1. 18 May, 2017 10 commits
    • Lucas Stach's avatar
      serial: core: fix crash in uart_suspend_port · 88e2582e
      Lucas Stach authored
      With serdev we might end up with serial ports that have no cdev exported
      to userspace, as they are used as the bus interface to other devices. In
      that case serial_match_port() won't be able to find a matching tty_dev.
      
      Skip the irq wakeup enabling in that case, as serdev will make sure to
      keep the port active, as long as there are devices depending on it.
      
      Fixes: 8ee3fde0 (tty_port: register tty ports with serdev bus)
      Signed-off-by: default avatarLucas Stach <l.stach@pengutronix.de>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      88e2582e
    • Vegard Nossum's avatar
      tty: fix port buffer locking · 925bb1ce
      Vegard Nossum authored
      tty_insert_flip_string_fixed_flag() is racy against itself when called
      from the ioctl(TCXONC, TCION/TCIOFF) path [1] and the flush_to_ldisc()
      workqueue path [2].
      
      The problem is that port->buf.tail->used is modified without consistent
      locking; the ioctl path takes tty->atomic_write_lock, whereas the workqueue
      path takes ldata->output_lock.
      
      We cannot simply take ldata->output_lock, since that is specific to the
      N_TTY line discipline.
      
      It might seem natural to try to take port->buf.lock inside
      tty_insert_flip_string_fixed_flag() and friends (where port->buf is
      actually used/modified), but this creates problems for flush_to_ldisc()
      which takes it before grabbing tty->ldisc_sem, o_tty->termios_rwsem,
      and ldata->output_lock.
      
      Therefore, the simplest solution for now seems to be to take
      tty->atomic_write_lock inside tty_port_default_receive_buf(). This lock
      is also used in the write path [3] with a consistent ordering.
      
      [1]: Call Trace:
       tty_insert_flip_string_fixed_flag
       pty_write
       tty_send_xchar                     // down_read(&o_tty->termios_rwsem)
                                          // mutex_lock(&tty->atomic_write_lock)
       n_tty_ioctl_helper
       n_tty_ioctl
       tty_ioctl                          // down_read(&tty->ldisc_sem)
       do_vfs_ioctl
       SyS_ioctl
      
      [2]: Workqueue: events_unbound flush_to_ldisc
      Call Trace:
       tty_insert_flip_string_fixed_flag
       pty_write
       tty_put_char
       __process_echoes
       commit_echoes                      // mutex_lock(&ldata->output_lock)
       n_tty_receive_buf_common
       n_tty_receive_buf2
       tty_ldisc_receive_buf              // down_read(&o_tty->termios_rwsem)
       tty_port_default_receive_buf       // down_read(&tty->ldisc_sem)
       flush_to_ldisc                     // mutex_lock(&port->buf.lock)
       process_one_work
      
      [3]: Call Trace:
       tty_insert_flip_string_fixed_flag
       pty_write
       n_tty_write                        // mutex_lock(&ldata->output_lock)
                                          // down_read(&tty->termios_rwsem)
       do_tty_write (inline)              // mutex_lock(&tty->atomic_write_lock)
       tty_write                          // down_read(&tty->ldisc_sem)
       __vfs_write
       vfs_write
       SyS_write
      
      The bug can result in about a dozen different crashes depending on what
      exactly gets corrupted when port->buf.tail->used points outside the
      buffer.
      
      The patch passes my LOCKDEP/PROVE_LOCKING testing but more testing is
      always welcome.
      
      Found using syzkaller.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      925bb1ce
    • Johan Hovold's avatar
      tty: ehv_bytechan: clean up init error handling · 11d4d321
      Johan Hovold authored
      Straighten out the initcall error handling to avoid deregistering a
      never-registered tty driver (something which would lead to a
      NULL-pointer dereference) in the most unlikely event that driver
      registration fails (e.g. we've run out of major numbers).
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      11d4d321
    • Johan Hovold's avatar
      serial: ifx6x60: fix use-after-free on module unload · 1e948479
      Johan Hovold authored
      Make sure to deregister the SPI driver before releasing the tty driver
      to avoid use-after-free in the SPI remove callback where the tty
      devices are deregistered.
      
      Fixes: 72d4724e ("serial: ifx6x60: Add modem power off function in the platform reboot process")
      Cc: stable <stable@vger.kernel.org>     # 3.8
      Cc: Jun Chen <jun.d.chen@intel.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1e948479
    • Alexey Khoroshilov's avatar
      serial: altera_jtaguart: adding iounmap() · 5c9d6abe
      Alexey Khoroshilov authored
      The driver does ioremap(port->mapbase, ALTERA_JTAGUART_SIZE),
      but there is no any iounmap().
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Acked-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5c9d6abe
    • Jan Kiszka's avatar
      serial: exar: Fix stuck MSIs · 2c0ac5b4
      Jan Kiszka authored
      After migrating 8250_exar to MSI in 172c33cb, we can get stuck
      without further interrupts because of the special wake-up event these
      chips send. They are only cleared by reading INT0. As we fail to do so
      during startup and shutdown, we can leave the interrupt line asserted,
      which is fatal with edge-triggered MSIs.
      
      Add the required reading of INT0 to startup and shutdown. Also account
      for the fact that a pending wake-up interrupt means we have to return 1
      from exar_handle_irq. Drop the unneeded reading of INT1..3 along with
      this - those never reset anything.
      
      An alternative approach would have been disabling the wake-up interrupt.
      Unfortunately, this feature (REGB[17] = 1) is not available on the
      XR17D15X.
      
      Fixes: 172c33cb ("serial: exar: Enable MSI support")
      Signed-off-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2c0ac5b4
    • Christophe JAILLET's avatar
      serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' · be40597a
      Christophe JAILLET authored
      UARTn_FRAME_PARITY_ODD is 0x0300
      UARTn_FRAME_PARITY_EVEN is 0x0200
      So if the UART is configured for EVEN parity, it would be reported as ODD.
      Fix it by correctly testing if the 2 bits are set.
      
