The q-counter-id is given in modify-QP command associates
the QP with the counter. The offset to which the counter
ID was set is incorrect, causing IB port counters not to
count on QP.

Fixes: 0837e86a ('IB/mlx5: Add per port counters')
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Tested-by: Mark Bloch <markb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Number of outstanding_pi may overflow and as a result may indicate that
there are no elements in the queue. The effect of doing this is that the
MAD layer will get stuck waiting for completions. The MAD layer will
think that the QP is full - because it didn't receive these completions.

This fix changes it so the outstanding_pi number is increased
with 32-bit wraparound and is not limited to max_send_wr so
that the difference between outstanding_pi and outstanding_ci will
really indicate the number of outstanding completions.

Cc: Stable <stable@vger.kernel.org>
Fixes: ea6dc203 ('IB/mlx5: Reorder GSI completions')
Signed-off-by: Slava Shwartsman <slavash@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Reviewed-by: Haggai Eran <haggaie@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Fixes the following sparse warning:

drivers/infiniband/hw/mlx5/main.c:2574:25: warning: duplicate const
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Acked-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Expose new counters using the get protocol stats callback.
We expose the following counters:

|------------------------------------------------------------------------|
|      Name           | IB | EN |           Description                  |
|------------------------------------------------------------------------|
|rx_write_requests    | +  | -  | Number of received WRITE requests for  |
|                     |    |    | the associated QP.                     |
|------------------------------------------------------------------------|
|rx_read_requests     | +  | -  | Number of received READ requests for   |
|                     |    |    | the associated QP.                     |
|------------------------------------------------------------------------|
|rx_atomic_requests   | +  | -  | Number of received ATOMIC requests for |
|                     |    |    | the associated QP.                     |
|------------------------------------------------------------------------|
|out_of_buffer        | +  | +  | Number of drops occurred due to lack   |
|                     |    |    | of WQE for the associated QPs/RQs.     |
|------------------------------------------------------------------------|
|out_of_sequence      | +  | -  | Number of errors in the packet         |
|                     |    |    | transport sequence number              |
|------------------------------------------------------------------------|
|duplicate_request    | +  | +  | Number of received duplicated packets. |
|                     |    |    | A request that previously executed is  |
|                     |    |    | named duplicated.                      |
|------------------------------------------------------------------------|
|rnr_nak_retry_err    | +  | +  | Number of received RNR NAC packets.    |
|                     |    |    | The QP retry limit did not exceed.     |
|------------------------------------------------------------------------|
|packet_seq_err       | +  | +  | Number of received NAK - sequence error|
|                     |    |    | packets. The QP retry limit did not    |
|                     |    |    | exceed.                                |
|------------------------------------------------------------------------|
|implied_nak_err      | +  | +  | Number of times the requester detected |
|                     |    |    | an ACK with a PSN larger than expected |
|                     |    |    | PSN for RDMA READ or ATOMIC response   |
|                     |    |    | The QP retry limit did not exceed.     |
|------------------------------------------------------------------------|
|local_ack_timeout_err| +  | -  | Number of NO ACK responses from        |
|                     |    |    | responder within timer interval.       |
|                     |    |    | The QP retry limit did not exceed.     |
|------------------------------------------------------------------------|

Counters are available if all of them are supported.
Signed-off-by: Mark Bloch <markb@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Reviewed-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

In order to support statistics for ports, we attach
each QP to a counter set which is dedicate to this port.
Signed-off-by: Mark Bloch <markb@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Currently, the SRQ API uses the obsolete mlx5_*_srq_mbox_{in,out}
structs which limit the ability to pass the SRQ attributes between
net and IB parts of the driver.

This patch changes the SRQ API so as to use auto-generated structs
and provides a better way to pass attributes which will be in use by
coming features.
Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Make MODIFY_QP command input structure compliant to specification

Fixes: e126ba97 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Enable mlx5 based hardware to report TCP segmentation offload (TSO)
capabilities from kernel to user space. A TSO enabled NIC will accept
big chunks of data with sizes greater than MTU for TCP traffic.  The TSO
engine will break the data into separate packets and will insert headers
automatically.

