1. 15 Feb, 2018 14 commits
    • AMAN DEEP's avatar
      usb: ohci: Proper handling of ed_rm_list to handle race condition between... · 46408ea5
      AMAN DEEP authored
      usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()
      
      There is a race condition between finish_unlinks->finish_urb() function
      and usb_kill_urb() in ohci controller case. The finish_urb calls
      spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call,
      then if during this time, usb_kill_urb is called for another endpoint,
      then new ed will be added to ed_rm_list at beginning for unlink, and
      ed_rm_list will point to newly added.
      
      When finish_urb() is completed in finish_unlinks() and ed->td_list
      becomes empty as in below code (in finish_unlinks() function):
      
              if (list_empty(&ed->td_list)) {
                      *last = ed->ed_next;
                      ed->ed_next = NULL;
              } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                      *last = ed->ed_next;
                      ed->ed_next = NULL;
                      ed_schedule(ohci, ed);
              }
      
      The *last = ed->ed_next will make ed_rm_list to point to ed->ed_next
      and previously added ed by usb_kill_urb will be left unreferenced by
      ed_rm_list. This causes usb_kill_urb() hang forever waiting for
      finish_unlink to remove added ed from ed_rm_list.
      
      The main reason for hang in this race condtion is addition and removal
      of ed from ed_rm_list in the beginning during usb_kill_urb and later
      last* is modified in finish_unlinks().
      
      As suggested by Alan Stern, the solution for proper handling of
      ohci->ed_rm_list is to remove ed from the ed_rm_list before finishing
      any URBs. Then at the end, we can add ed back to the list if necessary.
      
      This properly handle the updated ohci->ed_rm_list in usb_kill_urb().
      
      Fixes: 977dcfdc ("USB: OHCI: don't lose track of EDs when a controller dies")
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarAman Deep <aman.deep@samsung.com>
      Signed-off-by: default avatarJeffy Chen <jeffy.chen@rock-chips.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      46408ea5
    • Peter Chen's avatar
      usb: host: ehci: always enable interrupt for qtd completion at test mode · 91b11935
      Peter Chen authored
      At former code, the SETUP stage does not enable interrupt
      for qtd completion, it relies on IAA watchdog to complete
      interrupt, then the transcation would be considered timeout
      if the flag need_io_watchdog is cleared by platform code.
      
      In this commit, we always add enable interrupt for qtd completion,
      then the qtd completion can be notified by hardware interrupt.
      Signed-off-by: default avatarPeter Chen <peter.chen@nxp.com>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      91b11935
    • Karsten Koop's avatar
      usb: ldusb: add PIDs for new CASSY devices supported by this driver · 52ad2bd8
      Karsten Koop authored
      This patch adds support for new CASSY devices to the ldusb driver. The
      PIDs are also added to the ignore list in hid-quirks.
      Signed-off-by: default avatarKarsten Koop <kkoop@ld-didactic.de>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      52ad2bd8
    • Yoshihiro Shimoda's avatar
      usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path · d6efa938
      Yoshihiro Shimoda authored
      This fixes an issue that a gadget driver (usb_f_fs) is possible to
      stop rx transactions after the usb-dmac is used because the following
      functions missed to set/check the "running" flag.
       - usbhsf_dma_prepare_pop_with_usb_dmac()
       - usbhsf_dma_pop_done_with_usb_dmac()
      
      So, if next transaction uses pio, the usbhsf_prepare_pop() can not
      start the transaction because the "running" flag is 0.
      
      Fixes: 8355b2b3 ("usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle")
      Cc: <stable@vger.kernel.org> # v3.19+
      Signed-off-by: default avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d6efa938
    • Peter Chen's avatar
      usb: host: ehci: use correct device pointer for dma ops · 02a10f06
      Peter Chen authored
      commit a8c06e40 ("usb: separate out sysdev pointer from usb_bus")
      converted to use hcd->self.sysdev for DMA operations instead of
      hcd->self.controller, but forgot to do it for hcd test mode. Replace
      the correct one in this commit.
      
      Fixes: a8c06e40 ("usb: separate out sysdev pointer from usb_bus")
      Signed-off-by: default avatarPeter Chen <peter.chen@nxp.com>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      02a10f06
    • Shuah Khan's avatar
      usbip: keep usbip_device sockfd state in sync with tcp_socket · 009f41ae
      Shuah Khan authored
      Keep usbip_device sockfd state in sync with tcp_socket. When tcp_socket
      is reset to null, reset sockfd to -1 to keep it in sync.
      Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      009f41ae
    • Shigeru Yoshida's avatar
      ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() · b2685bda
      Shigeru Yoshida authored
      Running io_watchdog_func() while ohci_urb_enqueue() is running can
      cause a race condition where ohci->prev_frame_no is corrupted and the
      watchdog can mis-detect following error:
      
        ohci-platform 664a0800.usb: frame counter not updating; disabled
        ohci-platform 664a0800.usb: HC died; cleaning up
      
      Specifically, following scenario causes a race condition:
      
