Pull NTB updates from Jon Mason:

 - fixes for switchtec debugability and mapping table entries

 - NTB transport improvements

 - a reworking of the peer_db_addr for better abstraction

* tag 'ntb-5.1' of git://github.com/jonmason/ntb:
  NTB: add new parameter to peer_db_addr() db_bit and db_data
  NTB: ntb_transport: Ensure the destination buffer is mapped for TX DMA
  NTB: ntb_transport: Free MWs in ntb_transport_link_cleanup()
  ntb_hw_switchtec: Added support of >=4G memory windows
  ntb_hw_switchtec: NT req id mapping table register entry number should be 512
  ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers

Pull fbdev updates from Bartlomiej Zolnierkiewicz:
 "Just a couple of small fixes and cleanups:

   - fix memory access if logo is bigger than the screen (Manfred
     Schlaegl)

   - silence fbcon logo on 'quiet' boots (Prarit Bhargava)

   - use kvmalloc() for scrollback buffer in fbcon (Konstantin Khorenko)

   - misc fixes (Colin Ian King, YueHaibing, Matteo Croce, Mathieu
     Malaterre, Anders Roxell, Arnd Bergmann)

   - misc cleanups (Rob Herring, Lubomir Rintel, Greg Kroah-Hartman,
     Jani Nikula, Michal Vokáč)"

* tag 'fbdev-v5.1' of git://github.com/bzolnier/linux:
  fbdev: mbx: fix a misspelled variable name
  fbdev: omap2: fix warnings in dss core
  video: fbdev: Fix potential NULL pointer dereference
  fbcon: Silence fbcon logo on 'quiet' boots
  printk: Export console_printk
  ARM: dts: imx28-cfa10036: Fix the reset gpio signal polarity
  video: ssd1307fb: Do not hard code active-low reset sequence
  dt-bindings: display: ssd1307fb: Remove reset-active-low from examples
  fbdev: fbmem: fix memory access if logo is bigger than the screen
  video/fbdev: refactor video= cmdline parsing
  fbdev: mbx: fix up debugfs file creation
  fbdev: omap2: no need to check return value of debugfs_create functions
  video: fbdev: geode: remove ifdef OLPC noise
  video: offb: annotate implicit fall throughs
  omapfb: fix typo
  fbdev: Use of_node_name_eq for node name comparisons
  fbcon: use kvmalloc() for scrollback buffer
  fbdev: chipsfb: remove set but not used variable 'size'
  fbdev/via: fix spelling mistake "Expandsion" -> "Expansion"

Pull i2c fixes from Wolfram Sang:
 "A set of driver bugfixes and an improvement for a core helper"

* 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: i2c-designware-platdrv: Always use a dynamic adapter number
  i2c: i2c-designware-platdrv: Cleanup setting of the adapter number
  i2c: add extra check to safe DMA buffer helper
  i2c: i2c-stm32f7: Fix SDADEL minimum formula
  i2c: rcar: explain the lockless design
  i2c: rcar: fix concurrency issue related to ICDMAER
  i2c: sis630: correct format strings
  i2c: mediatek: modify threshold passed to i2c_get_dma_safe_msg_buf()

Pull sound fixes from Takashi Iwai:
 "Some cleaning after the first batch; mostly about HD-audio quirks but
  also some NULL dereference fixes in corner cases and a random build
  error fix, too"

* tag 'sound-fix-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB
  ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO
  ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook
  ALSA: pcm: Fix function name in kernel-doc comment
  ALSA: hda: hdmi - add Icelake support
  ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
  ALSA: hda/realtek - Fixed Headset Mic JD not stable
  ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255
  ALSA: hda/tegra: avoid build error without CONFIG_PM
  ALSA: usx2y: Fix potential NULL pointer dereference
  ALSA: hda: Avoid NULL pointer dereference at snd_hdac_stream_start()

Pull drm fixes and updates from Dave Airlie:
 "A few various fixes pulls and one late etnaviv pull but it was nearly
  all fixes anyways.

  etnaviv:
   - late next pull
   - mmu mapping fix
   - build non-ARM arches
   - misc fixes

  i915:
   - HDCP state handling fix
   - shrinker interaction fix
   - atomic state leak fix

  qxl:
   - kick out framebuffers early fix

  amdgpu:
   - Powerplay fixes
   - DC fixes
   - BACO turned off for now on vega20
   - Locking fix
   - KFD MQD fix
   - gfx9 golden register updates"

