- Linux-stable-mirror - lists.linaro.org

patch "xhci: Fix use-after-free in xhci_free_virt_device" causes kernel crashes on 4.16.8 on unplug

by Jacob Saunders

On Linux kernel 4.16.8 (using Arch Linux) if I eject a USB 3.0 device from my system (unplug or "udisksctl power-off --block-device /dev/sde), it freezes instantly with a null pointer error in XHCI. I've been unable to successfully capture a kernel log of the error (and my cameras did not return usable results) and the screen begins scrolling near-immediately with hung processors in a VT. I have done a git bisection (between 4.16.7 and 4.16.7) narrowing it down to the following commit: commit f5331826b0b7a5f2db56a9020ddbb8ce16acdfc0 Author: Mathias Nyman <mathias.nyman(a)linux.intel.com> Date: Thu May 3 17:30:07 2018 +0300 xhci: Fix use-after-free in xhci_free_virt_device commit 44a182b9d17765514fa2b1cc911e4e65134eef93 upstream. KASAN found a use-after-free in xhci_free_virt_device+0x33b/0x38e where xhci_free_virt_device() sets slot id to 0 if udev exists: if (dev->udev && dev->udev->slot_id) dev->udev->slot_id = 0; dev->udev will be true even if udev is freed because dev->udev is not set to NULL. set dev->udev pointer to NULL in xhci_free_dev() The original patch went to stable so this fix needs to be applied there as well. Fixes: a400efe455f7 ("xhci: zero usb device slot_id member when disabling and freeing a xhci slot") Cc: <stable(a)vger.kernel.org> Reported-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> :040000 040000 356ecdc13bf252535bd51b8558a8173dae546f19 d28f201228652e87e51ba48f5a0ad4539cca5c29 M drivers Can I be CC'd on future responses to this? I am not subscribed to the list. Jacob Saunders

7 years, 7 months

2
1
0 0

[patch 10/13] mm, oom: fix concurrent munlock and oom reaper unmap, v3

by akpm＠linux-foundation.org

From: David Rientjes <rientjes(a)google.com> Subject: mm, oom: fix concurrent munlock and oom reaper unmap, v3 Since exit_mmap() is done without the protection of mm->mmap_sem, it is possible for the oom reaper to concurrently operate on an mm until MMF_OOM_SKIP is set. This allows munlock_vma_pages_all() to concurrently run while the oom reaper is operating on a vma. Since munlock_vma_pages_range() depends on clearing VM_LOCKED from vm_flags before actually doing the munlock to determine if any other vmas are locking the same memory, the check for VM_LOCKED in the oom reaper is racy. This is especially noticeable on architectures such as powerpc where clearing a huge pmd requires serialize_against_pte_lookup(). If the pmd is zapped by the oom reaper during follow_page_mask() after the check for pmd_none() is bypassed, this ends up deferencing a NULL ptl or a kernel oops. Fix this by manually freeing all possible memory from the mm before doing the munlock and then setting MMF_OOM_SKIP. The oom reaper can not run on the mm anymore so the munlock is safe to do in exit_mmap(). It also matches the logic that the oom reaper currently uses for determining when to set MMF_OOM_SKIP itself, so there's no new risk of excessive oom killing. This issue fixes CVE-2018-1000200. Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1804241526320.238665@chino.kir.cor… Fixes: 212925802454 ("mm: oom: let oom_reap_task and exit_mmap run concurrently") Signed-off-by: David Rientjes <rientjes(a)google.com> Suggested-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: <stable(a)vger.kernel.org> [4.14+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/oom.h | 2 + mm/mmap.c | 44 +++++++++++++--------- mm/oom_kill.c | 81 ++++++++++++++++++++++-------------------- 3 files changed, 71 insertions(+), 56 deletions(-) diff -puN include/linux/oom.h~mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap include/linux/oom.h --- a/include/linux/oom.h~mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap +++ a/include/linux/oom.h @@ -95,6 +95,8 @@ static inline int check_stable_address_s return 0; } +void __oom_reap_task_mm(struct mm_struct *mm); + extern unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg, const nodemask_t *nodemask, unsigned long totalpages); diff -puN mm/mmap.c~mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap mm/mmap.c --- a/mm/mmap.c~mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap +++ a/mm/mmap.c @@ -3024,6 +3024,32 @@ void exit_mmap(struct mm_struct *mm) /* mm's last user has gone, and its about to be pulled down */ mmu_notifier_release(mm); + if (unlikely(mm_is_oom_victim(mm))) { + /* + * Manually reap the mm to free as much memory as possible. + * Then, as the oom reaper does, set MMF_OOM_SKIP to disregard + * this mm from further consideration. Taking mm->mmap_sem for + * write after setting MMF_OOM_SKIP will guarantee that the oom + * reaper will not run on this mm again after mmap_sem is + * dropped. + * + * Nothing can be holding mm->mmap_sem here and the above call + * to mmu_notifier_release(mm) ensures mmu notifier callbacks in + * __oom_reap_task_mm() will not block. + * + * This needs to be done before calling munlock_vma_pages_all(), + * which clears VM_LOCKED, otherwise the oom reaper cannot + * reliably test it. + */ + mutex_lock(&oom_lock); + __oom_reap_task_mm(mm); + mutex_unlock(&oom_lock); + + set_bit(MMF_OOM_SKIP, &mm->flags); + down_write(&mm->mmap_sem); + up_write(&mm->mmap_sem); + } + if (mm->locked_vm) { vma = mm->mmap; while (vma) { @@ -3045,24 +3071,6 @@ void exit_mmap(struct mm_struct *mm) /* update_hiwater_rss(mm) here? but nobody should be looking */ /* Use -1 here to ensure all VMAs in the mm are unmapped */ unmap_vmas(&tlb, vma, 0, -1); - - if (unlikely(mm_is_oom_victim(mm))) { - /* - * Wait for oom_reap_task() to stop working on this - * mm. Because MMF_OOM_SKIP is already set before - * calling down_read(), oom_reap_task() will not run - * on this "mm" post up_write(). - * - * mm_is_oom_victim() cannot be set from under us - * either because victim->mm is already set to NULL - * under task_lock before calling mmput and oom_mm is - * set not NULL by the OOM killer only if victim->mm - * is found not NULL while holding the task_lock. - */ - set_bit(MMF_OOM_SKIP, &mm->flags); - down_write(&mm->mmap_sem); - up_write(&mm->mmap_sem); - } free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, 0, -1); diff -puN mm/oom_kill.c~mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap mm/oom_kill.c --- a/mm/oom_kill.c~mm-oom-fix-concurrent-munlock-and-oom-reaper-unmap +++ a/mm/oom_kill.c @@ -469,7 +469,6 @@ bool process_shares_mm(struct task_struc return false; } - #ifdef CONFIG_MMU /* * OOM Reaper kernel thread which tries to reap the memory used by the OOM @@ -480,16 +479,54 @@ static DECLARE_WAIT_QUEUE_HEAD(oom_reape static struct task_struct *oom_reaper_list; static DEFINE_SPINLOCK(oom_reaper_lock); -static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) +void __oom_reap_task_mm(struct mm_struct *mm) { - struct mmu_gather tlb; struct vm_area_struct *vma; + + /* + * Tell all users of get_user/copy_from_user etc... that the content + * is no longer stable. No barriers really needed because unmapping + * should imply barriers already and the reader would hit a page fault + * if it stumbled over a reaped memory. + */ + set_bit(MMF_UNSTABLE, &mm->flags); + + for (vma = mm->mmap ; vma; vma = vma->vm_next) { + if (!can_madv_dontneed_vma(vma)) + continue; + + /* + * Only anonymous pages have a good chance to be dropped + * without additional steps which we cannot afford as we + * are OOM already. + * + * We do not even care about fs backed pages because all + * which are reclaimable have already been reclaimed and + * we do not want to block exit_mmap by keeping mm ref + * count elevated without a good reason. + */ + if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) { + const unsigned long start = vma->vm_start; + const unsigned long end = vma->vm_end; + struct mmu_gather tlb; + + tlb_gather_mmu(&tlb, mm, start, end); + mmu_notifier_invalidate_range_start(mm, start, end); + unmap_page_range(&tlb, vma, start, end, NULL); + mmu_notifier_invalidate_range_end(mm, start, end); + tlb_finish_mmu(&tlb, start, end); + } + } +} + +static bool oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) +{ bool ret = true; /* * We have to make sure to not race with the victim exit path * and cause premature new oom victim selection: - * __oom_reap_task_mm exit_mm + * oom_reap_task_mm exit_mm * mmget_not_zero * mmput * atomic_dec_and_test @@ -534,39 +571,8 @@ static bool __oom_reap_task_mm(struct ta trace_start_task_reaping(tsk->pid); - /* - * Tell all users of get_user/copy_from_user etc... that the content - * is no longer stable. No barriers really needed because unmapping - * should imply barriers already and the reader would hit a page fault - * if it stumbled over a reaped memory. - */ - set_bit(MMF_UNSTABLE, &mm->flags); - - for (vma = mm->mmap ; vma; vma = vma->vm_next) { - if (!can_madv_dontneed_vma(vma)) - continue; + __oom_reap_task_mm(mm); - /* - * Only anonymous pages have a good chance to be dropped - * without additional steps which we cannot afford as we - * are OOM already. - * - * We do not even care about fs backed pages because all - * which are reclaimable have already been reclaimed and - * we do not want to block exit_mmap by keeping mm ref - * count elevated without a good reason. - */ - if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) { - const unsigned long start = vma->vm_start; - const unsigned long end = vma->vm_end; - - tlb_gather_mmu(&tlb, mm, start, end); - mmu_notifier_invalidate_range_start(mm, start, end); - unmap_page_range(&tlb, vma, start, end, NULL); - mmu_notifier_invalidate_range_end(mm, start, end); - tlb_finish_mmu(&tlb, start, end); - } - } pr_info("oom_reaper: reaped process %d (%s), now anon-rss:%lukB, file-rss:%lukB, shmem-rss:%lukB\n", task_pid_nr(tsk), tsk->comm, K(get_mm_counter(mm, MM_ANONPAGES)), @@ -587,14 +593,13 @@ static void oom_reap_task(struct task_st struct mm_struct *mm = tsk->signal->oom_mm; /* Retry the down_read_trylock(mmap_sem) a few times */ - while (attempts++ < MAX_OOM_REAP_RETRIES && !__oom_reap_task_mm(tsk, mm)) + while (attempts++ < MAX_OOM_REAP_RETRIES && !oom_reap_task_mm(tsk, mm)) schedule_timeout_idle(HZ/10); if (attempts <= MAX_OOM_REAP_RETRIES || test_bit(MMF_OOM_SKIP, &mm->flags)) goto done; - pr_info("oom_reaper: unable to reap pid:%d (%s)\n", task_pid_nr(tsk), tsk->comm); debug_show_all_locks(); _

7 years, 7 months

1
0
0 0

[patch 06/13] mm: sections are not offlined during memory hotremove

by akpm＠linux-foundation.org

From: Pavel Tatashin <pasha.tatashin(a)oracle.com> Subject: mm: sections are not offlined during memory hotremove Memory hotplug and hotremove operate with per-block granularity. If the machine has a large amount of memory (more than 64G), the size of a memory block can span multiple sections. By mistake, during hotremove we set only the first section to offline state. The bug was discovered because kernel selftest started to fail: https://lkml.kernel.org/r/20180423011247.GK5563@yexl-desktop After commit, "mm/memory_hotplug: optimize probe routine". But, the bug is older than this commit. In this optimization we also added a check for sections to be in a proper state during hotplug operation. Link: http://lkml.kernel.org/r/20180427145257.15222-1-pasha.tatashin@oracle.com Fixes: 2d070eab2e82 ("mm: consider zone which is not fully populated to have holes") Signed-off-by: Pavel Tatashin <pasha.tatashin(a)oracle.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Steven Sistare <steven.sistare(a)oracle.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/sparse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN mm/sparse.c~mm-sections-are-not-offlined-during-memory-hotremove mm/sparse.c --- a/mm/sparse.c~mm-sections-are-not-offlined-during-memory-hotremove +++ a/mm/sparse.c @@ -629,7 +629,7 @@ void offline_mem_sections(unsigned long unsigned long pfn; for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) { - unsigned long section_nr = pfn_to_section_nr(start_pfn); + unsigned long section_nr = pfn_to_section_nr(pfn); struct mem_section *ms; /* _

7 years, 7 months

1
0
0 0

[patch 05/13] z3fold: fix reclaim lock-ups

by akpm＠linux-foundation.org

From: Vitaly Wool <vitalywool(a)gmail.com> Subject: z3fold: fix reclaim lock-ups Do not try to optimize in-page object layout while the page is under reclaim. This fixes lock-ups on reclaim and improves reclaim performance at the same time. [akpm(a)linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20180430125800.444cae9706489f412ad12621@gmail.com Signed-off-by: Vitaly Wool <vitaly.vul(a)sony.com> Reported-by: Guenter Roeck <linux(a)roeck-us.net> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Cc: <Oleksiy.Avramchenko(a)sony.com> Cc: Matthew Wilcox <mawilcox(a)microsoft.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) diff -puN mm/z3fold.c~z3fold-fix-reclaim-lock-ups mm/z3fold.c --- a/mm/z3fold.c~z3fold-fix-reclaim-lock-ups +++ a/mm/z3fold.c @@ -144,7 +144,8 @@ enum z3fold_page_flags { PAGE_HEADLESS = 0, MIDDLE_CHUNK_MAPPED, NEEDS_COMPACTING, - PAGE_STALE + PAGE_STALE, + UNDER_RECLAIM }; /***************** @@ -173,6 +174,7 @@ static struct z3fold_header *init_z3fold clear_bit(MIDDLE_CHUNK_MAPPED, &page->private); clear_bit(NEEDS_COMPACTING, &page->private); clear_bit(PAGE_STALE, &page->private); + clear_bit(UNDER_RECLAIM, &page->private); spin_lock_init(&zhdr->page_lock); kref_init(&zhdr->refcount); @@ -756,6 +758,10 @@ static void z3fold_free(struct z3fold_po atomic64_dec(&pool->pages_nr); return; } + if (test_bit(UNDER_RECLAIM, &page->private)) { + z3fold_page_unlock(zhdr); + return; + } if (test_and_set_bit(NEEDS_COMPACTING, &page->private)) { z3fold_page_unlock(zhdr); return; @@ -840,6 +846,8 @@ static int z3fold_reclaim_page(struct z3 kref_get(&zhdr->refcount); list_del_init(&zhdr->buddy); zhdr->cpu = -1; + set_bit(UNDER_RECLAIM, &page->private); + break; } list_del_init(&page->lru); @@ -887,25 +895,35 @@ static int z3fold_reclaim_page(struct z3 goto next; } next: - spin_lock(&pool->lock); if (test_bit(PAGE_HEADLESS, &page->private)) { if (ret == 0) { - spin_unlock(&pool->lock); free_z3fold_page(page); return 0; } - } else if (kref_put(&zhdr->refcount, release_z3fold_page)) { - atomic64_dec(&pool->pages_nr); + spin_lock(&pool->lock); + list_add(&page->lru, &pool->lru); + spin_unlock(&pool->lock); + } else { + z3fold_page_lock(zhdr); + clear_bit(UNDER_RECLAIM, &page->private); + if (kref_put(&zhdr->refcount, + release_z3fold_page_locked)) { + atomic64_dec(&pool->pages_nr); + return 0; + } + /* + * if we are here, the page is still not completely + * free. Take the global pool lock then to be able + * to add it back to the lru list + */ + spin_lock(&pool->lock); + list_add(&page->lru, &pool->lru); spin_unlock(&pool->lock); - return 0; + z3fold_page_unlock(zhdr); } - /* - * Add to the beginning of LRU. - * Pool lock has to be kept here to ensure the page has - * not already been released - */ - list_add(&page->lru, &pool->lru); + /* We started off locked to we need to lock the pool back */ + spin_lock(&pool->lock); } spin_unlock(&pool->lock); return -EAGAIN; _

