Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

+777 -637
+9 -2
MAINTAINERS
··· 2633 2633 F: Documentation/devicetree/bindings/sound/axentia,* 2634 2634 F: sound/soc/atmel/tse850-pcm5142.c 2635 2635 2636 + AXXIA I2C CONTROLLER 2637 + M: Krzysztof Adamski <krzysztof.adamski@nokia.com> 2638 + L: linux-i2c@vger.kernel.org 2639 + S: Maintained 2640 + F: Documentation/devicetree/bindings/i2c/i2c-axxia.txt 2641 + F: drivers/i2c/busses/i2c-axxia.c 2642 + 2636 2643 AZ6007 DVB DRIVER 2637 2644 M: Mauro Carvalho Chehab <mchehab@kernel.org> 2638 2645 L: linux-media@vger.kernel.org ··· 4057 4050 F: drivers/media/dvb-frontends/cxd2820r* 4058 4051 4059 4052 CXGB3 ETHERNET DRIVER (CXGB3) 4060 - M: Santosh Raspatur <santosh@chelsio.com> 4053 + M: Arjun Vynipadath <arjun@chelsio.com> 4061 4054 L: netdev@vger.kernel.org 4062 4055 W: http://www.chelsio.com 4063 4056 S: Supported ··· 4086 4079 F: drivers/crypto/chelsio 4087 4080 4088 4081 CXGB4 ETHERNET DRIVER (CXGB4) 4089 - M: Ganesh Goudar <ganeshgr@chelsio.com> 4082 + M: Arjun Vynipadath <arjun@chelsio.com> 4090 4083 L: netdev@vger.kernel.org 4091 4084 W: http://www.chelsio.com 4092 4085 S: Supported
+2 -7
Makefile
··· 1076 1076 # version.h and scripts_basic is processed / created. 1077 1077 1078 1078 # Listed in dependency order 1079 - PHONY += prepare archprepare macroprepare prepare0 prepare1 prepare2 prepare3 1079 + PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3 1080 1080 1081 1081 # prepare3 is used to check if we are building in a separate output directory, 1082 1082 # and if so do: ··· 1099 1099 prepare1: prepare2 $(version_h) $(autoksyms_h) include/generated/utsrelease.h 1100 1100 $(cmd_crmodverdir) 1101 1101 1102 - macroprepare: prepare1 archmacros 1103 - 1104 - archprepare: archheaders archscripts macroprepare scripts_basic 1102 + archprepare: archheaders archscripts prepare1 scripts_basic 1105 1103 1106 1104 prepare0: archprepare gcc-plugins 1107 1105 $(Q)$(MAKE) $(build)=. ··· 1174 1176 1175 1177 PHONY += archscripts 1176 1178 archscripts: 1177 - 1178 - PHONY += archmacros 1179 - archmacros: 1180 1179 1181 1180 PHONY += __headers 1182 1181 __headers: $(version_h) scripts_basic uapi-asm-generic archheaders archscripts
+6 -7
arch/sparc/kernel/setup_32.c
··· 310 310 311 311 register_console(&prom_early_console); 312 312 313 - printk("ARCH: "); 314 313 switch(sparc_cpu_model) { 315 314 case sun4m: 316 - printk("SUN4M\n"); 315 + pr_info("ARCH: SUN4M\n"); 317 316 break; 318 317 case sun4d: 319 - printk("SUN4D\n"); 318 + pr_info("ARCH: SUN4D\n"); 320 319 break; 321 320 case sun4e: 322 - printk("SUN4E\n"); 321 + pr_info("ARCH: SUN4E\n"); 323 322 break; 324 323 case sun4u: 325 - printk("SUN4U\n"); 324 + pr_info("ARCH: SUN4U\n"); 326 325 break; 327 326 case sparc_leon: 328 - printk("LEON\n"); 327 + pr_info("ARCH: LEON\n"); 329 328 break; 330 329 default: 331 - printk("UNKNOWN!\n"); 330 + pr_info("ARCH: UNKNOWN!\n"); 332 331 break; 333 332 } 334 333
+2 -2
arch/sparc/kernel/setup_64.c
··· 642 642 register_console(&prom_early_console); 643 643 644 644 if (tlb_type == hypervisor) 645 - printk("ARCH: SUN4V\n"); 645 + pr_info("ARCH: SUN4V\n"); 646 646 else 647 - printk("ARCH: SUN4U\n"); 647 + pr_info("ARCH: SUN4U\n"); 648 648 649 649 #ifdef CONFIG_DUMMY_CONSOLE 650 650 conswitchp = &dummy_con;
+1 -1
arch/sparc/vdso/Makefile
··· 34 34 CPPFLAGS_vdso.lds += -P -C 35 35 36 36 VDSO_LDFLAGS_vdso.lds = -m elf64_sparc -soname linux-vdso.so.1 --no-undefined \ 37 - -z max-page-size=8192 -z common-page-size=8192 37 + -z max-page-size=8192 38 38 39 39 $(obj)/vdso64.so.dbg: $(obj)/vdso.lds $(vobjs) FORCE 40 40 $(call if_changed,vdso)
-7
arch/x86/Makefile
··· 232 232 archheaders: 233 233 $(Q)$(MAKE) $(build)=arch/x86/entry/syscalls all 234 234 235 - archmacros: 236 - $(Q)$(MAKE) $(build)=arch/x86/kernel arch/x86/kernel/macros.s 237 - 238 - ASM_MACRO_FLAGS = -Wa,arch/x86/kernel/macros.s 239 - export ASM_MACRO_FLAGS 240 - KBUILD_CFLAGS += $(ASM_MACRO_FLAGS) 241 - 242 235 ### 243 236 # Kernel objects 244 237
+1 -1
arch/x86/entry/calling.h
··· 352 352 .macro CALL_enter_from_user_mode 353 353 #ifdef CONFIG_CONTEXT_TRACKING 354 354 #ifdef HAVE_JUMP_LABEL 355 - STATIC_BRANCH_JMP l_yes=.Lafter_call_\@, key=context_tracking_enabled, branch=1 355 + STATIC_JUMP_IF_FALSE .Lafter_call_\@, context_tracking_enabled, def=0 356 356 #endif 357 357 call enter_from_user_mode 358 358 .Lafter_call_\@:
+2 -1
arch/x86/entry/vdso/Makefile
··· 171 171 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' 172 172 173 173 VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \ 174 - $(call ld-option, --build-id) -Bsymbolic 174 + $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \ 175 + -Bsymbolic 175 176 GCOV_PROFILE := n 176 177 177 178 #
+6 -14
arch/x86/include/asm/alternative-asm.h
··· 7 7 #include <asm/asm.h> 8 8 9 9 #ifdef CONFIG_SMP 10 - .macro LOCK_PREFIX_HERE 10 + .macro LOCK_PREFIX 11 + 672: lock 11 12 .pushsection .smp_locks,"a" 12 13 .balign 4 13 - .long 671f - . # offset 14 + .long 672b - . 14 15 .popsection 15 - 671: 16 - .endm 17 - 18 - .macro LOCK_PREFIX insn:vararg 19 - LOCK_PREFIX_HERE 20 - lock \insn 21 - .endm 16 + .endm 22 17 #else 23 - .macro LOCK_PREFIX_HERE 24 - .endm 25 - 26 - .macro LOCK_PREFIX insn:vararg 27 - .endm 18 + .macro LOCK_PREFIX 19 + .endm 28 20 #endif 29 21 30 22 /*
+9 -2
arch/x86/include/asm/alternative.h
··· 31 31 */ 32 32 33 33 #ifdef CONFIG_SMP 34 - #define LOCK_PREFIX_HERE "LOCK_PREFIX_HERE\n\t" 35 - #define LOCK_PREFIX "LOCK_PREFIX " 34 + #define LOCK_PREFIX_HERE \ 35 + ".pushsection .smp_locks,\"a\"\n" \ 36 + ".balign 4\n" \ 37 + ".long 671f - .\n" /* offset */ \ 38 + ".popsection\n" \ 39 + "671:" 40 + 41 + #define LOCK_PREFIX LOCK_PREFIX_HERE "\n\tlock; " 42 + 36 43 #else /* ! CONFIG_SMP */ 37 44 #define LOCK_PREFIX_HERE "" 38 45 #define LOCK_PREFIX ""
+33 -20
arch/x86/include/asm/asm.h
··· 120 120 /* Exception table entry */ 121 121 #ifdef __ASSEMBLY__ 122 122 # define _ASM_EXTABLE_HANDLE(from, to, handler) \ 123 - ASM_EXTABLE_HANDLE from to handler 124 - 125 - .macro ASM_EXTABLE_HANDLE from:req to:req handler:req 126 - .pushsection "__ex_table","a" 127 - .balign 4 128 - .long (\from) - . 129 - .long (\to) - . 130 - .long (\handler) - . 123 + .pushsection "__ex_table","a" ; \ 124 + .balign 4 ; \ 125 + .long (from) - . ; \ 126 + .long (to) - . ; \ 127 + .long (handler) - . ; \ 131 128 .popsection 132 - .endm 133 - #else /* __ASSEMBLY__ */ 134 - 135 - # define _ASM_EXTABLE_HANDLE(from, to, handler) \ 136 - "ASM_EXTABLE_HANDLE from=" #from " to=" #to \ 137 - " handler=\"" #handler "\"\n\t" 138 - 139 - /* For C file, we already have NOKPROBE_SYMBOL macro */ 140 - 141 - #endif /* __ASSEMBLY__ */ 142 129 143 130 # define _ASM_EXTABLE(from, to) \ 144 131 _ASM_EXTABLE_HANDLE(from, to, ex_handler_default) ··· 148 161 _ASM_PTR (entry); \ 149 162 .popsection 150 163 151 - #ifdef __ASSEMBLY__ 152 164 .macro ALIGN_DESTINATION 153 165 /* check for bad alignment of destination */ 154 166 movl %edi,%ecx ··· 171 185 _ASM_EXTABLE_UA(100b, 103b) 172 186 _ASM_EXTABLE_UA(101b, 103b) 173 187 .endm 174 - #endif /* __ASSEMBLY__ */ 188 + 189 + #else 190 + # define _EXPAND_EXTABLE_HANDLE(x) #x 191 + # define _ASM_EXTABLE_HANDLE(from, to, handler) \ 192 + " .pushsection \"__ex_table\",\"a\"\n" \ 193 + " .balign 4\n" \ 194 + " .long (" #from ") - .\n" \ 195 + " .long (" #to ") - .\n" \ 196 + " .long (" _EXPAND_EXTABLE_HANDLE(handler) ") - .\n" \ 197 + " .popsection\n" 198 + 199 + # define _ASM_EXTABLE(from, to) \ 200 + _ASM_EXTABLE_HANDLE(from, to, ex_handler_default) 201 + 202 + # define _ASM_EXTABLE_UA(from, to) \ 203 + _ASM_EXTABLE_HANDLE(from, to, ex_handler_uaccess) 204 + 205 + # define _ASM_EXTABLE_FAULT(from, to) \ 206 + _ASM_EXTABLE_HANDLE(from, to, ex_handler_fault) 207 + 208 + # define _ASM_EXTABLE_EX(from, to) \ 209 + _ASM_EXTABLE_HANDLE(from, to, ex_handler_ext) 210 + 211 + # define _ASM_EXTABLE_REFCOUNT(from, to) \ 212 + _ASM_EXTABLE_HANDLE(from, to, ex_handler_refcount) 213 + 214 + /* For C file, we already have NOKPROBE_SYMBOL macro */ 215 + #endif 175 216 176 217 #ifndef __ASSEMBLY__ 177 218 /*
+42 -56
arch/x86/include/asm/bug.h
··· 4 4 5 5 #include <linux/stringify.h> 6 6 7 - #ifndef __ASSEMBLY__ 8 - 9 7 /* 10 8 * Despite that some emulators terminate on UD2, we use it for WARN(). 11 9 * ··· 20 22 21 23 #define LEN_UD2 2 22 24 25 + #ifdef CONFIG_GENERIC_BUG 26 + 27 + #ifdef CONFIG_X86_32 28 + # define __BUG_REL(val) ".long " __stringify(val) 29 + #else 30 + # define __BUG_REL(val) ".long " __stringify(val) " - 2b" 31 + #endif 32 + 33 + #ifdef CONFIG_DEBUG_BUGVERBOSE 34 + 23 35 #define _BUG_FLAGS(ins, flags) \ 24 36 do { \ 25 - asm volatile("ASM_BUG ins=\"" ins "\" file=%c0 line=%c1 " \ 26 - "flags=%c2 size=%c3" \ 27 - : : "i" (__FILE__), "i" (__LINE__), \ 28 - "i" (flags), \ 37 + asm volatile("1:\t" ins "\n" \ 38 + ".pushsection __bug_table,\"aw\"\n" \ 39 + "2:\t" __BUG_REL(1b) "\t# bug_entry::bug_addr\n" \ 40 + "\t" __BUG_REL(%c0) "\t# bug_entry::file\n" \ 41 + "\t.word %c1" "\t# bug_entry::line\n" \ 42 + "\t.word %c2" "\t# bug_entry::flags\n" \ 43 + "\t.org 2b+%c3\n" \ 44 + ".popsection" \ 45 + : : "i" (__FILE__), "i" (__LINE__), \ 46 + "i" (flags), \ 29 47 "i" (sizeof(struct bug_entry))); \ 30 48 } while (0) 49 + 50 + #else /* !CONFIG_DEBUG_BUGVERBOSE */ 51 + 52 + #define _BUG_FLAGS(ins, flags) \ 53 + do { \ 54 + asm volatile("1:\t" ins "\n" \ 55 + ".pushsection __bug_table,\"aw\"\n" \ 56 + "2:\t" __BUG_REL(1b) "\t# bug_entry::bug_addr\n" \ 57 + "\t.word %c0" "\t# bug_entry::flags\n" \ 58 + "\t.org 2b+%c1\n" \ 59 + ".popsection" \ 60 + : : "i" (flags), \ 61 + "i" (sizeof(struct bug_entry))); \ 62 + } while (0) 63 + 64 + #endif /* CONFIG_DEBUG_BUGVERBOSE */ 65 + 66 + #else 67 + 68 + #define _BUG_FLAGS(ins, flags) asm volatile(ins) 69 + 70 + #endif /* CONFIG_GENERIC_BUG */ 31 71 32 72 #define HAVE_ARCH_BUG 33 73 #define BUG() \ ··· 81 45 } while (0) 82 46 83 47 #include <asm-generic/bug.h> 84 - 85 - #else /* __ASSEMBLY__ */ 86 - 87 - #ifdef CONFIG_GENERIC_BUG 88 - 89 - #ifdef CONFIG_X86_32 90 - .macro __BUG_REL val:req 91 - .long \val 92 - .endm 93 - #else 94 - .macro __BUG_REL val:req 95 - .long \val - 2b 96 - .endm 97 - #endif 98 - 99 - #ifdef CONFIG_DEBUG_BUGVERBOSE 100 - 101 - .macro ASM_BUG ins:req file:req line:req flags:req size:req 102 - 1: \ins 103 - .pushsection __bug_table,"aw" 104 - 2: __BUG_REL val=1b # bug_entry::bug_addr 105 - __BUG_REL val=\file # bug_entry::file 106 - .word \line # bug_entry::line 107 - .word \flags # bug_entry::flags 108 - .org 2b+\size 109 - .popsection 110 - .endm 111 - 112 - #else /* !CONFIG_DEBUG_BUGVERBOSE */ 113 - 114 - .macro ASM_BUG ins:req file:req line:req flags:req size:req 115 - 1: \ins 116 - .pushsection __bug_table,"aw" 117 - 2: __BUG_REL val=1b # bug_entry::bug_addr 118 - .word \flags # bug_entry::flags 119 - .org 2b+\size 120 - .popsection 121 - .endm 122 - 123 - #endif /* CONFIG_DEBUG_BUGVERBOSE */ 124 - 125 - #else /* CONFIG_GENERIC_BUG */ 126 - 127 - .macro ASM_BUG ins:req file:req line:req flags:req size:req 128 - \ins 129 - .endm 130 - 131 - #endif /* CONFIG_GENERIC_BUG */ 132 - 133 - #endif /* __ASSEMBLY__ */ 134 48 135 49 #endif /* _ASM_X86_BUG_H */