        1. ohci_urb_enqueue() calls spin_lock_irqsave(&ohci->lock, flags)
           and enters the critical section
        2. ohci_urb_enqueue() calls timer_pending(&ohci->io_watchdog) and it
           returns false
        3. ohci_urb_enqueue() sets ohci->prev_frame_no to a frame number
           read by ohci_frame_no(ohci)
        4. ohci_urb_enqueue() schedules io_watchdog_func() with mod_timer()
        5. ohci_urb_enqueue() calls spin_unlock_irqrestore(&ohci->lock,
           flags) and exits the critical section
        6. Later, ohci_urb_enqueue() is called
        7. ohci_urb_enqueue() calls spin_lock_irqsave(&ohci->lock, flags)
           and enters the critical section
        8. The timer scheduled on step 4 expires and io_watchdog_func() runs
        9. io_watchdog_func() calls spin_lock_irqsave(&ohci->lock, flags)
           and waits on it because ohci_urb_enqueue() is already in the
           critical section on step 7
       10. ohci_urb_enqueue() calls timer_pending(&ohci->io_watchdog) and it
           returns false
       11. ohci_urb_enqueue() sets ohci->prev_frame_no to new frame number
           read by ohci_frame_no(ohci) because the frame number proceeded
           between step 3 and 6
       12. ohci_urb_enqueue() schedules io_watchdog_func() with mod_timer()
       13. ohci_urb_enqueue() calls spin_unlock_irqrestore(&ohci->lock,
           flags) and exits the critical section, then wake up
           io_watchdog_func() which is waiting on step 9
       14. io_watchdog_func() enters the critical section
       15. io_watchdog_func() calls ohci_frame_no(ohci) and set frame_no
           variable to the frame number
       16. io_watchdog_func() compares frame_no and ohci->prev_frame_no
      
      On step 16, because this calling of io_watchdog_func() is scheduled on
      step 4, the frame number set in ohci->prev_frame_no is expected to the
      number set on step 3.  However, ohci->prev_frame_no is overwritten on
      step 11.  Because step 16 is executed soon after step 11, the frame
      number might not proceed, so ohci->prev_frame_no must equals to
      frame_no.
      
      To address above scenario, this patch introduces a special sentinel
      value IO_WATCHDOG_OFF and set this value to ohci->prev_frame_no when
      the watchdog is not pending or running.  When ohci_urb_enqueue()
      schedules the watchdog (step 4 and 12 above), it compares
      ohci->prev_frame_no to IO_WATCHDOG_OFF so that ohci->prev_frame_no is
      not overwritten while io_watchdog_func() is running.
      Signed-off-by: default avatarShigeru Yoshida <Shigeru.Yoshida@windriver.com>
      Signed-off-by: default avatarHaiqing Bai <Haiqing.Bai@windriver.com>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b2685bda
    • Kristian Evensen's avatar
      USB: serial: option: Add support for Quectel EP06 · 71a0483d
      Kristian Evensen authored
      The Quectel EP06 is a Cat. 6 LTE modem, and the interface mapping is as
      follows:
      
      0: Diag
      1: NMEA
      2: AT
      3: Modem
      
      Interface 4 is QMI and interface 5 is ADB, so they are blacklisted.
      
      This patch should also be considered for -stable. The QMI-patch for this
      modem is already in the -stable-queue.
      
      v1->v2:
      * Updated commit prefix (thanks Johan Hovold)
      * Updated commit message slightly.
      Signed-off-by: default avatarKristian Evensen <kristian.evensen@gmail.com>
      Acked-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      71a0483d
    • Zhengjun Xing's avatar
      xhci: fix xhci debugfs errors in xhci_stop · 11cd764d
      Zhengjun Xing authored
      In function xhci_stop, xhci_debugfs_exit called before xhci_mem_cleanup.
      xhci_debugfs_exit removed the xhci debugfs root nodes, xhci_mem_cleanup
      called function xhci_free_virt_devices_depth_first which in turn called
      function xhci_debugfs_remove_slot.
      Function xhci_debugfs_remove_slot removed the nodes for devices, the nodes
      folders are sub folder of xhci debugfs.
      
      It is unreasonable to remove xhci debugfs root folder before
      xhci debugfs sub folder. Function xhci_mem_cleanup should be called
      before function xhci_debugfs_exit.
      
      Fixes: 02b6fdc2 ("usb: xhci: Add debugfs interface for xHCI driver")
      Cc: <stable@vger.kernel.org> # v4.15
      Signed-off-by: default avatarZhengjun Xing <zhengjun.xing@linux.intel.com>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      11cd764d
    • Zhengjun Xing's avatar
      xhci: xhci debugfs device nodes weren't removed after device plugged out · 8c5a93eb
      Zhengjun Xing authored
      There is a bug after plugged out USB device, the device and its ep00
      nodes are still kept, we need to remove the nodes in xhci_free_dev when
      USB device is plugged out.
      