7 years, 7 months

1
0
0 0

Re: [PATCH] drm/i915/oa: Disable OA on Haswell

by Chris Wilson

Quoting Lionel Landwerlin (2018-05-11 18:41:28) > On 11/05/18 16:51, Chris Wilson wrote: > > But I can't even startup a gdm on that machine with drm-tip. So maybe > there is some much more broken... > > Don't leave us in suspense... > > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890614 > > > Not our bug :) You would not believe how relieved I am that someone else has bugs in their code. -Chris

7 years, 7 months

1
0
0 0

[GIT PULL] tracing: Fix regex_match_front() to not over compare the test string

by Steven Rostedt

Linus, Working on some new updates to trace filtering, I noticed that the regex_match_front() test was updated to be limited to the size of the pattern instead of the full test string. But as the test string is not guaranteed to be nul terminated, it still needs to consider the size of the test string. Please pull the latest trace-v4.17-rc4 tree, which can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git trace-v4.17-rc4 Tag SHA1: cb82e07247fa5f1a91940a2928fb260256727a14 Head SHA1: dc432c3d7f9bceb3de6f5b44fb9c657c9810ed6d Steven Rostedt (VMware) (1): tracing: Fix regex_match_front() to not over compare the test string ---- kernel/trace/trace_events_filter.c | 3 +++ 1 file changed, 3 insertions(+) --------------------------- commit dc432c3d7f9bceb3de6f5b44fb9c657c9810ed6d Author: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Date: Wed May 9 11:59:32 2018 -0400 tracing: Fix regex_match_front() to not over compare the test string The regex match function regex_match_front() in the tracing filter logic, was fixed to test just the pattern length from testing the entire test string. That is, it went from strncmp(str, r->pattern, len) to strcmp(str, r->pattern, r->len). The issue is that str is not guaranteed to be nul terminated, and if r->len is greater than the length of str, it can access more memory than is allocated. The solution is to add a simple test if (len < r->len) return 0. Cc: stable(a)vger.kernel.org Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching") Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index 1f951b3df60c..7d306b74230f 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -762,6 +762,9 @@ static int regex_match_full(char *str, struct regex *r, int len) static int regex_match_front(char *str, struct regex *r, int len) { + if (len < r->len) + return 0; + if (strncmp(str, r->pattern, r->len) == 0) return 1; return 0;

7 years, 7 months

1
0
0 0

FAILED: patch "[PATCH] test_firmware: fix setting old custom fw path back on exit, " failed to apply to 4.16-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.16-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From e538409257d0217a9bc715686100a5328db75a15 Mon Sep 17 00:00:00 2001 From: Ben Hutchings <ben.hutchings(a)codethink.co.uk> Date: Wed, 4 Apr 2018 22:38:49 +0200 Subject: [PATCH] test_firmware: fix setting old custom fw path back on exit, second try Commit 65c79230576 tried to clear the custom firmware path on exit by writing a single space to the firmware_class.path parameter. This doesn't work because nothing strips this space from the value stored and fw_get_filesystem_firmware() only ignores zero-length paths. Instead, write a null byte. Fixes: 0a8adf58475 ("test: add firmware_class loader test") Fixes: 65c79230576 ("test_firmware: fix setting old custom fw path back on exit") Signed-off-by: Ben Hutchings <ben.hutchings(a)codethink.co.uk> Acked-by: Luis R. Rodriguez <mcgrof(a)kernel.org> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh index 9ea31b57d71a..962d7f4ac627 100755 --- a/tools/testing/selftests/firmware/fw_lib.sh +++ b/tools/testing/selftests/firmware/fw_lib.sh @@ -154,11 +154,13 @@ test_finish() if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout fi - if [ "$OLD_FWPATH" = "" ]; then - OLD_FWPATH=" " - fi if [ "$TEST_REQS_FW_SET_CUSTOM_PATH" = "yes" ]; then - echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + if [ "$OLD_FWPATH" = "" ]; then + # A zero-length write won't work; write a null byte + printf '\000' >/sys/module/firmware_class/parameters/path + else + echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + fi fi if [ -f $FW ]; then rm -f "$FW"

7 years, 7 months

3
3
0 0

[PATCH 4/4] KVM: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls

by Andre Przywara

kvm_read_guest() will eventually look up in kvm_memslots(), which requires either to hold the kvm->slots_lock or to be inside a kvm->srcu critical section. In contrast to x86 and s390 we don't take the SRCU lock on every guest exit, so we have to do it individually for each kvm_read_guest() call. Use the newly introduced wrapper for that. Cc: Stable <stable(a)vger.kernel.org> # 4.12+ Reported-by: Jan Glauber <jan.glauber(a)caviumnetworks.com> Signed-off-by: Andre Przywara <andre.przywara(a)arm.com> --- virt/kvm/arm/vgic/vgic-its.c | 4 ++-- virt/kvm/arm/vgic/vgic-v3.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index 7cb060e01a76..4ed79c939fb4 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -1897,7 +1897,7 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz, int next_offset; size_t byte_offset; - ret = kvm_read_guest(kvm, gpa, entry, esz); + ret = kvm_read_guest_lock(kvm, gpa, entry, esz); if (ret) return ret; @@ -2267,7 +2267,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) int ret; BUG_ON(esz > sizeof(val)); - ret = kvm_read_guest(kvm, gpa, &val, esz); + ret = kvm_read_guest_lock(kvm, gpa, &val, esz); if (ret) return ret; val = le64_to_cpu(val); diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c index c7423f3768e5..bdcf8e7a6161 100644 --- a/virt/kvm/arm/vgic/vgic-v3.c +++ b/virt/kvm/arm/vgic/vgic-v3.c @@ -344,7 +344,7 @@ int vgic_v3_lpi_sync_pending_status(struct kvm *kvm, struct vgic_irq *irq) bit_nr = irq->intid % BITS_PER_BYTE; ptr = pendbase + byte_offset; - ret = kvm_read_guest(kvm, ptr, &val, 1); + ret = kvm_read_guest_lock(kvm, ptr, &val, 1); if (ret) return ret; @@ -397,7 +397,7 @@ int vgic_v3_save_pending_tables(struct kvm *kvm) ptr = pendbase + byte_offset; if (byte_offset != last_byte_offset) { - ret = kvm_read_guest(kvm, ptr, &val, 1); + ret = kvm_read_guest_lock(kvm, ptr, &val, 1); if (ret) return ret; last_byte_offset = byte_offset; -- 2.14.1

7 years, 7 months

1
0
0 0

[PATCH 3/4] KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock

by Andre Przywara

kvm_read_guest() will eventually look up in kvm_memslots(), which requires either to hold the kvm->slots_lock or to be inside a kvm->srcu critical section. In contrast to x86 and s390 we don't take the SRCU lock on every guest exit, so we have to do it individually for each kvm_read_guest() call. Provide a wrapper which does that and use that everywhere. Note that ending the SRCU critical section before returning from the kvm_read_guest() wrapper is safe, because the data has been *copied*, so we don't need to rely on valid references to the memslot anymore. Cc: Stable <stable(a)vger.kernel.org> # 4.8+ Reported-by: Jan Glauber <jan.glauber(a)caviumnetworks.com> Signed-off-by: Andre Przywara <andre.przywara(a)arm.com> --- arch/arm/include/asm/kvm_mmu.h | 16 ++++++++++++++++ arch/arm64/include/asm/kvm_mmu.h | 16 ++++++++++++++++ virt/kvm/arm/vgic/vgic-its.c | 15 ++++++++------- 3 files changed, 40 insertions(+), 7 deletions(-) diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h index 707a1f06dc5d..f675162663f0 100644 --- a/arch/arm/include/asm/kvm_mmu.h +++ b/arch/arm/include/asm/kvm_mmu.h @@ -309,6 +309,22 @@ static inline unsigned int kvm_get_vmid_bits(void) return 8; } +/* + * We are not in the kvm->srcu critical section most of the time, so we take + * the SRCU read lock here. Since we copy the data from the user page, we + * can immediately drop the lock again. + */ +static inline int kvm_read_guest_lock(struct kvm *kvm, + gpa_t gpa, void *data, unsigned long len) +{ + int srcu_idx = srcu_read_lock(&kvm->srcu); + int ret = kvm_read_guest(kvm, gpa, data, len); + + srcu_read_unlock(&kvm->srcu, srcu_idx); + + return ret; +} + static inline void *kvm_get_hyp_vector(void) { return kvm_ksym_ref(__kvm_hyp_vector); diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h index 082110993647..6128992c2ded 100644 --- a/arch/arm64/include/asm/kvm_mmu.h +++ b/arch/arm64/include/asm/kvm_mmu.h @@ -360,6 +360,22 @@ static inline unsigned int kvm_get_vmid_bits(void) return (cpuid_feature_extract_unsigned_field(reg, ID_AA64MMFR1_VMIDBITS_SHIFT) == 2) ? 16 : 8; } +/* + * We are not in the kvm->srcu critical section most of the time, so we take + * the SRCU read lock here. Since we copy the data from the user page, we + * can immediately drop the lock again. + */ +static inline int kvm_read_guest_lock(struct kvm *kvm, + gpa_t gpa, void *data, unsigned long len) +{ + int srcu_idx = srcu_read_lock(&kvm->srcu); + int ret = kvm_read_guest(kvm, gpa, data, len); + + srcu_read_unlock(&kvm->srcu, srcu_idx); + + return ret; +} + #ifdef CONFIG_KVM_INDIRECT_VECTORS /* * EL2 vectors can be mapped and rerouted in a number of ways, diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index 51a80b600632..7cb060e01a76 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -281,8 +281,8 @@ static int update_lpi_config(struct kvm *kvm, struct vgic_irq *irq, int ret; unsigned long flags; - ret = kvm_read_guest(kvm, propbase + irq->intid - GIC_LPI_OFFSET, - &prop, 1); + ret = kvm_read_guest_lock(kvm, propbase + irq->intid - GIC_LPI_OFFSET, + &prop, 1); if (ret) return ret; @@ -444,8 +444,9 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu) * this very same byte in the last iteration. Reuse that. */ if (byte_offset != last_byte_offset) { - ret = kvm_read_guest(vcpu->kvm, pendbase + byte_offset, - &pendmask, 1); + ret = kvm_read_guest_lock(vcpu->kvm, + pendbase + byte_offset, + &pendmask, 1); if (ret) { kfree(intids); return ret; @@ -789,7 +790,7 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id, return false; /* Each 1st level entry is represented by a 64-bit value. */ - if (kvm_read_guest(its->dev->kvm, + if (kvm_read_guest_lock(its->dev->kvm, BASER_ADDRESS(baser) + index * sizeof(indirect_ptr), &indirect_ptr, sizeof(indirect_ptr))) return false; @@ -1370,8 +1371,8 @@ static void vgic_its_process_commands(struct kvm *kvm, struct vgic_its *its) cbaser = CBASER_ADDRESS(its->cbaser); while (its->cwriter != its->creadr) { - int ret = kvm_read_guest(kvm, cbaser + its->creadr, - cmd_buf, ITS_CMD_SIZE); + int ret = kvm_read_guest_lock(kvm, cbaser + its->creadr, + cmd_buf, ITS_CMD_SIZE); /* * If kvm_read_guest() fails, this could be due to the guest * programming a bogus value in CBASER or something else going -- 2.14.1

7 years, 7 months

1
0
0 0

[PATCH 2/4] KVM: arm/arm64: VGIC/ITS: Promote irq_lock() in update_affinity

by Andre Przywara

Apparently the development of update_affinity() overlapped with the promotion of irq_lock to be _irqsave, so the patch didn't convert this lock over. This will make lockdep complain. Fix this by disabling IRQs around the lock. Cc: stable(a)vger.kernel.org Fixes: 08c9fd042117 ("KVM: arm/arm64: vITS: Add a helper to update the affinity of an LPI") Reported-by: Jan Glauber <jan.glauber(a)caviumnetworks.com> Signed-off-by: Andre Przywara <andre.przywara(a)arm.com> --- virt/kvm/arm/vgic/vgic-its.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index 41abf92f2699..51a80b600632 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -350,10 +350,11 @@ static int vgic_copy_lpi_list(struct kvm_vcpu *vcpu, u32 **intid_ptr) static int update_affinity(struct vgic_irq *irq, struct kvm_vcpu *vcpu) { int ret = 0; + unsigned long flags; - spin_lock(&irq->irq_lock); + spin_lock_irqsave(&irq->irq_lock, flags); irq->target_vcpu = vcpu; - spin_unlock(&irq->irq_lock); + spin_unlock_irqrestore(&irq->irq_lock, flags); if (irq->hw) { struct its_vlpi_map map; -- 2.14.1

