Contents of /trunk/kernel-alx-legacy/patches-4.9/0186-4.9.87-all-fixes.patch
Parent Directory | Revision Log
Revision 3608 -
(show annotations)
(download)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 77640 byte(s)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 77640 byte(s)
-added kerenl-alx-legacy pkg
1 | diff --git a/Makefile b/Makefile |
2 | index e918d25e95bb..3043937a65d1 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 86 |
9 | +SUBLEVEL = 87 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi |
14 | index 4f2c5ec75714..e262fa9ef334 100644 |
15 | --- a/arch/arm/boot/dts/logicpd-som-lv.dtsi |
16 | +++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi |
17 | @@ -97,6 +97,8 @@ |
18 | }; |
19 | |
20 | &i2c1 { |
21 | + pinctrl-names = "default"; |
22 | + pinctrl-0 = <&i2c1_pins>; |
23 | clock-frequency = <2600000>; |
24 | |
25 | twl: twl@48 { |
26 | @@ -215,7 +217,12 @@ |
27 | >; |
28 | }; |
29 | |
30 | - |
31 | + i2c1_pins: pinmux_i2c1_pins { |
32 | + pinctrl-single,pins = < |
33 | + OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ |
34 | + OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ |
35 | + >; |
36 | + }; |
37 | }; |
38 | |
39 | &omap3_pmx_wkup { |
40 | diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi |
41 | index efe53998c961..08f0a35dc0d1 100644 |
42 | --- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi |
43 | +++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi |
44 | @@ -100,6 +100,8 @@ |
45 | }; |
46 | |
47 | &i2c1 { |
48 | + pinctrl-names = "default"; |
49 | + pinctrl-0 = <&i2c1_pins>; |
50 | clock-frequency = <2600000>; |
51 | |
52 | twl: twl@48 { |
53 | @@ -207,6 +209,12 @@ |
54 | OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0) /* hsusb0_data7.hsusb0_data7 */ |
55 | >; |
56 | }; |
57 | + i2c1_pins: pinmux_i2c1_pins { |
58 | + pinctrl-single,pins = < |
59 | + OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ |
60 | + OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ |
61 | + >; |
62 | + }; |
63 | }; |
64 | |
65 | &uart2 { |
66 | diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile |
67 | index 92eab1d51785..61049216e4d5 100644 |
68 | --- a/arch/arm/kvm/hyp/Makefile |
69 | +++ b/arch/arm/kvm/hyp/Makefile |
70 | @@ -6,6 +6,8 @@ ccflags-y += -fno-stack-protector -DDISABLE_BRANCH_PROFILING |
71 | |
72 | KVM=../../../../virt/kvm |
73 | |
74 | +CFLAGS_ARMV7VE :=$(call cc-option, -march=armv7ve) |
75 | + |
76 | obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o |
77 | obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v3-sr.o |
78 | obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/timer-sr.o |
79 | @@ -14,7 +16,10 @@ obj-$(CONFIG_KVM_ARM_HOST) += tlb.o |
80 | obj-$(CONFIG_KVM_ARM_HOST) += cp15-sr.o |
81 | obj-$(CONFIG_KVM_ARM_HOST) += vfp.o |
82 | obj-$(CONFIG_KVM_ARM_HOST) += banked-sr.o |
83 | +CFLAGS_banked-sr.o += $(CFLAGS_ARMV7VE) |
84 | + |
85 | obj-$(CONFIG_KVM_ARM_HOST) += entry.o |
86 | obj-$(CONFIG_KVM_ARM_HOST) += hyp-entry.o |
87 | obj-$(CONFIG_KVM_ARM_HOST) += switch.o |
88 | +CFLAGS_switch.o += $(CFLAGS_ARMV7VE) |
89 | obj-$(CONFIG_KVM_ARM_HOST) += s2-setup.o |
90 | diff --git a/arch/arm/kvm/hyp/banked-sr.c b/arch/arm/kvm/hyp/banked-sr.c |
91 | index 111bda8cdebd..be4b8b0a40ad 100644 |
92 | --- a/arch/arm/kvm/hyp/banked-sr.c |
93 | +++ b/arch/arm/kvm/hyp/banked-sr.c |
94 | @@ -20,6 +20,10 @@ |
95 | |
96 | #include <asm/kvm_hyp.h> |
97 | |
98 | +/* |
99 | + * gcc before 4.9 doesn't understand -march=armv7ve, so we have to |
100 | + * trick the assembler. |
101 | + */ |
102 | __asm__(".arch_extension virt"); |
103 | |
104 | void __hyp_text __banked_save_state(struct kvm_cpu_context *ctxt) |
105 | diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig |
106 | index 541647f57192..895c0746fe50 100644 |
107 | --- a/arch/arm/mach-mvebu/Kconfig |
108 | +++ b/arch/arm/mach-mvebu/Kconfig |
109 | @@ -42,7 +42,7 @@ config MACH_ARMADA_375 |
110 | depends on ARCH_MULTI_V7 |
111 | select ARMADA_370_XP_IRQ |
112 | select ARM_ERRATA_720789 |
113 | - select ARM_ERRATA_753970 |
114 | + select PL310_ERRATA_753970 |
115 | select ARM_GIC |
116 | select ARMADA_375_CLK |
117 | select HAVE_ARM_SCU |
118 | @@ -58,7 +58,7 @@ config MACH_ARMADA_38X |
119 | bool "Marvell Armada 380/385 boards" |
120 | depends on ARCH_MULTI_V7 |
121 | select ARM_ERRATA_720789 |
122 | - select ARM_ERRATA_753970 |
123 | + select PL310_ERRATA_753970 |
124 | select ARM_GIC |
125 | select ARMADA_370_XP_IRQ |
126 | select ARMADA_38X_CLK |
127 | diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c |
128 | index d8199e12fb6e..b47a26f4290c 100644 |
129 | --- a/arch/arm64/net/bpf_jit_comp.c |
130 | +++ b/arch/arm64/net/bpf_jit_comp.c |
131 | @@ -234,8 +234,9 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) |
132 | off = offsetof(struct bpf_array, map.max_entries); |
133 | emit_a64_mov_i64(tmp, off, ctx); |
134 | emit(A64_LDR32(tmp, r2, tmp), ctx); |
135 | + emit(A64_MOV(0, r3, r3), ctx); |
136 | emit(A64_CMP(0, r3, tmp), ctx); |
137 | - emit(A64_B_(A64_COND_GE, jmp_offset), ctx); |
138 | + emit(A64_B_(A64_COND_CS, jmp_offset), ctx); |
139 | |
140 | /* if (tail_call_cnt > MAX_TAIL_CALL_CNT) |
141 | * goto out; |
142 | @@ -243,7 +244,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) |
143 | */ |
144 | emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx); |
145 | emit(A64_CMP(1, tcc, tmp), ctx); |
146 | - emit(A64_B_(A64_COND_GT, jmp_offset), ctx); |
147 | + emit(A64_B_(A64_COND_HI, jmp_offset), ctx); |
148 | emit(A64_ADD_I(1, tcc, tcc, 1), ctx); |
149 | |
150 | /* prog = array->ptrs[index]; |
151 | diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h |
152 | index 1d8c24dc04d4..88290d32b956 100644 |
153 | --- a/arch/parisc/include/asm/cacheflush.h |
154 | +++ b/arch/parisc/include/asm/cacheflush.h |
155 | @@ -25,6 +25,7 @@ void flush_user_icache_range_asm(unsigned long, unsigned long); |
156 | void flush_kernel_icache_range_asm(unsigned long, unsigned long); |
157 | void flush_user_dcache_range_asm(unsigned long, unsigned long); |
158 | void flush_kernel_dcache_range_asm(unsigned long, unsigned long); |
159 | +void purge_kernel_dcache_range_asm(unsigned long, unsigned long); |
160 | void flush_kernel_dcache_page_asm(void *); |
161 | void flush_kernel_icache_page(void *); |
162 | void flush_user_dcache_range(unsigned long, unsigned long); |
163 | diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c |
164 | index df757c9675e6..025afe5f17a7 100644 |
165 | --- a/arch/parisc/kernel/cache.c |
166 | +++ b/arch/parisc/kernel/cache.c |
167 | @@ -464,10 +464,10 @@ EXPORT_SYMBOL(copy_user_page); |
168 | int __flush_tlb_range(unsigned long sid, unsigned long start, |
169 | unsigned long end) |
170 | { |
171 | - unsigned long flags, size; |
172 | + unsigned long flags; |
173 | |
174 | - size = (end - start); |
175 | - if (size >= parisc_tlb_flush_threshold) { |
176 | + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && |
177 | + end - start >= parisc_tlb_flush_threshold) { |
178 | flush_tlb_all(); |
179 | return 1; |
180 | } |
181 | @@ -538,13 +538,11 @@ void flush_cache_mm(struct mm_struct *mm) |
182 | struct vm_area_struct *vma; |
183 | pgd_t *pgd; |
184 | |
185 | - /* Flush the TLB to avoid speculation if coherency is required. */ |
186 | - if (parisc_requires_coherency()) |
187 | - flush_tlb_all(); |
188 | - |
189 | /* Flushing the whole cache on each cpu takes forever on |
190 | rp3440, etc. So, avoid it if the mm isn't too big. */ |
191 | - if (mm_total_size(mm) >= parisc_cache_flush_threshold) { |
192 | + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && |
193 | + mm_total_size(mm) >= parisc_cache_flush_threshold) { |
194 | + flush_tlb_all(); |
195 | flush_cache_all(); |
196 | return; |
197 | } |
198 | @@ -552,9 +550,9 @@ void flush_cache_mm(struct mm_struct *mm) |
199 | if (mm->context == mfsp(3)) { |
200 | for (vma = mm->mmap; vma; vma = vma->vm_next) { |
201 | flush_user_dcache_range_asm(vma->vm_start, vma->vm_end); |
202 | - if ((vma->vm_flags & VM_EXEC) == 0) |
203 | - continue; |
204 | - flush_user_icache_range_asm(vma->vm_start, vma->vm_end); |
205 | + if (vma->vm_flags & VM_EXEC) |
206 | + flush_user_icache_range_asm(vma->vm_start, vma->vm_end); |
207 | + flush_tlb_range(vma, vma->vm_start, vma->vm_end); |
208 | } |
209 | return; |
210 | } |
211 | @@ -598,14 +596,9 @@ flush_user_icache_range(unsigned long start, unsigned long end) |
212 | void flush_cache_range(struct vm_area_struct *vma, |
213 | unsigned long start, unsigned long end) |
214 | { |
215 | - BUG_ON(!vma->vm_mm->context); |
216 | - |
217 | - /* Flush the TLB to avoid speculation if coherency is required. */ |
218 | - if (parisc_requires_coherency()) |
219 | + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && |
220 | + end - start >= parisc_cache_flush_threshold) { |
221 | flush_tlb_range(vma, start, end); |
222 | - |
223 | - if ((end - start) >= parisc_cache_flush_threshold |
224 | - || vma->vm_mm->context != mfsp(3)) { |
225 | flush_cache_all(); |
226 | return; |
227 | } |
228 | @@ -613,6 +606,7 @@ void flush_cache_range(struct vm_area_struct *vma, |
229 | flush_user_dcache_range_asm(start, end); |
230 | if (vma->vm_flags & VM_EXEC) |
231 | flush_user_icache_range_asm(start, end); |