      Fixes: 3afbd89c ("serial/efm32: add new driver")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Acked-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      be40597a
    • Johan Hovold's avatar
      serdev: fix tty-port client deregistration · aee5da78
      Johan Hovold authored
      The port client data must be set when registering the serdev controller
      or client deregistration will fail (and the serdev devices are left
      registered and allocated) if the port was never opened in between.
      
      Make sure to clear the port client data on any probe errors to avoid a
      use-after-free when the client is later deregistered unconditionally
      (e.g. in a tty-port deregistration helper).
      
      Also move port client operation initialisation to registration. Note
      that the client ops must be restored on failed probe.
      
      Fixes: bed35c6d ("serdev: add a tty port controller driver")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Reviewed-by: default avatarRob Herring <robh@kernel.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      aee5da78
    • Johan Hovold's avatar
      Revert "tty_port: register tty ports with serdev bus" · d3ba126a
      Johan Hovold authored
      This reverts commit 8ee3fde0.
      
      The new serdev bus hooked into the tty layer in
      tty_port_register_device() by registering a serdev controller instead of
      a tty device whenever a serdev client is present, and by deregistering
      the controller in the tty-port destructor. This is broken in several
      ways:
      
      Firstly, it leads to a NULL-pointer dereference whenever a tty driver
      later deregisters its devices as no corresponding character device will
      exist.
      
      Secondly, far from every tty driver uses tty-port refcounting (e.g.
      serial core) so the serdev devices might never be deregistered or
      deallocated.
      
      Thirdly, deregistering at tty-port destruction is too late as the
      underlying device and structures may be long gone by then. A port is not
      released before an open tty device is closed, something which a
      registered serdev client can prevent from ever happening. A driver
      callback while the device is gone typically also leads to crashes.
      
      Many tty drivers even keep their ports around until the driver is
      unloaded (e.g. serial core), something which even if a late callback
      never happens, leads to leaks if a device is unbound from its driver and
      is later rebound.
      
      The right solution here is to add a new tty_port_unregister_device()
      helper and to never call tty_device_unregister() whenever the port has
      been claimed by serdev, but since this requires modifying just about
      every tty driver (and multiple subsystems) it will need to be done
      incrementally.
      
      Reverting the offending patch is the first step in fixing the broken
      lifetime assumptions. A follow-up patch will add a new pair of
      tty-device registration helpers, which a vetted tty driver can use to
      support serdev (initially serial core). When every tty driver uses the
      serdev helpers (at least for deregistration), we can add serdev
      registration to tty_port_register_device() again.
      
      Note that this also fixes another issue with serdev, which currently
      allocates and registers a serdev controller for every tty device
      registered using tty_port_device_register() only to immediately
      deregister and deallocate it when the corresponding OF node or serdev
      child node is missing. This should be addressed before enabling serdev
      for hot-pluggable buses.
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Reviewed-by: default avatarRob Herring <robh@kernel.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d3ba126a
    • Ard Biesheuvel's avatar
      drivers/tty: 8250: only call fintek_8250_probe when doing port I/O · 4c4fc909
      Ard Biesheuvel authored
      Commit fa01e2ca ("serial: 8250: Integrate Fintek into 8250_base")
      modified the probing logic for PNP0501 devices, to remove a collision
      between the generic 16550A driver and the Fintek driver, which reused
      the same ACPI _HID.
      
      The Fintek device probe is now incorporated into the common 8250 probe
      path, and gets called for all discovered 16550A compatible devices,
      including ones that are MMIO mapped rather than IO mapped. However,
      the Fintek driver assumes the port base is a I/O address, and proceeds
      to probe some arbitrary offsets above it.
      
      This is generally a wrong thing to do, but on ARM systems (having no
      native port I/O), this may result in faulting accesses of completely
      unrelated MMIO regions in the PCI I/O space. Given that this is at
      serial probe time, this results in hard to diagnose crashes at boot.
      
      So let's restrict the Fintek probe to devices that we know are using
      port I/O in the first place.
      
      Fixes: fa01e2ca ("serial: 8250: Integrate Fintek into 8250_base")
      Suggested-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarRicardo Ribalda <ricardo.ribalda@gmail.com>
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4c4fc909
  2. 13 May, 2017 5 commits
    • Linus Torvalds's avatar
      Linux 4.12-rc1 · 2ea659a9
      Linus Torvalds authored
      2ea659a9
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · cd636458
      Linus Torvalds authored
      Pull some more input subsystem updates from Dmitry Torokhov:
       "An updated xpad driver with a few more recognized device IDs, and a
        new psxpad-spi driver, allowing connecting Playstation 1 and 2 joypads
        via SPI bus"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: cros_ec_keyb - remove extraneous 'const'
        Input: add support for PlayStation 1/2 joypads connected via SPI
        Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth
        Input: xpad - sync supported devices with xboxdrv
        Input: xpad - sort supported devices by USB ID
      cd636458
    • Linus Torvalds's avatar
      Merge tag 'upstream-4.12-rc1' of git://git.infradead.org/linux-ubifs · b53c4d5e
      Linus Torvalds authored
      Pull UBI/UBIFS updates from Richard Weinberger:
      
       - new config option CONFIG_UBIFS_FS_SECURITY
      
       - minor improvements
      
       - random fixes
      
      * tag 'upstream-4.12-rc1' of git://git.infradead.org/linux-ubifs:
        ubi: Add debugfs file for tracking PEB state
        ubifs: Fix a typo in comment of ioctl2ubifs & ubifs2ioctl
        ubifs: Remove unnecessary assignment
        ubifs: Fix cut and paste error on sb type comparisons
        ubi: fastmap: Fix slab corruption
        ubifs: Add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels
        ubi: Make mtd parameter readable
        ubi: Fix section mismatch
      b53c4d5e
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml · ec059019
      Linus Torvalds authored
      Pull UML fixes from Richard Weinberger:
       "No new stuff, just fixes"
      
      * 'for-linus-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml:
        um: Add missing NR_CPUS include
        um: Fix to call read_initrd after init_bootmem
        um: Include kbuild.h instead of duplicating its macros
        um: Fix PTRACE_POKEUSER on x86_64
        um: Set number of CPUs
        um: Fix _print_addr()
      ec059019
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 1251704a
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "15 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mm, docs: update memory.stat description with workingset* entries
        mm: vmscan: scan until it finds eligible pages
        mm, thp: copying user pages must schedule on collapse
        dax: fix PMD data corruption when fault races with write
        dax: fix data corruption when fault races with write
        ext4: return to starting transaction in ext4_dax_huge_fault()
        mm: fix data corruption due to stale mmap reads
        dax: prevent invalidation of mapped DAX entries
        Tigran has moved
        mm, vmalloc: fix vmalloc users tracking properly
        mm/khugepaged: add missed tracepoint for collapse_huge_page_swapin
        gcov: support GCC 7.1
        mm, vmstat: Remove spurious WARN() during zoneinfo print
        time: delete current_fs_time()
        hwpoison, memcg: forcibly uncharge LRU pages
      1251704a
  3. 12 May, 2017 25 commits
    • Roman Gushchin's avatar
      mm, docs: update memory.stat description with workingset* entries · b340959e
      Roman Gushchin authored
      Commit 4b4cea91691d ("mm: vmscan: fix IO/refault regression in cache
      workingset transition") introduced three new entries in memory stat
      file:
      
       - workingset_refault
       - workingset_activate
       - workingset_nodereclaim
      
      This commit adds a corresponding description to the cgroup v2 docs.
      
      Link: http://lkml.kernel.org/r/1494530293-31236-1-git-send-email-guro@fb.comSigned-off-by: default avatarRoman Gushchin <guro@fb.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Li Zefan <lizefan@huawei.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b340959e
    • Minchan Kim's avatar
      mm: vmscan: scan until it finds eligible pages · 791b48b6
      Minchan Kim authored
      Although there are a ton of free swap and anonymous LRU page in elgible
      zones, OOM happened.
      
        balloon invoked oom-killer: gfp_mask=0x17080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOTRACK), nodemask=(null),  order=0, oom_score_adj=0
        CPU: 7 PID: 1138 Comm: balloon Not tainted 4.11.0-rc6-mm1-zram-00289-ge228d67e9677-dirty #17
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
        Call Trace:
         oom_kill_process+0x21d/0x3f0
         out_of_memory+0xd8/0x390
         __alloc_pages_slowpath+0xbc1/0xc50
         __alloc_pages_nodemask+0x1a5/0x1c0
         pte_alloc_one+0x20/0x50
         __pte_alloc+0x1e/0x110
         __handle_mm_fault+0x919/0x960
         handle_mm_fault+0x77/0x120
         __do_page_fault+0x27a/0x550
         trace_do_page_fault+0x43/0x150
         do_async_page_fault+0x2c/0x90
         async_page_fault+0x28/0x30
        Mem-Info:
        active_anon:424716 inactive_anon:65314 isolated_anon:0
         active_file:52 inactive_file:46 isolated_file:0
         unevictable:0 dirty:27 writeback:0 unstable:0
         slab_reclaimable:3967 slab_unreclaimable:4125
         mapped:133 shmem:43 pagetables:1674 bounce:0
         free:4637 free_pcp:225 free_cma:0
        Node 0 active_anon:1698864kB inactive_anon:261256kB active_file:208kB inactive_file:184kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:532kB dirty:108kB writeback:0kB shmem:172kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
        DMA free:7316kB min:32kB low:44kB high:56kB active_anon:8064kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:464kB slab_unreclaimable:40kB kernel_stack:0kB pagetables:24kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
        lowmem_reserve[]: 0 992 992 1952
        DMA32 free:9088kB min:2048kB low:3064kB high:4080kB active_anon:952176kB inactive_anon:0kB active_file:36kB inactive_file:0kB unevictable:0kB writepending:88kB present:1032192kB managed:1019388kB mlocked:0kB slab_reclaimable:13532kB slab_unreclaimable:16460kB kernel_stack:3552kB pagetables:6672kB bounce:0kB free_pcp:56kB local_pcp:24kB free_cma:0kB
        lowmem_reserve[]: 0 0 0 959
        Movable free:3644kB min:1980kB low:2960kB high:3940kB active_anon:738560kB inactive_anon:261340kB active_file:188kB inactive_file:640kB unevictable:0kB writepending:20kB present:1048444kB managed:1010816kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:832kB local_pcp:60kB free_cma:0kB
        lowmem_reserve[]: 0 0 0 0
        DMA: 1*4kB (E) 0*8kB 18*16kB (E) 10*32kB (E) 10*64kB (E) 9*128kB (ME) 8*256kB (E) 2*512kB (E) 2*1024kB (E) 0*2048kB 0*4096kB = 7524kB
        DMA32: 417*4kB (UMEH) 181*8kB (UMEH) 68*16kB (UMEH) 48*32kB (UMEH) 14*64kB (MH) 3*128kB (M) 1*256kB (H) 1*512kB (M) 2*1024kB (M) 0*2048kB 0*4096kB = 9836kB
        Movable: 1*4kB (M) 1*8kB (M) 1*16kB (M) 1*32kB (M) 0*64kB 1*128kB (M) 2*256kB (M) 4*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 3772kB
        378 total pagecache pages
        17 pages in swap cache
        Swap cache stats: add 17325, delete 17302, find 0/27
        Free swap  = 978940kB
        Total swap = 1048572kB
        524157 pages RAM
        0 pages HighMem/MovableOnly
        12629 pages reserved
        0 pages cma reserved
        0 pages hwpoisoned
        [ pid ]   uid  tgid total_vm      rss nr_ptes nr_pmds swapents oom_score_adj name
        [  433]     0   433     4904        5      14       3       82             0 upstart-udev-br
        [  438]     0   438    12371        5      27       3      191         -1000 systemd-udevd
      
      With investigation, skipping page of isolate_lru_pages makes reclaim
      void because it returns zero nr_taken easily so LRU shrinking is
      effectively nothing and just increases priority aggressively.  Finally,
      OOM happens.
      
      The problem is that get_scan_count determines nr_to_scan with eligible
      zones so although priority drops to zero, it couldn't reclaim any pages
      if the LRU contains mostly ineligible pages.
      
      get_scan_count:
      
              size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx);
      	size = size >> sc->priority;
      
      Assumes sc->priority is 0 and LRU list is as follows.
      
      	N-N-N-N-H-H-H-H-H-H-H-H-H-H-H-H-H-H-H-H
      
      (Ie, small eligible pages are in the head of LRU but others are
       almost ineligible pages)
      
      In that case, size becomes 4 so VM want to scan 4 pages but 4 pages from
      tail of the LRU are not eligible pages.  If get_scan_count counts
      skipped pages, it doesn't reclaim any pages remained after scanning 4
      pages so it ends up OOM happening.
      
      This patch makes isolate_lru_pages try to scan pages until it encounters
      eligible zones's pages.
      
      [akpm@linux-foundation.org: clean up mind-bending `for' statement.  Tweak comment text]
      Fixes: 3db65812 ("Revert "mm, vmscan: account for skipped pages as a partial scan"")
      Link: http://lkml.kernel.org/r/1494457232-27401-1-git-send-email-minchan@kernel.orgSigned-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      791b48b6
    • David Rientjes's avatar
      mm, thp: copying user pages must schedule on collapse · 338a16ba
      David Rientjes authored
      We have encountered need_resched warnings in __collapse_huge_page_copy()
      while doing {clear,copy}_user_highpage() over HPAGE_PMD_NR source pages.
      
      mm->mmap_sem is held for write, but the iteration is well bounded.
      
      Reschedule as needed.
      
      Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1705101426380.109808@chino.kir.corp.google.comSigned-off-by: default avatarDavid Rientjes <rientjes@google.com>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      338a16ba
    • Ross Zwisler's avatar
      dax: fix PMD data corruption when fault races with write · 876f2946
      Ross Zwisler authored
      This is based on a patch from Jan Kara that fixed the equivalent race in
      the DAX PTE fault path.
      
      Currently DAX PMD read fault can race with write(2) in the following
      way:
      
      CPU1 - write(2)                 CPU2 - read fault
                                      dax_iomap_pmd_fault()
                                        ->iomap_begin() - sees hole
      
      dax_iomap_rw()
        iomap_apply()
          ->iomap_begin - allocates blocks
          dax_iomap_actor()
            invalidate_inode_pages2_range()
              - there's nothing to invalidate
      
                                        grab_mapping_entry()
      				  - we add huge zero page to the radix tree
      				    and map it to page tables
      
      The result is that hole page is mapped into page tables (and thus zeros
      are seen in mmap) while file has data written in that place.
      
      Fix the problem by locking exception entry before mapping blocks for the
      fault.  That way we are sure invalidate_inode_pages2_range() call for
      racing write will either block on entry lock waiting for the fault to
      finish (and unmap stale page tables after that) or read fault will see
      already allocated blocks by write(2).
      
      Fixes: 9f141d6e ("dax: Call ->iomap_begin without entry lock during dax fault")
      Link: http://lkml.kernel.org/r/20170510172700.18991-1-ross.zwisler@linux.intel.comSigned-off-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      876f2946
    • Jan Kara's avatar
      dax: fix data corruption when fault races with write · 13e451fd
      Jan Kara authored
      Currently DAX read fault can race with write(2) in the following way:
      
      CPU1 - write(2)			CPU2 - read fault
      				dax_iomap_pte_fault()
      				  ->iomap_begin() - sees hole
      dax_iomap_rw()
        iomap_apply()
          ->iomap_begin - allocates blocks
          dax_iomap_actor()
            invalidate_inode_pages2_range()
              - there's nothing to invalidate
      				  grab_mapping_entry()
      				  - we add zero page in the radix tree
      				    and map it to page tables
      
      The result is that hole page is mapped into page tables (and thus zeros
      are seen in mmap) while file has data written in that place.
      
      Fix the problem by locking exception entry before mapping blocks for the
      fault.  That way we are sure invalidate_inode_pages2_range() call for
      racing write will either block on entry lock waiting for the fault to
      finish (and unmap stale page tables after that) or read fault will see
      already allocated blocks by write(2).
      
      Fixes: 9f141d6e
      Link: http://lkml.kernel.org/r/20170510085419.27601-5-jack@suse.czSigned-off-by: default avatarJan Kara <jack@suse.cz>
      Reviewed-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      13e451fd
    • Jan Kara's avatar
      ext4: return to starting transaction in ext4_dax_huge_fault() · fb26a1cb
      Jan Kara authored
      DAX will return to locking exceptional entry before mapping blocks for a
      page fault to fix possible races with concurrent writes.  To avoid lock
      inversion between exceptional entry lock and transaction start, start
      the transaction already in ext4_dax_huge_fault().
      
      Fixes: 9f141d6e
      Link: http://lkml.kernel.org/r/20170510085419.27601-4-jack@suse.czSigned-off-by: default avatarJan Kara <jack@suse.cz>
      Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fb26a1cb
    • Jan Kara's avatar
      mm: fix data corruption due to stale mmap reads · cd656375
      Jan Kara authored
      Currently, we didn't invalidate page tables during invalidate_inode_pages2()
      for DAX.  That could result in e.g. 2MiB zero page being mapped into
      page tables while there were already underlying blocks allocated and
      thus data seen through mmap were different from data seen by read(2).
      The following sequence reproduces the problem:
      
       - open an mmap over a 2MiB hole
      
       - read from a 2MiB hole, faulting in a 2MiB zero page
      
       - write to the hole with write(3p). The write succeeds but we
         incorrectly leave the 2MiB zero page mapping intact.
      
       - via the mmap, read the data that was just written. Since the zero
         page mapping is still intact we read back zeroes instead of the new
         data.
      
      Fix the problem by unconditionally calling invalidate_inode_pages2_range()
      in dax_iomap_actor() for new block allocations and by properly
      invalidating page tables in invalidate_inode_pages2_range() for DAX
      mappings.
      