* tag 'drm-next-2019-03-15' of git://anongit.freedesktop.org/drm/drm: (43 commits)
  drm/amdgpu: Update gc golden setting for vega family
  drm/amd/powerplay: correct power reading on fiji
  drm/amd/powerplay: set max fan target temperature as 105C
  drm/i915: Relax mmap VMA check
  drm/i915: Fix atomic state leak when resetting HDMI link
  drm/i915: Acquire breadcrumb ref before cancelling
  drm/i915/selftests: Always free spinner on __sseu_prepare error
  drm/i915: Reacquire priolist cache after dropping the engine lock
  drm/i915: Protect i915_active iterators from the shrinker
  drm/i915: HDCP state handling in ddi_update_pipe
  drm/qxl: remove conflicting framebuffers earlier
  drm/fb-helper: call vga_remove_vgacon automatically.
  drm: move i915_kick_out_vgacon to vgaarb
  drm/amd/display: don't call dm_pp_ function from an fpu block
  drm: add __user attribute to ptr_to_compat()
  drm/amdgpu: clear PDs/PTs only after initializing them
  drm/amd/display: Pass app_tf by value rather than by reference
  Revert "drm/amdgpu: use BACO reset on vega20 if platform support"
  drm/amd/powerplay: show the right override pcie parameters
  drm/amd/powerplay: honor the OD settings
  ...

Pull xfs cleanups from Darrick Wong:
 "Here's a few more cleanups that trickled in for the merge window.

  It's all fixes for static checker complaints and slowly unwinding
  typedef usage. The four patches here have gone through a few days
  worth of fstest runs with no new problems observed.

  Summary:

   - Fix some clang/smatch/sparse warnings about uninitialized
     variables.

   - Clean up some typedef usage"

* tag 'xfs-5.1-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: clean up xfs_dir2_leaf_addname
  xfs: zero initialize highstale and lowstale in xfs_dir2_leaf_addname
  xfs: clean up xfs_dir2_leafn_add
  xfs: Zero initialize highstale and lowstale in xfs_dir2_leafn_add

Pull f2fs updates from Jaegeuk Kim:
 "We've continued mainly to fix bugs in this round, as f2fs has been
  shipped in more devices. Especially, we've focused on stabilizing
  checkpoint=disable feature, and provided some interfaces for QA.

  Enhancements:
   - expose FS_NOCOW_FL for pin_file
   - run discard jobs at unmount time with timeout
   - tune discarding thread to avoid idling which consumes power
   - some checking codes to address vulnerabilities
   - give random value to i_generation
   - shutdown with more flags for QA

  Bug fixes:
   - clean up stale objects when mount is failed along with
     checkpoint=disable
   - fix system being stuck due to wrong count by atomic writes
   - handle some corrupted disk cases
   - fix a deadlock in f2fs_read_inline_dir

  We've also added some minor build error fixes and clean-up patches"

* tag 'f2fs-for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (53 commits)
  f2fs: set pin_file under CAP_SYS_ADMIN
  f2fs: fix to avoid deadlock in f2fs_read_inline_dir()
  f2fs: fix to adapt small inline xattr space in __find_inline_xattr()
  f2fs: fix to do sanity check with inode.i_inline_xattr_size
  f2fs: give some messages for inline_xattr_size
  f2fs: don't trigger read IO for beyond EOF page
  f2fs: fix to add refcount once page is tagged PG_private
  f2fs: remove wrong comment in f2fs_invalidate_page()
  f2fs: fix to use kvfree instead of kzfree
  f2fs: print more parameters in trace_f2fs_map_blocks
  f2fs: trace f2fs_ioc_shutdown
  f2fs: fix to avoid deadlock of atomic file operations
  f2fs: fix to dirty inode for i_mode recovery
  f2fs: give random value to i_generation
  f2fs: no need to take page lock in readdir
  f2fs: fix to update iostat correctly in IPU path
  f2fs: fix encrypted page memory leak
  f2fs: make fault injection covering __submit_flush_wait()
  f2fs: fix to retry fill_super only if recovery failed
  f2fs: silence VM_WARN_ON_ONCE in mempool_alloc
  ...

Merge the left-over patches from Andrew Morton.

This merges the remaining two patches from Andrew's pile of "little bit
more MM".  I mulled it over, and we emailed back and forth with Josef,
and he pointed out where I was wrong.

Rule #51 of kernel maintenance: when somebody makes it clear that they
know the code better than you did, stop arguing and just apply the damn
patch.

Add a third patch by me to add a comment for the case that I had thought
was buggy and Josef corrected me on.

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  filemap: add a comment about FAULT_FLAG_RETRY_NOWAIT behavior
  filemap: drop the mmap_sem for all blocking operations
  filemap: kill page_cache_read usage in filemap_fault

I thought Josef Bacik's patch to drop the mmap_sem was buggy, because
when looking at the error cases, there was one case where we returned
VM_FAULT_RETRY without actually dropping the mmap_sem.

Josef had to explain to me (using small words) that yes, that's actually
what we're supposed to do, and his patch was correct.  Which not only
convinced me he knew what he was doing and I should stop arguing with
him, but also that I should add a comment to the case I was confused
about.
Patiently-pointed-out-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Currently we only drop the mmap_sem if there is contention on the page
lock.  The idea is that we issue readahead and then go to lock the page
while it is under IO and we want to not hold the mmap_sem during the IO.