232 | + flush_tlb_range(vma, start, end); |
233 | } |
234 | |
235 | void |
236 | @@ -621,8 +615,7 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long |
237 | BUG_ON(!vma->vm_mm->context); |
238 | |
239 | if (pfn_valid(pfn)) { |
240 | - if (parisc_requires_coherency()) |
241 | - flush_tlb_page(vma, vmaddr); |
242 | + flush_tlb_page(vma, vmaddr); |
243 | __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn)); |
244 | } |
245 | } |
246 | @@ -630,21 +623,33 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long |
247 | void flush_kernel_vmap_range(void *vaddr, int size) |
248 | { |
249 | unsigned long start = (unsigned long)vaddr; |
250 | + unsigned long end = start + size; |
251 | |
252 | - if ((unsigned long)size > parisc_cache_flush_threshold) |
253 | + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && |
254 | + (unsigned long)size >= parisc_cache_flush_threshold) { |
255 | + flush_tlb_kernel_range(start, end); |
256 | flush_data_cache(); |
257 | - else |
258 | - flush_kernel_dcache_range_asm(start, start + size); |
259 | + return; |
260 | + } |
261 | + |
262 | + flush_kernel_dcache_range_asm(start, end); |
263 | + flush_tlb_kernel_range(start, end); |
264 | } |
265 | EXPORT_SYMBOL(flush_kernel_vmap_range); |
266 | |
267 | void invalidate_kernel_vmap_range(void *vaddr, int size) |
268 | { |
269 | unsigned long start = (unsigned long)vaddr; |
270 | + unsigned long end = start + size; |
271 | |
272 | - if ((unsigned long)size > parisc_cache_flush_threshold) |
273 | + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && |
274 | + (unsigned long)size >= parisc_cache_flush_threshold) { |
275 | + flush_tlb_kernel_range(start, end); |
276 | flush_data_cache(); |
277 | - else |
278 | - flush_kernel_dcache_range_asm(start, start + size); |
279 | + return; |
280 | + } |
281 | + |
282 | + purge_kernel_dcache_range_asm(start, end); |
283 | + flush_tlb_kernel_range(start, end); |
284 | } |
285 | EXPORT_SYMBOL(invalidate_kernel_vmap_range); |
286 | diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S |
287 | index 2d40c4ff3f69..67b0f7532e83 100644 |
288 | --- a/arch/parisc/kernel/pacache.S |
289 | +++ b/arch/parisc/kernel/pacache.S |
290 | @@ -1110,6 +1110,28 @@ ENTRY_CFI(flush_kernel_dcache_range_asm) |
291 | .procend |
292 | ENDPROC_CFI(flush_kernel_dcache_range_asm) |
293 | |
294 | +ENTRY_CFI(purge_kernel_dcache_range_asm) |
295 | + .proc |
296 | + .callinfo NO_CALLS |
297 | + .entry |
298 | + |
299 | + ldil L%dcache_stride, %r1 |
300 | + ldw R%dcache_stride(%r1), %r23 |
301 | + ldo -1(%r23), %r21 |
302 | + ANDCM %r26, %r21, %r26 |
303 | + |
304 | +1: cmpb,COND(<<),n %r26, %r25,1b |
305 | + pdc,m %r23(%r26) |
306 | + |
307 | + sync |
308 | + syncdma |
309 | + bv %r0(%r2) |
310 | + nop |
311 | + .exit |
312 | + |
313 | + .procend |
314 | +ENDPROC_CFI(purge_kernel_dcache_range_asm) |
315 | + |
316 | ENTRY_CFI(flush_user_icache_range_asm) |
317 | .proc |
318 | .callinfo NO_CALLS |
319 | diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c |
320 | index 0fe98a567125..be9d968244ad 100644 |
321 | --- a/arch/powerpc/net/bpf_jit_comp64.c |
322 | +++ b/arch/powerpc/net/bpf_jit_comp64.c |
323 | @@ -245,6 +245,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 |
324 | * goto out; |
325 | */ |
326 | PPC_LWZ(b2p[TMP_REG_1], b2p_bpf_array, offsetof(struct bpf_array, map.max_entries)); |
327 | + PPC_RLWINM(b2p_index, b2p_index, 0, 0, 31); |
328 | PPC_CMPLW(b2p_index, b2p[TMP_REG_1]); |
329 | PPC_BCC(COND_GE, out); |
330 | |
331 | diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h |
332 | index 8b272a08d1a8..e2e09347ee3c 100644 |
333 | --- a/arch/x86/include/asm/mmu.h |
334 | +++ b/arch/x86/include/asm/mmu.h |
335 | @@ -3,12 +3,18 @@ |
336 | |
337 | #include <linux/spinlock.h> |
338 | #include <linux/mutex.h> |
339 | +#include <linux/atomic.h> |
340 | |
341 | /* |
342 | - * The x86 doesn't have a mmu context, but |
343 | - * we put the segment information here. |
344 | + * x86 has arch-specific MMU state beyond what lives in mm_struct. |
345 | */ |
346 | typedef struct { |
347 | + /* |
348 | + * ctx_id uniquely identifies this mm_struct. A ctx_id will never |
349 | + * be reused, and zero is not a valid ctx_id. |
350 | + */ |
351 | + u64 ctx_id; |
352 | + |
353 | #ifdef CONFIG_MODIFY_LDT_SYSCALL |
354 | struct ldt_struct *ldt; |
355 | #endif |
356 | @@ -33,6 +39,11 @@ typedef struct { |
357 | #endif |
358 | } mm_context_t; |
359 | |
360 | +#define INIT_MM_CONTEXT(mm) \ |
361 | + .context = { \ |
362 | + .ctx_id = 1, \ |
363 | + } |
364 | + |
365 | void leave_mm(int cpu); |
366 | |
367 | #endif /* _ASM_X86_MMU_H */ |
368 | diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h |
369 | index d23e35584f15..5a295bb97103 100644 |
370 | --- a/arch/x86/include/asm/mmu_context.h |
371 | +++ b/arch/x86/include/asm/mmu_context.h |
372 | @@ -12,6 +12,9 @@ |
373 | #include <asm/tlbflush.h> |
374 | #include <asm/paravirt.h> |
375 | #include <asm/mpx.h> |
376 | + |
377 | +extern atomic64_t last_mm_ctx_id; |
378 | + |
379 | #ifndef CONFIG_PARAVIRT |
380 | static inline void paravirt_activate_mm(struct mm_struct *prev, |
381 | struct mm_struct *next) |
382 | @@ -106,6 +109,8 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk) |
383 | static inline int init_new_context(struct task_struct *tsk, |
384 | struct mm_struct *mm) |
385 | { |
386 | + mm->context.ctx_id = atomic64_inc_return(&last_mm_ctx_id); |
387 | + |
388 | #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS |
389 | if (cpu_feature_enabled(X86_FEATURE_OSPKE)) { |
390 | /* pkey 0 is the default and always allocated */ |
391 | diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h |
392 | index 76b058533e47..81a1be326571 100644 |
393 | --- a/arch/x86/include/asm/nospec-branch.h |
394 | +++ b/arch/x86/include/asm/nospec-branch.h |
395 | @@ -177,4 +177,41 @@ static inline void indirect_branch_prediction_barrier(void) |
396 | } |
397 | |
398 | #endif /* __ASSEMBLY__ */ |
399 | + |
400 | +/* |
401 | + * Below is used in the eBPF JIT compiler and emits the byte sequence |
402 | + * for the following assembly: |
403 | + * |
404 | + * With retpolines configured: |
405 | + * |
406 | + * callq do_rop |
407 | + * spec_trap: |
408 | + * pause |
409 | + * lfence |
410 | + * jmp spec_trap |
411 | + * do_rop: |
412 | + * mov %rax,(%rsp) |
413 | + * retq |
414 | + * |
415 | + * Without retpolines configured: |
416 | + * |
417 | + * jmp *%rax |
418 | + */ |
419 | +#ifdef CONFIG_RETPOLINE |
420 | +# define RETPOLINE_RAX_BPF_JIT_SIZE 17 |
421 | +# define RETPOLINE_RAX_BPF_JIT() \ |
422 | + EMIT1_off32(0xE8, 7); /* callq do_rop */ \ |
423 | + /* spec_trap: */ \ |
424 | + EMIT2(0xF3, 0x90); /* pause */ \ |
425 | + EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \ |
426 | + EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \ |
427 | + /* do_rop: */ \ |
428 | + EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \ |
429 | + EMIT1(0xC3); /* retq */ |
430 | +#else |
431 | +# define RETPOLINE_RAX_BPF_JIT_SIZE 2 |
432 | +# define RETPOLINE_RAX_BPF_JIT() \ |
433 | + EMIT2(0xFF, 0xE0); /* jmp *%rax */ |
434 | +#endif |
435 | + |
436 | #endif /* _ASM_X86_NOSPEC_BRANCH_H_ */ |
437 | diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h |
438 | index 94146f665a3c..99185a064978 100644 |
439 | --- a/arch/x86/include/asm/tlbflush.h |
440 | +++ b/arch/x86/include/asm/tlbflush.h |
441 | @@ -68,6 +68,8 @@ static inline void invpcid_flush_all_nonglobals(void) |
442 | struct tlb_state { |
443 | struct mm_struct *active_mm; |
444 | int state; |
445 | + /* last user mm's ctx id */ |
446 | + u64 last_ctx_id; |
447 | |
448 | /* |
449 | * Access to this CR4 shadow and to H/W CR4 is protected by |
450 | diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c |
451 | index b5229abd1629..4922ab66fd29 100644 |
452 | --- a/arch/x86/kernel/apic/vector.c |
453 | +++ b/arch/x86/kernel/apic/vector.c |
454 | @@ -93,8 +93,12 @@ static struct apic_chip_data *alloc_apic_chip_data(int node) |
455 | return NULL; |
456 | } |
457 | |
458 | -static void free_apic_chip_data(struct apic_chip_data *data) |
459 | +static void free_apic_chip_data(unsigned int virq, struct apic_chip_data *data) |
460 | { |
461 | +#ifdef CONFIG_X86_IO_APIC |
462 | + if (virq < nr_legacy_irqs()) |
463 | + legacy_irq_data[virq] = NULL; |
464 | +#endif |
465 | if (data) { |
466 | free_cpumask_var(data->domain); |
467 | free_cpumask_var(data->old_domain); |
468 | @@ -318,11 +322,7 @@ static void x86_vector_free_irqs(struct irq_domain *domain, |
469 | apic_data = irq_data->chip_data; |
470 | irq_domain_reset_irq_data(irq_data); |
471 | raw_spin_unlock_irqrestore(&vector_lock, flags); |
472 | - free_apic_chip_data(apic_data); |
473 | -#ifdef CONFIG_X86_IO_APIC |
474 | - if (virq + i < nr_legacy_irqs()) |
475 | - legacy_irq_data[virq + i] = NULL; |
476 | -#endif |
477 | + free_apic_chip_data(virq + i, apic_data); |
478 | } |
479 | } |
480 | } |
481 | @@ -363,7 +363,7 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, |
482 | err = assign_irq_vector_policy(virq + i, node, data, info); |
483 | if (err) { |
484 | irq_data->chip_data = NULL; |
485 | - free_apic_chip_data(data); |
486 | + free_apic_chip_data(virq + i, data); |
487 | goto error; |
488 | } |
489 | } |
490 | diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c |
