Merge pull request #1 from torvalds/master #124

rakesh-gopal · 2014-09-19T12:34:10Z

pulling latest linux code

…_on() The code for resizing the trace ring buffers has to run the per-cpu resize on the CPU itself. The code was using preempt_off() and running the code for the current CPU directly, otherwise calling schedule_work_on(). At least on RT this could result in the following: |BUG: sleeping function called from invalid context at kernel/rtmutex.c:673 |in_atomic(): 1, irqs_disabled(): 0, pid: 607, name: bash |3 locks held by bash/607: |CPU: 0 PID: 607 Comm: bash Not tainted 3.12.15-rt25+ torvalds#124 |(rt_spin_lock+0x28/0x68) |(free_hot_cold_page+0x84/0x3b8) |(free_buffer_page+0x14/0x20) |(rb_update_pages+0x280/0x338) |(ring_buffer_resize+0x32c/0x3dc) |(free_snapshot+0x18/0x38) |(tracing_set_tracer+0x27c/0x2ac) probably via |cd /sys/kernel/debug/tracing/ |echo 1 > events/enable ; sleep 2 |echo 1024 > buffer_size_kb If we just always use schedule_work_on(), there's no need for the preempt_off(). So do that. Link: http://lkml.kernel.org/p/[email protected] Reported-by: Stanislav Meduna <[email protected]> Signed-off-by: Corey Minyard <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>

Cc: Mel Gorman <[email protected]> WARNING: line over 80 characters torvalds#124: FILE: mm/memory.c:1107: + /* oom_reaper cannot tear down dirty pages */ WARNING: line over 80 characters torvalds#125: FILE: mm/memory.c:1108: + if (unlikely(details && details->ignore_dirty)) WARNING: line over 80 characters torvalds#245: FILE: mm/oom_kill.c:483: + wait_event_freezable(oom_reaper_wait, (mm = READ_ONCE(mm_to_reap))); WARNING: Missing a blank line after declarations torvalds#245: FILE: mm/oom_kill.c:483: + struct mm_struct *mm; + wait_event_freezable(oom_reaper_wait, (mm = READ_ONCE(mm_to_reap))); WARNING: line over 80 characters torvalds#301: FILE: mm/oom_kill.c:721: + * We cannot use oom_reaper for the mm shared by this process WARNING: line over 80 characters torvalds#302: FILE: mm/oom_kill.c:722: + * because it wouldn't get killed and so the memory might be total: 0 errors, 6 warnings, 228 lines checked ./patches/mm-oom-introduce-oom-reaper.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Cc: Mel Gorman <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Michal Hocko <[email protected]> Signed-off-by: Andrew Morton <[email protected]>

Stanislav triggered this: |BUG: sleeping function called from invalid context at kernel/rtmutex.c:673 |in_atomic(): 1, irqs_disabled(): 0, pid: 607, name: bash |3 locks held by bash/607: |CPU: 0 PID: 607 Comm: bash Not tainted 3.12.15-rt25+ Freescale#124 |(rt_spin_lock+0x28/0x68) |(free_hot_cold_page+0x84/0x3b8) |(free_buffer_page+0x14/0x20) |(rb_update_pages+0x280/0x338) |(ring_buffer_resize+0x32c/0x3dc) |(free_snapshot+0x18/0x38) |(tracing_set_tracer+0x27c/0x2ac) probably via |cd /sys/kernel/debug/tracing/ |echo 1 > events/enable ; sleep 2 |echo 1024 > buffer_size_kb The purpose of preempt_disable() is likely to prevent to run on another CPU while doing what it is doing. This could also does migrate_disable(). Reported-by: Stanislav Meduna <[email protected]> Signed-off-by: Sebastian Andrzej Siewior <[email protected]>

…_on() commit 021c5b3 upstream. The code for resizing the trace ring buffers has to run the per-cpu resize on the CPU itself. The code was using preempt_off() and running the code for the current CPU directly, otherwise calling schedule_work_on(). At least on RT this could result in the following: |BUG: sleeping function called from invalid context at kernel/rtmutex.c:673 |in_atomic(): 1, irqs_disabled(): 0, pid: 607, name: bash |3 locks held by bash/607: |CPU: 0 PID: 607 Comm: bash Not tainted 3.12.15-rt25+ torvalds#124 |(rt_spin_lock+0x28/0x68) |(free_hot_cold_page+0x84/0x3b8) |(free_buffer_page+0x14/0x20) |(rb_update_pages+0x280/0x338) |(ring_buffer_resize+0x32c/0x3dc) |(free_snapshot+0x18/0x38) |(tracing_set_tracer+0x27c/0x2ac) probably via |cd /sys/kernel/debug/tracing/ |echo 1 > events/enable ; sleep 2 |echo 1024 > buffer_size_kb If we just always use schedule_work_on(), there's no need for the preempt_off(). So do that. Link: http://lkml.kernel.org/p/[email protected] Reported-by: Stanislav Meduna <[email protected]> Signed-off-by: Corey Minyard <[email protected]> Signed-off-by: Steven Rostedt <[email protected]> Signed-off-by: Jiri Slaby <[email protected]>

If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 torvalds#124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]>

If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 torvalds#124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]>