      Fixes: 052f71e2 ("xhci: Fix xhci debugfs NULL pointer dereference in resume from hibernate")
      Cc: <stable@vger.kernel.org> # v4.15
      Signed-off-by: default avatarZhengjun Xing <zhengjun.xing@linux.intel.com>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8c5a93eb
    • Zhengjun Xing's avatar
      xhci: Fix xhci debugfs devices node disappearance after hibernation · d9167671
      Zhengjun Xing authored
      During system resume from hibernation, xhci host is reset, all the
      nodes in devices folder are removed in xhci_mem_cleanup function.
      Later nodes in /sys/kernel/debug/usb/xhci/* are created again in
      function xhci_run, but the nodes already exist, so the nodes still
      keep the old ones, finally device nodes in xhci debugfs folder
      /sys/kernel/debug/usb/xhci/*/devices/* are disappeared.
      
      This fix removed xhci debugfs nodes before the nodes are re-created,
      so all the nodes in xhci debugfs can be re-created successfully.
      
      Fixes: 02b6fdc2 ("usb: xhci: Add debugfs interface for xHCI driver")
      Cc: <stable@vger.kernel.org> # v4.15
      Signed-off-by: default avatarZhengjun Xing <zhengjun.xing@linux.intel.com>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d9167671
    • Zhengjun Xing's avatar
      xhci: Fix NULL pointer in xhci debugfs · fa2dfd0e
      Zhengjun Xing authored
      Commit dde63405 ("xhci: Fix use-after-free in xhci debugfs") causes a
      null pointer dereference while fixing xhci-debugfs usage of ring pointers
      that were freed during hibernate.
      
      The fix passed addresses to ring pointers instead, but forgot to do this
      change for the xhci_ring_trb_show function.
      
      The address of the ring pointer passed to xhci-debugfs was of a temporary
      ring pointer "new_ring" instead of the actual ring "ring" pointer. The
      temporary new_ring pointer will be set to NULL later causing the NULL
      pointer dereference.
      
      This issue was seen when reading xhci related files in debugfs:
      
      cat /sys/kernel/debug/usb/xhci/*/devices/*/ep*/trbs
      
      [  184.604861] BUG: unable to handle kernel NULL pointer dereference at (null)
      [  184.613776] IP: xhci_ring_trb_show+0x3a/0x890
      [  184.618733] PGD 264193067 P4D 264193067 PUD 263238067 PMD 0
      [  184.625184] Oops: 0000 [#1] SMP
      [  184.726410] RIP: 0010:xhci_ring_trb_show+0x3a/0x890
      [  184.731944] RSP: 0018:ffffba8243c0fd90 EFLAGS: 00010246
      [  184.737880] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000295d6
      [  184.746020] RDX: 00000000000295d5 RSI: 0000000000000001 RDI: ffff971a6418d400
      [  184.754121] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
      [  184.762222] R10: ffff971a64c98a80 R11: ffff971a62a00e40 R12: ffff971a62a85500
      [  184.770325] R13: 0000000000020000 R14: ffff971a6418d400 R15: ffff971a6418d400
      [  184.778448] FS:  00007fe725a79700(0000) GS:ffff971a6ec00000(0000) knlGS:0000000000000000
      [  184.787644] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  184.794168] CR2: 0000000000000000 CR3: 000000025f365005 CR4: 00000000003606f0
      [  184.802318] Call Trace:
      [  184.805094]  ? seq_read+0x281/0x3b0
      [  184.809068]  seq_read+0xeb/0x3b0
      [  184.812735]  full_proxy_read+0x4d/0x70
      [  184.817007]  __vfs_read+0x23/0x120
      [  184.820870]  vfs_read+0x91/0x130
      [  184.824538]  SyS_read+0x42/0x90
      [  184.828106]  entry_SYSCALL_64_fastpath+0x1a/0x7d
      
      Fixes: dde63405 ("xhci: Fix use-after-free in xhci debugfs")
      Cc: <stable@vger.kernel.org> # v4.15
      Signed-off-by: default avatarZhengjun Xing <zhengjun.xing@linux.intel.com>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      fa2dfd0e
    • Mathias Nyman's avatar
      xhci: Don't print a warning when setting link state for disabled ports · 1208d8a8
      Mathias Nyman authored
      When disabling a USB3 port the hub driver will set the port link state to
      U3 to prevent "ejected" or "safely removed" devices that are still
      physically connected from immediately re-enumerating.
      
      If the device was really unplugged, then error messages were printed
      as the hub tries to set the U3 link state for a port that is no longer
      enabled.
      
      xhci-hcd ee000000.usb: Cannot set link state.
      usb usb8-port1: cannot disable (err = -32)
      
      Don't print error message in xhci-hub if hub tries to set port link state
      for a disabled port. Return -ENODEV instead which also silences hub driver.
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Tested-by: default avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1208d8a8
    • Joe Lee's avatar
      xhci: workaround for AMD Promontory disabled ports wakeup · bde0716d
      Joe Lee authored
      For AMD Promontory xHCI host, although you can disable USB ports in
      BIOS settings, those ports will be enabled anyway after you remove a
      device on that port and re-plug it in again. It's a known limitation of
      the chip. As a workaround we can clear the PORT_WAKE_BITS.
      
      [commit and code comment rephrasing -Mathias]
      Signed-off-by: default avatarJoe Lee <asmt.swfae@gmail.com>
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      bde0716d
  2. 11 Feb, 2018 9 commits
    • Linus Torvalds's avatar
      Linux 4.16-rc1 · 7928b2cb
      Linus Torvalds authored
      7928b2cb
    • Al Viro's avatar
      unify {de,}mangle_poll(), get rid of kernel-side POLL... · 7a163b21
      Al Viro authored
      except, again, POLLFREE and POLL_BUSY_LOOP.
      
      With this, we finally get to the promised end result:
      
       - POLL{IN,OUT,...} are plain integers and *not* in __poll_t, so any
         stray instances of ->poll() still using those will be caught by
         sparse.
      
       - eventpoll.c and select.c warning-free wrt __poll_t
      
       - no more kernel-side definitions of POLL... - userland ones are
         visible through the entire kernel (and used pretty much only for
         mangle/demangle)
      
       - same behavior as after the first series (i.e. sparc et.al. epoll(2)
         working correctly).
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7a163b21
    • Linus Torvalds's avatar
      vfs: do bulk POLL* -> EPOLL* replacement · a9a08845
      Linus Torvalds authored
      This is the mindless scripted replacement of kernel use of POLL*
      variables as described by Al, done by this script:
      
          for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
              L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
              for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
          done
      
      with de-mangling cleanups yet to come.
      
      NOTE! On almost all architectures, the EPOLL* constants have the same
      values as the POLL* constants do.  But they keyword here is "almost".
      For various bad reasons they aren't the same, and epoll() doesn't
      actually work quite correctly in some cases due to this on Sparc et al.
      
      The next patch from Al will sort out the final differences, and we
      should be all done.
      Scripted-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a9a08845
    • Linus Torvalds's avatar
      Merge branch 'work.poll2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · ee5daa13
      Linus Torvalds authored
      Pull more poll annotation updates from Al Viro:
       "This is preparation to solving the problems you've mentioned in the
        original poll series.
      
        After this series, the kernel is ready for running
      
            for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
                  L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
                  for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
            done
      
        as a for bulk search-and-replace.
      
        After that, the kernel is ready to apply the patch to unify
        {de,}mangle_poll(), and then get rid of kernel-side POLL... uses
        entirely, and we should be all done with that stuff.
      
        Basically, that's what you suggested wrt KPOLL..., except that we can
        use EPOLL... instead - they already are arch-independent (and equal to
        what is currently kernel-side POLL...).
      
        After the preparations (in this series) switch to returning EPOLL...
        from ->poll() instances is completely mechanical and kernel-side
        POLL... can go away. The last step (killing kernel-side POLL... and
        unifying {de,}mangle_poll() has to be done after the
        search-and-replace job, since we need userland-side POLL... for
        unified {de,}mangle_poll(), thus the cherry-pick at the last step.
      
        After that we will have:
      
         - POLL{IN,OUT,...} *not* in __poll_t, so any stray instances of
           ->poll() still using those will be caught by sparse.
      
         - eventpoll.c and select.c warning-free wrt __poll_t
      
         - no more kernel-side definitions of POLL... - userland ones are
           visible through the entire kernel (and used pretty much only for
           mangle/demangle)
      
         - same behavior as after the first series (i.e. sparc et.al. epoll(2)
           working correctly)"
      
      * 'work.poll2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        annotate ep_scan_ready_list()
        ep_send_events_proc(): return result via esed->res
        preparation to switching ->poll() to returning EPOLL...
        add EPOLLNVAL, annotate EPOLL... and event_poll->event
        use linux/poll.h instead of asm/poll.h
        xen: fix poll misannotation
        smc: missing poll annotations
      ee5daa13
    • Linus Torvalds's avatar
      Merge tag 'xtensa-20180211' of git://github.com/jcmvbkbc/linux-xtensa · 3fc928dc
      Linus Torvalds authored
      Pull xtense fix from Max Filippov:
       "Build fix for xtensa architecture with KASAN enabled"
      
      * tag 'xtensa-20180211' of git://github.com/jcmvbkbc/linux-xtensa:
        xtensa: fix build with KASAN
      3fc928dc
    • Linus Torvalds's avatar
      Merge tag 'nios2-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 · 60d7a21a
      Linus Torvalds authored
      Pull nios2 update from Ley Foon Tan:
      
       - clean up old Kconfig options from defconfig
      
       - remove leading 0x and 0s from bindings notation in dts files
      
      * tag 'nios2-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2:
        nios2: defconfig: Cleanup from old Kconfig options
        nios2: dts: Remove leading 0x and 0s from bindings notation
      60d7a21a
    • Max Filippov's avatar
      xtensa: fix build with KASAN · f8d0cbf2
      Max Filippov authored
      The commit 917538e2 ("kasan: clean up KASAN_SHADOW_SCALE_SHIFT
      usage") removed KASAN_SHADOW_SCALE_SHIFT definition from
      include/linux/kasan.h and added it to architecture-specific headers,
      except for xtensa. This broke the xtensa build with KASAN enabled.
      Define KASAN_SHADOW_SCALE_SHIFT in arch/xtensa/include/asm/kasan.h
      
      Reported by: kbuild test robot <fengguang.wu@intel.com>
      Fixes: 917538e2 ("kasan: clean up KASAN_SHADOW_SCALE_SHIFT usage")
      Acked-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      f8d0cbf2
    • Krzysztof Kozlowski's avatar
      nios2: defconfig: Cleanup from old Kconfig options · e0691ebb
      Krzysztof Kozlowski authored
      Remove old, dead Kconfig option INET_LRO. It is gone since
      commit 7bbf3cae ("ipv4: Remove inet_lro library").
      Signed-off-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
      Acked-by: default avatarLey Foon Tan <ley.foon.tan@intel.com>
      e0691ebb
    • Mathieu Malaterre's avatar
      nios2: dts: Remove leading 0x and 0s from bindings notation · 5d13c731
      Mathieu Malaterre authored
      Improve the DTS files by removing all the leading "0x" and zeros to fix the
      following dtc warnings:
      
      Warning (unit_address_format): Node /XXX unit name should not have leading "0x"
      
      and
      
      Warning (unit_address_format): Node /XXX unit name should not have leading 0s
      
      Converted using the following command:
      
      find . -type f \( -iname *.dts -o -iname *.dtsi \) -exec sed -E -i -e "s/@0x([0-9a-fA-F\.]+)\s?\{/@\L\1 \{/g" -e "s/@0+([0-9a-fA-F\.]+)\s?\{/@\L\1 \{/g" {} +
      
      For simplicity, two sed expressions were used to solve each warnings separately.
      
      To make the regex expression more robust a few other issues were resolved,
      namely setting unit-address to lower case, and adding a whitespace before the
      the opening curly brace:
      
      https://elinux.org/Device_Tree_Linux#Linux_conventions
      
      This is a follow up to commit 4c9847b7 ("dt-bindings: Remove leading 0x from bindings notation")
      Reported-by: default avatarDavid Daney <ddaney@caviumnetworks.com>
      Suggested-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarMathieu Malaterre <malat@debian.org>
      Acked-by: default avatarLey Foon Tan <ley.foon.tan@intel.com>
      5d13c731
  3. 10 Feb, 2018 14 commits
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.16-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · d48fcbd8
      Linus Torvalds authored
      Pull PCI fix from Bjorn Helgaas:
       "Fix a POWER9/powernv INTx regression from the merge window (Alexey
        Kardashevskiy)"
      
      * tag 'pci-v4.16-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        powerpc/pci: Fix broken INTx configuration via OF
      d48fcbd8
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20180210' of git://git.kernel.dk/linux-block · 9454473c
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A few fixes to round off the merge window on the block side:
      
         - a set of bcache fixes by way of Michael Lyle, from the usual bcache
           suspects.
      
         - add a simple-to-hook-into function for bpf EIO error injection.
      
         - fix blk-wbt that mischarectized flushes as reads. Improve the logic
           so that flushes and writes are accounted as writes, and only reads
           as reads. From me.
      
         - fix requeue crash in BFQ, from Paolo"
      
      * tag 'for-linus-20180210' of git://git.kernel.dk/linux-block:
        block, bfq: add requeue-request hook
        bcache: fix for data collapse after re-attaching an attached device
        bcache: return attach error when no cache set exist
        bcache: set writeback_rate_update_seconds in range [1, 60] seconds
        bcache: fix for allocator and register thread race
        bcache: set error_limit correctly
        bcache: properly set task state in bch_writeback_thread()
        bcache: fix high CPU occupancy during journal
        bcache: add journal statistic
        block: Add should_fail_bio() for bpf error injection
        blk-wbt: account flush requests correctly
      9454473c
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v4.16-3' of git://github.com/dvhart/linux-pdx86 · cc5cb5af
      Linus Torvalds authored
      Pull x86 platform driver updates from Darren Hart:
       "Mellanox fixes and new system type support.
      
        Mostly data for new system types with a correction and an
        uninitialized variable fix"
      
      [ Pulling from github because git.infradead.org currently seems to be
        down for some reason, but Darren had a backup location    - Linus ]
      
      * tag 'platform-drivers-x86-v4.16-3' of git://github.com/dvhart/linux-pdx86:
        platform/x86: mlx-platform: Add support for new 200G IB and Ethernet systems
        platform/x86: mlx-platform: Add support for new msn201x system type
        platform/x86: mlx-platform: Add support for new msn274x system type
        platform/x86: mlx-platform: Fix power cable setting for msn21xx family
        platform/x86: mlx-platform: Add define for the negative bus
        platform/x86: mlx-platform: Use defines for bus assignment
        platform/mellanox: mlxreg-hotplug: Fix uninitialized variable
      cc5cb5af
    • Linus Torvalds's avatar
      Merge tag 'chrome-platform-for-linus-4.16' of... · e9d46f74
      Linus Torvalds authored
      Merge tag 'chrome-platform-for-linus-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform
      
      Pull chrome platform updates from Benson Leung:
      
       - move cros_ec_dev to drivers/mfd
      
       - other small maintenance fixes
      
      [ The cros_ec_dev movement came in earlier through the MFD tree  - Linus ]
      
      * tag 'chrome-platform-for-linus-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform:
        platform/chrome: Use proper protocol transfer function
        platform/chrome: cros_ec_lpc: Add support for Google Glimmer
        platform/chrome: cros_ec_lpc: Register the driver if ACPI entry is missing.
        platform/chrome: cros_ec_lpc: remove redundant pointer request
        cros_ec: fix nul-termination for firmware build info
        platform/chrome: chromeos_laptop: make chromeos_laptop const
      e9d46f74
    • Linus Torvalds's avatar
      Merge tag 'kvm-4.16-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 15303ba5
      Linus Torvalds authored
      Pull KVM updates from Radim Krčmář:
       "ARM:
      
         - icache invalidation optimizations, improving VM startup time
      
         - support for forwarded level-triggered interrupts, improving
           performance for timers and passthrough platform devices
      
         - a small fix for power-management notifiers, and some cosmetic
           changes
      
        PPC:
      
         - add MMIO emulation for vector loads and stores
      
         - allow HPT guests to run on a radix host on POWER9 v2.2 CPUs without
           requiring the complex thread synchronization of older CPU versions
      
         - improve the handling of escalation interrupts with the XIVE
           interrupt controller
      
         - support decrement register migration
      
         - various cleanups and bugfixes.
      
        s390:
      
         - Cornelia Huck passed maintainership to Janosch Frank
      
         - exitless interrupts for emulated devices
      
         - cleanup of cpuflag handling
      
         - kvm_stat counter improvements
      
         - VSIE improvements
      
         - mm cleanup
      
        x86:
      
         - hypervisor part of SEV
      
         - UMIP, RDPID, and MSR_SMI_COUNT emulation
      
         - paravirtualized TLB shootdown using the new KVM_VCPU_PREEMPTED bit
      
         - allow guests to see TOPOEXT, GFNI, VAES, VPCLMULQDQ, and more
           AVX512 features
      
         - show vcpu id in its anonymous inode name
      
         - many fixes and cleanups
      
         - per-VCPU MSR bitmaps (already merged through x86/pti branch)
      
         - stable KVM clock when nesting on Hyper-V (merged through
           x86/hyperv)"
      
      * tag 'kvm-4.16-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (197 commits)
        KVM: PPC: Book3S: Add MMIO emulation for VMX instructions
        KVM: PPC: Book3S HV: Branch inside feature section
        KVM: PPC: Book3S HV: Make HPT resizing work on POWER9
        KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code
        KVM: PPC: Book3S PR: Fix broken select due to misspelling
        KVM: x86: don't forget vcpu_put() in kvm_arch_vcpu_ioctl_set_sregs()
        KVM: PPC: Book3S PR: Fix svcpu copying with preemption enabled
        KVM: PPC: Book3S HV: Drop locks before reading guest memory
        kvm: x86: remove efer_reload entry in kvm_vcpu_stat
        KVM: x86: AMD Processor Topology Information
        x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
        kvm: embed vcpu id to dentry of vcpu anon inode
        kvm: Map PFN-type memory regions as writable (if possible)
        x86/kvm: Make it compile on 32bit and with HYPYERVISOR_GUEST=n
        KVM: arm/arm64: Fixup userspace irqchip static key optimization
        KVM: arm/arm64: Fix userspace_irqchip_in_use counting
        KVM: arm/arm64: Fix incorrect timer_is_pending logic
        MAINTAINERS: update KVM/s390 maintainers
        MAINTAINERS: add Halil as additional vfio-ccw maintainer
        MAINTAINERS: add David as a reviewer for KVM/s390
        ...
      15303ba5
    • Alexey Kardashevskiy's avatar
      powerpc/pci: Fix broken INTx configuration via OF · c591c2e3
      Alexey Kardashevskiy authored
      59f47eff ("powerpc/pci: Use of_irq_parse_and_map_pci() helper")
      replaced of_irq_parse_pci() + irq_create_of_mapping() with
      of_irq_parse_and_map_pci(), but neglected to capture the virq
      returned by irq_create_of_mapping(), so virq remained zero, which
      caused INTx configuration to fail.
      
      Save the virq value returned by of_irq_parse_and_map_pci() and correct
      the virq declaration to match the of_irq_parse_and_map_pci() signature.
      
      Fixes: 59f47eff "powerpc/pci: Use of_irq_parse_and_map_pci() helper"
      Signed-off-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
      [bhelgaas: changelog]
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      c591c2e3
    • Linus Torvalds's avatar
      Merge tag 'kbuild-v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild · 9a61df9e
      Linus Torvalds authored
      Pull more Kbuild updates from Masahiro Yamada:
       "Makefile changes:
         - enable unused-variable warning that was wrongly disabled for clang
      
        Kconfig changes:
         - warn about blank 'help' and fix existing instances
         - fix 'choice' behavior to not write out invisible symbols
         - fix misc weirdness
      
        Coccinell changes:
         - fix false positive of free after managed memory alloc detection
         - improve performance of NULL dereference detection"
      