491 | index be644afab1bb..24d2a3ee743f 100644 |
492 | --- a/arch/x86/kvm/svm.c |
493 | +++ b/arch/x86/kvm/svm.c |
494 | @@ -44,6 +44,7 @@ |
495 | #include <asm/debugreg.h> |
496 | #include <asm/kvm_para.h> |
497 | #include <asm/irq_remapping.h> |
498 | +#include <asm/microcode.h> |
499 | #include <asm/nospec-branch.h> |
500 | |
501 | #include <asm/virtext.h> |
502 | @@ -4919,7 +4920,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) |
503 | * being speculatively taken. |
504 | */ |
505 | if (svm->spec_ctrl) |
506 | - wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); |
507 | + native_wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); |
508 | |
509 | asm volatile ( |
510 | "push %%" _ASM_BP "; \n\t" |
511 | @@ -5028,11 +5029,11 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) |
512 | * If the L02 MSR bitmap does not intercept the MSR, then we need to |
513 | * save it. |
514 | */ |
515 | - if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) |
516 | - rdmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); |
517 | + if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) |
518 | + svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); |
519 | |
520 | if (svm->spec_ctrl) |
521 | - wrmsrl(MSR_IA32_SPEC_CTRL, 0); |
522 | + native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); |
523 | |
524 | /* Eliminate branch target predictions from guest mode */ |
525 | vmexit_fill_RSB(); |
526 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
527 | index c51aaac953b4..0f3bb4632310 100644 |
528 | --- a/arch/x86/kvm/vmx.c |
529 | +++ b/arch/x86/kvm/vmx.c |
530 | @@ -49,6 +49,7 @@ |
531 | #include <asm/kexec.h> |
532 | #include <asm/apic.h> |
533 | #include <asm/irq_remapping.h> |
534 | +#include <asm/microcode.h> |
535 | #include <asm/nospec-branch.h> |
536 | |
537 | #include "trace.h" |
538 | @@ -8906,7 +8907,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) |
539 | * being speculatively taken. |
540 | */ |
541 | if (vmx->spec_ctrl) |
542 | - wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); |
543 | + native_wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); |
544 | |
545 | vmx->__launched = vmx->loaded_vmcs->launched; |
546 | asm( |
547 | @@ -9041,11 +9042,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) |
548 | * If the L02 MSR bitmap does not intercept the MSR, then we need to |
549 | * save it. |
550 | */ |
551 | - if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) |
552 | - rdmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); |
553 | + if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) |
554 | + vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); |
555 | |
556 | if (vmx->spec_ctrl) |
557 | - wrmsrl(MSR_IA32_SPEC_CTRL, 0); |
558 | + native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); |
559 | |
560 | /* Eliminate branch target predictions from guest mode */ |
561 | vmexit_fill_RSB(); |
562 | diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c |
563 | index 578973ade71b..eac92e2d171b 100644 |
564 | --- a/arch/x86/mm/tlb.c |
565 | +++ b/arch/x86/mm/tlb.c |
566 | @@ -10,6 +10,7 @@ |
567 | |
568 | #include <asm/tlbflush.h> |
569 | #include <asm/mmu_context.h> |
570 | +#include <asm/nospec-branch.h> |
571 | #include <asm/cache.h> |
572 | #include <asm/apic.h> |
573 | #include <asm/uv/uv.h> |
574 | @@ -29,6 +30,8 @@ |
575 | * Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi |
576 | */ |
577 | |
578 | +atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1); |
579 | + |
580 | struct flush_tlb_info { |
581 | struct mm_struct *flush_mm; |
582 | unsigned long flush_start; |
583 | @@ -104,6 +107,28 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, |
584 | unsigned cpu = smp_processor_id(); |
585 | |
586 | if (likely(prev != next)) { |
587 | + u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id); |
588 | + |
589 | + /* |
590 | + * Avoid user/user BTB poisoning by flushing the branch |
591 | + * predictor when switching between processes. This stops |
592 | + * one process from doing Spectre-v2 attacks on another. |
593 | + * |
594 | + * As an optimization, flush indirect branches only when |
595 | + * switching into processes that disable dumping. This |
596 | + * protects high value processes like gpg, without having |
597 | + * too high performance overhead. IBPB is *expensive*! |
598 | + * |
599 | + * This will not flush branches when switching into kernel |
600 | + * threads. It will also not flush if we switch to idle |
601 | + * thread and back to the same process. It will flush if we |
602 | + * switch to a different non-dumpable process. |
603 | + */ |
604 | + if (tsk && tsk->mm && |
605 | + tsk->mm->context.ctx_id != last_ctx_id && |
606 | + get_dumpable(tsk->mm) != SUID_DUMP_USER) |
607 | + indirect_branch_prediction_barrier(); |
608 | + |
609 | if (IS_ENABLED(CONFIG_VMAP_STACK)) { |
610 | /* |
611 | * If our current stack is in vmalloc space and isn't |
612 | @@ -118,6 +143,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, |
613 | set_pgd(pgd, init_mm.pgd[stack_pgd_index]); |
614 | } |
615 | |
616 | + /* |
617 | + * Record last user mm's context id, so we can avoid |
618 | + * flushing branch buffer with IBPB if we switch back |
619 | + * to the same user. |
620 | + */ |
621 | + if (next != &init_mm) |
622 | + this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id); |
623 | + |
624 | this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); |
625 | this_cpu_write(cpu_tlbstate.active_mm, next); |
626 | |
627 | diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c |
628 | index 7840331d3056..1f7ed2ed6ff7 100644 |
629 | --- a/arch/x86/net/bpf_jit_comp.c |
630 | +++ b/arch/x86/net/bpf_jit_comp.c |
631 | @@ -12,6 +12,7 @@ |
632 | #include <linux/filter.h> |
633 | #include <linux/if_vlan.h> |
634 | #include <asm/cacheflush.h> |
635 | +#include <asm/nospec-branch.h> |
636 | #include <linux/bpf.h> |
637 | |
638 | int bpf_jit_enable __read_mostly; |
639 | @@ -281,7 +282,7 @@ static void emit_bpf_tail_call(u8 **pprog) |
640 | EMIT2(0x89, 0xD2); /* mov edx, edx */ |
641 | EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */ |
642 | offsetof(struct bpf_array, map.max_entries)); |
643 | -#define OFFSET1 43 /* number of bytes to jump */ |
644 | +#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */ |
645 | EMIT2(X86_JBE, OFFSET1); /* jbe out */ |
646 | label1 = cnt; |
647 | |
648 | @@ -290,7 +291,7 @@ static void emit_bpf_tail_call(u8 **pprog) |
649 | */ |
650 | EMIT2_off32(0x8B, 0x85, -STACKSIZE + 36); /* mov eax, dword ptr [rbp - 516] */ |
651 | EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */ |
652 | -#define OFFSET2 32 |
653 | +#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE) |
654 | EMIT2(X86_JA, OFFSET2); /* ja out */ |
655 | label2 = cnt; |
656 | EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */ |
657 | @@ -304,7 +305,7 @@ static void emit_bpf_tail_call(u8 **pprog) |
658 | * goto out; |
659 | */ |
660 | EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */ |
661 | -#define OFFSET3 10 |
662 | +#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE) |
663 | EMIT2(X86_JE, OFFSET3); /* je out */ |
664 | label3 = cnt; |
665 | |
666 | @@ -317,7 +318,7 @@ static void emit_bpf_tail_call(u8 **pprog) |
667 | * rdi == ctx (1st arg) |
668 | * rax == prog->bpf_func + prologue_size |
669 | */ |
670 | - EMIT2(0xFF, 0xE0); /* jmp rax */ |
671 | + RETPOLINE_RAX_BPF_JIT(); |
672 | |
673 | /* out: */ |
674 | BUILD_BUG_ON(cnt - label1 != OFFSET1); |
675 | diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c |
676 | index 7850128f0026..834783bc6752 100644 |
677 | --- a/arch/x86/platform/intel-mid/intel-mid.c |
678 | +++ b/arch/x86/platform/intel-mid/intel-mid.c |
679 | @@ -79,7 +79,7 @@ static void intel_mid_power_off(void) |
680 | |
681 | static void intel_mid_reboot(void) |
682 | { |
683 | - intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0); |
684 | + intel_scu_ipc_simple_command(IPCMSG_COLD_RESET, 0); |
685 | } |
686 | |
687 | static unsigned long __init intel_mid_calibrate_tsc(void) |
688 | diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c |
689 | index 7f664c416faf..4ecd0de08557 100644 |
690 | --- a/arch/x86/xen/suspend.c |
691 | +++ b/arch/x86/xen/suspend.c |
692 | @@ -1,11 +1,14 @@ |
693 | #include <linux/types.h> |
694 | #include <linux/tick.h> |
695 | +#include <linux/percpu-defs.h> |
696 | |
697 | #include <xen/xen.h> |
698 | #include <xen/interface/xen.h> |
699 | #include <xen/grant_table.h> |
700 | #include <xen/events.h> |
701 | |
702 | +#include <asm/cpufeatures.h> |
703 | +#include <asm/msr-index.h> |
704 | #include <asm/xen/hypercall.h> |
705 | #include <asm/xen/page.h> |
706 | #include <asm/fixmap.h> |
707 | @@ -68,6 +71,8 @@ static void xen_pv_post_suspend(int suspend_cancelled) |
708 | xen_mm_unpin_all(); |
709 | } |
710 | |
711 | +static DEFINE_PER_CPU(u64, spec_ctrl); |
712 | + |
713 | void xen_arch_pre_suspend(void) |
714 | { |
715 | if (xen_pv_domain()) |
716 | @@ -84,6 +89,9 @@ void xen_arch_post_suspend(int cancelled) |
717 | |
718 | static void xen_vcpu_notify_restore(void *data) |
719 | { |
720 | + if (xen_pv_domain() && boot_cpu_has(X86_FEATURE_SPEC_CTRL)) |