The problem with this is the assumption that the readahead does anything.
In the case that the box is under extreme memory or IO pressure we may end
up not reading anything at all for readahead, which means we will end up
reading in the page under the mmap_sem.

Even if the readahead does something, it could get throttled because of io
pressure on the system and the process is in a lower priority cgroup.

Holding the mmap_sem while doing IO is problematic because it can cause
system-wide priority inversions.  Consider some large company that does a
lot of web traffic.  This large company has load balancing logic in it's
core web server, cause some engineer thought this was a brilliant plan.
This load balancing logic gets statistics from /proc about the system,
which trip over processes mmap_sem for various reasons.  Now the web
server application is in a protected cgroup, but these other processes may
not be, and if they are being throttled while their mmap_sem is held we'll
stall, and cause this nice death spiral.

Instead rework filemap fault path to drop the mmap sem at any point that
we may do IO or block for an extended period of time.  This includes while
issuing readahead, locking the page, or needing to call ->readpage because
readahead did not occur.  Then once we have a fully uptodate page we can
return with VM_FAULT_RETRY and come back again to find our nicely in-cache
page that was gotten outside of the mmap_sem.

This patch also adds a new helper for locking the page with the mmap_sem
dropped.  This doesn't make sense currently as generally speaking if the
page is already locked it'll have been read in (unless there was an error)
before it was unlocked.  However a forthcoming patchset will change this
with the ability to abort read-ahead bio's if necessary, making it more
likely that we could contend for a page lock and still have a not uptodate
page.  This allows us to deal with this case by grabbing the lock and
issuing the IO without the mmap_sem held, and then returning
VM_FAULT_RETRY to come back around.

[josef@toxicpanda.com: v6]
  Link: http://lkml.kernel.org/r/20181212152757.10017-1-josef@toxicpanda.com
[kirill@shutemov.name: fix race in filemap_fault()]
  Link: http://lkml.kernel.org/r/20181228235106.okk3oastsnpxusxs@kshutemo-mobl1
[akpm@linux-foundation.org: coding style fixes]
Link: http://lkml.kernel.org/r/20181211173801.29535-4-josef@toxicpanda.comSigned-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Tested-by: syzbot+b437b5a429d680cf2217@syzkaller.appspotmail.com
Cc: Dave Chinner <david@fromorbit.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Patch series "drop the mmap_sem when doing IO in the fault path", v6.

Now that we have proper isolation in place with cgroups2 we have started
going through and fixing the various priority inversions.  Most are all
gone now, but this one is sort of weird since it's not necessarily a
priority inversion that happens within the kernel, but rather because of
something userspace does.

We have giant applications that we want to protect, and parts of these
giant applications do things like watch the system state to determine how
healthy the box is for load balancing and such.  This involves running
'ps' or other such utilities.  These utilities will often walk
/proc/<pid>/whatever, and these files can sometimes need to
down_read(&task->mmap_sem).  Not usually a big deal, but we noticed when
we are stress testing that sometimes our protected application has latency
spikes trying to get the mmap_sem for tasks that are in lower priority
cgroups.

This is because any down_write() on a semaphore essentially turns it into
a mutex, so even if we currently have it held for reading, any new readers
will not be allowed on to keep from starving the writer.  This is fine,
except a lower priority task could be stuck doing IO because it has been
throttled to the point that its IO is taking much longer than normal.  But
because a higher priority group depends on this completing it is now stuck
behind lower priority work.

In order to avoid this particular priority inversion we want to use the
existing retry mechanism to stop from holding the mmap_sem at all if we
are going to do IO.  This already exists in the read case sort of, but
needed to be extended for more than just grabbing the page lock.  With
io.latency we throttle at submit_bio() time, so the readahead stuff can
block and even page_cache_read can block, so all these paths need to have
the mmap_sem dropped.

The other big thing is ->page_mkwrite.  btrfs is particularly shitty here
because we have to reserve space for the dirty page, which can be a very
expensive operation.  We use the same retry method as the read path, and
simply cache the page and verify the page is still setup properly the next
pass through ->page_mkwrite().

I've tested these patches with xfstests and there are no regressions.

This patch (of 3):

If we do not have a page at filemap_fault time we'll do this weird forced
page_cache_read thing to populate the page, and then drop it again and
loop around and find it.  This makes for 2 ways we can read a page in
filemap_fault, and it's not really needed.  Instead add a FGP_FOR_MMAP
flag so that pagecache_get_page() will return a unlocked page that's in
pagecache.  Then use the normal page locking and readpage logic already in
filemap_fault.  This simplifies the no page in page cache case
significantly.