+35 -47
arch/x86/include/asm/cpufeature.h
··· 2 2 #ifndef _ASM_X86_CPUFEATURE_H 3 3 #define _ASM_X86_CPUFEATURE_H 4 4 5 - #ifdef __KERNEL__ 6 - #ifndef __ASSEMBLY__ 7 - 8 5 #include <asm/processor.h> 6 + 7 + #if defined(__KERNEL__) && !defined(__ASSEMBLY__) 8 + 9 9 #include <asm/asm.h> 10 10 #include <linux/bitops.h> 11 11 ··· 161 161 */ 162 162 static __always_inline __pure bool _static_cpu_has(u16 bit) 163 163 { 164 - asm_volatile_goto("STATIC_CPU_HAS bitnum=%[bitnum] " 165 - "cap_byte=\"%[cap_byte]\" " 166 - "feature=%P[feature] t_yes=%l[t_yes] " 167 - "t_no=%l[t_no] always=%P[always]" 164 + asm_volatile_goto("1: jmp 6f\n" 165 + "2:\n" 166 + ".skip -(((5f-4f) - (2b-1b)) > 0) * " 167 + "((5f-4f) - (2b-1b)),0x90\n" 168 + "3:\n" 169 + ".section .altinstructions,\"a\"\n" 170 + " .long 1b - .\n" /* src offset */ 171 + " .long 4f - .\n" /* repl offset */ 172 + " .word %P[always]\n" /* always replace */ 173 + " .byte 3b - 1b\n" /* src len */ 174 + " .byte 5f - 4f\n" /* repl len */ 175 + " .byte 3b - 2b\n" /* pad len */ 176 + ".previous\n" 177 + ".section .altinstr_replacement,\"ax\"\n" 178 + "4: jmp %l[t_no]\n" 179 + "5:\n" 180 + ".previous\n" 181 + ".section .altinstructions,\"a\"\n" 182 + " .long 1b - .\n" /* src offset */ 183 + " .long 0\n" /* no replacement */ 184 + " .word %P[feature]\n" /* feature bit */ 185 + " .byte 3b - 1b\n" /* src len */ 186 + " .byte 0\n" /* repl len */ 187 + " .byte 0\n" /* pad len */ 188 + ".previous\n" 189 + ".section .altinstr_aux,\"ax\"\n" 190 + "6:\n" 191 + " testb %[bitnum],%[cap_byte]\n" 192 + " jnz %l[t_yes]\n" 193 + " jmp %l[t_no]\n" 194 + ".previous\n" 168 195 : : [feature] "i" (bit), 169 196 [always] "i" (X86_FEATURE_ALWAYS), 170 197 [bitnum] "i" (1 << (bit & 7)), ··· 226 199 #define CPU_FEATURE_TYPEVAL boot_cpu_data.x86_vendor, boot_cpu_data.x86, \ 227 200 boot_cpu_data.x86_model 228 201 229 - #else /* __ASSEMBLY__ */ 230 - 231 - .macro STATIC_CPU_HAS bitnum:req cap_byte:req feature:req t_yes:req t_no:req always:req 232 - 1: 233 - jmp 6f 234 - 2: 235 - .skip -(((5f-4f) - (2b-1b)) > 0) * ((5f-4f) - (2b-1b)),0x90 236 - 3: 237 - .section .altinstructions,"a" 238 - .long 1b - . /* src offset */ 239 - .long 4f - . /* repl offset */ 240 - .word \always /* always replace */ 241 - .byte 3b - 1b /* src len */ 242 - .byte 5f - 4f /* repl len */ 243 - .byte 3b - 2b /* pad len */ 244 - .previous 245 - .section .altinstr_replacement,"ax" 246 - 4: 247 - jmp \t_no 248 - 5: 249 - .previous 250 - .section .altinstructions,"a" 251 - .long 1b - . /* src offset */ 252 - .long 0 /* no replacement */ 253 - .word \feature /* feature bit */ 254 - .byte 3b - 1b /* src len */ 255 - .byte 0 /* repl len */ 256 - .byte 0 /* pad len */ 257 - .previous 258 - .section .altinstr_aux,"ax" 259 - 6: 260 - testb \bitnum,\cap_byte 261 - jnz \t_yes 262 - jmp \t_no 263 - .previous 264 - .endm 265 - 266 - #endif /* __ASSEMBLY__ */ 267 - 268 - #endif /* __KERNEL__ */ 202 + #endif /* defined(__KERNEL__) && !defined(__ASSEMBLY__) */ 269 203 #endif /* _ASM_X86_CPUFEATURE_H */
+11 -4
arch/x86/include/asm/fsgsbase.h
··· 16 16 */ 17 17 extern unsigned long x86_fsbase_read_task(struct task_struct *task); 18 18 extern unsigned long x86_gsbase_read_task(struct task_struct *task); 19 - extern int x86_fsbase_write_task(struct task_struct *task, unsigned long fsbase); 20 - extern int x86_gsbase_write_task(struct task_struct *task, unsigned long gsbase); 19 + extern void x86_fsbase_write_task(struct task_struct *task, unsigned long fsbase); 20 + extern void x86_gsbase_write_task(struct task_struct *task, unsigned long gsbase); 21 21 22 22 /* Helper functions for reading/writing FS/GS base */ 23 23 ··· 39 39 return gsbase; 40 40 } 41 41 42 - extern void x86_fsbase_write_cpu(unsigned long fsbase); 43 - extern void x86_gsbase_write_cpu_inactive(unsigned long gsbase); 42 + static inline void x86_fsbase_write_cpu(unsigned long fsbase) 43 + { 44 + wrmsrl(MSR_FS_BASE, fsbase); 45 + } 46 + 47 + static inline void x86_gsbase_write_cpu_inactive(unsigned long gsbase) 48 + { 49 + wrmsrl(MSR_KERNEL_GS_BASE, gsbase); 50 + } 44 51 45 52 #endif /* CONFIG_X86_64 */ 46 53
+54 -18
arch/x86/include/asm/jump_label.h
··· 2 2 #ifndef _ASM_X86_JUMP_LABEL_H 3 3 #define _ASM_X86_JUMP_LABEL_H 4 4 5 + #ifndef HAVE_JUMP_LABEL 6 + /* 7 + * For better or for worse, if jump labels (the gcc extension) are missing, 8 + * then the entire static branch patching infrastructure is compiled out. 9 + * If that happens, the code in here will malfunction. Raise a compiler 10 + * error instead. 11 + * 12 + * In theory, jump labels and the static branch patching infrastructure 13 + * could be decoupled to fix this. 14 + */ 15 + #error asm/jump_label.h included on a non-jump-label kernel 16 + #endif 17 + 5 18 #define JUMP_LABEL_NOP_SIZE 5 6 19 7 20 #ifdef CONFIG_X86_64 ··· 33 20 34 21 static __always_inline bool arch_static_branch(struct static_key *key, bool branch) 35 22 { 36 - asm_volatile_goto("STATIC_BRANCH_NOP l_yes=\"%l[l_yes]\" key=\"%c0\" " 37 - "branch=\"%c1\"" 38 - : : "i" (key), "i" (branch) : : l_yes); 23 + asm_volatile_goto("1:" 24 + ".byte " __stringify(STATIC_KEY_INIT_NOP) "\n\t" 25 + ".pushsection __jump_table, \"aw\" \n\t" 26 + _ASM_ALIGN "\n\t" 27 + ".long 1b - ., %l[l_yes] - . \n\t" 28 + _ASM_PTR "%c0 + %c1 - .\n\t" 29 + ".popsection \n\t" 30 + : : "i" (key), "i" (branch) : : l_yes); 31 + 39 32 return false; 40 33 l_yes: 41 34 return true; ··· 49 30 50 31 static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) 51 32 { 52 - asm_volatile_goto("STATIC_BRANCH_JMP l_yes=\"%l[l_yes]\" key=\"%c0\" " 53 - "branch=\"%c1\"" 33 + asm_volatile_goto("1:" 34 + ".byte 0xe9\n\t .long %l[l_yes] - 2f\n\t" 35 + "2:\n\t" 36 + ".pushsection __jump_table, \"aw\" \n\t" 37 + _ASM_ALIGN "\n\t" 38 + ".long 1b - ., %l[l_yes] - . \n\t" 39 + _ASM_PTR "%c0 + %c1 - .\n\t" 40 + ".popsection \n\t" 54 41 : : "i" (key), "i" (branch) : : l_yes); 55 42 56 43 return false; ··· 66 41 67 42 #else /* __ASSEMBLY__ */ 68 43 69 - .macro STATIC_BRANCH_NOP l_yes:req key:req branch:req 70 - .Lstatic_branch_nop_\@: 71 - .byte STATIC_KEY_INIT_NOP 72 - .Lstatic_branch_no_after_\@: 44 + .macro STATIC_JUMP_IF_TRUE target, key, def 45 + .Lstatic_jump_\@: 46 + .if \def 47 + /* Equivalent to "jmp.d32 \target" */ 48 + .byte 0xe9 49 + .long \target - .Lstatic_jump_after_\@ 50 + .Lstatic_jump_after_\@: 51 + .else 52 + .byte STATIC_KEY_INIT_NOP 53 + .endif 73 54 .pushsection __jump_table, "aw" 74 55 _ASM_ALIGN 75 - .long .Lstatic_branch_nop_\@ - ., \l_yes - . 76 - _ASM_PTR \key + \branch - . 56 + .long .Lstatic_jump_\@ - ., \target - . 57 + _ASM_PTR \key - . 77 58 .popsection 78 59 .endm 79 60 80 - .macro STATIC_BRANCH_JMP l_yes:req key:req branch:req 81 - .Lstatic_branch_jmp_\@: 82 - .byte 0xe9 83 - .long \l_yes - .Lstatic_branch_jmp_after_\@ 84 - .Lstatic_branch_jmp_after_\@: 61 + .macro STATIC_JUMP_IF_FALSE target, key, def 62 + .Lstatic_jump_\@: 63 + .if \def 64 + .byte STATIC_KEY_INIT_NOP 65 + .else 66 + /* Equivalent to "jmp.d32 \target" */ 67 + .byte 0xe9 68 + .long \target - .Lstatic_jump_after_\@ 69 + .Lstatic_jump_after_\@: 70 + .endif 85 71 .pushsection __jump_table, "aw" 86 72 _ASM_ALIGN 87 - .long .Lstatic_branch_jmp_\@ - ., \l_yes - . 88 - _ASM_PTR \key + \branch - . 73 + .long .Lstatic_jump_\@ - ., \target - . 74 + _ASM_PTR \key + 1 - . 89 75 .popsection 90 76 .endm 91 77
+29 -27
arch/x86/include/asm/paravirt_types.h
··· 348 348 #define paravirt_clobber(clobber) \ 349 349 [paravirt_clobber] "i" (clobber) 350 350 351 + /* 352 + * Generate some code, and mark it as patchable by the 353 + * apply_paravirt() alternate instruction patcher. 354 + */ 355 + #define _paravirt_alt(insn_string, type, clobber) \ 356 + "771:\n\t" insn_string "\n" "772:\n" \ 357 + ".pushsection .parainstructions,\"a\"\n" \ 358 + _ASM_ALIGN "\n" \ 359 + _ASM_PTR " 771b\n" \ 360 + " .byte " type "\n" \ 361 + " .byte 772b-771b\n" \ 362 + " .short " clobber "\n" \ 363 + ".popsection\n" 364 + 351 365 /* Generate patchable code, with the default asm parameters. */ 352 - #define paravirt_call \ 353 - "PARAVIRT_CALL type=\"%c[paravirt_typenum]\"" \ 354 - " clobber=\"%c[paravirt_clobber]\"" \ 355 - " pv_opptr=\"%c[paravirt_opptr]\";" 366 + #define paravirt_alt(insn_string) \ 367 + _paravirt_alt(insn_string, "%c[paravirt_typenum]", "%c[paravirt_clobber]") 356 368 357 369 /* Simple instruction patching code. */ 358 370 #define NATIVE_LABEL(a,x,b) "\n\t.globl " a #x "_" #b "\n" a #x "_" #b ":\n\t" ··· 383 371 unsigned native_patch(u8 type, void *ibuf, unsigned long addr, unsigned len); 384 372 385 373 int paravirt_disable_iospace(void); 374 + 375 + /* 376 + * This generates an indirect call based on the operation type number. 377 + * The type number, computed in PARAVIRT_PATCH, is derived from the 378 + * offset into the paravirt_patch_template structure, and can therefore be 379 + * freely converted back into a structure offset. 380 + */ 381 + #define PARAVIRT_CALL \ 382 + ANNOTATE_RETPOLINE_SAFE \ 383 + "call *%c[paravirt_opptr];" 386 384 387 385 /* 388 386 * These macros are intended to wrap calls through one of the paravirt ··· 531 509 /* since this condition will never hold */ \ 532 510 if (sizeof(rettype) > sizeof(unsigned long)) { \ 533 511 asm volatile(pre \ 534 - paravirt_call \ 512 + paravirt_alt(PARAVIRT_CALL) \ 535 513 post \ 536 514 : call_clbr, ASM_CALL_CONSTRAINT \ 537 515 : paravirt_type(op), \ ··· 541 519 __ret = (rettype)((((u64)__edx) << 32) | __eax); \ 542 520 } else { \ 543 521 asm volatile(pre \ 544 - paravirt_call \ 522 + paravirt_alt(PARAVIRT_CALL) \ 545 523 post \ 546 524 : call_clbr, ASM_CALL_CONSTRAINT \ 547 525 : paravirt_type(op), \ ··· 568 546 PVOP_VCALL_ARGS; \ 569 547 PVOP_TEST_NULL(op); \ 570 548 asm volatile(pre \ 571 - paravirt_call \ 549 + paravirt_alt(PARAVIRT_CALL) \ 572 550 post \ 573 551 : call_clbr, ASM_CALL_CONSTRAINT \ 574 552 : paravirt_type(op), \ ··· 685 663 686 664 extern struct paravirt_patch_site __parainstructions[], 687 665 __parainstructions_end[]; 688 - 689 - #else /* __ASSEMBLY__ */ 690 - 691 - /* 692 - * This generates an indirect call based on the operation type number. 693 - * The type number, computed in PARAVIRT_PATCH, is derived from the 694 - * offset into the paravirt_patch_template structure, and can therefore be 695 - * freely converted back into a structure offset. 696 - */ 697 - .macro PARAVIRT_CALL type:req clobber:req pv_opptr:req 698 - 771: ANNOTATE_RETPOLINE_SAFE 699 - call *\pv_opptr 700 - 772: .pushsection .parainstructions,"a" 701 - _ASM_ALIGN 702 - _ASM_PTR 771b 703 - .byte \type 704 - .byte 772b-771b 705 - .short \clobber 706 - .popsection 707 - .endm 708 666 709 667 #endif /* __ASSEMBLY__ */ 710 668
