Merge tag 'amlogic-dt64' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into next/dt

Pull "Amlogic 64-bit DT updates for v4.16" from Kevin Hilman
- meson-gx: add VPU power domain support
- odroid-c2: add HDMI and CEC nodes
- misc cleanups

* tag 'amlogic-dt64' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic:
  ARM64: dts: meson-gxm: fix q200 interrupt number
  ARM64: dts: meson-gxm: add the PHY interrupt line on Khadas VIM2
  ARM64: dts: meson: add comments with the GPIO for the PHY interrupts
  ARM64: dts: amlogic: use generic bus node names
  ARM64: dts: meson: drop "sana" clock from SAR ADC
  ARM64: dts: odroid-c2: Add HDMI and CEC Nodes
  ARM64: dts: meson-gx: grow reset controller memory zone
  ARM64: dts: meson-gx: Add HDMI_5V regulator on selected boards
  ARM64: dts: meson-gx: add VPU power domain

Merge tag 'amlogic-dt' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into next/dt

Pull "Amlogic 32-bit DT changes for v4.16" from Kevin Hilman:
- meson8: GPIO IRQ support
- switch to stable UART bindings w/correct clock
- add more L2 cache settings
- drop unused ADC clock

* tag 'amlogic-dt' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic:
  ARM: meson: enable MESON_IRQ_GPIO also for MACH_MESON8
  ARM: dts: meson8: enable the GPIO interrupt controller
  ARM: dts: meson8b: use stable UART bindings with correct gate clock
  ARM: dts: meson8: use stable UART bindings with correct gate clock
  ARM: dts: meson: drop "sana" clock from SAR ADC
  ARM: dts: meson8: add more L2 cache settings
  ARM: dts: meson8b: add more L2 cache settings

Merge tag 'renesas-arm64-dt-for-v4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/dt

Pull "Renesas ARM64 Based SoC DT Updates for v4.16" from Simon Horman:

* Use r8a77970 (V3M) CPG core clock and SYSC power domain macros

  These may be used in place of numeric constants now that they
  are present in Linus's tree.

* Add r8a77970 (V3M) Starter Kit board support

  This includes basic support to bring up the board with a serial
  console and EtherAVB support

* Add IPMMU nodes and connections to on-chip devices
  on r8a7795 (H3), r8a7796 (M3-W), r8a77970 (V3M) and r8a77995 (D3) SoCs

  Simon Horman says "With these patches applied a white list enabled IPMMU
  driver may be used to check silicon revision and then enable IPMMU in the
  known working cases."

* Enable DMA for SCIF2 on r8a77995 (D2) SoC

* Increase the number of GPIO bank 1 ports to 29 on r8a7795 (H3) SoC

  This adds support for the GP-1-28 port pin of the r8a7795 (H3) ES2.0 SoC

* Add support for CAN to r8a77995 (D3) SoC

  Ulrich Hecht says "This is a by-the-datasheet implementation, with the
  datasheet missing some bits, namely the pin map.  I filled in the gaps...
  by deducing the information from pin numbers already in the PFC driver,
  so careful scrutiny is advised."

* Add support for SDHI to r8a77995 (D3) SoC

* Add SoC name to file header of r8a7795 (H3) and r8a7796 (M3-W)
  Salvator-X and Salvator-XS board files

  Geert Uytterhoeven says "With the proliferation of Salvator-X and
  Salvator-XS boards carrying different R-Car Gen3 SoCs variants, several
  DTS files ended up having the same file headers.

  Add the SoC names to the file headers to avoid confusion."

* Add device note for ROHM BD9571MWV PMIC to
  r8a7795 (H3) and r8a7796 (M3-W) Salvator-X and Salvator-XS boards.

  Geert Uytterhoeven says "This was based on the example in the DT binding
  documentation, but using IRQ0 instead of a GPIO interrupt, as that
  matches the schematics, and because INTC-EX is a simpler block."

* Enable USB2.0 channel 0 on r8a77970 (V3M) ULCB Kingfisher board

  Vladimir Barinov says "The dedicated USB0_PWEN pin is used to control
  CN13 VBUS source from U43 power supply.  MAX3355 can also provide VBUS,
  hence it should be disabled via OTG_OFFVBUSn node coming from gpio
  expander TCA9539.  Set MAX3355 enabled using OTG_EXTLPn node to be able
  to read OTG ID of CN13."