721 | + wrmsrl(MSR_IA32_SPEC_CTRL, this_cpu_read(spec_ctrl)); |
722 | + |
723 | /* Boot processor notified via generic timekeeping_resume() */ |
724 | if (smp_processor_id() == 0) |
725 | return; |
726 | @@ -93,7 +101,15 @@ static void xen_vcpu_notify_restore(void *data) |
727 | |
728 | static void xen_vcpu_notify_suspend(void *data) |
729 | { |
730 | + u64 tmp; |
731 | + |
732 | tick_suspend_local(); |
733 | + |
734 | + if (xen_pv_domain() && boot_cpu_has(X86_FEATURE_SPEC_CTRL)) { |
735 | + rdmsrl(MSR_IA32_SPEC_CTRL, tmp); |
736 | + this_cpu_write(spec_ctrl, tmp); |
737 | + wrmsrl(MSR_IA32_SPEC_CTRL, 0); |
738 | + } |
739 | } |
740 | |
741 | void xen_arch_resume(void) |
742 | diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c |
743 | index 6f060c76217b..7205e6da16cd 100644 |
744 | --- a/drivers/char/tpm/st33zp24/st33zp24.c |
745 | +++ b/drivers/char/tpm/st33zp24/st33zp24.c |
746 | @@ -458,7 +458,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, |
747 | size_t count) |
748 | { |
749 | int size = 0; |
750 | - int expected; |
751 | + u32 expected; |
752 | |
753 | if (!chip) |
754 | return -EBUSY; |
755 | @@ -475,7 +475,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, |
756 | } |
757 | |
758 | expected = be32_to_cpu(*(__be32 *)(buf + 2)); |
759 | - if (expected > count) { |
760 | + if (expected > count || expected < TPM_HEADER_SIZE) { |
761 | size = -EIO; |
762 | goto out; |
763 | } |
764 | diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c |
765 | index 912ad30be585..65b824954bdc 100644 |
766 | --- a/drivers/char/tpm/tpm-dev.c |
767 | +++ b/drivers/char/tpm/tpm-dev.c |
768 | @@ -136,6 +136,12 @@ static ssize_t tpm_write(struct file *file, const char __user *buf, |
769 | return -EFAULT; |
770 | } |
771 | |
772 | + if (in_size < 6 || |
773 | + in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) { |
774 | + mutex_unlock(&priv->buffer_mutex); |
775 | + return -EINVAL; |
776 | + } |
777 | + |
778 | /* atomic tpm command send and result receive. We only hold the ops |
779 | * lock during this period so that the tpm can be unregistered even if |
780 | * the char dev is held open. |
781 | diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c |
782 | index 62ee44e57ddc..da69ddea56cf 100644 |
783 | --- a/drivers/char/tpm/tpm_i2c_infineon.c |
784 | +++ b/drivers/char/tpm/tpm_i2c_infineon.c |
785 | @@ -437,7 +437,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) |
786 | static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
787 | { |
788 | int size = 0; |
789 | - int expected, status; |
790 | + int status; |
791 | + u32 expected; |
792 | |
793 | if (count < TPM_HEADER_SIZE) { |
794 | size = -EIO; |
795 | @@ -452,7 +453,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
796 | } |
797 | |
798 | expected = be32_to_cpu(*(__be32 *)(buf + 2)); |
799 | - if ((size_t) expected > count) { |
800 | + if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) { |
801 | size = -EIO; |
802 | goto out; |
803 | } |
804 | diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c |
805 | index c6428771841f..caa86b19c76d 100644 |
806 | --- a/drivers/char/tpm/tpm_i2c_nuvoton.c |
807 | +++ b/drivers/char/tpm/tpm_i2c_nuvoton.c |
808 | @@ -281,7 +281,11 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
809 | struct device *dev = chip->dev.parent; |
810 | struct i2c_client *client = to_i2c_client(dev); |
811 | s32 rc; |
812 | - int expected, status, burst_count, retries, size = 0; |
813 | + int status; |
814 | + int burst_count; |
815 | + int retries; |
816 | + int size = 0; |
817 | + u32 expected; |
818 | |
819 | if (count < TPM_HEADER_SIZE) { |
820 | i2c_nuvoton_ready(chip); /* return to idle */ |
821 | @@ -323,7 +327,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
822 | * to machine native |
823 | */ |
824 | expected = be32_to_cpu(*(__be32 *) (buf + 2)); |
825 | - if (expected > count) { |
826 | + if (expected > count || expected < size) { |
827 | dev_err(dev, "%s() expected > count\n", __func__); |
828 | size = -EIO; |
829 | continue; |
830 | diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c |
831 | index 8022bea27fed..06173d2e316f 100644 |
832 | --- a/drivers/char/tpm/tpm_tis.c |
833 | +++ b/drivers/char/tpm/tpm_tis.c |
834 | @@ -98,7 +98,7 @@ static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len, |
835 | } |
836 | |
837 | static int tpm_tcg_write_bytes(struct tpm_tis_data *data, u32 addr, u16 len, |
838 | - u8 *value) |
839 | + const u8 *value) |
840 | { |
841 | struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); |
842 | |
843 | diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c |
844 | index 4d24ec3d7cd6..f9aa47ec7af7 100644 |
845 | --- a/drivers/char/tpm/tpm_tis_core.c |
846 | +++ b/drivers/char/tpm/tpm_tis_core.c |
847 | @@ -208,7 +208,8 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
848 | { |
849 | struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); |
850 | int size = 0; |
851 | - int expected, status; |
852 | + int status; |
853 | + u32 expected; |
854 | |
855 | if (count < TPM_HEADER_SIZE) { |
856 | size = -EIO; |
857 | @@ -223,7 +224,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
858 | } |
859 | |
860 | expected = be32_to_cpu(*(__be32 *) (buf + 2)); |
861 | - if (expected > count) { |
862 | + if (expected > count || expected < TPM_HEADER_SIZE) { |
863 | size = -EIO; |
864 | goto out; |
865 | } |
866 | @@ -256,7 +257,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) |
867 | * tpm.c can skip polling for the data to be available as the interrupt is |
868 | * waited for here |
869 | */ |
870 | -static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len) |
871 | +static int tpm_tis_send_data(struct tpm_chip *chip, const u8 *buf, size_t len) |
872 | { |
873 | struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); |
874 | int rc, status, burstcnt; |
875 | @@ -345,7 +346,7 @@ static void disable_interrupts(struct tpm_chip *chip) |
876 | * tpm.c can skip polling for the data to be available as the interrupt is |
877 | * waited for here |
878 | */ |
879 | -static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len) |
880 | +static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len) |
881 | { |
882 | struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); |
883 | int rc; |
884 | diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h |
885 | index 9191aabbf9c2..e1c2193f2ed3 100644 |
886 | --- a/drivers/char/tpm/tpm_tis_core.h |
887 | +++ b/drivers/char/tpm/tpm_tis_core.h |
888 | @@ -98,7 +98,7 @@ struct tpm_tis_phy_ops { |
889 | int (*read_bytes)(struct tpm_tis_data *data, u32 addr, u16 len, |
890 | u8 *result); |
891 | int (*write_bytes)(struct tpm_tis_data *data, u32 addr, u16 len, |
892 | - u8 *value); |
893 | + const u8 *value); |
894 | int (*read16)(struct tpm_tis_data *data, u32 addr, u16 *result); |
895 | int (*read32)(struct tpm_tis_data *data, u32 addr, u32 *result); |
896 | int (*write32)(struct tpm_tis_data *data, u32 addr, u32 src); |
897 | @@ -128,7 +128,7 @@ static inline int tpm_tis_read32(struct tpm_tis_data *data, u32 addr, |
898 | } |
899 | |
900 | static inline int tpm_tis_write_bytes(struct tpm_tis_data *data, u32 addr, |
901 | - u16 len, u8 *value) |
902 | + u16 len, const u8 *value) |
903 | { |
904 | return data->phy_ops->write_bytes(data, addr, len, value); |
905 | } |
906 | diff --git a/drivers/char/tpm/tpm_tis_spi.c b/drivers/char/tpm/tpm_tis_spi.c |
907 | index 3b97b14c3417..01eccb193b5a 100644 |
908 | --- a/drivers/char/tpm/tpm_tis_spi.c |
909 | +++ b/drivers/char/tpm/tpm_tis_spi.c |
910 | @@ -47,9 +47,7 @@ |
911 | struct tpm_tis_spi_phy { |
912 | struct tpm_tis_data priv; |
913 | struct spi_device *spi_device; |
914 | - |
915 | - u8 tx_buf[4]; |
916 | - u8 rx_buf[4]; |
917 | + u8 *iobuf; |
918 | }; |
919 | |
920 | static inline struct tpm_tis_spi_phy *to_tpm_tis_spi_phy(struct tpm_tis_data *data) |
921 | @@ -58,7 +56,7 @@ static inline struct tpm_tis_spi_phy *to_tpm_tis_spi_phy(struct tpm_tis_data *da |
922 | } |
923 | |
924 | static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
925 | - u8 *buffer, u8 direction) |
926 | + u8 *in, const u8 *out) |
927 | { |
928 | struct tpm_tis_spi_phy *phy = to_tpm_tis_spi_phy(data); |
929 | int ret = 0; |
930 | @@ -72,14 +70,14 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
931 | while (len) { |
932 | transfer_len = min_t(u16, len, MAX_SPI_FRAMESIZE); |
933 | |
934 | - phy->tx_buf[0] = direction | (transfer_len - 1); |
935 | - phy->tx_buf[1] = 0xd4; |
936 | - phy->tx_buf[2] = addr >> 8; |
937 | - phy->tx_buf[3] = addr; |
938 | + phy->iobuf[0] = (in ? 0x80 : 0) | (transfer_len - 1); |
939 | + phy->iobuf[1] = 0xd4; |
940 | + phy->iobuf[2] = addr >> 8; |
941 | + phy->iobuf[3] = addr; |
942 | |
943 | memset(&spi_xfer, 0, sizeof(spi_xfer)); |
944 | - spi_xfer.tx_buf = phy->tx_buf; |
945 | - spi_xfer.rx_buf = phy->rx_buf; |
946 | + spi_xfer.tx_buf = phy->iobuf; |
947 | + spi_xfer.rx_buf = phy->iobuf; |
948 | spi_xfer.len = 4; |
949 | spi_xfer.cs_change = 1; |
950 | |
951 | @@ -89,9 +87,9 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
952 | if (ret < 0) |
953 | goto exit; |
954 | |
955 | - if ((phy->rx_buf[3] & 0x01) == 0) { |
956 | + if ((phy->iobuf[3] & 0x01) == 0) { |
957 | // handle SPI wait states |