7 years, 7 months

1
0
0 0

[PATCH 1/4] KVM: arm/arm64: Properly protect VGIC locks from IRQs

by Andre Przywara

As Jan reported [1], lockdep complains about the VGIC not being bullet proof. This seems to be due to two issues: - When commit 006df0f34930 ("KVM: arm/arm64: Support calling vgic_update_irq_pending from irq context") promoted irq_lock and ap_list_lock to _irqsave, we forgot two instances of irq_lock. lockdeps seems to pick those up. - If a lock is _irqsave, any other locks we take inside them should be _irqsafe as well. So the lpi_list_lock needs to be promoted also. This fixes both issues by simply making the remaining instances of those locks _irqsave. One irq_lock is addressed in a separate patch, to simplify backporting. Cc: stable(a)vger.kernel.org Fixes: 006df0f34930 ("KVM: arm/arm64: Support calling vgic_update_irq_pending from irq context") Reported-by: Jan Glauber <jan.glauber(a)caviumnetworks.com> Signed-off-by: Andre Przywara <andre.przywara(a)arm.com> [1] http://lists.infradead.org/pipermail/linux-arm-kernel/2018-May/575718.html --- virt/kvm/arm/vgic/vgic-debug.c | 5 +++-- virt/kvm/arm/vgic/vgic-its.c | 10 ++++++---- virt/kvm/arm/vgic/vgic.c | 22 ++++++++++++++-------- 3 files changed, 23 insertions(+), 14 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-debug.c b/virt/kvm/arm/vgic/vgic-debug.c index 10b38178cff2..4ffc0b5e6105 100644 --- a/virt/kvm/arm/vgic/vgic-debug.c +++ b/virt/kvm/arm/vgic/vgic-debug.c @@ -211,6 +211,7 @@ static int vgic_debug_show(struct seq_file *s, void *v) struct vgic_state_iter *iter = (struct vgic_state_iter *)v; struct vgic_irq *irq; struct kvm_vcpu *vcpu = NULL; + unsigned long flags; if (iter->dist_id == 0) { print_dist_state(s, &kvm->arch.vgic); @@ -227,9 +228,9 @@ static int vgic_debug_show(struct seq_file *s, void *v) irq = &kvm->arch.vgic.spis[iter->intid - VGIC_NR_PRIVATE_IRQS]; } - spin_lock(&irq->irq_lock); + spin_lock_irqsave(&irq->irq_lock, flags); print_irq_state(s, irq, vcpu); - spin_unlock(&irq->irq_lock); + spin_unlock_irqrestore(&irq->irq_lock, flags); return 0; } diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index a8f07243aa9f..41abf92f2699 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -52,6 +52,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, { struct vgic_dist *dist = &kvm->arch.vgic; struct vgic_irq *irq = vgic_get_irq(kvm, NULL, intid), *oldirq; + unsigned long flags; int ret; /* In this case there is no put, since we keep the reference. */ @@ -71,7 +72,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, irq->intid = intid; irq->target_vcpu = vcpu; - spin_lock(&dist->lpi_list_lock); + spin_lock_irqsave(&dist->lpi_list_lock, flags); /* * There could be a race with another vgic_add_lpi(), so we need to @@ -99,7 +100,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, dist->lpi_list_count++; out_unlock: - spin_unlock(&dist->lpi_list_lock); + spin_unlock_irqrestore(&dist->lpi_list_lock, flags); /* * We "cache" the configuration table entries in our struct vgic_irq's. @@ -315,6 +316,7 @@ static int vgic_copy_lpi_list(struct kvm_vcpu *vcpu, u32 **intid_ptr) { struct vgic_dist *dist = &vcpu->kvm->arch.vgic; struct vgic_irq *irq; + unsigned long flags; u32 *intids; int irq_count, i = 0; @@ -330,7 +332,7 @@ static int vgic_copy_lpi_list(struct kvm_vcpu *vcpu, u32 **intid_ptr) if (!intids) return -ENOMEM; - spin_lock(&dist->lpi_list_lock); + spin_lock_irqsave(&dist->lpi_list_lock, flags); list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) { if (i == irq_count) break; @@ -339,7 +341,7 @@ static int vgic_copy_lpi_list(struct kvm_vcpu *vcpu, u32 **intid_ptr) continue; intids[i++] = irq->intid; } - spin_unlock(&dist->lpi_list_lock); + spin_unlock_irqrestore(&dist->lpi_list_lock, flags); *intid_ptr = intids; return i; diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c index 27219313a406..1dfb5b2f1b12 100644 --- a/virt/kvm/arm/vgic/vgic.c +++ b/virt/kvm/arm/vgic/vgic.c @@ -43,9 +43,13 @@ struct vgic_global kvm_vgic_global_state __ro_after_init = { * kvm->lock (mutex) * its->cmd_lock (mutex) * its->its_lock (mutex) - * vgic_cpu->ap_list_lock - * kvm->lpi_list_lock - * vgic_irq->irq_lock + * vgic_cpu->ap_list_lock must be taken with IRQs disabled + * kvm->lpi_list_lock must be taken with IRQs disabled + * vgic_irq->irq_lock must be taken with IRQs disabled + * + * As the ap_list_lock might be taken from the timer interrupt handler, + * we have to disable IRQs before taking this lock and everything lower + * than it. * * If you need to take multiple locks, always take the upper lock first, * then the lower ones, e.g. first take the its_lock, then the irq_lock. @@ -72,8 +76,9 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid) { struct vgic_dist *dist = &kvm->arch.vgic; struct vgic_irq *irq = NULL; + unsigned long flags; - spin_lock(&dist->lpi_list_lock); + spin_lock_irqsave(&dist->lpi_list_lock, flags); list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) { if (irq->intid != intid) @@ -89,7 +94,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid) irq = NULL; out_unlock: - spin_unlock(&dist->lpi_list_lock); + spin_unlock_irqrestore(&dist->lpi_list_lock, flags); return irq; } @@ -134,19 +139,20 @@ static void vgic_irq_release(struct kref *ref) void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq) { struct vgic_dist *dist = &kvm->arch.vgic; + unsigned long flags; if (irq->intid < VGIC_MIN_LPI) return; - spin_lock(&dist->lpi_list_lock); + spin_lock_irqsave(&dist->lpi_list_lock, flags); if (!kref_put(&irq->refcount, vgic_irq_release)) { - spin_unlock(&dist->lpi_list_lock); + spin_unlock_irqrestore(&dist->lpi_list_lock, flags); return; }; list_del(&irq->lpi_list); dist->lpi_list_count--; - spin_unlock(&dist->lpi_list_lock); + spin_unlock_irqrestore(&dist->lpi_list_lock, flags); kfree(irq); } -- 2.14.1

7 years, 7 months

1
0
0 0

[PATCH] [stable 4.14] arm64: Add work around for Arm Cortex-A55 Erratum 1024718

by Suzuki K Poulose

commit ece1397cbc89c51914fae1aec729539cfd8bd62b upstream Some variants of the Arm Cortex-55 cores (r0p0, r0p1, r1p0) suffer from an erratum 1024718, which causes incorrect updates when DBM/AP bits in a page table entry is modified without a break-before-make sequence. The work around is to disable the hardware DBM feature on the affected cores. The hardware Access Flag management features is not affected. The hardware DBM feature is a non-conflicting capability, i.e, the kernel could handle cores using the feature and those without having the features running at the same time. So this work around is detected at early boot time, rather than delaying it until the CPUs are brought up into the kernel with MMU turned on. This also avoids other complexities with late CPUs turning online, with or without the hardware DBM features. Cc: stable(a)vger.kernel.org # v4.14 Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will.deacon(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> --- Note: The upstream commit is on top of a reworked capability infrastructure for arm64 heterogeneous systems, which allows delaying the CPU model checks. This backport is based on the original version of the patch [0], which checks the affected CPU models during the early boot. [0] https://lkml.kernel.org/r/20180116102323.3470-1-suzuki.poulose@arm.com --- Documentation/arm64/silicon-errata.txt | 1 + arch/arm64/Kconfig | 14 ++++++++++++ arch/arm64/include/asm/assembler.h | 40 ++++++++++++++++++++++++++++++++++ arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/mm/proc.S | 5 +++++ 5 files changed, 62 insertions(+) diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt index f3d0d31..e4fe6ad 100644 --- a/Documentation/arm64/silicon-errata.txt +++ b/Documentation/arm64/silicon-errata.txt @@ -55,6 +55,7 @@ stable kernels. | ARM | Cortex-A57 | #834220 | ARM64_ERRATUM_834220 | | ARM | Cortex-A72 | #853709 | N/A | | ARM | Cortex-A73 | #858921 | ARM64_ERRATUM_858921 | +| ARM | Cortex-A55 | #1024718 | ARM64_ERRATUM_1024718 | | ARM | MMU-500 | #841119,#826419 | N/A | | | | | | | Cavium | ThunderX ITS | #22375, #24313 | CAVIUM_ERRATUM_22375 | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index c2abb4e..2d5f7ac 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -443,6 +443,20 @@ config ARM64_ERRATUM_843419 If unsure, say Y. +config ARM64_ERRATUM_1024718 + bool "Cortex-A55: 1024718: Update of DBM/AP bits without break before make might result in incorrect update" + default y + help + This option adds work around for Arm Cortex-A55 Erratum 1024718. + + Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect + update of the hardware dirty bit when the DBM/AP bits are updated + without a break-before-make. The work around is to disable the usage + of hardware DBM locally on the affected cores. CPUs not affected by + erratum will continue to use the feature. + + If unsure, say Y. + config CAVIUM_ERRATUM_22375 bool "Cavium erratum 22375, 24313" default y diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h index 463619d..25b2a41 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -25,6 +25,7 @@ #include <asm/asm-offsets.h> #include <asm/cpufeature.h> +#include <asm/cputype.h> #include <asm/page.h> #include <asm/pgtable-hwdef.h> #include <asm/ptrace.h> @@ -495,4 +496,43 @@ alternative_endif and \phys, \pte, #(((1 << (48 - PAGE_SHIFT)) - 1) << PAGE_SHIFT) .endm +/* + * Check the MIDR_EL1 of the current CPU for a given model and a range of + * variant/revision. See asm/cputype.h for the macros used below. + * + * model: MIDR_CPU_MODEL of CPU + * rv_min: Minimum of MIDR_CPU_VAR_REV() + * rv_max: Maximum of MIDR_CPU_VAR_REV() + * res: Result register. + * tmp1, tmp2, tmp3: Temporary registers + * + * Corrupts: res, tmp1, tmp2, tmp3 + * Returns: 0, if the CPU id doesn't match. Non-zero otherwise + */ + .macro cpu_midr_match model, rv_min, rv_max, res, tmp1, tmp2, tmp3 + mrs \res, midr_el1 + mov_q \tmp1, (MIDR_REVISION_MASK | MIDR_VARIANT_MASK) + mov_q \tmp2, MIDR_CPU_MODEL_MASK + and \tmp3, \res, \tmp2 // Extract model + and \tmp1, \res, \tmp1 // rev & variant + mov_q \tmp2, \model + cmp \tmp3, \tmp2 + cset \res, eq + cbz \res, .Ldone\@ // Model matches ? + + .if (\rv_min != 0) // Skip min check if rv_min == 0 + mov_q \tmp3, \rv_min + cmp \tmp1, \tmp3 + cset \res, ge + .endif // \rv_min != 0 + /* Skip rv_max check if rv_min == rv_max && rv_min != 0 */ + .if ((\rv_min != \rv_max) || \rv_min == 0) + mov_q \tmp2, \rv_max + cmp \tmp1, \tmp2 + cset \tmp2, le + and \res, \res, \tmp2 + .endif +.Ldone\@: + .endm + #endif /* __ASM_ASSEMBLER_H */ diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index be7bd19..30da091 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -78,6 +78,7 @@ #define ARM_CPU_PART_AEM_V8 0xD0F #define ARM_CPU_PART_FOUNDATION 0xD00 +#define ARM_CPU_PART_CORTEX_A55 0xD05 #define ARM_CPU_PART_CORTEX_A57 0xD07 #define ARM_CPU_PART_CORTEX_A72 0xD08 #define ARM_CPU_PART_CORTEX_A53 0xD03 @@ -98,6 +99,7 @@ #define QCOM_CPU_PART_KRYO 0x200 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) +#define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55) #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) #define MIDR_CORTEX_A73 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A73) diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S index 139320a..e338165 100644 --- a/arch/arm64/mm/proc.S +++ b/arch/arm64/mm/proc.S @@ -438,6 +438,11 @@ ENTRY(__cpu_setup) cbz x9, 2f cmp x9, #2 b.lt 1f +#ifdef CONFIG_ARM64_ERRATUM_1024718 + /* Disable hardware DBM on Cortex-A55 r0p0, r0p1 & r1p0 */ + cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(1, 0), x1, x2, x3, x4 + cbnz x1, 1f +#endif orr x10, x10, #TCR_HD // hardware Dirty flag update 1: orr x10, x10, #TCR_HA // hardware Access flag update 2: -- 2.7.4

7 years, 7 months

2
1
0 0

Please apply commit b86e33075ed1 to v4.4.y and v4.9.y

by Guenter Roeck

Hi Greg, commit b86e33075ed1 ("f2fs: fix a dead loop in f2fs_fiemap()") fixes CVE-2017-18257. Please apply to v4.4.y and v4.9.y. Thanks, Guenter

7 years, 7 months

2
1
0 0

patch "iio: sca3000: Fix an error handling path in 'sca3000_probe()'" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: sca3000: Fix an error handling path in 'sca3000_probe()' to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 4a5b45383ca371e123ba103d34d4b3b87616245c Mon Sep 17 00:00:00 2001 From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Date: Sun, 8 Apr 2018 21:44:01 +0200 Subject: iio: sca3000: Fix an error handling path in 'sca3000_probe()' Use 'devm_iio_kfifo_allocate()' instead of 'iio_kfifo_allocate()' in order to simplify code and avoid a memory leak in an error path in 'sca3000_probe()'. A call to 'sca3000_unconfigure_ring()' was missing. Sent via the next merge window as unimportant bug and there are other patches dependent on it. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/accel/sca3000.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c index f33dadf7b262..562f125235db 100644 --- a/drivers/iio/accel/sca3000.c +++ b/drivers/iio/accel/sca3000.c @@ -1277,7 +1277,7 @@ static int sca3000_configure_ring(struct iio_dev *indio_dev) { struct iio_buffer *buffer; - buffer = iio_kfifo_allocate(); + buffer = devm_iio_kfifo_allocate(&indio_dev->dev); if (!buffer) return -ENOMEM; @@ -1287,11 +1287,6 @@ static int sca3000_configure_ring(struct iio_dev *indio_dev) return 0; } -static void sca3000_unconfigure_ring(struct iio_dev *indio_dev) -{ - iio_kfifo_free(indio_dev->buffer); -} - static inline int __sca3000_hw_ring_state_set(struct iio_dev *indio_dev, bool state) { @@ -1546,8 +1541,6 @@ static int sca3000_remove(struct spi_device *spi) if (spi->irq) free_irq(spi->irq, indio_dev); - sca3000_unconfigure_ring(indio_dev); - return 0; } -- 2.17.0

