As reported by Arnd:

  https://lkml.org/lkml/2017/1/10/756

Compiling with the following configuration:

  # CONFIG_EXT2_FS is not set
  # CONFIG_EXT4_FS is not set
  # CONFIG_XFS_FS is not set
  # CONFIG_FS_IOMAP depends on the above filesystems, as is not set
  CONFIG_FS_DAX=y

generates build warnings about unused functions in fs/dax.c:

  fs/dax.c:878:12: warning: `dax_insert_mapping' defined but not used [-Wunused-function]
   static int dax_insert_mapping(struct address_space *mapping,
              ^~~~~~~~~~~~~~~~~~
  fs/dax.c:572:12: warning: `copy_user_dax' defined but not used [-Wunused-function]
   static int copy_user_dax(struct block_device *bdev, sector_t sector, size_t size,
              ^~~~~~~~~~~~~
  fs/dax.c:542:12: warning: `dax_load_hole' defined but not used [-Wunused-function]
   static int dax_load_hole(struct address_space *mapping, void **entry,
              ^~~~~~~~~~~~~
  fs/dax.c:312:14: warning: `grab_mapping_entry' defined but not used [-Wunused-function]
   static void *grab_mapping_entry(struct address_space *mapping, pgoff_t index,
                ^~~~~~~~~~~~~~~~~~

Now that the struct buffer_head based DAX fault paths and I/O path have
been removed we really depend on iomap support being present for DAX.
Make this explicit by selecting FS_IOMAP if we compile in DAX support.

This allows us to remove conditional selections of FS_IOMAP when FS_DAX
was present for ext2 and ext4, and to remove an #ifdef in fs/dax.c.

Link: http://lkml.kernel.org/r/1484087383-29478-1-git-send-email-ross.zwisler@linux.intel.comSigned-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Reported-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In commit 19be0eaf ("mm: remove gup_flags FOLL_WRITE games from
__get_user_pages()"), the mm code was changed from unsetting FOLL_WRITE
after a COW was resolved to setting the (newly introduced) FOLL_COW
instead.  Simultaneously, the check in gup.c was updated to still allow
writes with FOLL_FORCE set if FOLL_COW had also been set.

However, a similar check in huge_memory.c was forgotten.  As a result,
remote memory writes to ro regions of memory backed by transparent huge
pages cause an infinite loop in the kernel (handle_mm_fault sets
FOLL_COW and returns 0 causing a retry, but follow_trans_huge_pmd bails
out immidiately because `(flags & FOLL_WRITE) && !pmd_write(*pmd)` is
true.

While in this state the process is stil SIGKILLable, but little else
works (e.g.  no ptrace attach, no other signals).  This is easily
reproduced with the following code (assuming thp are set to always):

    #include <assert.h>
    #include <fcntl.h>
    #include <stdint.h>
    #include <stdio.h>
    #include <string.h>
    #include <sys/mman.h>
    #include <sys/stat.h>
    #include <sys/types.h>
    #include <sys/wait.h>
    #include <unistd.h>

    #define TEST_SIZE 5 * 1024 * 1024

    int main(void) {
      int status;
      pid_t child;
      int fd = open("/proc/self/mem", O_RDWR);
      void *addr = mmap(NULL, TEST_SIZE, PROT_READ,
                        MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
      assert(addr != MAP_FAILED);
      pid_t parent_pid = getpid();
      if ((child = fork()) == 0) {
        void *addr2 = mmap(NULL, TEST_SIZE, PROT_READ | PROT_WRITE,
                           MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
        assert(addr2 != MAP_FAILED);
        memset(addr2, 'a', TEST_SIZE);
        pwrite(fd, addr2, TEST_SIZE, (uintptr_t)addr);
        return 0;
      }
      assert(child == waitpid(child, &status, 0));
      assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
      return 0;
    }

Fix this by updating follow_trans_huge_pmd in huge_memory.c analogously
to the update in gup.c in the original commit.  The same pattern exists
in follow_devmap_pmd.  However, we should not be able to reach that
check with FOLL_COW set, so add WARN_ONCE to make sure we notice if we
ever do.

[akpm@linux-foundation.org: coding-style fixes]
Link: http://lkml.kernel.org/r/20170106015025.GA38411@juliacomputing.comSigned-off-by: Keno Fischer <keno@juliacomputing.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

online_{kernel|movable} is used to change the memory zone to
ZONE_{NORMAL|MOVABLE} and online the memory.

To check that memory zone can be changed, zone_can_shift() is used.
Currently the function returns minus integer value, plus integer
value and 0. When the function returns minus or plus integer value,
it means that the memory zone can be changed to ZONE_{NORNAL|MOVABLE}.

But when the function returns 0, there are two meanings.

One of the meanings is that the memory zone does not need to be changed.
For example, when memory is in ZONE_NORMAL and onlined by online_kernel
the memory zone does not need to be changed.

Another meaning is that the memory zone cannot be changed. When memory
is in ZONE_NORMAL and onlined by online_movable, the memory zone may
not be changed to ZONE_MOVALBE due to memory online limitation(see
Documentation/memory-hotplug.txt). In this case, memory must not be
onlined.

The patch changes the return type of zone_can_shift() so that memory
online operation fails when memory zone cannot be changed as follows:

Before applying patch:
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  7864320
           managed  7864320
   # echo online_movable > memory4097/state
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  8388608
           managed  8388608

   online_movable operation succeeded. But memory is onlined as
   ZONE_NORMAL, not ZONE_MOVABLE.

After applying patch:
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  7864320
           managed  7864320
   # echo online_movable > memory4097/state
   bash: echo: write error: Invalid argument
   # grep -A 35 "Node 2" /proc/zoneinfo
   Node 2, zone   Normal
   <snip>
      node_scanned  0
           spanned  8388608
           present  7864320
           managed  7864320

   online_movable operation failed because of failure of changing
   the memory zone from ZONE_NORMAL to ZONE_MOVABLE

Fixes: df429ac0 ("memory-hotplug: more general validation of zone during online")
Link: http://lkml.kernel.org/r/2f9c3837-33d7-b6e5-59c0-6ca4372b2d84@gmail.comSigned-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Reviewed-by: Reza Arbab <arbab@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull tile bugfix from Chris Metcalf:
 "This avoids an issue with short userspace reads for regset via ptrace"

* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
  tile/ptrace: Preserve previous registers for short regset write

Pull GPIO fix from Linus Walleij:
 "A single lockdep fix, nothing else going on. This makes lockdep
  noiseless and work properly with threaded GPIO IRQchips.

  Summary:

  Fix a lockdep issue: the threaded irqchips also need their unique key,
  and take this opportunity to get rid of the horrible macro and replace
  it with a static inline"

* tag 'gpio-v4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: provide lockdep keys for nested/unnested irqchips

Pull drm fixes from Dave Airlie:
 "drm fixes across the board.

  Okay holidays and LCA kinda caught up with me, I thought I'd get some
  of this dequeued last week, but Hobart was sunny and warm and not all
  gloomy and rainy as usual.

  This is a bit large, but not too much considering it's two weeks stuff
  from AMD and Intel.

  core:
   - one locking fix that helps with dynamic suspend/resume races

  i915:
   - mostly GVT updates, GVT was a recent introduction so fixes for it
     shouldn't cause any notable side effects.

  amdgpu:
   - a bunch of fixes for GPUs with a different memory controller design
     that need different firmware.

  exynos:
   - decon regression fixes

  msm:
   - two regression fixes

  etnaviv:
   - a workaround for an mmu bug that needs a lot more work.

  virtio:
   - sparse fix, and a maintainers update"

* tag 'drm-fixes-for-v4.10-rc6' of git://people.freedesktop.org/~airlied/linux: (56 commits)
  drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
  drm/exynos/decon5433: fix CMU programming
  drm/exynos/decon5433: do not disable video after reset
  drm/i915: Ignore bogus plane coordinates on SKL when the plane is not visible
  drm/i915: Remove WaDisableLSQCROPERFforOCL KBL workaround.
  drm/amdgpu: add support for new hainan variants
  drm/radeon: add support for new hainan variants
  drm/amdgpu: change clock gating mode for uvd_v4.
  drm/amdgpu: fix program vce instance logic error.
  drm/amdgpu: fix bug set incorrect value to vce register
  Revert "drm/amdgpu: Only update the CUR_SIZE register when necessary"
  drm/msm: fix potential null ptr issue in non-iommu case
  drm/msm/mdp5: rip out plane->pending tracking
  drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
  drm/exynos/decon5433: update shadow registers iff there are active windows
  drm/i915/gvt: rewrite gt reset handler using new function intel_gvt_reset_vgpu_locked
  drm/i915/gvt: fix vGPU instance reuse issues by vGPU reset function
  drm/i915/gvt: introduce intel_vgpu_reset_mmio() to reset mmio space
  drm/i915/gvt: move mmio init/clean function to mmio.c
  drm/i915/gvt: introduce intel_vgpu_reset_cfg_space to reset configuration space
  ...

drm-qemu: virtio sparse fix, MAINTAINERS updates.

* tag 'drm-qemu-20170110' of git://git.kraxel.org/linux:
  drm: flip cirrus driver status to "obsolete".
  drm: update MAINTAINERS for qemu drivers (bochs, cirrus, qxl, virtio-gpu)
  drm/virtio: fix framebuffer sparse warning

a single fix for a FE hang after IOVA rollover on GC3000. This isn't
pretty, but is the minimal fix for the issue. A larger rework of the
code, that will also fix this issue properly, is currently in the works,
but that needs to wait for at least the next feature pull.

* 'drm-etnaviv-fixes' of https://git.pengutronix.de/git/lst/linux:
  drm/etnaviv: trick drm_mm into giving out a low IOVA

Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes

Just regression fixups to resolve page fault issue of DECON device.

* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
  drm/exynos/decon5433: fix CMU programming
  drm/exynos/decon5433: do not disable video after reset
  drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
  drm/exynos/decon5433: update shadow registers iff there are active windows

A little bigger than usual since it's two weeks worth.  Highlights:
- Add support for new smc firmware on some new hainan variants
- add support for SI chips that require special mc firmware
- remove workarounds for issues fixed by new mc firmware
- fix a regression in cursor handling
- various VCE fixes
- fix for UVD clockgating

* 'drm-fixes-4.10' of git://people.freedesktop.org/~agd5f/linux:
  drm/amdgpu: add support for new hainan variants
  drm/radeon: add support for new hainan variants
  drm/amdgpu: change clock gating mode for uvd_v4.
  drm/amdgpu: fix program vce instance logic error.
  drm/amdgpu: fix bug set incorrect value to vce register
  Revert "drm/amdgpu: Only update the CUR_SIZE register when necessary"
  drm/amd/powerplay: refine vce dpm update code on Cz.
  drm/amdgpu: fix vm_fault_stop on gfx6
  drm/amd/powerplay: fix vce cg logic error on CZ/St.
  drm/radeon: drop the mclk quirk for hainan
  drm/radeon: drop oland quirks
  drm/amdgpu: drop the mclk quirk for hainan
  drm/amdgpu: drop oland quirks
  drm/amdgpu/si: load special ucode for certain MC configs
  drm/radeon/si: load special ucode for certain MC configs

* 'msm-fixes-4.10-rc4' of git://people.freedesktop.org/~robclark/linux:
  drm/msm: fix potential null ptr issue in non-iommu case
  drm/msm/mdp5: rip out plane->pending tracking

A few more core fixes.

* tag 'drm-misc-fixes-2017-01-13' of git://anongit.freedesktop.org/git/drm-misc:
  drm/probe-helpers: Drop locking from poll_enable
  drm: Fix broken VT switch with video=1366x768 option
  drm: Schedule the output_poll_work with 1s delay if we have delayed event

Merge tag 'drm-intel-fixes-2017-01-19' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes

More GVT-g stuff than I'd like at this stage, but then again that's
pretty new and isolated so I'm not too worried.

* tag 'drm-intel-fixes-2017-01-19' of git://anongit.freedesktop.org/git/drm-intel: (26 commits)
  drm/i915: Ignore bogus plane coordinates on SKL when the plane is not visible
  drm/i915: Remove WaDisableLSQCROPERFforOCL KBL workaround.
  drm/i915/gvt: rewrite gt reset handler using new function intel_gvt_reset_vgpu_locked
  drm/i915/gvt: fix vGPU instance reuse issues by vGPU reset function
  drm/i915/gvt: introduce intel_vgpu_reset_mmio() to reset mmio space
  drm/i915/gvt: move mmio init/clean function to mmio.c
  drm/i915/gvt: introduce intel_vgpu_reset_cfg_space to reset configuration space
  drm/i915/gvt: move cfg space inititation function to cfg_space.c
  drm/i915/gvt: introuduce intel_vgpu_reset_gtt() to reset gtt
  drm/i915/gvt: introudce intel_vgpu_reset_resource() to reset vgpu resource state
  drm/i915: Fix phys pwrite for struct_mutex-less operation
  drm/i915: Clear ret before unbinding in i915_gem_evict_something()
  drm/i915/gvt: cleanup GFP flags
  drm/i915/gvt/kvmgt: return meaningful error for vgpu creating failure
  drm/i915/gvt: cleanup opregion memory allocation code
  drm/i915/gvt: destroy the allocated idr on vgpu creating failures
  drm/i915/gvt: init/destroy vgpu_idr properly
  drm/i915/gvt: dec vgpu->running_workload_num after the workload is really done
  drm/i915/gvt: fix use after free for workload
  drm/i915/gvt: remove duplicated definition
  ...

Pull x86 fix from Thomas Gleixner:
 "Restore the retrigger callbacks in the IO APIC irq chips. That
  addresses a long standing regression which got introduced with the
  rewrite of the x86 irq subsystem two years ago and went unnoticed so
  far"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/ioapic: Restore IO-APIC irq_chip retrigger callback

Pull smp/hotplug fix from Thomas Gleixner:
 "Remove an unused variable which is a leftover from the notifier
  removal"

* 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  cpu/hotplug: Remove unused but set variable in _cpu_down()

Pull virtio/vhost fixes from Michael Tsirkin:
 "Random fixes and cleanups that accumulated over the time"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio/s390: virtio: constify virtio_config_ops structures
  virtio/s390: add missing \n to end of dev_err message
  virtio/s390: support READ_STATUS command for virtio-ccw
  tools/virtio/ringtest: tweaks for s390
  tools/virtio/ringtest: fix run-on-all.sh for offline cpus
  virtio_console: fix a crash in config_work_handler
  vhost/scsi: silence uninitialized variable warning
  vhost: scsi: constify target_core_fabric_ops structures

Pull thermal management fixes from Zhang Rui:

 - fix a regression that thermal zone dynamically allocated sysfs
   attributes are freed before they're removed, which is introduced in
   4.10-rc1 (Jacob von Chorus)

 - fix a boot warning because deprecated hwmon API is used (Fabio
   Estevam)

 - a couple of fixes for rockchip thermal driver (Brian Norris, Caesar
   Wang)

* 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  thermal: rockchip: fixes the conversion table
  thermal: core: move tz->device.groups cleanup to thermal_release
  thermal: thermal_hwmon: Convert to hwmon_device_register_with_info()
  thermal: rockchip: handle set_trips without the trip points
  thermal: rockchip: optimize the conversion table
  thermal: rockchip: fixes invalid temperature case
  thermal: rockchip: don't pass table structs by value
  thermal: rockchip: improve conversion error messages

Pull USB fixes from Greg KH:
 "Here are a few small USB fixes for 4.10-rc5.

  Most of these are gadget/dwc2 fixes for reported issues, all of these
  have been in linux-next for a while. The last one is a single xhci
  WARN_ON removal to handle an issue that the dwc3 driver is hitting in
  the 4.10-rc tree. The warning is harmless and needs to be removed, and
  a "real" fix that is more complex will show up in 4.11-rc1 for this
  device.

  That last patch hasn't been in linux-next yet due to the weekend
  timing, but it's a "simple" WARN_ON() removal so what could go wrong?
  :)"

Famous last words.

* tag 'usb-4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  xhci: remove WARN_ON if dma mask is not set for platform devices
  usb: dwc2: host: fix Wmaybe-uninitialized warning
  usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value
  usb: gadget: udc: atmel: remove memory leak
  usb: dwc3: exynos fix axius clock error path to do cleanup
  usb: dwc2: Avoid suspending if we're in gadget mode
  usb: dwc2: use u32 for DT binding parameters
  usb: gadget: f_fs: Fix iterations on endpoints.
  usb: dwc2: gadget: Fix DMA memory freeing
  usb: gadget: composite: Fix function used to free memory

Pull libnvdimm fixes from Dan Williams:
 "Two fixes:

   - a regression fix for the multiple-pmem-namespace-per-region support
     added in 4.9. Even if an existing environment is not using that
     feature the act of creating and a destroying a single namespace
     with the ndctl utility will lead to the proliferation of extra
     unwanted namespace devices.

   - a fix for the error code returned from the pmem driver when the
     memcpy_mcsafe() routine returns -EFAULT. Btrfs seems to be the only
     block I/O consumer that tries to parse the meaning of the error
     code when it is non-zero.

  Neither of these fixes are critical, the namespace leak is awkward in
  that it can cause device naming to change and complicates debugging
  namespace initialization issues. The error code fix is included out of
  caution for what other consumers might be expecting -EIO for block I/O
  errors"

* 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  libnvdimm, namespace: fix pmem namespace leak, delete when size set to zero
  pmem: return EIO on read_pmem() failure

Pull clk fix from Stephen Boyd:
 "One fix for Samsung Exynos524x SoCs where recent IOMMU patches have
  caused some of these clocks to turn off when they were always left on
  before"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk/samsung: exynos542x: mark some clocks as critical

Pull ARC fixes from Vineet Gupta:

 - more intc updates [Yuriv]

 - fix module build when unwinder is turned off

 - IO Coherency Programming model updates

 - other miscellaneous

* tag 'arc-4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: Revert "ARC: mm: IOC: Don't enable IOC by default"
  ARC: mm: split arc_cache_init to allow __init reaping of bulk
  ARCv2: IOC: Use actual memory size to setup aperture size
  ARCv2: IOC: Adhere to progamming model guidelines to avoid DMA corruption
  ARCv2: IOC: refactor the IOC and SLC operations into own functions
  ARC: module: Fix !CONFIG_ARC_DW2_UNWIND builds
  ARCv2: save r30 on kernel entry as gcc uses it for code-gen
  ARCv2: IRQ: Call entry/exit functions for chained handlers in MCIP
  ARC: IRQ: Use hwirq instead of virq in mask/unmask
  ARC: mmu: clarify the MMUv3 programming model

Pull powerpc fixes from Michael Ellerman:
 "Two fixes for fallout from the hugetlb changes we merged this cycle.

  Ten other fixes, four only affect Power9, and the rest are a bit of a
  mixture though nothing terrible.

  Thanks to: Aneesh Kumar K.V, Anton Blanchard, Benjamin Herrenschmidt,
  Dave Martin, Gavin Shan, Madhavan Srinivasan, Nicholas Piggin, Reza
  Arbab"

* tag 'powerpc-4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc: Ignore reserved field in DCSR and PVR reads and writes
  powerpc/ptrace: Preserve previous TM fprs/vsrs on short regset write
  powerpc/ptrace: Preserve previous fprs/vsrs on short regset write
  powerpc/perf: Use MSR to report privilege level on P9 DD1
  selftest/powerpc: Wrong PMC initialized in pmc56_overflow test
  powerpc/eeh: Enable IO path on permanent error
  powerpc/perf: Fix PM_BRU_CMPL event code for power9
  powerpc/mm: Fix little-endian 4K hugetlb
  powerpc/mm/hugetlb: Don't panic when we don't find the default huge page size
  powerpc: Fix pgtable pmd cache init
  powerpc/icp-opal: Fix missing KVM case and harden replay
  powerpc/mm: Fix memory hotplug BUG() on radix

Pull KVM fixes from Radim Krčmář:
 "ARM:
   - Fix for timer setup on VHE machines
   - Drop spurious warning when the timer races against the vcpu running
     again
   - Prevent a vgic deadlock when the initialization fails (for stable)

  s390:
   - Fix a kernel memory exposure (for stable)

  x86:
   - Fix exception injection when hypercall instruction cannot be
     patched"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: s390: do not expose random data via facility bitmap
  KVM: x86: fix fixing of hypercalls
  KVM: arm/arm64: vgic: Fix deadlock on error handling
  KVM: arm64: Access CNTHCTL_EL2 bit fields correctly on VHE systems
  KVM: arm/arm64: Fix occasional warning from the timer work function

Merge branch 'scsi-target-for-v4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bvanassche/linux

Pull SCSI target fixes from Bart Van Assche:

 - two small fixes for the ibmvscsis driver

 - ten patches with bug fixes for the target mode of the qla2xxx driver

 - four patches that avoid that the "sparse" and "smatch" static
   analyzer tools report false positives for the qla2xxx code base

* 'scsi-target-for-v4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bvanassche/linux:
  qla2xxx: Disable out-of-order processing by default in firmware
  qla2xxx: Fix erroneous invalid handle message
  qla2xxx: Reduce exess wait during chip reset
  qla2xxx: Terminate exchange if corrupted
  qla2xxx: Fix crash due to null pointer access
  qla2xxx: Collect additional information to debug fw dump
  qla2xxx: Reset reserved field in firmware options to 0
  qla2xxx: Set tcm_qla2xxx version to automatically track qla2xxx version
  qla2xxx: Include ATIO queue in firmware dump when in target mode
  qla2xxx: Fix wrong IOCB type assumption
  qla2xxx: Avoid that building with W=1 triggers complaints about set-but-not-used variables
  qla2xxx: Move two arrays from header files to .c files
  qla2xxx: Declare an array with file scope static
  qla2xxx: Fix indentation
  ibmvscsis: Fix sleeping in interrupt context
  ibmvscsis: Fix max transfer length

Pull block fixes from Jens Axboe:
 "Just two small fixes for this -rc.

  One is just killing an unused variable from Keith, but the other
  fixes a performance regression for nbd in this series, where we
  inadvertently flipped when we set MSG_MORE when outputting data"

* 'for-linus' of git://git.kernel.dk/linux-block:
  nbd: only set MSG_MORE when we have more to send
  blk-mq: Remove unused variable

Pull spi fixes from Mark Brown:
 "The usual small smattering of driver specific fixes. A few bits that
  stand out here:

   - the R-Car patches adding fallbacks are just adding new compatible
     strings to the driver so that device trees are written in a more
     robustly future proof fashion, this isn't strictly a fix but it's
     just new IDs and it's better to get it into mainline sooner to
     improve the ABI

   - the DesignWare "switch to new API part 2" patch is actually a
     misleadingly titled fix for a bit that got missed in the original
     conversion"

* tag 'spi-fix-v4.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: davinci: use dma_mapping_error()
  spi: spi-axi: Free resources on error path
  spi: pxa2xx: add missed break
  spi: dw-mid: switch to new dmaengine_terminate_* API (part 2)
  spi: dw: Make debugfs name unique between instances
  spi: sh-msiof: Do not use C++ style comment
  spi: armada-3700: Set mode bits correctly
  spi: armada-3700: fix unsigned compare than zero on irq
  spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings
  spi: SPI_FSL_DSPI should depend on HAS_DMA

Pull ceph fixes from Ilya Dryomov:
 "Three filesystem endianness fixes (one goes back to the 2.6 era, all
  marked for stable) and two fixups for this merge window's patches"

* tag 'ceph-for-4.10-rc5' of git://github.com/ceph/ceph-client:
  ceph: fix bad endianness handling in parse_reply_info_extra
  ceph: fix endianness bug in frag_tree_split_cmp
  ceph: fix endianness of getattr mask in ceph_d_revalidate
  libceph: make sure ceph_aes_crypt() IV is aligned
  ceph: fix ceph_get_caps() interruption

Pull overlayfs fix from Miklos Szeredi:
 "This fixes a regression introduced in this cycle"

* 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
  ovl: fix possible use after free on redirect dir lookup

Pull fuse fixes from Miklos Szeredi:
 "Fix two regressions, one introduced in 4.9 and a less recent one in
  4.2"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: fix time_to_jiffies nsec sanity check
  fuse: clear FR_PENDING flag when moving requests out of pending queue

Pull SCSI fixes from James Bottomley:
 "This is a set of 12 fixes including the mpt3sas one that was causing
  hangs on ATA passthrough.

  The others are a couple of zoned block device fixes, a SAS device
  detection bug which lead to SATA drives not being matched to bays, two
  qla2xxx MSI fixes, a qla2xxx req for rsp confusion caused by cut and
  paste, and a few other minor fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: mpt3sas: fix hang on ata passthrough commands
  scsi: lpfc: Set elsiocb contexts to NULL after freeing it
  scsi: sd: Ignore zoned field for host-managed devices
  scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
  scsi: bfa: fix wrongly initialized variable in bfad_im_bsg_els_ct_request()
  scsi: ses: Fix SAS device detection in enclosure
  scsi: libfc: Fix variable name in fc_set_wwpn
  scsi: lpfc: avoid double free of resource identifiers
  scsi: qla2xxx: remove irq_affinity_notifier
  scsi: qla2xxx: fix MSI-X vector affinity
  scsi: qla2xxx: Fix apparent cut-n-paste error.
  scsi: qla2xxx: Get mutex lock before checking optrom_state

Pull arm64 fixes from Catalin Marinas:

 - avoid potential stack information leak via the ptrace ABI caused by
   uninitialised variables

 - SWIOTLB DMA API fall-back allocation fix when the SWIOTLB buffer is
   not initialised (all RAM is suitable for 32-bit DMA masks)

 - fix the bad_mode function returning for unhandled exceptions coming
   from user space

 - fix name clash in __page_to_voff()

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: avoid returning from bad_mode
  arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields
  arm64/ptrace: Avoid uninitialised struct padding in fpr_set()
  arm64/ptrace: Preserve previous registers for short regset write
  arm64/ptrace: Preserve previous registers for short regset write
  arm64/ptrace: Preserve previous registers for short regset write
  arm64: mm: avoid name clash in __page_to_voff()
  arm64: Fix swiotlb fallback allocation

KVM: s390: Fix for 4.10 (via kvm/master)

Fix a kernel memory exposure.

kvm_s390_get_machine() populates the facility bitmap by copying bytes
from the host results that are stored in a 256 byte array in the prefix
page. The KVM code does use the size of the target buffer (2k), thus
copying and exposing unrelated kernel memory (mostly machine check
related logout data).

Let's use the size of the source buffer instead.  This is ok, as the
target buffer will always be greater or equal than the source buffer as
the KVM internal buffers (and thus S390_ARCH_FAC_LIST_SIZE_BYTE) cover
the maximum possible size that is allowed by STFLE, which is 256
doublewords. All structures are zero allocated so we can leave bytes
256-2047 unchanged.

Add a similar fix for kvm_arch_init_vm().
Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
[found with smatch]
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
CC: stable@vger.kernel.org
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>

The warn on is a bit too much, we will anyway set the dma mask if not set
previously.

The main reason for this fix is that 4.10-rc1  has a dwc3 change that
pass a parent sysdev dev pointer instead of setting the dma mask of
its xhci platform device. xhci platform driver can then get more
attributes from the sysdev than just the dma mask.

The usb core and xhci changes are not yet in 4.10, and a fix like
this was preferred instead of taking those big changes this late in
the rc-cycle.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

DECON_TV requires STANDALONE_UPDATE after output enabling, otherwise it does
not start. This change is neutral for DECON.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

DECON_CMU register has reserved bits which should not be zeroed, otherwise
IP can behave strangely and cause IOMMU faults.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

decon_commit is called just after reset so video is disabled anyway.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

IBM bit 31 (for the rest of us - bit 0) is a reserved field in the
instruction definition of mtspr and mfspr. Hardware is encouraged to
(and does) ignore it.

As a result, if userspace executes an mtspr DSCR with the reserved bit
set, we get a DSCR facility unavailable exception. The kernel fails to
match against the expected value/mask, and we silently return to
userspace to try and re-execute the same mtspr DSCR instruction. We
loop forever until the process is killed.

We should do something here, and it seems mirroring what hardware does
is the better option vs killing the process. While here, relax the
matching of mfspr PVR too.

Cc: stable@vger.kernel.org
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>