958 | - phy->tx_buf[0] = 0; |
959 | + phy->iobuf[0] = 0; |
960 | |
961 | for (i = 0; i < TPM_RETRY; i++) { |
962 | spi_xfer.len = 1; |
963 | @@ -100,7 +98,7 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
964 | ret = spi_sync_locked(phy->spi_device, &m); |
965 | if (ret < 0) |
966 | goto exit; |
967 | - if (phy->rx_buf[0] & 0x01) |
968 | + if (phy->iobuf[0] & 0x01) |
969 | break; |
970 | } |
971 | |
972 | @@ -114,12 +112,12 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
973 | spi_xfer.len = transfer_len; |
974 | spi_xfer.delay_usecs = 5; |
975 | |
976 | - if (direction) { |
977 | + if (in) { |
978 | spi_xfer.tx_buf = NULL; |
979 | - spi_xfer.rx_buf = buffer; |
980 | - } else { |
981 | - spi_xfer.tx_buf = buffer; |
982 | + } else if (out) { |
983 | spi_xfer.rx_buf = NULL; |
984 | + memcpy(phy->iobuf, out, transfer_len); |
985 | + out += transfer_len; |
986 | } |
987 | |
988 | spi_message_init(&m); |
989 | @@ -128,8 +126,12 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
990 | if (ret < 0) |
991 | goto exit; |
992 | |
993 | + if (in) { |
994 | + memcpy(in, phy->iobuf, transfer_len); |
995 | + in += transfer_len; |
996 | + } |
997 | + |
998 | len -= transfer_len; |
999 | - buffer += transfer_len; |
1000 | } |
1001 | |
1002 | exit: |
1003 | @@ -140,13 +142,13 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, |
1004 | static int tpm_tis_spi_read_bytes(struct tpm_tis_data *data, u32 addr, |
1005 | u16 len, u8 *result) |
1006 | { |
1007 | - return tpm_tis_spi_transfer(data, addr, len, result, 0x80); |
1008 | + return tpm_tis_spi_transfer(data, addr, len, result, NULL); |
1009 | } |
1010 | |
1011 | static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr, |
1012 | - u16 len, u8 *value) |
1013 | + u16 len, const u8 *value) |
1014 | { |
1015 | - return tpm_tis_spi_transfer(data, addr, len, value, 0); |
1016 | + return tpm_tis_spi_transfer(data, addr, len, NULL, value); |
1017 | } |
1018 | |
1019 | static int tpm_tis_spi_read16(struct tpm_tis_data *data, u32 addr, u16 *result) |
1020 | @@ -195,6 +197,10 @@ static int tpm_tis_spi_probe(struct spi_device *dev) |
1021 | |
1022 | phy->spi_device = dev; |
1023 | |
1024 | + phy->iobuf = devm_kmalloc(&dev->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); |
1025 | + if (!phy->iobuf) |
1026 | + return -ENOMEM; |
1027 | + |
1028 | return tpm_tis_core_init(&dev->dev, &phy->priv, -1, &tpm_spi_phy_ops, |
1029 | NULL); |
1030 | } |
1031 | diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c |
1032 | index 7b596fa38ad2..6bebc1f9f55a 100644 |
1033 | --- a/drivers/cpufreq/s3c24xx-cpufreq.c |
1034 | +++ b/drivers/cpufreq/s3c24xx-cpufreq.c |
1035 | @@ -351,7 +351,13 @@ struct clk *s3c_cpufreq_clk_get(struct device *dev, const char *name) |
1036 | static int s3c_cpufreq_init(struct cpufreq_policy *policy) |
1037 | { |
1038 | policy->clk = clk_arm; |
1039 | - return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency); |
1040 | + |
1041 | + policy->cpuinfo.transition_latency = cpu_cur.info->latency; |
1042 | + |
1043 | + if (ftab) |
1044 | + return cpufreq_table_validate_and_show(policy, ftab); |
1045 | + |
1046 | + return 0; |
1047 | } |
1048 | |
1049 | static int __init s3c_cpufreq_initclks(void) |
1050 | diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c |
1051 | index 0bf1a12e35fe..ee6045d6c0bb 100644 |
1052 | --- a/drivers/md/dm-io.c |
1053 | +++ b/drivers/md/dm-io.c |
1054 | @@ -302,6 +302,7 @@ static void do_region(int op, int op_flags, unsigned region, |
1055 | special_cmd_max_sectors = q->limits.max_write_same_sectors; |
1056 | if ((op == REQ_OP_DISCARD || op == REQ_OP_WRITE_SAME) && |
1057 | special_cmd_max_sectors == 0) { |
1058 | + atomic_inc(&io->count); |
1059 | dec_count(io, region, -EOPNOTSUPP); |
1060 | return; |
1061 | } |
1062 | diff --git a/drivers/md/md.c b/drivers/md/md.c |
1063 | index 8ebf1b97e1d2..27d8bb21e04f 100644 |
1064 | --- a/drivers/md/md.c |
1065 | +++ b/drivers/md/md.c |
1066 | @@ -8224,6 +8224,10 @@ static int remove_and_add_spares(struct mddev *mddev, |
1067 | int removed = 0; |
1068 | bool remove_some = false; |
1069 | |
1070 | + if (this && test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) |
1071 | + /* Mustn't remove devices when resync thread is running */ |
1072 | + return 0; |
1073 | + |
1074 | rdev_for_each(rdev, mddev) { |
1075 | if ((this == NULL || rdev == this) && |
1076 | rdev->raid_disk >= 0 && |
1077 | diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c |
1078 | index e0fe5bc9dbce..31f16105184c 100644 |
1079 | --- a/drivers/media/dvb-frontends/m88ds3103.c |
1080 | +++ b/drivers/media/dvb-frontends/m88ds3103.c |
1081 | @@ -1262,11 +1262,12 @@ static int m88ds3103_select(struct i2c_mux_core *muxc, u32 chan) |
1082 | * New users must use I2C client binding directly! |
1083 | */ |
1084 | struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg, |
1085 | - struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter) |
1086 | + struct i2c_adapter *i2c, |
1087 | + struct i2c_adapter **tuner_i2c_adapter) |
1088 | { |
1089 | struct i2c_client *client; |
1090 | struct i2c_board_info board_info; |
1091 | - struct m88ds3103_platform_data pdata; |
1092 | + struct m88ds3103_platform_data pdata = {}; |
1093 | |
1094 | pdata.clk = cfg->clock; |
1095 | pdata.i2c_wr_max = cfg->i2c_wr_max; |
1096 | @@ -1409,6 +1410,8 @@ static int m88ds3103_probe(struct i2c_client *client, |
1097 | case M88DS3103_CHIP_ID: |
1098 | break; |
1099 | default: |
1100 | + ret = -ENODEV; |
1101 | + dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id); |
1102 | goto err_kfree; |
1103 | } |
1104 | |
1105 | diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |
1106 | index 1e2c8eca3af1..bea9ae31a769 100644 |
1107 | --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |
1108 | +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |
1109 | @@ -809,6 +809,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, |
1110 | bool dynamic) |
1111 | { |
1112 | char *sfd_pl; |
1113 | + u8 num_rec; |
1114 | int err; |
1115 | |
1116 | sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL); |
1117 | @@ -818,9 +819,16 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, |
1118 | mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); |
1119 | mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), |
1120 | mac, fid, action, local_port); |
1121 | + num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); |
1122 | err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); |
1123 | - kfree(sfd_pl); |
1124 | + if (err) |
1125 | + goto out; |
1126 | + |
1127 | + if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl)) |
1128 | + err = -EBUSY; |
1129 | |
1130 | +out: |
1131 | + kfree(sfd_pl); |
1132 | return err; |
1133 | } |
1134 | |
1135 | @@ -845,6 +853,7 @@ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, |
1136 | bool adding, bool dynamic) |
1137 | { |
1138 | char *sfd_pl; |
1139 | + u8 num_rec; |
1140 | int err; |
1141 | |
1142 | sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL); |
1143 | @@ -855,9 +864,16 @@ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, |
1144 | mlxsw_reg_sfd_uc_lag_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), |
1145 | mac, fid, MLXSW_REG_SFD_REC_ACTION_NOP, |
1146 | lag_vid, lag_id); |
1147 | + num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); |
1148 | err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); |
1149 | - kfree(sfd_pl); |
1150 | + if (err) |
1151 | + goto out; |
1152 | + |
1153 | + if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl)) |
1154 | + err = -EBUSY; |
1155 | |
1156 | +out: |
1157 | + kfree(sfd_pl); |
1158 | return err; |
1159 | } |
1160 | |
1161 | @@ -891,6 +907,7 @@ static int mlxsw_sp_port_mdb_op(struct mlxsw_sp *mlxsw_sp, const char *addr, |
1162 | u16 fid, u16 mid, bool adding) |
1163 | { |
1164 | char *sfd_pl; |
1165 | + u8 num_rec; |
1166 | int err; |
1167 | |
1168 | sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL); |
1169 | @@ -900,7 +917,15 @@ static int mlxsw_sp_port_mdb_op(struct mlxsw_sp *mlxsw_sp, const char *addr, |
1170 | mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); |
1171 | mlxsw_reg_sfd_mc_pack(sfd_pl, 0, addr, fid, |
1172 | MLXSW_REG_SFD_REC_ACTION_NOP, mid); |
1173 | + num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); |
1174 | err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); |
1175 | + if (err) |
1176 | + goto out; |
1177 | + |
1178 | + if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl)) |
1179 | + err = -EBUSY; |
1180 | + |
1181 | +out: |
1182 | kfree(sfd_pl); |
1183 | return err; |
1184 | } |
1185 | diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c |
1186 | index 6e12401b5102..e2d9ca60e467 100644 |
1187 | --- a/drivers/net/phy/phy.c |
1188 | +++ b/drivers/net/phy/phy.c |
1189 | @@ -925,7 +925,7 @@ void phy_start(struct phy_device *phydev) |
1190 | break; |
1191 | case PHY_HALTED: |
1192 | /* make sure interrupts are re-enabled for the PHY */ |
1193 | - if (phydev->irq != PHY_POLL) { |
1194 | + if (phy_interrupt_is_valid(phydev)) { |
1195 | err = phy_enable_interrupts(phydev); |
1196 | if (err < 0) |
1197 | break; |
1198 | diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c |
1199 | index fc4c2ccc3d22..114457921890 100644 |