7 years, 7 months

1
0
0 0

patch "iio: adc: ad7791: remove sample freq sysfs attributes" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7791: remove sample freq sysfs attributes to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 7eb6b35d93c356f1afebbfb808bc296d6351e708 Mon Sep 17 00:00:00 2001 From: Alexandru Ardelean <alexandru.ardelean(a)analog.com> Date: Mon, 12 Mar 2018 14:06:53 +0200 Subject: iio: adc: ad7791: remove sample freq sysfs attributes In the current state, these attributes are broken, because they are registered already, and the kernel throws a warning. The first registration happens via the `IIO_CHAN_INFO_SAMP_FREQ` flag from the `ad_sigma_delta` driver. In this commit these attrs are removed, and in the following the IIO_CHAN_INFO_SAMP_FREQ behavior will be implemented, which replaces these hooks. This is done to make things a bit easier to review as there is a bit of overlap in the patch if it's done all at once. Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ") Signed-off-by: Alexandru Ardelean <alexandru.ardelean(a)analog.com> Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7791.c | 49 ---------------------------------------- 1 file changed, 49 deletions(-) diff --git a/drivers/iio/adc/ad7791.c b/drivers/iio/adc/ad7791.c index 70fbf92f9827..03a5f7d6cb0c 100644 --- a/drivers/iio/adc/ad7791.c +++ b/drivers/iio/adc/ad7791.c @@ -244,58 +244,9 @@ static int ad7791_read_raw(struct iio_dev *indio_dev, return -EINVAL; } -static const char * const ad7791_sample_freq_avail[] = { - [AD7791_FILTER_RATE_120] = "120", - [AD7791_FILTER_RATE_100] = "100", - [AD7791_FILTER_RATE_33_3] = "33.3", - [AD7791_FILTER_RATE_20] = "20", - [AD7791_FILTER_RATE_16_6] = "16.6", - [AD7791_FILTER_RATE_16_7] = "16.7", - [AD7791_FILTER_RATE_13_3] = "13.3", - [AD7791_FILTER_RATE_9_5] = "9.5", -}; - -static ssize_t ad7791_read_frequency(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct iio_dev *indio_dev = dev_to_iio_dev(dev); - struct ad7791_state *st = iio_priv(indio_dev); - unsigned int rate = st->filter & AD7791_FILTER_RATE_MASK; - - return sprintf(buf, "%s\n", ad7791_sample_freq_avail[rate]); -} - -static ssize_t ad7791_write_frequency(struct device *dev, - struct device_attribute *attr, const char *buf, size_t len) -{ - struct iio_dev *indio_dev = dev_to_iio_dev(dev); - struct ad7791_state *st = iio_priv(indio_dev); - int i, ret; - - i = sysfs_match_string(ad7791_sample_freq_avail, buf); - if (i < 0) - return i; - - ret = iio_device_claim_direct_mode(indio_dev); - if (ret) - return ret; - st->filter &= ~AD7791_FILTER_RATE_MASK; - st->filter |= i; - ad_sd_write_reg(&st->sd, AD7791_REG_FILTER, sizeof(st->filter), - st->filter); - iio_device_release_direct_mode(indio_dev); - - return len; -} - -static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO, - ad7791_read_frequency, - ad7791_write_frequency); - static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("120 100 33.3 20 16.7 16.6 13.3 9.5"); static struct attribute *ad7791_attributes[] = { - &iio_dev_attr_sampling_frequency.dev_attr.attr, &iio_const_attr_sampling_frequency_available.dev_attr.attr, NULL }; -- 2.17.0

7 years, 7 months

1
0
0 0

Re: [PATCH] drm: Match sysfs name in link removal to link creation

by Sean Paul

On Fri, May 11, 2018 at 07:15:42AM +0300, Haneen Mohammed wrote: > This patch matches the sysfs name used in the unlinking with the > linking function. Otherwise, remove_compat_control_link() fails to remove > sysfs created by create_compat_control_link() in drm_dev_register(). > > Signed-off-by: Haneen Mohammed <hamohammed.sa(a)gmail.com> Hey Haneen, Nice catch! I've applied this to drm-misc-fixes with applicable Fixes and Cc tags. Sean > --- > drivers/gpu/drm/drm_drv.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c > index a1b9338736e3..c2c21d839727 100644 > --- a/drivers/gpu/drm/drm_drv.c > +++ b/drivers/gpu/drm/drm_drv.c > @@ -716,7 +716,7 @@ static void remove_compat_control_link(struct drm_device *dev) > if (!minor) > return; > > - name = kasprintf(GFP_KERNEL, "controlD%d", minor->index); > + name = kasprintf(GFP_KERNEL, "controlD%d", minor->index + 64); > if (!name) > return; > > -- > 2.17.0 > -- Sean Paul, Software Engineer, Google / Chromium OS

7 years, 7 months

1
0
0 0

[PATCH] mtd: nand: Do not check FAIL bit when executing a SET_FEATURES op

by Boris Brezillon

The ONFI spec clearly says that FAIL bit is only valid for PROGRAM, ERASE and READ-with-on-die-ECC operations, and should be ignored otherwise. It seems that checking it after sending a SET_FEATURES is a bad idea because a previous READ, PROGRAM or ERASE op may have failed, and depending on the implementation, the FAIL bit is not cleared until a new READ, PROGRAM or ERASE is started. This leads to ->set_features() returning -EIO while it actually worked, which can sometimes stop a batch of READ/PROGRAM ops. Note that we only fix the ->exec_op() path here, because some drivers are abusing the NAND_STATUS_FAIL flag in their ->waitfunc() implementation to propagate other kind of errors, like wait-ready-timeout or controller-related errors. Let's not try to fix those drivers since they worked fine so far. Fixes: 8878b126df76 ("mtd: nand: add ->exec_op() implementation") Cc: stable(a)vger.kernel.org Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com> --- This patch is fixing a problem we had with on-die ECC on Micron NANDs [1]. On these chips, when you have an ECC failure, the FAIL bit is set and it's not cleared until the next READ operation, which led the following SET_FEATURES (used to re-enable on-die ECC) to fail with -EIO and stopped the batch of page reads started by UBIFS, which in turn led to unmountable FS. [1]http://patchwork.ozlabs.org/patch/907874/ --- drivers/mtd/nand/raw/nand_base.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c index f28c3a555861..ee29f34562ab 100644 --- a/drivers/mtd/nand/raw/nand_base.c +++ b/drivers/mtd/nand/raw/nand_base.c @@ -2174,7 +2174,6 @@ static int nand_set_features_op(struct nand_chip *chip, u8 feature, struct mtd_info *mtd = nand_to_mtd(chip); const u8 *params = data; int i, ret; - u8 status; if (chip->exec_op) { const struct nand_sdr_timings *sdr = @@ -2188,26 +2187,18 @@ static int nand_set_features_op(struct nand_chip *chip, u8 feature, }; struct nand_operation op = NAND_OPERATION(instrs); - ret = nand_exec_op(chip, &op); - if (ret) - return ret; - - ret = nand_status_op(chip, &status); - if (ret) - return ret; - } else { - chip->cmdfunc(mtd, NAND_CMD_SET_FEATURES, feature, -1); - for (i = 0; i < ONFI_SUBFEATURE_PARAM_LEN; ++i) - chip->write_byte(mtd, params[i]); + return nand_exec_op(chip, &op); + } - ret = chip->waitfunc(mtd, chip); - if (ret < 0) - return ret; + chip->cmdfunc(mtd, NAND_CMD_SET_FEATURES, feature, -1); + for (i = 0; i < ONFI_SUBFEATURE_PARAM_LEN; ++i) + chip->write_byte(mtd, params[i]); - status = ret; - } + ret = chip->waitfunc(mtd, chip); + if (ret < 0) + return ret; - if (status & NAND_STATUS_FAIL) + if (ret & NAND_STATUS_FAIL) return -EIO; return 0; -- 2.14.1

7 years, 7 months

1
1
0 0

Re: [PATCH] idr: fix invalid ptr dereference on item delete

by Paolo Bonzini

On 10/05/2018 21:16, Roman Kagan wrote: > If an IDR contains a single entry at index==0, the underlying radix tree > has a single item in its root node, in which case > __radix_tree_lookup(index!=0) doesn't set its *@nodep argument (in > addition to returning NULL). > > However, the tree itself is not empty, i.e. the tree root doesn't have > IDR_FREE tag. > > As a result, on an attempt to remove an index!=0 entry from such an IDR, > radix_tree_delete_item doesn't return early and calls > __radix_tree_delete with invalid parameters which are then dereferenced. > > Reported-by: syzbot+35666cba7f0a337e2e79(a)syzkaller.appspotmail.com > Signed-off-by: Roman Kagan <rkagan(a)virtuozzo.com> > --- > lib/radix-tree.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/lib/radix-tree.c b/lib/radix-tree.c > index da9e10c827df..10ff1bfae952 100644 > --- a/lib/radix-tree.c > +++ b/lib/radix-tree.c > @@ -2040,8 +2040,9 @@ void *radix_tree_delete_item(struct radix_tree_root *root, > void *entry; > > entry = __radix_tree_lookup(root, index, &node, &slot); > - if (!entry && (!is_idr(root) || node_tag_get(root, node, IDR_FREE, > - get_slot_offset(node, slot)))) > + if (!entry && (!is_idr(root) || !node || > + node_tag_get(root, node, IDR_FREE, > + get_slot_offset(node, slot)))) > return NULL; > > if (item && entry != item) > I cannot really vouch for the patch, but if it is correct it's definitely stuff for stable. The KVM testcase is only for 4.17-rc but this is a really nasty bug in a core data structure. Cc: stable(a)vger.kernel.org Should radix-tree be compilable in userspace, so that we can add unit tests for it?... Paolo

7 years, 7 months

3
3
0 0

patch "iio: sca3000: Fix an error handling path in 'sca3000_probe()'" added to staging-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: sca3000: Fix an error handling path in 'sca3000_probe()' to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 4a5b45383ca371e123ba103d34d4b3b87616245c Mon Sep 17 00:00:00 2001 From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Date: Sun, 8 Apr 2018 21:44:01 +0200 Subject: iio: sca3000: Fix an error handling path in 'sca3000_probe()' Use 'devm_iio_kfifo_allocate()' instead of 'iio_kfifo_allocate()' in order to simplify code and avoid a memory leak in an error path in 'sca3000_probe()'. A call to 'sca3000_unconfigure_ring()' was missing. Sent via the next merge window as unimportant bug and there are other patches dependent on it. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/accel/sca3000.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c index f33dadf7b262..562f125235db 100644 --- a/drivers/iio/accel/sca3000.c +++ b/drivers/iio/accel/sca3000.c @@ -1277,7 +1277,7 @@ static int sca3000_configure_ring(struct iio_dev *indio_dev) { struct iio_buffer *buffer; - buffer = iio_kfifo_allocate(); + buffer = devm_iio_kfifo_allocate(&indio_dev->dev); if (!buffer) return -ENOMEM; @@ -1287,11 +1287,6 @@ static int sca3000_configure_ring(struct iio_dev *indio_dev) return 0; } -static void sca3000_unconfigure_ring(struct iio_dev *indio_dev) -{ - iio_kfifo_free(indio_dev->buffer); -} - static inline int __sca3000_hw_ring_state_set(struct iio_dev *indio_dev, bool state) { @@ -1546,8 +1541,6 @@ static int sca3000_remove(struct spi_device *spi) if (spi->irq) free_irq(spi->irq, indio_dev); - sca3000_unconfigure_ring(indio_dev); - return 0; } -- 2.17.0

7 years, 7 months

1
0
0 0

patch "iio: adc: ad7791: remove sample freq sysfs attributes" added to staging-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7791: remove sample freq sysfs attributes to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 7eb6b35d93c356f1afebbfb808bc296d6351e708 Mon Sep 17 00:00:00 2001 From: Alexandru Ardelean <alexandru.ardelean(a)analog.com> Date: Mon, 12 Mar 2018 14:06:53 +0200 Subject: iio: adc: ad7791: remove sample freq sysfs attributes In the current state, these attributes are broken, because they are registered already, and the kernel throws a warning. The first registration happens via the `IIO_CHAN_INFO_SAMP_FREQ` flag from the `ad_sigma_delta` driver. In this commit these attrs are removed, and in the following the IIO_CHAN_INFO_SAMP_FREQ behavior will be implemented, which replaces these hooks. This is done to make things a bit easier to review as there is a bit of overlap in the patch if it's done all at once. Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ") Signed-off-by: Alexandru Ardelean <alexandru.ardelean(a)analog.com> Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7791.c | 49 ---------------------------------------- 1 file changed, 49 deletions(-) diff --git a/drivers/iio/adc/ad7791.c b/drivers/iio/adc/ad7791.c index 70fbf92f9827..03a5f7d6cb0c 100644 --- a/drivers/iio/adc/ad7791.c +++ b/drivers/iio/adc/ad7791.c @@ -244,58 +244,9 @@ static int ad7791_read_raw(struct iio_dev *indio_dev, return -EINVAL; } -static const char * const ad7791_sample_freq_avail[] = { - [AD7791_FILTER_RATE_120] = "120", - [AD7791_FILTER_RATE_100] = "100", - [AD7791_FILTER_RATE_33_3] = "33.3", - [AD7791_FILTER_RATE_20] = "20", - [AD7791_FILTER_RATE_16_6] = "16.6", - [AD7791_FILTER_RATE_16_7] = "16.7", - [AD7791_FILTER_RATE_13_3] = "13.3", - [AD7791_FILTER_RATE_9_5] = "9.5", -}; - -static ssize_t ad7791_read_frequency(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct iio_dev *indio_dev = dev_to_iio_dev(dev); - struct ad7791_state *st = iio_priv(indio_dev); - unsigned int rate = st->filter & AD7791_FILTER_RATE_MASK; - - return sprintf(buf, "%s\n", ad7791_sample_freq_avail[rate]); -} - -static ssize_t ad7791_write_frequency(struct device *dev, - struct device_attribute *attr, const char *buf, size_t len) -{ - struct iio_dev *indio_dev = dev_to_iio_dev(dev); - struct ad7791_state *st = iio_priv(indio_dev); - int i, ret; - - i = sysfs_match_string(ad7791_sample_freq_avail, buf); - if (i < 0) - return i; - - ret = iio_device_claim_direct_mode(indio_dev); - if (ret) - return ret; - st->filter &= ~AD7791_FILTER_RATE_MASK; - st->filter |= i; - ad_sd_write_reg(&st->sd, AD7791_REG_FILTER, sizeof(st->filter), - st->filter); - iio_device_release_direct_mode(indio_dev); - - return len; -} - -static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO, - ad7791_read_frequency, - ad7791_write_frequency); - static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("120 100 33.3 20 16.7 16.6 13.3 9.5"); static struct attribute *ad7791_attributes[] = { - &iio_dev_attr_sampling_frequency.dev_attr.attr, &iio_const_attr_sampling_frequency_available.dev_attr.attr, NULL }; -- 2.17.0