+5
arch/x86/include/asm/pgtable_64_types.h
··· 111 111 */ 112 112 #define MAXMEM (1UL << MAX_PHYSMEM_BITS) 113 113 114 + #define GUARD_HOLE_PGD_ENTRY -256UL 115 + #define GUARD_HOLE_SIZE (16UL << PGDIR_SHIFT) 116 + #define GUARD_HOLE_BASE_ADDR (GUARD_HOLE_PGD_ENTRY << PGDIR_SHIFT) 117 + #define GUARD_HOLE_END_ADDR (GUARD_HOLE_BASE_ADDR + GUARD_HOLE_SIZE) 118 + 114 119 #define LDT_PGD_ENTRY -240UL 115 120 #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT) 116 121 #define LDT_END_ADDR (LDT_BASE_ADDR + PGDIR_SIZE)
+33 -48
arch/x86/include/asm/refcount.h
··· 4 4 * x86-specific implementation of refcount_t. Based on PAX_REFCOUNT from 5 5 * PaX/grsecurity. 6 6 */ 7 - 8 - #ifdef __ASSEMBLY__ 9 - 10 - #include <asm/asm.h> 11 - #include <asm/bug.h> 12 - 13 - .macro REFCOUNT_EXCEPTION counter:req 14 - .pushsection .text..refcount 15 - 111: lea \counter, %_ASM_CX 16 - 112: ud2 17 - ASM_UNREACHABLE 18 - .popsection 19 - 113: _ASM_EXTABLE_REFCOUNT(112b, 113b) 20 - .endm 21 - 22 - /* Trigger refcount exception if refcount result is negative. */ 23 - .macro REFCOUNT_CHECK_LT_ZERO counter:req 24 - js 111f 25 - REFCOUNT_EXCEPTION counter="\counter" 26 - .endm 27 - 28 - /* Trigger refcount exception if refcount result is zero or negative. */ 29 - .macro REFCOUNT_CHECK_LE_ZERO counter:req 30 - jz 111f 31 - REFCOUNT_CHECK_LT_ZERO counter="\counter" 32 - .endm 33 - 34 - /* Trigger refcount exception unconditionally. */ 35 - .macro REFCOUNT_ERROR counter:req 36 - jmp 111f 37 - REFCOUNT_EXCEPTION counter="\counter" 38 - .endm 39 - 40 - #else /* __ASSEMBLY__ */ 41 - 42 7 #include <linux/refcount.h> 43 8 #include <asm/bug.h> 44 9 ··· 15 50 * central refcount exception. The fixup address for the exception points 16 51 * back to the regular execution flow in .text. 17 52 */ 53 + #define _REFCOUNT_EXCEPTION \ 54 + ".pushsection .text..refcount\n" \ 55 + "111:\tlea %[var], %%" _ASM_CX "\n" \ 56 + "112:\t" ASM_UD2 "\n" \ 57 + ASM_UNREACHABLE \ 58 + ".popsection\n" \ 59 + "113:\n" \ 60 + _ASM_EXTABLE_REFCOUNT(112b, 113b) 61 + 62 + /* Trigger refcount exception if refcount result is negative. */ 63 + #define REFCOUNT_CHECK_LT_ZERO \ 64 + "js 111f\n\t" \ 65 + _REFCOUNT_EXCEPTION 66 + 67 + /* Trigger refcount exception if refcount result is zero or negative. */ 68 + #define REFCOUNT_CHECK_LE_ZERO \ 69 + "jz 111f\n\t" \ 70 + REFCOUNT_CHECK_LT_ZERO 71 + 72 + /* Trigger refcount exception unconditionally. */ 73 + #define REFCOUNT_ERROR \ 74 + "jmp 111f\n\t" \ 75 + _REFCOUNT_EXCEPTION 18 76 19 77 static __always_inline void refcount_add(unsigned int i, refcount_t *r) 20 78 { 21 79 asm volatile(LOCK_PREFIX "addl %1,%0\n\t" 22 - "REFCOUNT_CHECK_LT_ZERO counter=\"%[counter]\"" 23 - : [counter] "+m" (r->refs.counter) 80 + REFCOUNT_CHECK_LT_ZERO 81 + : [var] "+m" (r->refs.counter) 24 82 : "ir" (i) 25 83 : "cc", "cx"); 26 84 } ··· 51 63 static __always_inline void refcount_inc(refcount_t *r) 52 64 { 53 65 asm volatile(LOCK_PREFIX "incl %0\n\t" 54 - "REFCOUNT_CHECK_LT_ZERO counter=\"%[counter]\"" 55 - : [counter] "+m" (r->refs.counter) 66 + REFCOUNT_CHECK_LT_ZERO 67 + : [var] "+m" (r->refs.counter) 56 68 : : "cc", "cx"); 57 69 } 58 70 59 71 static __always_inline void refcount_dec(refcount_t *r) 60 72 { 61 73 asm volatile(LOCK_PREFIX "decl %0\n\t" 62 - "REFCOUNT_CHECK_LE_ZERO counter=\"%[counter]\"" 63 - : [counter] "+m" (r->refs.counter) 74 + REFCOUNT_CHECK_LE_ZERO 75 + : [var] "+m" (r->refs.counter) 64 76 : : "cc", "cx"); 65 77 } 66 78 67 79 static __always_inline __must_check 68 80 bool refcount_sub_and_test(unsigned int i, refcount_t *r) 69 81 { 70 - 71 82 return GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", 72 - "REFCOUNT_CHECK_LT_ZERO counter=\"%[var]\"", 83 + REFCOUNT_CHECK_LT_ZERO, 73 84 r->refs.counter, e, "er", i, "cx"); 74 85 } 75 86 76 87 static __always_inline __must_check bool refcount_dec_and_test(refcount_t *r) 77 88 { 78 89 return GEN_UNARY_SUFFIXED_RMWcc(LOCK_PREFIX "decl", 79 - "REFCOUNT_CHECK_LT_ZERO counter=\"%[var]\"", 90 + REFCOUNT_CHECK_LT_ZERO, 80 91 r->refs.counter, e, "cx"); 81 92 } 82 93 ··· 93 106 94 107 /* Did we try to increment from/to an undesirable state? */ 95 108 if (unlikely(c < 0 || c == INT_MAX || result < c)) { 96 - asm volatile("REFCOUNT_ERROR counter=\"%[counter]\"" 97 - : : [counter] "m" (r->refs.counter) 109 + asm volatile(REFCOUNT_ERROR 110 + : : [var] "m" (r->refs.counter) 98 111 : "cc", "cx"); 99 112 break; 100 113 } ··· 108 121 { 109 122 return refcount_add_not_zero(1, r); 110 123 } 111 - 112 - #endif /* __ASSEMBLY__ */ 113 124 114 125 #endif
+4
arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
··· 23 23 24 24 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 25 25 26 + #include <linux/cpu.h> 26 27 #include <linux/kernfs.h> 27 28 #include <linux/seq_file.h> 28 29 #include <linux/slab.h> ··· 311 310 return -EINVAL; 312 311 buf[nbytes - 1] = '\0'; 313 312 313 + cpus_read_lock(); 314 314 rdtgrp = rdtgroup_kn_lock_live(of->kn); 315 315 if (!rdtgrp) { 316 316 rdtgroup_kn_unlock(of->kn); 317 + cpus_read_unlock(); 317 318 return -ENOENT; 318 319 } 319 320 rdt_last_cmd_clear(); ··· 370 367 371 368 out: 372 369 rdtgroup_kn_unlock(of->kn); 370 + cpus_read_unlock(); 373 371 return ret ?: nbytes; 374 372 } 375 373
+2
arch/x86/kernel/cpu/mtrr/if.c
··· 165 165 struct mtrr_gentry gentry; 166 166 void __user *arg = (void __user *) __arg; 167 167 168 + memset(&gentry, 0, sizeof(gentry)); 169 + 168 170 switch (cmd) { 169 171 case MTRRIOC_ADD_ENTRY: 170 172 case MTRRIOC_SET_ENTRY:
-16
arch/x86/kernel/macros.S
··· 1 - /* SPDX-License-Identifier: GPL-2.0 */ 2 - 3 - /* 4 - * This file includes headers whose assembly part includes macros which are 5 - * commonly used. The macros are precompiled into assmebly file which is later 6 - * assembled together with each compiled file. 7 - */ 8 - 9 - #include <linux/compiler.h> 10 - #include <asm/refcount.h> 11 - #include <asm/alternative-asm.h> 12 - #include <asm/bug.h> 13 - #include <asm/paravirt.h> 14 - #include <asm/asm.h> 15 - #include <asm/cpufeature.h> 16 - #include <asm/jump_label.h>
+55 -44
arch/x86/kernel/process_64.c
··· 339 339 return base; 340 340 } 341 341 342 - void x86_fsbase_write_cpu(unsigned long fsbase) 343 - { 344 - /* 345 - * Set the selector to 0 as a notion, that the segment base is 346 - * overwritten, which will be checked for skipping the segment load 347 - * during context switch. 348 - */ 349 - loadseg(FS, 0); 350 - wrmsrl(MSR_FS_BASE, fsbase); 351 - } 352 - 353 - void x86_gsbase_write_cpu_inactive(unsigned long gsbase) 354 - { 355 - /* Set the selector to 0 for the same reason as %fs above. */ 356 - loadseg(GS, 0); 357 - wrmsrl(MSR_KERNEL_GS_BASE, gsbase); 358 - } 359 - 360 342 unsigned long x86_fsbase_read_task(struct task_struct *task) 361 343 { 362 344 unsigned long fsbase; ··· 367 385 return gsbase; 368 386 } 369 387 370 - int x86_fsbase_write_task(struct task_struct *task, unsigned long fsbase) 388 + void x86_fsbase_write_task(struct task_struct *task, unsigned long fsbase) 371 389 { 372 - /* 373 - * Not strictly needed for %fs, but do it for symmetry 374 - * with %gs 375 - */ 376 - if (unlikely(fsbase >= TASK_SIZE_MAX)) 377 - return -EPERM; 390 + WARN_ON_ONCE(task == current); 378 391 379 - preempt_disable(); 380 392 task->thread.fsbase = fsbase; 381 - if (task == current) 382 - x86_fsbase_write_cpu(fsbase); 383 - task->thread.fsindex = 0; 384 - preempt_enable(); 385 - 386 - return 0; 387 393 } 388 394 389 - int x86_gsbase_write_task(struct task_struct *task, unsigned long gsbase) 395 + void x86_gsbase_write_task(struct task_struct *task, unsigned long gsbase) 390 396 { 391 - if (unlikely(gsbase >= TASK_SIZE_MAX)) 392 - return -EPERM; 397 + WARN_ON_ONCE(task == current); 393 398 394 - preempt_disable(); 395 399 task->thread.gsbase = gsbase; 396 - if (task == current) 397 - x86_gsbase_write_cpu_inactive(gsbase); 398 - task->thread.gsindex = 0; 399 - preempt_enable(); 400 - 401 - return 0; 402 400 } 403 401 404 402 int copy_thread_tls(unsigned long clone_flags, unsigned long sp, ··· 716 754 717 755 switch (option) { 718 756 case ARCH_SET_GS: { 719 - ret = x86_gsbase_write_task(task, arg2); 757 + if (unlikely(arg2 >= TASK_SIZE_MAX)) 758 + return -EPERM; 759 + 760 + preempt_disable(); 761 + /* 762 + * ARCH_SET_GS has always overwritten the index 763 + * and the base. Zero is the most sensible value 764 + * to put in the index, and is the only value that 765 + * makes any sense if FSGSBASE is unavailable. 766 + */ 767 + if (task == current) { 768 + loadseg(GS, 0); 769 + x86_gsbase_write_cpu_inactive(arg2); 770 + 771 + /* 772 + * On non-FSGSBASE systems, save_base_legacy() expects 773 + * that we also fill in thread.gsbase. 774 + */ 775 + task->thread.gsbase = arg2; 776 + 777 + } else { 778 + task->thread.gsindex = 0; 779 + x86_gsbase_write_task(task, arg2); 780 + } 781 + preempt_enable(); 720 782 break; 721 783 } 722 784 case ARCH_SET_FS: { 723 - ret = x86_fsbase_write_task(task, arg2); 785 + /* 786 + * Not strictly needed for %fs, but do it for symmetry 787 + * with %gs 788 + */ 789 + if (unlikely(arg2 >= TASK_SIZE_MAX)) 790 + return -EPERM; 791 + 792 + preempt_disable(); 793 + /* 794 + * Set the selector to 0 for the same reason 795 + * as %gs above. 796 + */ 797 + if (task == current) { 798 + loadseg(FS, 0); 799 + x86_fsbase_write_cpu(arg2); 800 + 801 + /* 802 + * On non-FSGSBASE systems, save_base_legacy() expects 803 + * that we also fill in thread.fsbase. 804 + */ 805 + task->thread.fsbase = arg2; 806 + } else { 807 + task->thread.fsindex = 0; 808 + x86_fsbase_write_task(task, arg2); 809 + } 810 + preempt_enable(); 724 811 break; 725 812 } 726 813 case ARCH_GET_FS: {
