:24:00 -08:00
Linus Torvalds
a215ce8f0e IOMMU Fix for Linux v5.0-rc8
One important patch:
 
 	- Fix for a memory corruption issue in the Intel VT-d driver
 	  that triggers on hardware with deep PCI hierarchies
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJceWO/AAoJECvwRC2XARrjBtQQAJ5w8QuiuPsukHSE6Qt7OqAM
 2W0B6J4Mb2LoY08Zfh0eG59WrJZU+vZSgi/NoKU7VJJFQmlD/Y+DMFdkzCpBfGXq
 NP1lCvKlcAaKi81PnAr2LFR7jMr4n5j7kPl6DVizFuBztwZcoYXXesNcbemMJLfo
 NMCYDlo8qyAf9+ETY6UKa5rbr6lJZCGodiNQazkAsVAAs5LNlYoXZKlD4/SYElmL
 Kj7OFeKD2TgtmD1MKA6LdP3MfjP3HvI9nXO/+20LZdDxJoBIkD/4SWCrjxtzny84
 z85ypxwGZahKRZwKNSvjKMNaQJfu/S9uiN2yx4IZI8prYG5Po7lB4bI/Ol420Ze5
 oKdMjFQ4mfKswm3fBOwlMpCJr41jwY1oWjdtLwHNXX3iwCh7EoGTKzQpjqH7GAa2
 iSzlVhQS/o2FS7OcklYtmHnOwgbM1t3J4r3viAPpyVjkQh1RCnw3RBAsxM6ta3Rn
 BFVzoTdf3oDAyTVhBpfbPIGCmy3BD7KBanarYPXAKdSUn94UNj2qe6e1ePsGtESk
 Xmj9eHxO2eJXo1CndWB+kElGrdGT0WuRE2kYI9A3PzNPgR504yqyPcTUaJ7A74l6
 iubggAE6SY6QyLVTLUe25x9papjudLELlG+bAFKnjpQ9IxL34X2ExIZEYc9K9jsu
 OrgXdHKFjnhHvlMUNs/b
 =H9KF
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fix-v5.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull IOMMU fix from Joerg Roedel:
 "One important fix for a memory corruption issue in the Intel VT-d
  driver that triggers on hardware with deep PCI hierarchies"

* tag 'iommu-fix-v5.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/dmar: Fix buffer overflow during PCI bus notification
2019-03-01 09:13:04 -08:00
Linus Torvalds
2d28e01dca Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton:
 "2 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  hugetlbfs: fix races and page leaks during migration
  kasan: turn off asan-stack for clang-8 and earlier
2019-03-01 09:04:59 -08:00
Mike Kravetz
cb6acd01e2 hugetlbfs: fix races and page leaks during migration
hugetlb pages should only be migrated if they are 'active'.  The
routines set/clear_page_huge_active() modify the active state of hugetlb
pages.

When a new hugetlb page is allocated at fault time, set_page_huge_active
is called before the page is locked.  Therefore, another thread could
race and migrate the page while it is being added to page table by the
fault code.  This race is somewhat hard to trigger, but can be seen by
strategically adding udelay to simulate worst case scheduling behavior.
Depending on 'how' the code races, various BUG()s could be triggered.

To address this issue, simply delay the set_page_huge_active call until
after the page is successfully added to the page table.

Hugetlb pages can also be leaked at migration time if the pages are
associated with a file in an explicitly mounted hugetlbfs filesystem.
For example, consider a two node system with 4GB worth of huge pages
available.  A program mmaps a 2G file in a hugetlbfs filesystem.  It
then migrates the pages associated with the file from one node to
another.  When the program exits, huge page counts are as follows:

  node0
  1024    free_hugepages
  1024    nr_hugepages

  node1
  0       free_hugepages
  1024    nr_hugepages

  Filesystem                         Size  Used Avail Use% Mounted on
  nodev                              4.0G  2.0G  2.0G  50% /var/opt/hugepool

That is as expected.  2G of huge pages are taken from the free_hugepages
counts, and 2G is the size of the file in the explicitly mounted
filesystem.  If the file is then removed, the counts become:

  node0
  1024    free_hugepages
  1024    nr_hugepages

  node1
  1024    free_hugepages
  1024    nr_hugepages

  Filesystem                         Size  Used Avail Use% Mounted on
  nodev                              4.0G  2.0G  2.0G  50% /var/opt/hugepool

Note that the filesystem still shows 2G of pages used, while there
actually are no huge pages in use.  The only way to 'fix' the filesystem
accounting is to unmount the filesystem

If a hugetlb page is associated with an explicitly mounted filesystem,
this information in contained in the page_private field.  At migration
time, this information is not preserved.  To fix, simply transfer
page_private from old to new page at migration time if necessary.

There is a related race with removing a huge page from a file and
migration.  When a huge page is removed from the pagecache, the
page_mapping() field is cleared, yet page_private remains set until the
page is actually freed by free_huge_page().  A page could be migrated
while in this state.  However, since page_mapping() is not set the
hugetlbfs specific routine to transfer page_private is not called and we
leak the page count in the filesystem.

To fix that, check for this condition before migrating a huge page.  If
the condition is detected, return EBUSY for the page.