7 years, 7 months

1
0
0 0

[PATCH v4.9] KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry

by Paul Mackerras

commit a8b48a4dccea77e29462e59f1dbf0d5aa1ff167c upstream. This fixes a bug where the trap number that is returned by __kvmppc_vcore_entry gets corrupted. The effect of the corruption is that IPIs get ignored on POWER9 systems when the IPI is sent via a doorbell interrupt to a CPU which is executing in a KVM guest. The effect of the IPI being ignored is often that another CPU locks up inside smp_call_function_many() (and if that CPU is holding a spinlock, other CPUs then lock up inside raw_spin_lock()). The trap number is currently held in register r12 for most of the assembly-language part of the guest exit path. In that path, we call kvmppc_subcore_exit_guest(), which is a C function, without restoring r12 afterwards. Depending on the kernel config and the compiler, it may modify r12 or it may not, so some config/compiler combinations see the bug and others don't. To fix this, we arrange for the trap number to be stored on the stack from the point where kvmhv_commence_exit is called until the end of the function, then the trap number is loaded and returned in r12 as before. Cc: stable(a)vger.kernel.org # v4.8+ Fixes: fd7bacbca47a ("KVM: PPC: Book3S HV: Fix TB corruption in guest exit path on HMI interrupt") Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org> --- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S index 55fbc0c78721..79a180cf4c94 100644 --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S @@ -299,7 +299,6 @@ kvm_novcpu_exit: stw r12, STACK_SLOT_TRAP(r1) bl kvmhv_commence_exit nop - lwz r12, STACK_SLOT_TRAP(r1) b kvmhv_switch_to_host /* @@ -1023,6 +1022,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) secondary_too_late: li r12, 0 + stw r12, STACK_SLOT_TRAP(r1) cmpdi r4, 0 beq 11f stw r12, VCPU_TRAP(r4) @@ -1266,12 +1266,12 @@ mc_cont: bl kvmhv_accumulate_time #endif + stw r12, STACK_SLOT_TRAP(r1) mr r3, r12 /* Increment exit count, poke other threads to exit */ bl kvmhv_commence_exit nop ld r9, HSTATE_KVM_VCPU(r13) - lwz r12, VCPU_TRAP(r9) /* Stop others sending VCPU interrupts to this physical CPU */ li r0, -1 @@ -1549,6 +1549,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) * POWER7/POWER8 guest -> host partition switch code. * We don't have to lock against tlbies but we do * have to coordinate the hardware threads. + * Here STACK_SLOT_TRAP(r1) contains the trap number. */ kvmhv_switch_to_host: /* Secondary threads wait for primary to do partition switch */ @@ -1599,11 +1600,11 @@ BEGIN_FTR_SECTION END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) /* If HMI, call kvmppc_realmode_hmi_handler() */ + lwz r12, STACK_SLOT_TRAP(r1) cmpwi r12, BOOK3S_INTERRUPT_HMI bne 27f bl kvmppc_realmode_hmi_handler nop - li r12, BOOK3S_INTERRUPT_HMI /* * At this point kvmppc_realmode_hmi_handler would have resync-ed * the TB. Hence it is not required to subtract guest timebase @@ -1678,6 +1679,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) li r0, KVM_GUEST_MODE_NONE stb r0, HSTATE_IN_GUEST(r13) + lwz r12, STACK_SLOT_TRAP(r1) /* return trap # in r12 */ ld r0, SFS+PPC_LR_STKOFF(r1) addi r1, r1, SFS mtlr r0 -- 2.11.0