GIT ca80d82c230807c588d14e3f26dee035f3ca1658 commit 6f0b826da4a33e83501d6c1dc977afa0f5f7166f Author: Markus Elfring <[email protected]> Date: Sat Aug 20 07:50:09 2016 +0200 mlx5/core: Use memdup_user() rather than duplicating its implementation * Reuse existing functionality from memdup_user() instead of keeping duplicate source code. This issue was detected by using the Coccinelle software. * Return directly if this copy operation failed. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit b9a24bb76bf611a5268ceffe04219e6ad264559b Author: WANG Cong <[email protected]> Date: Fri Aug 19 12:36:54 2016 -0700 net_sched: properly handle failure case of tcf_exts_init() After commit 22dc13c837c3 ("net_sched: convert tcf_exts from list to pointer array") we do dynamic allocation in tcf_exts_init(), therefore we need to handle the ENOMEM case properly. Cc: Jamal Hadi Salim <[email protected]> Signed-off-by: Cong Wang <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit cae750bae4e488c138eb436175201a60943eb3dc Author: Paul Burton <[email protected]> Date: Fri Aug 19 18:11:19 2016 +0100 irqchip/mips-gic: Use for_each_set_bit to iterate over IRQs The MIPS GIC driver has previously iterated over bits set in a bitmap representing pending IRQs by calling find_first_bit, clearing that bit then calling find_first_bit again until all bits are clear. If multiple interrupts are pending then this is wasteful, as find_first_bit will have to loop over the whole bitmap from the start. Use the for_each_set_bit macro which performs exactly what we need here instead. It will use find_next_bit and thus only scan over the relevant part of the bitmap, and it makes the intent of the code more clear. Signed-off-by: Paul Burton <[email protected]> Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Jason Cooper <[email protected]> commit a10035a9b787a65e2cc9e7d59df6c698ba778c17 Author: Mike Christie <[email protected]> Date: Thu Aug 18 18:38:45 2016 +0200 rbd: add force close option This adds a force close option, so we can force the unmapping of a rbd device that is open. If a path/device is blacklisted, apps like multipathd can map a new device and then unmap the old one. The unmapping cleanup would then be handled by the generic hotunplug code paths in multipahd like is done for iSCSI, FC/FCOE, SAS, etc. Signed-off-by: Mike Christie <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit 21118df66c198d6ebb23e6827e2e92ab1e148e78 Author: Wei Yongjun <[email protected]> Date: Sat Aug 20 15:26:28 2016 +0000 irqchip/jcore-aic: Fix non static symbol warning Fixes the following sparse warning: drivers/irqchip/irq-jcore-aic.c:47:12: warning: symbol 'aic_irq_of_init' was not declared. Should it be static? Signed-off-by: Wei Yongjun <[email protected]> Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Jason Cooper <[email protected]> commit 04208a24b9d2f46f07f4400a4829d5372d0a3661 Author: Thomas Petazzoni <[email protected]> Date: Fri Aug 5 16:55:20 2016 +0200 arm64: marvell: enable the Marvell PIC driver This commit makes sure the driver for the Marvell PIC interrupt controller (used on Marvell Armada 7K/8K) is enabled. Signed-off-by: Thomas Petazzoni <[email protected]> Link: https://lkml.kernel.org/r/1470408921-447-4-git-send-email-thomas.petazzoni@free-electrons.com Signed-off-by: Jason Cooper <[email protected]> commit a109893bd3e71912b376a731b27de8c45fded9b3 Author: Thomas Petazzoni <[email protected]> Date: Fri Aug 5 16:55:19 2016 +0200 irqchip/mvebu-pic: New driver for Marvell Armada 7K/8K PIC The Marvell Armada 7K/8K integrates a secondary interrupt controller very originally named "PIC". It is connected to the main GIC via a PPI. Amongst other things, this PIC is used for the ARM PMU. This commit adds a simple irqchip driver for this interrupt controller. Since this interrupt controller is not needed early at boot time, we make the driver a proper platform driver rather than use the IRQCHIP_DECLARE() mechanism. Signed-off-by: Yehuda Yitschak <[email protected]> Signed-off-by: Thomas Petazzoni <[email protected]> Link: https://lkml.kernel.org/r/1470408921-447-3-git-send-email-thomas.petazzoni@free-electrons.com Signed-off-by: Jason Cooper <[email protected]> commit f69f2593c77e981922234369ec157117e7068776 Author: Mike Christie <[email protected]> Date: Thu Aug 18 18:38:45 2016 +0200 rbd: add 'config_info' sysfs rbd device attribute Export the info used to setup the rbd image, so it can be used to remap the image. Signed-off-by: Mike Christie <[email protected]> [[email protected]: do_rbd_add() EH] Signed-off-by: Ilya Dryomov <[email protected]> commit dd86aa3766a11e5d8dfd43940f63b784fc733695 Author: Mike Christie <[email protected]> Date: Thu Aug 18 18:38:44 2016 +0200 rbd: add 'snap_id' sysfs rbd device attribute Export snap id in sysfs, so tools like multipathd can use it in a uuid. Signed-off-by: Mike Christie <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit 07f22ac266cb1591aac4679d3462706de0ff7a5d Author: Mike Christie <[email protected]> Date: Thu Aug 18 18:38:43 2016 +0200 rbd: add 'cluster_fsid' sysfs rbd device attribute Export the cluster fsid, so tools like udev and multipath-tools can use it for part of the uuid. Signed-off-by: Mike Christie <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit 83a117c50940d5367710a0f00d0d8be693d937f5 Author: Ilya Dryomov <[email protected]> Date: Thu Aug 18 18:38:43 2016 +0200 rbd: add 'client_addr' sysfs rbd device attribute Export client addr/nonce, so userspace can check if a image is being blacklisted. Signed-off-by: Mike Christie <[email protected]> [[email protected]: ceph_client_addr(), endianess fix] Signed-off-by: Ilya Dryomov <[email protected]> commit ca7bfe2c8d9f3aee469a3a36110a95ebb511ee20 Author: Mauro Carvalho Chehab <[email protected]> Date: Mon Aug 22 11:04:49 2016 -0300 docs-rst: add package adjustbox We need adjustbox to allow adjusting the size of tables that are bigger than the line width. There are quite a few of them at the media books. Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit ba1377fba7047a86c31981363cbd9e65b1ca2763 Author: Mauro Carvalho Chehab <[email protected]> Date: Sun Aug 21 15:23:04 2016 -0300 docs-rst: Fix an warning when in interactive mode When XeLaTeX is in interactive mode, it complains that py@noticelength already exists. Rename it and declare it only once to avoid such messages. Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit 41cff161fe99d1c6a773becc2250a1dc3ac035ff Author: Mauro Carvalho Chehab <[email protected]> Date: Sun Aug 21 15:23:03 2016 -0300 docs-rst: Use better colors for note/warning/attention boxes Instead of painting the box with gray, let's use a colored box. IMHO, that makes easier to warn users about some issue pointed by the Sphinx. It also matches to what we do already with the HTML output. Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit bf1bead585e5a8c21d4ac7a8d7fc860b80c4290a Author: Ilya Dryomov <[email protected]> Date: Thu Aug 18 18:38:41 2016 +0200 rbd: print capacity in decimal and features in hex With exclusive-lock added and more to come, print features into dmesg. Change capacity to decimal while at it. Signed-off-by: Ilya Dryomov <[email protected]> commit aa0336393dc095f2a2eaf543ebbf1dfc0bda40cf Author: Ilya Dryomov <[email protected]> Date: Fri Aug 12 16:40:02 2016 +0200 rbd: support for exclusive-lock feature Add basic support for RBD_FEATURE_EXCLUSIVE_LOCK feature. Maintenance operations (resize, snapshot create, etc) are offloaded to librbd via returning -EOPNOTSUPP - librbd should request the lock and execute the operation. Signed-off-by: Ilya Dryomov <[email protected]> commit d7ad7f3c6bc4da00a822bf65f8c677173e7192a2 Author: Ilya Dryomov <[email protected]> Date: Fri Aug 12 16:11:41 2016 +0200 rbd: retry watch re-registration periodically Revamp watch code to support retrying watch re-registration: - add rbd_dev->watch_state for more robust errcb handling - store watch cookie separately to avoid dereferencing watch_handle which is set to NULL on unwatch - move re-register code into a delayed work and retry re-registration every second, unless the client is blacklisted Signed-off-by: Ilya Dryomov <[email protected]> commit 885bfa587709736b9081ef2cf2a08c007b798ea5 Author: Ilya Dryomov <[email protected]> Date: Fri Aug 12 15:45:52 2016 +0200 rbd: introduce a per-device ordered workqueue This is going to be used for reregistering watch requests and exclusive-lock tasks: acquire/request lock, notify-acquired, release lock, notify-released. Some refactoring in the map/unmap paths was necessary to give this workqueue a meaningful name: "rbdX-tasks". Signed-off-by: Ilya Dryomov <[email protected]> commit a926f18ef50a526726d1f9e9249bb455246389e0 Author: Ilya Dryomov <[email protected]> Date: Fri Aug 12 14:59:58 2016 +0200 libceph: rename ceph_client_id() -> ceph_client_gid() Signed-off-by: Ilya Dryomov <[email protected]> commit 243b6381a3ddafef0f598c825da094fb2aca9c1b Author: Douglas Fuller <[email protected]> Date: Wed Jul 22 20:59:52 2015 -0400 libceph: support for blacklisting clients Reuse ceph_mon_generic_request infrastructure for sending monitor commands. In particular, add support for 'blacklist add' to prevent other, non-responsive clients from making further updates. Signed-off-by: Douglas Fuller <[email protected]> [[email protected]: refactor, misc fixes throughout] Signed-off-by: Ilya Dryomov <[email protected]> commit c33c690cc42e7e11a694ad2b7721ed37c883c1a3 Author: Douglas Fuller <[email protected]> Date: Mon Jun 29 16:55:42 2015 -0700 libceph: support for lock.lock_info Add an interface for the Ceph OSD lock.lock_info method and associated data structures. Based heavily on code by Mike Christie <[email protected]>. Signed-off-by: Douglas Fuller <[email protected]> [[email protected]: refactor, misc fixes throughout] Signed-off-by: Ilya Dryomov <[email protected]> commit b3872a9b832154b6051ecfcd81ff315ee1447c36 Author: Douglas Fuller <[email protected]> Date: Thu Jun 18 13:06:10 2015 -0700 libceph: support for advisory locking on RADOS objects This patch adds support for rados lock, unlock and break lock. Based heavily on code by Mike Christie <[email protected]>. Signed-off-by: Douglas Fuller <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit 66b78cbaa9d7f7d6c1e4dee8495db436bcd9cc51 Author: Douglas Fuller <[email protected]> Date: Wed Jun 17 14:49:45 2015 -0400 libceph: add ceph_osdc_call() single-page helper Add a convenience function to osd_client to send Ceph OSD 'class' ops. The interface assumes that the request and reply data each consist of single pages. Signed-off-by: Douglas Fuller <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit ba5eddca49df02a746026725c94965d2e0300cbf Author: Douglas Fuller <[email protected]> Date: Fri Jul 17 13:18:07 2015 -0700 libceph: support for CEPH_OSD_OP_LIST_WATCHERS Add support for this Ceph OSD op, needed to support the RBD exclusive lock feature. Signed-off-by: Douglas Fuller <[email protected]> [[email protected]: refactor, misc fixes throughout] Signed-off-by: Ilya Dryomov <[email protected]> commit a653fc0abf0f9641c611d9e993c865e75e5de997 Author: Ilya Dryomov <[email protected]> Date: Thu Jun 2 16:45:08 2016 +0200 libceph: rename ceph_entity_name_encode() -> ceph_auth_entity_name_encode() Clear up EntityName vs entity_name_t confusion. Signed-off-by: Ilya Dryomov <[email protected]> commit aa4e37a3d13679dccf7945dd864375b698cf0df9 Author: Mauro Carvalho Chehab <[email protected]> Date: Fri Aug 19 09:49:38 2016 -0300 docs-rst: conf.py: adjust the size of .. note:: tag While the current implementation works well when using as a paragraph, it doesn't work properly if inside a table. As we have quite a few such cases, fix the logic to take the column size into account. PS.: I took the logic there from the latest version of Sphinx.sty Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit d565127d120e9b95ba98549c31eab9cec1cbbbc7 Author: Mauro Carvalho Chehab <[email protected]> Date: Thu Aug 18 11:53:39 2016 -0300 docs-rst: add support for LaTeX output Sphinx supports LaTeX output. Sometimes, it is interesting to call it directly, instead of also generating a PDF. As it comes for free, add a target for it. Signed-off-by: Mauro Carvalho Chehab <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit 9cd3476c91708b4b814f17671597a2708ec195ed Author: Markus Heiser <[email protected]> Date: Mon Aug 15 16:08:28 2016 +0200 doc-rst: migrate ioctl CEC_DQEVENT to c-domain This is only one example, demonstrating the benefits of the patch series. The CEC_DQEVENT ioctl is migrated to the sphinx c-domain and referred by ":name: CEC_DQEVENT". With this change the indirection using ":ref:`CEC_DQEVENT` is no longer needed, we can refer the ioctl directly with ":c:func:`CEC_DQEVENT`". As addition in the index, there is a entry "CEC_DQEVENT (C function)". Signed-off-by: Markus Heiser <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit aa10a7826646c56eb4553df8fe81b3d23655c91a Author: Markus Heiser <[email protected]> Date: Mon Aug 15 16:08:27 2016 +0200 doc-rst: Revert "kernel-doc: fix handling of address_space tags" This reverts commit a88b1672d4ddf9895eb53e6980926d5e960dea8e. From the origin comit log:: The RST cpp:function handler is very pedantic: it doesn't allow any macros like __user on it Since the kernel-doc parser does NOT make use of the cpp:domain, there is no need to change the kernel-doc parser eleminating the address_space tags. Signed-off-by: Markus Heiser <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit 556aa6d5d9616ccfc0099c40dc239157f50ee776 Author: Markus Heiser <[email protected]> Date: Mon Aug 15 16:08:26 2016 +0200 doc-rst: moved *duplicate* warnings to nitpicky mode Moved the *duplicate C object description* warnings for function declarations in the nitpicky mode. In nitpick mode, you can suppress those warnings (e.g. ioctl) with:: nitpicky = True nitpick_ignore = [ ("c:func", "ioctl"), ] See Sphinx documentation for the config values for ``nitpick`` and ``nitpick_ignore`` [1]. With this change all the ".. cpp:function:: int ioctl(..)" descriptions (found in the media book) can be migrated to ".. c:function:: int ioctl(..)", without getting any warnings. E.g.:: .. cpp:function:: int ioctl( int fd, int request, struct cec_event *argp ) .. c:function:: int ioctl( int fd, int request, struct cec_event *argp ) The main effect, is that we get those *CPP-types* back into Sphinx's C- namespace and we need no longer to distinguish between c/cpp references, when we refer a function like the ioctl. [1] http://www.sphinx-doc.org/en/stable/config.html?highlight=nitpick#confval-nitpicky Signed-off-by: Markus Heiser <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit 2c645cd7c4a0d4b35da1e43ec3a5b55a64038157 Author: Markus Heiser <[email protected]> Date: Mon Aug 15 16:08:25 2016 +0200 doc-rst:c-domain: ref-name of a function declaration Add option 'name' to the "c:function:" directive. With option 'name' the ref-name of a function can be modified. E.g.:: .. c:function:: int ioctl( int fd, int request ) :name: VIDIOC_LOG_STATUS The func-name (e.g. ioctl) remains in the output but the ref-name changed from ``ioctl`` to ``VIDIOC_LOG_STATUS``. The index entry for this function is also changed to ``VIDIOC_LOG_STATUS`` and the function can now referenced by:: :c:func:`VIDIOC_LOG_STATUS` Signed-off-by: Markus Heiser <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> commit e8f5c617f26626ef4915ffa176f4ae02c9e08531 Author: Markus Heiser <[email protected]> Date: Mon Aug 22 15:16:21 2016 -0600 doc-rst: add boilerplate to customize c-domain Add a sphinx-extension to customize the sphinx c-domain. No functional changes right yet, just the boilerplate code. Signed-off-by: Markus Heiser <[email protected]> [ jc: coding-style tweak ] Signed-off-by: Jonathan Corbet <[email protected]> commit 99ff4d3af80caa91eef5a4b709def6b8b362ce8c Author: Dmitry Torokhov <[email protected]> Date: Fri Aug 19 10:03:59 2016 -0700 Input: jornada720_kbd - switch to using dev_dbg Switch to using dev_dbg instead of naked printk so that output is uniform with the other driver messages in the kernel. Signed-off-by: Dmitry Torokhov <[email protected]> commit 0f631d87d9a5e3f5f22908b102c8eaad944f390e Author: Russell King <[email protected]> Date: Fri Aug 19 09:41:47 2016 -0700 Input: jornada720_kbd - get rid of mach/irqs.h include Switch the jornada720 keyboard driver to obtain its interrupt from the platform device, rather than via a hard-coded interrupt number obtained from the mach/irqs.h header. Signed-off-by: Russell King <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit a8a7bdc598ec0c355491bc1cac75f8f6b8a1740d Author: Russell King <[email protected]> Date: Fri Aug 19 09:40:58 2016 -0700 Input: jornada720_kbd - switch to devm_* APIs Switch the jornada720_kbd driver to use the devm_* APIs. This is in preparation to removing the mach/irqs.h include from this driver. Signed-off-by: Russell King <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 3f5c5920e627b602db4e13b9010f76ed1d078c54 Author: Krzysztof Kozlowski <[email protected]> Date: Fri Aug 19 10:15:46 2016 -0700 Input: max77693-haptic - change Krzysztof Kozlowski's email to kernel.org Change my email address to kernel.org instead of Samsung one for the purpose of any future contact. The copyrights remain untouched and are attributed to Samsung. Signed-off-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit e9bf4529d3db9e6291ebfe41be08e6bb76bdf49d Author: LABBE Corentin <[email protected]> Date: Fri Aug 19 10:18:32 2016 -0700 Input: pixcir_i2c_ts - remove a useless blank line This patch fix the following checkpatch report: Blank lines aren't necessary after an open brace Signed-off-by: LABBE Corentin <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 5ac82f081ac08c5ca551aa6cfc5d81ff26efdf4e Author: LABBE Corentin <[email protected]> Date: Fri Aug 19 10:17:18 2016 -0700 Input: pixcir_i2c_ts - remove text about writing to Free Software Foundation Checkpatch complains about the text suggesting writing to Free Software Foundation for GPLv2 license copy. This patch remove that text. Signed-off-by: LABBE Corentin <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 8ffef3cc696e9eff67ec79be349407895bffdfc1 Author: LABBE Corentin <[email protected]> Date: Fri Aug 19 10:16:51 2016 -0700 Input: pixcir_i2c_ts - simplify code with of_device_get_match_data The usage of of_device_get_match_data reduce the code size a bit. Furthermore, it is better to use a standard function for getting the match data. Signed-off-by: LABBE Corentin <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit d18716542d137beafef2859bdf90d4e0c9a25523 Author: Hans de Goede <[email protected]> Date: Thu Aug 4 08:21:19 2016 -0700 Input: remove duplicate ft6236 driver The new(ish) ft6236 simply re-implements the M09 protocol of the (much) older edt-ft5x06.c driver. This commit removes this duplicate driver and adds the i2c ids and dt compatible string to the edt-ft5x06.c driver to keep compatibility. This commit also adds the standard touchscreen properties as optional properties to the edt,ft5x06 binding, these were documented in the focaltech,ft6236 bindingi, but were missing from the edt,ft5x06 doc. Signed-off-by: Hans de Goede <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit e3a888a4bff0bef0b256d55c58bc32c99fb44ece Author: Petr Cvek <[email protected]> Date: Fri Aug 19 10:14:29 2016 -0700 Input: ads7846 - remove redundant regulator_disable call ADS7846 regulator is disabled twice in a row in ads7846_remove(). Valid one is in ads7846_disable(). Removing the ads7846 module causes warning about unbalanced disables. ... WARNING: CPU: 0 PID: 29269 at drivers/regulator/core.c:2251 _regulator_disable+0xf8/0x130 unbalanced disables for vads7846 CPU: 0 PID: 29269 Comm: rmmod Tainted: G D W 4.7.0+ #3 Hardware name: HTC Magician ... show_stack+0x10/0x14 __warn+0xd8/0x100 warn_slowpath_fmt+0x38/0x48 _regulator_disable+0xf8/0x130 regulator_disable+0x34/0x60 ads7846_remove+0x58/0xd4 [ads7846] spi_drv_remove+0x1c/0x34 __device_release_driver+0x84/0x114 driver_detach+0x8c/0x90 bus_remove_driver+0x5c/0xc8 SyS_delete_module+0x1a0/0x238 ret_fast_syscall+0x0/0x38 Signed-off-by: Petr Cvek <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 3e29d6bb6433ebfa4e187b1164b80baf720d58c3 Author: Andrew Duggan <[email protected]> Date: Mon Aug 22 11:28:11 2016 -0700 Input: synaptics-rmi4 - fix register descriptor subpacket map construction The map_offset variable is specific to the register and needs to be reset in the loop. Otherwise, subsequent register's subpacket maps will have their bits set at the wrong index. Signed-off-by: Andrew Duggan <[email protected]> Tested-by: Nitin Chaudhary <[email protected]> Reviewed-by: Benjamin Tissoires <[email protected]> Cc: [email protected] Signed-off-by: Dmitry Torokhov <[email protected]> commit fae16989be77b09bab86c79233e4b511ea769cea Author: Masahiro Yamada <[email protected]> Date: Mon Aug 22 13:25:56 2016 -0700 Input: tegra-kbc - fix inverted reset logic Commit fe6b0dfaba68 ("Input: tegra-kbc - use reset framework") accidentally converted _deassert to _assert, so there is no code to wake up this hardware. Fixes: fe6b0dfaba68 ("Input: tegra-kbc - use reset framework") Signed-off-by: Masahiro Yamada <[email protected]> Acked-by: Thierry Reding <[email protected]> Acked-by: Laxman Dewangan <[email protected]> Cc: [email protected] Signed-off-by: Dmitry Torokhov <[email protected]> commit 5cab4d84780573afbf5077ae9c3f919b4f305f20 Author: Hans de Goede <[email protected]> Date: Mon Aug 22 13:49:59 2016 -0700 Input: silead - use devm_gpiod_get The silead code is using devm_foo for everything (and does not free any resources). Except that it is using gpiod_get instead of devm_gpiod_get (but is not freeing the gpio_desc), change this to use devm_gpiod_get so that the gpio will be properly released. Signed-off-by: Hans de Goede <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 7ac5d7b1a1254ceb4be19ba93ef7a6ee4e7ac382 Author: Mikko Rapeli <[email protected]> Date: Mon Aug 22 20:32:22 2016 +0200 HSI: hsi_char.h: use __u32 from linux/types.h Fixes userspace compiler errors like: linux/hsi/hsi_char.h:51:2: error: unknown type name ‘uint32_t’ Signed-off-by: Mikko Rapeli <[email protected]> Signed-off-by: Sebastian Reichel <[email protected]> commit 67c52cac0c2427af61590c1dbb993457574be00f Author: Mathieu Poirier <[email protected]> Date: Tue Jul 5 14:22:15 2016 -0600 coresight: etm4x: adding configurable start/stop filtering With this patch we add start/stop filtering as specified on the perf cmd line. When the IP matches the start address trace generation gets triggered. The stop condition is achieved when the IP matches the stop address. Signed-off-by: Mathieu Poirier <[email protected]> commit 236a79f45fde4997eaadeb11742222fa11ab8c69 Author: Mathieu Poirier <[email protected]> Date: Mon Jul 4 11:42:08 2016 -0600 coresight: etm4x: adding configurable address range filtering This patch adds the capability to specify address ranges from the perf cmd line using the --filter option. If the IP falls within the range(s) program flow traces are generated. Signed-off-by: Mathieu Poirier <[email protected]> commit 6dc9ed33e57d13ea01e429c09b25a8a4fbd440fb Author: Mathieu Poirier <[email protected]> Date: Wed Jun 29 13:08:47 2016 -0600 coresight: etm4x: configuring include/exclude function The include/exclude function of a tracer is applicable to address range and start/stop filters. To avoid duplication and reuse code moving the include/exclude configuration to a function of its own. Signed-off-by: Mathieu Poirier <[email protected]> commit 9c183490e9443995fb089c96f1574191f59b681e Author: Mathieu Poirier <[email protected]> Date: Wed Jun 29 11:01:58 2016 -0600 coresight: etm4x: adding range filter configuration function Introducing a new function to do address range configuration generic enough to work for any address range and any comparator. Signed-off-by: Mathieu Poirier <[email protected]> commit 523a338d065deed8578a6660a08e79ae0709bd7f Author: Mathieu Poirier <[email protected]> Date: Tue Jun 28 15:33:21 2016 -0600 coresight: etm4x: cleaning up default filter configuration The default filter configuration was hard to read and included some redundancy. This patch attempts to stream line configuration and improve readability. No change of functionality is included. Signed-off-by: Mathieu Poirier <[email protected]> commit bf36f73716e587da061017ed94fdbb4d50746068 Author: Mathieu Poirier <[email protected]> Date: Tue Jun 28 11:26:33 2016 -0600 coresight: etm4x: split default and filter configuration Splitting the steps involved in the configuration of a tracer. The first part is generic and can be reused for both sysFS and Perf methods. The second part pertains to the configuration of filters themselves where the source of the information used to configure the filters will vary depending on the access methods. Signed-off-by: Mathieu Poirier <[email protected]> commit 333d82a4ec6438da5abeaf15007942269d2c4b4a Author: Mathieu Poirier <[email protected]> Date: Tue Jun 28 14:13:32 2016 -0600 coresight: etm-perf: configuring filters from perf core This patch implements the required API needed to access and retrieve range and start/stop filters from the perf core. Signed-off-by: Mathieu Poirier <[email protected]> commit 100b0715792ea234a1e49d512f85d01f2f450ac4 Author: Mathieu Poirier <[email protected]> Date: Thu Jun 30 13:04:46 2016 -0600 coresight: remove duplicated enumeration Both ETMv3 and ETMv4 drivers are declaring an 'enum etm_addr_type', creating reduncancy. This patch removes the enumeration from the driver files and adds it to a common header. Signed-off-by: Mathieu Poirier <[email protected]> commit 5a4982d170de64c554bba1c745ed5b50475bb4e4 Author: Mathieu Poirier <[email protected]> Date: Fri Jun 24 15:36:08 2016 -0600 coresight: etm-perf: pass struct perf_event to source::enable/disable() With this commit [1] address range filter information is now found in the struct hw_perf_event::addr_filters. As such pass the event itself to the coresight_source::enable/disable() functions so that both event attribute and filter can be accessible for configuration. [1] 'commit 375637bc5249 ("perf/core: Introduce address range filtering")' Signed-off-by: Mathieu Poirier <[email protected]> commit a403cf91f1ea18de671fba7f56edc6cdf5e93d52 Author: Fengguang Wu <[email protected]> Date: Tue Jul 12 07:45:57 2016 -0700 rcu: Disable RCU_PERF_TEST and RCU_TORTURE_TEST for usermode Linux Usermode Linux currently does not implement arch_irqs_disabled_flags(), which results in a build failure in TASKS_RCU. Commit 570dd3c74241 ("rcu: Disable TASKS_RCU for usermode Linux") attempted to fix this by making TASKS_RCU depend on !UML, which does work in production builds. However, test builds that enable either RCU_PERF_TEST or RCU_TORTURE_TEST will select TASKS_RCU, defeating the dependency on !UML. This commit therefore makes both RCU_PERF_TEST and RCU_TORTURE_TEST also depend on !UML. The usermode Linux maintainers expect to merge arch_irqs_disabled_flags() into 4.8, at which point this commit may be reverted. Signed-off-by: Fengguang Wu <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> commit e0d70f18b5d8ace575815c1cc617d8a1512244ea Author: Paul E. McKenney <[email protected]> Date: Tue Jun 28 19:52:01 2016 -0700 rcu: First stage expedited documentation Signed-off-by: Paul E. McKenney <[email protected]> commit becbca8482697b6e9fa850023698df3259babf1b Author: Paul E. McKenney <[email protected]> Date: Fri Apr 29 14:57:41 2016 -0700 torture: Affinity waiter tasks away from hotpluggable CPU Signed-off-by: Paul E. McKenney <[email protected]> commit b7683340e469dc2e0e37a10d57c9c533213e6864 Author: Paul E. McKenney <[email protected]> Date: Fri Apr 29 14:33:30 2016 -0700 torture: Make waketorture kill test if no hotpluggable CPUs This commit shuts down the kernel if a shutdown time was specified and if there were no hotpluggable CPUs. Signed-off-by: Paul E. McKenney <[email protected]> commit e07b0edd917a714bc8b74e494ec9f5ff665bae01 Author: Paul E. McKenney <[email protected]> Date: Fri Apr 22 06:10:34 2016 -0700 torture: Make waketorture always hotplug the same CPU This commit causes waketorture to always hotplug the same CPU, namely, the highest-numbered CPU that can be hotplugged. This will be used by later commits to force race conditions with higher probability. Signed-off-by: Paul E. McKenney <[email protected]> commit 497bd987bed2ea3373292ce54b53a3a55b231633 Author: Paul E. McKenney <[email protected]> Date: Thu Mar 24 16:01:57 2016 -0700 waketorture: Add hrtimer support Signed-off-by: Paul E. McKenney <[email protected]> commit 8692b0bbb9ad6c7da5b8aa498569bdbd89901950 Author: Paul E. McKenney <[email protected]> Date: Thu Mar 24 12:19:52 2016 -0700 waketorture: Add utilization measurement Signed-off-by: Paul E. McKenney <[email protected]> commit 77259c23ae05d90d3bbc43d2cc6236ace279ce72 Author: Paul E. McKenney <[email protected]> Date: Wed Mar 23 10:43:23 2016 -0700 waketorture: Don't kick unless grace period or request The current code can result in spurious kicks when there are no grace periods in progress and no grace-period-related requests. This is sort of OK for a diagnostic aid, but the resulting ftrace-dump messages in dmesg are annoying. This commit therefore avoids spurious kicks in the common case. Signed-off-by: Paul E. McKenney <[email protected]> commit c20aae2f71b80a3a2528800d9dfd43c67b961d4a Author: Paul E. McKenney <[email protected]> Date: Tue Mar 22 15:59:51 2016 -0700 waketorture: Update scripting to accommodate waketorture This commit adds the scripting changes to add support for the shiny new waketorture kernel module. Signed-off-by: Paul E. McKenney <[email protected]> commit 25b5bb1583ab6f553e32d3cf9e37aeb5bc3be525 Author: Paul E. McKenney <[email protected]> Date: Tue Mar 22 15:17:07 2016 -0700 waketorture: Add a wakeup-torture module This commit adds a wakeup-torture module to assist tracking down an elusive lost-wakeup problem. Signed-off-by: Paul E. McKenney <[email protected]> commit ff84772684d11e0a040cac23485adc7831287fdd Author: Sudeep Holla <[email protected]> Date: Thu Aug 4 17:22:26 2016 +0100 coresight: fix handling of ETM trace register access via sysfs The ETM registers are classified into 2 categories: trace and management. The core power domain contains most of the trace unit logic including all(except TRCOSLAR and TRCOSLSR) the trace registers. The debug power domain contains the external debugger interface including all management registers. This patch adds coresight unit specific function coresight_simple_func which can be used for ETM trace registers by providing a ETM specific read function which does smp cross call to ensure the trace core is powered up before the register is accessed. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 78e9ac29184d1e94ca014fb12afb7f3149d6c4af Author: Sudeep Holla <[email protected]> Date: Wed Aug 3 17:12:31 2016 +0100 coresight: etm4x: request to retain power to the trace unit when active The Coresight ETMv4 architecture provides a way to request to keep the power to the trace unit. This might help to collect the traces without the need to disable the CPU power management(entering/exiting deeper idle states). Trace PowerDown Control Register provides powerup request bit which when set requests the system to retain power to the trace unit and emulate the powerdown request. Typically, a trace unit drives a signal to the power controller to request that the trace unit core power domain is powered up. However, if the trace unit and the CPU are in the same power domain then the implementation might combine the trace unit power up status with a signal from the CPU. This patch requests to retain power to the trace unit when active and to remove when inactive. Note this change will only request but the behaviour depends on the implementation. However, it matches the exact behaviour expected when the external debugger is connected with respect to CPU power states. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 9bf184979ecbb9b520b22df70e54aeedf89f341e Author: Markus Elfring <[email protected]> Date: Sat Jul 23 20:04:09 2016 +0200 coresight: tmc: Delete an unnecessary check before the function call "kfree" The kfree() function tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit badefb02b9f4cc725f0a460d63cc39ab9006b418 Author: Wei Yongjun <[email protected]> Date: Tue Jul 19 11:27:21 2016 +0000 coresight: etm4x: remove duplicated include from coresight-etm4x.c Remove duplicated include. Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 66686a0384db093a707c864bf211e2ea246f8267 Author: Suzuki K Poulose <[email protected]> Date: Wed Jul 13 17:40:25 2016 +0100 coresight: Use local coresight_desc instances Each coresight device prepares a description for coresight_register() in struct coresight_desc. Once we register the device, the description is useless and can be freed. The coresight_desc is small enough (48bytes on 64bit)i to be allocated on the stack. Hence use an automatic variable to avoid a needless dynamic allocation and wasting the memory(which will only be free'd when the device is destroyed). Cc: Mathieu Poirier <[email protected]> Cc: Pratik Patel <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit b5218e8113f0456ac864c431d500fb164f1a27d9 Author: Peter Chen <[email protected]> Date: Tue Jul 5 10:11:04 2016 +0800 hwtracing: coresight: of_coresight: add missing of_node_put after calling of_parse_phandle of_node_put needs to be called when the device node which is got from of_parse_phandle has finished using. Cc: [email protected] Cc: Mathieu Poirier <[email protected]> Signed-off-by: Peter Chen <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 470048b468a679f124a82887400ac5b756233a19 Author: Olivier Schonken <[email protected]> Date: Tue Jul 5 10:05:49 2016 +0200 coresight-etm3x: Add ARM ETM 3.5 Cortex-A5 peripheral ID Signed-off-by: Olivier Schonken <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 6b95d87c63466a75a1e60e776ef8966ef018485f Author: Mathieu Poirier <[email protected]> Date: Thu Jun 16 13:04:12 2016 -0600 coresight: add PM runtime calls to coresight_simple_func() It is mandatory to enable a coresight block's power domain before trying to access management registers. Otherwise the transaction simply stalls, leading to a system hang. Signed-off-by: Mathieu Poirier <[email protected]> Reviewed-by: Sudeep Holla <[email protected]> commit fc612c88c768a5451233e9aad50ad07f2a11d44d Author: Mathieu Poirier <[email protected]> Date: Sun Jun 19 11:19:43 2016 -0600 coresight: delay initialisation when children are missing Depending on when CoreSight device are discovered it is possible that some IP block may be referencing devices that have not been added to the bus yet. The end result is missing nodes in the CoreSight topology even when the devices are present and properly initialised. This patch solves the problem by asking the driver core to try initialising the device at a later time when the children of a CoreSight node are missing. Signed-off-by: Mathieu Poirier <[email protected]> commit a7e592ee55691d7433299cea988fd371a71bbf57 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:54 2016 +0100 coresight: Add better messages for coresight_timeout When we encounter a timeout waiting for a status change via coresight_timeout, the caller always print the offset which was tried. This is pretty much useless as it doesn't specify the bit position we wait for. Also, one needs to lookup the TRM to figure out, what was wrong. This patch changes all such error messages to print something more meaningful. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit d8cd9e64d2fd11d03ac02e5408266464ad8bdf23 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:53 2016 +0100 coresight: Cleanup TMC status check Use the defined symbol rather than hardcoding the value to check whether the TMC buffer is full. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit f76c97d43e059485517c66bd2dfb3cedf9c32fa4 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:52 2016 +0100 coresight: etmv4: Fix ETMv4x peripheral ID table This patch cleans up the peripheral id table for different ETMv4 implementations. As per Cortex-A53 TRM, the ETM has following id values: Peripheral ID0 0x5D 0xFE0 Peripheral ID1 0xB9 0xFE4 Peripheral ID2 0x4B 0xFE8 Peripheral ID3 0x00 0xFEC where, PID2: has the following format: [7:4] Revision [3] JEDEC 0b1 res1. Indicates a JEP106 identity code is used [2:0] DES_1 0b011 ARM Limited. This is bits[6:4] of JEP106 ID code The existing table entry checks only the bits [1:0], which is not sufficient enough. Fix it to match bits [3:0], just like the other entries do. While at it, correct the comment for A57 and the A53 entry. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 05d3b4b44aa41e0d03320d9fb098486a3a300e1c Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:51 2016 +0100 coresight: tmc: Limit the trace to available data At present the ETF or ETR gives out the entire device buffer, even if there is less or even no trace data available. This patch limits the trace data given out to the actual trace data collected. Cc: [email protected] Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 02b5b7d1e764d72931f48b4c5159a14182bd1cb8 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:50 2016 +0100 coresight: Fix csdev connections initialisation This is a cleanup patch. coresight_device->conns holds an array to point to the devices connected to the OUT ports of a component. Sinks, e.g ETR, do not have an OUT port (nr_outport = 0), as it streams the trace to memory via AXI. At coresight_register() we do : conns = kcalloc(csdev->nr_outport, sizeof(*conns), GFP_KERNEL); if (!conns) { ret = -ENOMEM; goto err_kzalloc_conns; } For ETR, since the total size requested for kcalloc is zero, the return value is, ZERO_SIZE_PTR ( != NULL). Hence, csdev->conns = ZERO_SIZE_PTR which cannot be verified later to contain a valid pointer. The code which accesses the csdev->conns is bounded by the csdev->nr_outport check, hence we don't try to dereference the ZERO_SIZE_PTR. This patch cleans up the csdev->conns initialisation to make sure we initialise it properly(i.e, either NULL or valid conns array). Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 8ef9abe100a16badee4c1513fa5d09f78ebb3e78 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:49 2016 +0100 coresight: Consolidate error handling path for tmc_probe This patch cleans up the error handling path for tmc_probe as a side effect of the removal of the spurious dma_free_coherent(). Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 29b7b2d2752c78c6070041c1856700d17af3f4d3 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:48 2016 +0100 coresight: Remove erroneous dma_free_coherent in tmc_probe commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed") removed the static allocation of buffer for the trace data in ETR mode in tmc_probe. However it failed to remove the "devm_free_coherent" in tmc_probe when the probe fails due to other reasons. This patch gets rid of the incorrect dma_free_coherent() call. Fixes: commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed") Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit d44ec31c1965264b243606ea98d517eb3c03b363 Author: Sudeep Holla <[email protected]> Date: Mon Jun 20 15:25:41 2016 +0100 coresight: always use stashed trace id value in etm4_trace_id etm4_trace_id is not guaranteed to be executed on the CPU whose ETM is being accessed. This leads to exception similar to below one if the CPU whose ETM is being accessed is in deeper idle states. So it must be executed on the CPU whose ETM is being accessed. Unhandled fault: synchronous external abort (0x96000210) at 0xffff000008db4040 Internal error: : 96000210 [#1] PREEMPT SMP Modules linked in: CPU: 5 PID: 5979 Comm: etm.sh Not tainted 4.7.0-rc3 #159 Hardware name: ARM Juno development board (r2) (DT) task: ffff80096dd34b00 ti: ffff80096dfe4000 task.ti: ffff80096dfe4000 PC is at etm4_trace_id+0x5c/0x90 LR is at etm4_trace_id+0x3c/0x90 Call trace: etm4_trace_id+0x5c/0x90 coresight_id_match+0x78/0xa8 bus_for_each_dev+0x60/0xa0 coresight_enable+0xc0/0x1b8 enable_source_store+0x3c/0x70 dev_attr_store+0x18/0x28 sysfs_kf_write+0x48/0x58 kernfs_fop_write+0x14c/0x1e0 __vfs_write+0x1c/0x100 vfs_write+0xa0/0x1b8 SyS_write+0x44/0xa0 el0_svc_naked+0x24/0x28 However, TRCTRACEIDR is not guaranteed to hold the previous programmed trace id if it enters deeper idle states. Further, the trace id that is computed in etm4_init_trace_id is programmed into TRCTRACEIDR only in etm4_enable_hw which happens much later in the sequence after coresight_id_match is executed from enable_source_store. This patch simplifies etm4_trace_id by returning the stashed trace id value similar to etm4_cpu_id. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit aee3a6dd6566e119fa4ac5dabf382542cff5005b Author: Chunyan Zhang <[email protected]> Date: Tue Jun 21 10:24:36 2016 +0800 coresight-stm: support mmapping channel regions with mmio_addr CoreSight STM device allows direct mapping of the channel regions to userspace for zero-copy writing. To support this ability, the STM framework has provided a hook 'mmio_addr', this patch just implemented this hook for CoreSight STM. This patch also added an item into 'channel_space' to save the physical base address of channel region which mmap operation needs to know. Signed-off-by: Chunyan Zhang <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 46cbc9300504b0c9ee8d11085517625b56cee0be Author: Sudeep Holla <[email protected]> Date: Thu Jun 16 11:13:09 2016 +0100 coresight: access conn->child_name only if it's initialised If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 489bb3d252d41392ce52590e49f0ae8782fb016e Author: SeongJae Park <[email protected]> Date: Sun Aug 21 16:54:40 2016 +0900 torture: TOROUT_STRING(): Insert a space between flag and message The TOROUT_STRING() macro does not insert a space between the flag and the message. In contrast, other similar torture-test dmesg messages consistently supply a single space character. This difference makes the output hard to read and to mechanically parse. This commit therefore adds a space character between flag and message in TOROUT_STRING() output. Signed-off-by: SeongJae Park <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> commit a56fefa2605cf8e125ef09451487f30336128028 Author: SeongJae Park <[email protected]> Date: Sun Aug 21 16:54:39 2016 +0900 rcuperf: Consistently insert space between flag and message A few rcuperf dmesg output messages have no space between the flag and the start of the message. In contrast, every other messages consistently supplies a single space. This difference makes rcuperf dmesg output hard to read and to mechanically parse. This commit therefore fixes this problem by modifying a pr_alert() call and PERFOUT_STRING() macro function to provide that single space. Signed-off-by: SeongJae Park <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> commit 472213a675e21185416101a77102253f93713fa9 Author: SeongJae Park <[email protected]> Date: Sat Aug 13 15:54:35 2016 +0900 rcutorture: Print out barrier error as document says Tests for rcu_barrier() were introduced by commit fae4b54f28f0 ("rcu: Introduce rcutorture testing for rcu_barrier()"). This commit updated the documentation to say that the "rtbe" field in rcutorture's dmesg output indicates test failure. However, the code was not updated, only the documentation. This commit therefore updates the code to match the updated documentation. Signed-off-by: SeongJae Park <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> commit 4ffa66992476c94d8b4d33b2c792d336a400ada2 Author: Paul E. McKenney <[email protected]> Date: Thu Jun 30 11:56:38 2016 -0700 torture: Add task state to writer-task stall printk()s This commit adds a dump of the scheduler state for stalled rcutorture writer tasks. This addition provides yet more debug for the intermittent "failures to proceed", where grace periods move ahead but the rcutorture writer tasks fail to do so. Signed-off-by: Paul E. McKenney <[email protected]> commit 31257c3c8b7307f106d67345755d937cb5fb8bd4 Author: Paul E. McKenney <[email protected]> Date: Sat Jun 18 07:45:43 2016 -0700 torture: Convert torture_shutdown() to hrtimer Upcoming changes to the timer wheel introduce significant inaccuracy and possibly also an ultimate limit on timeout duration. This is a problem for the current implementation of torture_shutdown() because (1) shutdown times are user-specified, and can therefore be quite long, and (2) the torture scripting will kill a test instance that runs for more than a few minutes longer than scheduled. This commit therefore converts the torture_shutdown() timed waits to an hrtimer, thus avoiding too-short torture test runs as well as death by scripting. Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Arnd Bergmann <[email protected]> commit f6ac28c367ce61011e346af57ee20f0f23f5d729 Author: Valentin Rothberg <[email protected]> Date: Sat Aug 20 12:16:10 2016 +0200 lib/Kconfig.debug: Fix typo in select statement Commit 484f29c7430b3 ("bug: Provide toggle for BUG on data corruption") added a Kconfig select statement on CONFIG_DEBUG_LIST, but the CONFIG_ prefix is only used in Make and C(PP) syntax. Remove the CONFIG_ prefix to correctly select the Kconfig option DEBUG_LIST. Signed-off-by: Valentin Rothberg <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Kees Cook <[email protected]> commit acc5ebe5c29d007951e3c1d611569b97c71ffd8d Author: Kees Cook <[email protected]> Date: Wed Aug 17 14:42:12 2016 -0700 lkdtm: Add tests for struct list corruption When building under CONFIG_DEBUG_LIST, list addition and removal will be sanity-checked. This validates that the check is working as expected by setting up classic corruption attacks against list manipulations, available with the new lkdtm tests CORRUPT_LIST_ADD and CORRUPT_LIST_DEL. Signed-off-by: Kees Cook <[email protected]> Acked-by: Steven Rostedt <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Rik van Riel <[email protected]> commit 40cd725cfc7fec2635a79814398d4d93d5558ac2 Author: Kees Cook <[email protected]> Date: Wed Aug 17 14:42:11 2016 -0700 bug: Provide toggle for BUG on data corruption The kernel checks for cases of data structure corruption under some CONFIGs (e.g. CONFIG_DEBUG_LIST). When corruption is detected, some systems may want to BUG() immediately instead of letting the system run with known corruption. Usually these kinds of manipulation primitives can be used by security flaws to gain arbitrary memory write control. This provides a new config CONFIG_BUG_ON_DATA_CORRUPTION and a corresponding macro CHECK_DATA_CORRUPTION for handling these situations. Notably, even if not BUGing, the kernel should not continue processing the corrupted structure. This is inspired by similar hardening by Syed Rameez Mustafa in MSM kernels, and in PaX and Grsecurity, which is likely in response to earlier removal of the BUG calls in commit 924d9addb9b1 ("list debugging: use WARN() instead of BUG()"). Signed-off-by: Kees Cook <[email protected]> Acked-by: Steven Rostedt <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Rik van Riel <[email protected]> commit 36c956ec858eb4e0bf1730e152f20122c2e8f93d Author: Kees Cook <[email protected]> Date: Wed Aug 17 14:42:10 2016 -0700 list: Split list_del() debug checking into separate function Similar to the list_add() debug consolidation, this commit consolidates the debug checking performed during CONFIG_DEBUG_LIST into a new __list_del_entry_valid() function, and stops list updates when corruption is found. Refactored from same hardening in PaX and Grsecurity. Signed-off-by: Kees Cook <[email protected]> Acked-by: Steven Rostedt <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Rik van Riel <[email protected]> commit e5bb62b63ae07e930719b02105103ff1dc3e12d0 Author: Kees Cook <[email protected]> Date: Wed Aug 17 14:42:09 2016 -0700 rculist: Consolidate DEBUG_LIST for list_add_rcu() This commit consolidates the debug checking for list_add_rcu() into the new single __list_add_valid() debug function. Notably, this commit fixes the sanity check that was added in commit 17a801f4bfeb ("list_debug: WARN for adding something already in the list"), which wasn't checking RCU-protected lists. Signed-off-by: Kees Cook <[email protected]> Acked-by: Steven Rostedt <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Rik van Riel <[email protected]> commit c69780bdd841801501cef7efbcce95e1ae6826f9 Author: Kees Cook <[email protected]> Date: Wed Aug 17 14:42:08 2016 -0700 list: Split list_add() debug checking into separate function Right now, __list_add() code is repeated either in list.h or in list_debug.c, but the only differences between the two versions are the debug checks. This commit therefore extracts these debug checks into a separate __list_add_valid() function and consolidates __list_add(). Additionally this new __list_add_valid() function will stop list manipulations if a corruption is detected, instead of allowing for further corruption that may lead to even worse conditions. This is slight refactoring of the same hardening done in PaX and Grsecurity. Signed-off-by: Kees Cook <[email protected]> Acked-by: Steven Rostedt <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> Acked-by: Rik van Riel <[email protected]> commit 0ffd374b2207a1a0cba9f2dbcc799198482391d5 Author: Sebastian Andrzej Siewior <[email protected]> Date: Thu Aug 18 14:57:22 2016 +0200 rcutorture: Convert to hotplug state machine Install the callbacks via the state machine and let the core invoke the callbacks on the already online CPUs. Cc: Josh Triplett <[email protected]> Cc: "Paul E. McKenney" <[email protected]> Cc: Steven Rostedt <[email protected]> Cc: Mathieu Desnoyers <[email protected]> Cc: Lai Jiangshan <[email protected]> Signed-off-by: Sebastian Andrzej Siewior <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> commit 0c6d4576c45736f829dc3390ac95181b2ed21bc7 Author: Sebastian Andrzej Siewior <[email protected]> Date: Wed Aug 17 14:21:04 2016 +0200 cpu/hotplug: Get rid of CPU_STARTING reference CPU_STARTING is scheduled for removal. There is no use of it in drivers and core code uses it only for compatibility with old-style CPU-hotplug notifiers. This patch removes therefore removes CPU_STARTING from an RCU-related comment. Signed-off-by: Sebastian Andrzej Siewior <[email protected]> Signed-off-by: Paul E. McKenney <[email protected]> commit 6999aeabbb703a81a204cb6f9f8f151759a99ac4 Author: Wei Yongjun <[email protected]> Date: Sat Aug 20 15:25:32 2016 +0000 spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function The call sequence spi_alloc_master/spi_register_master/spi_unregister_master is complete; it reduces the device reference count to zero, which and results in device memory being freed. The subsequent call to spi_master_put is unnecessary and results in an access to free memory. Drop it. Fixes: 9298bc727385 ("spi: spi-fsl-dspi: Remove spi-bitbang") Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Mark Brown <[email protected]> commit 7ec99de36f402618ae44147ac7fa9a07e4757a5f Author: Paul E. McKenney <[email protected]> Date: Thu Jun 30 13:58:26 2016 -0700 rcu: Provide exact CPU-online tracking for RCU Up to now, RCU has assumed that the CPU-online process makes it from CPU_UP_PREPARE to set_cpu_online() within one jiffy. Given the recent rise of virtualized environments, this assumption is very clearly obsolete. Failing to meet this deadline can result in RCU paying attention to an incoming CPU for one jiffy, then ignoring it until the grace period following the one in which that CPU sets itself online. This situation might prove to be fatally disappointing to any RCU read-side critical sections that had the misfortune to execute during the time in which RCU was ignoring the slow-to-come-online CPU. This commit therefore updates RCU's internal CPU state-tracking information at notify_cpu_starting() time, thus providing RCU with an exact transition of the CPU's state from offline to online. Note that this means that incoming CPUs must not use RCU read-side critical section (other than those of SRCU) until notify_cpu_starting() time. Note also that the CPU_STARTING notifiers -are- allowed to use RCU read-side critical sections. (Of course, CPU-hotplug notifiers are rapidly becoming obsolete, so you need to act fast!) If a given architecture or CPU family needs to use RCU read-side critical sections earlier, the call to rcu_cpu_starting() from notify_cpu_starting() will need to be architecture-specific, with architectures that need early use being required to hand-place the call to rcu_cpu_starting() at some point preceding the call to notify_cpu_starting(). Signed-off-by: Paul E. McKenney <[email protected]> commit 3563a438f124cb0b8cfd350c86de2f26c63d8837 Author: Paul E. McKenney <[email protected]> Date: Thu Jul 28 09:39:11 2016 -0700 rcu: Avoid redundant quiescent-state chasing Currently, __note_gp_changes() checks to see if the CPU has slept through multiple grace periods. If it has, it resynchronizes that CPU's view of the grace-period state, which includes whether or not the current grace period needs a quiescent state from this CPU. The fact of this need (or lack thereof) needs to be in two places, rdp->cpu_no_qs.b.norm and rdp->core_needs_qs. The former tells RCU's context-switch code to go get a quiescent state and the latter says that it needs to be reported. The current code unconditionally sets the former to true, but correctly sets the latter. This does not result in failures, but it does unnecessarily increase the amount of work done on average at context-switch time. This commit therefore correctly sets both fields. Signed-off-by: Paul E. McKenney <[email protected]> commit e77b7041258e11ba198951553d3acf1e371a9053 Author: Paul Gortmaker <[email protected]> Date: Fri Jul 15 12:19:41 2016 -0400 rcu: Don't use modular infrastructure in non-modular code The Kconfig currently controlling compilation of tree.c is: init/Kconfig:config TREE_RCU init/Kconfig: bool ...and update.c and sync.c are "obj-y" meanin…