1200 | --- a/drivers/net/ppp/ppp_generic.c |
1201 | +++ b/drivers/net/ppp/ppp_generic.c |
1202 | @@ -3157,6 +3157,15 @@ ppp_connect_channel(struct channel *pch, int unit) |
1203 | goto outl; |
1204 | |
1205 | ppp_lock(ppp); |
1206 | + spin_lock_bh(&pch->downl); |
1207 | + if (!pch->chan) { |
1208 | + /* Don't connect unregistered channels */ |
1209 | + spin_unlock_bh(&pch->downl); |
1210 | + ppp_unlock(ppp); |
1211 | + ret = -ENOTCONN; |
1212 | + goto outl; |
1213 | + } |
1214 | + spin_unlock_bh(&pch->downl); |
1215 | if (pch->file.hdrlen > ppp->file.hdrlen) |
1216 | ppp->file.hdrlen = pch->file.hdrlen; |
1217 | hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */ |
1218 | diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c |
1219 | index 47fdb87d3567..8a9aced850be 100644 |
1220 | --- a/drivers/net/wan/hdlc_ppp.c |
1221 | +++ b/drivers/net/wan/hdlc_ppp.c |
1222 | @@ -574,7 +574,10 @@ static void ppp_timer(unsigned long arg) |
1223 | ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0, |
1224 | 0, NULL); |
1225 | proto->restart_counter--; |
1226 | - } else |
1227 | + } else if (netif_carrier_ok(proto->dev)) |
1228 | + ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0, |
1229 | + 0, NULL); |
1230 | + else |
1231 | ppp_cp_event(proto->dev, proto->pid, TO_BAD, 0, 0, |
1232 | 0, NULL); |
1233 | break; |
1234 | diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c |
1235 | index b0916b126923..6643a7bc381c 100644 |
1236 | --- a/drivers/pci/pcie/aspm.c |
1237 | +++ b/drivers/pci/pcie/aspm.c |
1238 | @@ -526,10 +526,14 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev) |
1239 | |
1240 | /* |
1241 | * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe |
1242 | - * hierarchies. |
1243 | + * hierarchies. Note that some PCIe host implementations omit |
1244 | + * the root ports entirely, in which case a downstream port on |
1245 | + * a switch may become the root of the link state chain for all |
1246 | + * its subordinate endpoints. |
1247 | */ |
1248 | if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT || |
1249 | - pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) { |
1250 | + pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE || |
1251 | + !pdev->bus->parent->self) { |
1252 | link->root = link; |
1253 | } else { |
1254 | struct pcie_link_state *parent; |
1255 | diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h |
1256 | index 9b5fc502f6a1..403712bf1ddf 100644 |
1257 | --- a/drivers/s390/net/qeth_core.h |
1258 | +++ b/drivers/s390/net/qeth_core.h |
1259 | @@ -592,6 +592,11 @@ struct qeth_cmd_buffer { |
1260 | void (*callback) (struct qeth_channel *, struct qeth_cmd_buffer *); |
1261 | }; |
1262 | |
1263 | +static inline struct qeth_ipa_cmd *__ipa_cmd(struct qeth_cmd_buffer *iob) |
1264 | +{ |
1265 | + return (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE); |
1266 | +} |
1267 | + |
1268 | /** |
1269 | * definition of a qeth channel, used for read and write |
1270 | */ |
1271 | @@ -849,7 +854,7 @@ struct qeth_trap_id { |
1272 | */ |
1273 | static inline int qeth_get_elements_for_range(addr_t start, addr_t end) |
1274 | { |
1275 | - return PFN_UP(end - 1) - PFN_DOWN(start); |
1276 | + return PFN_UP(end) - PFN_DOWN(start); |
1277 | } |
1278 | |
1279 | static inline int qeth_get_micros(void) |
1280 | diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c |
1281 | index df8f74cb1406..cc28dda322b5 100644 |
1282 | --- a/drivers/s390/net/qeth_core_main.c |
1283 | +++ b/drivers/s390/net/qeth_core_main.c |
1284 | @@ -2050,7 +2050,7 @@ int qeth_send_control_data(struct qeth_card *card, int len, |
1285 | unsigned long flags; |
1286 | struct qeth_reply *reply = NULL; |
1287 | unsigned long timeout, event_timeout; |
1288 | - struct qeth_ipa_cmd *cmd; |
1289 | + struct qeth_ipa_cmd *cmd = NULL; |
1290 | |
1291 | QETH_CARD_TEXT(card, 2, "sendctl"); |
1292 | |
1293 | @@ -2064,23 +2064,27 @@ int qeth_send_control_data(struct qeth_card *card, int len, |
1294 | } |
1295 | reply->callback = reply_cb; |
1296 | reply->param = reply_param; |
1297 | - if (card->state == CARD_STATE_DOWN) |
1298 | - reply->seqno = QETH_IDX_COMMAND_SEQNO; |
1299 | - else |
1300 | - reply->seqno = card->seqno.ipa++; |
1301 | + |
1302 | init_waitqueue_head(&reply->wait_q); |
1303 | - spin_lock_irqsave(&card->lock, flags); |
1304 | - list_add_tail(&reply->list, &card->cmd_waiter_list); |
1305 | - spin_unlock_irqrestore(&card->lock, flags); |
1306 | QETH_DBF_HEX(CTRL, 2, iob->data, QETH_DBF_CTRL_LEN); |
1307 | |
1308 | while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ; |
1309 | - qeth_prepare_control_data(card, len, iob); |
1310 | |
1311 | - if (IS_IPA(iob->data)) |
1312 | + if (IS_IPA(iob->data)) { |
1313 | + cmd = __ipa_cmd(iob); |
1314 | + cmd->hdr.seqno = card->seqno.ipa++; |
1315 | + reply->seqno = cmd->hdr.seqno; |
1316 | event_timeout = QETH_IPA_TIMEOUT; |
1317 | - else |
1318 | + } else { |
1319 | + reply->seqno = QETH_IDX_COMMAND_SEQNO; |
1320 | event_timeout = QETH_TIMEOUT; |
1321 | + } |
1322 | + qeth_prepare_control_data(card, len, iob); |
1323 | + |
1324 | + spin_lock_irqsave(&card->lock, flags); |
1325 | + list_add_tail(&reply->list, &card->cmd_waiter_list); |
1326 | + spin_unlock_irqrestore(&card->lock, flags); |
1327 | + |
1328 | timeout = jiffies + event_timeout; |
1329 | |
1330 | QETH_CARD_TEXT(card, 6, "noirqpnd"); |
1331 | @@ -2105,9 +2109,8 @@ int qeth_send_control_data(struct qeth_card *card, int len, |
1332 | |
1333 | /* we have only one long running ipassist, since we can ensure |
1334 | process context of this command we can sleep */ |
1335 | - cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE); |
1336 | - if ((cmd->hdr.command == IPA_CMD_SETIP) && |
1337 | - (cmd->hdr.prot_version == QETH_PROT_IPV4)) { |
1338 | + if (cmd && cmd->hdr.command == IPA_CMD_SETIP && |
1339 | + cmd->hdr.prot_version == QETH_PROT_IPV4) { |
1340 | if (!wait_event_timeout(reply->wait_q, |
1341 | atomic_read(&reply->received), event_timeout)) |
1342 | goto time_err; |
1343 | @@ -2871,7 +2874,7 @@ static void qeth_fill_ipacmd_header(struct qeth_card *card, |
1344 | memset(cmd, 0, sizeof(struct qeth_ipa_cmd)); |
1345 | cmd->hdr.command = command; |
1346 | cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST; |
1347 | - cmd->hdr.seqno = card->seqno.ipa; |
1348 | + /* cmd->hdr.seqno is set by qeth_send_control_data() */ |
1349 | cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type); |
1350 | cmd->hdr.rel_adapter_no = (__u8) card->info.portno; |
1351 | if (card->options.layer2) |
1352 | @@ -3852,10 +3855,12 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags); |
1353 | int qeth_get_elements_no(struct qeth_card *card, |
1354 | struct sk_buff *skb, int extra_elems, int data_offset) |
1355 | { |
1356 | - int elements = qeth_get_elements_for_range( |
1357 | - (addr_t)skb->data + data_offset, |
1358 | - (addr_t)skb->data + skb_headlen(skb)) + |
1359 | - qeth_get_elements_for_frags(skb); |
1360 | + addr_t end = (addr_t)skb->data + skb_headlen(skb); |
1361 | + int elements = qeth_get_elements_for_frags(skb); |
1362 | + addr_t start = (addr_t)skb->data + data_offset; |
1363 | + |
1364 | + if (start != end) |
1365 | + elements += qeth_get_elements_for_range(start, end); |
1366 | |
1367 | if ((elements + extra_elems) > QETH_MAX_BUFFER_ELEMENTS(card)) { |
1368 | QETH_DBF_MESSAGE(2, "Invalid size of IP packet " |
1369 | diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h |
1370 | index eedf9b01a496..573569474e44 100644 |
1371 | --- a/drivers/s390/net/qeth_l3.h |
1372 | +++ b/drivers/s390/net/qeth_l3.h |
1373 | @@ -39,8 +39,40 @@ struct qeth_ipaddr { |
1374 | unsigned int pfxlen; |
1375 | } a6; |
1376 | } u; |
1377 | - |
1378 | }; |
1379 | + |
1380 | +static inline bool qeth_l3_addr_match_ip(struct qeth_ipaddr *a1, |
1381 | + struct qeth_ipaddr *a2) |
1382 | +{ |
1383 | + if (a1->proto != a2->proto) |
1384 | + return false; |
1385 | + if (a1->proto == QETH_PROT_IPV6) |
1386 | + return ipv6_addr_equal(&a1->u.a6.addr, &a2->u.a6.addr); |
1387 | + return a1->u.a4.addr == a2->u.a4.addr; |
1388 | +} |
1389 | + |
1390 | +static inline bool qeth_l3_addr_match_all(struct qeth_ipaddr *a1, |
1391 | + struct qeth_ipaddr *a2) |
1392 | +{ |
1393 | + /* Assumes that the pair was obtained via qeth_l3_addr_find_by_ip(), |
1394 | + * so 'proto' and 'addr' match for sure. |
1395 | + * |
1396 | + * For ucast: |
1397 | + * - 'mac' is always 0. |
1398 | + * - 'mask'/'pfxlen' for RXIP/VIPA is always 0. For NORMAL, matching |
1399 | + * values are required to avoid mixups in takeover eligibility. |
1400 | + * |
1401 | + * For mcast, |
1402 | + * - 'mac' is mapped from the IP, and thus always matches. |
1403 | + * - 'mask'/'pfxlen' is always 0. |
1404 | + */ |
1405 | + if (a1->type != a2->type) |
1406 | + return false; |
1407 | + if (a1->proto == QETH_PROT_IPV6) |
1408 | + return a1->u.a6.pfxlen == a2->u.a6.pfxlen; |
1409 | + return a1->u.a4.mask == a2->u.a4.mask; |
1410 | +} |
1411 | + |
1412 | static inline u64 qeth_l3_ipaddr_hash(struct qeth_ipaddr *addr) |
1413 | { |
1414 | u64 ret = 0; |
1415 | diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c |
1416 | index 1487f8a0c575..a668e6b71a29 100644 |
1417 | --- a/drivers/s390/net/qeth_l3_main.c |
1418 | +++ b/drivers/s390/net/qeth_l3_main.c |
1419 | @@ -154,6 +154,24 @@ int qeth_l3_string_to_ipaddr(const char *buf, enum qeth_prot_versions proto, |
1420 | return -EINVAL; |
1421 | } |
1422 | |
1423 | +static struct qeth_ipaddr *qeth_l3_find_addr_by_ip(struct qeth_card *card, |
1424 | + struct qeth_ipaddr *query) |
1425 | +{ |
1426 | + u64 key = qeth_l3_ipaddr_hash(query); |
1427 | + struct qeth_ipaddr *addr; |
1428 | + |
1429 | + if (query->is_multicast) { |
1430 | + hash_for_each_possible(card->ip_mc_htable, addr, hnode, key) |
1431 | + if (qeth_l3_addr_match_ip(addr, query)) |
1432 | + return addr; |
1433 | + } else { |
1434 | + hash_for_each_possible(card->ip_htable, addr, hnode, key) |
1435 | + if (qeth_l3_addr_match_ip(addr, query)) |
1436 | + return addr; |
1437 | + } |
1438 | + return NULL; |
1439 | +} |
1440 | + |
1441 | static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len) |
1442 | { |
1443 | int i, j; |
1444 | @@ -207,34 +225,6 @@ static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card, |
1445 | return rc; |
1446 | } |
1447 | |
1448 | -inline int |
1449 | -qeth_l3_ipaddrs_is_equal(struct qeth_ipaddr *addr1, struct qeth_ipaddr *addr2) |
1450 | -{ |
1451 | - return addr1->proto == addr2->proto && |
1452 | - !memcmp(&addr1->u, &addr2->u, sizeof(addr1->u)) && |
1453 | - !memcmp(&addr1->mac, &addr2->mac, sizeof(addr1->mac)); |
1454 | -} |
1455 | - |
1456 | -static struct qeth_ipaddr * |
1457 | -qeth_l3_ip_from_hash(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1458 | -{ |
1459 | - struct qeth_ipaddr *addr; |
1460 | - |
1461 | - if (tmp_addr->is_multicast) { |
1462 | - hash_for_each_possible(card->ip_mc_htable, addr, |
1463 | - hnode, qeth_l3_ipaddr_hash(tmp_addr)) |
1464 | - if (qeth_l3_ipaddrs_is_equal(tmp_addr, addr)) |
1465 | - return addr; |
1466 | - } else { |
1467 | - hash_for_each_possible(card->ip_htable, addr, |
1468 | - hnode, qeth_l3_ipaddr_hash(tmp_addr)) |
1469 | - if (qeth_l3_ipaddrs_is_equal(tmp_addr, addr)) |
1470 | - return addr; |
1471 | - } |
1472 | - |
1473 | - return NULL; |
1474 | -} |
1475 | - |
1476 | int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1477 | { |
1478 | int rc = 0; |
1479 | @@ -249,8 +239,8 @@ int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1480 | QETH_CARD_HEX(card, 4, ((char *)&tmp_addr->u.a6.addr) + 8, 8); |
1481 | } |
1482 | |
1483 | - addr = qeth_l3_ip_from_hash(card, tmp_addr); |
1484 | - if (!addr) |
1485 | + addr = qeth_l3_find_addr_by_ip(card, tmp_addr); |
1486 | + if (!addr || !qeth_l3_addr_match_all(addr, tmp_addr)) |
1487 | return -ENOENT; |
1488 | |
1489 | addr->ref_counter--; |
1490 | @@ -259,12 +249,8 @@ int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1491 | if (addr->in_progress) |
1492 | return -EINPROGRESS; |
1493 | |
1494 | - if (!qeth_card_hw_is_reachable(card)) { |
1495 | - addr->disp_flag = QETH_DISP_ADDR_DELETE; |
1496 | - return 0; |
1497 | - } |
1498 | - |
1499 | - rc = qeth_l3_deregister_addr_entry(card, addr); |
1500 | + if (qeth_card_hw_is_reachable(card)) |
1501 | + rc = qeth_l3_deregister_addr_entry(card, addr); |
1502 | |
1503 | hash_del(&addr->hnode); |
1504 | kfree(addr); |
1505 | @@ -276,6 +262,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1506 | { |
1507 | int rc = 0; |
1508 | struct qeth_ipaddr *addr; |
1509 | + char buf[40]; |
1510 | |
1511 | QETH_CARD_TEXT(card, 4, "addip"); |
1512 | |
1513 | @@ -286,8 +273,20 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1514 | QETH_CARD_HEX(card, 4, ((char *)&tmp_addr->u.a6.addr) + 8, 8); |
1515 | } |
1516 | |
1517 | - addr = qeth_l3_ip_from_hash(card, tmp_addr); |
1518 | - if (!addr) { |
1519 | + addr = qeth_l3_find_addr_by_ip(card, tmp_addr); |
1520 | + if (addr) { |
1521 | + if (tmp_addr->type != QETH_IP_TYPE_NORMAL) |
1522 | + return -EADDRINUSE; |
1523 | + if (qeth_l3_addr_match_all(addr, tmp_addr)) { |
1524 | + addr->ref_counter++; |
1525 | + return 0; |
1526 | + } |
1527 | + qeth_l3_ipaddr_to_string(tmp_addr->proto, (u8 *)&tmp_addr->u, |
1528 | + buf); |
1529 | + dev_warn(&card->gdev->dev, |
1530 | + "Registering IP address %s failed\n", buf); |
1531 | + return -EADDRINUSE; |
1532 | + } else { |
1533 | addr = qeth_l3_get_addr_buffer(tmp_addr->proto); |
1534 | if (!addr) |
1535 | return -ENOMEM; |
1536 | @@ -327,18 +326,15 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) |
1537 | (rc == IPA_RC_LAN_OFFLINE)) { |
1538 | addr->disp_flag = QETH_DISP_ADDR_DO_NOTHING; |
1539 | if (addr->ref_counter < 1) { |
1540 | - qeth_l3_delete_ip(card, addr); |
1541 | + qeth_l3_deregister_addr_entry(card, addr); |
1542 | + hash_del(&addr->hnode); |
1543 | kfree(addr); |
1544 | } |
1545 | } else { |
1546 | hash_del(&addr->hnode); |
1547 | kfree(addr); |
1548 | } |
1549 | - } else { |
1550 | - if (addr->type == QETH_IP_TYPE_NORMAL) |
1551 | - addr->ref_counter++; |
1552 | } |
1553 | - |
1554 | return rc; |
1555 | } |
1556 | |
1557 | @@ -406,11 +402,7 @@ static void qeth_l3_recover_ip(struct qeth_card *card) |
1558 | spin_lock_bh(&card->ip_lock); |
1559 | |
1560 | hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) { |
1561 | - if (addr->disp_flag == QETH_DISP_ADDR_DELETE) { |
1562 | - qeth_l3_deregister_addr_entry(card, addr); |
1563 | - hash_del(&addr->hnode); |
1564 | - kfree(addr); |
1565 | - } else if (addr->disp_flag == QETH_DISP_ADDR_ADD) { |
1566 | + if (addr->disp_flag == QETH_DISP_ADDR_ADD) { |
1567 | if (addr->proto == QETH_PROT_IPV4) { |
1568 | addr->in_progress = 1; |
1569 | spin_unlock_bh(&card->ip_lock); |
1570 | @@ -726,12 +718,7 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto, |
1571 | return -ENOMEM; |
1572 | |
1573 | spin_lock_bh(&card->ip_lock); |
1574 | - |
1575 | - if (qeth_l3_ip_from_hash(card, ipaddr)) |
1576 | - rc = -EEXIST; |
1577 | - else |
1578 | - qeth_l3_add_ip(card, ipaddr); |
1579 | - |
1580 | + rc = qeth_l3_add_ip(card, ipaddr); |
1581 | spin_unlock_bh(&card->ip_lock); |
1582 | |
1583 | kfree(ipaddr); |
1584 | @@ -794,12 +781,7 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto, |
1585 | return -ENOMEM; |
1586 | |
1587 | spin_lock_bh(&card->ip_lock); |
1588 | - |
1589 | - if (qeth_l3_ip_from_hash(card, ipaddr)) |
1590 | - rc = -EEXIST; |
1591 | - else |
1592 | - qeth_l3_add_ip(card, ipaddr); |
1593 | - |
1594 | + rc = qeth_l3_add_ip(card, ipaddr); |
1595 | spin_unlock_bh(&card->ip_lock); |
1596 | |
1597 | kfree(ipaddr); |
1598 | @@ -1444,8 +1426,9 @@ qeth_l3_add_mc_to_hash(struct qeth_card *card, struct in_device *in4_dev) |
1599 | memcpy(tmp->mac, buf, sizeof(tmp->mac)); |
1600 | tmp->is_multicast = 1; |
1601 | |
1602 | - ipm = qeth_l3_ip_from_hash(card, tmp); |
1603 | + ipm = qeth_l3_find_addr_by_ip(card, tmp); |
1604 | if (ipm) { |
1605 | + /* for mcast, by-IP match means full match */ |
1606 | ipm->disp_flag = QETH_DISP_ADDR_DO_NOTHING; |
1607 | } else { |
1608 | ipm = qeth_l3_get_addr_buffer(QETH_PROT_IPV4); |
1609 | @@ -1528,8 +1511,9 @@ qeth_l3_add_mc6_to_hash(struct qeth_card *card, struct inet6_dev *in6_dev) |
1610 | sizeof(struct in6_addr)); |
1611 | tmp->is_multicast = 1; |
1612 | |
1613 | - ipm = qeth_l3_ip_from_hash(card, tmp); |
1614 | + ipm = qeth_l3_find_addr_by_ip(card, tmp); |
1615 | if (ipm) { |
1616 | + /* for mcast, by-IP match means full match */ |
1617 | ipm->disp_flag = QETH_DISP_ADDR_DO_NOTHING; |
1618 | continue; |
1619 | } |
1620 | @@ -2784,11 +2768,12 @@ static void qeth_tso_fill_header(struct qeth_card *card, |
1621 | static int qeth_l3_get_elements_no_tso(struct qeth_card *card, |
1622 | struct sk_buff *skb, int extra_elems) |
1623 | { |
1624 | - addr_t tcpdptr = (addr_t)tcp_hdr(skb) + tcp_hdrlen(skb); |
1625 | - int elements = qeth_get_elements_for_range( |
1626 | - tcpdptr, |
1627 | - (addr_t)skb->data + skb_headlen(skb)) + |
1628 | - qeth_get_elements_for_frags(skb); |
1629 | + addr_t start = (addr_t)tcp_hdr(skb) + tcp_hdrlen(skb); |
1630 | + addr_t end = (addr_t)skb->data + skb_headlen(skb); |
1631 | + int elements = qeth_get_elements_for_frags(skb); |
1632 | + |
1633 | + if (start != end) |
1634 | + elements += qeth_get_elements_for_range(start, end); |
1635 | |
1636 | if ((elements + extra_elems) > QETH_MAX_BUFFER_ELEMENTS(card)) { |
1637 | QETH_DBF_MESSAGE(2, |
1638 | diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c |
1639 | index 8d8370ddb6b2..1ba49ebe67da 100644 |
1640 | --- a/fs/btrfs/acl.c |
1641 | +++ b/fs/btrfs/acl.c |
1642 | @@ -114,13 +114,17 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans, |
1643 | int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type) |
1644 | { |
1645 | int ret; |
1646 | + umode_t old_mode = inode->i_mode; |
1647 | |
1648 | if (type == ACL_TYPE_ACCESS && acl) { |
1649 | ret = posix_acl_update_mode(inode, &inode->i_mode, &acl); |
1650 | if (ret) |
1651 | return ret; |
1652 | } |
1653 | - return __btrfs_set_acl(NULL, inode, acl, type); |
1654 | + ret = __btrfs_set_acl(NULL, inode, acl, type); |
1655 | + if (ret) |
1656 | + inode->i_mode = old_mode; |
1657 | + return ret; |
1658 | } |
1659 | |
1660 | /* |
1661 | diff --git a/include/linux/fs.h b/include/linux/fs.h |
1662 | index 745ea1b2e02c..18552189560b 100644 |
1663 | --- a/include/linux/fs.h |
1664 | +++ b/include/linux/fs.h |
1665 | @@ -3048,7 +3048,7 @@ static inline bool vma_is_fsdax(struct vm_area_struct *vma) |
1666 | if (!vma_is_dax(vma)) |
