1. 01 Mar, 2017 12 commits
    • Jakub Kicinski's avatar
      vxlan: lock RCU on TX path · 56de859e
      Jakub Kicinski authored
      There is no guarantees that callers of the TX path will hold
      the RCU lock.  Grab it explicitly.
      
      Fixes: c6fcc4fc ("vxlan: avoid using stale vxlan socket.")
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      56de859e
    • Eric Dumazet's avatar
      net: solve a NAPI race · 39e6c820
      Eric Dumazet authored
      While playing with mlx4 hardware timestamping of RX packets, I found
      that some packets were received by TCP stack with a ~200 ms delay...
      
      Since the timestamp was provided by the NIC, and my probe was added
      in tcp_v4_rcv() while in BH handler, I was confident it was not
      a sender issue, or a drop in the network.
      
      This would happen with a very low probability, but hurting RPC
      workloads.
      
      A NAPI driver normally arms the IRQ after the napi_complete_done(),
      after NAPI_STATE_SCHED is cleared, so that the hard irq handler can grab
      it.
      
      Problem is that if another point in the stack grabs NAPI_STATE_SCHED bit
      while IRQ are not disabled, we might have later an IRQ firing and
      finding this bit set, right before napi_complete_done() clears it.
      
      This can happen with busy polling users, or if gro_flush_timeout is
      used. But some other uses of napi_schedule() in drivers can cause this
      as well.
      
      thread 1                                 thread 2 (could be on same cpu, or not)
      
      // busy polling or napi_watchdog()
      napi_schedule();
      ...
      napi->poll()
      
      device polling:
      read 2 packets from ring buffer
                                                Additional 3rd packet is
      available.
                                                device hard irq
      
                                                // does nothing because
      NAPI_STATE_SCHED bit is owned by thread 1
                                                napi_schedule();
      
      napi_complete_done(napi, 2);
      rearm_irq();
      
      Note that rearm_irq() will not force the device to send an additional
      IRQ for the packet it already signaled (3rd packet in my example)
      
      This patch adds a new NAPI_STATE_MISSED bit, that napi_schedule_prep()
      can set if it could not grab NAPI_STATE_SCHED
      
      Then napi_complete_done() properly reschedules the napi to make sure
      we do not miss something.
      
      Since we manipulate multiple bits at once, use cmpxchg() like in
      sk_busy_loop() to provide proper transactions.
      
      In v2, I changed napi_watchdog() to use a relaxed variant of
      napi_schedule_prep() : No need to set NAPI_STATE_MISSED from this point.
      
      In v3, I added more details in the changelog and clears
      NAPI_STATE_MISSED in busy_poll_stop()
      
      In v4, I added the ideas given by Alexander Duyck in v3 review
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Alexander Duyck <alexander.duyck@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      39e6c820
    • Dan Carpenter's avatar
      net/mlx4: && vs & typo · b2d0fe35
      Dan Carpenter authored
      Bitwise & was obviously intended here.
      
      Fixes: 745d8ae4 ("net/mlx4: Spoofcheck and zero MAC can't coexist")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b2d0fe35
    • Colin Ian King's avatar
      net: usb: asix_devices: fix missing return code check on call to asix_write_medium_mode · 4f3de46f
      Colin Ian King authored
      The call to asix_write_medium_mode is not updating the return code ret
      and yet ret is being checked for an error. Fix this by assigning ret to
      the return code from the call asix_write_medium_mode.
      
      Detected by CoverityScan, CID#1357148 ("Logically Dead Code")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4f3de46f
    • Baruch Siach's avatar
      MAINTAINERS: Orphan usb/net/hso driver · 0bf09c39
      Baruch Siach authored
      The email address of Jan Dumon bounces, and there is not relevant information
      in the linked website.
      Signed-off-by: default avatarBaruch Siach <baruch@tkos.co.il>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0bf09c39
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Avoid potential packets loss · f7df4923
      Ido Schimmel authored
      When the structure of the LPM tree changes (f.e., due to the addition of
      a new prefix), we unbind the old tree and then bind the new one. This
      may result in temporary packet loss.
      
      Instead, overwrite the old binding with the new one.
      