If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 torvalds#124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>

If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 torvalds#124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]>

GIT 91aea5e0544dafdc6f0b4bab44b4902c2a56febf commit 265d426d7470d53e900379960eef5b4482125089 Author: Benjamin Tissoires <[email protected]> Date: Fri Sep 30 16:42:19 2016 -0700 Input: elan_i2c - fix return tests of i2c_smbus_read_block_data() i2c_smbus_read_block_data() returns negative errno else the number of data bytes in the slave's response. Checking for error not null means the function always fails if the device answers properly. So given that we read 3 bytes and access those, better check that we actually read those 3 bytes. Signed-off-by: Benjamin Tissoires <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 979987ded3a5ae1fb60ef751bdf185c502d70590 Author: Arnd Bergmann <[email protected]> Date: Fri Sep 30 15:36:54 2016 -0700 Input: ektf2127 - mark PM functions as __maybe_unused The newly added ektf2127 driver uses the SIMPLE_DEV_PM_OPS macro to conditionally refer to the resume/suspend functions, which causes a warning when CONFIG_PM_SLEEP is disabled: drivers/input/touchscreen/ektf2127.c:168:12: error: 'ektf2127_resume' defined but not used [-Werror=unused-function] drivers/input/touchscreen/ektf2127.c:156:12: error: 'ektf2127_suspend' defined but not used [-Werror=unused-function] We could either put these functions inside of an #ifdef or add __maybe_unused annotations. This uses the second approach, which is generally more foolproof. Fixes: 9ca5bf5029b6 ("Input: add support for Elan eKTF2127 touchscreen controller") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]> commit 348b9b1192144e13b779f8f9be301d492bebaff2 Author: Chris Wilson <[email protected]> Date: Mon Oct 3 13:45:16 2016 +0100 drm/i915: Use correct index for backtracking HUNG semaphores When decoding the semaphores inside hangcheck, we need to use the hw-id and not the local array index. Fixes: de1add360522 ("drm/i915: Decouple execbuf uAPI ...") Testcase: igt/gem_exec_whisper/hang # gen6-7 Signed-off-by: Chris Wilson <[email protected]> Cc: Mika Kuoppala <[email protected]> Cc: Tvrtko Ursulin <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: [email protected] Reviewed-by: Joonas Lahtinen <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit 5f12b80a0b42da253691ca03828033014bb786eb Author: Chris Wilson <[email protected]> Date: Mon Oct 3 13:45:15 2016 +0100 drm/i915: Unalias obj->phys_handle and obj->userptr We use obj->phys_handle to choose the pread/pwrite path, but as obj->phys_handle is a union with obj->userptr, we then mistakenly use the phys_handle path for userptr objects within pread/pwrite. Testcase: igt/gem_userptr_blits/forbidden-operations Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97519 Signed-off-by: Chris Wilson <[email protected]> Cc: [email protected] Reviewed-by: Joonas Lahtinen <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit dda960335e020835f7f1c12760e7f0b525b451e2 Author: Chris Wilson <[email protected]> Date: Mon Oct 3 13:45:14 2016 +0100 drm/i915: Just clear the mmiodebug before a register access When we enable the per-register access mmiodebug, it is to detect which access is illegal. Reporting on earlier untraced access outside of the mmiodebug does not help debugging (as the suspicion is immediately put upon the current register which is not at fault)! References: https://bugs.freedesktop.org/show_bug.cgi?id=97985 Signed-off-by: Chris Wilson <[email protected]> Cc: Mika Kuoppala <[email protected]> Reviewed-by: Mika Kuoppala <[email protected]> Cc: [email protected] Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit bb086a89a406b5d877ee616f1490fcc81f8e1b2b Author: Shaohua Li <[email protected]> Date: Fri Sep 30 09:45:40 2016 -0700 md: set rotational bit if all disks in an array are non-rotational, set the array non-rotational. This only works for array with all disks populated at startup. Support for disk hotadd/hotremove could be added later if necessary. Acked-by: Tejun Heo <[email protected]> Signed-off-by: Shaohua Li <[email protected]> commit f5b88de284932def6850e976c18d25940c1b2c3d Author: Brian Norris <[email protected]> Date: Mon Oct 3 09:49:35 2016 -0700 mtd: nand: fix trivial spelling error Introduced by commit fde85cfd2d07 ("mtd: nand: Fix nand_command_lp() for 8bits opcodes") and I didn't have the heart to have Boris rewrite his pull request just for that. Anyway, there's some value in having stable commit hashes. Signed-off-by: Brian Norris <[email protected]> commit 45808987495ff50a772d1cc66401f5f304948bd9 Author: Chunyan Zhang <[email protected]> Date: Fri Sep 9 18:18:09 2016 +0800 coresight: stm: return error code instead of zero in .packet() In STM framework driver, the trace data writing loop would keep running until it received a negative return value or the whole trace packet has been written to STM device. So if the .packet() of STM device always returns zero since the device is not enabled or the parameter isn't supported, STM framework driver will stall into a dead loop. Returning -EACCES (Permission denied) in .packet() if the device is disabled makes more sense, and this is the same for returning -EINVAL if the channel passed into is not supported. Signed-off-by: Chunyan Zhang <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit f8fb90de9d4fb2deb504ba6df22c28cb5dc08480 Author: Baoyou Xie <[email protected]> Date: Tue Sep 6 16:03:50 2016 +0800 coresight: tmc: mark symbols static where possible We get a few warnings when building kernel with W=1: drivers/hwtracing/coresight/coresight-tmc-etr.c:23:6: warning: no previous prototype for 'tmc_etr_enable_hw' [-Wmissing-prototypes] drivers/hwtracing/coresight/coresight-tmc-etf.c:25:6: warning: no previous prototype for 'tmc_etb_enable_hw' [-Wmissing-prototypes] drivers/hwtracing/coresight/coresight-tmc.c:250:9: warning: no previous prototype for ‘trigger_cntr_show’ [-Wmissing-prototypes] ... In fact, these functions are only used in the file in which they are declared and don't need a declaration, but can be made static. so this patch marks these functions with 'static'. Signed-off-by: Baoyou Xie <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit ce6e23ba05532a2bb5d572a7e3ac8cc07202c3e5 Author: Mathieu Poirier <[email protected]> Date: Wed Aug 24 14:07:56 2016 -0600 coresight: perf: deal with error condition properly Function coresight_build_path() should return -ENOMEM when kzalloc fails to allocated the requested memory. That way callers can deal with the error condition in a similar way. Signed-off-by: Mathieu Poirier <[email protected]> commit 76637d2d0d2e78b428b052c1852a4c73fdea5c2d Author: Mathieu Poirier <[email protected]> Date: Tue Jul 5 14:22:15 2016 -0600 coresight: etm4x: adding configurable start/stop filtering With this patch we add start/stop filtering as specified on the perf cmd line. When the IP matches the start address trace generation gets triggered. The stop condition is achieved when the IP matches the stop address. Signed-off-by: Mathieu Poirier <[email protected]> commit 2bbb2af3480f2277c0f8ada20eb8b54c733bb0a0 Author: Mathieu Poirier <[email protected]> Date: Mon Jul 4 11:42:08 2016 -0600 coresight: etm4x: adding configurable address range filtering This patch adds the capability to specify address ranges from the perf cmd line using the --filter option. If the IP falls within the range(s) program flow traces are generated. Signed-off-by: Mathieu Poirier <[email protected]> commit 57cdb630ec2477f3b02312e6b9917bad66d7139b Author: Mathieu Poirier <[email protected]> Date: Wed Jun 29 13:08:47 2016 -0600 coresight: etm4x: configuring include/exclude function The include/exclude function of a tracer is applicable to address range and start/stop filters. To avoid duplication and reuse code moving the include/exclude configuration to a function of its own. Signed-off-by: Mathieu Poirier <[email protected]> commit f4639a00374e30179f94935d8f173fa316617d60 Author: Mathieu Poirier <[email protected]> Date: Wed Jun 29 11:01:58 2016 -0600 coresight: etm4x: adding range filter configuration function Introducing a new function to do address range configuration generic enough to work for any address range and any comparator. Signed-off-by: Mathieu Poirier <[email protected]> commit c0efed1b44e5bfb9127be3ecba4b3b12bca34ce6 Author: Mathieu Poirier <[email protected]> Date: Tue Jun 28 15:33:21 2016 -0600 coresight: etm4x: cleaning up default filter configuration The default filter configuration was hard to read and included some redundancy. This patch attempts to stream line configuration and improve readability. No change of functionality is included. Signed-off-by: Mathieu Poirier <[email protected]> commit 43e8f63182a234efeedcfea50ffbb8cb97e1e278 Author: Mathieu Poirier <[email protected]> Date: Tue Jun 28 11:26:33 2016 -0600 coresight: etm4x: split default and filter configuration Splitting the steps involved in the configuration of a tracer. The first part is generic and can be reused for both sysFS and Perf methods. The second part pertains to the configuration of filters themselves where the source of the information used to configure the filters will vary depending on the access methods. Signed-off-by: Mathieu Poirier <[email protected]> commit f4360705982d755eded63faa0b6aebb65af492dc Author: Mathieu Poirier <[email protected]> Date: Tue Jun 28 14:13:32 2016 -0600 coresight: etm-perf: configuring filters from perf core This patch implements the required API needed to access and retrieve range and start/stop filters from the perf core. Signed-off-by: Mathieu Poirier <[email protected]> commit 6a6b5d0f5e9d3e66fcc9cae7f5eed97fcc93c18b Author: Mathieu Poirier <[email protected]> Date: Thu Jun 30 13:04:46 2016 -0600 coresight: remove duplicated enumeration Both ETMv3 and ETMv4 drivers are declaring an 'enum etm_addr_type', creating reduncancy. This patch removes the enumeration from the driver files and adds it to a common header. Signed-off-by: Mathieu Poirier <[email protected]> commit 3325f97d774751508f5fec48effd6608f28c9f64 Author: Mathieu Poirier <[email protected]> Date: Fri Jun 24 15:36:08 2016 -0600 coresight: etm-perf: pass struct perf_event to source::enable/disable() With this commit [1] address range filter information is now found in the struct hw_perf_event::addr_filters. As such pass the event itself to the coresight_source::enable/disable() functions so that both event attribute and filter can be accessible for configuration. [1] 'commit 375637bc5249 ("perf/core: Introduce address range filtering")' Signed-off-by: Mathieu Poirier <[email protected]> commit 7cc481aac207625659878475bca11b3eeff3e39a Author: Sudeep Holla <[email protected]> Date: Thu Aug 4 17:22:26 2016 +0100 coresight: fix handling of ETM trace register access via sysfs The ETM registers are classified into 2 categories: trace and management. The core power domain contains most of the trace unit logic including all(except TRCOSLAR and TRCOSLSR) the trace registers. The debug power domain contains the external debugger interface including all management registers. This patch adds coresight unit specific function coresight_simple_func which can be used for ETM trace registers by providing a ETM specific read function which does smp cross call to ensure the trace core is powered up before the register is accessed. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit a9164547054cbbec110ff15a4a2dd4d87173ca70 Author: Sudeep Holla <[email protected]> Date: Wed Aug 3 17:12:31 2016 +0100 coresight: etm4x: request to retain power to the trace unit when active The Coresight ETMv4 architecture provides a way to request to keep the power to the trace unit. This might help to collect the traces without the need to disable the CPU power management(entering/exiting deeper idle states). Trace PowerDown Control Register provides powerup request bit which when set requests the system to retain power to the trace unit and emulate the powerdown request. Typically, a trace unit drives a signal to the power controller to request that the trace unit core power domain is powered up. However, if the trace unit and the CPU are in the same power domain then the implementation might combine the trace unit power up status with a signal from the CPU. This patch requests to retain power to the trace unit when active and to remove when inactive. Note this change will only request but the behaviour depends on the implementation. However, it matches the exact behaviour expected when the external debugger is connected with respect to CPU power states. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 5f73805256603b24adbbc9b22ac04a1834e346ca Author: Markus Elfring <[email protected]> Date: Sat Jul 23 20:04:09 2016 +0200 coresight: tmc: Delete an unnecessary check before the function call "kfree" The kfree() function tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit eb549fcd1761d6f7279f032d2e0f8df36f0de36a Author: Wei Yongjun <[email protected]> Date: Tue Jul 19 11:27:21 2016 +0000 coresight: etm4x: remove duplicated include from coresight-etm4x.c Remove duplicated include. Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit de38be189881d3d61b4bd19a8157a972f4a5a161 Author: Suzuki K Poulose <[email protected]> Date: Wed Jul 13 17:40:25 2016 +0100 coresight: Use local coresight_desc instances Each coresight device prepares a description for coresight_register() in struct coresight_desc. Once we register the device, the description is useless and can be freed. The coresight_desc is small enough (48bytes on 64bit)i to be allocated on the stack. Hence use an automatic variable to avoid a needless dynamic allocation and wasting the memory(which will only be free'd when the device is destroyed). Cc: Mathieu Poirier <[email protected]> Cc: Pratik Patel <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 884b736b114446bf4505470fa21d7899c89b7355 Author: Peter Chen <[email protected]> Date: Tue Jul 5 10:11:04 2016 +0800 hwtracing: coresight: of_coresight: add missing of_node_put after calling of_parse_phandle of_node_put needs to be called when the device node which is got from of_parse_phandle has finished using. Cc: [email protected] Cc: Mathieu Poirier <[email protected]> Signed-off-by: Peter Chen <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 718e1d9d2ece1932596a8f1cc1e8dd08d8963ace Author: Olivier Schonken <[email protected]> Date: Tue Jul 5 10:05:49 2016 +0200 coresight-etm3x: Add ARM ETM 3.5 Cortex-A5 peripheral ID Signed-off-by: Olivier Schonken <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit f2d67408493021dd7081b76336a64ee339c556d5 Author: Mathieu Poirier <[email protected]> Date: Thu Jun 16 13:04:12 2016 -0600 coresight: add PM runtime calls to coresight_simple_func() It is mandatory to enable a coresight block's power domain before trying to access management registers. Otherwise the transaction simply stalls, leading to a system hang. Signed-off-by: Mathieu Poirier <[email protected]> Reviewed-by: Sudeep Holla <[email protected]> commit 90f50e031a28a5b3551701a69d78bb75d07c5ecb Author: Mathieu Poirier <[email protected]> Date: Sun Jun 19 11:19:43 2016 -0600 coresight: delay initialisation when children are missing Depending on when CoreSight device are discovered it is possible that some IP block may be referencing devices that have not been added to the bus yet. The end result is missing nodes in the CoreSight topology even when the devices are present and properly initialised. This patch solves the problem by asking the driver core to try initialising the device at a later time when the children of a CoreSight node are missing. Signed-off-by: Mathieu Poirier <[email protected]> commit dfb8cd5ab64754d56154e4654044ab86479ad02e Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:54 2016 +0100 coresight: Add better messages for coresight_timeout When we encounter a timeout waiting for a status change via coresight_timeout, the caller always print the offset which was tried. This is pretty much useless as it doesn't specify the bit position we wait for. Also, one needs to lookup the TRM to figure out, what was wrong. This patch changes all such error messages to print something more meaningful. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 90977c5d9158ac4d583a311229617c3ad43707fe Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:53 2016 +0100 coresight: Cleanup TMC status check Use the defined symbol rather than hardcoding the value to check whether the TMC buffer is full. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit c7ec0b1c3b51595d0c268b85a9dd8895945462e7 Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:52 2016 +0100 coresight: etmv4: Fix ETMv4x peripheral ID table This patch cleans up the peripheral id table for different ETMv4 implementations. As per Cortex-A53 TRM, the ETM has following id values: Peripheral ID0 0x5D 0xFE0 Peripheral ID1 0xB9 0xFE4 Peripheral ID2 0x4B 0xFE8 Peripheral ID3 0x00 0xFEC where, PID2: has the following format: [7:4] Revision [3] JEDEC 0b1 res1. Indicates a JEP106 identity code is used [2:0] DES_1 0b011 ARM Limited. This is bits[6:4] of JEP106 ID code The existing table entry checks only the bits [1:0], which is not sufficient enough. Fix it to match bits [3:0], just like the other entries do. While at it, correct the comment for A57 and the A53 entry. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 58a47a8de41a0ee3bbf06c42669f1b9066cd6e4f Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:51 2016 +0100 coresight: tmc: Limit the trace to available data At present the ETF or ETR gives out the entire device buffer, even if there is less or even no trace data available. This patch limits the trace data given out to the actual trace data collected. Cc: [email protected] Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 462f767c2834e2802d7589f88891f29cf38d3cbf Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:50 2016 +0100 coresight: Fix csdev connections initialisation This is a cleanup patch. coresight_device->conns holds an array to point to the devices connected to the OUT ports of a component. Sinks, e.g ETR, do not have an OUT port (nr_outport = 0), as it streams the trace to memory via AXI. At coresight_register() we do : conns = kcalloc(csdev->nr_outport, sizeof(*conns), GFP_KERNEL); if (!conns) { ret = -ENOMEM; goto err_kzalloc_conns; } For ETR, since the total size requested for kcalloc is zero, the return value is, ZERO_SIZE_PTR ( != NULL). Hence, csdev->conns = ZERO_SIZE_PTR which cannot be verified later to contain a valid pointer. The code which accesses the csdev->conns is bounded by the csdev->nr_outport check, hence we don't try to dereference the ZERO_SIZE_PTR. This patch cleans up the csdev->conns initialisation to make sure we initialise it properly(i.e, either NULL or valid conns array). Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 018fd130e0b9720d83cdbc205f51de5e34c8ae7f Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:49 2016 +0100 coresight: Consolidate error handling path for tmc_probe This patch cleans up the error handling path for tmc_probe as a side effect of the removal of the spurious dma_free_coherent(). Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 8db55674062e6e54f89e009cc623e5a2752a2f4f Author: Suzuki K Poulose <[email protected]> Date: Tue Jun 21 17:10:48 2016 +0100 coresight: Remove erroneous dma_free_coherent in tmc_probe commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed") removed the static allocation of buffer for the trace data in ETR mode in tmc_probe. However it failed to remove the "devm_free_coherent" in tmc_probe when the probe fails due to other reasons. This patch gets rid of the incorrect dma_free_coherent() call. Fixes: commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed") Cc: Mathieu Poirier <[email protected]> Signed-off-by: Suzuki K Poulose <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 5e60f02512fcb1be1627ba904d2ddf88a45b78ec Author: Sudeep Holla <[email protected]> Date: Mon Jun 20 15:25:41 2016 +0100 coresight: always use stashed trace id value in etm4_trace_id etm4_trace_id is not guaranteed to be executed on the CPU whose ETM is being accessed. This leads to exception similar to below one if the CPU whose ETM is being accessed is in deeper idle states. So it must be executed on the CPU whose ETM is being accessed. Unhandled fault: synchronous external abort (0x96000210) at 0xffff000008db4040 Internal error: : 96000210 [#1] PREEMPT SMP Modules linked in: CPU: 5 PID: 5979 Comm: etm.sh Not tainted 4.7.0-rc3 #159 Hardware name: ARM Juno development board (r2) (DT) task: ffff80096dd34b00 ti: ffff80096dfe4000 task.ti: ffff80096dfe4000 PC is at etm4_trace_id+0x5c/0x90 LR is at etm4_trace_id+0x3c/0x90 Call trace: etm4_trace_id+0x5c/0x90 coresight_id_match+0x78/0xa8 bus_for_each_dev+0x60/0xa0 coresight_enable+0xc0/0x1b8 enable_source_store+0x3c/0x70 dev_attr_store+0x18/0x28 sysfs_kf_write+0x48/0x58 kernfs_fop_write+0x14c/0x1e0 __vfs_write+0x1c/0x100 vfs_write+0xa0/0x1b8 SyS_write+0x44/0xa0 el0_svc_naked+0x24/0x28 However, TRCTRACEIDR is not guaranteed to hold the previous programmed trace id if it enters deeper idle states. Further, the trace id that is computed in etm4_init_trace_id is programmed into TRCTRACEIDR only in etm4_enable_hw which happens much later in the sequence after coresight_id_match is executed from enable_source_store. This patch simplifies etm4_trace_id by returning the stashed trace id value similar to etm4_cpu_id. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit a419ec2cf36a13a6414a63f7c606f202f656fdc0 Author: Chunyan Zhang <[email protected]> Date: Tue Jun 21 10:24:36 2016 +0800 coresight-stm: support mmapping channel regions with mmio_addr CoreSight STM device allows direct mapping of the channel regions to userspace for zero-copy writing. To support this ability, the STM framework has provided a hook 'mmio_addr', this patch just implemented this hook for CoreSight STM. This patch also added an item into 'channel_space' to save the physical base address of channel region which mmap operation needs to know. Signed-off-by: Chunyan Zhang <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 635a375873c4e158cd30e829884a48fbe36076f3 Author: Sudeep Holla <[email protected]> Date: Thu Jun 16 11:13:09 2016 +0100 coresight: access conn->child_name only if it's initialised If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <[email protected]> Signed-off-by: Sudeep Holla <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> commit 61347fa6087884305ea4a3a04501839fdb68dc76 Author: Parav Pandit <[email protected]> Date: Tue Sep 13 19:40:50 2016 +0530 IB/rdmavt: Trivial function comment corrected. Corrected function name in comment from qib_ to rvt_. Signed-off-by: Parav Pandit <[email protected]> Signed-off-by: Doug Ledford <[email protected]> commit 94c630ee73a4a1db18561511dfefc2e41d2e6d1e Author: Shuah Khan <[email protected]> Date: Mon Sep 26 11:50:24 2016 -0600 Doc: update 00-INDEX files to reflect the runnable code move Update 00-INDEX files with the current file list to reflect the runnable code move. Acked-by: Michal Marek <[email protected]> Acked-by: Jonathan Corbet <[email protected]> Signed-off-by: Shuah Khan <[email protected]> commit c6d2995da5409e3d0ef30c53287d3c17e450e96e Author: Shuah Khan <[email protected]> Date: Fri Sep 23 15:14:56 2016 -0600 samples: move blackfin gptimers-example from Documentation Move blackfin gptimers-example to samples and remove it from Documentation Makefile. Update samples Kconfig and Makefile to build gptimers-example. blackfin is the last CONFIG_BUILD_DOCSRC target in Documentation/Makefile, hence this patch also includes changes to remove CONFIG_BUILD_DOCSRC from Makefile and lib/Kconfig.debug. Acked-by: Michal Marek <[email protected]> Acked-by: Jonathan Corbet <[email protected]> Signed-off-by: Shuah Khan <[email protected]> commit 464691bd52b46a565153ec2a3b8b9984dacd4a00 Author: Ilya Dryomov <[email protected]> Date: Fri Sep 23 09:57:57 2016 +0200 libceph: ceph_build_auth() doesn't need ceph_auth_build_hello() A static bug finder (EBA) on Linux 4.7: Double lock in net/ceph/auth.c second lock at 108: mutex_lock(& ac->mutex); [ceph_auth_build_hello] after calling from 263: ret = ceph_auth_build_hello(ac, msg_buf, msg_len); if ! ac->protocol -> true at 262 first lock at 261: mutex_lock(& ac->mutex); [ceph_build_auth] ceph_auth_build_hello() is never called, because the protocol is always initialized, whether we are checking existing tickets (in delayed_work()) or getting new ones after invalidation (in invalidate_authorizer()). Reported-by: Iago Abal <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit fdc723e77bcf17ec2646fdef031e7f135968a9b7 Author: Ilya Dryomov <[email protected]> Date: Fri Sep 23 09:57:56 2016 +0200 libceph: use CEPH_AUTH_UNKNOWN in ceph_auth_build_hello() Signed-off-by: Ilya Dryomov <[email protected]> commit 92c1037ce8e3a70b616c8b91c990caf16a0096d1 Author: Andreas Gerstmayr <[email protected]> Date: Thu Sep 15 21:23:01 2016 +0200 ceph: fix description for rsize and rasize mount options Signed-off-by: Andreas Gerstmayr <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit 88a25a5fa09dff62b5fc1e82fb9c0c6b23971887 Author: Markus Elfring <[email protected]> Date: Sun Sep 11 12:21:25 2016 +0200 rbd: use kmalloc_array() in rbd_header_from_disk() * A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. * Delete the local variable "size" which became unnecessary with this refactoring. Signed-off-by: Markus Elfring <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit 8cdcc07dde27d29bc25b3588238d4b1cc9a56fe9 Author: Wei Yongjun <[email protected]> Date: Sat Aug 13 09:10:28 2016 +0000 ceph: use list_move instead of list_del/list_add Using list_move() instead of list_del() + list_add(). Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> commit fcff415c9421b417ef91d48f546f3c4566ddc358 Author: Yan, Zheng <[email protected]> Date: Wed Sep 14 16:39:51 2016 +0800 ceph: handle CEPH_SESSION_REJECT message Signed-off-by: Yan, Zheng <[email protected]> commit ce2728aaa82bbebae7d20345324af3f0f49eeb20 Author: Yan, Zheng <[email protected]> Date: Wed Sep 14 14:53:05 2016 +0800 ceph: avoid accessing / when mounting a subpath Accessing / causes failuire if the client has caps that restrict path Signed-off-by: Yan, Zheng <[email protected]> commit db4a63aab43b2040292b2023512864702b5f9799 Author: Yan, Zheng <[email protected]> Date: Tue Sep 13 10:15:36 2016 +0800 ceph: fix mandatory flock check Signed-off-by: Yan, Zheng <[email protected]> commit e55f1a1871b148802b42ee3807edcb6528ffc27d Author: NeilBrown <[email protected]> Date: Wed Aug 31 12:59:29 2016 +1000 ceph: remove warning when ceph_releasepage() is called on dirty page If O_DIRECT writes are racing with buffered writes, then the call to invalidate_inode_pages2_range() can call ceph_releasepage() on dirty pages. Most filesystems hold inode_lock() across O_DIRECT writes so they do not suffer this race, but cephfs deliberately drops the lock, and opens a window for the race. This race can be triggered with the generic/036 test from the xfstests test suite. It doesn't happen every time, but it does happen often. As the possibilty is expected, remove the warning, and instead include the PageDirty() status in the debug message. Signed-off-by: NeilBrown <[email protected]> Reviewed-by: Jeff Layton <[email protected]> Reviewed-by: Yan, Zheng <[email protected]> commit 5d7eb1a3225309b294275385ece36fee256d5c46 Author: NeilBrown <[email protected]> Date: Thu Sep 1 22:26:23 2016 +0800 ceph: ignore error from invalidate_inode_pages2_range() in direct write This call can fail if there are dirty pages. The preceding call to filemap_write_and_wait_range() will normally remove dirty pages, but as inode_lock() is not held over calls to ceph_direct_read_write(), it could race with non-direct writes and pages could be dirtied immediately after filemap_write_and_wait_range() returns If there are dirty pages, they will be removed by the subsequent call to truncate_inode_pages_range(), so having them here is not a problem. If the 'ret' value is left holding an error, then in the async IO case (aio_req is not NULL) the loop that would normally call ceph_osdc_start_request() will see the error in 'ret' and abort all requests. This doesn't seem like correct behaviour. So use separate 'ret2' instead of overloading 'ret'. Signed-off-by: NeilBrown <[email protected]> Reviewed-by: Jeff Layton <[email protected]> Reviewed-by: Yan, Zheng <[email protected]> commit 1afe478569ba7414dde8a874dda9c1ea621c0c63 Author: Yan, Zheng <[email protected]> Date: Wed Aug 24 11:33:46 2016 +0800 ceph: fix error handling of start_read() If start_page() fails to add a page to page cache or fails to send OSD request. It should cal put_page() (instead of free_page()) for relevant pages. Besides, start_page() need to cancel fscache readpage if it fails to send OSD request. Signed-off-by: Yan, Zheng <[email protected]> Reported-by: Zhi Zhang <[email protected]> commit 0dcc685e7dd7190dcaa5435e9c14150f1d405b7b Author: Ilya Dryomov <[email protected]> Date: Mon Sep 26 15:43:52 2016 +0200 rbd: add rbd_obj_request_error() helper Pull setting an error and marking a request done code into a new helper. obj_request_img_data_test() check isn't strictly needed right now, but makes it applicable to !img_data requests and a bit safer. Signed-off-by: Ilya Dryomov <[email protected]> commit 04dc923c9e4c43df7d2d94f290189785d3172326 Author: Ilya Dryomov <[email protected]> Date: Thu Sep 15 18:05:16 2016 +0200 rbd: img_data requests don't own their page array Move the check into rbd_obj_request_destroy() to avoid use-after-free on errors in rbd_img_request_fill(..., OBJ_REQUEST_PAGES, ...), where pages, owned by the caller, gets freed in rbd_img_request_fill(). Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit 7c84883adf6dc614fc9e01304aa1813a55c43ad2 Author: Ilya Dryomov <[email protected]> Date: Thu Sep 15 17:56:39 2016 +0200 rbd: don't call rbd_osd_req_format_read() for !img_data requests Accessing obj_request->img_request union field is only valid for object requests associated with an image (i.e. if obj_request_img_data_test() returns true). rbd_osd_req_format_read() used to do more, but now it just sets osd_req->snap_id. Standalone and stat object requests always go to the HEAD revision and are fine with CEPH_NOSNAP set by libceph, so get around the invalid union field use by simply not calling rbd_osd_req_format_read() in those places. Reported-by: David Disseldorp <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit 710214e391476f331abed1b774b5f025d054ab7f Author: Ilya Dryomov <[email protected]> Date: Thu Sep 15 17:53:32 2016 +0200 rbd: rework rbd_img_obj_exists_submit() error paths - don't put obj_request before rbd_obj_request_get() if rbd_obj_request_create() fails - don't leak pages if rbd_obj_request_create() fails - don't leak stat_request if rbd_osd_req_create() fails Reported-by: David Disseldorp <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit fa355112c2763d513f1356119684dc8a6150d08a Author: Ilya Dryomov <[email protected]> Date: Fri Sep 16 15:20:42 2016 +0200 rbd: don't crash or leak on errors in rbd_img_obj_parent_read_full_callback() - fix parent_length == img_request->xferred assert to not fire on copyup read failures - don't leak pages if copyup read fails or we can't allocate a new osd request Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit 4a17dadcae55ca1f5c1ed826d42185e22653c256 Author: Ilya Dryomov <[email protected]> Date: Tue Sep 13 21:08:10 2016 +0200 rbd: move bumping img_request refcount into rbd_obj_request_submit() Commit 0f2d5be792b0 ("rbd: use reference counts for image requests") added rbd_img_request_get(), which rbd_img_request_fill() calls for each obj_request added to img_request. It was an urgent band-aid for the uglyness that is rbd_img_obj_callback() and none of the error paths were updated. Given that this img_request reference is meant to represent an obj_request that hasn't passed through rbd_img_obj_callback() yet, proper cleanup in appropriate destructors is a challenge. However, noting that if we don't get a chance to call rbd_obj_request_complete(), there is not going to be a call to rbd_img_obj_callback(), we can move rbd_img_request_get() into rbd_obj_request_submit() and fixup the two places that call rbd_obj_request_complete() directly and not through rbd_obj_request_submit() to temporarily bump img_request, so that rbd_img_obj_callback() can put as usual. This takes care of img_request leaks on errors on the submit side. Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> commit c2e82414884718ad6ec33a7528606cb07cf55cb4 Author: Ilya Dryomov <[email protected]> Date: Tue Sep 13 20:18:01 2016 +0200 rbd: mark the original request as done if stat request fails If stat request fails with something other than -ENOENT (which just means that we need to copyup), the original object request is never marked as done and therefore never completed. Fix this by moving the mark done + complete snippet from rbd_img_obj_parent_read_full() into rbd_img_obj_exists_callback(). The former remains covered, as the latter is its only caller (through rbd_img_obj_request_submit()). Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit 058aa9919147da9f088a96982a19ea0864139dc8 Author: Ilya Dryomov <[email protected]> Date: Mon Sep 12 14:44:45 2016 +0200 rbd: clean up asserts in rbd_img_obj_request_submit() helpers Assert once in rbd_img_obj_request_submit(). Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit 980917fc6ec94cb614fd79e6a124689e700f9d97 Author: Ilya Dryomov <[email protected]> Date: Mon Sep 12 18:59:42 2016 +0200 rbd: change rbd_obj_request_submit() signature - osdc parameter is useless - starting with commit 5aea3dcd5021 ("libceph: a major OSD client update"), ceph_osdc_start_request() always returns success Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: David Disseldorp <[email protected]> commit 80de19122866d0a65f741e7ff2d5d20842d22d6b Author: Ilya Dryomov <[email protected]> Date: Tue Sep 20 14:23:17 2016 +0200 rbd: lock_on_read map option Add a per-device option to acquire exclusive lock on reads (in addition to writes and discards). The use case is iSCSI, where it will be used to prevent execution of stale writes after the implicit failover. Signed-off-by: Ilya Dryomov <[email protected]> Tested-by: Mike Christie <[email protected]> commit bd85f4b37ddf2da22ccf5b29d264b2459b6722df Author: Xie XiuQi <[email protected]> Date: Tue Sep 27 15:07:12 2016 +0800 ipmi: fix crash on reading version from proc after unregisted bmc I meet a crash, which could be reproduce: 1) while true; do cat /proc/ipmi/0/version; done 2) modprobe -rv ipmi_si ipmi_msghandler ipmi_devintf [82761.021137] IPMI BT: req2rsp=5 secs retries=2 [82761.034524] ipmi device interface [82761.222218] ipmi_si ipmi_si.0: Found new BMC (man_id: 0x0007db, prod_id: 0x0001, dev_id: 0x01) [82761.222230] ipmi_si ipmi_si.0: IPMI bt interface initialized [82903.922740] BUG: unable to handle kernel NULL pointer dereference at 00000000000002d4 [82903.930952] IP: [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler] [82903.939220] PGD 86693a067 PUD 865304067 PMD 0 [82903.943893] Thread overran stack, or stack corrupted [82903.949034] Oops: 0000 [#1] SMP [82903.983091] Modules linked in: ipmi_si(-) ipmi_msghandler binfmt_misc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ... [82904.057285] pps_core scsi_transport_sas dm_mod vfio_iommu_type1 vfio xt_sctp nf_conntrack_proto_sctp nf_nat_proto_sctp nf_nat nf_conntrack sctp libcrc32c [last unloaded: ipmi_devintf] [82904.073169] CPU: 37 PID: 28089 Comm: cat Tainted: GF O ---- ------- 3.10.0-327.28.3.el7.x86_64 #1 [82904.083373] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 3.22 05/16/2016 [82904.090592] task: ffff880101cc2e00 ti: ffff880369c54000 task.ti: ffff880369c54000 [82904.098414] RIP: 0010:[<ffffffffa030d9e8>] [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler] [82904.109124] RSP: 0018:ffff880369c57e70 EFLAGS: 00010203 [82904.114608] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000024688470 [82904.121912] RDX: fffffffffffffff4 RSI: ffffffffa0313404 RDI: ffff8808670ce200 [82904.129218] RBP: ffff880369c57e70 R08: 0000000000019720 R09: ffffffff81204a27 [82904.136521] R10: ffff88046f803300 R11: 0000000000000246 R12: ffff880662399700 [82904.143828] R13: 0000000000000001 R14: ffff880369c57f48 R15: ffff8808670ce200 [82904.151128] FS: 00007fb70c9ca740(0000) GS:ffff88086e340000(0000) knlGS:0000000000000000 [82904.159557] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [82904.165473] CR2: 00000000000002d4 CR3: 0000000864c0c000 CR4: 00000000003407e0 [82904.172778] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [82904.180084] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [82904.187385] Stack: [82904.189573] ffff880369c57ee0 ffffffff81204f1a 00000000122a2427 0000000001426000 [82904.197392] ffff8808670ce238 0000000000010000 0000000000000000 0000000000000fff [82904.205198] 00000000122a2427 ffff880862079600 0000000001426000 ffff880369c57f48 [82904.212962] Call Trace: [82904.219667] [<ffffffff81204f1a>] seq_read+0xfa/0x3a0 [82904.224893] [<ffffffff8124ce2d>] proc_reg_read+0x3d/0x80 [82904.230468] [<ffffffff811e102c>] vfs_read+0x9c/0x170 [82904.235689] [<ffffffff811e1b7f>] SyS_read+0x7f/0xe0 [82904.240816] [<ffffffff81649209>] system_call_fastpath+0x16/0x1b [82904.246991] Code: 30 a0 e8 0c 6f ef e0 5b 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 47 78 55 48 c7 c6 04 34 31 a0 48 89 e5 48 8b 40 50 <0f> b6 90 d4 02 00 00 31 c0 89 d1 83 e2 0f c0 e9 04 0f b6 c9 e8 [82904.267710] RIP [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler] [82904.276079] RSP <ffff880369c57e70> [82904.279734] CR2: 00000000000002d4 [82904.283731] ---[ end trace a69e4328b49dd7c4 ]--- [82904.328118] Kernel panic - not syncing: Fatal exception Reading versin from /proc need bmc device struct available. So in this patch we move add/remove_proc_entries between ipmi_bmc_register and ipmi_bmc_unregister. Cc: Kefeng Wang <[email protected]> Signed-off-by: Xie XiuQi <[email protected]> Signed-off-by: Corey Minyard <[email protected]> commit 262f75a6288346db44038c63b7a95ee68f8b7bea Author: Daniel Vetter <[email protected]> Date: Mon Oct 3 10:28:27 2016 +0200 drm: Undo damage to page_flip_ioctl I screwed up rebasing of my patch in commit 43968d7b806d7a7e021261294c583a216fddf0e5 Author: Daniel Vetter <[email protected]> Date: Wed Sep 21 10:59:24 2016 +0200 drm: Extract drm_plane.