7 years, 7 months

2
1
0 0

[GIT PULL] commits for Linux 4.16

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 4.16 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit b42b71cd28f213cf4688b9891e66b57bdb6eefe8: Linux 4.16.4 (2018-04-24 09:43:11 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-4.16-26042018 for you to fetch changes up to bafaa8866f7137b7ed3df848b0e77c8cfc15066c: kdb: make "mdr" command repeat (2018-04-25 17:24:16 -0400) - ---------------------------------------------------------------- for-greg-4.16-26042018 - ---------------------------------------------------------------- Aapo Vienamo (1): ARM: dts: imx7d: cl-som-imx7: fix pinctrl_enet Aaro Koskinen (1): drivers: macintosh: rack-meter: really fix bogus memsets Akinobu Mita (1): media: ov5645: add missing of_node_put() in error path Alexander Graf (1): lan78xx: Connect phy early Alexander Shishkin (1): intel_th: Use correct method of finding hub Alexandre Belloni (4): rtc: hctosys: Ensure system time doesn't overflow time_t rtc: rk808: fix possible race condition rtc: m41t80: fix race conditions rtc: rp5c01: fix possible race condition Alexey Khoroshilov (3): watchdog: davinci_wdt: fix error handling in davinci_wdt_probe() watchdog: sprd_wdt: Fix error handling in sprd_wdt_enable() watchdog: asm9260_wdt: fix error handling in asm9260_wdt_probe() Alistair Popple (1): powerpc/powernv/npu: Fix deadlock in mmio_invalidate() Amitkumar Karwar (1): rsi: fix kernel panic observed on 64bit machine Anand Jain (1): btrfs: fix null pointer deref when target device is missing Andrea Parri (1): riscv/spinlock: Strengthen implementations with fences Andreas Gruenbacher (2): gfs2: Check for the end of metadata in punch_hole gfs2: Fix fallocate chunk size Andrey Konovalov (2): kasan: fix invalid-free test crashing the kernel kasan, slub: fix handling of kasan_slab_free hook Andrzej Hajda (6): clk: samsung: s3c2410: Fix PLL rates clk: samsung: exynos7: Fix PLL rates clk: samsung: exynos5260: Fix PLL rates clk: samsung: exynos5433: Fix PLL rates clk: samsung: exynos5250: Fix PLL rates clk: samsung: exynos3250: Fix PLL rates Anilkumar Kolli (1): ath10k: advertize beacon_int_min_gcd Anshuman Khandual (1): powerpc/fscr: Enable interrupts earlier before calling get_user() Antoine Tenart (8): crypto: inside-secure - move the digest to the request context crypto: inside-secure - wait for the request to complete if in the backlog crypto: atmel-aes - fix the keys zeroing on errors crypto: inside-secure - do not process request if no command was issued crypto: inside-secure - fix the cache_len computation crypto: inside-secure - fix the extra cache computation crypto: inside-secure - do not overwrite the threshold value crypto: inside-secure - fix the invalidation step during cra_exit Archit Taneja (1): dt-bindings: display: msm/dsi: Fix the PHY regulator supply props Arjun Vynipadath (2): cxgb4: Setup FW queues before registering netdev cxgb4: Fix queue free path of ULD drivers Arnd Bergmann (2): clk: hisilicon: mark wdt_mux_p[] as const media: s3c-camif: fix out-of-bounds array access Baoquan He (1): x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified Bart Van Assche (1): block: Fix a race between request queue removal and the block cgroup controller Ben Hutchings (1): usbip: Correct maximum value of CONFIG_USBIP_VHCI_HC_PORTS Benoit Parrot (1): drm/omap: Add pclk setting case when channel is DSS_WB Bjorn Andersson (2): soc: qcom: wcnss_ctrl: Fix increment in NV upload pinctrl: msm: Use dynamic GPIO numbering Bob Moore (1): ACPICA: Fix memory leak on unusual memory leak Borislav Petkov (1): x86/mce/AMD: Collect error info even if valid bits are not set Brad Love (6): media: cx23885: Override 888 ImpactVCBe crystal frequency media: cx23885: Set subdev host data to clk_freq pointer media: lgdt3306a: Fix a double kfree on i2c device remove media: lgdt3306a: Fix module count mismatch on usb unplug media: em28xx: Add Hauppauge SoloHD/DualHD bulk models media: em28xx: USB bulk packet size fix Brian Norris (1): watchdog: dw: RMW the control register Brijesh Singh (1): crypto: ccp - add check to get PSP master only when PSP is detected Bryan O'Donoghue (1): rtc: snvs: Fix usage of snvs_rtc_enable Carlos Maiolino (1): Force log to disk before reading the AGF during a fstrim Chao Yu (3): f2fs: fix to set KEEP_SIZE bit in f2fs_zero_range f2fs: fix to clear CP_TRIMMED_FLAG f2fs: fix to check extent cache in f2fs_drop_extent_tree Charles Keepax (1): regmap: Correct comparison in regmap_cached Chris Dickens (1): usb: gadget: composite: fix incorrect handling of OS desc requests Christophe JAILLET (4): remoteproc: imx_rproc: Fix an error handling path in 'imx_rproc_probe()' drm/meson: Fix some error handling paths in 'meson_drv_bind_master()' drm/meson: Fix an un-handled error path in 'meson_drv_bind_master()' regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()' Christophe Jaillet (2): regulator: gpio: Fix some error handling paths in 'gpio_regulator_probe()' spi: bcm-qspi: fIX some error handling paths Christophe Leroy (1): powerpc/mm/slice: Fix hugepage allocation at hint address on 8xx Chunyu Hu (1): cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path Claudio Imbrenda (1): mm/ksm: fix interaction with THP Colin Ian King (4): net: qualcomm: rmnet: check for null ep to avoid null pointer dereference staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr rtc: tx4939: avoid unintended sign extension on a 24 bit shift media: cx25821: prevent out-of-bounds read on array card Coly Li (3): bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set bcache: fix cached_dev->count usage for bch_cache_set_error() bcache: stop dc->writeback_rate_update properly Cornelia Huck (1): vfio-ccw: fence off transport mode Dan Carpenter (2): platform/x86: dell-smbios: Fix memory leaks in build_tokens_sysfs() xen/acpi: off by one in read_acpi_id() Danilo Krummrich (1): fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table Dave Carroll (1): scsi: aacraid: Insure command thread is not recursively stopped Dave Hansen (1): x86/mm: Do not forbid _PAGE_RW before init for __ro_after_init David Ahern (1): selftests: Add FIB onlink tests David Howells (3): fscache: Fix hanging wait on page discarded by writeback rxrpc: Fix Tx ring annotation after initial Tx failure rxrpc: Don't treat call aborts as conn aborts David Lechner (1): ARM: davinci_all_defconfig: set CONFIG_DAVINCI_WATCHDOG=y David S. Miller (1): sparc64: Make atomic_xchg() an inline function rather than a macro. Davidlohr Bueso (4): ipc/msg: introduce msgctl(MSG_STAT_ANY) ipc/sem: introduce semctl(SEM_STAT_ANY) ipc/shm: introduce shmctl(SHM_STAT_ANY) sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning Dexuan Cui (1): tools: hv: fix compiler warnings about major/target_fname Dhinakaran Pandiyan (1): drm/vblank: Data type fixes for 64-bit vblank sequences. Douglas Gilbert (1): scsi: core: Make SCSI Status CONDITION MET equivalent to GOOD Emily Deng (1): drm/amdgpu: Clean sdma wptr register when only enable wptr polling Emmanuel Grumbach (1): mac80211: don't WARN on bad WMM parameters from buggy APs Eran Ben Elisha (1): net/mlx5e: Move all TX timeout logic to be under state lock Eric Anholt (1): drm/panel: simple: Fix the bus format for the Ontat panel Eric Dumazet (3): crypto: af_alg - fix possible uninit-value in alg_bind() soreuseport: initialise timewait reuseport field dccp: initialize ireq->ir_mark Eric Sandeen (1): ext4: don't complain about incorrect features when probing Erik Schmauss (1): ACPICA: Events: add a return on failure from acpi_hw_register_read Esben Haabendal (2): dp83640: Ensure against premature access to PHY registers after reset ARM: dts: ls1021a: Specify TBIPA register address Ezequiel Garcia (1): ASoC: rockchip: rk3288-hdmi-analog: Select needed codecs Felipe Balbi (1): usb: dwc3: Makefile: fix link error on randconfig Filip Sadowski (1): i40e: Add delay after EMP reset for firmware to recover Filipe Manana (2): Btrfs: fix loss of prealloc extents past i_size after fsync log replay Btrfs: fix copy_items() return value when logging an inode Florian Fainelli (2): net: bgmac: Fix endian access in bgmac_dma_tx_ring_free() net: bgmac: Correctly annotate register space Frank Asseg (1): tools/thermal: tmon: fix for segfault Fuyun Liang (3): net: hns3: fix for the wrong shift problem in hns3_set_txbd_baseinfo net: hns3: fix for returning wrong value problem in hns3_get_rss_indir_size net: hns3: fix for returning wrong value problem in hns3_get_rss_key_size Gabriel Matni (1): serial: mvebu-uart: fix tx lost characters Gao Xiang (1): f2fs: flush cp pack except cp pack 2 page at first Geert Uytterhoeven (8): dmaengine: rcar-dmac: Fix too early/late system suspend/resume callbacks serial: xuartps: Fix out-of-bounds access through DT alias serial: sh-sci: Fix out-of-bounds access through DT alias serial: samsung: Fix out-of-bounds access through serial port index serial: mxs-auart: Fix out-of-bounds access through serial port index serial: imx: Fix out-of-bounds access through serial port index serial: fsl_lpuart: Fix out-of-bounds access through DT alias serial: arc_uart: Fix out-of-bounds access through DT alias Govindarajulu Varadarajan (1): enic: enable rq before updating rq descriptors Greg Ungerer (1): m68k: set dma and coherent masks for platform FEC ethernets Gregory CLEMENT (1): i2c: mv64xxx: Apply errata delay only in standard mode Grigor Tovmasyan (1): usb: dwc2: Fix interval type issue Guenter Roeck (3): hwmon: (nct6775) Fix writing pwmX_mode hwmon: (pmbus/max8688) Accept negative page register values hwmon: (pmbus/adm1275) Accept negative page register values Haiyang Zhang (1): hv_netvsc: Fix the return status in RX path Hans Verkuil (1): media: vivid: fix incorrect capabilities for radio Harry Morris (1): ieee802154: ca8210: fix uninitialised data read Heiner Kallweit (1): soc: amlogic: meson-gx-pwrc-vpu: fix error on shutdown when domain is powered off Helge Deller (1): parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode Henry Zhang (1): ARM: dts: bcm283x: Fix pin function of JTAG pins Honggang Li (1): IB/mlx5: Set the default active rate and width to QDR and 4X Huang Ying (1): mm: fix races between address_space dereference and free in page_evicatable Icenowy Zheng (1): dt-bindings: add device tree binding for Allwinner H6 main CCU Igor Russkikh (1): net: aquantia: oops when shutdown on already stopped device Ilia Lin (1): arm64: dts: qcom: Fix SPI5 config on MSM8996 Ioana Radulescu (2): staging: fsl-dpaa2/eth: Fix incorrect kfree staging: fsl-dpaa2/eth: Fix incorrect casts Ivan Gorinov (2): x86/devicetree: Initialize device tree before using it x86/devicetree: Fix device IRQ settings in DT Jacob Keller (2): i40e: hold the RTNL lock while changing interrupt schemes ixgbe: prevent ptp_rx_hang from running when in FILTER_ALL mode Jake Moroni (1): dpaa_eth: fix pause capability advertisement logic James Hogan (1): rtc: goldfish: Add missing MODULE_LICENSE James Smart (8): nvme: expand nvmf_check_if_ready checks nvme_fc: fix abort race on teardown with lld reject scsi: lpfc: Fix NVME Initiator FirstBurst scsi: lpfc: Fix issue_lip if link is disabled scsi: lpfc: Fix nonrecovery of NVME controller after cable swap. scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing scsi: lpfc: Fix IO failure during hba reset testing with nvme io. scsi: lpfc: Fix frequency of Release WQE CQEs Jan Kara (2): udf: Provide saner default for invalid uid / gid fanotify: Avoid lost events due to ENOMEM for unlimited queues Jan KundrÃ¡t (1): pinctrl: mcp23s08: spi: Fix regmap debugfs entries JarosÅ‚aw Janik (1): nvme-pci: disable APST for Samsung NVMe SSD 960 EVO + ASUS PRIME Z370-A Javier Martinez Canillas (1): i2c: core: report OF style module alias for devices registered via OF Jay Vosburgh (1): virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS Jean Delvare (1): firmware: dmi_scan: Fix UUID length safety check Jeff Mahoney (1): btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers Jens Axboe (1): sr: get/drop reference to device in revalidate and check_events Jerome Brunet (1): clk: meson: axg: add the fractional part of the fixed_pll Jiandi An (1): ima: Fix Kconfig to select TPM 2.0 CRB interface Jin Yao (1): perf report: Fix wrong jump arrow Jiri Olsa (3): perf tests: Use arch__compare_symbol_names to compare symbols perf report: Fix memory corruption in --branch-history mode --branch-history perf tests: Fix dwarf unwind for stripped binaries Joe Perches (1): MIPS: Octeon: Fix logging messages with spurious periods after newlines Joerg Roedel (1): x86/pgtable: Don't set huge PUD/PMD on non-leaf entries Johannes Thumshirn (1): nvme: don't send keep-alives to the discovery controller John Allen (1): ibmvnic: Fix reset return from closed state Joonsoo Kim (1): ARM: CMA: avoid double mapping to the CMA area if CONFIG_HIGHMEM=y Juergen Gross (1): x86/xen: Add pvh specific rsdp address retrieval function Jun Piao (1): ocfs2/dlm: don't handle migrate lockres if already in shutdown Kamlakant Patel (1): ipmi_ssif: Fix kernel panic at msg_done_handler Kan Liang (5): perf mmap: Fix accessing unmapped mmap in perf_mmap__read_done() perf/x86/intel: Properly save/restore the PMU state in the NMI handler perf/x86/intel: Fix large period handling on Broadwell CPUs perf/x86/intel: Fix event update for auto-reload perf kvm: Switch to new perf_mmap__read_event() interface Karthikeyan Periyasamy (2): Revert "ath10k: send (re)assoc peer command when NSS changed" ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk) Kieran Bingham (1): media: i2c: adv748x: fix HDMI field heights Kirill Marinushkin (1): staging: bcm2835-audio: Release resources on module_exit() Ladislav Michl (1): power: supply: ltc2941-battery-gauge: Fix temperature units Larry Finger (1): Bluetooth: btusb: Add device ID for RTL8822BE Lars-Peter Clausen (2): usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS usb: gadget: ffs: Execute copy_to_user() with USER_DS set Laurent Pinchart (3): drm: omapdrm: dss: Move initialization code from component bind to probe media: v4l: vsp1: Fix display stalls when requesting too many inputs ARM: dts: porter: Fix HDMI output routing Lenny Szubowicz (1): ACPI: acpi_pad: Fix memory leak in power saving threads Leo Yan (1): coresight: Use %px to print pcsr instead of %p Leon Romanovsky (2): net/mlx5: Protect from command bit overflow RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPs Linus Walleij (1): drm/bridge: sii902x: Retry status read after DDI I2C Liu Bo (3): Btrfs: clean up resources during umount after trans is aborted Btrfs: bail out on error during replay_dir_deletes Btrfs: fix NULL pointer dereference in log_dir_items Lorenzo Bianconi (2): mt76x2: fix possible NULL pointer dereferencing in mt76x2_tx() mt76x2: fix warning in ieee80211_get_key_rx_seq() Luca Coelho (1): iwlwifi: mvm: check if mac80211_queue is valid in iwl_mvm_disable_txq Luis R. Rodriguez (1): firmware: fix checking for return values for fw_add_devm_name() Madalin Bucur (1): dpaa_eth: fix SG mapping Madhavan Srinivasan (1): powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer Marc Dionne (1): rxrpc: Fix resend event time calculation Marc Zyngier (1): arm64: insn: Allow ADD/SUB (immediate) with LSL #12 Marcel Ziswiler (1): clk: tegra: Fix pll_u rate configuration Mark Rutland (1): efi/arm*: Only register page tables when they exist Masami Hiramatsu (2): tracing/uprobe_event: Fix strncpy corner case media: vb2: Fix videobuf2 to map correct area Mathias Kresin (1): MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset Mathias Nyman (2): xhci: Show what USB release number the xHC supports from protocol capablity xhci: zero usb device slot_id member when disabling and freeing a xhci slot Mathieu Malaterre (1): powerpc: Add missing prototype for arch_irq_work_raise() Maurizio Lombardi (1): cdrom: do not call check_disk_change() inside cdrom_open() Michael Ellerman (4): powerpc/mpic: Check if cpu_possible() in mpic_physmask() powerpc/perf: Fix kernel address leak via sampling registers selftests: Print the test we're running to /dev/kmsg powerpc/pseries: Make plpar_wrappers.h safe to include when PSERIES=n Michael Schmitz (1): zorro: Set up z->dev.dma_mask for the DMA API Michal Hocko (1): memcg: fix per_node_info cleanup Mikhail Malygin (1): IB/rxe: Fix for oops in rxe_register_device on ppc64le arch Milton Miller (2): watchdog: aspeed: Allow configuring for alternate boot watchdog: aspeed: Fix translation of reset mode to ctrl register Mimi Zohar (1): ima: clear IMA_HASH Minas Harutyunyan (2): usb: dwc2: hcd: Fix host channel halt flow usb: dwc2: host: Fix transaction errors in host mode Ming Lei (1): block: null_blk: fix 'Invalid parameters' when loading module Monk Liu (2): drm/amdgpu: disable GFX ring and disable PQ wptr in hw_fini drm/amdgpu: adjust timeout for ib_ring_tests(v2) NeilBrown (2): staging: lustre: fix bug in osc_enter_cache_try staging: lustre: lmv: correctly iput lmo_root Nicholas Piggin (2): powerpc/64s/idle: Fix restore of AMOR on POWER9 after deep sleep powerpc/64s: sreset panic if there is no debugger or crash dump handlers Nicolin Chen (1): ASoC: fsl_ssi: Maintain a mask of active streams Niklas Cassel (4): pinctrl: artpec6: dt: add missing pin group uart5nocts net: stmmac: ensure that the device has released ownership before reading data net: stmmac: ensure that the MSS desc is the last desc to set the own bit net: stmmac: call correct function in stmmac_mac_config_rx_queues_routing() Nikolay Borisov (1): btrfs: Fix possible softlock on single core machines Nobutaka Okabe (1): ALSA: usb-audio: Add native DSD support for Luxman DA-06 Oded Gabbay (1): drm/amdkfd: add missing include of mm.h Omar Sandoval (1): loop: don't call into filesystem while holding lo_ctl_mutex Parav Pandit (1): IB/core: Honor port_num while resolving GID for IB link layer Paul E. McKenney (1): rcu: Create RCU-specific workqueues with rescuers PaweÅ‚ JabÅ‚oÅ„ski (1): i40e: Fix attach VF to VM issue Peter Robinson (1): crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss Peter Rosin (2): ARM: dts: at91: nattis: use the correct compatible for the eeprom ARM: dts: at91: tse850: use the correct compatible for the eeprom Peter Zijlstra (1): perf/core: Fix perf_output_read_group() Petr Vorel (1): ima: Fallback to the builtin hash algorithm Philipp Puschmann (1): arm: dts: socfpga: fix GIC PPI warning Pierre Bourdon (1): max17042: propagate of_node to power supply device Prashant Bhole (1): selftests/net: fixes psock_fanout eBPF test case Qi Hou (1): dmaengine: pl330: fix a race condition in case of threaded irqs Qu Wenruo (2): btrfs: tests/qgroup: Fix wrong tree backref level btrfs: qgroup: Fix root item corruption when multiple same source snapshots are created with quota enabled Quytelda Kahja (1): staging: ks7010: Use constants from ieee80211_eid instead of literal ints. Rafael J. Wysocki (2): PCI: Restore config space on runtime resume despite being unbound PCMCIA / PM: Avoid noirq suspend aborts during suspend-to-idle Randy Dunlap (1): kdb: make "mdr" command repeat Ranjani Sridharan (1): ASoC: topology: create TLV data for dapm widgets Ravikumar Kattekola (1): ARM: dts: dra71-evm: Correct evm_sd regulator max voltage Rich Felker (1): sh: fix debug trap failure to process signals before return to user Richard Fitzgerald (1): pinctrl: devicetree: Fix dt_to_map_one_config handling of hogs Richard Guy Briggs (1): audit: return on memory error to avoid null pointer dereference