The capabilities are exposed to user space through query_device by uhw
directly. The following capabilities are reported:

1. The maximum payload size in bytes supported for segmentation by TSO
   engine.
2. Bitmap showing which QP types are supported by TSO operation. The bitmap
   is built by members from 'enmu ib_qp_type'. For example, similar code
   should be performed if UD QP is supported:
	supported_qpts |= 1 << IB_QPT_UD;

To make user-space library aware of whether kernel supports uhw or not, a
new flag: cmds_supp_uhw will be returned back to user-space through
alloc_ucontext.
Signed-off-by: Bodong Wang <bodong@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Enable flow steering for IPv6 traffic by using an IPv6 spec.
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Add IPv6 flow specification support.
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

The driver exposes interfaces that directly relate to HW state.
Upon fatal error, consumers of these interfaces (ULPs) that rely
on completion of all their posted work-request could hang, thereby
introducing dependencies in shutdown order. To prevent this from
happening, we manage the relevant resources (CQs, QPs) that are used
by the device. Upon a fatal error, we now generate simulated
completions for outstanding WQEs that were not completed at the
time the HW was reset.

It includes invoking the completion event handler for all involved
CQs so that the ULPs will poll those CQs. When polled we return
simulated CQEs with IB_WC_WR_FLUSH_ERR return code enabling ULPs
to clean up their  resources and not wait forever for completions
upon receiving remove_one.

The above change requires an extra check in the data path to make
sure that when device is in error state, the simulated CQEs will
be returned and no further WQEs will be posted.
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Implements the IB core disassociate_ucontext API.
The driver detaches the HW resources for a given user context to
prevent a dependency between application termination and device
disconnect. This is done by managing the VMAs that were mapped
to the HW bars such as doorbell and blueflame. When need to detach,
remap them to an arbitrary kernel page returned by the zap API.
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Add support for Raw Ethernet RX HASH QP. Currently, creation and
destruction of such a QP are supported. This QP is implemented as
a simple TIR object which points to the receive RQ indirection table.
The given hashing configuration is used to configure the TIR and by
that it chooses the right RQ from the RQ indirection table.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

User applications that want to spread incoming traffic between several WQs
should create a QP which contains an indirection table.

When such a QP is created other receive side parameters are not valid
and should not be given. Its send side is optional and assumed active
based on max_send_wr capability value.

Extend create QP to work accordingly.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Extend create QP to get Receive Work Queue (WQ) indirection table.

QP can be created with external Receive Work Queue indirection table,
in that case it is ready to receive immediately.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Some mlx5 based hardwares support a RQ table object. This RQ table
points to a few RQ objects. We implement the receive work queue
indirection table API (create and destroy) by using this hardware
object.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

User applications that want to spread traffic on several WQs, need to
create an indirection table, by using already created WQs.

Adding uverbs API in order to create and destroy this table.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Introduce Receive Work Queue (WQ) indirection table.
This object can be used to spread incoming traffic to different
receive Work Queues.

A Receive WQ indirection table points to variable size of WQs.
This table is given to a QP in downstream patches.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimerg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

A QP can be created without internal WQs "packaged" inside it,
this QP can be configured to use "external" WQ object as its
receive/send queue.

WQ is a necessary component for RSS technology since RSS mechanism
is supposed to distribute the traffic between multiple
Receive Work Queues

Receive WQs are implemented by RQs.

Implement the WQ creation, modification and destruction verbs.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

User space applications which use RSS functionality need to create
a work queue object (WQ). The lifetime of such an object is:
 * Create a WQ
 * Modify the WQ from reset to init state.
 * Use the WQ (by downstream patches).
 * Destroy the WQ.

These commands are added to the uverbs API.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@rimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Introduce Work Queue object and its create/destroy/modify verbs.

QP can be created without internal WQs "packaged" inside it,
this QP can be configured to use "external" WQ object as its
receive/send queue.
WQ is a necessary component for RSS technology since RSS mechanism
is supposed to distribute the traffic between multiple
Receive Work Queues.

WQ associated (many to one) with Completion Queue and it owns WQ
properties (PD, WQ size, etc.).
WQ has a type, this patch introduces the IB_WQT_RQ (i.e.receive queue),
it may be extend to others such as IB_WQT_SQ. (send queue).
WQ from type IB_WQT_RQ contains receive work requests.

PD is an attribute of a work queue (i.e. send/receive queue), it's used
by the hardware for security validation before scattering to a memory
region which is pointed by the WQ. For that, an external WQ object
needs a PD, letting the hardware makes that validation.

When accessing a memory region that is pointed by the WQ its PD
is used and not the QP's PD, this behavior is similar
to a SRQ and a QP.

WQ context is subject to a well-defined state transitions done by
the modify_wq verb.
When WQ is created its initial state becomes IB_WQS_RESET.
>From IB_WQS_RESET it can be modified to itself or to IB_WQS_RDY.
>From IB_WQS_RDY it can be modified to itself, to IB_WQS_RESET
or to IB_WQS_ERR.
>From IB_WQS_ERR it can be modified to IB_WQS_RESET.

Note: transition to IB_WQS_ERR might occur implicitly in case there
was some HW error.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

In order to support RSS QPs, we need to create Ethernet based objects.
This is done by create_rq, destroy_rq, create_rqt and destroy_rqt
mlx5_core functions. We export these functions.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>

Mellanox shared code between RDMA and net-next trees

This is Mellanox mlx5_core shared code for both net-next and RDMA
trees for 4.8 kernel cycle.

Pull thermal management fixes from Zhang Rui:

 - fix an ordering issue in cpu cooling that cooling device is
   registered before it's ready (freq_table being populated).
   (Lukasz Luba)

 - fix a missing comment update (Caesar Wang)

* 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  thermal: add the note for set_trip_temp
  thermal: cpu_cooling: fix improper order during initialization

Pull block layer fixes from Jens Axboe:
 "A small collection of fixes for the current series.  This contains:

   - Two fixes for xen-blkfront, from Bob Liu.

   - A bug fix for NVMe, releasing only the specific resources we
     requested.

   - Fix for a debugfs flags entry for nbd, from Josef.

   - Plug fix from Omar, fixing up a case of code being switched between
     two functions.

   - A missing bio_put() for the new discard callers of
     submit_bio_wait(), fixing a regression causing a leak of the bio.
     From Shaun.

   - Improve dirty limit calculation precision in the writeback code,
     fixing a case where setting a limit lower than 1% of memory would
     end up being zero.  From Tejun"

* 'for-linus' of git://git.kernel.dk/linux-block:
  NVMe: Only release requested regions
  xen-blkfront: fix resume issues after a migration
  xen-blkfront: don't call talk_to_blkback when already connected to blkback
  nbd: pass the nbd pointer for flags debugfs
  block: missing bio_put following submit_bio_wait
  blk-mq: really fix plug list flushing for nomerge queues
  writeback: use higher precision calculation in domain_dirty_limits()

Pull GPIO fixes from Linus Walleij:
 "A new bunch of GPIO fixes for v4.7.

  This time I am very grateful that Ricardo Ribalda Delgado went in and
  fixed my stupid refcounting mistakes in the removal path for GPIO
  chips.  I had a feeling something was wrong here and so it was.  It
  exploded on OMAP and it fixes their problem.  Now it should be (more)
  solid.

  The rest i compilation, Kconfig and driver fixes.  Some tagged for
  stable.

  Summary:

   - Fix a NULL pointer dereference when we are searching the GPIO
     device list but one of the devices have been removed (struct
     gpio_chip pointer is NULL).

   - Fix unaligned reference counters: we were ending on +3 after all
     said and done.  It should be 0.  Remove an extraneous get_device(),
     and call cdev_del() followed by device_del() in gpiochip_remove()
     instead and the count goes to zero and calls the release() function
     properly.

   - Fix a compile warning due to a missing #include in the OF/device
     tree portions.

   - Select ANON_INODES for GPIOLIB, we're using that for our character
     device.  Some randconfig tests disclosed the problem.

   - Make sure the Zynq driver clock runs also without CONFIG_PM enabled

   - Fix an off-by-one error in the 104-DIO-48E driver

   - Fix warnings in bcm_kona_gpio_reset()"

* tag 'gpio-v4.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings
  gpio: select ANON_INODES
  gpio: include <linux/io-mapping.h> in gpiolib-of
  gpiolib: Fix unaligned used of reference counters
  gpiolib: Fix NULL pointer deference
  gpio: zynq: initialize clock even without CONFIG_PM
  gpio: 104-dio-48e: Fix control port offset computation off-by-one error

Pull SCSI fixes from James Bottomley:
 "Two current fixes:

   - one affects Qemu CD ROM emulation, which stopped working after the
     updates in SCSI to require VPD pages from all conformant devices.

     Fix temporarily by blacklisting Qemu (we can relax later when they
     come into compliance).

   - The other is a fix to the optimal transfer size.  We set up a
     minefield for ourselves by being confused about whether the limits
     are in bytes or sectors (SCSI optimal is in blocks and the queue
     parameter is in bytes).

     This tries to fix the problem (wrong setting for queue limits
     max_sectors) and make the problem more obvious by introducing a
     wrapper function"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  sd: Fix rw_max for devices that report an optimal xfer size
  scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist

Pull i2c fixes from Wolfram Sang:

 - a bigger fix for i801 to finally be able to be loaded on some
   machines again

 - smaller driver fixes

 - documentation update because of a renamed file

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: mux: reg: Provide of_match_table
  i2c: mux: refer to i2c-mux.txt
  i2c: octeon: Avoid printk after too long SMBUS message
  i2c: octeon: Missing AAK flag in case of I2C_M_RECV_LEN
  i2c: i801: Allow ACPI SystemIO OpRegion to conflict with PCI BAR

Pull DeviceTree fixes from Rob Herring:

 - fix unflatten_dt_nodes when dad parameter is set.

 - add vendor prefixes for TechNexion and UniWest

 - documentation fix for Marvell BT

 - OF IRQ kerneldoc fixes

 - restrict CMA alignment adjustments to non dma-coherent

 - a couple of warning fixes in reserved-memory code

 - DT maintainers updates

* tag 'devicetree-fixes-for-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  drivers: of: add definition of early_init_dt_alloc_reserved_memory_arch
  drivers/of: Fix depth for sub-tree blob in unflatten_dt_nodes()
  drivers: of: Fix of_pci.h header guard
  dt-bindings: Add vendor prefix for TechNexion
  of: add vendor prefix for UniWest
  dt: bindings: fix documentation for MARVELL's bt-sd8xxx wireless device
  of: add missing const for of_parse_phandle_with_args() in !CONFIG_OF
  of: silence warnings due to max() usage
  drivers: of: of_reserved_mem: fixup the CMA alignment not to affect dma-coherent
  of: irq: fix of_irq_get[_byname]() kernel-doc
  MAINTAINERS: DeviceTree maintainer updates

Merge tag '20160610_uvc_compat_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux

Pull uvc compat XU ioctl fixes from Andy Lutomirski:
 "uvc's compat XU ioctls go through tons of potentially buggy
  indirection.  The first patch removes the indirection.  The second one
  cleans up the code.

  Compile-tested only.  I have the hardware, but I have absolutely no
  idea what XU does, how to use it, what software to recompile as
  32-bit, or what to test in that software"

* tag '20160610_uvc_compat_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux:
  uvc_v4l2: Simplify compat ioctl implementation
  uvc: Forward compat ioctls to their handlers directly

The uvc compat ioctl implementation seems to have copied user data
for no good reason.  Remove a bunch of copies.
Signed-off-by: Andy Lutomirski <luto@kernel.org>

The current code goes through a lot of indirection just to call a
known handler.  Simplify it: just call the handlers directly.

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@kernel.org>

Pull btrfs fixes from Chris Mason:
 "Has some fixes and some new self tests for btrfs.  The self tests are
  usually disabled in the .config file (unless you're doing btrfs dev
  work), and this bunch is meant to find problems with the 64K page size
  patches.

  Jeff has a patch to help people see if they are using the hardware
  assist crc32c module, which really helps us nail down problems when
  people ask why crcs are using so much CPU.

  Otherwise, it's small fixes"

* 'for-linus-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: self-tests: Fix extent buffer bitmap test fail on BE system
  Btrfs: self-tests: Fix test_bitmaps fail on 64k sectorsize
  Btrfs: self-tests: Use macros instead of constants and add missing newline
  Btrfs: self-tests: Support testing all possible sectorsizes and nodesizes
  Btrfs: self-tests: Execute page straddling test only when nodesize < PAGE_SIZE
  btrfs: advertise which crc32c implementation is being used at module load
  Btrfs: add validadtion checks for chunk loading
  Btrfs: add more validation checks for superblock
  Btrfs: clear uptodate flags of pages in sys_array eb
  Btrfs: self-tests: Support non-4k page size
  Btrfs: Fix integer overflow when calculating bytes_per_bitmap
  Btrfs: test_check_exists: Fix infinite loop when searching for free space entries
  Btrfs: end transaction if we abort when creating uuid root
  btrfs: Use __u64 in exported linux/btrfs.h.

Merge tag 'powerpc-4.7-3Michael Ellerman:' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from
 - ptrace: Fix out of bounds array access warning from Khem Raj
 - pseries: Fix PCI config address for DDW from Gavin Shan
 - pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added
   from Michael Ellerman
 - of: fix autoloading due to broken modalias with no 'compatible' from
   Wolfram Sang
 - radix: Fix always false comparison against MMU_NO_CONTEXT from Aneesh
   Kumar K.V
 - hash: Compute the segment size correctly for ISA 3.0 from Aneesh
   Kumar K.V
 - nohash: Fix build break with 64K pages from Michael Ellerman

* tag 'powerpc-4.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/nohash: Fix build break with 64K pages
  powerpc/mm/hash: Compute the segment size correctly for ISA 3.0
  powerpc/mm/radix: Fix always false comparison against MMU_NO_CONTEXT
  of: fix autoloading due to broken modalias with no 'compatible'
  powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added
  powerpc/pseries: Fix PCI config address for DDW
  powerpc/ptrace: Fix out of bounds array access warning

Merge tag 'hwmon-for-linus-v4.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - fix regression in fam15h_power driver

 - minor variable type fix in lm90 driver

 - document compatible statement for ina2xx driver

* tag 'hwmon-for-linus-v4.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (lm90) use proper type for update_interval
  hwmon: (ina2xx) Document compatible for INA231
  hwmon: (fam15h_power) Disable preemption when reading registers

Merge filesystem stacking fixes from Jann Horn.

* emailed patches from Jann Horn <jannh@google.com>:
  sched: panic on corrupted stack end
  ecryptfs: forbid opening files without mmap handler
  proc: prevent stacking filesystems on top

Until now, hitting this BUG_ON caused a recursive oops (because oops
handling involves do_exit(), which calls into the scheduler, which in
turn raises an oops), which caused stuff below the stack to be
overwritten until a panic happened (e.g.  via an oops in interrupt
context, caused by the overwritten CPU index in the thread_info).

Just panic directly.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This prevents users from triggering a stack overflow through a recursive
invocation of pagefault handling that involves mapping procfs files into
virtual memory.
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This prevents stacking filesystems (ecryptfs and overlayfs) from using
procfs as lower filesystem.  There is too much magic going on inside
procfs, and there is no good reason to stack stuff on top of procfs.

(For example, procfs does access checks in VFS open handlers, and
ecryptfs by design calls open handlers from a kernel thread that doesn't
drop privileges or so.)
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>