[akpm@linux-foundation.org: fix comment text]
[josef@toxicpanda.com: don't unlock null page in FGP_FOR_MMAP case]
  Link: http://lkml.kernel.org/r/20190312201742.22935-1-josef@toxicpanda.com
Link: http://lkml.kernel.org/r/20181211173801.29535-2-josef@toxicpanda.comSigned-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge misc patches from Andrew Morton:

- a little bit more MM

- a few fixups

[ The "little bit more MM" is actually just one of the three patches
  Andrew sent for mm/filemap.c, I'm still mulling over two more of them
  from Josef Bacik     - Linus ]

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
  tools/testing/selftests/proc/proc-pid-vm.c: test with vsyscall in mind
  zram: default to lzo-rle instead of lzo
  filemap: pass vm_fault to the mmap ra helpers

Use offsetof() to calculate offset of a field to take advantage of
compiler built-in version when possible, and avoid UBSAN warning when
compiling with Clang:

  UBSAN: Undefined behaviour in mm/swapfile.c:3010:38
  member access within null pointer of type 'union swap_header'
  CPU: 6 PID: 1833 Comm: swapon Tainted: G S                4.19.23 #43
  Call trace:
   dump_backtrace+0x0/0x194
   show_stack+0x20/0x2c
   __dump_stack+0x20/0x28
   dump_stack+0x70/0x94
   ubsan_epilogue+0x14/0x44
   ubsan_type_mismatch_common+0xf4/0xfc
   __ubsan_handle_type_mismatch_v1+0x34/0x54
   __se_sys_swapon+0x654/0x1084
   __arm64_sys_swapon+0x1c/0x24
   el0_svc_common+0xa8/0x150
   el0_svc_compat_handler+0x2c/0x38
   el0_svc_compat+0x8/0x18

Link: http://lkml.kernel.org/r/20190312081902.223764-1-pihsun@chromium.orgSigned-off-by: Pi-Hsun Shih <pihsun@chromium.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

: selftests: proc: proc-pid-vm
: ========================================
: proc-pid-vm: proc-pid-vm.c:277: main: Assertion `rv == strlen(buf0)' failed.
: Aborted

Because the vsyscall mapping is enabled.  Read from vsyscall page to tell
if vsyscall is being used.

Link: http://lkml.kernel.org/r/20190307183204.GA11405@avx2
Link: http://lkml.kernel.org/r/20190219094722.GB28258@shao2-debian
Fixes: 34aab6bec23e7e9 ("proc: test /proc/*/maps, smaps, smaps_rollup, statm")
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: kernel test robot <rong.a.chen@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

lzo-rle gives higher performance and similar compression ratios to lzo.

Link: http://lkml.kernel.org/r/20190205155944.16007-4-dave.rodgman@arm.comSigned-off-by: Dave Rodgman <dave.rodgman@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

All of the arguments to these functions come from the vmf.

Cut down on the amount of arguments passed by simply passing in the vmf
to these two helpers.

Link: http://lkml.kernel.org/r/20181211173801.29535-3-josef@toxicpanda.comSigned-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull more ACPI updates from Rafael Wysocki:
 "These fix a couple of issues and do some cleanups on top of the
  previous ACPI changes for 5.1-rc1.

  Specifics:

   - Fix a crash caused by unloading an SSDT overlay (Andy Shevchenko)

   - Prevent user space from getting confusing error values on failing
     ACPI sysfs accesses (Rafael Wysocki)

   - Simplify leaf node detection in the PPTT parsing code by using a
     new flag defined in ACPI 6.3 (Jeremy Linton)

   - Add missing "static" in some places in the ACPI configfs code (Andy
     Shevchenko)

   - Fix acpidbg tool path in the ACPI documentation (Flavio Suligoi)"

* tag 'acpi-5.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: sysfs: Prevent get_status() from returning acpi_status
  ACPI / device_sysfs: Avoid OF modalias creation for removed device
  ACPI / configfs: Mark local data structures static
  ACPI / configfs: Mark local functions static
  ACPI: tables: Simplify PPTT leaf node detection
  ACPI: Documentation: Fix path for acpidbg tool

Pull more power management updates from Rafael Wysocki:
 "These are mostly fixes and cleanups on top of the previously merged
  power management material for 5.1-rc1 with one cpupower utility update
  that wasn't pushed earlier due to unfortunate timing.

  Specifics:

   - Fix registration of new cpuidle governors partially broken during
     the 5.0 development cycle by mistake (Rafael Wysocki).

   - Avoid integer overflows in the menu cpuidle governor by making it
     discard the overflowing data points upfront (Rafael Wysocki).

   - Fix minor mistake in the recent update of the iowait boost
     computation in the intel_pstate driver (Rafael Wysocki).

   - Drop incorrect __init annotation from one function in the pxa2xx
     cpufreq driver (Arnd Bergmann).

   - Fix the operating performance points (OPP) framework initialization
     for devices in multiple power domains if only one of them is
     scalable (Rajendra Nayak).