Richard Haines (1): netlabel: If PF_INET6, check sk_buff ip header version Rolf Evers-Fischer (1): PCI: endpoint: Fix kernel panic after put_device() Sai Praneeth (1): x86/mm: Fix bogus warning during EFI bootup, use boot_cpu_has() instead of this_cpu_has() in build_cr3_noflush() Sandipan Das (2): perf tools: Fix perf builds with clang support perf clang: Add support for recent clang versions Sara Sharon (1): iwlwifi: mvm: take RCU lock before dereferencing Scott Branden (1): bnxt_en: fix clear flags in ethtool reset handling Sean Christopherson (2): KVM: VMX: raise internal error for exception during invalid protected mode state Revert "KVM: X86: Fix SMRAM accessing even if VM is shutdown" Sebastian Andrzej Siewior (2): iommu/amd: Take into account that alloc_dev_data() may return NULL crypto: ccp - don't disable interrupts while setting up debugfs Sebastian Gottschall (1): ath9k: fix crash in spectral scan Sergei Shtylyov (4): sh_eth: fix TSU init on SH7734/R8A7740 soc: renesas: r8a77970-sysc: fix power area parents drm: rcar-du: lvds: Fix LVDS startup on R-Car Gen3 drm: rcar-du: lvds: Fix LVDS startup on R-Car Gen2 Seunghun Han (1): ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c Shawn Lin (4): clk: rockchip: Fix wrong parent for SDMMC phase clock for rk3228 clk: Don't show the incorrect clock phase phy: rockchip-emmc: retry calpad busy trimming clk: rockchip: Prevent calculating mmc phase if clock rate is zero Shunyong Yang (1): cpufreq: CPPC: Initialize shared perf capabilities of CPUs Sinan Kaya (1): net: qlge: Eliminate duplicate barriers on weakly-ordered archs Sowmini Varadhan (1): rds: tcp: must use spin_lock_irq* and not spin_lock_bh with rds_tcp_conn_lock Sriharsha Basavapatna (1): bnxt_en: Ignore src port field in decap filter nodes Srinivas Kandagatla (1): dmaengine: qcom: bam_dma: get num-channels and num-ees from dt Stefan Wahren (2): ARM: dts: bcm283x: Fix probing of bcm2835-i2s hwrng: bcm2835 - Handle deferred clock properly Sukadev Bhattiprolu (1): powerpc/vas: Fix cleanup when VAS is not configured Suman Anna (1): ARM: dts: keystone-k2e-clocks: Fix missing unit address separator Sylwester Nawrocki (2): ASoC: samsung: odroid: Fix 32000 sample rate handling ASoC: samsung: i2s: Ensure the RCLK rate is properly determined Takashi Iwai (1): ALSA: vmaster: Propagate slave error Takeshi Kihara (1): pinctrl: sh-pfc: r8a7796: Fix MOD_SEL register pin assignment for SSI pins group Tao (1): drm/amd/display: Set vsc pack revision when DPCD revision is >= 1.2 Tedd Ho-Jeong An (1): Bluetooth: btusb: Add support for Intel Bluetooth device 22560 [8087:0026] Tejun Heo (1): rcu: Call touch_nmi_watchdog() while printing stall warnings Tero Kristo (1): clk: ti: fix flag space conflict with clkctrl clocks Thinh Nguyen (2): usb: dwc3: Add SoftReset PHY synchonization delay usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields Thomas Falcon (3): ibmvnic: Zero used TX descriptor counter on reset ibmvnic: Allocate statistics buffers during probe ibmvnic: Fix TX descriptor tracking again Thomas Gleixner (1): genirq/affinity: Don't return with empty affinity masks on error Thomas Hellstrom (1): drm/vmwgfx: Unpin the screen object backup buffer when not used Thomas Richter (2): perf stat: Fix core dump when flag T is used perf test: Fix test case inet_pton to accept inlines. Thomas Vincent-Cross (1): PCI: Add function 1 DMA alias quirk for Marvell 88SE9220 Tom Abraham (1): swap: divide-by-zero when zero length swap file on ssd Ursula Braun (1): net/smc: pay attention to MAX_ORDER for CQ entries Uwe Kleine-KÃ¶nig (1): serial: altera: ensure port->regshift is honored consistently Vaibhav Jain (2): powerpc/xmon: Setup debugger hooks when first break-point is set cxl: Check if PSL data-cache is available before issue flush request Vicente Bergas (1): Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB Vignesh R (1): serial: 8250: Don't service RX FIFO if interrupts are disabled Viresh Kumar (1): cpufreq: Reorder cpufreq_online() error code path Vitaly Kuznetsov (1): KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use Vivek Gautam (1): phy: qcom-qmp: Fix phy pipe clock gating Wilfried Weissmann (1): scsi: mvsas: fix wrong endianness of sgpio api Wolfram Sang (1): usb: gadget: udc: change comparison to bitshift when dealing with a mask Xidong Wang (1): z3fold: fix memory leak Xose Vazquez Perez (1): scsi: devinfo: add HP DISK-SUBSYSTEM device, for HP XP arrays Yang Shi (1): mm: thp: fix potential clearing to referenced flag in page_idle_clear_pte_refs_one() Yisheng Xie (1): perf top: Fix top.call-graph config option reading Yixun Lan (1): clk: meson: axg: fix the od shift of the sys_pll Yong Wu (1): iommu/mediatek: Fix protect memory setting Yoshihiro Shimoda (1): dmaengine: rcar-dmac: Check the done lists in rcar_dmac_chan_get_residue() leilei.lin (1): perf/core: Fix installing cgroup events on CPU lionel.debieve(a)st.com (1): hwrng: stm32 - add reset during probe Ã˜rjan Eide (1): drm/rockchip: Respect page offset for PRIME mmap calls .../devicetree/bindings/clock/sunxi-ccu.txt | 4 + .../devicetree/bindings/display/msm/dsi.txt | 4 + .../bindings/pinctrl/axis,artpec6-pinctrl.txt | 5 +- arch/arm/boot/dts/at91-nattis-2-natte-2.dts | 2 +- arch/arm/boot/dts/at91-tse850-3.dts | 2 +- arch/arm/boot/dts/bcm283x.dtsi | 6 +- arch/arm/boot/dts/dra71-evm.dts | 4 +- arch/arm/boot/dts/imx7d-cl-som-imx7.dts | 52 +-- arch/arm/boot/dts/keystone-k2e-clocks.dtsi | 2 +- arch/arm/boot/dts/ls1021a.dtsi | 3 +- arch/arm/boot/dts/r8a7791-porter.dts | 2 +- arch/arm/boot/dts/socfpga.dtsi | 2 +- arch/arm/configs/davinci_all_defconfig | 2 +- arch/arm/mm/dma-mapping.c | 16 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 +- arch/arm64/kernel/insn.c | 18 +- arch/m68k/coldfire/device.c | 12 +- arch/mips/cavium-octeon/octeon-irq.c | 10 +- arch/mips/include/asm/mach-ath79/ar71xx_regs.h | 2 +- arch/powerpc/include/asm/irq_work.h | 1 + arch/powerpc/include/asm/mmu-8xx.h | 6 + arch/powerpc/include/asm/plpar_wrappers.h | 4 + arch/powerpc/kernel/idle_book3s.S | 2 + arch/powerpc/kernel/setup-common.c | 2 + arch/powerpc/kernel/traps.c | 47 ++- arch/powerpc/mm/8xx_mmu.c | 2 +- arch/powerpc/mm/hugetlbpage.c | 2 + arch/powerpc/mm/mmu_context_nohash.c | 18 +- arch/powerpc/perf/core-book3s.c | 25 ++ arch/powerpc/platforms/Kconfig.cputype | 1 + arch/powerpc/platforms/powernv/npu-dma.c | 229 ++++++++----- arch/powerpc/platforms/powernv/vas-debug.c | 11 + arch/powerpc/platforms/powernv/vas.c | 6 +- arch/powerpc/sysdev/mpic.c | 2 +- arch/powerpc/xmon/xmon.c | 17 +- arch/riscv/include/asm/fence.h | 12 + arch/riscv/include/asm/spinlock.h | 29 +- arch/sh/kernel/entry-common.S | 2 +- arch/sparc/include/asm/atomic_64.h | 6 +- arch/x86/events/core.c | 15 +- arch/x86/events/intel/core.c | 12 +- arch/x86/events/intel/ds.c | 92 ++++- arch/x86/events/perf_event.h | 2 +- arch/x86/include/asm/tlbflush.h | 7 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/cpu/mcheck/mce.c | 14 + arch/x86/kernel/devicetree.c | 21 +- arch/x86/kvm/lapic.c | 10 +- arch/x86/kvm/mmu.c | 2 +- arch/x86/kvm/vmx.c | 20 +- arch/x86/mm/pageattr.c | 6 +- arch/x86/mm/pgtable.c | 9 + arch/x86/xen/enlighten_pvh.c | 14 +- block/blk-core.c | 31 ++ block/blk-sysfs.c | 7 - crypto/af_alg.c | 8 +- drivers/acpi/acpi_pad.c | 3 + drivers/acpi/acpica/evevent.c | 9 +- drivers/acpi/acpica/nseval.c | 8 + drivers/acpi/acpica/psargs.c | 4 + drivers/base/firmware_class.c | 12 +- drivers/base/regmap/regmap.c | 2 +- drivers/block/loop.c | 38 ++- drivers/block/null_blk.c | 46 +-- drivers/block/paride/pcd.c | 2 + drivers/bluetooth/btusb.c | 13 + drivers/cdrom/cdrom.c | 3 - drivers/cdrom/gdrom.c | 3 + drivers/char/hw_random/bcm2835-rng.c | 2 + drivers/char/hw_random/stm32-rng.c | 9 + drivers/char/ipmi/ipmi_ssif.c | 4 +- drivers/clk/clk.c | 3 + drivers/clk/hisilicon/crg-hi3516cv300.c | 2 +- drivers/clk/meson/axg.c | 7 +- drivers/clk/rockchip/clk-mmc-phase.c | 23 ++ drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/samsung/clk-exynos3250.c | 4 +- drivers/clk/samsung/clk-exynos5250.c | 8 +- drivers/clk/samsung/clk-exynos5260.c | 2 +- drivers/clk/samsung/clk-exynos5433.c | 12 +- drivers/clk/samsung/clk-exynos7.c | 2 +- drivers/clk/samsung/clk-s3c2410.c | 16 +- drivers/clk/tegra/clk-pll.c | 2 + drivers/clk/ti/clock.h | 9 +- drivers/cpufreq/cppc_cpufreq.c | 23 +- drivers/cpufreq/cpufreq.c | 6 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/ccp/ccp-debugfs.c | 7 +- drivers/crypto/ccp/sp-dev.c | 6 +- drivers/crypto/inside-secure/safexcel.c | 12 +- drivers/crypto/inside-secure/safexcel_cipher.c | 2 +- drivers/crypto/inside-secure/safexcel_hash.c | 38 ++- drivers/crypto/sunxi-ss/sun4i-ss-core.c | 1 + drivers/dma/pl330.c | 6 +- drivers/dma/qcom/bam_dma.c | 27 +- drivers/dma/sh/rcar-dmac.c | 13 +- drivers/firmware/dmi_scan.c | 2 +- drivers/firmware/efi/arm-runtime.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 33 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c | 7 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- drivers/gpu/drm/bridge/sii902x.c | 20 +- drivers/gpu/drm/drm_vblank.c | 8 +- drivers/gpu/drm/meson/meson_drv.c | 29 +- drivers/gpu/drm/omapdrm/dss/dispc.c | 4 + drivers/gpu/drm/omapdrm/dss/dss.c | 193 ++++++----- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c | 18 +- drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 29 +- drivers/hwmon/nct6775.c | 10 +- drivers/hwmon/pmbus/adm1275.c | 4 +- drivers/hwmon/pmbus/max8688.c | 2 +- drivers/hwtracing/coresight/coresight-cpu-debug.c | 2 +- drivers/hwtracing/intel_th/core.c | 2 +- drivers/i2c/busses/i2c-mv64xxx.c | 8 +- drivers/i2c/i2c-core-base.c | 8 + drivers/ide/ide-cd.c | 2 + drivers/infiniband/core/multicast.c | 26 +- drivers/infiniband/hw/mlx5/main.c | 3 + drivers/infiniband/hw/mlx5/qp.c | 3 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- drivers/iommu/amd_iommu.c | 2 + drivers/iommu/mtk_iommu.c | 15 +- drivers/iommu/mtk_iommu.h | 1 + drivers/macintosh/rack-meter.c | 4 +- drivers/md/bcache/bcache.h | 9 +- drivers/md/bcache/super.c | 39 ++- drivers/md/bcache/sysfs.c | 3 +- drivers/md/bcache/writeback.c | 60 +++- drivers/md/bcache/writeback.h | 2 - drivers/media/common/videobuf2/videobuf2-vmalloc.c | 2 +- drivers/media/dvb-frontends/lgdt3306a.c | 10 +- drivers/media/i2c/adv748x/adv748x-hdmi.c | 3 + drivers/media/i2c/ov5645.c | 5 +- drivers/media/pci/cx23885/cx23885-cards.c | 4 + drivers/media/pci/cx23885/cx23885-core.c | 10 + drivers/media/pci/cx25821/cx25821-core.c | 7 +- drivers/media/platform/s3c-camif/camif-capture.c | 7 +- drivers/media/platform/vivid/vivid-ctrls.c | 2 + drivers/media/platform/vsp1/vsp1_drm.c | 9 + drivers/media/usb/em28xx/em28xx-cards.c | 22 +- drivers/media/usb/em28xx/em28xx.h | 2 +- drivers/misc/cxl/cxl.h | 4 + drivers/misc/cxl/native.c | 11 +- drivers/misc/cxl/pci.c | 19 +- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 8 +- drivers/net/ethernet/broadcom/bgmac.c | 3 +- drivers/net/ethernet/broadcom/bgmac.h | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 8 +- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 11 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 1 + drivers/net/ethernet/cisco/enic/enic_main.c | 10 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 23 +- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 +- drivers/net/ethernet/ibm/ibmvnic.c | 32 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 30 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 61 ++-- drivers/net/ethernet/qlogic/qlge/qlge.h | 16 + drivers/net/ethernet/qlogic/qlge/qlge_main.c | 3 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 + drivers/net/ethernet/renesas/sh_eth.c | 6 +- drivers/net/ethernet/renesas/sh_eth.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 16 +- drivers/net/hyperv/netvsc.c | 8 +- drivers/net/hyperv/netvsc_drv.c | 2 +- drivers/net/hyperv/rndis_filter.c | 4 +- drivers/net/ieee802154/ca8210.c | 14 +- drivers/net/phy/dp83640.c | 18 + drivers/net/usb/lan78xx.c | 34 +- drivers/net/virtio_net.c | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 17 +- drivers/net/wireless/ath/ath9k/common-spectral.c | 12 +- drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 11 +- drivers/net/wireless/mediatek/mt76/mt76x2_main.c | 11 + drivers/net/wireless/mediatek/mt76/mt76x2_tx.c | 5 +- drivers/net/wireless/rsi/rsi_91x_sdio.c | 32 +- drivers/net/wireless/rsi/rsi_sdio.h | 2 + drivers/nvme/host/core.c | 17 +- drivers/nvme/host/fabrics.c | 83 ++++- drivers/nvme/host/fabrics.h | 33 +- drivers/nvme/host/fc.c | 17 +- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/pci.c | 7 +- drivers/nvme/host/rdma.c | 14 +- drivers/nvme/target/loop.c | 11 +- drivers/parisc/lba_pci.c | 20 +- drivers/pci/endpoint/pci-epf-core.c | 2 +- drivers/pci/pci-driver.c | 17 +- drivers/pci/quirks.c | 3 + drivers/pcmcia/cs.c | 10 +- drivers/pcmcia/cs_internal.h | 1 + drivers/phy/qualcomm/phy-qcom-qmp.c | 4 +- drivers/phy/rockchip/phy-rockchip-emmc.c | 27 +- drivers/pinctrl/devicetree.c | 6 +- drivers/pinctrl/pinctrl-mcp23s08.c | 37 +- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- drivers/pinctrl/sh-pfc/pfc-r8a7796.c | 40 +-- drivers/platform/x86/dell-smbios-base.c | 4 +- drivers/power/supply/ltc2941-battery-gauge.c | 8 +- drivers/power/supply/max17042_battery.c | 1 + drivers/regulator/gpio-regulator.c | 16 +- drivers/regulator/of_regulator.c | 1 + drivers/remoteproc/imx_rproc.c | 6 +- drivers/rtc/hctosys.c | 5 + drivers/rtc/rtc-goldfish.c | 2 + drivers/rtc/rtc-m41t80.c | 18 +- drivers/rtc/rtc-rk808.c | 14 +- drivers/rtc/rtc-rp5c01.c | 12 +- drivers/rtc/rtc-snvs.c | 15 +- drivers/rtc/rtc-tx4939.c | 6 +- drivers/s390/cio/vfio_ccw_fsm.c | 5 + drivers/scsi/aacraid/commsup.c | 4 +- drivers/scsi/aacraid/linit.c | 1 + drivers/scsi/lpfc/lpfc_attr.c | 5 + drivers/scsi/lpfc/lpfc_hbadisc.c | 5 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 15 +- drivers/scsi/lpfc/lpfc_nvme.c | 28 +- drivers/scsi/lpfc/lpfc_nvme.h | 2 + drivers/scsi/lpfc/lpfc_sli.c | 2 + drivers/scsi/mvsas/mv_94xx.c | 23 +- drivers/scsi/scsi_devinfo.c | 1 + drivers/scsi/scsi_lib.c | 11 + drivers/scsi/sr.c | 21 +- drivers/soc/amlogic/meson-gx-pwrc-vpu.c | 6 +- drivers/soc/qcom/wcnss_ctrl.c | 2 +- drivers/soc/renesas/r8a77970-sysc.c | 12 +- drivers/spi/spi-bcm-qspi.c | 4 +- drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 16 +- drivers/staging/ks7010/ks_hostif.c | 31 +- drivers/staging/ks7010/ks_hostif.h | 1 + drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/lustre/lustre/lmv/lmv_obd.c | 2 +- drivers/staging/lustre/lustre/osc/osc_cache.c | 2 +- drivers/staging/rtl8192u/r8192U_core.c | 2 + .../staging/vc04_services/bcm2835-audio/bcm2835.c | 54 ++- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/serial/altera_uart.c | 12 +- drivers/tty/serial/arc_uart.c | 5 + drivers/tty/serial/fsl_lpuart.c | 4 + drivers/tty/serial/imx.c | 6 + drivers/tty/serial/mvebu-uart.c | 2 +- drivers/tty/serial/mxs-auart.c | 4 + drivers/tty/serial/samsung.c | 4 + drivers/tty/serial/sh-sci.c | 4 + drivers/tty/serial/xilinx_uartps.c | 2 +- drivers/usb/dwc2/core.h | 2 +- drivers/usb/dwc2/hcd.c | 32 +- drivers/usb/dwc3/Makefile | 2 +- drivers/usb/dwc3/core.c | 13 +- drivers/usb/dwc3/core.h | 2 + drivers/usb/gadget/composite.c | 40 ++- drivers/usb/gadget/function/f_fs.c | 6 +- drivers/usb/gadget/udc/goku_udc.h | 2 +- drivers/usb/host/xhci-mem.c | 2 + drivers/usb/host/xhci.c | 14 +- drivers/usb/usbip/Kconfig | 2 +- drivers/watchdog/asm9260_wdt.c | 8 +- drivers/watchdog/aspeed_wdt.c | 13 +- drivers/watchdog/davinci_wdt.c | 15 +- drivers/watchdog/dw_wdt.c | 23 +- drivers/watchdog/sprd_wdt.c | 4 +- drivers/xen/xen-acpi-processor.c | 6 +- drivers/zorro/zorro.c | 12 + fs/btrfs/dev-replace.c | 2 +- fs/btrfs/disk-io.c | 5 +- fs/btrfs/extent-tree.c | 1 + fs/btrfs/tests/qgroup-tests.c | 2 +- fs/btrfs/transaction.c | 10 +- fs/btrfs/tree-log.c | 75 ++++- fs/ext4/super.c | 12 + fs/f2fs/checkpoint.c | 71 ++-- fs/f2fs/extent_cache.c | 3 + fs/f2fs/file.c | 8 +- fs/fscache/page.c | 13 +- fs/gfs2/bmap.c | 10 +- fs/gfs2/file.c | 5 +- fs/gfs2/quota.h | 2 + fs/notify/fanotify/fanotify.c | 19 +- fs/notify/fanotify/fanotify.h | 3 +- fs/notify/fanotify/fanotify_user.c | 2 +- fs/ocfs2/dlm/dlmdomain.c | 14 - fs/ocfs2/dlm/dlmdomain.h | 25 +- fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/proc/proc_sysctl.c | 3 + fs/udf/super.c | 5 +- fs/xfs/xfs_discard.c | 14 +- include/drm/drm_vblank.h | 2 +- include/linux/usb/composite.h | 3 + include/net/inet_timewait_sock.h | 1 + include/scsi/scsi.h | 2 + include/uapi/linux/msg.h | 1 + include/uapi/linux/sem.h | 1 + include/uapi/linux/shm.h | 5 +- ipc/msg.c | 17 +- ipc/sem.c | 17 +- ipc/shm.c | 23 +- kernel/audit.c | 2 + kernel/debug/kdb/kdb_main.c | 27 +- kernel/events/core.c | 49 ++- kernel/irq/affinity.c | 15 +- kernel/rcu/rcu.h | 1 + kernel/rcu/srcutree.c | 8 +- kernel/rcu/tree.c | 6 + kernel/rcu/tree_exp.h | 2 +- kernel/rcu/tree_plugin.h | 14 +- kernel/sched/rt.c | 2 + kernel/trace/trace_uprobe.c | 2 + lib/test_kasan.c | 8 + mm/ksm.c | 28 ++ mm/memcontrol.c | 3 + mm/page_idle.c | 12 +- mm/slub.c | 57 ++-- mm/swapfile.c | 4 + mm/vmscan.c | 8 +- mm/z3fold.c | 9 +- net/dccp/ipv4.c | 1 + net/dccp/ipv6.c | 1 + net/ipv4/inet_timewait_sock.c | 1 + net/mac80211/mlme.c | 3 +- net/netlabel/netlabel_unlabeled.c | 10 + net/rds/tcp.c | 17 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/input.c | 15 +- net/rxrpc/sendmsg.c | 4 +- net/smc/smc_ib.c | 10 +- net/smc/smc_wr.h | 1 - security/integrity/ima/Kconfig | 1 + security/integrity/ima/ima_crypto.c | 2 + security/integrity/ima/ima_main.c | 13 + security/integrity/ima/ima_policy.c | 2 +- security/selinux/hooks.c | 3 + security/smack/smack_lsm.c | 3 + sound/core/vmaster.c | 5 +- sound/soc/fsl/fsl_ssi.c | 15 +- sound/soc/rockchip/Kconfig | 3 + sound/soc/samsung/i2s.c | 13 +- sound/soc/samsung/odroid.c | 11 +- sound/soc/soc-topology.c | 3 + sound/usb/quirks.c | 29 +- tools/hv/hv_fcopy_daemon.c | 3 +- tools/hv/hv_vss_daemon.c | 1 + tools/perf/Makefile.perf | 3 +- tools/perf/builtin-kvm.c | 17 +- tools/perf/builtin-stat.c | 9 +- tools/perf/builtin-top.c | 6 +- tools/perf/tests/dwarf-unwind.c | 46 ++- .../perf/tests/shell/trace+probe_libc_inet_pton.sh | 6 +- tools/perf/tests/vmlinux-kallsyms.c | 2 +- tools/perf/ui/browsers/annotate.c | 9 +- tools/perf/util/c++/clang.cpp | 11 +- tools/perf/util/hist.c | 4 +- tools/perf/util/hist.h | 1 - tools/perf/util/mmap.c | 6 + tools/testing/selftests/Makefile | 1 + tools/testing/selftests/net/fib-onlink-tests.sh | 375 +++++++++++++++++++++ tools/testing/selftests/net/psock_fanout.c | 3 +- tools/thermal/tmon/sysfs.c | 12 +- tools/thermal/tmon/tmon.c | 1 - 368 files changed, 3410 insertions(+), 1253 deletions(-) create mode 100644 arch/riscv/include/asm/fence.h create mode 100755 tools/testing/selftests/net/fib-onlink-tests.sh -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlrihEMACgkQ3qZv95d3 LNz4qhAAqKT0kzQMLjCSKqrRx0B51Z50nxtr7Qa5QchvT/38SphIyXq/+5MCeRsE V4AA21ltul6rjVh84AWfcIGjkP4eCcFS6D/y2/0bkDO1r2zyJonZ2JvIGkx7kQyW Atomdc231mNzkaH45a+JwJ+fnbQQq9zLZVDDQCk1jXYSwAklC8TvCvCd9xB/Eqda 3ZB0/+rpNG42ZXwH5YGMTFbNdp+vhHhMW4sF4FWnSvX8pspyrHlyYlzlxZLoakHz TNOq2shWITPiBOEh3b2MpNJFmiD/980r+K6qwEPZIeDwoUF1ADVz2SgWiEcf2iTU 14URtiUGg5RTLW82xq1wxxa0g61G5JZplzwE3yrOM9SA5Kclsx2LlCdBYo14nB4R Cz1EBUtV/HxuXrMVf2YRWU0SEMGClm2XgZycLvx5tMgNXLgxA6/fTXmWiR3seBgH Fwnb5u/YGFtrzjkgQ9HlhvmT1hiy2a7hOAjiULx7mBtYo/Ns7FWWGGAYX3O9vML4 WvAlDUcts1t6h225G8o2rFHJfAPiipmEfzp2o0lFSXGiCsL47JRk8aq99XsjpI5G n5KesG0ndKgtnZuI9vi11fffKOREm0tRYuABncqIPqKIPVZoBq2gwiFDgVHDzai+ VZaipyeHdueAH/Fnenp0a05mBdg7m+4NfOUVqApH2SYQizWSYuM= =MB3S -----END PGP SIGNATURE-----