      Fixes: 6b75c480 ("mlxsw: spectrum_router: Add virtual router management")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f7df4923
    • Zhu Yanjun's avatar
      rds: ib: add the static type to the variables · 4f7bfb39
      Zhu Yanjun authored
      The variables rds_ib_mr_1m_pool_size and rds_ib_mr_8k_pool_size
      are used only in the ib.c file. As such, the static type is
      added to limit them in this file.
      
      Cc: Joe Jin <joe.jin@oracle.com>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Signed-off-by: default avatarZhu Yanjun <yanjun.zhu@oracle.com>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4f7bfb39
    • Xin Long's avatar
      sctp: call rcu_read_lock before checking for duplicate transport nodes · 5179b266
      Xin Long authored
      Commit cd2b7087 ("sctp: check duplicate node before inserting a
      new transport") called rhltable_lookup() to check for the duplicate
      transport node in transport rhashtable.
      
      But rhltable_lookup() doesn't call rcu_read_lock inside, it could cause
      a use-after-free issue if it tries to dereference the node that another
      cpu has freed it. Note that sock lock can not avoid this as it is per
      sock.
      
      This patch is to fix it by calling rcu_read_lock before checking for
      duplicate transport nodes.
      
      Fixes: cd2b7087 ("sctp: check duplicate node before inserting a new transport")
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5179b266
    • David Howells's avatar
      rxrpc: Fix deadlock between call creation and sendmsg/recvmsg · 540b1c48
      David Howells authored
      All the routines by which rxrpc is accessed from the outside are serialised
      by means of the socket lock (sendmsg, recvmsg, bind,
      rxrpc_kernel_begin_call(), ...) and this presents a problem:
      
       (1) If a number of calls on the same socket are in the process of
           connection to the same peer, a maximum of four concurrent live calls
           are permitted before further calls need to wait for a slot.
      
       (2) If a call is waiting for a slot, it is deep inside sendmsg() or
           rxrpc_kernel_begin_call() and the entry function is holding the socket
           lock.
      
       (3) sendmsg() and recvmsg() or the in-kernel equivalents are prevented
           from servicing the other calls as they need to take the socket lock to
           do so.
      
       (4) The socket is stuck until a call is aborted and makes its slot
           available to the waiter.
      
      Fix this by:
      
       (1) Provide each call with a mutex ('user_mutex') that arbitrates access
           by the users of rxrpc separately for each specific call.
      
       (2) Make rxrpc_sendmsg() and rxrpc_recvmsg() unlock the socket as soon as
           they've got a call and taken its mutex.
      
           Note that I'm returning EWOULDBLOCK from recvmsg() if MSG_DONTWAIT is
           set but someone else has the lock.  Should I instead only return
           EWOULDBLOCK if there's nothing currently to be done on a socket, and
           sleep in this particular instance because there is something to be
           done, but we appear to be blocked by the interrupt handler doing its
           ping?
      
       (3) Make rxrpc_new_client_call() unlock the socket after allocating a new
           call, locking its user mutex and adding it to the socket's call tree.
           The call is returned locked so that sendmsg() can add data to it
           immediately.
      
           From the moment the call is in the socket tree, it is subject to
           access by sendmsg() and recvmsg() - even if it isn't connected yet.
      
       (4) Lock new service calls in the UDP data_ready handler (in
           rxrpc_new_incoming_call()) because they may already be in the socket's
           tree and the data_ready handler makes them live immediately if a user
           ID has already been preassigned.
      
           Note that the new call is locked before any notifications are sent
           that it is live, so doing mutex_trylock() *ought* to always succeed.
           Userspace is prevented from doing sendmsg() on calls that are in a
           too-early state in rxrpc_do_sendmsg().
      
       (5) Make rxrpc_new_incoming_call() return the call with the user mutex
           held so that a ping can be scheduled immediately under it.
      
           Note that it might be worth moving the ping call into
           rxrpc_new_incoming_call() and then we can drop the mutex there.
      
       (6) Make rxrpc_accept_call() take the lock on the call it is accepting and
           release the socket after adding the call to the socket's tree.  This
           is slightly tricky as we've dequeued the call by that point and have
           to requeue it.
      
           Note that requeuing emits a trace event.
      
       (7) Make rxrpc_kernel_send_data() and rxrpc_kernel_recv_data() take the
           new mutex immediately and don't bother with the socket mutex at all.
      
      This patch has the nice bonus that calls on the same socket are now to some
      extent parallelisable.
      