* Add support for r8a7795 (M3-W) Salvator-XS board

  Geert Uytterhoeven says "This patch series adds support for the version
  of the Salvator-XS development board equipped with an R-Car M3-W SiP.

  The DT was based on work for the Salvator-X and -XS boards with M3-W
  resp. H3 SiPs."

* Add watchdog timer support to r8a77970 (V3M) eagle board

  Geert Uytterhoven says "This allows to use the watchdog timer to reset
  the board, until PSCI is enhanced to include such functionality."

* Use Use R-Car SDHI Gen3 fallback on r8a7795 (H3) and r8a7796 (M3-W) SoCs

* Set driver type for MMC on r8a7795 (H3) and r8a7796 (M3-W) Salvator-X and
  Salvator-XS boards.

  Wolfram Sang says "These boards are known to have eMMC issues with the
  default driver type.  Specify a working one."

* tag 'renesas-arm64-dt-for-v4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/horms/renesas: (54 commits)
  arm64: dts: renesas: r8a77970: use SYSC power domain macros
  arm64: dts: renesas: r8a77970: use CPG core clock macros
  arm64: dts: renesas: v3msk: add EtherAVB support
  arm64: dts: renesas: initial V3MSK board device tree
  arm64: dts: renesas: r8a77995: Connect Ethernet-AVB to IPMMU-RT
  arm64: dts: renesas: r8a77995: Add IPMMU device nodes
  arm64: dts: renesas: r8a77970: Enable IPMMU-DS1, RT and MM
  arm64: dts: renesas: r8a77970: Connect Ethernet-AVB to IPMMU-RT
  arm64: dts: renesas: r8a77970: Tie SYS-DMAC to IPMMU-DS1
  arm64: dts: renesas: r8a77970: Add IPMMU device nodes
  arm64: dts: renesas: r8a77995: add DMA for SCIF2
  arm64: dts: renesas: r8a77970: sort includes
  arm64: dts: renesas: r8a7795: Increase the number of GPIO bank 1 ports to 29
  arm64: dts: renesas: r8a77995: Add CAN FD support
  arm64: dts: renesas: r8a77995: Add CAN support
  arm64: dts: renesas: r8a77995: Add CAN external clock support
  arm64: dts: renesas: r8a7795-salvator-xs: Add SoC name to file header
  arm64: dts: renesas: r8a7796-salvator-x: Add SoC name to file header
  arm64: dts: renesas: r8a7795-salvator-x: Add SoC name to file header
  arm64: dts: renesas: r8a7795-es1-salvator-x: Add SoC name to file header
  ...

Merge tag 'renesas-dt-for-v4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/dt

Pull "Renesas ARM Based SoC DT Updates for v4.16" from Simon Horman:

* Convert to named i2c-gpio bindings

  Geert Uytterhoeven says "Commits 7d29f509 ("dt-bindings: i2c:
  i2c-gpio: Add support for named gpios") and 05c74778 ("i2c: gpio:
  Add support for named gpios in DT") introduced named i2c-gpio DT
  bindings, and deprecated the more error-prone unnamed variant.

  This patch series switches all Renesas boards to the new bindings, and
  adds the missing GPIO_OPEN_DRAIN I/O flags, which were implicitly
  assumed before..."

  ...  Note that after this series is applied, the i2c-gpio buses are no
  longer detected when booting new DTBs on old (v4.14 and older) kernels,
  which should not be an issue.  Booting old DTBs on new kernels is not
  affected."

* Update DTS for CMT DT binding rework

  Geert Uytterhoeven says "This patch series updates the CMT device nodes
  in the various Renesas DTS files sh_cmt clocksource driver for the recent
  DT binding rework that was merged in v4.14-rc1 and v4.15-rc1..."

* Add SMP support to r8a7794 (R-Car E2) SoC

  Sergei Shtylyov says "Add the device tree node for the Advanced Power
  Management Unit (APMU).  Use the "enable-method" prop to  point out that
  the APMU should be used for the SMP support."