Link: http://lkml.kernel.org/r/74510272-7319-7372-9ea6-ec914734c179@oracle.com
Link: http://lkml.kernel.org/r/20190212221400.3512-1-mike.kravetz@oracle.com
Fixes: bcc54222309c ("mm: hugetlb: introduce page_huge_active")
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: <stable@vger.kernel.org>
[mike.kravetz@oracle.com: v2]
  Link: http://lkml.kernel.org/r/7534d322-d782-8ac6-1c8d-a8dc380eb3ab@oracle.com
[mike.kravetz@oracle.com: update comment and changelog]
  Link: http://lkml.kernel.org/r/420bcfd6-158b-38e4-98da-26d0cd85bd01@oracle.com
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-03-01 09:02:33 -08:00
Arnd Bergmann
6baec880d7 kasan: turn off asan-stack for clang-8 and earlier
Building an arm64 allmodconfig kernel with clang results in over 140
warnings about overly large stack frames, the worst ones being:

  drivers/gpu/drm/panel/panel-sitronix-st7789v.c:196:12: error: stack frame size of 20224 bytes in function 'st7789v_prepare'
  drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td028ttec1.c:196:12: error: stack frame size of 13120 bytes in function 'td028ttec1_panel_enable'
  drivers/usb/host/max3421-hcd.c:1395:1: error: stack frame size of 10048 bytes in function 'max3421_spi_thread'
  drivers/net/wan/slic_ds26522.c:209:12: error: stack frame size of 9664 bytes in function 'slic_ds26522_probe'
  drivers/crypto/ccp/ccp-ops.c:2434:5: error: stack frame size of 8832 bytes in function 'ccp_run_cmd'
  drivers/media/dvb-frontends/stv0367.c:1005:12: error: stack frame size of 7840 bytes in function 'stv0367ter_algo'

None of these happen with gcc today, and almost all of these are the
result of a single known issue in llvm.  Hopefully it will eventually
get fixed with the clang-9 release.

In the meantime, the best idea I have is to turn off asan-stack for
clang-8 and earlier, so we can produce a kernel that is safe to run.

I have posted three patches that address the frame overflow warnings
that are not addressed by turning off asan-stack, so in combination with
this change, we get much closer to a clean allmodconfig build, which in
turn is necessary to do meaningful build regression testing.

It is still possible to turn on the CONFIG_ASAN_STACK option on all
versions of clang, and it's always enabled for gcc, but when
CONFIG_COMPILE_TEST is set, the option remains invisible, so
allmodconfig and randconfig builds (which are normally done with a
forced CONFIG_COMPILE_TEST) will still result in a mostly clean build.

Link: http://lkml.kernel.org/r/20190222222950.3997333-1-arnd@arndb.de
Link: https://bugs.llvm.org/show_bug.cgi?id=38809
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Qian Cai <cai@lca.pw>
Reviewed-by: Mark Brown <broonie@kernel.org>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-03-01 09:02:33 -08:00
Linus Torvalds
6357c8127b drm amdgfx, bochs and one core fix
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJceMUnAAoJEAx081l5xIa+n40P/iFOvzFXDdCaEf21XNdtH1Jk
 gjMBeMwxKdrQCsknaQhADtX/IwoSoUyu50jRhkdTQrhCwprkFFnq3LBt11QmYv/k
 Wj94D0yjIQAgnt+/rXi8ZKvH+MDZxmwGR+l9gRfKLywtreNaeLqjn875wkhzy6mB
 DgyfB4Xuyrpgg9K0yDbVdSQrxmHJuEx3VYVF/tvbL8HLFbxjhP2PV3eYhNxGC9Kj
 Ft1ulGZCfT8xQnxc1n/Bb+CHkQX9ZH2sVv8uezkaItEA7okboU71RCkMd5MjZ4AD
 HcmJEEpYv2dJPdGpnjrn2xfHKB/HEnBaGeFAIsfmhat5paYh7DV9gATFwQ8ZcCQ8
 HzX5/nD7rFA8G9gGjjVXYzCgX6egNtY6Oj35/IHfFJnKoqLeJvv7qkpX4OMUdcP8
 dB5TR+S6bD1VCDj6Wi7lFfA9uRBkpLbyDUhDnFS/fKvD0Ecw/BopwRnhTPn+lqtA
 50//WT5QZGQ+aRzzSxlIyfXJAyZBT2lr09r97G5noE0bal5iT8pc0xRiz6EHVrAd
 y9J2yLOpLrPym1av5RB5Nnj7Pohup9WPf29T7T5XbQ8kxuk+sK5EJt8NqD8KIyU6
 3RUG3cWlJGlWmX+V9GiMV/DnrfSZMnif0HUhxCxsDPmI0BHbQ3kn8vWtw9SAbHN2
 nFe8B5Ok057cb3FR8uYC
 =TtJZ
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2019-03-01' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "Three final fixes, one for a feature that is new in this kernel, one
  bochs fix for qemu riscv and one atomic modesetting fix.

  I've left a few of the other late fixes until next as I didn't want to
  throw in anything that wasn't really necessary"

* tag 'drm-fixes-2019-03-01' of git://anongit.freedesktop.org/drm/drm:
  drm/bochs: Fix the ID mismatch error
  drm: Block fb changes for async plane updates
  drm/amd/display: Use vrr friendly pageflip throttling in DC.
2019-03-01 08:44:11 -08:00