+5 -4
arch/x86/kernel/ptrace.c
··· 397 397 if (value >= TASK_SIZE_MAX) 398 398 return -EIO; 399 399 /* 400 - * When changing the FS base, use the same 401 - * mechanism as for do_arch_prctl_64(). 400 + * When changing the FS base, use do_arch_prctl_64() 401 + * to set the index to zero and to set the base 402 + * as requested. 402 403 */ 403 404 if (child->thread.fsbase != value) 404 - return x86_fsbase_write_task(child, value); 405 + return do_arch_prctl_64(child, ARCH_SET_FS, value); 405 406 return 0; 406 407 case offsetof(struct user_regs_struct,gs_base): 407 408 /* ··· 411 410 if (value >= TASK_SIZE_MAX) 412 411 return -EIO; 413 412 if (child->thread.gsbase != value) 414 - return x86_gsbase_write_task(child, value); 413 + return do_arch_prctl_64(child, ARCH_SET_GS, value); 415 414 return 0; 416 415 #endif 417 416 }
+3 -1
arch/x86/kvm/svm.c
··· 2937 2937 static void nested_svm_init_mmu_context(struct kvm_vcpu *vcpu) 2938 2938 { 2939 2939 WARN_ON(mmu_is_nested(vcpu)); 2940 + 2941 + vcpu->arch.mmu = &vcpu->arch.guest_mmu; 2940 2942 kvm_init_shadow_mmu(vcpu); 2941 2943 vcpu->arch.mmu->set_cr3 = nested_svm_set_tdp_cr3; 2942 2944 vcpu->arch.mmu->get_cr3 = nested_svm_get_tdp_cr3; ··· 2951 2949 2952 2950 static void nested_svm_uninit_mmu_context(struct kvm_vcpu *vcpu) 2953 2951 { 2952 + vcpu->arch.mmu = &vcpu->arch.root_mmu; 2954 2953 vcpu->arch.walk_mmu = &vcpu->arch.root_mmu; 2955 2954 } 2956 2955 ··· 3461 3458 svm->vcpu.arch.hflags &= ~HF_HIF_MASK; 3462 3459 3463 3460 if (nested_vmcb->control.nested_ctl & SVM_NESTED_CTL_NP_ENABLE) { 3464 - kvm_mmu_unload(&svm->vcpu); 3465 3461 svm->nested.nested_cr3 = nested_vmcb->control.nested_cr3; 3466 3462 nested_svm_init_mmu_context(&svm->vcpu); 3467 3463 }
+6 -9
arch/x86/mm/dump_pagetables.c
··· 55 55 enum address_markers_idx { 56 56 USER_SPACE_NR = 0, 57 57 KERNEL_SPACE_NR, 58 - LOW_KERNEL_NR, 59 - #if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL) 58 + #ifdef CONFIG_MODIFY_LDT_SYSCALL 60 59 LDT_NR, 61 60 #endif 61 + LOW_KERNEL_NR, 62 62 VMALLOC_START_NR, 63 63 VMEMMAP_START_NR, 64 64 #ifdef CONFIG_KASAN ··· 66 66 KASAN_SHADOW_END_NR, 67 67 #endif 68 68 CPU_ENTRY_AREA_NR, 69 - #if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL) 70 - LDT_NR, 71 - #endif 72 69 #ifdef CONFIG_X86_ESPFIX64 73 70 ESPFIX_START_NR, 74 71 #endif ··· 509 512 { 510 513 #ifdef CONFIG_X86_64 511 514 /* 512 - * ffff800000000000 - ffff87ffffffffff is reserved for 513 - * the hypervisor. 515 + * A hole in the beginning of kernel address space reserved 516 + * for a hypervisor. 514 517 */ 515 - return (idx >= pgd_index(__PAGE_OFFSET) - 16) && 516 - (idx < pgd_index(__PAGE_OFFSET)); 518 + return (idx >= pgd_index(GUARD_HOLE_BASE_ADDR)) && 519 + (idx < pgd_index(GUARD_HOLE_END_ADDR)); 517 520 #else 518 521 return false; 519 522 #endif
+16 -8
arch/x86/mm/pageattr.c
··· 285 285 on_each_cpu(__cpa_flush_all, (void *) cache, 1); 286 286 } 287 287 288 - static bool __cpa_flush_range(unsigned long start, int numpages, int cache) 288 + static bool __inv_flush_all(int cache) 289 289 { 290 290 BUG_ON(irqs_disabled() && !early_boot_irqs_disabled); 291 - 292 - WARN_ON(PAGE_ALIGN(start) != start); 293 291 294 292 if (cache && !static_cpu_has(X86_FEATURE_CLFLUSH)) { 295 293 cpa_flush_all(cache); 296 294 return true; 297 295 } 298 296 299 - flush_tlb_kernel_range(start, start + PAGE_SIZE * numpages); 300 - 301 - return !cache; 297 + return false; 302 298 } 303 299 304 300 static void cpa_flush_range(unsigned long start, int numpages, int cache) ··· 302 306 unsigned int i, level; 303 307 unsigned long addr; 304 308 305 - if (__cpa_flush_range(start, numpages, cache)) 309 + WARN_ON(PAGE_ALIGN(start) != start); 310 + 311 + if (__inv_flush_all(cache)) 312 + return; 313 + 314 + flush_tlb_kernel_range(start, start + PAGE_SIZE * numpages); 315 + 316 + if (!cache) 306 317 return; 307 318 308 319 /* ··· 335 332 { 336 333 unsigned int i, level; 337 334 338 - if (__cpa_flush_range(baddr, numpages, cache)) 335 + if (__inv_flush_all(cache)) 336 + return; 337 + 338 + flush_tlb_all(); 339 + 340 + if (!cache) 339 341 return; 340 342 341 343 /*
+11 -2
arch/x86/mm/pat.c
··· 519 519 * for a "decoy" virtual address (bit 63 clear) passed to 520 520 * set_memory_X(). __pa() on a "decoy" address results in a 521 521 * physical address with bit 63 set. 522 + * 523 + * Decoy addresses are not present for 32-bit builds, see 524 + * set_mce_nospec(). 522 525 */ 523 - return address & __PHYSICAL_MASK; 526 + if (IS_ENABLED(CONFIG_X86_64)) 527 + return address & __PHYSICAL_MASK; 528 + return address; 524 529 } 525 530 526 531 /* ··· 551 546 552 547 start = sanitize_phys(start); 553 548 end = sanitize_phys(end); 554 - BUG_ON(start >= end); /* end is exclusive */ 549 + if (start >= end) { 550 + WARN(1, "%s failed: [mem %#010Lx-%#010Lx], req %s\n", __func__, 551 + start, end - 1, cattr_name(req_type)); 552 + return -EINVAL; 553 + } 555 554 556 555 if (!pat_enabled()) { 557 556 /* This is identical to page table setting without PAT */
+6 -5
arch/x86/xen/mmu_pv.c
··· 648 648 unsigned long limit) 649 649 { 650 650 int i, nr, flush = 0; 651 - unsigned hole_low, hole_high; 651 + unsigned hole_low = 0, hole_high = 0; 652 652 653 653 /* The limit is the last byte to be touched */ 654 654 limit--; 655 655 BUG_ON(limit >= FIXADDR_TOP); 656 656 657 + #ifdef CONFIG_X86_64 657 658 /* 658 659 * 64-bit has a great big hole in the middle of the address 659 - * space, which contains the Xen mappings. On 32-bit these 660 - * will end up making a zero-sized hole and so is a no-op. 660 + * space, which contains the Xen mappings. 661 661 */ 662 - hole_low = pgd_index(USER_LIMIT); 663 - hole_high = pgd_index(PAGE_OFFSET); 662 + hole_low = pgd_index(GUARD_HOLE_BASE_ADDR); 663 + hole_high = pgd_index(GUARD_HOLE_END_ADDR); 664 + #endif 664 665 665 666 nr = pgd_index(limit) + 1; 666 667 for (i = 0; i < nr; i++) {
+3 -9
drivers/gpio/gpio-max7301.c
··· 25 25 struct spi_device *spi = to_spi_device(dev); 26 26 u16 word = ((reg & 0x7F) << 8) | (val & 0xFF); 27 27 28 - return spi_write(spi, (const u8 *)&word, sizeof(word)); 28 + return spi_write_then_read(spi, &word, sizeof(word), NULL, 0); 29 29 } 30 30 31 31 /* A read from the MAX7301 means two transfers; here, one message each */ ··· 37 37 struct spi_device *spi = to_spi_device(dev); 38 38 39 39 word = 0x8000 | (reg << 8); 40 - ret = spi_write(spi, (const u8 *)&word, sizeof(word)); 41 - if (ret) 42 - return ret; 43 - /* 44 - * This relies on the fact, that a transfer with NULL tx_buf shifts out 45 - * zero bytes (=NOOP for MAX7301) 46 - */ 47 - ret = spi_read(spi, (u8 *)&word, sizeof(word)); 40 + ret = spi_write_then_read(spi, &word, sizeof(word), &word, 41 + sizeof(word)); 48 42 if (ret) 49 43 return ret; 50 44 return word & 0xff;
+3 -3
drivers/gpio/gpio-mvebu.c
··· 773 773 "marvell,armada-370-gpio")) 774 774 return 0; 775 775 776 - if (IS_ERR(mvchip->clk)) 777 - return PTR_ERR(mvchip->clk); 778 - 779 776 /* 780 777 * There are only two sets of PWM configuration registers for 781 778 * all the GPIO lines on those SoCs which this driver reserves ··· 782 785 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pwm"); 783 786 if (!res) 784 787 return 0; 788 + 789 + if (IS_ERR(mvchip->clk)) 790 + return PTR_ERR(mvchip->clk); 785 791 786 792 /* 787 793 * Use set A for lines of GPIO chip with id 0, B for GPIO chip
+5 -59
drivers/gpio/gpio-omap.c
··· 32 32 #define OMAP4_GPIO_DEBOUNCINGTIME_MASK 0xFF 33 33 34 34 #define OMAP_GPIO_QUIRK_IDLE_REMOVE_TRIGGER BIT(2) 35 - #define OMAP_GPIO_QUIRK_DEFERRED_WKUP_EN BIT(1) 36 35 37 36 struct gpio_regs { 38 37 u32 irqenable1; ··· 378 379 readl_relaxed(bank->base + bank->regs->fallingdetect); 379 380 380 381 if (likely(!(bank->non_wakeup_gpios & gpio_bit))) { 381 - /* Defer wkup_en register update until we idle? */ 382 - if (bank->quirks & OMAP_GPIO_QUIRK_DEFERRED_WKUP_EN) { 383 - if (trigger) 384 - bank->context.wake_en |= gpio_bit; 385 - else 386 - bank->context.wake_en &= ~gpio_bit; 387 - } else { 388 - omap_gpio_rmw(base, bank->regs->wkup_en, gpio_bit, 389 - trigger != 0); 390 - bank->context.wake_en = 391 - readl_relaxed(bank->base + bank->regs->wkup_en); 392 - } 382 + omap_gpio_rmw(base, bank->regs->wkup_en, gpio_bit, trigger != 0); 383 + bank->context.wake_en = 384 + readl_relaxed(bank->base + bank->regs->wkup_en); 393 385 } 394 386 395 387 /* This part needs to be executed always for OMAP{34xx, 44xx} */ ··· 932 942 bank->base + bank->regs->risingdetect); 933 943 } 934 944 935 - /* 936 - * On omap4 and later SoC variants a level interrupt with wkup_en 937 - * enabled blocks the GPIO functional clock from idling until the GPIO 938 - * instance has been reset. To avoid that, we must set wkup_en only for 939 - * idle for level interrupts, and clear level registers for the duration 940 - * of idle. The level interrupts will be still there on wakeup by their 941 - * nature. 942 - */ 943 - static void __maybe_unused 944 - omap4_gpio_enable_level_quirk(struct gpio_bank *bank) 945 - { 946 - /* Update wake register for idle, edge bits might be already set */ 947 - writel_relaxed(bank->context.wake_en, 948 - bank->base + bank->regs->wkup_en); 949 - 950 - /* Clear level registers for idle */ 951 - writel_relaxed(0, bank->base + bank->regs->leveldetect0); 952 - writel_relaxed(0, bank->base + bank->regs->leveldetect1); 953 - } 954 - 955 - static void __maybe_unused 956 - omap4_gpio_disable_level_quirk(struct gpio_bank *bank) 957 - { 958 - /* Restore level registers after idle */ 959 - writel_relaxed(bank->context.leveldetect0, 960 - bank->base + bank->regs->leveldetect0); 961 - writel_relaxed(bank->context.leveldetect1, 962 - bank->base + bank->regs->leveldetect1); 963 - 964 - /* Clear saved wkup_en for level, it will be set for next idle again */ 965 - bank->context.wake_en &= ~(bank->context.leveldetect0 | 966 - bank->context.leveldetect1); 967 - 968 - /* Update wake with only edge configuration */ 969 - writel_relaxed(bank->context.wake_en, 970 - bank->base + bank->regs->wkup_en); 971 - } 972 - 973 945 /*---------------------------------------------------------------------*/ 974 946 975 947 static int omap_mpuio_suspend_noirq(struct device *dev) ··· 1364 1412 omap_set_gpio_dataout_mask_multiple; 1365 1413 } 1366 1414 1367 - if (bank->quirks & OMAP_GPIO_QUIRK_DEFERRED_WKUP_EN) { 1368 - bank->funcs.idle_enable_level_quirk = 1369 - omap4_gpio_enable_level_quirk; 1370 - bank->funcs.idle_disable_level_quirk = 1371 - omap4_gpio_disable_level_quirk; 1372 - } else if (bank->quirks & OMAP_GPIO_QUIRK_IDLE_REMOVE_TRIGGER) { 1415 + if (bank->quirks & OMAP_GPIO_QUIRK_IDLE_REMOVE_TRIGGER) { 1373 1416 bank->funcs.idle_enable_level_quirk = 1374 1417 omap2_gpio_enable_level_quirk; 1375 1418 bank->funcs.idle_disable_level_quirk = ··· 1753 1806 .regs = &omap4_gpio_regs, 1754 1807 .bank_width = 32, 1755 1808 .dbck_flag = true, 1756 - .quirks = OMAP_GPIO_QUIRK_IDLE_REMOVE_TRIGGER | 1757 - OMAP_GPIO_QUIRK_DEFERRED_WKUP_EN, 1809 + .quirks = OMAP_GPIO_QUIRK_IDLE_REMOVE_TRIGGER, 1758 1810 }; 1759 1811 1760 1812 static const struct of_device_id omap_gpio_match[] = {
+94 -70
drivers/gpio/gpiolib-acpi.c
··· 19 19 20 20 #include "gpiolib.h" 21 21 22 + /** 23 + * struct acpi_gpio_event - ACPI GPIO event handler data 24 + * 25 + * @node: list-entry of the events list of the struct acpi_gpio_chip 26 + * @handle: handle of ACPI method to execute when the IRQ triggers 27 + * @handler: irq_handler to pass to request_irq when requesting the IRQ 28 + * @pin: GPIO pin number on the gpio_chip 29 + * @irq: Linux IRQ number for the event, for request_ / free_irq 30 + * @irqflags: flags to pass to request_irq when requesting the IRQ 31 + * @irq_is_wake: If the ACPI flags indicate the IRQ is a wakeup source 32 + * @is_requested: True if request_irq has been done 33 + * @desc: gpio_desc for the GPIO pin for this event 34 + */ 22 35 struct acpi_gpio_event { 23 36 struct list_head node; 24 37 acpi_handle handle; 38 + irq_handler_t handler; 25 39 unsigned int pin; 26 40 unsigned int irq; 41 + unsigned long irqflags; 42 + bool irq_is_wake; 43 + bool irq_requested; 27 44 struct gpio_desc *desc; 28 45 }; 29 46 ··· 66 49 67 50 /* 68 51 * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init 69 - * (so builtin drivers) we register the ACPI GpioInt event handlers from a 52 + * (so builtin drivers) we register the ACPI GpioInt IRQ handlers from a 70 53 * late_initcall_sync handler, so that other builtin drivers can register their 71 54 * OpRegions before the event handlers can run. This list contains gpiochips 72 - * for which the acpi_gpiochip_request_interrupts() has been deferred. 55 + * for which the acpi_gpiochip_request_irqs() call has been deferred. 73 56 */ 74 57 static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock); 75 58 static LIST_HEAD(acpi_gpio_deferred_req_irqs_list); ··· 150 133 } 151 134 EXPORT_SYMBOL_GPL(acpi_gpio_get_irq_resource); 152 135 153 - static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, 154 - void *context) 136 + static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio, 137 + struct acpi_gpio_event *event) 138 + { 139 + int ret, value; 140 + 141 + ret = request_threaded_irq(event->irq, NULL, event->handler, 142 + event->irqflags, "ACPI:Event", event); 143 + if (ret) { 144 + dev_err(acpi_gpio->chip->parent, 145 + "Failed to setup interrupt handler for %d\n", 146 + event->irq); 147 + return; 148 + } 149 + 150 + if (event->irq_is_wake) 151 + enable_irq_wake(event->irq); 152 + 153 + event->irq_requested = true; 154 + 155 + /* Make sure we trigger the initial state of edge-triggered IRQs */ 156 + value = gpiod_get_raw_value_cansleep(event->desc); 157 + if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) || 158 + ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0)) 159 + event->handler(event->irq, event); 160 + } 161 + 162 + static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio) 163 + { 164 + struct acpi_gpio_event *event; 165 + 166 + list_for_each_entry(event, &acpi_gpio->events, node) 167 + acpi_gpiochip_request_irq(acpi_gpio, event); 168 + } 169 + 170 + static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, 171 + void *context) 155 172 { 156 173 struct acpi_gpio_chip *acpi_gpio = context; 157 174 struct gpio_chip *chip = acpi_gpio->chip; ··· 194 143 struct acpi_gpio_event *event; 195 144 irq_handler_t handler = NULL; 196 145 struct gpio_desc *desc; 197 - unsigned long irqflags; 198 - int ret, pin, irq, value; 146 + int ret, pin, irq; 199 147 200 148 if (!acpi_gpio_get_irq_resource(ares, &agpio)) 201 149 return AE_OK; ··· 225 175 226 176 gpiod_direction_input(desc); 227 177 228 - value = gpiod_get_value_cansleep(desc); 229 - 230 178 ret = gpiochip_lock_as_irq(chip, pin); 231 179 if (ret) { 232 180 dev_err(chip->parent, "Failed to lock GPIO as interrupt\n"); ··· 237 189 goto fail_unlock_irq; 238 190 } 239 191 240 - irqflags = IRQF_ONESHOT; 241 - if (agpio->triggering == ACPI_LEVEL_SENSITIVE) { 242 - if (agpio->polarity == ACPI_ACTIVE_HIGH) 243 - irqflags |= IRQF_TRIGGER_HIGH; 244 - else 245 - irqflags |= IRQF_TRIGGER_LOW; 246 - } else { 247 - switch (agpio->polarity) { 248 - case ACPI_ACTIVE_HIGH: 249 - irqflags |= IRQF_TRIGGER_RISING; 250 - break; 251 - case ACPI_ACTIVE_LOW: 252 - irqflags |= IRQF_TRIGGER_FALLING; 253 - break; 254 - default: 255 - irqflags |= IRQF_TRIGGER_RISING | 256 - IRQF_TRIGGER_FALLING; 257 - break; 258 - } 259 - } 260 - 261 192 event = kzalloc(sizeof(*event), GFP_KERNEL); 262 193 if (!event) 263 194 goto fail_unlock_irq; 264 195 196 + event->irqflags = IRQF_ONESHOT; 197 + if (agpio->triggering == ACPI_LEVEL_SENSITIVE) { 198 + if (agpio->polarity == ACPI_ACTIVE_HIGH) 199 + event->irqflags |= IRQF_TRIGGER_HIGH; 200 + else 201 + event->irqflags |= IRQF_TRIGGER_LOW; 202 + } else { 203 + switch (agpio->polarity) { 204 + case ACPI_ACTIVE_HIGH: 205 + event->irqflags |= IRQF_TRIGGER_RISING; 206 + break; 207 + case ACPI_ACTIVE_LOW: 208 + event->irqflags |= IRQF_TRIGGER_FALLING; 209 + break; 210 + default: 211 + event->irqflags |= IRQF_TRIGGER_RISING | 212 + IRQF_TRIGGER_FALLING; 213 + break; 214 + } 215 + } 216 + 265 217 event->handle = evt_handle; 218 + event->handler = handler; 266 219 event->irq = irq; 220 + event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; 267 221 event->pin = pin; 268 222 event->desc = desc; 269 223 270 - ret = request_threaded_irq(event->irq, NULL, handler, irqflags, 271 - "ACPI:Event", event); 272 - if (ret) { 273 - dev_err(chip->parent, 274 - "Failed to setup interrupt handler for %d\n", 275 - event->irq); 276 - goto fail_free_event; 277 - } 278 - 279 - if (agpio->wake_capable == ACPI_WAKE_CAPABLE) 280 - enable_irq_wake(irq); 281 - 282 224 list_add_tail(&event->node, &acpi_gpio->events); 283 - 284 - /* 285 - * Make sure we trigger the initial state of the IRQ when using RISING 286 - * or FALLING. Note we run the handlers on late_init, the AML code 287 - * may refer to OperationRegions from other (builtin) drivers which 288 - * may be probed after us. 289 - */ 290 - if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) || 291 - ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)) 292 - handler(event->irq, event); 293 225 294 226 return AE_OK; 295 227 296 - fail_free_event: 297 - kfree(event); 298 228 fail_unlock_irq: 299 229 gpiochip_unlock_as_irq(chip, pin); 300 230 fail_free_desc: ··· 309 283 if (ACPI_FAILURE(status)) 310 284 return; 311 285 286 + acpi_walk_resources(handle, "_AEI", 287 + acpi_gpiochip_alloc_event, acpi_gpio); 288 + 312 289 mutex_lock(&acpi_gpio_deferred_req_irqs_lock); 313 290 defer = !acpi_gpio_deferred_req_irqs_done; 314 291 if (defer) ··· 322 293 if (defer) 323 294 return; 324 295 325 - acpi_walk_resources(handle, "_AEI", 326 - acpi_gpiochip_request_interrupt, acpi_gpio); 296 + acpi_gpiochip_request_irqs(acpi_gpio); 327 297 } 328 298 EXPORT_SYMBOL_GPL(acpi_gpiochip_request_interrupts); 329 299 ··· 359 331 list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) { 360 332 struct gpio_desc *desc; 361 333 362 - if (irqd_is_wakeup_set(irq_get_irq_data(event->irq))) 363 - disable_irq_wake(event->irq); 334 + if (event->irq_requested) { 335 + if (event->irq_is_wake) 336 + disable_irq_wake(event->irq); 364 337 365 - free_irq(event->irq, event); 338 + free_irq(event->irq, event); 339 + } 340 + 366 341 desc = event->desc; 367 342 if (WARN_ON(IS_ERR(desc))) 368 343 continue; ··· 1231 1200 return con_id == NULL; 1232 1201 } 1233 1202 1234 - /* Run deferred acpi_gpiochip_request_interrupts() */ 1235 - static int acpi_gpio_handle_deferred_request_interrupts(void) 1203 + /* Run deferred acpi_gpiochip_request_irqs() */ 1204 + static int acpi_gpio_handle_deferred_request_irqs(void) 1236 1205 { 1237 1206 struct acpi_gpio_chip *acpi_gpio, *tmp; 1238 1207 1239 1208 mutex_lock(&acpi_gpio_deferred_req_irqs_lock); 1240 1209 list_for_each_entry_safe(acpi_gpio, tmp, 1241 1210 &acpi_gpio_deferred_req_irqs_list, 1242 - deferred_req_irqs_list_entry) { 1243 - acpi_handle handle; 1244 - 1245 - handle = ACPI_HANDLE(acpi_gpio->chip->parent); 1246 - acpi_walk_resources(handle, "_AEI", 1247 - acpi_gpiochip_request_interrupt, acpi_gpio); 1248 - 1249 - list_del_init(&acpi_gpio->deferred_req_irqs_list_entry); 1250 - } 1211 + deferred_req_irqs_list_entry) 1212 + acpi_gpiochip_request_irqs(acpi_gpio); 1251 1213 1252 1214 acpi_gpio_deferred_req_irqs_done = true; 1253 1215 mutex_unlock(&acpi_gpio_deferred_req_irqs_lock); ··· 1248 1224 return 0; 1249 1225 } 1250 1226 /* We must use _sync so that this runs after the first deferred_probe run */ 1251 - late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts); 1227 + late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+8 -2
drivers/gpu/drm/drm_ioctl.c
··· 37 37 38 38 #include <linux/pci.h> 39 39 #include <linux/export.h> 40 + #include <linux/nospec.h> 40 41 41 42 /** 42 43 * DOC: getunique and setversion story ··· 801 800 802 801 if (is_driver_ioctl) { 803 802 /* driver ioctl */ 804 - if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls) 803 + unsigned int index = nr - DRM_COMMAND_BASE; 804 + 805 + if (index >= dev->driver->num_ioctls) 805 806 goto err_i1; 806 - ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE]; 807 + index = array_index_nospec(index, dev->driver->num_ioctls); 808 + ioctl = &dev->driver->ioctls[index]; 807 809 } else { 808 810 /* core ioctl */ 809 811 if (nr >= DRM_CORE_IOCTL_COUNT) 810 812 goto err_i1; 813 + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT); 811 814 ioctl = &drm_ioctls[nr]; 812 815 } 813 816 ··· 893 888 894 889 if (nr >= DRM_CORE_IOCTL_COUNT) 895 890 return false; 891 + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT); 896 892 897 893 *flags = drm_ioctls[nr].flags; 898 894 return true;
+1 -1
drivers/i2c/busses/i2c-nvidia-gpu.c
··· 342 342 pci_free_irq_vectors(pdev); 343 343 } 344 344 345 - static int gpu_i2c_resume(struct device *dev) 345 + static __maybe_unused int gpu_i2c_resume(struct device *dev) 346 346 { 347 347 struct gpu_i2c_dev *i2cd = dev_get_drvdata(dev); 348 348
+4 -12
drivers/input/keyboard/omap4-keypad.c
··· 126 126 { 127 127 struct omap4_keypad *keypad_data = dev_id; 128 128 129 - if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) { 130 - /* Disable interrupts */ 131 - kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, 132 - OMAP4_VAL_IRQDISABLE); 129 + if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) 133 130 return IRQ_WAKE_THREAD; 134 - } 135 131 136 132 return IRQ_NONE; 137 133 } ··· 169 173 kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, 170 174 kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); 171 175 172 - /* enable interrupts */ 173 - kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, 174 - OMAP4_DEF_IRQENABLE_EVENTEN | 175 - OMAP4_DEF_IRQENABLE_LONGKEY); 176 - 177 176 return IRQ_HANDLED; 178 177 } 179 178 ··· 205 214 206 215 disable_irq(keypad_data->irq); 207 216 208 - /* Disable interrupts */ 217 + /* Disable interrupts and wake-up events */ 209 218 kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, 210 219 OMAP4_VAL_IRQDISABLE); 220 + kbd_writel(keypad_data, OMAP4_KBD_WAKEUPENABLE, 0); 211 221 212 222 /* clear pending interrupts */ 213 223 kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, ··· 357 365 } 358 366 359 367 error = request_threaded_irq(keypad_data->irq, omap4_keypad_irq_handler, 360 - omap4_keypad_irq_thread_fn, 0, 368 + omap4_keypad_irq_thread_fn, IRQF_ONESHOT, 361 369 "omap4-keypad", keypad_data); 362 370 if (error) { 363 371 dev_err(&pdev->dev, "failed to register interrupt\n");
+16 -2
drivers/input/mouse/elantech.c
··· 1767 1767 module_param_named(elantech_smbus, elantech_smbus, int, 0644); 1768 1768 MODULE_PARM_DESC(elantech_smbus, "Use a secondary bus for the Elantech device."); 1769 1769 1770 + static const char * const i2c_blacklist_pnp_ids[] = { 1771 + /* 1772 + * These are known to not be working properly as bits are missing 1773 + * in elan_i2c. 1774 + */ 1775 + "LEN2131", /* ThinkPad P52 w/ NFC */ 1776 + "LEN2132", /* ThinkPad P52 */ 1777 + "LEN2133", /* ThinkPad P72 w/ NFC */ 1778 + "LEN2134", /* ThinkPad P72 */ 1779 + NULL 1780 + }; 1781 + 1770 1782 static int elantech_create_smbus(struct psmouse *psmouse, 1771 1783 struct elantech_device_info *info, 1772 1784 bool leave_breadcrumbs) ··· 1814 1802 1815 1803 if (elantech_smbus == ELANTECH_SMBUS_NOT_SET) { 1816 1804 /* 1817 - * New ICs are enabled by default. 1805 + * New ICs are enabled by default, unless mentioned in 1806 + * i2c_blacklist_pnp_ids. 1818 1807 * Old ICs are up to the user to decide. 1819 1808 */ 1820 - if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version)) 1809 + if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) || 1810 + psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids)) 1821 1811 return -ENXIO; 1822 1812 } 1823 1813
+2
drivers/input/mouse/synaptics.c
··· 171 171 "LEN0046", /* X250 */ 172 172 "LEN004a", /* W541 */ 173 173 "LEN005b", /* P50 */ 174 + "LEN005e", /* T560 */ 174 175 "LEN0071", /* T480 */ 175 176 "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ 176 177 "LEN0073", /* X1 Carbon G5 (Elantech) */ ··· 179 178 "LEN0096", /* X280 */ 180 179 "LEN0097", /* X280 -> ALPS trackpoint */ 181 180 "LEN200f", /* T450s */ 181 + "SYN3052", /* HP EliteBook 840 G4 */ 182 182 "SYN3221", /* HP 15-ay000 */ 183 183 NULL 184 184 };
+1 -1
drivers/mtd/ubi/build.c
··· 1101 1101 ubi_wl_close(ubi); 1102 1102 ubi_free_internal_volumes(ubi); 1103 1103 vfree(ubi->vtbl); 1104 - put_mtd_device(ubi->mtd); 1105 1104 vfree(ubi->peb_buf); 1106 1105 vfree(ubi->fm_buf); 1107 1106 ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index); 1107 + put_mtd_device(ubi->mtd); 1108 1108 put_device(&ubi->dev); 1109 1109 return 0; 1110 1110 }
+1 -1
drivers/mtd/ubi/kapi.c
··· 227 227 out_free: 228 228 kfree(desc); 229 229 out_put_ubi: 230 - ubi_put_device(ubi); 231 230 ubi_err(ubi, "cannot open device %d, volume %d, error %d", 232 231 ubi_num, vol_id, err); 232 + ubi_put_device(ubi); 233 233 return ERR_PTR(err); 234 234 } 235 235 EXPORT_SYMBOL_GPL(ubi_open_volume);
+1 -1
drivers/net/ethernet/mscc/ocelot.c
··· 746 746 } 747 747 748 748 return ocelot_mact_learn(ocelot, port->chip_port, addr, vid, 749 - ENTRYTYPE_NORMAL); 749 + ENTRYTYPE_LOCKED); 750 750 } 751 751 752 752 static int ocelot_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
+2 -1
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
··· 1125 1125 return -EINVAL; 1126 1126 } 1127 1127 val = nx_get_bios_version(adapter); 1128 - netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios); 1128 + if (netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios)) 1129 + return -EIO; 1129 1130 if ((__force u32)val != bios) { 1130 1131 dev_err(&pdev->dev, "%s: firmware bios is incompatible\n", 1131 1132 fw_name[fw_type]);
+9 -7
drivers/net/usb/qmi_wwan.c
··· 151 151 152 152 static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) 153 153 { 154 - unsigned int len, offset = sizeof(struct qmimux_hdr); 154 + unsigned int len, offset = 0; 155 155 struct qmimux_hdr *hdr; 156 156 struct net_device *net; 157 157 struct sk_buff *skbn; 158 + u8 qmimux_hdr_sz = sizeof(*hdr); 158 159 159 - while (offset < skb->len) { 160 - hdr = (struct qmimux_hdr *)skb->data; 160 + while (offset + qmimux_hdr_sz < skb->len) { 161 + hdr = (struct qmimux_hdr *)(skb->data + offset); 161 162 len = be16_to_cpu(hdr->pkt_len); 162 163 163 164 /* drop the packet, bogus length */ 164 - if (offset + len > skb->len) 165 + if (offset + len + qmimux_hdr_sz > skb->len) 165 166 return 0; 166 167 167 168 /* control packet, we do not know what to do */ ··· 177 176 return 0; 178 177 skbn->dev = net; 179 178 180 - switch (skb->data[offset] & 0xf0) { 179 + switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) { 181 180 case 0x40: 182 181 skbn->protocol = htons(ETH_P_IP); 183 182 break; ··· 189 188 goto skip; 190 189 } 191 190 192 - skb_put_data(skbn, skb->data + offset, len); 191 + skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len); 193 192 if (netif_rx(skbn) != NET_RX_SUCCESS) 194 193 return 0; 195 194 196 195 skip: 197 - offset += len + sizeof(struct qmimux_hdr); 196 + offset += len + qmimux_hdr_sz; 198 197 } 199 198 return 1; 200 199 } ··· 1266 1265 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ 1267 1266 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ 1268 1267 {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ 1268 + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ 1269 1269 1270 1270 /* 4. Gobi 1000 devices */ 1271 1271 {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+26 -5
drivers/tty/serial/sunsu.c
··· 1394 1394 static enum su_type su_get_type(struct device_node *dp) 1395 1395 { 1396 1396 struct device_node *ap = of_find_node_by_path("/aliases"); 1397 + enum su_type rc = SU_PORT_PORT; 1397 1398 1398 1399 if (ap) { 1399 1400 const char *keyb = of_get_property(ap, "keyboard", NULL); 1400 1401 const char *ms = of_get_property(ap, "mouse", NULL); 1402 + struct device_node *match; 1401 1403 1402 1404 if (keyb) { 1403 - if (dp == of_find_node_by_path(keyb)) 1404 - return SU_PORT_KBD; 1405 + match = of_find_node_by_path(keyb); 1406 + 1407 + /* 1408 + * The pointer is used as an identifier not 1409 + * as a pointer, we can drop the refcount on 1410 + * the of__node immediately after getting it. 1411 + */ 1412 + of_node_put(match); 1413 + 1414 + if (dp == match) { 1415 + rc = SU_PORT_KBD; 1416 + goto out; 1417 + } 1405 1418 } 1406 1419 if (ms) { 1407 - if (dp == of_find_node_by_path(ms)) 1408 - return SU_PORT_MS; 1420 + match = of_find_node_by_path(ms); 1421 + 1422 + of_node_put(match); 1423 + 1424 + if (dp == match) { 1425 + rc = SU_PORT_MS; 1426 + goto out; 1427 + } 1409 1428 } 1410 1429 } 1411 1430 1412 - return SU_PORT_PORT; 1431 + out: 1432 + of_node_put(ap); 1433 + return rc; 1413 1434 } 1414 1435 1415 1436 static int su_probe(struct platform_device *op)
+8 -8
fs/cifs/smb2inode.c
··· 97 97 if (rc) 98 98 goto finished; 99 99 100 - smb2_set_next_command(server, &rqst[num_rqst++]); 100 + smb2_set_next_command(server, &rqst[num_rqst++], 0); 101 101 102 102 /* Operation */ 103 103 switch (command) { ··· 111 111 SMB2_O_INFO_FILE, 0, 112 112 sizeof(struct smb2_file_all_info) + 113 113 PATH_MAX * 2, 0, NULL); 114 - smb2_set_next_command(server, &rqst[num_rqst]); 114 + smb2_set_next_command(server, &rqst[num_rqst], 0); 115 115 smb2_set_related(&rqst[num_rqst++]); 116 116 break; 117 117 case SMB2_OP_DELETE: ··· 127 127 rqst[num_rqst].rq_iov = si_iov; 128 128 rqst[num_rqst].rq_nvec = 1; 129 129 130 - size[0] = 8; 130 + size[0] = 1; /* sizeof __u8 See MS-FSCC section 2.4.11 */ 131 131 data[0] = &delete_pending[0]; 132 132 133 133 rc = SMB2_set_info_init(tcon, &rqst[num_rqst], COMPOUND_FID, 134 134 COMPOUND_FID, current->tgid, 135 135 FILE_DISPOSITION_INFORMATION, 136 136 SMB2_O_INFO_FILE, 0, data, size); 137 - smb2_set_next_command(server, &rqst[num_rqst]); 137 + smb2_set_next_command(server, &rqst[num_rqst], 1); 138 138 smb2_set_related(&rqst[num_rqst++]); 139 139 break; 140 140 case SMB2_OP_SET_EOF: ··· 149 149 COMPOUND_FID, current->tgid, 150 150 FILE_END_OF_FILE_INFORMATION, 151 151 SMB2_O_INFO_FILE, 0, data, size); 152 - smb2_set_next_command(server, &rqst[num_rqst]); 152 + smb2_set_next_command(server, &rqst[num_rqst], 0); 153 153 smb2_set_related(&rqst[num_rqst++]); 154 154 break; 155 155 case SMB2_OP_SET_INFO: ··· 165 165 COMPOUND_FID, current->tgid, 166 166 FILE_BASIC_INFORMATION, 167 167 SMB2_O_INFO_FILE, 0, data, size); 168 - smb2_set_next_command(server, &rqst[num_rqst]); 168 + smb2_set_next_command(server, &rqst[num_rqst], 0); 169 169 smb2_set_related(&rqst[num_rqst++]); 170 170 break; 171 171 case SMB2_OP_RENAME: ··· 189 189 COMPOUND_FID, current->tgid, 190 190 FILE_RENAME_INFORMATION, 191 191 SMB2_O_INFO_FILE, 0, data, size); 192 - smb2_set_next_command(server, &rqst[num_rqst]); 192 + smb2_set_next_command(server, &rqst[num_rqst], 0); 193 193 smb2_set_related(&rqst[num_rqst++]); 194 194 break; 195 195 case SMB2_OP_HARDLINK: ··· 213 213 COMPOUND_FID, current->tgid, 214 214 FILE_LINK_INFORMATION, 215 215 SMB2_O_INFO_FILE, 0, data, size); 216 - smb2_set_next_command(server, &rqst[num_rqst]); 216 + smb2_set_next_command(server, &rqst[num_rqst], 0); 217 217 smb2_set_related(&rqst[num_rqst++]); 218 218 break; 219 219 default:
+15 -8
fs/cifs/smb2ops.c
··· 1194 1194 rc = SMB2_open_init(tcon, &rqst[0], &oplock, &oparms, path); 1195 1195 if (rc) 1196 1196 goto iqinf_exit; 1197 - smb2_set_next_command(ses->server, &rqst[0]); 1197 + smb2_set_next_command(ses->server, &rqst[0], 0); 1198 1198 1199 1199 /* Query */ 1200 1200 memset(&qi_iov, 0, sizeof(qi_iov)); ··· 1208 1208 qi.output_buffer_length, buffer); 1209 1209 if (rc) 1210 1210 goto iqinf_exit; 1211 - smb2_set_next_command(ses->server, &rqst[1]); 1211 + smb2_set_next_command(ses->server, &rqst[1], 0); 1212 1212 smb2_set_related(&rqst[1]); 1213 1213 1214 1214 /* Close */ ··· 1761 1761 char smb2_padding[7] = {0, 0, 0, 0, 0, 0, 0}; 1762 1762 1763 1763 void 1764 - smb2_set_next_command(struct TCP_Server_Info *server, struct smb_rqst *rqst) 1764 + smb2_set_next_command(struct TCP_Server_Info *server, struct smb_rqst *rqst, 1765 + bool has_space_for_padding) 1765 1766 { 1766 1767 struct smb2_sync_hdr *shdr; 1767 1768 unsigned long len = smb_rqst_len(server, rqst); 1768 1769 1769 1770 /* SMB headers in a compound are 8 byte aligned. */ 1770 1771 if (len & 7) { 1771 - rqst->rq_iov[rqst->rq_nvec].iov_base = smb2_padding; 1772 - rqst->rq_iov[rqst->rq_nvec].iov_len = 8 - (len & 7); 1773 - rqst->rq_nvec++; 1772 + if (has_space_for_padding) { 1773 + len = rqst->rq_iov[rqst->rq_nvec - 1].iov_len; 1774 + rqst->rq_iov[rqst->rq_nvec - 1].iov_len = 1775 + (len + 7) & ~7; 1776 + } else { 1777 + rqst->rq_iov[rqst->rq_nvec].iov_base = smb2_padding; 1778 + rqst->rq_iov[rqst->rq_nvec].iov_len = 8 - (len & 7); 1779 + rqst->rq_nvec++; 1780 + } 1774 1781 len = smb_rqst_len(server, rqst); 1775 1782 } 1776 1783 ··· 1827 1820 rc = SMB2_open_init(tcon, &rqst[0], &oplock, &oparms, &srch_path); 1828 1821 if (rc) 1829 1822 goto qfs_exit; 1830 - smb2_set_next_command(server, &rqst[0]); 1823 + smb2_set_next_command(server, &rqst[0], 0); 1831 1824 1832 1825 memset(&qi_iov, 0, sizeof(qi_iov)); 1833 1826 rqst[1].rq_iov = qi_iov; ··· 1840 1833 NULL); 1841 1834 if (rc) 1842 1835 goto qfs_exit; 1843 - smb2_set_next_command(server, &rqst[1]); 1836 + smb2_set_next_command(server, &rqst[1], 0); 1844 1837 smb2_set_related(&rqst[1]); 1845 1838 1846 1839 memset(&close_iov, 0, sizeof(close_iov));
+2 -1
fs/cifs/smb2proto.h
··· 117 117 extern unsigned long smb_rqst_len(struct TCP_Server_Info *server, 118 118 struct smb_rqst *rqst); 119 119 extern void smb2_set_next_command(struct TCP_Server_Info *server, 120 - struct smb_rqst *rqst); 120 + struct smb_rqst *rqst, 121 + bool has_space_for_padding); 121 122 extern void smb2_set_related(struct smb_rqst *rqst); 122 123 123 124 /*
+8 -8
fs/ubifs/Kconfig
··· 12 12 help 13 13 UBIFS is a file system for flash devices which works on top of UBI. 14 14 15 + if UBIFS_FS 16 + 15 17 config UBIFS_FS_ADVANCED_COMPR 16 18 bool "Advanced compression options" 17 - depends on UBIFS_FS 18 19 help 19 20 This option allows to explicitly choose which compressions, if any, 20 21 are enabled in UBIFS. Removing compressors means inability to read ··· 25 24 26 25 config UBIFS_FS_LZO 27 26 bool "LZO compression support" if UBIFS_FS_ADVANCED_COMPR 28 - depends on UBIFS_FS 29 27 default y 30 28 help 31 29 LZO compressor is generally faster than zlib but compresses worse. ··· 32 32 33 33 config UBIFS_FS_ZLIB 34 34 bool "ZLIB compression support" if UBIFS_FS_ADVANCED_COMPR 35 - depends on UBIFS_FS 36 35 default y 37 36 help 38 37 Zlib compresses better than LZO but it is slower. Say 'Y' if unsure. 39 38 40 39 config UBIFS_ATIME_SUPPORT 41 - bool "Access time support" if UBIFS_FS 42 - depends on UBIFS_FS 40 + bool "Access time support" 43 41 default n 44 42 help 45 43 Originally UBIFS did not support atime, because it looked like a bad idea due ··· 52 54 53 55 config UBIFS_FS_XATTR 54 56 bool "UBIFS XATTR support" 55 - depends on UBIFS_FS 56 57 default y 57 58 help 58 59 Saying Y here includes support for extended attributes (xattrs). ··· 62 65 63 66 config UBIFS_FS_ENCRYPTION 64 67 bool "UBIFS Encryption" 65 - depends on UBIFS_FS && UBIFS_FS_XATTR && BLOCK 68 + depends on UBIFS_FS_XATTR && BLOCK 66 69 select FS_ENCRYPTION 67 70 default n 68 71 help ··· 73 76 74 77 config UBIFS_FS_SECURITY 75 78 bool "UBIFS Security Labels" 76 - depends on UBIFS_FS && UBIFS_FS_XATTR 79 + depends on UBIFS_FS_XATTR 77 80 default y 78 81 help 79 82 Security labels provide an access control facility to support Linux ··· 86 89 87 90 config UBIFS_FS_AUTHENTICATION 88 91 bool "UBIFS authentication support" 92 + depends on KEYS 89 93 select CRYPTO_HMAC 90 94 help 91 95 Enable authentication support for UBIFS. This feature offers protection ··· 94 96 If you say yes here you should also select a hashing algorithm such as 95 97 sha256, these are not selected automatically since there are many 96 98 different options. 99 + 100 + endif # UBIFS_FS
+6 -6
fs/ubifs/lpt.c
··· 1675 1675 if (!ubifs_authenticated(c)) 1676 1676 return 0; 1677 1677 1678 + if (!c->nroot) { 1679 + err = ubifs_read_nnode(c, NULL, 0); 1680 + if (err) 1681 + return err; 1682 + } 1683 + 1678 1684 desc = ubifs_hash_get_desc(c); 1679 1685 if (IS_ERR(desc)) 1680 1686 return PTR_ERR(desc); ··· 1689 1683 if (!buf) { 1690 1684 err = -ENOMEM; 1691 1685 goto out; 1692 - } 1693 - 1694 - if (!c->nroot) { 1695 - err = ubifs_read_nnode(c, NULL, 0); 1696 - if (err) 1697 - return err; 1698 1686 } 1699 1687 1700 1688 cnode = (struct ubifs_cnode *)c->nroot;
+61 -11
fs/ubifs/replay.c
··· 213 213 } 214 214 215 215 /** 216 + * inode_still_linked - check whether inode in question will be re-linked. 217 + * @c: UBIFS file-system description object 218 + * @rino: replay entry to test 219 + * 220 + * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1. 221 + * This case needs special care, otherwise all references to the inode will 222 + * be removed upon the first replay entry of an inode with link count 0 223 + * is found. 224 + */ 225 + static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino) 226 + { 227 + struct replay_entry *r; 228 + 229 + ubifs_assert(c, rino->deletion); 230 + ubifs_assert(c, key_type(c, &rino->key) == UBIFS_INO_KEY); 231 + 232 + /* 233 + * Find the most recent entry for the inode behind @rino and check 234 + * whether it is a deletion. 235 + */ 236 + list_for_each_entry_reverse(r, &c->replay_list, list) { 237 + ubifs_assert(c, r->sqnum >= rino->sqnum); 238 + if (key_inum(c, &r->key) == key_inum(c, &rino->key)) 239 + return r->deletion == 0; 240 + 241 + } 242 + 243 + ubifs_assert(c, 0); 244 + return false; 245 + } 246 + 247 + /** 216 248 * apply_replay_entry - apply a replay entry to the TNC. 217 249 * @c: UBIFS file-system description object 218 250 * @r: replay entry to apply ··· 270 238 case UBIFS_INO_KEY: 271 239 { 272 240 ino_t inum = key_inum(c, &r->key); 241 + 242 + if (inode_still_linked(c, r)) { 243 + err = 0; 244 + break; 245 + } 273 246 274 247 err = ubifs_tnc_remove_ino(c, inum); 275 248 break; ··· 570 533 return data == 0xFFFFFFFF; 571 534 } 572 535 536 + /* authenticate_sleb_hash and authenticate_sleb_hmac are split out for stack usage */ 537 + static int authenticate_sleb_hash(struct ubifs_info *c, struct shash_desc *log_hash, u8 *hash) 538 + { 539 + SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm); 540 + 541 + hash_desc->tfm = c->hash_tfm; 542 + hash_desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; 543 + 544 + ubifs_shash_copy_state(c, log_hash, hash_desc); 545 + return crypto_shash_final(hash_desc, hash); 546 + } 547 + 548 + static int authenticate_sleb_hmac(struct ubifs_info *c, u8 *hash, u8 *hmac) 549 + { 550 + SHASH_DESC_ON_STACK(hmac_desc, c->hmac_tfm); 551 + 552 + hmac_desc->tfm = c->hmac_tfm; 553 + hmac_desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; 554 + 555 + return crypto_shash_digest(hmac_desc, hash, c->hash_len, hmac); 556 + } 557 + 573 558 /** 574 559 * authenticate_sleb - authenticate one scan LEB 575 560 * @c: UBIFS file-system description object ··· 633 574 634 575 if (snod->type == UBIFS_AUTH_NODE) { 635 576 struct ubifs_auth_node *auth = snod->node; 636 - SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm); 637 - SHASH_DESC_ON_STACK(hmac_desc, c->hmac_tfm); 638 577 639 - hash_desc->tfm = c->hash_tfm; 640 - hash_desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; 641 - 642 - ubifs_shash_copy_state(c, log_hash, hash_desc); 643 - err = crypto_shash_final(hash_desc, hash); 578 + err = authenticate_sleb_hash(c, log_hash, hash); 644 579 if (err) 645 580 goto out; 646 581 647 - hmac_desc->tfm = c->hmac_tfm; 648 - hmac_desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; 649 - err = crypto_shash_digest(hmac_desc, hash, c->hash_len, 650 - hmac); 582 + err = authenticate_sleb_hmac(c, hash, hmac); 651 583 if (err) 652 584 goto out; 653 585
+12 -1
fs/ubifs/sb.c
··· 63 63 /* Default time granularity in nanoseconds */ 64 64 #define DEFAULT_TIME_GRAN 1000000000 65 65 66 + static int get_default_compressor(struct ubifs_info *c) 67 + { 68 + if (ubifs_compr_present(c, UBIFS_COMPR_LZO)) 69 + return UBIFS_COMPR_LZO; 70 + 71 + if (ubifs_compr_present(c, UBIFS_COMPR_ZLIB)) 72 + return UBIFS_COMPR_ZLIB; 73 + 74 + return UBIFS_COMPR_NONE; 75 + } 76 + 66 77 /** 67 78 * create_default_filesystem - format empty UBI volume. 68 79 * @c: UBIFS file-system description object ··· 218 207 if (c->mount_opts.override_compr) 219 208 sup->default_compr = cpu_to_le16(c->mount_opts.compr_type); 220 209 else 221 - sup->default_compr = cpu_to_le16(UBIFS_COMPR_LZO); 210 + sup->default_compr = cpu_to_le16(get_default_compressor(c)); 222 211 223 212 generate_random_uuid(sup->uuid); 224 213
+4 -4
include/asm-generic/bug.h
··· 17 17 #ifndef __ASSEMBLY__ 18 18 #include <linux/kernel.h> 19 19 20 - struct bug_entry { 20 + #ifdef CONFIG_BUG 21 + 21 22 #ifdef CONFIG_GENERIC_BUG 23 + struct bug_entry { 22 24 #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS 23 25 unsigned long bug_addr; 24 26 #else ··· 35 33 unsigned short line; 36 34 #endif 37 35 unsigned short flags; 38 - #endif /* CONFIG_GENERIC_BUG */ 39 36 }; 40 - 41 - #ifdef CONFIG_BUG 37 + #endif /* CONFIG_GENERIC_BUG */ 42 38 43 39 /* 44 40 * Don't use BUG() or BUG_ON() unless there's really no way out; one
+13 -43
include/linux/compiler.h
··· 99 99 * unique, to convince GCC not to merge duplicate inline asm statements. 100 100 */ 101 101 #define annotate_reachable() ({ \ 102 - asm volatile("ANNOTATE_REACHABLE counter=%c0" \ 103 - : : "i" (__COUNTER__)); \ 102 + asm volatile("%c0:\n\t" \ 103 + ".pushsection .discard.reachable\n\t" \ 104 + ".long %c0b - .\n\t" \ 105 + ".popsection\n\t" : : "i" (__COUNTER__)); \ 104 106 }) 105 107 #define annotate_unreachable() ({ \ 106 - asm volatile("ANNOTATE_UNREACHABLE counter=%c0" \ 107 - : : "i" (__COUNTER__)); \ 108 + asm volatile("%c0:\n\t" \ 109 + ".pushsection .discard.unreachable\n\t" \ 110 + ".long %c0b - .\n\t" \ 111 + ".popsection\n\t" : : "i" (__COUNTER__)); \ 108 112 }) 113 + #define ASM_UNREACHABLE \ 114 + "999:\n\t" \ 115 + ".pushsection .discard.unreachable\n\t" \ 116 + ".long 999b - .\n\t" \ 117 + ".popsection\n\t" 109 118 #else 110 119 #define annotate_reachable() 111 120 #define annotate_unreachable() ··· 302 293 return (void *)((unsigned long)off + *off); 303 294 } 304 295 305 - #else /* __ASSEMBLY__ */ 306 - 307 - #ifdef __KERNEL__ 308 - #ifndef LINKER_SCRIPT 309 - 310 - #ifdef CONFIG_STACK_VALIDATION 311 - .macro ANNOTATE_UNREACHABLE counter:req 312 - \counter: 313 - .pushsection .discard.unreachable 314 - .long \counter\()b -. 315 - .popsection 316 - .endm 317 - 318 - .macro ANNOTATE_REACHABLE counter:req 319 - \counter: 320 - .pushsection .discard.reachable 321 - .long \counter\()b -. 322 - .popsection 323 - .endm 324 - 325 - .macro ASM_UNREACHABLE 326 - 999: 327 - .pushsection .discard.unreachable 328 - .long 999b - . 329 - .popsection 330 - .endm 331 - #else /* CONFIG_STACK_VALIDATION */ 332 - .macro ANNOTATE_UNREACHABLE counter:req 333 - .endm 334 - 335 - .macro ANNOTATE_REACHABLE counter:req 336 - .endm 337 - 338 - .macro ASM_UNREACHABLE 339 - .endm 340 - #endif /* CONFIG_STACK_VALIDATION */ 341 - 342 - #endif /* LINKER_SCRIPT */ 343 - #endif /* __KERNEL__ */ 344 296 #endif /* __ASSEMBLY__ */ 345 297 346 298 /* Compile time object size, -1 for unknown */
+63 -6
kernel/futex.c
··· 1148 1148 return ret; 1149 1149 } 1150 1150 1151 + static int handle_exit_race(u32 __user *uaddr, u32 uval, 1152 + struct task_struct *tsk) 1153 + { 1154 + u32 uval2; 1155 + 1156 + /* 1157 + * If PF_EXITPIDONE is not yet set, then try again. 1158 + */ 1159 + if (tsk && !(tsk->flags & PF_EXITPIDONE)) 1160 + return -EAGAIN; 1161 + 1162 + /* 1163 + * Reread the user space value to handle the following situation: 1164 + * 1165 + * CPU0 CPU1 1166 + * 1167 + * sys_exit() sys_futex() 1168 + * do_exit() futex_lock_pi() 1169 + * futex_lock_pi_atomic() 1170 + * exit_signals(tsk) No waiters: 1171 + * tsk->flags |= PF_EXITING; *uaddr == 0x00000PID 1172 + * mm_release(tsk) Set waiter bit 1173 + * exit_robust_list(tsk) { *uaddr = 0x80000PID; 1174 + * Set owner died attach_to_pi_owner() { 1175 + * *uaddr = 0xC0000000; tsk = get_task(PID); 1176 + * } if (!tsk->flags & PF_EXITING) { 1177 + * ... attach(); 1178 + * tsk->flags |= PF_EXITPIDONE; } else { 1179 + * if (!(tsk->flags & PF_EXITPIDONE)) 1180 + * return -EAGAIN; 1181 + * return -ESRCH; <--- FAIL 1182 + * } 1183 + * 1184 + * Returning ESRCH unconditionally is wrong here because the 1185 + * user space value has been changed by the exiting task. 1186 + * 1187 + * The same logic applies to the case where the exiting task is 1188 + * already gone. 1189 + */ 1190 + if (get_futex_value_locked(&uval2, uaddr)) 1191 + return -EFAULT; 1192 + 1193 + /* If the user space value has changed, try again. */ 1194 + if (uval2 != uval) 1195 + return -EAGAIN; 1196 + 1197 + /* 1198 + * The exiting task did not have a robust list, the robust list was 1199 + * corrupted or the user space value in *uaddr is simply bogus. 1200 + * Give up and tell user space. 1201 + */ 1202 + return -ESRCH; 1203 + } 1204 + 1151 1205 /* 1152 1206 * Lookup the task for the TID provided from user space and attach to 1153 1207 * it after doing proper sanity checks. 1154 1208 */ 1155 - static int attach_to_pi_owner(u32 uval, union futex_key *key, 1209 + static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, 1156 1210 struct futex_pi_state **ps) 1157 1211 { 1158 1212 pid_t pid = uval & FUTEX_TID_MASK; ··· 1216 1162 /* 1217 1163 * We are the first waiter - try to look up the real owner and attach 1218 1164 * the new pi_state to it, but bail out when TID = 0 [1] 1165 + * 1166 + * The !pid check is paranoid. None of the call sites should end up 1167 + * with pid == 0, but better safe than sorry. Let the caller retry 1219 1168 */ 1220 1169 if (!pid) 1221 - return -ESRCH; 1170 + return -EAGAIN; 1222 1171 p = find_get_task_by_vpid(pid); 1223 1172 if (!p) 1224 - return -ESRCH; 1173 + return handle_exit_race(uaddr, uval, NULL); 1225 1174 1226 1175 if (unlikely(p->flags & PF_KTHREAD)) { 1227 1176 put_task_struct(p); ··· 1244 1187 * set, we know that the task has finished the 1245 1188 * cleanup: 1246 1189 */ 1247 - int ret = (p->flags & PF_EXITPIDONE) ? -ESRCH : -EAGAIN; 1190 + int ret = handle_exit_race(uaddr, uval, p); 1248 1191 1249 1192 raw_spin_unlock_irq(&p->pi_lock); 1250 1193 put_task_struct(p); ··· 1301 1244 * We are the first waiter - try to look up the owner based on 1302 1245 * @uval and attach to it. 1303 1246 */ 1304 - return attach_to_pi_owner(uval, key, ps); 1247 + return attach_to_pi_owner(uaddr, uval, key, ps); 1305 1248 } 1306 1249 1307 1250 static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) ··· 1409 1352 * attach to the owner. If that fails, no harm done, we only 1410 1353 * set the FUTEX_WAITERS bit in the user space variable. 1411 1354 */ 1412 - return attach_to_pi_owner(uval, key, ps); 1355 + return attach_to_pi_owner(uaddr, newval, key, ps); 1413 1356 } 1414 1357 1415 1358 /**
+1 -4
kernel/time/posix-timers.c
··· 289 289 { 290 290 struct hrtimer *timer = &timr->it.real.timer; 291 291 292 - if (!timr->it_interval) 293 - return; 294 - 295 292 timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(), 296 293 timr->it_interval); 297 294 hrtimer_restart(timer); ··· 314 317 if (!timr) 315 318 return; 316 319 317 - if (timr->it_requeue_pending == info->si_sys_private) { 320 + if (timr->it_interval && timr->it_requeue_pending == info->si_sys_private) { 318 321 timr->kclock->timer_rearm(timr); 319 322 320 323 timr->it_active = 1;
+3
net/core/skmsg.c
··· 94 94 } 95 95 96 96 while (len) { 97 + if (sk_msg_full(dst)) 98 + return -ENOSPC; 99 + 97 100 sge_len = sge->length - off; 98 101 sge_off = sge->offset + off; 99 102 if (sge_len > len)
+3 -1
net/ipv4/inet_diag.c
··· 998 998 if (!inet_diag_bc_sk(bc, sk)) 999 999 goto next_normal; 1000 1000 1001 - sock_hold(sk); 1001 + if (!refcount_inc_not_zero(&sk->sk_refcnt)) 1002 + goto next_normal; 1003 + 1002 1004 num_arr[accum] = num; 1003 1005 sk_arr[accum] = sk; 1004 1006 if (++accum == SKARR_SZ)
+1
net/ipv6/ip6_tunnel.c
··· 901 901 goto drop; 902 902 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) 903 903 goto drop; 904 + ipv6h = ipv6_hdr(skb); 904 905 if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) 905 906 goto drop; 906 907 if (iptunnel_pull_header(skb, 0, tpi->proto, false))
+1
net/ipv6/ip6_vti.c
··· 318 318 return 0; 319 319 } 320 320 321 + ipv6h = ipv6_hdr(skb); 321 322 if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) { 322 323 t->dev->stats.rx_dropped++; 323 324 rcu_read_unlock();
+1
net/ipv6/reassembly.c
··· 384 384 if (skb_try_coalesce(head, fp, &headstolen, &delta)) { 385 385 kfree_skb_partial(fp, headstolen); 386 386 } else { 387 + fp->sk = NULL; 387 388 if (!skb_shinfo(head)->frag_list) 388 389 skb_shinfo(head)->frag_list = fp; 389 390 head->data_len += fp->len;
+4
net/packet/af_packet.c
··· 2627 2627 proto = saddr->sll_protocol; 2628 2628 addr = saddr->sll_addr; 2629 2629 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); 2630 + if (addr && dev && saddr->sll_halen < dev->addr_len) 2631 + goto out; 2630 2632 } 2631 2633 2632 2634 err = -ENXIO; ··· 2827 2825 proto = saddr->sll_protocol; 2828 2826 addr = saddr->sll_addr; 2829 2827 dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); 2828 + if (addr && dev && saddr->sll_halen < dev->addr_len) 2829 + goto out; 2830 2830 } 2831 2831 2832 2832 err = -ENXIO;
+6 -4
net/tls/tls_sw.c
··· 943 943 tls_ctx->tx.overhead_size); 944 944 } 945 945 946 - ret = sk_msg_memcopy_from_iter(sk, &msg->msg_iter, msg_pl, 947 - try_to_copy); 948 - if (ret < 0) 949 - goto trim_sgl; 946 + if (try_to_copy) { 947 + ret = sk_msg_memcopy_from_iter(sk, &msg->msg_iter, 948 + msg_pl, try_to_copy); 949 + if (ret < 0) 950 + goto trim_sgl; 951 + } 950 952 951 953 /* Open records defined only if successfully copied, otherwise 952 954 * we would trim the sg but not reset the open record frags.
+1 -3
scripts/Kbuild.include
··· 115 115 116 116 # Do not attempt to build with gcc plugins during cc-option tests. 117 117 # (And this uses delayed resolution so the flags will be up to date.) 118 - # In addition, do not include the asm macros which are built later. 119 - CC_OPTION_FILTERED = $(GCC_PLUGINS_CFLAGS) $(ASM_MACRO_FLAGS) 120 - CC_OPTION_CFLAGS = $(filter-out $(CC_OPTION_FILTERED),$(KBUILD_CFLAGS)) 118 + CC_OPTION_CFLAGS = $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS)) 121 119 122 120 # cc-option 123 121 # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
-2
scripts/mod/Makefile
··· 4 4 hostprogs-y := modpost mk_elfconfig 5 5 always := $(hostprogs-y) empty.o 6 6 7 - CFLAGS_REMOVE_empty.o := $(ASM_MACRO_FLAGS) 8 - 9 7 modpost-objs := modpost.o file2alias.o sumversion.o 10 8 11 9 devicetable-offsets-file := devicetable-offsets.h