* Correct primary compatible value for eeprom
  on r7s72100 (RZ/A1H) genmai and r8a7791 (R-Car M2-W) koelsh boards

  Geert Uytterhoeven says "The Renesas part numbers of the two-wire serial
  interface EEPROMs do not follow the 24Cxx pattern, but the R1EX24xxx
  pattern.

  Hence change the primary compatible values to the appropriate variant of
  "renesas,r1ex24xxx", like is already done on Gose.""

* Move cec_clock to root node on r8a7791 (R-Car M2-W) koelsh board
  r8a7791 (R-Car M2-W) koelsh board

* Use R-Car SDHI and Ether Gen1 and 2 fallback compat strings

  Use recently posted R-Car SDHI and Ether Gen 1 and 2 fallback
  compat strings in the DT of Renesas ARM based SoCs.

* Add IIC cores to dtsi of r8a7745 (RZ/G1E) SoC

* Rework DT architecture for r8a7745 (RZ/G1E) iW-RainboW-G22D development
  platform and add serial support.

  Fabrizio Castro says "... define a new DT architecture for the
  iW-RainboW-G22D SODIMM Development Platform to include the configuration
  with the HDMI daughter board and to define the serial interfaces."

* Add USB function support to
  r8a7745 (RZ/G1E) iW-RainboW-G22D development platform

* Add PCIEC and ttySC3 support to r8a7743 (RZ/G1M) iW-RainboW-G20M-Qseven SoM

* Add VIN support to r8a7743 (RZ/G1M) and r8a7745 (RZ/G1E) SoCs

* Add CAN and HDMI support to r8a7743 (RZ/G1M) iW-RainboW-G20D-Qseven and
  r8a7745 (RZ/G1E) iW-RainboW-G22D development platforms

* tag 'renesas-dt-for-v4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/horms/renesas: (61 commits)
  ARM: dts: alt: Convert to named i2c-gpio bindings
  ARM: dts: koelsch: Convert to named i2c-gpio bindings
  ARM: dts: lager: Convert to named i2c-gpio bindings
  ARM: dts: armadillo800eva: Convert to named i2c-gpio bindings
  ARM: dts: sh73a0: Remove CMT renesas,channels-mask
  ARM: dts: r8a7794: Remove CMT renesas,channels-mask
  ARM: dts: r8a7793: Remove CMT renesas,channels-mask
  ARM: dts: r8a7791: Remove CMT renesas,channels-mask
  ARM: dts: r8a7790: Remove CMT renesas,channels-mask
  ARM: dts: r8a7740: Remove CMT renesas,channels-mask
  ARM: dts: r8a73a4: Remove CMT renesas,channels-mask
  ARM: dts: r8a7794: Update CMT compat strings
  ARM: dts: r8a7793: Update CMT compat strings
  ARM: dts: r8a7791: Update CMT compat strings
  ARM: dts: r8a7790: Update CMT compat strings
  ARM: dts: r8a73a4: Update CMT compat string
  ARM: dts: r8a7794: Add SMP support
  ARM: dts: genmai: Correct primary compatible value for eeprom
  ARM: dts: koelsch: Correct primary compatible value for eeprom
  ARM: dts: r8a7745: add VIN dt support
  ...

Merge tag 'renesas-dt-bindings-for-v4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/dt

Pull "Renesas ARM Based SoC DT Bindings Updates for v4.16" from Simon Horman:

* Document V3MSK board bindings

  These are the bindings for the R-Car V3M Starter Kit

* Document M3-W-based Salvator-XS board bingigns

  Geert Uytterhoeven says "The Renesas Salvator-XS (Salvator-X 2nd version)
  development board can be equipped with either an R-Car H3 ES2.0 or M3-W
  ES1.x SiP, which are pin-compatible."

* tag 'renesas-dt-bindings-for-v4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  arm64: renesas: document V3MSK board bindings
  ARM: shmobile: Document Renesas M3-W-based Salvator-XS board DT bindings

Blink the LED on a kernel panic.
Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org>
Acked-by: Guodong Xu <guodong.xu@linaro.org>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Blink the LED on a kernel panic.
Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org>
Acked-by: Guodong Xu <guodong.xu@linaro.org>
Tested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Blink the LED on a kernel panic.
Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

ARCH_S3C24XX is a very exceptional platform that some DT files in
arch/arm/boot/dts/, but does not select USE_OF.

All the other platforms with DT files correctly select USE_OF
directly or indirectly (Most of them are either ARCH_MULTIPLATFORM
or ARM_SINGLE_ARMV7M).

With ARCH_S3C24XX fixed, "ifeq ($(CONFIG_OF),y)" in DT Makefile
can be deleted.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

The at24 driver allows to register I2C EEPROM chips using different vendor
and devices, but the I2C subsystem does not take the vendor into account
when matching using the I2C table since it only has device entries.

But when matching using an OF table, both the vendor and device has to be
taken into account so the driver defines only a set of compatible strings
using the "atmel" vendor as a generic fallback for compatible I2C devices.

So add this generic fallback to the device node compatible string to make
the device to match the driver using the OF device ID table.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

The at24 driver allows to register I2C EEPROM chips using different vendor
and devices, but the I2C subsystem does not take the vendor into account
when matching using the I2C table since it only has device entries.

But when matching using an OF table, both the vendor and device has to be
taken into account so the driver defines only a set of compatible strings
using the "atmel" vendor as a generic fallback for compatible I2C devices.

So add this generic fallback to the device node compatible string to make
the device to match the driver using the OF device ID table.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

The at24 driver allows to register I2C EEPROM chips using different vendor
and devices, but the I2C subsystem does not take the vendor into account
when matching using the I2C table since it only has device entries.

But when matching using an OF table, both the vendor and device has to be
taken into account so the driver defines only a set of compatible strings
using the "atmel" vendor as a generic fallback for compatible I2C devices.

So add this generic fallback to the device node compatible string to make
the device to match the driver using the OF device ID table.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

This reverts commit 04e35f44.

SELinux runs with secureexec for all non-"noatsecure" domain transitions,
which means lots of processes end up hitting the stack hard-limit change
that was introduced in order to fix a race with prlimit(). That race fix
will need to be redesigned.
Reported-by: Laura Abbott <labbott@redhat.com>
Reported-by: Tomáš Trnka <trnka@scm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull Page Table Isolation (PTI) v4.14 backporting base tree from Ingo Molnar:
 "This tree contains the v4.14 PTI backport preparatory tree, which
  consists of four merges of upstream trees and 7 cherry-picked commits,
  which the upcoming PTI work depends on"

NOTE! The resulting tree is exactly the same as the original base tree
(ie the diff between this commit and its immediate first parent is
empty).

The only reason for this merge is literally to have a common point for
the actual PTI changes so that the commits can be shared in both the
4.15 and 4.14 trees.

* 'WIP.x86-pti.base-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow
  locking/barriers: Convert users of lockless_dereference() to READ_ONCE()
  locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE()
  bpf: fix build issues on um due to mising bpf_perf_event.h
  perf/x86: Enable free running PEBS for REGS_USER/INTR
  x86: Make X86_BUG_FXSAVE_LEAK detectable in CPUID on AMD
  x86/cpufeature: Add User-Mode Instruction Prevention definitions

Merge branch 'WIP.x86-pti.base.prep-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull Page Table Isolation (PTI) preparatory tree from Ingo Molnar:
 "This does a rename to free up linux/pti.h to be used by the upcoming
  page table isolation feature"

* 'WIP.x86-pti.base.prep-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  drivers/misc/intel/pti: Rename the header file to free up the namespace

Pull timer fix from Thomas Gleixner:
 "A single bugfix which prevents arbitrary sigev_notify values in
  posix-timers"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  posix-timer: Properly check sigevent->sigev_notify

Pull dmaengine fixes from Vinod Koul:
 "This time consisting of fixes in a bunch of drivers and the dmatest
  module:

   - Fix for disable clk on error path in fsl-edma driver
   - Disable clk fail fix in jz4740 driver
   - Fix long pending bug in dmatest driver for dangling pointer
   - Fix potential NULL pointer dereference in at_hdmac driver
   - Error handling path in ioat driver"

* tag 'dmaengine-fix-4.15-rc4' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine: fsl-edma: disable clks on all error paths
  dmaengine: jz4740: disable/unprepare clk if probe fails
  dmaengine: dmatest: move callback wait queue to thread context
  dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
  dmaengine: ioat: Fix error handling path

With CONFIG_MTD=m and CONFIG_CRAMFS=y, we now get a link failure:

  fs/cramfs/inode.o: In function `cramfs_mount': inode.c:(.text+0x220): undefined reference to `mount_mtd'
  fs/cramfs/inode.o: In function `cramfs_mtd_fill_super':
  inode.c:(.text+0x6d8): undefined reference to `mtd_point'
  inode.c:(.text+0xae4): undefined reference to `mtd_unpoint'

This adds a more specific Kconfig dependency to avoid the broken
configuration.

Alternatively we could make CRAMFS itself depend on "MTD || !MTD" with a
similar result.

Fixes: 99c18ce5 ("cramfs: direct memory access support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull vfs fixes from Al Viro:
 "The alloc_super() one is a regression in this merge window, lazytime
  thing is older..."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  VFS: Handle lazytime in do_mount()
  alloc_super(): do ->s_umount initialization earlier

Pull ext4 fixes from Ted Ts'o:
 "Fix a regression which caused us to fail to interpret symlinks in very
  ancient ext3 file system images.

  Also fix two xfstests failures, one of which could cause an OOPS, plus
  an additional bug fix caught by fuzz testing"

* tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix crash when a directory's i_size is too small
  ext4: add missing error check in __ext4_new_inode()
  ext4: fix fdatasync(2) after fallocate(2) operation
  ext4: support fast symlinks from ext3 file systems

[ Note, this is a Git cherry-pick of the following commit:

    d17a1d97: ("x86/mm/kasan: don't use vmemmap_populate() to initialize shadow")

  ... for easier x86 PTI code testing and back-porting. ]

The KASAN shadow is currently mapped using vmemmap_populate() since that
provides a semi-convenient way to map pages into init_top_pgt.  However,
since that no longer zeroes the mapped pages, it is not suitable for
KASAN, which requires zeroed shadow memory.

Add kasan_populate_shadow() interface and use it instead of
vmemmap_populate().  Besides, this allows us to take advantage of
gigantic pages and use them to populate the shadow, which should save us
some memory wasted on page tables and reduce TLB pressure.

Link: http://lkml.kernel.org/r/20171103185147.2688-2-pasha.tatashin@oracle.comSigned-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Steven Sistare <steven.sistare@oracle.com>
Cc: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Bob Picco <bob.picco@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>

[ Note, this is a Git cherry-pick of the following commit:

    506458ef ("locking/barriers: Convert users of lockless_dereference() to READ_ONCE()")

  ... for easier x86 PTI code testing and back-porting. ]

READ_ONCE() now has an implicit smp_read_barrier_depends() call, so it
can be used instead of lockless_dereference() without any change in
semantics.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1508840570-22169-4-git-send-email-will.deacon@arm.comSigned-off-by: Ingo Molnar <mingo@kernel.org>

[ Note, this is a Git cherry-pick of the following commit:

    76ebbe78 ("locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE()")

  ... for easier x86 PTI code testing and back-porting. ]

In preparation for the removal of lockless_dereference(), which is the
same as READ_ONCE() on all architectures other than Alpha, add an
implicit smp_read_barrier_depends() to READ_ONCE() so that it can be
used to head dependency chains on all architectures.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1508840570-22169-3-git-send-email-will.deacon@arm.comSigned-off-by: Ingo Molnar <mingo@kernel.org>

[ Note, this is a Git cherry-pick of the following commit:

    a23f06f0 ("bpf: fix build issues on um due to mising bpf_perf_event.h")

  ... for easier x86 PTI code testing and back-porting. ]

Since c895f6f7 ("bpf: correct broken uapi for
BPF_PROG_TYPE_PERF_EVENT program type") um (uml) won't build
on i386 or x86_64:

  [...]
    CC      init/main.o
  In file included from ../include/linux/perf_event.h:18:0,
                   from ../include/linux/trace_events.h:10,
                   from ../include/trace/syscall.h:7,
                   from ../include/linux/syscalls.h:82,
                   from ../init/main.c:20:
  ../include/uapi/linux/bpf_perf_event.h:11:32: fatal error:
  asm/bpf_perf_event.h: No such file or directory #include
  <asm/bpf_perf_event.h>
  [...]

Lets add missing bpf_perf_event.h also to um arch. This seems
to be the only one still missing.

Fixes: c895f6f7 ("bpf: correct broken uapi for BPF_PROG_TYPE_PERF_EVENT program type")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Suggested-by: Richard Weinberger <richard@sigma-star.at>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Cc: Richard Weinberger <richard@sigma-star.at>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>

[ Note, this is a Git cherry-pick of the following commit:

    a47ba4d7 ("perf/x86: Enable free running PEBS for REGS_USER/INTR")

  ... for easier x86 PTI code testing and back-porting. ]

Currently free running PEBS is disabled when user or interrupt
registers are requested. Most of the registers are actually
available in the PEBS record and can be supported.

So we just need to check for the supported registers and then
allow it: it is all except for the segment register.

For user registers this only works when the counter is limited
to ring 3 only, so this also needs to be checked.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170831214630.21892-1-andi@firstfloor.orgSigned-off-by: Ingo Molnar <mingo@kernel.org>

[ Note, this is a Git cherry-pick of the following commit:

    2b67799bdf25 ("x86: Make X86_BUG_FXSAVE_LEAK detectable in CPUID on AMD")

  ... for easier x86 PTI code testing and back-porting. ]

The latest AMD AMD64 Architecture Programmer's Manual
adds a CPUID feature XSaveErPtr (CPUID_Fn80000008_EBX[2]).

If this feature is set, the FXSAVE, XSAVE, FXSAVEOPT, XSAVEC, XSAVES
/ FXRSTOR, XRSTOR, XRSTORS always save/restore error pointers,
thus making the X86_BUG_FXSAVE_LEAK workaround obsolete on such CPUs.
Signed-Off-By: Rudolf Marek <r.marek@assembler.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Tested-by: Borislav Petkov <bp@suse.de>
Cc: Andy Lutomirski <luto@amacapital.net>
Link: https://lkml.kernel.org/r/bdcebe90-62c5-1f05-083c-eba7f08b2540@assembler.czSigned-off-by: Ingo Molnar <mingo@kernel.org>

[ Note, this is a Git cherry-pick of the following commit: (limited to the cpufeatures.h file)

    3522c2a6 ("x86/cpufeature: Add User-Mode Instruction Prevention definitions")

  ... for easier x86 PTI code testing and back-porting. ]

User-Mode Instruction Prevention is a security feature present in new
Intel processors that, when set, prevents the execution of a subset of
instructions if such instructions are executed in user mode (CPL > 0).
Attempting to execute such instructions causes a general protection
exception.

The subset of instructions comprises:

 * SGDT - Store Global Descriptor Table
 * SIDT - Store Interrupt Descriptor Table
 * SLDT - Store Local Descriptor Table
 * SMSW - Store Machine Status Word
 * STR  - Store Task Register

This feature is also added to the list of disabled-features to allow
a cleaner handling of build-time configuration.
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-7-git-send-email-ricardo.neri-calderon@linux.intel.comSigned-off-by: Ingo Molnar <mingo@kernel.org>

Merge a minimal set of virt cleanups, for a base for the MM isolation patches.
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Signed-off-by: Ingo Molnar <mingo@kernel.org>

Conflicts:
	arch/x86/kernel/cpu/Makefile
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Pull in a minimal set of v4.15 entry code changes, for a base for the MM isolation patches.
Signed-off-by: Ingo Molnar <mingo@kernel.org>

We'd like to use the 'PTI' acronym for 'Page Table Isolation' - free up the
namespace by renaming the <linux/pti.h> driver header to <linux/intel-pti.h>.

(Also standardize the header guard name while at it.)

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: J Freyensee <james_p_freyensee@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Pull rdma fixes from Jason Gunthorpe:
 "More fixes from testing done on the rc kernel, including more SELinux
  testing. Looking forward, lockdep found regression today in ipoib
  which is still being fixed.

  Summary:

   - Fix for SELinux on the umad SMI path. Some old hardware does not
     fill the PKey properly exposing another bug in the newer SELinux
     code.

   - Check the input port as we can exceed array bounds from this user
     supplied value

   - Users are unable to use the hash field support as they want due to
     incorrect checks on the field restrictions, correct that so the
     feature works as intended

   - User triggerable oops in the NETLINK_RDMA handler

   - cxgb4 driver fix for a bad interaction with CQ flushing in iser
     caused by patches in this merge window, and bad CQ flushing during
     normal close.

   - Unbalanced memalloc_noio in ipoib in an error path"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  IB/ipoib: Restore MM behavior in case of tx_ring allocation failure
  iw_cxgb4: only insert drain cqes if wq is flushed
  iw_cxgb4: only clear the ARMED bit if a notification is needed
  RDMA/netlink: Fix general protection fault
  IB/mlx4: Fix RSS hash fields restrictions
  IB/core: Don't enforce PKey security on SMI MADs
  IB/core: Bound check alternate path port number

Pull i2c fixes from Wolfram Sang:
 "Two bugfixes for the AT24 I2C eeprom driver and some minor corrections
  for I2C bus drivers"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: piix4: Fix port number check on release
  i2c: stm32: Fix copyrights
  i2c-cht-wc: constify platform_device_id
  eeprom: at24: change nvmem stride to 1
  eeprom: at24: fix I2C device selection for runtime PM

Pull NFS client fixes from Anna Schumaker:
 "This has two stable bugfixes, one to fix a BUG_ON() when
  nfs_commit_inode() is called with no outstanding commit requests and
  another to fix a race in the SUNRPC receive codepath.

  Additionally, there are also fixes for an NFS client deadlock and an
  xprtrdma performance regression.

  Summary:

  Stable bugfixes:
   - NFS: Avoid a BUG_ON() in nfs_commit_inode() by not waiting for a
     commit in the case that there were no commit requests.
   - SUNRPC: Fix a race in the receive code path

  Other fixes:
   - NFS: Fix a deadlock in nfs client initialization
   - xprtrdma: Fix a performance regression for small IOs"

* tag 'nfs-for-4.15-3' of git://git.linux-nfs.org/projects/anna/linux-nfs:
  SUNRPC: Fix a race in the receive code path
  nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
  xprtrdma: Spread reply processing over more CPUs
  nfs: fix a deadlock in nfs client initialization

This reverts commits 5c9d2d5c, c7da82b8, and e7fe7b5c.

We'll probably need to revisit this, but basically we should not
complicate the get_user_pages_fast() case, and checking the actual page
table protection key bits will require more care anyway, since the
protection keys depend on the exact state of the VM in question.

Particularly when doing a "remote" page lookup (ie in somebody elses VM,
not your own), you need to be much more careful than this was.  Dave
Hansen says:

 "So, the underlying bug here is that we now a get_user_pages_remote()
  and then go ahead and do the p*_access_permitted() checks against the
  current PKRU. This was introduced recently with the addition of the
  new p??_access_permitted() calls.

  We have checks in the VMA path for the "remote" gups and we avoid
  consulting PKRU for them. This got missed in the pkeys selftests
  because I did a ptrace read, but not a *write*. I also didn't
  explicitly test it against something where a COW needed to be done"

It's also not entirely clear that it makes sense to check the protection
key bits at this level at all.  But one possible eventual solution is to
make the get_user_pages_fast() case just abort if it sees protection key
bits set, which makes us fall back to the regular get_user_pages() case,
which then has a vma and can do the check there if we want to.

We'll see.

Somewhat related to this all: what we _do_ want to do some day is to
check the PAGE_USER bit - it should obviously always be set for user
pages, but it would be a good check to have back.  Because we have no
generic way to test for it, we lost it as part of moving over from the
architecture-specific x86 GUP implementation to the generic one in
commit e585513b ("x86/mm/gup: Switch GUP to the generic
get_user_page_fast() implementation").

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: "Jérôme Glisse" <jglisse@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull networking fixes from David Miller:

 1) Clamp timeouts to INT_MAX in conntrack, from Jay Elliot.

 2) Fix broken UAPI for BPF_PROG_TYPE_PERF_EVENT, from Hendrik
    Brueckner.

 3) Fix locking in ieee80211_sta_tear_down_BA_sessions, from Johannes
    Berg.

 4) Add missing barriers to ptr_ring, from Michael S. Tsirkin.

 5) Don't advertise gigabit in sh_eth when not available, from Thomas
    Petazzoni.

 6) Check network namespace when delivering to netlink taps, from Kevin
    Cernekee.

 7) Kill a race in raw_sendmsg(), from Mohamed Ghannam.

 8) Use correct address in TCP md5 lookups when replying to an incoming
    segment, from Christoph Paasch.

 9) Add schedule points to BPF map alloc/free, from Eric Dumazet.

10) Don't allow silly mtu values to be used in ipv4/ipv6 multicast, also
    from Eric Dumazet.

11) Fix SKB leak in tipc, from Jon Maloy.

12) Disable MAC learning on OVS ports of mlxsw, from Yuval Mintz.

13) SKB leak fix in skB_complete_tx_timestamp(), from Willem de Bruijn.

14) Add some new qmi_wwan device IDs, from Daniele Palmas.

15) Fix static key imbalance in ingress qdisc, from Jiri Pirko.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (76 commits)
  net: qcom/emac: Reduce timeout for mdio read/write
  net: sched: fix static key imbalance in case of ingress/clsact_init error
  net: sched: fix clsact init error path
  ip_gre: fix wrong return value of erspan_rcv
  net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support
  pkt_sched: Remove TC_RED_OFFLOADED from uapi
  net: sched: Move to new offload indication in RED
  net: sched: Add TCA_HW_OFFLOAD
  net: aquantia: Increment driver version
  net: aquantia: Fix typo in ethtool statistics names
  net: aquantia: Update hw counters on hw init
  net: aquantia: Improve link state and statistics check interval callback
  net: aquantia: Fill in multicast counter in ndev stats from hardware
  net: aquantia: Fill ndev stat couters from hardware
  net: aquantia: Extend stat counters to 64bit values
  net: aquantia: Fix hardware DMA stream overload on large MRRS
  net: aquantia: Fix actual speed capabilities reporting
  sock: free skb in skb_complete_tx_timestamp on error
  s390/qeth: update takeover IPs after configuration change
  s390/qeth: lock IP table while applying takeover changes
  ...

Pull USB fixes from Greg KH:
 "Here are some USB fixes for 4.15-rc4.

  There is the usual handful gadget/dwc2/dwc3 fixes as always, for
  reported issues. But the most important things in here is the core fix
  from Alan Stern to resolve a nasty security bug (my first attempt is
  reverted, Alan's was much cleaner), as well as a number of usbip fixes
  from Shuah Khan to resolve those reported security issues.

  All of these have been in linux-next with no reported issues"

* tag 'usb-4.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: core: prevent malicious bNumInterfaces overflow
  Revert "USB: core: only clean up what we allocated"
  USB: core: only clean up what we allocated
  Revert "usb: gadget: allow to enable legacy drivers without USB_ETH"
  usb: gadget: webcam: fix V4L2 Kconfig dependency
  usb: dwc2: Fix TxFIFOn sizes and total TxFIFO size issues
  usb: dwc3: gadget: Fix PCM1 for ISOC EP with ep->mult less than 3
  usb: dwc3: of-simple: set dev_pm_ops
  usb: dwc3: of-simple: fix missing clk_disable_unprepare
  usb: dwc3: gadget: Wait longer for controller to end command processing
  usb: xhci: fix TDS for MTK xHCI1.1
  xhci: Don't add a virt_dev to the devs array before it's fully allocated
  usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
  usbip: prevent vhci_hcd driver from leaking a socket pointer address
  usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
  usbip: fix stub_rx: get_pipe() to validate endpoint number
  tools/usbip: fixes potential (minor) "buffer overflow" (detected on recent gcc with -Werror)
  USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
  usb: musb: da8xx: fix babble condition handling

Pull staging fixes from Greg KH:
 "Here are some small staging driver fixes for 4.15-rc4.

  One patch for the ccree driver to prevent an unitialized value from
  being returned to a caller, and the other fixes a logic error in the
  pi433 driver"

* tag 'staging-4.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: pi433: Fixes issue with bit shift in rf69_get_modulation
  staging: ccree: Uninitialized return in ssi_ahash_import()