[hc] which meant on error paths drm_crtc_vblank_put could be called without a get, leading to an underrun of the refcount. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98020 Reported-and-tested-by: Andy Furniss <[email protected]> Cc: Sean Paul <[email protected]> Cc: Michel Dänzer <[email protected]> Signed-off-by: Daniel Vetter <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit 63401ccdb2ca08ae76909f6588a3f3348bc3555d Author: Miklos Szeredi <[email protected]> Date: Mon Oct 3 11:06:05 2016 +0200 fuse: limit xattr returned size Don't let userspace filesystem give bogus values for the size of xattr and xattr list. Signed-off-by: Miklos Szeredi <[email protected]> commit fc113d54e9d7ef3296cdf2eff49c8ca0a3e5a482 Author: Brian Boylston <[email protected]> Date: Mon Sep 26 13:57:14 2016 -0500 watchdog: hpwdt: add support for iLO5 iLO5 will offer the same watchdog timer as previous generations, but the PCI subsystem vendor ID will be PCI_VENDOR_ID_HP_3PAR (0x1590) instead of PCI_VENDOR_ID_HP (0x103c). Add 0x1590 to the whitelist and be more specific when ignoring the 103c,1979 device. Signed-off-by: Brian Boylston <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]> commit f814bfd765218908b23e21ca7f0b6f403fb88972 Author: Alexey Khoroshilov <[email protected]> Date: Sat Oct 1 00:56:37 2016 +0300 net: mvmdio: do not clk_disable_unprepare() NULL clock There is no need to clk_disable_unprepare(dev->clk) before it was initialized. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 85de4a2101acb85c3b1dde465e84596ccca99f2c Author: Jiri Benc <[email protected]> Date: Fri Sep 30 19:08:07 2016 +0200 openvswitch: use mpls_hdr skb_mpls_header is equivalent to mpls_hdr now. Use the existing helper instead. Signed-off-by: Jiri Benc <[email protected]> Acked-by: Pravin B Shelar <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 9095e10edd28e1e4a10ba5ca61fb54d9f74f8968 Author: Jiri Benc <[email protected]> Date: Fri Sep 30 19:08:06 2016 +0200 mpls: move mpls_hdr to a common location This will be also used by openvswitch. Signed-off-by: Jiri Benc <[email protected]> Acked-by: David Ahern <[email protected]> Acked-by: Pravin B Shelar <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit f7d49bce8e741e1e6aa14ce4db1b6cea7e4be4e8 Author: Jiri Benc <[email protected]> Date: Fri Sep 30 19:08:05 2016 +0200 openvswitch: mpls: set network header correctly on key extract After the 48d2ab609b6b ("net: mpls: Fixups for GSO"), MPLS handling in openvswitch was changed to have network header pointing to the start of the MPLS headers and inner_network_header pointing after the MPLS headers. However, key_extract was missed by the mentioned commit, causing incorrect headers to be set when a MPLS packet just enters the bridge or after it is recirculated. Fixes: 48d2ab609b6b ("net: mpls: Fixups for GSO") Signed-off-by: Jiri Benc <[email protected]> Acked-by: Pravin B Shelar <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit ab580705693d5af79663efa504a72248700766fc Author: Arnd Bergmann <[email protected]> Date: Fri Sep 30 18:17:10 2016 +0200 mlxsw: spectrum_router: avoid potential uninitialized data usage If fi->fib_nhs is zero, the router interface pointer is uninitialized, as shown by this warning: drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c: In function 'mlxsw_sp_router_fib_event': drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:1674:21: error: 'r' may be used uninitialized in this function [-Werror=maybe-uninitialized] drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:1643:23: note: 'r' was declared here This changes the loop so we handle the case the same way as finding no router interface pointer attached to one of the nexthops to ensure we always trap here instead of using uninitialized data. Fixes: b45f64d16d45 ("mlxsw: spectrum_router: Use FIB notifications instead of switchdev calls") Signed-off-by: Arnd Bergmann <[email protected]> Acked-by: Ido Schimmel <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit d0debb76df18f05ecc65579d37203703ffdec44d Author: Arnd Bergmann <[email protected]> Date: Fri Sep 30 18:17:09 2016 +0200 net/mlx5e: shut up maybe-uninitialized warning Build-testing this driver with -Wmaybe-uninitialized gives a new false-positive warning that I can't really explain: drivers/net/ethernet/mellanox/mlx5/core/en_tc.c: In function 'mlx5e_configure_flower': drivers/net/ethernet/mellanox/mlx5/core/en_tc.c:509:3: error: 'old_attr' may be used uninitialized in this function [-Werror=maybe-uninitialized] It's obvious from the code that 'old_attr' is initialized whenever 'old' is non-NULL here. The warning appears with all versions I tested from gcc-4.7 through gcc-6.1, and I could not come up with a way to rewrite the function in a more readable way that avoids the warning, so I'm adding another initialization to shut it up. Fixes: 8b32580df1cb ("net/mlx5e: Add TC vlan action for SRIOV offloads") Signed-off-by: Arnd Bergmann <[email protected]> Acked-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 0c238e65d7dc62c5cae138cec720fec7baa07a24 Author: Tomeu Vizoso <[email protected]> Date: Fri Sep 23 16:06:40 2016 +0200 drm/rockchip: analogix_dp: Refuse to enable PSR if panel doesn't support it There's no point in enabling PSR when the panel doesn't support it. This also avoids a problem when PSR gets enabled when a CRTC is being disabled, because sometimes in that situation the DSP_HOLD_VALID_INTR interrupt on which we wait will never arrive. This was observed on RK3288 with a panel without PSR (veyron-jaq Chromebook). It's very easy to reproduce by running the kms_rmfb test in IGT a few times. Cc: Yakir Yang <[email protected]> Reviewed-by: Sean Paul <[email protected]> Signed-off-by: Tomeu Vizoso <[email protected]> Signed-off-by: Archit Taneja <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit a4cb6284e28b90761145f3ffa454a515ac4644ba Author: Tomeu Vizoso <[email protected]> Date: Fri Sep 23 16:06:39 2016 +0200 drm/bridge: analogix_dp: Add analogix_dp_psr_supported So users know whether PSR should be enabled or not. Cc: Yakir Yang <[email protected]> Reviewed-by: Sean Paul <[email protected]> Signed-off-by: Tomeu Vizoso <[email protected]> Signed-off-by: Archit Taneja <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit fbb6aacb078285f88e4a4a20399c6af8d61e0000 Author: Bjorn Andersson <[email protected]> Date: Sun Oct 2 17:46:39 2016 -0700 remoteproc: Refactor rproc module locking Lock the implementation as we hand out references to client drivers rather than when they try to boot the remote processor. This allows auto-booting remote processors to be shut down by unloading their module, in addition to first unbinding them. Signed-off-by: Bjorn Andersson <[email protected]> commit 433c0e04bc06da6d049c691a9ef238d61edb841c Author: Bjorn Andersson <[email protected]> Date: Sun Oct 2 17:46:38 2016 -0700 remoteproc: Split driver and consumer dereferencing In order to be able to lock a rproc driver implementations only when used by a client, we must differ between the dereference operation of a client and the implementation itself. This patch brings no functional change. Signed-off-by: Bjorn Andersson <[email protected]> commit 229b85a6a54d7eef81ba307d60a589cc232f06d1 Author: Bjorn Andersson <[email protected]> Date: Sun Oct 2 17:41:29 2016 -0700 remoteproc: Correct resource handling upon boot failure The freeing of resources will attempt to clear values previously set in the cached resource table, so make sure to free the table after we have cleaned up the resources. Fixes: 988d204cdaf6 ("remoteproc: Move handling of cached table to boot/shutdown") Signed-off-by: Bjorn Andersson <[email protected]> commit bcaf9dcf55fdac747f04a79e976c4543da3a4ab2 Author: Olof Johansson <[email protected]> Date: Sun Oct 2 22:42:13 2016 -0700 ARM: SoC: Document merges Signed-off-by: Olof Johansson <[email protected]> commit 7c70c4f8b2bf5ed777120f3d70efe35e64930c10 Author: Arnd Bergmann <[email protected]> Date: Fri Sep 30 18:15:33 2016 +0200 cxgb4: unexport cxgb4_dcb_enabled A recent cleanup marked cxgb4_dcb_enabled as 'static', which is correct, but this ignored how the symbol is also exported. In addition, the export can be compiled out when modules are disabled, causing a harmless compiler warning in configurations for which it is not used at all: drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:282:12: error: 'cxgb4_dcb_enabled' defined but not used [-Werror=unused-function] This removes the export and moves the function into the correct #ifdef so we only build it when there are users. Fixes: 50935857f878 ("cxgb4: mark symbols static where possible") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit fa34cd94fb01fcb8d79d91e009451b37692e94e5 Author: Arnd Bergmann <[email protected]> Date: Fri Sep 30 18:13:49 2016 +0200 net: rtnl: avoid uninitialized data in IFLA_VF_VLAN_LIST handling With the newly added support for IFLA_VF_VLAN_LIST netlink messages, we get a warning about potential uninitialized variable use in the parsing of the user input when enabling the -Wmaybe-uninitialized warning: net/core/rtnetlink.c: In function 'do_setvfinfo': net/core/rtnetlink.c:1756:9: error: 'ivvl$' may be used uninitialized in this function [-Werror=maybe-uninitialized] I have not been able to prove whether it is possible to arrive in this code with an empty IFLA_VF_VLAN_LIST block, but if we do, then ndo_set_vf_vlan gets called with uninitialized arguments. This adds an explicit check for an empty list, making it obvious to the reader and the compiler that this cannot happen. Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support") Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Moshe Shemesh <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 63d75463c91a5b5be7c0aca11ceb45ea5a0ae81d Author: Paolo Abeni <[email protected]> Date: Fri Sep 30 16:56:45 2016 +0200 net: pktgen: fix pkt_size The commit 879c7220e828 ("net: pktgen: Observe needed_headroom of the device") increased the 'pkt_overhead' field value by LL_RESERVED_SPACE. As a side effect the generated packet size, computed as: /* Eth + IPh + UDPh + mpls */ datalen = pkt_dev->cur_pkt_size - 14 - 20 - 8 - pkt_dev->pkt_overhead; is decreased by the same value. The above changed slightly the behavior of existing pktgen users, and made the procfs interface somewhat inconsistent. Fix it by restoring the previous pkt_overhead value and using LL_RESERVED_SPACE as extralen in skb allocation. Also, change pktgen_alloc_skb() to only partially reserve the headroom to allow the caller to prefetch from ll header start. v1 -> v2: - fixed some typos in the comments Fixes: 879c7220e828 ("net: pktgen: Observe needed_headroom of the device") Suggested-by: Ben Greear <[email protected]> Signed-off-by: Paolo Abeni <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit b82d44d78480faff7456e9e0999acb9d38666057 Author: Gavin Schenk <[email protected]> Date: Fri Sep 30 11:46:10 2016 +0200 net: fec: set mac address unconditionally If the mac address origin is not dt, you can only safely assign a mac address after "link up" of the device. If the link is off the clocks are disabled and because of issues assigning registers when clocks are off the new mac address cannot be written in .ndo_set_mac_address() on some soc's. This fix sets the mac address unconditionally in fec_restart(...) and ensures consistency between fec registers and the network layer. Signed-off-by: Gavin Schenk <[email protected]> Acked-by: Fugang Duan <[email protected]> Acked-by: Uwe Kleine-König <[email protected]> Fixes: 9638d19e4816 ("net: fec: add netif status check before set mac address") Signed-off-by: David S. Miller <[email protected]> commit d6db68b2deaa0158d25b236edffcf6dd2117208f Author: Linus Walleij <[email protected]> Date: Sun Oct 2 23:53:59 2016 +0200 bus: qcom-ebi2: depend on HAS_IOMEM After being asked to not depend on ARCH_QCOM* or similar, unsurprisingly compilation fails on UM as it has no I/O memory: drivers/built-in.o: In function `qcom_ebi2_probe': >> drivers/bus/qcom-ebi2.c:333: undefined reference to `devm_ioremap_resource' Fix this by letting the Kconfig atleast depend on HAS_IOMEM. Reported-by: kbuild test robot <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Andy Gross <[email protected]> Cc: [email protected] Signed-off-by: Linus Walleij <[email protected]> Signed-off-by: Olof Johansson <[email protected]> commit 3a82e78c131a8199d38cf653b523c8fa2909df65 Author: Baoyou Xie <[email protected]> Date: Fri Sep 30 15:48:50 2016 +0800 net: ethernet: mediatek: mark symbols static where possible We get 2 warnings when building kernel with W=1: drivers/net/ethernet/mediatek/mtk_eth_soc.c:2041:5: warning: no previous prototype for 'mtk_get_link_ksettings' [-Wmissing-prototypes] drivers/net/ethernet/mediatek/mtk_eth_soc.c:2052:5: warning: no previous prototype for 'mtk_set_link_ksettings' [-Wmissing-prototypes] In fact, these functions are only used in the file in which they are declared and don't need a declaration, but can be made static. So this patch marks these functions with 'static'. Signed-off-by: Baoyou Xie <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 8efebd6e5e93283a72d7a014d6dd8130e6601352 Author: Baoyou Xie <[email protected]> Date: Fri Sep 30 15:34:25 2016 +0800 cxgb4: mark cxgb_setup_tc() static We get 1 warning when building kernel with W=1: drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:2715:5: warning: no previous prototype for 'cxgb_setup_tc' [-Wmissing-prototypes] In fact, this function is only used in the file in which it is declared and don't need a declaration, but can be made static. so this patch marks this function with 'static'. Signed-off-by: Baoyou Xie <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 8185041f5fa6f02acf75229a590e16aac028fc5e Author: Vladimir Zapolskiy <[email protected]> Date: Fri Jul 8 01:46:41 2016 +0300 ARM: dts: lpc32xx: add device node for IRAM on-chip memory The change adds a new device node with description of generic SRAM on-chip memory found on NXP LPC32xx SoC series and connected to AHB matrix slave port 3. Note that NXP LPC3220 SoC has 128KiB of SRAM memory, the other LPC3230, LPC3240 and LPC3250 SoCs all have 256KiB SRAM space, in the shared DTSI file this change specifies 128KiB SRAM size. Also it's worth to mention that the SRAM area contains of 64KiB banks, 2 banks on LPC3220 and 4 banks on the other SoCs from the series, and all SRAM banks but the first one have independent power controls, the description of this feature will be added with the introduction of power domains for the SoC series. Signed-off-by: Vladimir Zapolskiy <[email protected]> Cc: Sylvain Lemieux <[email protected]> Signed-off-by: Olof Johansson <[email protected]> commit cb9e684e89e69894cb6697a3fa1274a284d1d3bb Author: Maciej Żenczykowski <[email protected]> Date: Thu Sep 29 00:33:43 2016 -0700 ipv6 addrconf: remove addrconf_sysctl_hop_limit() This is an effective no-op in terms of user observable behaviour. By preventing the overwrite of non-null extra1/extra2 fields in addrconf_sysctl() we can enable the use of proc_dointvec_minmax(). This allows us to eliminate the constant min/max (1..255) trampoline function that is addrconf_sysctl_hop_limit(). This is nice because it simplifies the code, and allows future sysctls with constant min/max limits to also not require trampolines. We still can't eliminate the trampoline for mtu because it isn't actually a constant (it depends on other tunables of the device) and thus requires at-write-time logic to enforce range. Signed-off-by: Maciej Żenczykowski <[email protected]> Acked-by: Erik Kline <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit d4ef9f72128d414ad83b27b49312faa971d77382 Author: Stefan Agner <[email protected]> Date: Wed Sep 28 15:05:28 2016 -0700 netfilter: bridge: clarify bridge/netfilter message Whe…

Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]>

Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>

documentation update and fix for building on Windows with msys2

[ Upstream commit 73d2c66 ] Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>

[ Upstream commit 73d2c66 ] Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Jiri Slaby <[email protected]>

commit 73d2c66 upstream. Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Ben Hutchings <[email protected]>

commit 73d2c66 upstream. Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Willy Tarreau <[email protected]>

BugLink: http://bugs.launchpad.net/bugs/1666324 [ Upstream commit 73d2c66 ] Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Tim Gardner <[email protected]> Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]>

ERROR: code indent should use tabs where possible torvalds#124: FILE: kernel/panic.c:604: + clear_warn_once_set,$ WARNING: please, no spaces at the start of a line torvalds#124: FILE: kernel/panic.c:604: + clear_warn_once_set,$ ERROR: code indent should use tabs where possible torvalds#125: FILE: kernel/panic.c:605: +^I^I "%lld\n");$ WARNING: please use device_initcall() or more appropriate function instead of __initcall() (see include/linux/init.h) torvalds#135: FILE: kernel/panic.c:615: +__initcall(register_warn_debugfs); total: 2 errors, 2 warnings, 87 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. NOTE: Whitespace errors detected. You may wish to use scripts/cleanpatch or scripts/cleanfile ./patches/support-resetting-warn_once.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Cc: Andi Kleen <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Mark Brown <[email protected]>

ERROR: code indent should use tabs where possible torvalds#124: FILE: kernel/panic.c:604: + clear_warn_once_set,$ WARNING: please, no spaces at the start of a line torvalds#124: FILE: kernel/panic.c:604: + clear_warn_once_set,$ ERROR: code indent should use tabs where possible torvalds#125: FILE: kernel/panic.c:605: +^I^I "%lld\n");$ WARNING: please use device_initcall() or more appropriate function instead of __initcall() (see include/linux/init.h) torvalds#135: FILE: kernel/panic.c:615: +__initcall(register_warn_debugfs); total: 2 errors, 2 warnings, 87 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. NOTE: Whitespace errors detected. You may wish to use scripts/cleanpatch or scripts/cleanfile ./patches/support-resetting-warn_once.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Cc: Andi Kleen <[email protected]> Signed-off-by: Andrew Morton <[email protected]>

[ Upstream commit 73d2c66 ] Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ torvalds#124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <[email protected]> Tested-by: Andrey Konovalov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>

[ Upstream commit 28b2f82 ] Fix below division by zero warning: [ 3.176443] Division by zero in kernel. [ 3.181809] CPU: 0 PID: 88 Comm: kworker/0:2 Not tainted 5.3.0-rc2-next-20190730-63758-ge08da51-dirty torvalds#124 [ 3.191817] Hardware name: Freescale i.MX7ULP (Device Tree) [ 3.197821] Workqueue: events dbs_work_handler [ 3.202849] [<c01127d8>] (unwind_backtrace) from [<c010cd80>] (show_stack+0x10/0x14) [ 3.211058] [<c010cd80>] (show_stack) from [<c0c77e68>] (dump_stack+0xd8/0x110) [ 3.218820] [<c0c77e68>] (dump_stack) from [<c0c753c0>] (Ldiv0_64+0x8/0x18) [ 3.226263] [<c0c753c0>] (Ldiv0_64) from [<c05984b4>] (clk_pfdv2_set_rate+0x54/0xac) [ 3.234487] [<c05984b4>] (clk_pfdv2_set_rate) from [<c059192c>] (clk_change_rate+0x1a4/0x698) [ 3.243468] [<c059192c>] (clk_change_rate) from [<c0591a08>] (clk_change_rate+0x280/0x698) [ 3.252180] [<c0591a08>] (clk_change_rate) from [<c0591fc0>] (clk_core_set_rate_nolock+0x1a0/0x278) [ 3.261679] [<c0591fc0>] (clk_core_set_rate_nolock) from [<c05920c8>] (clk_set_rate+0x30/0x64) [ 3.270743] [<c05920c8>] (clk_set_rate) from [<c089cb88>] (imx7ulp_set_target+0x184/0x2a4) [ 3.279501] [<c089cb88>] (imx7ulp_set_target) from [<c0896358>] (__cpufreq_driver_target+0x188/0x514) [ 3.289196] [<c0896358>] (__cpufreq_driver_target) from [<c0899b0c>] (od_dbs_update+0x130/0x15c) [ 3.298438] [<c0899b0c>] (od_dbs_update) from [<c089a5d0>] (dbs_work_handler+0x2c/0x5c) [ 3.306914] [<c089a5d0>] (dbs_work_handler) from [<c0156858>] (process_one_work+0x2ac/0x704) [ 3.315826] [<c0156858>] (process_one_work) from [<c0156cdc>] (worker_thread+0x2c/0x574) [ 3.324404] [<c0156cdc>] (worker_thread) from [<c015cfe8>] (kthread+0x134/0x148) [ 3.332278] [<c015cfe8>] (kthread) from [<c01010b4>] (ret_from_fork+0x14/0x20) [ 3.339858] Exception stack(0xe82d5fb0 to 0xe82d5ff8) [ 3.345314] 5fa0: 00000000 00000000 00000000 00000000 [ 3.353926] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 3.362519] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 Signed-off-by: Anson Huang <[email protected]> Signed-off-by: Peng Fan <[email protected]> Signed-off-by: Shawn Guo <[email protected]> Signed-off-by: Sasha Levin <[email protected]>

This commit fixes the following checkpatch.pl errors: ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#12: FILE: ./hal/HalHWImg8723B_RF.c:12: + struct DM_ODM_T * pDM_Odm, const u32 Condition1, const u32 Condition2 ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#124: FILE: ./hal/HalHWImg8723B_RF.c:124: + struct DM_ODM_T * pDM_Odm, const u32 Condition1, const u32 Condition2 ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#262: FILE: ./hal/HalHWImg8723B_RF.c:262: +void ODM_ReadAndConfig_MP_8723B_RadioA(struct DM_ODM_T * pDM_Odm) ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#423: FILE: ./hal/HalHWImg8723B_RF.c:423: +void ODM_ReadAndConfig_MP_8723B_TxPowerTrack_SDIO(struct DM_ODM_T * pDM_Odm) ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#425: FILE: ./hal/HalHWImg8723B_RF.c:425: + struct ODM_RF_CAL_T * pRFCalibrateInfo = &(pDM_Odm->RFCalibrateInfo); ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#758: FILE: ./hal/HalHWImg8723B_RF.c:758: +void ODM_ReadAndConfig_MP_8723B_TXPWR_LMT(struct DM_ODM_T * pDM_Odm) Signed-off-by: Marco Cesati <[email protected]>

This commit fixes the following checkpatch.pl errors: ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#12: FILE: ./hal/HalHWImg8723B_RF.c:12: + struct DM_ODM_T * pDM_Odm, const u32 Condition1, const u32 Condition2 ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#124: FILE: ./hal/HalHWImg8723B_RF.c:124: + struct DM_ODM_T * pDM_Odm, const u32 Condition1, const u32 Condition2 ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#262: FILE: ./hal/HalHWImg8723B_RF.c:262: +void ODM_ReadAndConfig_MP_8723B_RadioA(struct DM_ODM_T * pDM_Odm) ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#423: FILE: ./hal/HalHWImg8723B_RF.c:423: +void ODM_ReadAndConfig_MP_8723B_TxPowerTrack_SDIO(struct DM_ODM_T * pDM_Odm) ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#425: FILE: ./hal/HalHWImg8723B_RF.c:425: + struct ODM_RF_CAL_T * pRFCalibrateInfo = &(pDM_Odm->RFCalibrateInfo); ERROR:POINTER_LOCATION: "foo * bar" should be "foo *bar" torvalds#758: FILE: ./hal/HalHWImg8723B_RF.c:758: +void ODM_ReadAndConfig_MP_8723B_TXPWR_LMT(struct DM_ODM_T * pDM_Odm) Reviewed-by: Dan Carpenter <[email protected]> Signed-off-by: Marco Cesati <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>

Handle possible allocation failure in `user_ptr`.

When SUSPEND_DISCONNECTING bit is set that means Disconnect is pending but the code was evaluating if the list is empty before calling hci_conn_del which does the actual cleanup and remove the connection from the list thus the bit is never cleared causing the suspend procedure to always timeout when there are connections to be disconnected: Suspend/Resume - Success 5 (Pairing - Legacy) - waiting done Set the system into Suspend via force_suspend = mgmt-tester: Suspend/Resume - Success 5 (Pairing -.. 17:03:13.200458 = mgmt-tester: Set the system into Suspend via force_suspend 17:03:13.205812 < HCI Command: Write Scan E.. (0x03|0x001a) plen 1 torvalds#122 [hci0] 17:03:13.213561 Scan enable: No Scans (0x00) > HCI Event: Command Complete (0x0e) plen 4 torvalds#123 [hci0] 17:03:13.214710 Write Scan Enable (0x03|0x001a) ncmd 1 Status: Success (0x00) < HCI Command: Disconnect (0x01|0x0006) plen 3 torvalds#124 [hci0] 17:03:13.215830 Handle: 42 Reason: Remote Device Terminated due to Power Off (0x15) > HCI Event: Command Status (0x0f) plen 4 torvalds#125 [hci0] 17:03:13.216602 Disconnect (0x01|0x0006) ncmd 1 Status: Success (0x00) > HCI Event: Disconnect Complete (0x05) plen 4 torvalds#126 [hci0] 17:03:13.217342 Status: Success (0x00) Handle: 42 Reason: Remote Device Terminated due to Power Off (0x15) @ MGMT Event: Device Disconn.. (0x000c) plen 8 {0x0002} [hci0] 17:03:13.217688 BR/EDR Address: 00:AA:01:01:00:00 (Intel Corporation) Reason: Connection terminated by local host for suspend (0x05) @ MGMT Event: Device Disconn.. (0x000c) plen 8 {0x0001} [hci0] 17:03:13.217688 BR/EDR Address: 00:AA:01:01:00:00 (Intel Corporation) Reason: Connection terminated by local host for suspend (0x05) Suspend/Resume - Success 5 (Pairing - Legacy) - test timed out = mgmt-tester: Suspend/Resume - Success 5 (Pairing -.. 17:03:13.939317 Suspend/Resume - Success 5 (Pairing - Legacy) - teardown = mgmt-tester: Suspend/Resume - Success 5 (Pairing -.. 17:03:13.947267 [ 13.284291] Bluetooth: hci0: Timed out waiting for suspend events [ 13.287324] Bluetooth: hci0: Suspend timeout bit: 6 Signed-off-by: Luiz Augusto von Dentz <[email protected]> Signed-off-by: Marcel Holtmann <[email protected]>

…_on() The code for resizing the trace ring buffers has to run the per-cpu resize on the CPU itself. The code was using preempt_off() and running the code for the current CPU directly, otherwise calling schedule_work_on(). At least on RT this could result in the following: |BUG: sleeping function called from invalid context at kernel/rtmutex.c:673 |in_atomic(): 1, irqs_disabled(): 0, pid: 607, name: bash |3 locks held by bash/607: |CPU: 0 PID: 607 Comm: bash Not tainted 3.12.15-rt25+ torvalds#124 |(rt_spin_lock+0x28/0x68) |(free_hot_cold_page+0x84/0x3b8) |(free_buffer_page+0x14/0x20) |(rb_update_pages+0x280/0x338) |(ring_buffer_resize+0x32c/0x3dc) |(free_snapshot+0x18/0x38) |(tracing_set_tracer+0x27c/0x2ac) probably via |cd /sys/kernel/debug/tracing/ |echo 1 > events/enable ; sleep 2 |echo 1024 > buffer_size_kb If we just always use schedule_work_on(), there's no need for the preempt_off(). So do that. Link: http://lkml.kernel.org/p/[email protected] Reported-by: Stanislav Meduna <[email protected]> Signed-off-by: Corey Minyard <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>

PD#150078: driver defect clean up: torvalds#14 torvalds#89 torvalds#111 torvalds#124 torvalds#133 torvalds#136 torvalds#137 torvalds#146 torvalds#148 torvalds#150 torvalds#153 Change-Id: I734a66a8b92a0dc57a232879463a3fc074534fa0 Signed-off-by: Zongdong Jiao <[email protected]>

@offset

[BUG] David reported an ASSERT() get triggered during fio load on 8 devices with data/raid6 and metadata/raid1c3: fio --rw=randrw --randrepeat=1 --size=3000m \ --bsrange=512b-64k --bs_unaligned \ --ioengine=libaio --fsync=1024 \ --name=job0 --name=job1 \ The ASSERT() is from rbio_add_bio() of raid56.c: ASSERT(orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN); Which is checking if the target rbio is crossing the full stripe boundary. [100.789] assertion failed: orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN, in fs/btrfs/raid56.c:1622 [100.795] ------------[ cut here ]------------ [100.796] kernel BUG at fs/btrfs/raid56.c:1622! [100.797] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [100.798] CPU: 1 PID: 100 Comm: kworker/u8:4 Not tainted 6.4.0-rc6-default+ torvalds#124 [100.799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [100.802] Workqueue: writeback wb_workfn (flush-btrfs-1) [100.803] RIP: 0010:rbio_add_bio+0x204/0x210 [btrfs] [100.806] RSP: 0018:ffff888104a8f300 EFLAGS: 00010246 [100.808] RAX: 00000000000000a1 RBX: ffff8881075907e0 RCX: ffffed1020951e01 [100.809] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001 [100.811] RBP: 0000000141d20000 R08: 0000000000000001 R09: ffff888104a8f04f [100.813] R10: ffffed1020951e09 R11: 0000000000000003 R12: ffff88810e87f400 [100.815] R13: 0000000041d20000 R14: 0000000144529000 R15: ffff888101524000 [100.817] FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 [100.821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [100.822] CR2: 000055d54e44c270 CR3: 000000010a9a1006 CR4: 00000000003706a0 [100.824] Call Trace: [100.825] <TASK> [100.825] ? die+0x32/0x80 [100.826] ? do_trap+0x12d/0x160 [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.829] ? do_error_trap+0x90/0x130 [100.830] ? rbio_add_bio+0x204/0x210 [btrfs] [100.831] ? handle_invalid_op+0x2c/0x30 [100.833] ? rbio_add_bio+0x204/0x210 [btrfs] [100.835] ? exc_invalid_op+0x29/0x40 [100.836] ? asm_exc_invalid_op+0x16/0x20 [100.837] ? rbio_add_bio+0x204/0x210 [btrfs] [100.837] raid56_parity_write+0x64/0x270 [btrfs] [100.838] btrfs_submit_chunk+0x26e/0x800 [btrfs] [100.840] ? btrfs_bio_init+0x80/0x80 [btrfs] [100.841] ? release_pages+0x503/0x6d0 [100.842] ? folio_unlock+0x2f/0x60 [100.844] ? __folio_put+0x60/0x60 [100.845] ? btrfs_do_readpage+0xae0/0xae0 [btrfs] [100.847] btrfs_submit_bio+0x21/0x60 [btrfs] [100.847] submit_one_bio+0x6a/0xb0 [btrfs] [100.849] extent_write_cache_pages+0x395/0x680 [btrfs] [100.850] ? __extent_writepage+0x520/0x520 [btrfs] [100.851] ? mark_usage+0x190/0x190 [100.852] extent_writepages+0xdb/0x130 [btrfs] [100.853] ? extent_write_locked_range+0x480/0x480 [btrfs] [100.854] ? mark_usage+0x190/0x190 [100.854] ? attach_extent_buffer_page+0x220/0x220 [btrfs] [100.855] ? reacquire_held_locks+0x178/0x280 [100.856] ? writeback_sb_inodes+0x245/0x7f0 [100.857] do_writepages+0x102/0x2e0 [100.858] ? page_writeback_cpu_online+0x10/0x10 [100.859] ? __lock_release.isra.0+0x14a/0x4d0 [100.860] ? reacquire_held_locks+0x280/0x280 [100.861] ? __lock_acquired+0x1e9/0x3d0 [100.862] ? do_raw_spin_lock+0x1b0/0x1b0 [100.863] __writeback_single_inode+0x94/0x450 [100.864] writeback_sb_inodes+0x372/0x7f0 [100.864] ? lock_sync+0xd0/0xd0 [100.865] ? do_raw_spin_unlock+0x93/0xf0 [100.866] ? sync_inode_metadata+0xc0/0xc0 [100.867] ? rwsem_optimistic_spin+0x340/0x340 [100.868] __writeback_inodes_wb+0x70/0x130 [100.869] wb_writeback+0x2d1/0x530 [100.869] ? __writeback_inodes_wb+0x130/0x130 [100.870] ? lockdep_hardirqs_on_prepare.part.0+0xf1/0x1c0 [100.870] wb_do_writeback+0x3eb/0x480 [100.871] ? wb_writeback+0x530/0x530 [100.871] ? mark_lock_irq+0xcd0/0xcd0 [100.872] wb_workfn+0xe0/0x3f0< [CAUSE] Commit a97699d ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") changes how we calculate the map length, to reduce u64 division. Function btrfs_max_io_len() is to get the length to the stripe boundary. It calculates the full stripe start offset (inside the chunk) by the following code: *full_stripe_start = rounddown(*stripe_nr, nr_data_stripes(map)) << BTRFS_STRIPE_LEN_SHIFT; The calculation itself is fine, but the value returned by rounddown() is dependent on both @stripe_nr (which is u32) and nr_data_stripes() (which returned int). Thus the result is also u32, then we do the left shift, which can overflow u32. If such overflow happens, @full_stripe_start will be a value way smaller than @offset, causing later "full_stripe_len - (offset - *full_stripe_start)" to underflow, thus make later length calculation to have no stripe boundary limit, resulting a write bio to exceed stripe boundary. There are some other locations like this, with a u32 @stripe_nr got left shift, which can lead to a similar overflow. [FIX] Fix all @stripe_nr with left shift with a type cast to u64 before the left shift. Those involved @stripe_nr or similar variables are recording the stripe number inside the chunk, which is small enough to be contained by u32, but their offset inside the chunk can not fit into u32. Thus for those specific left shifts, a type cast to u64 is necessary so this patch does not touch them and the code will be cleaned up in the future to keep the fix minimal. Reported-by: David Sterba <[email protected]> Fixes: a97699d ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") Tested-by: David Sterba <[email protected]> Signed-off-by: Qu Wenruo <[email protected]> Signed-off-by: David Sterba <[email protected]>

@offset

[BUG] David reported an ASSERT() get triggered during fio load on 8 devices with data/raid6 and metadata/raid1c3: fio --rw=randrw --randrepeat=1 --size=3000m \ --bsrange=512b-64k --bs_unaligned \ --ioengine=libaio --fsync=1024 \ --name=job0 --name=job1 \ The ASSERT() is from rbio_add_bio() of raid56.c: ASSERT(orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN); Which is checking if the target rbio is crossing the full stripe boundary. [100.789] assertion failed: orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN, in fs/btrfs/raid56.c:1622 [100.795] ------------[ cut here ]------------ [100.796] kernel BUG at fs/btrfs/raid56.c:1622! [100.797] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [100.798] CPU: 1 PID: 100 Comm: kworker/u8:4 Not tainted 6.4.0-rc6-default+ torvalds#124 [100.799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [100.802] Workqueue: writeback wb_workfn (flush-btrfs-1) [100.803] RIP: 0010:rbio_add_bio+0x204/0x210 [btrfs] [100.806] RSP: 0018:ffff888104a8f300 EFLAGS: 00010246 [100.808] RAX: 00000000000000a1 RBX: ffff8881075907e0 RCX: ffffed1020951e01 [100.809] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001 [100.811] RBP: 0000000141d20000 R08: 0000000000000001 R09: ffff888104a8f04f [100.813] R10: ffffed1020951e09 R11: 0000000000000003 R12: ffff88810e87f400 [100.815] R13: 0000000041d20000 R14: 0000000144529000 R15: ffff888101524000 [100.817] FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 [100.821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [100.822] CR2: 000055d54e44c270 CR3: 000000010a9a1006 CR4: 00000000003706a0 [100.824] Call Trace: [100.825] <TASK> [100.825] ? die+0x32/0x80 [100.826] ? do_trap+0x12d/0x160 [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.829] ? do_error_trap+0x90/0x130 [100.830] ? rbio_add_bio+0x204/0x210 [btrfs] [100.831] ? handle_invalid_op+0x2c/0x30 [100.833] ? rbio_add_bio+0x204/0x210 [btrfs] [100.835] ? exc_invalid_op+0x29/0x40 [100.836] ? asm_exc_invalid_op+0x16/0x20 [100.837] ? rbio_add_bio+0x204/0x210 [btrfs] [100.837] raid56_parity_write+0x64/0x270 [btrfs] [100.838] btrfs_submit_chunk+0x26e/0x800 [btrfs] [100.840] ? btrfs_bio_init+0x80/0x80 [btrfs] [100.841] ? release_pages+0x503/0x6d0 [100.842] ? folio_unlock+0x2f/0x60 [100.844] ? __folio_put+0x60/0x60 [100.845] ? btrfs_do_readpage+0xae0/0xae0 [btrfs] [100.847] btrfs_submit_bio+0x21/0x60 [btrfs] [100.847] submit_one_bio+0x6a/0xb0 [btrfs] [100.849] extent_write_cache_pages+0x395/0x680 [btrfs] [100.850] ? __extent_writepage+0x520/0x520 [btrfs] [100.851] ? mark_usage+0x190/0x190 [100.852] extent_writepages+0xdb/0x130 [btrfs] [100.853] ? extent_write_locked_range+0x480/0x480 [btrfs] [100.854] ? mark_usage+0x190/0x190 [100.854] ? attach_extent_buffer_page+0x220/0x220 [btrfs] [100.855] ? reacquire_held_locks+0x178/0x280 [100.856] ? writeback_sb_inodes+0x245/0x7f0 [100.857] do_writepages+0x102/0x2e0 [100.858] ? page_writeback_cpu_online+0x10/0x10 [100.859] ? __lock_release.isra.0+0x14a/0x4d0 [100.860] ? reacquire_held_locks+0x280/0x280 [100.861] ? __lock_acquired+0x1e9/0x3d0 [100.862] ? do_raw_spin_lock+0x1b0/0x1b0 [100.863] __writeback_single_inode+0x94/0x450 [100.864] writeback_sb_inodes+0x372/0x7f0 [100.864] ? lock_sync+0xd0/0xd0 [100.865] ? do_raw_spin_unlock+0x93/0xf0 [100.866] ? sync_inode_metadata+0xc0/0xc0 [100.867] ? rwsem_optimistic_spin+0x340/0x340 [100.868] __writeback_inodes_wb+0x70/0x130 [100.869] wb_writeback+0x2d1/0x530 [100.869] ? __writeback_inodes_wb+0x130/0x130 [100.870] ? lockdep_hardirqs_on_prepare.part.0+0xf1/0x1c0 [100.870] wb_do_writeback+0x3eb/0x480 [100.871] ? wb_writeback+0x530/0x530 [100.871] ? mark_lock_irq+0xcd0/0xcd0 [100.872] wb_workfn+0xe0/0x3f0< [CAUSE] Commit a97699d ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") changes how we calculate the map length, to reduce u64 division. Function btrfs_max_io_len() is to get the length to the stripe boundary. It calculates the full stripe start offset (inside the chunk) by the following code: *full_stripe_start = rounddown(*stripe_nr, nr_data_stripes(map)) << BTRFS_STRIPE_LEN_SHIFT; The calculation itself is fine, but the value returned by rounddown() is dependent on both @stripe_nr (which is u32) and nr_data_stripes() (which returned int). Thus the result is also u32, then we do the left shift, which can overflow u32. If such overflow happens, @full_stripe_start will be a value way smaller than @offset, causing later "full_stripe_len - (offset - *full_stripe_start)" to underflow, thus make later length calculation to have no stripe boundary limit, resulting a write bio to exceed stripe boundary. There are some other locations like this, with a u32 @stripe_nr got left shift, which can lead to a similar overflow. [FIX] Fix all @stripe_nr with left shift with a type cast to u64 before the left shift. Those involved @stripe_nr or similar variables are recording the stripe number inside the chunk, which is small enough to be contained by u32, but their offset inside the chunk can not fit into u32. Thus for those specific left shifts, a type cast to u64 is necessary so this patch does not touch them and the code will be cleaned up in the future to keep the fix minimal. Reported-by: David Sterba <[email protected]> Fixes: a97699d ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") Tested-by: David Sterba <[email protected]> Signed-off-by: Qu Wenruo <[email protected]> Signed-off-by: David Sterba <[email protected]>

Like commit 1cf3bfc ("bpf: Support 64-bit pointers to kfuncs") for s390x, add support for 64-bit pointers to kfuncs for LoongArch. Since the infrastructure is already implemented in BPF core, the only thing need to be done is to override bpf_jit_supports_far_kfunc_call(). Before this change, several test_verifier tests failed: # ./test_verifier | grep # | grep FAIL torvalds#119/p calls: invalid kfunc call: ptr_to_mem to struct with non-scalar FAIL torvalds#120/p calls: invalid kfunc call: ptr_to_mem to struct with nesting depth > 4 FAIL torvalds#121/p calls: invalid kfunc call: ptr_to_mem to struct with FAM FAIL torvalds#122/p calls: invalid kfunc call: reg->type != PTR_TO_CTX FAIL torvalds#123/p calls: invalid kfunc call: void * not allowed in func proto without mem size arg FAIL torvalds#124/p calls: trigger reg2btf_ids[reg->type] for reg->type > __BPF_REG_TYPE_MAX FAIL torvalds#125/p calls: invalid kfunc call: reg->off must be zero when passed to release kfunc FAIL torvalds#126/p calls: invalid kfunc call: don't match first member type when passed to release kfunc FAIL torvalds#127/p calls: invalid kfunc call: PTR_TO_BTF_ID with negative offset FAIL torvalds#128/p calls: invalid kfunc call: PTR_TO_BTF_ID with variable offset FAIL torvalds#129/p calls: invalid kfunc call: referenced arg needs refcounted PTR_TO_BTF_ID FAIL torvalds#130/p calls: valid kfunc call: referenced arg needs refcounted PTR_TO_BTF_ID FAIL torvalds#486/p map_kptr: ref: reference state created and released on xchg FAIL This is because the kfuncs in the loaded module are far away from __bpf_call_base: ffff800002009440 t bpf_kfunc_call_test_fail1 [bpf_testmod] 9000000002e128d8 T __bpf_call_base The offset relative to __bpf_call_base does NOT fit in s32, which breaks the assumption in BPF core. Enable bpf_jit_supports_far_kfunc_call() lifts this limit. Note that to reproduce the above result, tools/testing/selftests/bpf/config should be applied, and run the test with JIT enabled, unpriv BPF enabled. With this change, the test_verifier tests now all passed: # ./test_verifier ... Summary: 777 PASSED, 0 SKIPPED, 0 FAILED Tested-by: Tiezhu Yang <[email protected]> Signed-off-by: Hengqi Chen <[email protected]> Signed-off-by: Huacai Chen <[email protected]>

Merge pull request #1 from torvalds/master

aeb978c

pulling latest linux code

rakesh-gopal closed this Sep 19, 2014

laijs pushed a commit to laijs/linux that referenced this pull request Feb 13, 2017

Merge pull request torvalds#124 from staalmannen/lkl-win2

8da1ab8

documentation update and fix for building on Windows with msys2

ojeda pushed a commit to ojeda/linux that referenced this pull request Mar 21, 2021

Merge pull request torvalds#124 from wedsonaf/user_ptr-alloc

72904b1

Handle possible allocation failure in `user_ptr`.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge pull request #1 from torvalds/master #124

Merge pull request #1 from torvalds/master #124

rakesh-gopal commented Sep 19, 2014

Merge pull request #1 from torvalds/master #124

Merge pull request #1 from torvalds/master #124

Conversation

rakesh-gopal commented Sep 19, 2014