   - Fix mistake in dev_pm_opp_set_rate() which causes it to skip
     updating the performance state if the new frequency is the same as
     the old one (Viresh Kumar).

   - Rework the cancellation of wakeup source timers to avoid potential
     issues with it and do some cleanups unlocked by that change (Viresh
     Kumar, Rafael Wysocki).

   - Clean up the code computing the active/suspended time of devices in
     the PM-runtime framework after recent changes (Ulf Hansson).

   - Make the power management infrastructure code use pr_fmt()
     consistently (Joe Perches).

   - Clean up the generic power domains (genpd) framework somewhat
     (Aisheng Dong).

   - Improve kerneldoc comments for two functions in the cpufreq core
     (Rafael Wysocki).

   - Fix typo in a PM QoS file description comment (Aisheng Dong).

   - Update the handling of CPU boost frequencies in the cpupower
     utility (Abhishek Goel)"

* tag 'pm-5.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpuidle: governor: Add new governors to cpuidle_governors again
  cpufreq: intel_pstate: Fix up iowait_boost computation
  PM / OPP: Update performance state when freq == old_freq
  PM / wakeup: Drop wakeup_source_drop()
  PM / wakeup: Rework wakeup source timer cancellation
  PM / domains: Remove one unnecessary blank line
  PM / Domains: Return early for all errors in _genpd_power_off()
  PM / Domains: Improve warn for multiple states but no governor
  OPP: Fix handling of multiple power domains
  PM / QoS: Fix typo in file description
  cpufreq: pxa2xx: remove incorrect __init annotation
  PM-runtime: Call pm_runtime_active|suspended_time() from sysfs
  PM-runtime: Consolidate code to get active/suspended time
  PM: Add and use pr_fmt()
  cpufreq: Improve kerneldoc comments for cpufreq_cpu_get/put()
  cpuidle: menu: Avoid overflows when computing variance
  tools/power/cpupower: Display boost frequency separately

Pull Microblaze update from Michal Simek:
 "Simplify debugfs initialization"

* tag 'microblaze-v5.1-rc1' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: no need to check return value of debugfs_create functions

Android uses pin_file for uncrypt during OTA, and that should be managed by
CAP_SYS_ADMIN only.
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

Pull networking fixes from David Miller:
 "More fixes in the queue:

  1) Netfilter nat can erroneously register the device notifier twice,
     fix from Florian Westphal.

  2) Use after free in nf_tables, from Pablo Neira Ayuso.

  3) Parallel update of steering rule fix in mlx5 river, from Eli
     Britstein.

  4) RX processing panic in lan743x, fix from Bryan Whitehead.

  5) Use before initialization of TCP_SKB_CB, fix from Christoph Paasch.

  6) Fix locking in SRIOV mode of mlx4 driver, from Jack Morgenstein.

  7) Fix TX stalls in lan743x due to mishandling of interrupt ACKing
     modes, from Bryan Whitehead.

  8) Fix infoleak in l2tp_ip6_recvmsg(), from Eric Dumazet"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits)
  pptp: dst_release sk_dst_cache in pptp_sock_destruct
  MAINTAINERS: GENET & SYSTEMPORT: Add internal Broadcom list
  l2tp: fix infoleak in l2tp_ip6_recvmsg()
  net/tls: Inform user space about send buffer availability
  net_sched: return correct value for *notify* functions
  lan743x: Fix TX Stall Issue
  net/mlx4_core: Fix qp mtt size calculation
  net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling
  net/mlx4_core: Fix reset flow when in command polling mode
  mlxsw: minimal: Initialize base_mac
  mlxsw: core: Prevent duplication during QSFP module initialization
  net: dwmac-sun8i: fix a missing check of of_get_phy_mode
  net: sh_eth: fix a missing check of of_get_phy_mode
  net: 8390: fix potential NULL pointer dereferences
  net: fujitsu: fix a potential NULL pointer dereference
  net: qlogic: fix a potential NULL pointer dereference
  isdn: hfcpci: fix potential NULL pointer dereference
  Documentation: devicetree: add a new optional property for port mac address
  net: rocker: fix a potential NULL pointer dereference
  net: qlge: fix a potential NULL pointer dereference
  ...

Pull dmaengine updates from Vinod Koul:

 - dmatest updates for modularizing common struct and code

 - remove SG support for VDMA xilinx IP and updates to driver

 - Update to dw driver to support Intel iDMA controllers multi-block
   support

 - tegra updates for proper reporting of residue

 - Add Snow Ridge ioatdma device id and support for IOATDMA v3.4

 - struct_size() usage and useless LIST_HEAD cleanups in subsystem.