7 years, 7 months

4
9
0 0

+ radix-tree-fix-multi-order-iteration-race.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: radix tree: fix multi-order iteration race has been added to the -mm tree. Its filename is radix-tree-fix-multi-order-iteration-race.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/radix-tree-fix-multi-order-iterati… and later at http://ozlabs.org/~akpm/mmotm/broken-out/radix-tree-fix-multi-order-iterati… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Ross Zwisler <ross.zwisler(a)linux.intel.com> Subject: radix tree: fix multi-order iteration race Fix a race in the multi-order iteration code which causes the kernel to hit a GP fault. This was first seen with a production v4.15 based kernel (4.15.6-300.fc27.x86_64) utilizing a DAX workload which used order 9 PMD DAX entries. The race has to do with how we tear down multi-order sibling entries when we are removing an item from the tree. Remember for example that an order 2 entry looks like this: struct radix_tree_node.slots[] = [entry][sibling][sibling][sibling] where 'entry' is in some slot in the struct radix_tree_node, and the three slots following 'entry' contain sibling pointers which point back to 'entry.' When we delete 'entry' from the tree, we call : radix_tree_delete() radix_tree_delete_item() __radix_tree_delete() replace_slot() replace_slot() first removes the siblings in order from the first to the last, then at then replaces 'entry' with NULL. This means that for a brief period of time we end up with one or more of the siblings removed, so: struct radix_tree_node.slots[] = [entry][NULL][sibling][sibling] This causes an issue if you have a reader iterating over the slots in the tree via radix_tree_for_each_slot() while only under rcu_read_lock()/rcu_read_unlock() protection. This is a common case in mm/filemap.c. The issue is that when __radix_tree_next_slot() => skip_siblings() tries to skip over the sibling entries in the slots, it currently does so with an exact match on the slot directly preceding our current slot. Normally this works: V preceding slot struct radix_tree_node.slots[] = [entry][sibling][sibling][sibling] ^ current slot This lets you find the first sibling, and you skip them all in order. But in the case where one of the siblings is NULL, that slot is skipped and then our sibling detection is interrupted: V preceding slot struct radix_tree_node.slots[] = [entry][NULL][sibling][sibling] ^ current slot This means that the sibling pointers aren't recognized since they point all the way back to 'entry', so we think that they are normal internal radix tree pointers. This causes us to think we need to walk down to a struct radix_tree_node starting at the address of 'entry'. In a real running kernel this will crash the thread with a GP fault when you try and dereference the slots in your broken node starting at 'entry'. We fix this race by fixing the way that skip_siblings() detects sibling nodes. Instead of testing against the preceding slot we instead look for siblings via is_sibling_entry() which compares against the position of the struct radix_tree_node.slots[] array. This ensures that sibling entries are properly identified, even if they are no longer contiguous with the 'entry' they point to. Link: http://lkml.kernel.org/r/20180503192430.7582-6-ross.zwisler@linux.intel.com Fixes: 148deab223b2 ("radix-tree: improve multiorder iterators") Signed-off-by: Ross Zwisler <ross.zwisler(a)linux.intel.com> Reported-by: CR, Sapthagirish <sapthagirish.cr(a)intel.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Dave Chinner <david(a)fromorbit.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/radix-tree.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff -puN lib/radix-tree.c~radix-tree-fix-multi-order-iteration-race lib/radix-tree.c --- a/lib/radix-tree.c~radix-tree-fix-multi-order-iteration-race +++ a/lib/radix-tree.c @@ -1612,11 +1612,9 @@ static void set_iter_tags(struct radix_t static void __rcu **skip_siblings(struct radix_tree_node **nodep, void __rcu **slot, struct radix_tree_iter *iter) { - void *sib = node_to_entry(slot - 1); - while (iter->index < iter->next_index) { *nodep = rcu_dereference_raw(*slot); - if (*nodep && *nodep != sib) + if (*nodep && !is_sibling_entry(iter->node, *nodep)) return slot; slot++; iter->index = __radix_tree_iter_add(iter, 1); @@ -1631,7 +1629,7 @@ void __rcu **__radix_tree_next_slot(void struct radix_tree_iter *iter, unsigned flags) { unsigned tag = flags & RADIX_TREE_ITER_TAG_MASK; - struct radix_tree_node *node = rcu_dereference_raw(*slot); + struct radix_tree_node *node; slot = skip_siblings(&node, slot, iter); _ Patches currently in -mm which might be from ross.zwisler(a)linux.intel.com are radix-tree-test-suite-fix-mapshift-build-target.patch radix-tree-test-suite-fix-compilation-issue.patch radix-tree-test-suite-add-item_delete_rcu.patch radix-tree-test-suite-multi-order-iteration-race.patch radix-tree-fix-multi-order-iteration-race.patch

7 years, 7 months

3
2
0 0

Backport commit b7363e67 to stable 4.9.y

by Raju Rangoju

Hi Greg, Could you please backport the below commit to 4.9 stable tree. With a CPU bounded workqueue we see much lower cpu utilization and the same IOPs performance. commit b7363e67b23e04c23c2a99437feefac7292a88bc Author: Sagi Grimberg <sagi(a)grimberg.me> Date: Wed Mar 8 22:03:17 2017 +0200 IB/device: Convert ib-comp-wq to be CPU-bound Thanks, Raju

7 years, 7 months

2
2
0 0

[PATCH 2/2] can: hi311x: Work around TX complete interrupt erratum

by Marc Kleine-Budde

From: Lukas Wunner <lukas(a)wunner.de> When sending packets as fast as possible using "cangen -g 0 -i -x", the HI-3110 occasionally latches the interrupt pin high on completion of a packet, but doesn't set the TXCPLT bit in the INTF register. The INTF register contains 0x00 as if no interrupt has occurred. Even waiting for a few milliseconds after the interrupt doesn't help. Work around this apparent erratum by instead checking the TXMTY bit in the STATF register ("TX FIFO empty"). We know that we've queued up a packet for transmission if priv->tx_len is nonzero. If the TX FIFO is empty, transmission of that packet must have completed. Note that this is congruent with our handling of received packets, which likewise gleans from the STATF register whether a packet is waiting in the RX FIFO, instead of looking at the INTF register. Cc: Mathias Duckeck <m.duckeck(a)kunbus.de> Cc: Akshay Bhat <akshay.bhat(a)timesys.com> Cc: Casey Fitzpatrick <casey.fitzpatrick(a)timesys.com> Cc: stable(a)vger.kernel.org # v4.12+ Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Acked-by: Akshay Bhat <akshay.bhat(a)timesys.com> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- drivers/net/can/spi/hi311x.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c index c2cf254e4e95..53e320c92a8b 100644 --- a/drivers/net/can/spi/hi311x.c +++ b/drivers/net/can/spi/hi311x.c @@ -91,6 +91,7 @@ #define HI3110_STAT_BUSOFF BIT(2) #define HI3110_STAT_ERRP BIT(3) #define HI3110_STAT_ERRW BIT(4) +#define HI3110_STAT_TXMTY BIT(7) #define HI3110_BTR0_SJW_SHIFT 6 #define HI3110_BTR0_BRP_SHIFT 0 @@ -737,10 +738,7 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) } } - if (intf == 0) - break; - - if (intf & HI3110_INT_TXCPLT) { + if (priv->tx_len && statf & HI3110_STAT_TXMTY) { net->stats.tx_packets++; net->stats.tx_bytes += priv->tx_len - 1; can_led_event(net, CAN_LED_EVENT_TX); @@ -750,6 +748,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) } netif_wake_queue(net); } + + if (intf == 0) + break; } mutex_unlock(&priv->hi3110_lock); return IRQ_HANDLED; -- 2.17.0

7 years, 7 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror