1. 03 Apr, 2018 11 commits
    • Palmer Dabbelt's avatar
      RISC-V: Assorted memory model fixes · 2c9046b7
      Palmer Dabbelt authored
      These fixes fall into three categories
      
      * The definiton of __smp_{store_release,load_acquire}, which allow us to
        emit a full fence when unnecessary.
      * Fixes to avoid relying on the behavior of "*.aqrl" atomics, as those
        are specified in the currently released RISC-V memory model draft in
        a way that makes them useless for Linux.  This might change in the
        future, but now the code matches the memory model spec as it's written
        so at least we're getting closer to something sane.  The actual fix is
        to delete the RISC-V specific atomics and drop back to generic
        versions that use the new fences from above.
      * Cleanups to our atomic macros, which are mostly non-functional
        changes.
      
      Unfortunately I haven't given these as thorough of a testing as I
      probably should have, but I've poked through the code and they seem
      generally OK.
      2c9046b7
    • Palmer Dabbelt's avatar
      RISC-V: Add dynamic ftrace support for RISC-V platforms · 1cead2d7
      Palmer Dabbelt authored
      This patch set includes the building blocks of dynamic ftrace features
      for RISC-V machines.  I'm afraid I'm not very familiar with ftrace, but
      the code looks OK to me.  It's been used to track down a performance
      problem in our SPI driver and appears to work acceptably, but we haven't
      given it a whole lot of banging yet so there might still be some bugs
      lurking around somewhere.
      1cead2d7
    • Andrea Parri's avatar
      riscv/atomic: Strengthen implementations with fences · 5ce6c1f3
      Andrea Parri authored
      Atomics present the same issue with locking: release and acquire
      variants need to be strengthened to meet the constraints defined
      by the Linux-kernel memory consistency model [1].
      
      Atomics present a further issue: implementations of atomics such
      as atomic_cmpxchg() and atomic_add_unless() rely on LR/SC pairs,
      which do not give full-ordering with .aqrl; for example, current
      implementations allow the "lr-sc-aqrl-pair-vs-full-barrier" test
      below to end up with the state indicated in the "exists" clause.
      
      In order to "synchronize" LKMM and RISC-V's implementation, this
      commit strengthens the implementations of the atomics operations
      by replacing .rl and .aq with the use of ("lightweigth") fences,
      and by replacing .aqrl LR/SC pairs in sequences such as:
      
        0:      lr.w.aqrl  %0, %addr
                bne        %0, %old, 1f
                ...
                sc.w.aqrl  %1, %new, %addr
                bnez       %1, 0b
        1:
      
      with sequences of the form:
      
        0:      lr.w       %0, %addr
                bne        %0, %old, 1f
                ...
                sc.w.rl    %1, %new, %addr   /* SC-release   */
                bnez       %1, 0b
                fence      rw, rw            /* "full" fence */
        1:
      
      following Daniel's suggestion.
      
      These modifications were validated with simulation of the RISC-V
      memory consistency model.
      
      C lr-sc-aqrl-pair-vs-full-barrier
      
      {}
      
      P0(int *x, int *y, atomic_t *u)
      {
      	int r0;
      	int r1;
      
      	WRITE_ONCE(*x, 1);
      	r0 = atomic_cmpxchg(u, 0, 1);
      	r1 = READ_ONCE(*y);
      }
      
      P1(int *x, int *y, atomic_t *v)
      {
      	int r0;
      	int r1;
      
      	WRITE_ONCE(*y, 1);
      	r0 = atomic_cmpxchg(v, 0, 1);
      	r1 = READ_ONCE(*x);
      }
      
      exists (u=1 /\ v=1 /\ 0:r1=0 /\ 1:r1=0)
      
      [1] https://marc.info/?l=linux-kernel&m=151930201102853&w=2
          https://groups.google.com/a/groups.riscv.org/forum/#!topic/isa-dev/hKywNHBkAXM
          https://marc.info/?l=linux-kernel&m=151633436614259&w=2Suggested-by: default avatarDaniel Lustig <dlustig@nvidia.com>
      Signed-off-by: default avatarAndrea Parri <parri.andrea@gmail.com>
      Cc: Palmer Dabbelt <palmer@sifive.com>
      Cc: Albert Ou <albert@sifive.com>
      Cc: Daniel Lustig <dlustig@nvidia.com>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Boqun Feng <boqun.feng@gmail.com>
      Cc: Nicholas Piggin <npiggin@gmail.com>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Jade Alglave <j.alglave@ucl.ac.uk>
      Cc: Luc Maranget <luc.maranget@inria.fr>
      Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
      Cc: Akira Yokosawa <akiyks@gmail.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: linux-riscv@lists.infradead.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      5ce6c1f3
    • Andrea Parri's avatar
      riscv/spinlock: Strengthen implementations with fences · 0123f4d7
      Andrea Parri authored
      Current implementations map locking operations using .rl and .aq
      annotations.  However, this mapping is unsound w.r.t. the kernel
      memory consistency model (LKMM) [1]:
      
      Referring to the "unlock-lock-read-ordering" test reported below,
      Daniel wrote:
      
        "I think an RCpc interpretation of .aq and .rl would in fact
         allow the two normal loads in P1 to be reordered [...]
      
         The intuition would be that the amoswap.w.aq can forward from
         the amoswap.w.rl while that's still in the store buffer, and
         then the lw x3,0(x4) can also perform while the amoswap.w.rl
         is still in the store buffer, all before the l1 x1,0(x2)
         executes.  That's not forbidden unless the amoswaps are RCsc,
         unless I'm missing something.
      
         Likewise even if the unlock()/lock() is between two stores.
         A control dependency might originate from the load part of
         the amoswap.w.aq, but there still would have to be something
         to ensure that this load part in fact performs after the store
         part of the amoswap.w.rl performs globally, and that's not
         automatic under RCpc."
      
      Simulation of the RISC-V memory consistency model confirmed this
      expectation.
      
      In order to "synchronize" LKMM and RISC-V's implementation, this
      commit strengthens the implementations of the locking operations
      by replacing .rl and .aq with the use of ("lightweigth") fences,
      resp., "fence rw,  w" and "fence r , rw".
      
      C unlock-lock-read-ordering
      
      {}
      /* s initially owned by P1 */
      
      P0(int *x, int *y)
      {
              WRITE_ONCE(*x, 1);
              smp_wmb();
              WRITE_ONCE(*y, 1);
      }
      
      P1(int *x, int *y, spinlock_t *s)
      {
              int r0;
              int r1;
      
              r0 = READ_ONCE(*y);
              spin_unlock(s);
              spin_lock(s);
              r1 = READ_ONCE(*x);
      }
      
      exists (1:r0=1 /\ 1:r1=0)
      
      [1] https://marc.info/?l=linux-kernel&m=151930201102853&w=2
          https://groups.google.com/a/groups.riscv.org/forum/#!topic/isa-dev/hKywNHBkAXM
          https://marc.info/?l=linux-kernel&m=151633436614259&w=2Signed-off-by: default avatarAndrea Parri <parri.andrea@gmail.com>
      Cc: Palmer Dabbelt <palmer@sifive.com>
      Cc: Albert Ou <albert@sifive.com>
      Cc: Daniel Lustig <dlustig@nvidia.com>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Boqun Feng <boqun.feng@gmail.com>
      Cc: Nicholas Piggin <npiggin@gmail.com>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Jade Alglave <j.alglave@ucl.ac.uk>
      Cc: Luc Maranget <luc.maranget@inria.fr>
      Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
      Cc: Akira Yokosawa <akiyks@gmail.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: linux-riscv@lists.infradead.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      0123f4d7
    • Andrea Parri's avatar
      riscv/barrier: Define __smp_{store_release,load_acquire} · 8d235b17
      Andrea Parri authored
      Introduce __smp_{store_release,load_acquire}, and rely on the generic
      definitions for smp_{store_release,load_acquire}. This avoids the use
      of full ("rw,rw") fences on SMP.
      Signed-off-by: default avatarAndrea Parri <parri.andrea@gmail.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      8d235b17
    • Alan Kao's avatar
      riscv/ftrace: Add HAVE_FUNCTION_GRAPH_RET_ADDR_PTR support · b785ec12
      Alan Kao authored
      In walk_stackframe, the pc now receives the address from calling
      ftrace_graph_ret_addr instead of manual calculation.
      
      Note that the original calculation,
              pc = frame->ra - 4
      is buggy when the instruction at the return address happened to be a
      compressed inst. But since it is not a critical part of ftrace, it is
      ignored for now to ease the review process.
      
      Cc: Greentime Hu <greentime@andestech.com>
      Signed-off-by: default avatarAlan Kao <alankao@andestech.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      b785ec12
    • Alan Kao's avatar
      riscv/ftrace: Add DYNAMIC_FTRACE_WITH_REGS support · aea4c671
      Alan Kao authored
      Cc: Greentime Hu <greentime@andestech.com>
      Signed-off-by: default avatarAlan Kao <alankao@andestech.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      aea4c671
    • Alan Kao's avatar
      riscv/ftrace: Add ARCH_SUPPORTS_FTRACE_OPS support · 71e736a7
      Alan Kao authored
      Cc: Greentime Hu <greentime@andestech.com>
      Signed-off-by: default avatarAlan Kao <alankao@andestech.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      71e736a7
    • Alan Kao's avatar
      riscv/ftrace: Add dynamic function graph tracer support · bc1a4c3a
      Alan Kao authored
      Once the function_graph tracer is enabled, a filtered function has the
      following call sequence:
      
      * ftracer_caller         ==> on/off by ftrace_make_call/ftrace_make_nop
      * ftrace_graph_caller
      * ftrace_graph_call      ==> on/off by ftrace_en/disable_ftrace_graph_caller
      * prepare_ftrace_return
      
      Considering the following DYNAMIC_FTRACE_WITH_REGS feature, it would be
      more extendable to have a ftrace_graph_caller function, instead of
      calling prepare_ftrace_return directly in ftrace_caller.
      
      Cc: Greentime Hu <greentime@andestech.com>
      Signed-off-by: default avatarAlan Kao <alankao@andestech.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      bc1a4c3a
    • Alan Kao's avatar
      riscv/ftrace: Add dynamic function tracer support · c15ac4fd
      Alan Kao authored
      We now have dynamic ftrace with the following added items:
      
      * ftrace_make_call, ftrace_make_nop (in kernel/ftrace.c)
        The two functions turn each recorded call site of filtered functions
        into a call to ftrace_caller or nops
      
      * ftracce_update_ftrace_func (in kernel/ftrace.c)
        turns the nops at ftrace_call into a call to a generic entry for
        function tracers.
      
      * ftrace_caller (in kernel/mcount-dyn.S)
        The entry where each _mcount call sites calls to once they are
        filtered to be traced.
      
      Also, this patch fixes the semantic problems in mcount.S, which will be
      treated as only a reference implementation once we have the dynamic
      ftrace.
      
      Cc: Greentime Hu <greentime@andestech.com>
      Signed-off-by: default avatarAlan Kao <alankao@andestech.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      c15ac4fd
    • Alan Kao's avatar
      riscv/ftrace: Add RECORD_MCOUNT support · a1d2a6b4
      Alan Kao authored
      Now recordmcount.pl recognizes RISC-V object files. For the mechanism to
      work, we have to disable the linker relaxation.
      
      Cc: Greentime Hu <greentime@andestech.com>
      Signed-off-by: default avatarAlan Kao <alankao@andestech.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
      a1d2a6b4
  2. 01 Apr, 2018 1 commit
  3. 31 Mar, 2018 5 commits
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 10b84dad
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Two fixlets"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/hwbp: Simplify the perf-hwbp code, fix documentation
        perf/x86/intel: Fix linear IP of PEBS real_ip on Haswell and later CPUs
      10b84dad
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ad0500ca
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Two UV platform fixes, and a kbuild fix"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/platform/UV: Fix critical UV MMR address error
        x86/platform/uv/BAU: Add APIC idt entry
        x86/purgatory: Avoid creating stray .<pid>.d files, remove -MD from KBUILD_CFLAGS
      ad0500ca
    • Linus Torvalds's avatar
      Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 93e04d4a
      Linus Torvalds authored
      Pull x86 PTI fixes from Ingo Molnar:
       "Two fixes: a relatively simple objtool fix that makes Clang built
        kernels work with ORC debug info, plus an alternatives macro fix"
      
      * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/alternatives: Fixup alternative_call_2
        objtool: Add Clang support
      93e04d4a
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v4.16-3' of... · b5dbc287
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v4.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix missed rebuild of TRIM_UNUSED_KSYMS
      
       - fix rpm-pkg for GNU tar >= 1.29
      
       - include scripts/dtc/include-prefixes/* to kernel header deb-pkg
      
       - add -no-integrated-as option ealier to fix building with Clang
      
       - fix netfilter Makefile for parallel building
      
      * tag 'kbuild-fixes-v4.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        netfilter: nf_nat_snmp_basic: add correct dependency to Makefile
        kbuild: rpm-pkg: Support GNU tar >= 1.29
        builddeb: Fix header package regarding dtc source links
        kbuild: set no-integrated-as before incl. arch Makefile
        kbuild: make scripts/adjust_autoksyms.sh robust against timestamp races
      b5dbc287
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a44406ec
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix RCU locking in xfrm_local_error(), from Taehee Yoo.
      
       2) Fix return value assignments and thus error checking in
          iwl_mvm_start_ap_ibss(), from Johannes Berg.
      
       3) Don't count header length twice in vti4, from Stefano Brivio.
      
       4) Fix deadlock in rt6_age_examine_exception, from Eric Dumazet.
      
       5) Fix out-of-bounds access in nf_sk_lookup_slow{v4,v6}() from Subash
          Abhinov.
      
       6) Check nladdr size in netlink_connect(), from Alexander Potapenko.
      
       7) VF representor SQ numbers are 32 not 16 bits, in mlx5 driver, from
          Or Gerlitz.
      
       8) Out of bounds read in skb_network_protocol(), from Eric Dumazet.
      
       9) r8169 driver sets driver data pointer after register_netdev() which
          is too late. Fix from Heiner Kallweit.
      
      10) Fix memory leak in mlx4 driver, from Moshe Shemesh.
      
      11) The multi-VLAN decap fix added a regression when dealing with device
          that lack a MAC header, such as tun. Fix from Toshiaki Makita.
      
      12) Fix integer overflow in dynamic interrupt coalescing code. From Tal
          Gilboa.
      
      13) Use after free in vrf code, from David Ahern.
      
      14) IPV6 route leak between VRFs fix, also from David Ahern.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (81 commits)
        net: mvneta: fix enable of all initialized RXQs
        net/ipv6: Fix route leaking between VRFs
        vrf: Fix use after free and double free in vrf_finish_output
        ipv6: sr: fix seg6 encap performances with TSO enabled
        net/dim: Fix int overflow
        vlan: Fix vlan insertion for packets without ethernet header
        net: Fix untag for vlan packets without ethernet header
        atm: iphase: fix spelling mistake: "Receiverd" -> "Received"
        vhost: validate log when IOTLB is enabled
        qede: Do not drop rx-checksum invalidated packets.
        hv_netvsc: enable multicast if necessary
        ip_tunnel: Resolve ipsec merge conflict properly.
        lan78xx: Crash in lan78xx_writ_reg (Workqueue: events lan78xx_deferred_multicast_write)
        qede: Fix barrier usage after tx doorbell write.
        vhost: correctly remove wait queue during poll failure
        net/mlx4_core: Fix memory leak while delete slave's resources
        net/mlx4_en: Fix mixed PFC and Global pause user control requests
        net/smc: use announced length in sock_recvmsg()
        llc: properly handle dev_queue_xmit() return value
        strparser: Fix sign of err codes
        ...
      a44406ec
  4. 30 Mar, 2018 19 commits
    • Yelena Krivosheev's avatar
      net: mvneta: fix enable of all initialized RXQs · e81b5e01
      Yelena Krivosheev authored
      In mvneta_port_up() we enable relevant RX and TX port queues by write
      queues bit map to an appropriate register.
      
      q_map must be ZERO in the beginning of this process.
      Signed-off-by: default avatarYelena Krivosheev <yelena@marvell.com>
      Signed-off-by: default avatarGregory CLEMENT <gregory.clement@bootlin.com>
      Acked-by: default avatarThomas Petazzoni <thomas.petazzoni@bootlin.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e81b5e01
    • David Ahern's avatar
      net/ipv6: Fix route leaking between VRFs · b6cdbc85
      David Ahern authored
      Donald reported that IPv6 route leaking between VRFs is not working.
      The root cause is the strict argument in the call to rt6_lookup when
      validating the nexthop spec.
      
      ip6_route_check_nh validates the gateway and device (if given) of a
      route spec. It in turn could call rt6_lookup (e.g., lookup in a given
      table did not succeed so it falls back to a full lookup) and if so
      sets the strict argument to 1. That means if the egress device is given,
      the route lookup needs to return a result with the same device. This
      strict requirement does not work with VRFs (IPv4 or IPv6) because the
      oif in the flow struct is overridden with the index of the VRF device
      to trigger a match on the l3mdev rule and force the lookup to its table.
      
      The right long term solution is to add an l3mdev index to the flow
      struct such that the oif is not overridden. That solution will not
      backport well, so this patch aims for a simpler solution to relax the
      strict argument if the route spec device is an l3mdev slave. As done
      in other places, use the FLOWI_FLAG_SKIP_NH_OIF to know that the
      RT6_LOOKUP_F_IFACE flag needs to be removed.
      
      Fixes: ca254490 ("net: Add VRF support to IPv6 stack")
      Reported-by: default avatarDonald Sharp <sharpd@cumulusnetworks.com>
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b6cdbc85
    • David Ahern's avatar
      vrf: Fix use after free and double free in vrf_finish_output · 82dd0d2a
      David Ahern authored
      Miguel reported an skb use after free / double free in vrf_finish_output
      when neigh_output returns an error. The vrf driver should return after
      the call to neigh_output as it takes over the skb on error path as well.
      
      Patch is a simplified version of Miguel's patch which was written for 4.9,
      and updated to top of tree.
      
      Fixes: 8f58336d ("net: Add ethernet header for pass through VRF device")
      Signed-off-by: default avatarMiguel Fadon Perlines <mfadon@teldat.com>
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      82dd0d2a
    • David Lebrun's avatar
      ipv6: sr: fix seg6 encap performances with TSO enabled · 5807b22c
      David Lebrun authored
      Enabling TSO can lead to abysmal performances when using seg6 in
      encap mode, such as with the ixgbe driver. This patch adds a call to
      iptunnel_handle_offloads() to remove the encapsulation bit if needed.
      
      Before:
      root@comp4-seg6bpf:~# iperf3 -c fc00::55
      Connecting to host fc00::55, port 5201
      [  4] local fc45::4 port 36592 connected to fc00::55 port 5201
      [ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
      [  4]   0.00-1.00   sec   196 KBytes  1.60 Mbits/sec   47   6.66 KBytes
      [  4]   1.00-2.00   sec   304 KBytes  2.49 Mbits/sec  100   5.33 KBytes
      [  4]   2.00-3.00   sec   284 KBytes  2.32 Mbits/sec   92   5.33 KBytes
      
      After:
      root@comp4-seg6bpf:~# iperf3 -c fc00::55
      Connecting to host fc00::55, port 5201
      [  4] local fc45::4 port 43062 connected to fc00::55 port 5201
      [ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
      [  4]   0.00-1.00   sec  1.03 GBytes  8.89 Gbits/sec    0    743 KBytes
      [  4]   1.00-2.00   sec  1.03 GBytes  8.87 Gbits/sec    0    743 KBytes
      [  4]   2.00-3.00   sec  1.03 GBytes  8.87 Gbits/sec    0    743 KBytes
      Reported-by: default avatarTom Herbert <tom@quantonium.net>
      Fixes: 6c8702c6 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
      Signed-off-by: default avatarDavid Lebrun <dlebrun@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5807b22c
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.16-rc8' of git://github.com/ceph/ceph-client · 9dd23268
      Linus Torvalds authored
      Pull ceph fix from Ilya Dryomov:
       "A fix for a dio-enabled loop on ceph deadlock from Zheng, marked for
        stable"
      
      * tag 'ceph-for-4.16-rc8' of git://github.com/ceph/ceph-client:
        ceph: only dirty ITER_IOVEC pages for direct read
      9dd23268
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 72573481
      Linus Torvalds authored
      Pull KVM fixes from Radim Krčmář:
       "PPC:
         - Fix a bug causing occasional machine check exceptions on POWER8
           hosts (introduced in 4.16-rc1)
      
        x86:
         - Fix a guest crashing regression with nested VMX and restricted
           guest (introduced in 4.16-rc1)
      
         - Fix dependency check for pv tlb flush (the wrong dependency that
           effectively disabled the feature was added in 4.16-rc4, the
           original feature in 4.16-rc1, so it got decent testing)"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Fix pv tlb flush dependencies
        KVM: nVMX: sync vmcs02 segment regs prior to vmx_set_cr0
        KVM: PPC: Book3S HV: Fix duplication of host SLB entries
      72573481
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · bd886137
      Linus Torvalds authored
      Pull i2c fix from Wolfram Sang:
       "A simple but worthwhile I2C driver fix for 4.16"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: i2c-stm32f7: fix no check on returned setup
      bd886137
    • Linus Torvalds's avatar
      Merge tag 'sound-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ef82f598
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Very small fixes (all one-liners) at this time.
      
        One fix is for a PCM core stuff to correct the mmap behavior on
        non-x86. It doesn't show on most machines but mostly only for exotic
        non-interleaved formats"
      
      * tag 'sound-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: pcm: potential uninitialized return values
        ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
        ALSA: usb-audio: Add native DSD support for TEAC UD-301
      ef82f598
    • Tal Gilboa's avatar
      net/dim: Fix int overflow · f97c3dc3
      Tal Gilboa authored
      When calculating difference between samples, the values
      are multiplied by 100. Large values may cause int overflow
      when multiplied (usually on first iteration).
      Fixed by forcing 100 to be of type unsigned long.
      
      Fixes: 4c4dbb4a ("net/mlx5e: Move dynamic interrupt coalescing code to include/linux")
      Signed-off-by: default avatarTal Gilboa <talgi@mellanox.com>
      Reviewed-by: default avatarAndy Gospodarek <gospo@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f97c3dc3
    • David S. Miller's avatar
      Merge branch 'vlan-fix' · 52a9692a
      David S. Miller authored
      Toshiaki Makita says:
      
      ====================
      Fix vlan tag handling for vlan packets without ethernet headers
      
      Eric Dumazet reported syzbot found a new bug which leads to underflow of
      size argument of memmove(), causing crash[1]. This can be triggered by tun
      devices.
      
      The underflow happened because skb_vlan_untag() did not expect vlan packets
      without ethernet headers, and tun can produce such packets.
      I also checked vlan_insert_inner_tag() and found a similar bug.
      
      This series fixes these problems.
      
      [1] https://marc.info/?l=linux-netdev&m=152221753920510&w=2
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      52a9692a
    • Toshiaki Makita's avatar
      vlan: Fix vlan insertion for packets without ethernet header · c769accd
      Toshiaki Makita authored
      In some situation vlan packets do not have ethernet headers. One example
      is packets from tun devices. Users can specify vlan protocol in tun_pi
      field instead of IP protocol. When we have a vlan device with reorder_hdr
      disabled on top of the tun device, such packets from tun devices are
      untagged in skb_vlan_untag() and vlan headers will be inserted back in
      vlan_insert_inner_tag().
      
      vlan_insert_inner_tag() however did not expect packets without ethernet
      headers, so in such a case size argument for memmove() underflowed.
      
      We don't need to copy headers for packets which do not have preceding
      headers of vlan headers, so skip memmove() in that case.
      Also don't write vlan protocol in skb->data when it does not have enough
      room for it.
      
      Fixes: cbe7128c ("vlan: Fix out of order vlan headers with reorder header off")
      Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c769accd
    • Toshiaki Makita's avatar
      net: Fix untag for vlan packets without ethernet header · ae474573
      Toshiaki Makita authored
      In some situation vlan packets do not have ethernet headers. One example
      is packets from tun devices. Users can specify vlan protocol in tun_pi
      field instead of IP protocol, and skb_vlan_untag() attempts to untag such
      packets.
      
      skb_vlan_untag() (more precisely, skb_reorder_vlan_header() called by it)
      however did not expect packets without ethernet headers, so in such a case
      size argument for memmove() underflowed and triggered crash.
      
      ====
      BUG: unable to handle kernel paging request at ffff8801cccb8000
      IP: __memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43
      PGD 9cee067 P4D 9cee067 PUD 1d9401063 PMD 1cccb7063 PTE 2810100028101
      Oops: 000b [#1] SMP KASAN
      Dumping ftrace buffer:
         (ftrace buffer empty)
      Modules linked in:
      CPU: 1 PID: 17663 Comm: syz-executor2 Not tainted 4.16.0-rc7+ #368
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:__memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43
      RSP: 0018:ffff8801cc046e28 EFLAGS: 00010287
      RAX: ffff8801ccc244c4 RBX: fffffffffffffffe RCX: fffffffffff6c4c2
      RDX: fffffffffffffffe RSI: ffff8801cccb7ffc RDI: ffff8801cccb8000
      RBP: ffff8801cc046e48 R08: ffff8801ccc244be R09: ffffed0039984899
      R10: 0000000000000001 R11: ffffed0039984898 R12: ffff8801ccc244c4
      R13: ffff8801ccc244c0 R14: ffff8801d96b7c06 R15: ffff8801d96b7b40
      FS:  00007febd562d700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffff8801cccb8000 CR3: 00000001ccb2f006 CR4: 00000000001606e0
      DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
      Call Trace:
       memmove include/linux/string.h:360 [inline]
       skb_reorder_vlan_header net/core/skbuff.c:5031 [inline]
       skb_vlan_untag+0x470/0xc40 net/core/skbuff.c:5061
       __netif_receive_skb_core+0x119c/0x3460 net/core/dev.c:4460
       __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4627
       netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4701
       netif_receive_skb+0xae/0x390 net/core/dev.c:4725
       tun_rx_batched.isra.50+0x5ee/0x870 drivers/net/tun.c:1555
       tun_get_user+0x299e/0x3c20 drivers/net/tun.c:1962
       tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1990
       call_write_iter include/linux/fs.h:1782 [inline]
       new_sync_write fs/read_write.c:469 [inline]
       __vfs_write+0x684/0x970 fs/read_write.c:482
       vfs_write+0x189/0x510 fs/read_write.c:544
       SYSC_write fs/read_write.c:589 [inline]
       SyS_write+0xef/0x220 fs/read_write.c:581
       do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x42/0xb7
      RIP: 0033:0x454879
      RSP: 002b:00007febd562cc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 00007febd562d6d4 RCX: 0000000000454879
      RDX: 0000000000000157 RSI: 0000000020000180 RDI: 0000000000000014
      RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
      R13: 00000000000006b0 R14: 00000000006fc120 R15: 0000000000000000
      Code: 90 90 90 90 90 90 90 48 89 f8 48 83 fa 20 0f 82 03 01 00 00 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f 9f 00 00 00 48 89 d1 <f3> a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 3b 48 83 ea 20
      RIP: __memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43 RSP: ffff8801cc046e28
      CR2: ffff8801cccb8000
      ====
      
      We don't need to copy headers for packets which do not have preceding
      headers of vlan headers, so skip memmove() in that case.
      
      Fixes: 4bbb3e0e ("net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off")
      Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ae474573
    • Colin Ian King's avatar
      atm: iphase: fix spelling mistake: "Receiverd" -> "Received" · a9645b27
      Colin Ian King authored
      Trivial fix to spelling mistake in message text
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a9645b27
    • Yan, Zheng's avatar
      ceph: only dirty ITER_IOVEC pages for direct read · 85784f93
      Yan, Zheng authored
      If a page is already locked, attempting to dirty it leads to a deadlock
      in lock_page().  This is what currently happens to ITER_BVEC pages when
      a dio-enabled loop device is backed by ceph:
      
        $ losetup --direct-io /dev/loop0 /mnt/cephfs/img
        $ xfs_io -c 'pread 0 4k' /dev/loop0
      
      Follow other file systems and only dirty ITER_IOVEC pages.
      
      Cc: stable@kernel.org
      Signed-off-by: default avatar"Yan, Zheng" <zyan@redhat.com>
      Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      85784f93
    • Linus Torvalds's avatar
      Merge tag 'for-4.16/dm-fixes-4' of... · c2a98384
      Linus Torvalds authored
      Merge tag 'for-4.16/dm-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix a DM multipath regression introduced in a v4.16-rc6 commit:
         restore support for loading, and attaching, scsi_dh modules during
         multipath table load. Otherwise some users may find themselves unable
         to boot, as was reported today:
      
           https://marc.info/?l=linux-scsi&m=152231276114962&w=2
      
       - Fix a DM core ioctl permission check regression introduced in a
         v4.16-rc5 commit.
      
      * tag 'for-4.16/dm-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm: fix dropped return code from dm_get_bdev_for_ioctl
        dm mpath: fix support for loading scsi_dh modules during table load
      c2a98384
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · d89b9f50
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "It has been fairly silent lately on our -rc front. Big queue of
        patches on the mailing list going to for-next though.
      
        Bug fixes:
         - qedr driver bugfixes causing application hangs, wrong uapi errnos,
           and a race condition
         - three syzkaller found bugfixes in the ucma uapi
      
        Regression fixes for things introduced in 4.16:
         - Crash on error introduced in mlx5 UMR flow
         - Crash on module unload/etc introduced by bad interaction of
           restrack and mlx5 patches this cycle
         - Typo in a two line syzkaller bugfix causing a bad regression
         - Coverity report of nonsense code in hns driver"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/ucma: Introduce safer rdma_addr_size() variants
        RDMA/hns: ensure for-loop actually iterates and free's buffers
        RDMA/ucma: Check that device exists prior to accessing it
        RDMA/ucma: Check that device is connected prior to access it
        RDMA/rdma_cm: Fix use after free race with process_one_req
        RDMA/qedr: Fix QP state initialization race
        RDMA/qedr: Fix rc initialization on CNQ allocation failure
        RDMA/qedr: fix QP's ack timeout configuration
        RDMA/ucma: Correct option size check using optlen
        RDMA/restrack: Move restrack_clean to be symmetrical to restrack_init
        IB/mlx5: Don't clean uninitialized UMR resources
      d89b9f50
    • Linus Torvalds's avatar
      Merge tag 'mtd/fixes-for-4.16' of git://git.infradead.org/linux-mtd · ab12762b
      Linus Torvalds authored
      Pull MTD fixes from Boris Brezillon:
       "Two fixes, one in the atmel NAND driver and another one in the
        CFI/JEDEC code.
      
        Summary:
      
         - Fix a bug in Atmel ECC engine driver
      
         - Fix a bug in the CFI/JEDEC driver"
      
      * tag 'mtd/fixes-for-4.16' of git://git.infradead.org/linux-mtd:
        mtd: jedec_probe: Fix crash in jedec_read_mfr()
        mtd: nand: atmel: Fix get_sectorsize() function
      ab12762b
    • Mike Snitzer's avatar
      dm: fix dropped return code from dm_get_bdev_for_ioctl · da5dadb4
      Mike Snitzer authored
      dm_get_bdev_for_ioctl()'s return of 0 or 1 must be the result from
      prepare_ioctl (1 means the ioctl was issued to a partition, 0 means it
      wasn't).  Unfortunately commit 519049af ("dm: use blkdev_get rather
      than bdgrab when issuing pass-through ioctl") reused the variable 'r'
      to store the return from blkdev_get() that follows prepare_ioctl()
      -- whereby dropping prepare_ioctl()'s result on the floor.
      
      This can lead to an ioctl or persistent reservation being issued to a
      partition going unnoticed, which implies the extra permission check for
      CAP_SYS_RAWIO is skipped.
      
      Fix this by using a different variable to store blkdev_get()'s return.
      
      Fixes: 519049af ("dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl")
      Reported-by: default avatarAlasdair G Kergon <agk@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      da5dadb4
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 74957cbf
      David S. Miller authored
      Daniel Borkman says:
      
      ====================
      pull-request: bpf 2018-03-29
      
      The following pull-request contains BPF updates for your *net* tree.
      
      The main changes are:
      
      1) Fix nfp to properly check max insn count while emitting
         instructions in the JIT which was wrongly comparing bytes
         against number of instructions before, from Jakub.
      
      2) Fix for bpftool to avoid usage of hex numbers in JSON
         output since JSON doesn't accept hex numbers with 0x
         prefix, also from Jakub.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      74957cbf
  5. 29 Mar, 2018 4 commits