 - qDMA controller driver for Layerscape SoCs

 - stm32-dma PM Runtime support

 - And usual updates to imx-sdma, sprd, Documentation, fsl-edma,
   bcm2835, qcom_hidma etc

* tag 'dmaengine-5.1-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (81 commits)
  dmaengine: imx-sdma: fix consistent dma test failures
  dmaengine: imx-sdma: add a test for imx8mq multi sdma devices
  dmaengine: imx-sdma: add clock ratio 1:1 check
  dmaengine: dmatest: move test data alloc & free into functions
  dmaengine: dmatest: add short-hand `buf_size` var in dmatest_func()
  dmaengine: dmatest: wrap src & dst data into a struct
  dmaengine: ioatdma: support latency tolerance report (LTR) for v3.4
  dmaengine: ioatdma: add descriptor pre-fetch support for v3.4
  dmaengine: ioatdma: disable DCA enabling on IOATDMA v3.4
  dmaengine: ioatdma: Add Snow Ridge ioatdma device id
  dmaengine: sprd: Change channel id to slave id for DMA cell specifier
  dt-bindings: dmaengine: sprd: Change channel id to slave id for DMA cell specifier
  dmaengine: mv_xor: Use correct device for DMA API
  Documentation :dmaengine: clarify DMA desc. pointer after submission
  Documentation: dmaengine: fix dmatest.rst warning
  dmaengine: k3dma: Add support for dma-channel-mask
  dmaengine: k3dma: Delete axi_config
  dmaengine: k3dma: Upgrade k3dma driver to support hisi_asp_dma hardware
  Documentation: bindings: dma: Add binding for dma-channel-mask
  Documentation: bindings: k3dma: Extend the k3dma driver binding to support hisi-asp
  ...

Pull remoteproc updates from Bjorn Andersson:
 "This contains the last patches in Loic's remoteproc resource table
  handling changes, a number of updates to documentation, support for
  invoking the crash handler (for testing purposes), a fix for the
  handling of virtio devices during recovery, performance state votes in
  Qualcomm modem driver, support for specifying board specific firmware
  path for Qualcomm modem driver and improved support for graceful
  shutdown of Qualcomm remoteprocs"

* tag 'rproc-v5.1' of git://github.com/andersson/remoteproc: (33 commits)
  remoteproc: fix for "dma-mapping: remove the DMA_MEMORY_EXCLUSIVE flag"
  remoteproc: fix rproc_check_carveout_da() returned error and comments
  remoteproc: fix trace buffer va initialization
  remoteproc: fix rproc_alloc_carveout() for rproc with iommu domain
  remoteproc: add warning on resource table cast
  remoteproc: fix rproc_alloc_carveout() bad variable cast
  remoteproc: fix rproc_da_to_va in case of unallocated carveout
  remoteproc: correct rproc_mem_entry_init() comments
  remoteproc: fix recovery procedure
  rpmsg: virtio: change header file sort style
  rpmsg: virtio: allocate buffer from parent
  remoteproc: st: add reserved memory support
  remoteproc: create vdev subdevice with specific dma memory pool
  remoteproc: q6v5_adsp: Remove voting for lpass_aon clock
  dt-binding: remoteproc: Remove lpass_aon clock from adsp pil clock list
  remoteproc: q6v5-mss: Active powerdomain for SDM845
  remoteproc: q6v5-mss: Vote for rpmh power domains
  remoteproc: qcom: Add support for parsing fw dt bindings
  remoteproc: qcom_q6v5: don't auto boot remote processor
  remoteproc: qcom: Wait for shutdown-ack/ind on sysmon shutdown
  ...

Pull clk subsystem updates from Stephen Boyd:
 "We have a fairly balanced mix of clk driver updates and clk framework
  updates this time around. It's the usual pile of new drivers for new
  hardware out there and the normal small fixes and updates, but then we
  have some core framework changes too.

  In the core framework, we introduce support for a clk_get_optional()
  API to get clks that may not always be populated and a way to devm
  manage clkdev lookups registered by provider drivers. We also do some
  refactoring to simplify the interface between clkdev and the common
  clk framework so we can reuse the DT parsing and clk_get() path in
  provider drivers in the future. This work will continue in the next
  few cycles while we convert how providers specify clk parents.

  On the driver side, the biggest part of the dirstat is the Amlogic clk
  driver that got support for the G12A SoC. It dominates with almost
  half the overall diff, while the second largest part of the diff is in
  the i.MX clk driver that gained support for imx8mm SoCs. After that,
  we have the Actions Semiconductor and Qualcomm drivers rounding out
  the big part of the dirstat because they both got new hardware support
  for SoCs. The rest is just various updates and non-critical fixes for
  existing drivers.

  Core:
   - Convert a few clk bindings to JSON schema format
   - Add a {devm_}clk_get_optional() API
   - Add devm_clk_hw_register_clkdev() API to manage clkdev lookups
   - Start rewriting clk parent registration and supporting device links
     by moving around code that supports clk_get() and DT parsing of the
     'clocks' property

  New Drivers:
   - Add Qualcomm MSM8998 RPM managed clks
   - IPA clk support on Qualcomm RPMh clk controllers
   - Actions Semi S500 SoC clk support
   - Support for fixed rate clks populated from an MMIO register
   - Add RPC (QSPI/HyperFLASH) clocks on Renesas R-Car V3H
   - Add TMU (timer) clocks on Renesas RZ/G2E
   - Add Amlogic G12A Always-On Clock Controller
   - Add 32k clock generation for Amlogic AXG
   - Add support for the Mali GPU clocks on Amlogic Meson8
   - Add Amlogic G12A EE clock controller driver
   - Add missing CANFD clocks on Renesas RZ/G2M and RZ/G2E
   - Add i.MX8MM SoC clk driver support

  Removed Drivers:
   - Remove clps711x driver as the board support is gone

  Updates:
   - 3rd ECO fix for Mediatek MT2712 SoCs
   - Updates for Qualcomm MSM8998 GCC clks
   - Random static analysis fixes for clk drivers
   - Support for sleeping gpios in the clk-gpio type
   - Minor fixes for STM32MP1 clk driver (parents, critical flag, etc.)
   - Split LCDC into two clks on the Marvell MMP2 SoC
   - Various DT of_node refcount fixes
   - Get rid of CLK_IS_BASIC from TI code (yay!)
   - TI Autoidle clk support
   - Fix Amlogic Meson8 APB clock ID name
   - Claim input clocks through DT for Amlogic AXG and GXBB
   - Correct the DU (display unit) parent clock on Renesas RZ/G2E
   - Exynos5433 IMEM CMU crypto clk support (SlimSS)
   - Fix for the PLL-MIPI on the Allwinner A23
   - Fix Rockchip rk3328 PLL rate calculation
   - Add SET_RATE_PARENT flag on display clk of Rockhip rk3066
   - i.MX SCU clk driver clk_set_parent() and cpufreq support"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (150 commits)
  dt-bindings: clock: imx8mq: Fix numbering overlaps and gaps
  clk: ti: clkctrl: Fix clkdm_name regression for TI_CLK_CLKCTRL_COMPAT
  clk: fixup default index for of_clk_get_by_name()
  clk: Move of_clk_*() APIs into clk.c from clkdev.c
  clk: Inform the core about consumer devices
  clk: Introduce of_clk_get_hw_from_clkspec()
  clk: core: clarify the check for runtime PM
  clk: Combine __clk_get() and __clk_create_clk()
  clk: imx8mq: add GPIO clocks to clock tree
  clk: mediatek: correct cpu clock name for MT8173 SoC
  clk: imx: Refactor entire sccg pll clk
  clk: imx: scu: add cpu frequency scaling support
  clk: mediatek: Mark bus and DRAM related clocks as critical
  clk: mediatek: Add flags to mtk_gate
  clk: mediatek: Add MUX_FLAGS macro
  clk: qcom: gcc-sdm845: Define parent of PCIe PIPE clocks
  clk: ingenic: Remove set but not used variable 'enable'
  clk: at91: programmable: remove unneeded register read
  clk: mediatek: using CLK_MUX_ROUND_CLOSEST for the clock of dpi1_sel
  clk: mediatek: add MUX_GATE_FLAGS_2
  ...

* acpi-tables:
  ACPI: tables: Simplify PPTT leaf node detection

* acpi-debug:
  ACPI: sysfs: Prevent get_status() from returning acpi_status

* acpi-doc:
  ACPI: Documentation: Fix path for acpidbg tool

* acpi-misc:
  ACPI / configfs: Mark local data structures static
  ACPI / configfs: Mark local functions static

* pm-opp:
  PM / OPP: Update performance state when freq == old_freq
  OPP: Fix handling of multiple power domains

* pm-tools:
  tools/power/cpupower: Display boost frequency separately

* pm-domains:
  PM / domains: Remove one unnecessary blank line
  PM / Domains: Return early for all errors in _genpd_power_off()
  PM / Domains: Improve warn for multiple states but no governor

* pm-cpuidle:
  cpuidle: governor: Add new governors to cpuidle_governors again
  cpuidle: menu: Avoid overflows when computing variance

* pm-cpufreq:
  cpufreq: intel_pstate: Fix up iowait_boost computation
  cpufreq: pxa2xx: remove incorrect __init annotation
  cpufreq: Improve kerneldoc comments for cpufreq_cpu_get/put()

* pm-core:
  PM-runtime: Call pm_runtime_active|suspended_time() from sysfs
  PM-runtime: Consolidate code to get active/suspended time

* pm-sleep:
  PM / wakeup: Drop wakeup_source_drop()
  PM / wakeup: Rework wakeup source timer cancellation

* pm-qos:
  PM / QoS: Fix typo in file description

Enable headset mode support for new WYSE NB platform.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This patch will enable WYSE AIO for Headset mode.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The ALC225_FIXUP_HEADSET_JACK fixup can be merged to alc295_fixup_chromebook.
There are no other users for ALC225_FIXUP_HEADSET_JACK other than
the chromebook hardware.

Fixes: 10f5b1b8 ("ALSA: hda/realtek - Fixed Headset Mic JD not stable")
Cc: Kailang Yang <kailang@realtek.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

- Update golden regs for gfx9
- Powerplay fixes
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190313194249.3346-1-alexander.deucher@amd.com

Merge tag 'drm-intel-next-fixes-2019-03-12' of git://anongit.freedesktop.org/drm/drm-intel into drm-next

- HDCP state handling in ddi_update_pipe
- Protect i915_active iterators from the shrinker
- Reacquire priolist cache after dropping the engine lock
- (Selftest) Always free spinner on __sseu_prepare error
- Acquire breadcrumb ref before canceling
- Fix atomic state leak on HDMI link reset
- Relax mmap VMA check
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190312205551.GA7701@intel.com

Merge tag 'drm-misc-next-fixes-2019-03-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

 - qxl: Remove the conflicting framebuffers earlier
 - Split out some i915 code into the fb_helper to allow the above
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190313192158.k3qssf733khsqodn@flea

sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
otherwise, the dst refcnt will leak.

It can be reproduced by this syz log:

  r1 = socket$pptp(0x18, 0x1, 0x2)
  bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
  connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)

Consecutive dmesg warnings will occur:

  unregister_netdevice: waiting for lo to become free. Usage count = 1

v1->v2:
  - use rcu_dereference_protected() instead of rcu_dereference_check(),
    as suggested by Eric.

Fixes: 00959ade ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There is a patchwork instance behind bcm-kernel-feedback-list that is
helpful to track submissions, add this list for the Broadcom GENET and
SYSTEMPORT drivers.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Back in 2013 Hannes took care of most of such leaks in commit
bceaa902 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")

But the bug in l2tp_ip6_recvmsg() has not been fixed.

syzbot report :

BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
CPU: 1 PID: 10996 Comm: syz-executor362 Not tainted 5.0.0+ #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x173/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:600
 kmsan_internal_check_memory+0x9f4/0xb10 mm/kmsan/kmsan.c:694
 kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601
 _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
 copy_to_user include/linux/uaccess.h:174 [inline]
 move_addr_to_user+0x311/0x570 net/socket.c:227
 ___sys_recvmsg+0xb65/0x1310 net/socket.c:2283
 do_recvmmsg+0x646/0x10c0 net/socket.c:2390
 __sys_recvmmsg net/socket.c:2469 [inline]
 __do_sys_recvmmsg net/socket.c:2492 [inline]
 __se_sys_recvmmsg+0x1d1/0x350 net/socket.c:2485
 __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2485
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x445819
Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f64453eddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445819
RDX: 0000000000000005 RSI: 0000000020002f80 RDI: 0000000000000003
RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c
R13: 00007ffeba8f87af R14: 00007f64453ee9c0 R15: 20c49ba5e353f7cf

Local variable description: ----addr@___sys_recvmsg
Variable was created at:
 ___sys_recvmsg+0xf6/0x1310 net/socket.c:2244
 do_recvmmsg+0x646/0x10c0 net/socket.c:2390

Bytes 0-31 of 32 are uninitialized
Memory access of size 32 starts at ffff8880ae62fbb0
Data copied to user address 0000000020000000

Fixes: a32e0eec ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

A previous fix ("tls: Fix write space handling") assumed that
user space application gets informed about the socket send buffer
availability when tls_push_sg() gets called. Inside tls_push_sg(), in
case do_tcp_sendpages() returns 0, the function returns without calling
ctx->sk_write_space. Further, the new function tls_sw_write_space()
did not invoke ctx->sk_write_space. This leads to situation that user
space application encounters a lockup always waiting for socket send
buffer to become available.

Rather than call ctx->sk_write_space from tls_push_sg(), it should be
called from tls_write_space. So whenever tcp stack invokes
sk->sk_write_space after freeing socket send buffer, we always declare
the same to user space by the way of invoking ctx->sk_write_space.

Fixes: 7463d3a2 ("tls: Fix write space handling")
Signed-off-by: Vakul Garg <vakul.garg@nxp.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

It is confusing to directly use return value of netlink_send()/
netlink_unicast() as the return value of *notify*, as it may be not
error at all.

Example: in tc_del_tfilter(), after calling tfilter_del_notify(), it will
goto errout if (err). However, the netlink_send()/netlink_unicast() will
return positive value even for successful case. So it may not call
tcf_chain_tp_remove() and so on to clean up the resource, as a result,
resource is leaked.

It may be easier to only check the return value of tfilter_del_nofiy(),
but it is more clean to correct all related functions.
Co-developed-by: Zengmo Gao <gaozengmo@jd.com>
Signed-off-by: Zhike Wang <wangzhike@jd.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>