      Note that we might want to move rxrpc_service_prealloc() calls out from the
      socket lock and give it its own lock, so that we don't hang progress in
      other calls because we're waiting for the allocator.
      
      We probably also want to avoid calling rxrpc_notify_socket() from within
      the socket lock (rxrpc_accept_call()).
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Tested-by: default avatarMarc Dionne <marc.c.dionne@auristor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      540b1c48
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.11' of git://git.code.sf.net/p/openipmi/linux-ipmi · 2d6be4ab
      Linus Torvalds authored
      Pull IPMI updates from Corey Minyard:
       "This is a few small fixes to the main IPMI driver, make some things
        const, fix typos, etc.
      
        The last patch came in about a week ago, but IMHO it's best to go in
        now. It is not for the main driver, it's for the bt-bmc driver, which
        runs on the managment controller side, not on the host side, so the
        scope is limited and the change is necessary"
      
      * tag 'for-linus-4.11' of git://git.code.sf.net/p/openipmi/linux-ipmi:
        ipmi: bt-bmc: Use a regmap for register access
        char: ipmi: constify ipmi_smi_handlers structures
        acpi:ipmi: Make IPMI user handler const
        ipmi: make ipmi_usr_hndl const
        Documentation: Fix a typo in IPMI.txt.
      2d6be4ab
    • Linus Torvalds's avatar
      Merge branch 'idr-4.11' of git://git.infradead.org/users/willy/linux-dax · cf393195
      Linus Torvalds authored
      Pull IDR rewrite from Matthew Wilcox:
       "The most significant part of the following is the patch to rewrite the
        IDR & IDA to be clients of the radix tree. But there's much more,
        including an enhancement of the IDA to be significantly more space
        efficient, an IDR & IDA test suite, some improvements to the IDR API
        (and driver changes to take advantage of those improvements), several
        improvements to the radix tree test suite and RCU annotations.
      
        The IDR & IDA rewrite had a good spin in linux-next and Andrew's tree
        for most of the last cycle. Coupled with the IDR test suite, I feel
        pretty confident that any remaining bugs are quite hard to hit. 0-day
        did a great job of watching my git tree and pointing out problems; as
        it hit them, I added new test-cases to be sure not to be caught the
        same way twice"
      
      Willy goes on to expand a bit on the IDR rewrite rationale:
       "The radix tree and the IDR use very similar data structures.
      
        Merging the two codebases lets us share the memory allocation pools,
        and results in a net deletion of 500 lines of code. It also opens up
        the possibility of exposing more of the features of the radix tree to
        users of the IDR (and I have some interesting patches along those
        lines waiting for 4.12)
      
        It also shrinks the size of the 'struct idr' from 40 bytes to 24 which
        will shrink a fair few data structures that embed an IDR"
      
      * 'idr-4.11' of git://git.infradead.org/users/willy/linux-dax: (32 commits)
        radix tree test suite: Add config option for map shift
        idr: Add missing __rcu annotations
        radix-tree: Fix __rcu annotations
        radix-tree: Add rcu_dereference and rcu_assign_pointer calls
        radix tree test suite: Run iteration tests for longer
        radix tree test suite: Fix split/join memory leaks
        radix tree test suite: Fix leaks in regression2.c
        radix tree test suite: Fix leaky tests
        radix tree test suite: Enable address sanitizer
        radix_tree_iter_resume: Fix out of bounds error
        radix-tree: Store a pointer to the root in each node
        radix-tree: Chain preallocated nodes through ->parent
        radix tree test suite: Dial down verbosity with -v
        radix tree test suite: Introduce kmalloc_verbose
        idr: Return the deleted entry from idr_remove
        radix tree test suite: Build separate binaries for some tests
        ida: Use exceptional entries for small IDAs
        ida: Move ida_bitmap to a percpu variable
        Reimplement IDR and IDA using the radix tree
        radix-tree: Add radix_tree_iter_delete
        ...
      cf393195
    • Linus Torvalds's avatar
      Merge tag 'iommu-fix-v4.11-rc0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 5ecc5ac2
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
       "Fix an issue introduced this merge window into the AMD and Intel IOMMU
        drivers that causes an oops when the vendor-specific sysfs-entries are
        accessed.
      
        The reason for this issue is that I forgot to update the sysfs code in
        the drivers when moving the iommu 'struct device' to the iommu-core"
      
      * tag 'iommu-fix-v4.11-rc0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: Fix crash when accessing AMD-Vi sysfs entries
        iommu/vt-d: Fix crash when accessing VT-d sysfs entries
      5ecc5ac2
  2. 28 Feb, 2017 28 commits
    • Linus Torvalds's avatar
      Merge tag 'nfsd-4.11' of git://linux-nfs.org/~bfields/linux · 8313064c
      Linus Torvalds authored
      Pull nfsd updates from Bruce Fields:
       "The nfsd update this round is mainly a lot of miscellaneous cleanups
        and bugfixes.
      
        A couple changes could theoretically break working setups on upgrade.
        I don't expect complaints in practice, but they seem worth calling out
        just in case:
      
         - NFS security labels are now off by default; a new security_label
           export flag reenables it per export. But, having them on by default
           is a disaster, as it generally only makes sense if all your clients
           and servers have similar enough selinux policies. Thanks to Jason
           Tibbitts for pointing this out.
      
         - NFSv4/UDP support is off. It was never really supported, and the
           spec explicitly forbids it. We only ever left it on out of
           laziness; thanks to Jeff Layton for finally fixing that"
      
      * tag 'nfsd-4.11' of git://linux-nfs.org/~bfields/linux: (34 commits)
        nfsd: Fix display of the version string
        nfsd: fix configuration of supported minor versions
        sunrpc: don't register UDP port with rpcbind when version needs congestion control
        nfs/nfsd/sunrpc: enforce transport requirements for NFSv4
        sunrpc: flag transports as having congestion control
        sunrpc: turn bitfield flags in svc_version into bools
        nfsd: remove superfluous KERN_INFO
        nfsd: special case truncates some more
        nfsd: minor nfsd_setattr cleanup
        NFSD: Reserve adequate space for LOCKT operation
        NFSD: Get response size before operation for all RPCs
        nfsd/callback: Drop a useless data copy when comparing sessionid
        nfsd/callback: skip the callback tag
        nfsd/callback: Cleanup callback cred on shutdown
        nfsd/idmap: return nfserr_inval for 0-length names
        SUNRPC/Cache: Always treat the invalid cache as unexpired
        SUNRPC: Drop all entries from cache_detail when cache_purge()
        svcrdma: Poll CQs in "workqueue" mode
        svcrdma: Combine list fields in struct svc_rdma_op_ctxt
        svcrdma: Remove unused sc_dto_q field
        ...
      8313064c
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.11-rc1' of git://github.com/ceph/ceph-client · b2deee2d
      Linus Torvalds authored
      Pull ceph updates from Ilya Dryomov:
       "This time around we have:
      
         - support for rbd data-pool feature, which enables rbd images on
           erasure-coded pools (myself). CEPH_PG_MAX_SIZE has been bumped to
           allow erasure-coded profiles with k+m up to 32.
      
         - a patch for ceph_d_revalidate() performance regression introduced
           in 4.9, along with some cleanups in the area (Jeff Layton)
      
         - a set of fixes for unsafe ->d_parent accesses in CephFS (Jeff
           Layton)
      
         - buffered reads are now processed in rsize windows instead of rasize
           windows (Andreas Gerstmayr). The new default for rsize mount option
           is 64M.
      
         - ack vs commit distinction is gone, greatly simplifying ->fsync()
           and MOSDOpReply handling code (myself)
      
        ... also a few filesystem bug fixes from Zheng, a CRUSH sync up (CRUSH
        computations are still serialized though) and several minor fixes and
        cleanups all over"
      
      * tag 'ceph-for-4.11-rc1' of git://github.com/ceph/ceph-client: (52 commits)
        libceph, rbd, ceph: WRITE | ONDISK -> WRITE
        libceph: get rid of ack vs commit
        ceph: remove special ack vs commit behavior
        ceph: tidy some white space in get_nonsnap_parent()
        crush: fix dprintk compilation
        crush: do is_out test only if we do not collide
        ceph: remove req from unsafe list when unregistering it
        rbd: constify device_type structure
        rbd: kill obj_request->object_name and rbd_segment_name_cache
        rbd: store and use obj_request->object_no
        rbd: RBD_V{1,2}_DATA_FORMAT macros
        rbd: factor out __rbd_osd_req_create()
        rbd: set offset and length outside of rbd_obj_request_create()
        rbd: support for data-pool feature
        rbd: introduce rbd_init_layout()
        rbd: use rbd_obj_bytes() more
        rbd: remove now unused rbd_obj_request_wait() and helpers
        rbd: switch rbd_obj_method_sync() to ceph_osdc_call()
        libceph: pass reply buffer length through ceph_osdc_call()
        rbd: do away with obj_request in rbd_obj_read_sync()
        ...
      b2deee2d
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · d4f4cf77
      Linus Torvalds authored
      Pull ARM updates from Russell King:
      
       - nommu updates from Afzal Mohammed cleaning up the vectors support
      
       - allow DMA memory "mapping" for nommu Benjamin Gaignard
      
       - fixing a correctness issue with R_ARM_PREL31 relocations in the
         module linker
      
       - add strlen() prototype for the decompressor
      
       - support for DEBUG_VIRTUAL from Florian Fainelli
      
       - adjusting memory bounds after memory reservations have been
         registered
      
       - unipher cache handling updates from Masahiro Yamada
      
       - initrd and Thumb Kconfig cleanups
      
      * 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: (23 commits)
        ARM: mm: round the initrd reservation to page boundaries
        ARM: mm: clean up initrd initialisation
        ARM: mm: move initrd init code out of arm_memblock_init()
        ARM: 8655/1: improve NOMMU definition of pgprot_*()
        ARM: 8654/1: decompressor: add strlen prototype
        ARM: 8652/1: cache-uniphier: clean up active way setup code
        ARM: 8651/1: cache-uniphier: include <linux/errno.h> instead of <linux/types.h>
        ARM: 8650/1: module: handle negative R_ARM_PREL31 addends correctly
        ARM: 8649/2: nommu: remove Hivecs configuration is asm
        ARM: 8648/2: nommu: display vectors base
        ARM: 8647/2: nommu: dynamic exception base address setting
        ARM: 8646/1: mmu: decouple VECTORS_BASE from Kconfig
        ARM: 8644/1: Reduce "CPU: shutdown" message to debug level
        ARM: 8641/1: treewide: Replace uses of virt_to_phys with __pa_symbol
        ARM: 8640/1: Add support for CONFIG_DEBUG_VIRTUAL
        ARM: 8639/1: Define KERNEL_START and KERNEL_END
        ARM: 8638/1: mtd: lart: Rename partition defines to be prefixed with PART_
        ARM: 8637/1: Adjust memory boundaries after reservations
        ARM: 8636/1: Cleanup sanity_check_meminfo
        ARM: add CPU_THUMB_CAPABLE to indicate possible Thumb support
        ...
      d4f4cf77
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f89db789
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Two documentation updates, plus a debugging annotation fix"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/crash: Update the stale comment in reserve_crashkernel()
        x86/irq, trace: Add __irq_entry annotation to x86's platform IRQ handlers
        Documentation, x86, resctrl: Recommend locking for resctrlfs
      f89db789
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 65314ed0
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "Two rq-clock warnings related fixes, plus a cgroups related crash fix"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/cgroup: Move sched_online_group() back into css_online() to fix crash
        sched/fair: Update rq clock before changing a task's CPU affinity
        sched/core: Fix update_rq_clock() splat on hotplug (and suspend/resume)
      65314ed0
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3f26b0c8
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Misc fixes on the kernel and tooling side - nothing in particular
        stands out"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
        perf/core: Fix the perf_cpu_time_max_percent check
        perf/core: Fix perf_event_enable_on_exec() timekeeping (again)
        perf/core: Remove confusing comment and move put_ctx()
        perf record: Honor --quiet option properly
        perf annotate: Add -q/--quiet option
        perf diff: Add -q/--quiet option
        perf report: Add -q/--quiet option
        perf utils: Check verbose flag properly
        perf utils: Add perf_quiet_option()
        perf record: Add -a as default target
        perf stat: Add -a as default target
        perf tools: Fail on using multiple bits long terms without value
        perf tools: Move new_term arguments into struct parse_events_term template
        perf build: Add special fixdep cleaning rule
        perf tools: Replace _SC_NPROCESSORS_CONF with max_present_cpu in cpu_topology_map
        perf header: Make build_cpu_topology skip offline/absent CPUs
        perf cpumap: Add cpu__max_present_cpu()
        perf session: Fix DEBUG=1 build with clang
        tools lib traceevent: It's preempt not prempt
        perf python: Filter out -specs=/a/b/c from the python binding cc options
        ...
      3f26b0c8
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 74efe07b
      Linus Torvalds authored
      Pull locking fixes from Ingo Molnar:
       "The main change is the uninlining of large refcount_t APIs, plus a
        header dependency fix.
      
        Note that the uninlining allowed us to enable the underflow/overflow
        warnings unconditionally and remove the debug Kconfig switch: this
        might trigger new warnings in buggy code and turn
        crashes/use-after-free bugs into less harmful memory leaks"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        locking/refcounts: Add missing kernel.h header to have UINT_MAX defined
        locking/refcounts: Out-of-line everything
      74efe07b
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e72e58fa
      Linus Torvalds authored
      Pull objtool fixes from Ingo Molnar:
       "A handful of objtool fixes related to unreachable code, plus a build
        fix for out of tree modules"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        objtool: Enclose contents of unreachable() macro in a block
        objtool: Prevent GCC from merging annotate_unreachable()
        objtool: Improve detection of BUG() and other dead ends
        objtool: Fix CONFIG_STACK_VALIDATION=y warning for out-of-tree modules
      e72e58fa
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide · 74e3f63c
      Linus Torvalds authored
      Pull IDE updates from David Miller:
       "Just one actual change here this time around, adding some init data
        annotations. The other change was bogus and got reverted"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide:
        ide: palm_bk3710: add __initdata to palm_bk3710_port_info
        Revert "ide: Fix interface autodetection in legacy IDE driver (trial #2)"
        ide: Fix interface autodetection in legacy IDE driver (trial #2)
      74e3f63c
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c2eca00f
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Don't save TIPC header values before the header has been validated,
          from Jon Paul Maloy.
      
       2) Fix memory leak in RDS, from Zhu Yanjun.
      
       3) We miss to initialize the UID in the flow key in some paths, from
          Julian Anastasov.
      
       4) Fix latent TOS masking bug in the routing cache removal from years
          ago, also from Julian.
      
       5) We forget to set the sockaddr port in sctp_copy_local_addr_list(),
          fix from Xin Long.
      
       6) Missing module ref count drop in packet scheduler actions, from
          Roman Mashak.
      
       7) Fix RCU annotations in rht_bucket_nested, from Herbert Xu.
      
       8) Fix use after free which happens because L2TP's ipv4 support returns
          non-zero values from it's backlog_rcv function which ipv4 interprets
          as protocol values. Fix from Paul Hüber.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (35 commits)
        qed: Don't use attention PTT for configuring BW
        qed: Fix race with multiple VFs
        l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
        xfrm: provide correct dst in xfrm_neigh_lookup
        rhashtable: Fix RCU dereference annotation in rht_bucket_nested
        rhashtable: Fix use before NULL check in bucket_table_free
        net sched actions: do not overwrite status of action creation.
        rxrpc: Kernel calls get stuck in recvmsg
        net sched actions: decrement module reference count after table flush.
        lib: Allow compile-testing of parman
        ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
        sctp: set sin_port for addr param when checking duplicate address
        net/mlx4_en: fix overflow in mlx4_en_init_timestamp()
        netfilter: nft_set_bitmap: incorrect bitmap size
        net: s2io: fix typo argumnet argument
        net: vxge: fix typo argumnet argument
        netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.
        ipv4: mask tos for input route
        ipv4: add missing initialization for flowi4_uid
        lib: fix spelling mistake: "actualy" -> "actually"
        ...
      c2eca00f
    • Joerg Roedel's avatar
      iommu/amd: Fix crash when accessing AMD-Vi sysfs entries · b7a42b9d
      Joerg Roedel authored
      The link between the iommu sysfs-device and the struct
      amd_iommu is no longer stored as driver-data. Update the
      code to the new correct way of getting from device to
      amd_iommu.
      Reported-by: default avatarDave Jones <davej@codemonkey.org.uk>
      Fixes: 39ab9555 ('iommu: Add sysfs bindings for struct iommu_device')
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      b7a42b9d
    • Joerg Roedel's avatar
      iommu/vt-d: Fix crash when accessing VT-d sysfs entries · a7fdb6e6
      Joerg Roedel authored
      The link between the iommu sysfs-device and the struct
      intel_iommu is no longer stored as driver-data. Update the
      code to use the new access method.
      Reported-by: default avatarDave Jones <davej@codemonkey.org.uk>
      Fixes: 39ab9555 ('iommu: Add sysfs bindings for struct iommu_device')
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      a7fdb6e6
    • Russell King's avatar
      Merge branches 'fixes' and 'misc'; commit 'kuser^{/add CPU_THUMB_CAPABLE to... · 17a870be
      Russell King authored
      Merge branches 'fixes' and 'misc'; commit 'kuser^{/add CPU_THUMB_CAPABLE to indicate}' into for-linus
      17a870be
    • Russell King's avatar
      ARM: mm: round the initrd reservation to page boundaries · cdcc5fa0
      Russell King authored
      Round the initrd memblock reservation to page boundaries to prevent
      other data sharing the initrd pages.  This prevents an allocation
      possibly overlapping with the initrd, which would later get trampled
      on in free_initrd_mem().
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      cdcc5fa0
    • Russell King's avatar
      ARM: mm: clean up initrd initialisation · 68b32f36
      Russell King authored
      Rather than repeatedly testing phys_initrd_size to see if the initrd
      is still enabled, return from the new function to avoid executing the
      remaining initialisation.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      68b32f36
    • Russell King's avatar
      ARM: mm: move initrd init code out of arm_memblock_init() · 39286248
      Russell King authored
      Move the ARM initrd initialisation code out of arm_memblock_init() into
      its own function, so it can be cleaned up.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      39286248
    • Arnd Bergmann's avatar
      ARM: 8655/1: improve NOMMU definition of pgprot_*() · e2fce0a2
      Arnd Bergmann authored
      The tegra DRM driver produces a harmless warning when built for NOMMU:
      
      drivers/gpu/drm/tegra/gem.c: In function 'tegra_drm_mmap':
      drivers/gpu/drm/tegra/gem.c:508:12: unused variable 'prot'
      
      This is because pgprot_writecombine() on ARM returns a constant and
      ignores its argument. The version in asm-generic doesn't have that
      problem, so let's use that one instead. We don't actually care
      about the value on NOMMU, and this is consistent with what some
      other architectures do.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarThierry Reding <treding@nvidia.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      e2fce0a2
    • Arnd Bergmann's avatar
      ARM: 8654/1: decompressor: add strlen prototype · 7b96ddd0
      Arnd Bergmann authored
      The decompress.c file contains a declaration for strstr() so we can
      include some compression library code.
      
      With the updated LZ4 implementation, we run into the same problem again
      for strlen():
      
      In file included from ../include/linux/rcupdate.h:40:0,
                       from ../include/linux/srcu.h:33,
                       from ../include/linux/notifier.h:15,
                       from ../include/linux/memory_hotplug.h:6,
                       from ../include/linux/mmzone.h:749,
                       from ../include/linux/gfp.h:5,
                       from ../include/linux/kmod.h:22,
                       from ../include/linux/module.h:13,
                       from ../arch/arm/boot/compressed/../../../../lib/lz4/lz4_decompress.c:39,
                       from ../arch/arm/boot/compressed/../../../../lib/decompress_unlz4.c:13,
                       from ../arch/arm/boot/compressed/decompress.c:55:
      include/linux/cpumask.h: In function 'cpumask_parse':
      include/linux/cpumask.h:592:53: error: implicit declaration of function 'strlen';did you mean 'strstr'? [-Werror=implicit-function-declaration]
      
      This adds another declaration to work around the new problem.
      
      Fixes: ce83d9ab80d6 ("lib: update LZ4 compressor module")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      7b96ddd0
    • Masahiro Yamada's avatar
      ARM: 8652/1: cache-uniphier: clean up active way setup code · 06369a1e
      Masahiro Yamada authored
      Now, the active way setup function is called with a fixed value zero
      for the second argument.  The code can be simpler.
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      06369a1e
    • Masahiro Yamada's avatar
      ARM: 8651/1: cache-uniphier: include <linux/errno.h> instead of <linux/types.h> · 1c63d4c5
      Masahiro Yamada authored
      Nothing in this header file depends on <linux/types.h>.
      Rather, <linux/errno.h> should be included for -ENODEV.
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      1c63d4c5
    • Ard Biesheuvel's avatar
      ARM: 8650/1: module: handle negative R_ARM_PREL31 addends correctly · 050d18d1
      Ard Biesheuvel authored
      According to the spec 'ELF for the ARM Architecture' (IHI 0044E),
      addends for R_ARM_PREL31 relocations are 31-bit signed quantities,
      so we need to sign extend the value to 32 bits before it can be used
      as an offset in the calculation of the relocated value.
      