      * tag 'kbuild-v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (21 commits)
        kconfig: remove const qualifier from sym_expand_string_value()
        kconfig: add xrealloc() helper
        kconfig: send error messages to stderr
        kconfig: echo stdin to stdout if either is redirected
        kconfig: remove check_stdin()
        kconfig: remove 'config*' pattern from .gitignnore
        kconfig: show '?' prompt even if no help text is available
        kconfig: do not write choice values when their dependency becomes n
        coccinelle: deref_null: avoid useless computation
        coccinelle: devm_free: reduce false positives
        kbuild: clang: disable unused variable warnings only when constant
        kconfig: Warn if help text is blank
        nios2: kconfig: Remove blank help text
        arm: vt8500: kconfig: Remove blank help text
        MIPS: kconfig: Remove blank help text
        MIPS: BCM63XX: kconfig: Remove blank help text
        lib/Kconfig.debug: Remove blank help text
        Staging: rtl8192e: kconfig: Remove blank help text
        Staging: rtl8192u: kconfig: Remove blank help text
        mmc: kconfig: Remove blank help text
        ...
      9a61df9e
    • Al Viro's avatar
      7a501609
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 878e66d0
      Linus Torvalds authored
      Pull misc vfs fixes from Al Viro.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        seq_file: fix incomplete reset on read from zero offset
        kernfs: fix regression in kernfs_fop_write caused by wrong type
      878e66d0
    • Masahiro Yamada's avatar
      kconfig: remove const qualifier from sym_expand_string_value() · 523ca58b
      Masahiro Yamada authored
      This function returns realloc'ed memory, so the returned pointer
      must be passed to free() when done.  So, 'const' qualifier is odd.
      It is allowed to modify the expanded string.
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      523ca58b
    • Masahiro Yamada's avatar
      kconfig: add xrealloc() helper · d717f24d
      Masahiro Yamada authored
      We already have xmalloc(), xcalloc().  Add xrealloc() as well
      to save tedious error handling.
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      d717f24d
    • Vadim Pasternak's avatar
      platform/x86: mlx-platform: Add support for new 200G IB and Ethernet systems · 1bd42d94
      Vadim Pasternak authored
      It adds support for new Mellanox system types of basic classes qmb7, sn34,
      sn37, containing systems QMB700 (40x200GbE InfiniBand switch), SN3700
      (32x200GbE and 16x400GbE Ethernet switch) and SN3410 (6x400GbE plus
      48x50GbE Ethernet switch). These are the Top of the Rack systems, equipped
      with Mellanox COM-Express carrier board and switch board with Mellanox
      Quantum device, which supports InfiniBand switching with 40X200G ports and
      line rate of up to HDR speed or with Mellanox Spectrum-2 device, which
      supports Ethernet switching with 32X200G ports line rate of up to HDR
      speed.
      Signed-off-by: default avatarVadim Pasternak <vadimp@mellanox.com>
      Signed-off-by: default avatarDarren Hart (VMware) <dvhart@infradead.org>
      1bd42d94
    • Vadim Pasternak's avatar
      platform/x86: mlx-platform: Add support for new msn201x system type · a49a4148
      Vadim Pasternak authored
      It adds support for new Mellanox system types of basic half unit size
      class msn201x, containing system MSN2010 (18x10GbE plus 4x4x25GbE) half
      and its derivatives. This is the Top of the Rack system, equipped with
      Mellanox Small Form Factor carrier board and switch board with Mellanox
      Spectrum device, which supports Ethernet switching with 32X100G ports line
      rate of up to EDR speed.
      Signed-off-by: default avatarVadim Pasternak <vadimp@mellanox.com>
      Signed-off-by: default avatarDarren Hart (VMware) <dvhart@infradead.org>
      a49a4148
    • Vadim Pasternak's avatar
      platform/x86: mlx-platform: Add support for new msn274x system type · ef08e14a
      Vadim Pasternak authored
      It adds support for new Mellanox system types of basic class msn274x,
      containing system MSN2740 (32x100GbE Ethernet switch with cost reduction)
      and its derivatives. These are the Top of the Rack system, equipped with
      Mellanox Small Form Factor carrier board and switch board with Mellanox
      Spectrum device, which supports Ethernet switching with 32X100G ports line
      rate of up to EDR speed.
      Signed-off-by: default avatarVadim Pasternak <vadimp@mellanox.com>
      Signed-off-by: default avatarDarren Hart (VMware) <dvhart@infradead.org>
      ef08e14a
  4. 09 Feb, 2018 3 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c839682c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Make allocations less aggressive in x_tables, from Minchal Hocko.
      
       2) Fix netfilter flowtable Kconfig deps, from Pablo Neira Ayuso.
      
       3) Fix connection loss problems in rtlwifi, from Larry Finger.
      
       4) Correct DRAM dump length for some chips in ath10k driver, from Yu
          Wang.
      
       5) Fix ABORT handling in rxrpc, from David Howells.
      
       6) Add SPDX tags to Sun networking drivers, from Shannon Nelson.
      
       7) Some ipv6 onlink handling fixes, from David Ahern.
      
       8) Netem packet scheduler interval calcualtion fix from Md. Islam.
      
       9) Don't put crypto buffers on-stack in rxrpc, from David Howells.
      
      10) Fix handling of error non-delivery status in netlink multicast
          delivery over multiple namespaces, from Nicolas Dichtel.
      
      11) Missing xdp flush in tuntap driver, from Jason Wang.
      
      12) Synchonize RDS protocol netns/module teardown with rds object
          management, from Sowini Varadhan.
      
      13) Add nospec annotations to mpls, from Dan Williams.
      
      14) Fix SKB truesize handling in TIPC, from Hoang Le.
      
      15) Interrupt masking fixes in stammc from Niklas Cassel.
      
      16) Don't allow ptr_ring objects to be sized outside of kmalloc's
          limits, from Jason Wang.
      
      17) Don't allow SCTP chunks to be built which will have a length
          exceeding the chunk header's 16-bit length field, from Alexey
          Kodanev.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (82 commits)
        ibmvnic: Remove skb->protocol checks in ibmvnic_xmit
        bpf: fix rlimit in reuseport net selftest
        sctp: verify size of a new chunk in _sctp_make_chunk()
        s390/qeth: fix SETIP command handling
        s390/qeth: fix underestimated count of buffer elements
        ptr_ring: try vmalloc() when kmalloc() fails
        ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
        net: stmmac: remove redundant enable of PMT irq
        net: stmmac: rename GMAC_INT_DEFAULT_MASK for dwmac4
        net: stmmac: discard disabled flags in interrupt status register
        ibmvnic: Reset long term map ID counter
        tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
        selftests/bpf: add selftest that use test_libbpf_open
        selftests/bpf: add test program for loading BPF ELF files
        tools/libbpf: improve the pr_debug statements to contain section numbers
        bpf: Sync kernel ABI header with tooling header for bpf_common.h
        net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
        net: thunder: change q_len's type to handle max ring size
        tipc: fix skb truesize/datasize ratio control
        net/sched: cls_u32: fix cls_u32 on filter replace
        ...
      c839682c
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.16-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 82f0a41e
      Linus Torvalds authored
      Pull more NFS client updates from Trond Myklebust:
       "A few bugfixes and some small sunrpc latency/performance improvements
        before the merge window closes:
      
        Stable fixes:
      
         - fix an incorrect calculation of the RDMA send scatter gather
           element limit
      
         - fix an Oops when attempting to free resources after RDMA device
           removal
      
        Bugfixes:
      
         - SUNRPC: Ensure we always release the TCP socket in a timely fashion
           when the connection is shut down.
      
         - SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context
      
        Latency/Performance:
      
         - SUNRPC: Queue latency sensitive socket tasks to the less contended
           xprtiod queue
      
         - SUNRPC: Make the xprtiod workqueue unbounded.
      
         - SUNRPC: Make the rpciod workqueue unbounded"
      
      * tag 'nfs-for-4.16-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context
        fix parallelism for rpc tasks
        Make the xprtiod workqueue unbounded.
        SUNRPC: Queue latency-sensitive socket tasks to xprtiod
        SUNRPC: Ensure we always close the socket after a connection shuts down
        xprtrdma: Fix BUG after a device removal
        xprtrdma: Fix calculation of ri_max_send_sges
      82f0a41e
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 858f45bf
      Linus Torvalds authored
      Pull SCSI target updates from Nicholas Bellinger:
       "The highlights include:
      
         - numerous target-core-user improvements related to queue full and
           timeout handling. (MNC)
      
         - prevent target-core-user corruption when invalid data page is
           requested. (MNC)
      
         - add target-core device action configfs attributes to allow
           user-space to trigger events separate from existing attributes
           exposed to end-users. (MNC)
      
         - fix iscsi-target NULL pointer dereference 4.6+ regression in CHAP
           error path. (David Disseldorp)
      
         - avoid target-core backend UNMAP callbacks if range is zero. (Andrei
           Vagin)
      
         - fix a iscsi-target 4.14+ regression related multiple PDU logins,
           that was exposed due to removal of TCP prequeue support. (Florian
           Westphal + MNC)
      
        Also, there is a iser-target bug still being worked on for post -rc1
        code to address a long standing issue resulting in persistent
        ib_post_send() failures, for RNICs with small max_send_sge"
      
      * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (36 commits)
        iscsi-target: make sure to wake up sleeping login worker
        tcmu: Fix trailing semicolon
        tcmu: fix cmd user after free
        target: fix destroy device in target_configure_device
        tcmu: allow userspace to reset ring
        target core: add device action configfs files
        tcmu: fix error return code in tcmu_configure_device()
        target_core_user: add cmd id to broken ring message
        target: add SAM_STAT_BUSY sense reason
        tcmu: prevent corruption when invalid data page requested
        target: don't call an unmap callback if a range length is zero
        target/iscsi: avoid NULL dereference in CHAP auth error path
        cxgbit: call neigh_event_send() to update MAC address
        target: tcm_loop: Use seq_puts() in tcm_loop_show_info()
        target: tcm_loop: Delete an unnecessary return statement in tcm_loop_submission_work()
        target: tcm_loop: Delete two unnecessary variable initialisations in tcm_loop_issue_tmr()
        target: tcm_loop: Combine substrings for 26 messages
        target: tcm_loop: Improve a size determination in two functions
        target: tcm_loop: Delete an error message for a failed memory allocation in four functions
        sbp-target: Delete an error message for a failed memory allocation in three functions
        ...
      858f45bf