      Fixes: c6dcf52c
      Link: http://lkml.kernel.org/r/20170510085419.27601-3-jack@suse.czSigned-off-by: default avatarJan Kara <jack@suse.cz>
      Signed-off-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      cd656375
    • Ross Zwisler's avatar
      dax: prevent invalidation of mapped DAX entries · 4636e70b
      Ross Zwisler authored
      Patch series "mm,dax: Fix data corruption due to mmap inconsistency",
      v4.
      
      This series fixes data corruption that can happen for DAX mounts when
      page faults race with write(2) and as a result page tables get out of
      sync with block mappings in the filesystem and thus data seen through
      mmap is different from data seen through read(2).
      
      The series passes testing with t_mmap_stale test program from Ross and
      also other mmap related tests on DAX filesystem.
      
      This patch (of 4):
      
      dax_invalidate_mapping_entry() currently removes DAX exceptional entries
      only if they are clean and unlocked.  This is done via:
      
        invalidate_mapping_pages()
          invalidate_exceptional_entry()
            dax_invalidate_mapping_entry()
      
      However, for page cache pages removed in invalidate_mapping_pages()
      there is an additional criteria which is that the page must not be
      mapped.  This is noted in the comments above invalidate_mapping_pages()
      and is checked in invalidate_inode_page().
      
      For DAX entries this means that we can can end up in a situation where a
      DAX exceptional entry, either a huge zero page or a regular DAX entry,
      could end up mapped but without an associated radix tree entry.  This is
      inconsistent with the rest of the DAX code and with what happens in the
      page cache case.
      
      We aren't able to unmap the DAX exceptional entry because according to
      its comments invalidate_mapping_pages() isn't allowed to block, and
      unmap_mapping_range() takes a write lock on the mapping->i_mmap_rwsem.
      
      Since we essentially never have unmapped DAX entries to evict from the
      radix tree, just remove dax_invalidate_mapping_entry().
      
      Fixes: c6dcf52c ("mm: Invalidate DAX radix tree entries only if appropriate")
      Link: http://lkml.kernel.org/r/20170510085419.27601-2-jack@suse.czSigned-off-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      Reported-by: default avatarJan Kara <jack@suse.cz>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: <stable@vger.kernel.org>    [4.10+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4636e70b
    • Andrew Morton's avatar
      Tigran has moved · cea58224
      Andrew Morton authored
      Cc: Tigran Aivazian <aivazian.tigran@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      cea58224
    • Michal Hocko's avatar
      mm, vmalloc: fix vmalloc users tracking properly · 8594a21c
      Michal Hocko authored
      Commit 1f5307b1 ("mm, vmalloc: properly track vmalloc users") has
      pulled asm/pgtable.h include dependency to linux/vmalloc.h and that
      turned out to be a bad idea for some architectures.  E.g.  m68k fails
      with
      
         In file included from arch/m68k/include/asm/pgtable_mm.h:145:0,
                          from arch/m68k/include/asm/pgtable.h:4,
                          from include/linux/vmalloc.h:9,
                          from arch/m68k/kernel/module.c:9:
         arch/m68k/include/asm/mcf_pgtable.h: In function 'nocache_page':
      >> arch/m68k/include/asm/mcf_pgtable.h:339:43: error: 'init_mm' undeclared (first use in this function)
          #define pgd_offset_k(address) pgd_offset(&init_mm, address)
      
      as spotted by kernel build bot. nios2 fails for other reason
      
        In file included from include/asm-generic/io.h:767:0,
                         from arch/nios2/include/asm/io.h:61,
                         from include/linux/io.h:25,
                         from arch/nios2/include/asm/pgtable.h:18,
                         from include/linux/mm.h:70,
                         from include/linux/pid_namespace.h:6,
                         from include/linux/ptrace.h:9,
                         from arch/nios2/include/uapi/asm/elf.h:23,
                         from arch/nios2/include/asm/elf.h:22,
                         from include/linux/elf.h:4,
                         from include/linux/module.h:15,
                         from init/main.c:16:
        include/linux/vmalloc.h: In function '__vmalloc_node_flags':
        include/linux/vmalloc.h:99:40: error: 'PAGE_KERNEL' undeclared (first use in this function); did you mean 'GFP_KERNEL'?
      
      which is due to the newly added #include <asm/pgtable.h>, which on nios2
      includes <linux/io.h> and thus <asm/io.h> and <asm-generic/io.h> which
      again includes <linux/vmalloc.h>.
      
      Tweaking that around just turns out a bigger headache than necessary.
      This patch reverts 1f5307b1 and reimplements the original fix in a
      different way.  __vmalloc_node_flags can stay static inline which will
      cover vmalloc* functions.  We only have one external user
      (kvmalloc_node) and we can export __vmalloc_node_flags_caller and
      provide the caller directly.  This is much simpler and it doesn't really
      need any games with header files.
      
      [akpm@linux-foundation.org: coding-style fixes]
      [mhocko@kernel.org: revert old comment]
        Link: http://lkml.kernel.org/r/20170509211054.GB16325@dhcp22.suse.cz
      Fixes: 1f5307b1 ("mm, vmalloc: properly track vmalloc users")
      Link: http://lkml.kernel.org/r/20170509153702.GR6481@dhcp22.suse.czSigned-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Cc: Tobias Klauser <tklauser@distanz.ch>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8594a21c
    • SeongJae Park's avatar
      mm/khugepaged: add missed tracepoint for collapse_huge_page_swapin · 835152a2
      SeongJae Park authored
      One return case of `__collapse_huge_page_swapin()` does not invoke
      tracepoint while every other return case does.  This commit adds a
      tracepoint invocation for the case.
      
      Link: http://lkml.kernel.org/r/20170507101813.30187-1-sj38.park@gmail.comSigned-off-by: default avatarSeongJae Park <sj38.park@gmail.com>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      835152a2
    • Martin Liska's avatar
      gcov: support GCC 7.1 · 05384213
      Martin Liska authored
      Starting from GCC 7.1, __gcov_exit is a new symbol expected to be
      implemented in a profiling runtime.
      
      [akpm@linux-foundation.org: coding-style fixes]
      [mliska@suse.cz: v2]
        Link: http://lkml.kernel.org/r/e63a3c59-0149-c97e-4084-20ca8f146b26@suse.cz
      Link: http://lkml.kernel.org/r/8c4084fa-3885-29fe-5fc4-0d4ca199c785@suse.czSigned-off-by: default avatarMartin Liska <mliska@suse.cz>
      Acked-by: default avatarPeter Oberparleiter <oberpar@linux.vnet.ibm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      05384213
    • Reza Arbab's avatar
      mm, vmstat: Remove spurious WARN() during zoneinfo print · 8d35bb31
      Reza Arbab authored
      After commit e2ecc8a7 ("mm, vmstat: print non-populated zones in
      zoneinfo"), /proc/zoneinfo will show unpopulated zones.
      
      A memoryless node, having no populated zones at all, was previously
      ignored, but will now trigger the WARN() in is_zone_first_populated().
      
      Remove this warning, as its only purpose was to warn of a situation that
      has since been enabled.
      
      Aside: The "per-node stats" are still printed under the first populated
      zone, but that's not necessarily the first stanza any more.  I'm not
      sure which criteria is more important with regard to not breaking
      parsers, but it looks a little weird to the eye.
      
      Fixes:  e2ecc8a7 ("mm, vmstat: print node-based stats in zoneinfo file")
      Link: http://lkml.kernel.org/r/1493854905-10918-1-git-send-email-arbab@linux.vnet.ibm.comSigned-off-by: default avatarReza Arbab <arbab@linux.vnet.ibm.com>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Anshuman Khandual <khandual@linux.vnet.ibm.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8d35bb31
    • Deepa Dinamani's avatar
      time: delete current_fs_time() · 572e0ca9
      Deepa Dinamani authored
      All uses of the current_fs_time() function have been replaced by other
      time interfaces.
      
      And, its use cases can be fulfilled by current_time() or ktime_get_*
      variants.
      
      Link: http://lkml.kernel.org/r/1491613030-11599-13-git-send-email-deepa.kernel@gmail.comSigned-off-by: default avatarDeepa Dinamani <deepa.kernel@gmail.com>
      Reviewed-by: default avatarArnd Bergmann <arnd@arndb.de>
      Cc: John Stultz <john.stultz@linaro.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      572e0ca9
    • Michal Hocko's avatar
      hwpoison, memcg: forcibly uncharge LRU pages · 18365225
      Michal Hocko authored
      Laurent Dufour has noticed that hwpoinsoned pages are kept charged.  In
      his particular case he has hit a bad_page("page still charged to
      cgroup") when onlining a hwpoison page.  While this looks like something
      that shouldn't happen in the first place because onlining hwpages and
      returning them to the page allocator makes only little sense it shows a
      real problem.
      
      hwpoison pages do not get freed usually so we do not uncharge them (at
      least not since commit 0a31bc97 ("mm: memcontrol: rewrite uncharge
      API")).  Each charge pins memcg (since e8ea14cc ("mm: memcontrol:
      take a css reference for each charged page")) as well and so the
      mem_cgroup and the associated state will never go away.  Fix this leak
      by forcibly uncharging a LRU hwpoisoned page in delete_from_lru_cache().
      We also have to tweak uncharge_list because it cannot rely on zero ref
      count for these pages.
      
      [akpm@linux-foundation.org: coding-style fixes]
      Fixes: 0a31bc97 ("mm: memcontrol: rewrite uncharge API")
      Link: http://lkml.kernel.org/r/20170502185507.GB19165@dhcp22.suse.czSigned-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Reported-by: default avatarLaurent Dufour <ldufour@linux.vnet.ibm.com>
      Tested-by: default avatarLaurent Dufour <ldufour@linux.vnet.ibm.com>
      Reviewed-by: default avatarBalbir Singh <bsingharora@gmail.com>
      Reviewed-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      18365225
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 0fcc3ab2
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
       "Incremental fixes and a small feature addition on top of the main
        libnvdimm 4.12 pull request:
      
         - Geert noticed that tinyconfig was bloated by BLOCK selecting DAX.
           The size regression is fixed by moving all dax helpers into the
           dax-core and only specifying "select DAX" for FS_DAX and
           dax-capable drivers. He also asked for clarification of the
           NR_DEV_DAX config option which, on closer look, does not need to be
           a config option at all. Mike also throws in a DEV_DAX_PMEM fixup
           for good measure.
      
         - Ben's attention to detail on -stable patch submissions caught a
           case where the recent fixes to arch_copy_from_iter_pmem() missed a
           condition where we strand dirty data in the cache. This is tagged
           for -stable and will also be included in the rework of the pmem api
           to a proposed {memcpy,copy_user}_flushcache() interface for 4.13.
      
         - Vishal adds a feature that missed the initial pull due to pending
           review feedback. It allows the kernel to clear media errors when
           initializing a BTT (atomic sector update driver) instance on a pmem
           namespace.
      
         - Ross noticed that the dax_device + dax_operations conversion broke
           __dax_zero_page_range(). The nvdimm unit tests fail to check this
           path, but xfstests immediately trips over it. No excuse for missing
           this before submitting the 4.12 pull request.
      
        These all pass the nvdimm unit tests and an xfstests spot check. The
        set has received a build success notification from the kbuild robot"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        filesystem-dax: fix broken __dax_zero_page_range() conversion
        libnvdimm, btt: ensure that initializing metadata clears poison
        libnvdimm: add an atomic vs process context flag to rw_bytes
        x86, pmem: Fix cache flushing for iovec write < 8 bytes
        device-dax: kill NR_DEV_DAX
        block, dax: move "select DAX" from BLOCK to FS_DAX
        device-dax: Tell kbuild DEV_DAX_PMEM depends on DEV_DAX
      0fcc3ab2
    • Linus Torvalds's avatar
      Merge tag 'sound-fix-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · deac8429
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This contains a one-liner change that has a significant impact:
        disabling the build of OSS. It's been unmaintained for long time, and
        we'd like to drop the stuff. Finally, as the first step, stop the
        build. Let's see whether it works without much complaints.
      
        Other than that, there are two small fixes for HD-audio"
      
      * tag 'sound-fix-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        sound: Disable the build of OSS drivers
        ALSA: hda: Fix cpu lockup when stopping the cmd dmas
        ALSA: hda - Add mute led support for HP EliteBook 840 G3
      deac8429
    • Linus Torvalds's avatar
      Merge tag 'for-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply · 6b402bdf
      Linus Torvalds authored
      Pull more power-supply updates from Sebastian Reichel:
       "The power-supply subsystem has a few more changes for the v4.12 merge
        window:
      
         - New battery driver for AXP20X and AXP22X PMICs
      
         - Improve max17042_battery for usage on x86
      
         - Misc small cleanups & fixes"
      
      * tag 'for-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (34 commits)
        power: supply: cpcap-charger: Keep trickle charger bits disabled
        power: supply: cpcap-charger: Fix enable for 3.8V charge setting
        power: supply: cpcap-charger: Fix charge voltage configuration
        power: supply: cpcap-charger: Fix charger name
        power: supply: twl4030-charger: make twl4030_bci_property_is_writeable static
        power: supply: sbs-battery: Add alert callback
        mailmap: add Sebastian Reichel
        power: supply: avoid unused twl4030-madc.h
        power: supply: sbs-battery: Correct supply status with current draw
        power: supply: sbs-battery: Don't ignore the first external power change
        power: supply: pda_power: move from timer to delayed_work
        power: supply: max17042_battery: Add support for the SCOPE property
        power: supply: max17042_battery: Add support for the CHARGE_NOW property
        power: supply: max17042_battery: Add support for the CHARGE_FULL_DESIGN property
        power: supply: max17042_battery: mAh readings depend on r_sns value
        power: supply: max17042_battery: Add support for the VOLT_MIN property
        power: supply: max17042_battery: Add support for the TECHNOLOGY attribute
        power: supply: max17042_battery: Add external_power_changed callback
        power: supply: max17042_battery: Add support for the STATUS property
        power: supply: max17042_battery: Add default platform_data fallback data
        ...
      6b402bdf
    • Linus Torvalds's avatar
      Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · 6a776e47
      Linus Torvalds authored
      Pull thermal management updates from Zhang Rui:
      
       - Fix a problem where orderly_shutdown() is called for multiple times
         due to multiple critical overheating events raised in a short period
         by platform thermal driver. (Keerthy)
      
       - Introduce a backup thermal shutdown mechanism, which invokes
         kernel_power_off()/emergency_restart() directly, after
         orderly_shutdown() being issued for certain amount of time(specified
         via Kconfig). This is useful in certain conditions that userspace may
         be unable to power off the system in a clean manner and leaves the
         system in a critical state, like in the middle of driver probing
         phase. (Keerthy)
      
       - Introduce a new interface in thermal devfreq_cooling code so that the
         driver can provide more precise data regarding actual power to the
         thermal governor every time the power budget is calculated. (Lukasz
         Luba)
      
       - Introduce BCM 2835 soc thermal driver and northstar thermal driver,
         within a new sub-folder. (Rafał Miłecki)
      
       - Introduce DA9062/61 thermal driver. (Steve Twiss)
      
       - Remove non-DT booting on TI-SoC driver. Also add support to fetching
         coefficients from DT. (Keerthy)
      
       - Refactorf RCAR Gen3 thermal driver. (Niklas Söderlund)
      
       - Small fix on MTK and intel-soc-dts thermal driver. (Dawei Chien,
         Brian Bian)
      
      * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: (25 commits)
        thermal: core: Add a back up thermal shutdown mechanism
        thermal: core: Allow orderly_poweroff to be called only once
        Thermal: Intel SoC DTS: Change interrupt request behavior
        trace: thermal: add another parameter 'power' to the tracing function
        thermal: devfreq_cooling: add new interface for direct power read
        thermal: devfreq_cooling: refactor code and add get_voltage function
        thermal: mt8173: minor mtk_thermal.c cleanups
        thermal: bcm2835: move to the broadcom subdirectory
        thermal: broadcom: ns: specify myself as MODULE_AUTHOR
        thermal: da9062/61: Thermal junction temperature monitoring driver
        Documentation: devicetree: thermal: da9062/61 TJUNC temperature binding
        thermal: broadcom: add Northstar thermal driver
        dt-bindings: thermal: add support for Broadcom's Northstar thermal
        thermal: bcm2835: add thermal driver for bcm2835 SoC
        dt-bindings: Add thermal zone to bcm2835-thermal example
        thermal: rcar_gen3_thermal: add suspend and resume support
        thermal: rcar_gen3_thermal: store device match data in private structure
        thermal: rcar_gen3_thermal: enable hardware interrupts for trip points
        thermal: rcar_gen3_thermal: record and check number of TSCs found
        thermal: rcar_gen3_thermal: check that TSC exists before memory allocation
        ...
      6a776e47
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux · a34ab101
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "AMD, nouveau, one i915, and one EDID fix for v4.12-rc1
      
        Some fixes that it would be good to have in rc1. It contains the i915
        quiet fix that you reported.
      
        It also has an amdgpu fixes pull, with lots of ongoing work on Vega10
        which is new in this kernel and is preliminary support so may have a
        fair bit of movement.
      
        Otherwise a few non-Vega10 AMD fixes, one EDID fix and some nouveau
        regression fixers"
      
      * tag 'drm-fixes-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux: (144 commits)
        drm/i915: Make vblank evade warnings optional
        drm/nouveau/therm: remove ineffective workarounds for alarm bugs
        drm/nouveau/tmr: avoid processing completed alarms when adding a new one
        drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
        drm/nouveau/tmr: handle races with hw when updating the next alarm time
        drm/nouveau/tmr: ack interrupt before processing alarms
        drm/nouveau/core: fix static checker warning
        drm/nouveau/fb/ram/gf100-: remove 0x10f200 read
        drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes
        drm/nouveau/kms/nv50: fix source-rect-only plane updates
        drm/nouveau/kms/nv50: remove pointless argument to window atomic_check_acquire()
        drm/amd/powerplay: refine pwm1_enable callback functions for CI.
        drm/amd/powerplay: refine pwm1_enable callback functions for vi.
        drm/amd/powerplay: refine pwm1_enable callback functions for Vega10.
        drm/amdgpu: refine amdgpu pwm1_enable sysfs interface.
        drm/amdgpu: add amd fan ctrl mode enums.
        drm/amd/powerplay: add more smu message on Vega10.
        drm/amdgpu: fix dependency issue
        drm/amd: fix init order of sched job
        drm/amdgpu: add some additional vega10 pci ids
        ...
      a34ab101
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · bd1286f9
      Linus Torvalds authored
      Pull SCSI target updates from Nicholas Bellinger:
       "Things were a lot more calm than previously expected. It's primarily
        fixes in various areas, with most of the new functionality centering
        around TCMU backend driver work that Xiubo Li has been driving.
      
        Here's the summary on the feature side:
      
         - Make T10-PI verify configurable for emulated (FILEIO + RD) backends
          (Dmitry Monakhov)
         - Allow target-core/TCMU pass-through to use in-kernel SPC-PR logic
          (Bryant Ly + MNC)
         - Add TCMU support for growing ring buffer size (Xiubo Li + MNC)
         - Add TCMU support for global block data pool (Xiubo Li + MNC)
      
        and on the bug-fix side:
      
         - Fix COMPARE_AND_WRITE non GOOD status handling for READ phase
          failures (Gary Guo + nab)
         - Fix iscsi-target hang with explicitly changing per NodeACL
          CmdSN number depth with concurrent login driven session
          reinstatement.  (Gary Guo + nab)
         - Fix ibmvscsis fabric driver ABORT task handling (Bryant Ly)
         - Fix target-core/FILEIO zero length handling (Bart Van Assche)
      
        Also, there was an OOPs introduced with the WRITE_VERIFY changes that
        I ended up reverting at the last minute, because as not unusual Bart
        and I could not agree on the fix in time for -rc1. Since it's specific
        to a conformance test, it's been reverted for now.
      
        There is a separate patch in the queue to address the underlying
        control CDB write overflow regression in >= v4.3 separate from the
        WRITE_VERIFY revert here, that will be pushed post -rc1"
      
      * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (30 commits)
        Revert "target: Fix VERIFY and WRITE VERIFY command parsing"
        IB/srpt: Avoid that aborting a command triggers a kernel warning
        IB/srpt: Fix abort handling
        target/fileio: Fix zero-length READ and WRITE handling
        ibmvscsis: Do not send aborted task response
        tcmu: fix module removal due to stuck thread
        target: Don't force session reset if queue_depth does not change
        iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
        target: Fix compare_and_write_callback handling for non GOOD status
        tcmu: Recalculate the tcmu_cmd size to save cmd area memories
        tcmu: Add global data block pool support
        tcmu: Add dynamic growing data area feature support
        target: fixup error message in target_tg_pt_gp_tg_pt_gp_id_store()
        target: fixup error message in target_tg_pt_gp_alua_access_type_store()
        target/user: PGR Support
        target: Add WRITE_VERIFY_16
        Documentation/target: add an example script to configure an iSCSI target
        target: Use kmalloc_array() in transport_kmap_data_sg()
        target: Use kmalloc_array() in compare_and_write_callback()
        target: Improve size determinations in two functions
        ...
      bd1286f9
    • Linus Torvalds's avatar
      Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 05045329
      Linus Torvalds authored
      Pull misc vfs updates from Al Viro:
       "Making sure that something like a referral point won't end up as pwd
        or root.
      
        The main part is the last commit (fixing mntns_install()); that one
        fixes a hard-to-hit race. The fchdir() commit is making fchdir(2) a
        bit more robust - it should be impossible to get opened files (even
        O_PATH ones) for referral points in the first place, so the existing
        checks are OK, but checking the same thing as in chdir(2) is just as
        cheap.
      
        The path_init() commit removes a redundant check that shouldn't have
        been there in the first place"
      
      * 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        make sure that mntns_install() doesn't end up with referral for root
        path_init(): don't bother with checking MAY_EXEC for LOOKUP_ROOT
        make sure that fchdir() won't accept referral points, etc.
      05045329
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e0c4a5fc
      Linus Torvalds authored
      Pull perf updates/fixes from Ingo Molnar:
       "Mostly tooling updates, but also two kernel fixes: a call chain
        handling robustness fix and an x86 PMU driver event definition fix"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/callchain: Force USER_DS when invoking perf_callchain_user()
        tools build: Fixup sched_getcpu feature test
        perf tests kmod-path: Don't fail if compressed modules aren't supported
        perf annotate: Fix AArch64 comment char
        perf tools: Fix spelling mistakes
        perf/x86: Fix Broadwell-EP DRAM RAPL events
        perf config: Refactor a duplicated code for obtaining config file name
        perf symbols: Allow user probes on versioned symbols
        perf symbols: Accept symbols starting at address 0
        tools lib string: Adopt prefixcmp() from perf and subcmd
        perf units: Move parse_tag_value() to units.[ch]
        perf ui gtk: Move gtk .so name to the only place where it is used
        perf tools: Move HAS_BOOL define to where perl headers are used
        perf memswap: Split the byteswap memory range wrappers from util.[ch]
        perf tools: Move event prototypes from util.h to event.h
        perf buildid: Move prototypes from util.h to build-id.h
      e0c4a5fc
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · dfcb7b23
      Linus Torvalds authored
      Pull timer fix from Ingo Molnar:
       "A single ARM Juno clocksource driver fix"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clocksource/arm_arch_timer: Fix arch_timer_mem_find_best_frame()
      dfcb7b23
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1b84fc15
      Linus Torvalds authored
      Pull stackprotector fixlet from Ingo Molnar:
       "A single fix/enhancement to increase stackprotector canary randomness
        on 64-bit kernels with very little cost"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
      1b84fc15