      We have not been bitten by this because these relocations are usually
      emitted against the start of a section, which means the addends never
      assume negative values in practice. But it is a bug nonetheless, so fix
      it.
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      050d18d1
    • Afzal Mohammed's avatar
      ARM: 8649/2: nommu: remove Hivecs configuration is asm · ad475117
      Afzal Mohammed authored
      Now that exception based address is handled dynamically for
      processors with CP15, remove Hivecs configuration in assembly.
      Signed-off-by: default avatarafzal mohammed <afzal.mohd.ma@gmail.com>
      Tested-by: default avatarVladimir Murzin <vladimir.murzin@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      ad475117
    • Afzal Mohammed's avatar
      ARM: 8648/2: nommu: display vectors base · 58c16709
      Afzal Mohammed authored
      VECTORS_BASE displays the exception base address. Now on no-MMU as
      the exception base address is dynamically estimated, define
      VECTORS_BASE to the variable holding it.
      
      As it is the case, limit VECTORS_BASE constant definition to MMU.
      Suggested-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarafzal mohammed <afzal.mohd.ma@gmail.com>
      Tested-by: default avatarVladimir Murzin <vladimir.murzin@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      58c16709
    • Afzal Mohammed's avatar
      ARM: 8647/2: nommu: dynamic exception base address setting · f8300a0b
      Afzal Mohammed authored
      No-MMU dynamic exception base address configuration on CP15
      processors. In the case of low vectors, decision based on whether
      security extensions are enabled & whether remap vectors to RAM
      CONFIG option is selected.
      
      For no-MMU without CP15, current default value of 0x0 is retained.
      Signed-off-by: default avatarafzal mohammed <afzal.mohd.ma@gmail.com>
      Tested-by: default avatarVladimir Murzin <vladimir.murzin@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      f8300a0b
    • Afzal Mohammed's avatar
      ARM: 8646/1: mmu: decouple VECTORS_BASE from Kconfig · d2ca5f24
      Afzal Mohammed authored
      For MMU configurations, VECTORS_BASE is always 0xffff0000, a macro
      definition will suffice.
      
      For no-MMU, exception base address is dynamically determined in
      subsequent patches. To preserve bisectability, now make the
      macro applicable for no-MMU scenario too.
      
      Thanks to 0-DAY kernel test infrastructure that found the
      bisectability issue. This macro will be restricted to MMU case upon
      dynamically determining exception base address for no-MMU.
      
      Once exception address is handled dynamically for no-MMU,
      VECTORS_BASE can be removed from Kconfig.
      Signed-off-by: default avatarafzal mohammed <afzal.mohd.ma@gmail.com>
      Tested-by: default avatarVladimir Murzin <vladimir.murzin@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      d2ca5f24
    • Florian Fainelli's avatar
      ARM: 8644/1: Reduce "CPU: shutdown" message to debug level · 035e7875
      Florian Fainelli authored
      Similar to c68b0274 ("ARM: reduce "Booted secondary processor"
      message to debug level"), demote the "CPU: shutdown" pr_notice() into a
      pr_debug().
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      035e7875
    • Florian Fainelli's avatar
      ARM: 8641/1: treewide: Replace uses of virt_to_phys with __pa_symbol · 64fc2a94
      Florian Fainelli authored
      All low-level PM/SMP code using virt_to_phys() should actually use
      __pa_symbol() against kernel symbols. Update code where relevant to move
      away from virt_to_phys().
      Acked-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Reviewed-by: default avatarLaura Abbott <labbott@redhat.com>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      64fc2a94
    • Florian Fainelli's avatar
      ARM: 8640/1: Add support for CONFIG_DEBUG_VIRTUAL · e377cd82
      Florian Fainelli authored
      x86 has an option: CONFIG_DEBUG_VIRTUAL to do additional checks on
      virt_to_phys calls. The goal is to catch users who are calling
      virt_to_phys on non-linear addresses immediately. This includes caller
      using __virt_to_phys() on image addresses instead of __pa_symbol(). This
      is a generally useful debug feature to spot bad code (particulary in
      drivers).
      Acked-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Acked-by: default avatarLaura Abbott <labbott@redhat.com>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      e377cd82