1667 | return false; |
1668 | inode = file_inode(vma->vm_file); |
1669 | - if (inode->i_mode == S_IFCHR) |
1670 | + if (S_ISCHR(inode->i_mode)) |
1671 | return false; /* device-dax */ |
1672 | return true; |
1673 | } |
1674 | diff --git a/include/linux/nospec.h b/include/linux/nospec.h |
1675 | index fbc98e2c8228..132e3f5a2e0d 100644 |
1676 | --- a/include/linux/nospec.h |
1677 | +++ b/include/linux/nospec.h |
1678 | @@ -72,7 +72,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, |
1679 | BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ |
1680 | BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ |
1681 | \ |
1682 | - _i &= _mask; \ |
1683 | - _i; \ |
1684 | + (typeof(_i)) (_i & _mask); \ |
1685 | }) |
1686 | #endif /* _LINUX_NOSPEC_H */ |
1687 | diff --git a/include/net/udplite.h b/include/net/udplite.h |
1688 | index 80761938b9a7..8228155b305e 100644 |
1689 | --- a/include/net/udplite.h |
1690 | +++ b/include/net/udplite.h |
1691 | @@ -62,6 +62,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh) |
1692 | UDP_SKB_CB(skb)->cscov = cscov; |
1693 | if (skb->ip_summed == CHECKSUM_COMPLETE) |
1694 | skb->ip_summed = CHECKSUM_NONE; |
1695 | + skb->csum_valid = 0; |
1696 | } |
1697 | |
1698 | return 0; |
1699 | diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c |
1700 | index 9a1e6ed7babc..a38119e4a427 100644 |
1701 | --- a/kernel/bpf/arraymap.c |
1702 | +++ b/kernel/bpf/arraymap.c |
1703 | @@ -20,8 +20,10 @@ static void bpf_array_free_percpu(struct bpf_array *array) |
1704 | { |
1705 | int i; |
1706 | |
1707 | - for (i = 0; i < array->map.max_entries; i++) |
1708 | + for (i = 0; i < array->map.max_entries; i++) { |
1709 | free_percpu(array->pptrs[i]); |
1710 | + cond_resched(); |
1711 | + } |
1712 | } |
1713 | |
1714 | static int bpf_array_alloc_percpu(struct bpf_array *array) |
1715 | @@ -37,6 +39,7 @@ static int bpf_array_alloc_percpu(struct bpf_array *array) |
1716 | return -ENOMEM; |
1717 | } |
1718 | array->pptrs[i] = ptr; |
1719 | + cond_resched(); |
1720 | } |
1721 | |
1722 | return 0; |
1723 | @@ -48,8 +51,9 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) |
1724 | bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY; |
1725 | u32 elem_size, index_mask, max_entries; |
1726 | bool unpriv = !capable(CAP_SYS_ADMIN); |
1727 | + u64 cost, array_size, mask64; |
1728 | struct bpf_array *array; |
1729 | - u64 array_size, mask64; |
1730 | + int ret; |
1731 | |
1732 | /* check sanity of attributes */ |
1733 | if (attr->max_entries == 0 || attr->key_size != 4 || |
1734 | @@ -92,8 +96,19 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) |
1735 | array_size += (u64) max_entries * elem_size; |
1736 | |
1737 | /* make sure there is no u32 overflow later in round_up() */ |
1738 | - if (array_size >= U32_MAX - PAGE_SIZE) |
1739 | + cost = array_size; |
1740 | + if (cost >= U32_MAX - PAGE_SIZE) |
1741 | return ERR_PTR(-ENOMEM); |
1742 | + if (percpu) { |
1743 | + cost += (u64)attr->max_entries * elem_size * num_possible_cpus(); |
1744 | + if (cost >= U32_MAX - PAGE_SIZE) |
1745 | + return ERR_PTR(-ENOMEM); |
1746 | + } |
1747 | + cost = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT; |
1748 | + |
1749 | + ret = bpf_map_precharge_memlock(cost); |
1750 | + if (ret < 0) |
1751 | + return ERR_PTR(ret); |
1752 | |
1753 | /* allocate all map elements and zero-initialize them */ |
1754 | array = bpf_map_area_alloc(array_size); |
1755 | @@ -107,20 +122,16 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) |
1756 | array->map.key_size = attr->key_size; |
1757 | array->map.value_size = attr->value_size; |
1758 | array->map.max_entries = attr->max_entries; |
1759 | + array->map.map_flags = attr->map_flags; |
1760 | + array->map.pages = cost; |
1761 | array->elem_size = elem_size; |
1762 | |
1763 | - if (!percpu) |
1764 | - goto out; |
1765 | - |
1766 | - array_size += (u64) attr->max_entries * elem_size * num_possible_cpus(); |
1767 | - |
1768 | - if (array_size >= U32_MAX - PAGE_SIZE || |
1769 | - elem_size > PCPU_MIN_UNIT_SIZE || bpf_array_alloc_percpu(array)) { |
1770 | + if (percpu && |
1771 | + (elem_size > PCPU_MIN_UNIT_SIZE || |
1772 | + bpf_array_alloc_percpu(array))) { |
1773 | bpf_map_area_free(array); |
1774 | return ERR_PTR(-ENOMEM); |
1775 | } |
1776 | -out: |
1777 | - array->map.pages = round_up(array_size, PAGE_SIZE) >> PAGE_SHIFT; |
1778 | |
1779 | return &array->map; |
1780 | } |
1781 | diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c |
1782 | index be8519148c25..a2a232dec236 100644 |
1783 | --- a/kernel/bpf/stackmap.c |
1784 | +++ b/kernel/bpf/stackmap.c |
1785 | @@ -88,6 +88,7 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr) |
1786 | smap->map.key_size = attr->key_size; |
1787 | smap->map.value_size = value_size; |
1788 | smap->map.max_entries = attr->max_entries; |
1789 | + smap->map.map_flags = attr->map_flags; |
1790 | smap->n_buckets = n_buckets; |
1791 | smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT; |
1792 | |
1793 | diff --git a/kernel/time/timer.c b/kernel/time/timer.c |
1794 | index 2d5cc7dfee14..7c477912f36d 100644 |
1795 | --- a/kernel/time/timer.c |
1796 | +++ b/kernel/time/timer.c |
1797 | @@ -1884,6 +1884,12 @@ int timers_dead_cpu(unsigned int cpu) |
1798 | spin_lock_irq(&new_base->lock); |
1799 | spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING); |
1800 | |
1801 | + /* |
1802 | + * The current CPUs base clock might be stale. Update it |
1803 | + * before moving the timers over. |
1804 | + */ |
1805 | + forward_timer_base(new_base); |
1806 | + |
1807 | BUG_ON(old_base->running_timer); |
1808 | |
1809 | for (i = 0; i < WHEEL_SIZE; i++) |
1810 | diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c |
1811 | index 8bd569695e76..abf711112418 100644 |
1812 | --- a/net/bridge/br_sysfs_if.c |
1813 | +++ b/net/bridge/br_sysfs_if.c |
1814 | @@ -230,6 +230,9 @@ static ssize_t brport_show(struct kobject *kobj, |
1815 | struct brport_attribute *brport_attr = to_brport_attr(attr); |
1816 | struct net_bridge_port *p = to_brport(kobj); |
1817 | |
1818 | + if (!brport_attr->show) |
1819 | + return -EINVAL; |
1820 | + |
1821 | return brport_attr->show(p, buf); |
1822 | } |
1823 | |
1824 | diff --git a/net/core/dev.c b/net/core/dev.c |
1825 | index 8898618bf341..272f84ad16e0 100644 |
1826 | --- a/net/core/dev.c |
1827 | +++ b/net/core/dev.c |
1828 | @@ -2199,8 +2199,11 @@ EXPORT_SYMBOL(netif_set_xps_queue); |
1829 | */ |
1830 | int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) |
1831 | { |
1832 | + bool disabling; |
1833 | int rc; |
1834 | |
1835 | + disabling = txq < dev->real_num_tx_queues; |
1836 | + |
1837 | if (txq < 1 || txq > dev->num_tx_queues) |
1838 | return -EINVAL; |
1839 | |
1840 | @@ -2216,15 +2219,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) |
1841 | if (dev->num_tc) |
1842 | netif_setup_tc(dev, txq); |
1843 | |
1844 | - if (txq < dev->real_num_tx_queues) { |
1845 | + dev->real_num_tx_queues = txq; |
1846 | + |
1847 | + if (disabling) { |
1848 | + synchronize_net(); |
1849 | qdisc_reset_all_tx_gt(dev, txq); |
1850 | #ifdef CONFIG_XPS |
1851 | netif_reset_xps_queues_gt(dev, txq); |
1852 | #endif |
1853 | } |
1854 | + } else { |
1855 | + dev->real_num_tx_queues = txq; |
1856 | } |
1857 | |
1858 | - dev->real_num_tx_queues = txq; |
1859 | return 0; |
1860 | } |
1861 | EXPORT_SYMBOL(netif_set_real_num_tx_queues); |
1862 | diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c |
1863 | index 38c1c979ecb1..7e7b7a3efa99 100644 |
1864 | --- a/net/ipv4/fib_semantics.c |
1865 | +++ b/net/ipv4/fib_semantics.c |
1866 | @@ -640,6 +640,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi) |
1867 | fi->fib_nh, cfg)) |
1868 | return 1; |
1869 | } |
1870 | +#ifdef CONFIG_IP_ROUTE_CLASSID |
1871 | + if (cfg->fc_flow && |
1872 | + cfg->fc_flow != fi->fib_nh->nh_tclassid) |
1873 | + return 1; |
1874 | +#endif |
1875 | if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) && |
1876 | (!cfg->fc_gw || cfg->fc_gw == fi->fib_nh->nh_gw)) |
1877 | return 0; |
1878 | diff --git a/net/ipv4/route.c b/net/ipv4/route.c |
1879 | index 7ac319222558..4c9fbf4f5905 100644 |
1880 | --- a/net/ipv4/route.c |
1881 | +++ b/net/ipv4/route.c |
1882 | @@ -126,10 +126,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1)); |
1883 | static int ip_rt_error_cost __read_mostly = HZ; |
1884 | static int ip_rt_error_burst __read_mostly = 5 * HZ; |
1885 | static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ; |
1886 | -static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; |
1887 | +static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; |
1888 | static int ip_rt_min_advmss __read_mostly = 256; |
1889 | |
1890 | static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; |
1891 | + |
1892 | +static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; |
1893 | + |
1894 | /* |
1895 | * Interface to generic destination cache. |
1896 | */ |
1897 | @@ -2772,7 +2775,8 @@ static struct ctl_table ipv4_route_table[] = { |
1898 | .data = &ip_rt_min_pmtu, |
1899 | .maxlen = sizeof(int), |
1900 | .mode = 0644, |
1901 | - .proc_handler = proc_dointvec, |
1902 | + .proc_handler = proc_dointvec_minmax, |
1903 | + .extra1 = &ip_min_valid_pmtu, |
1904 | }, |
1905 | { |
1906 | .procname = "min_adv_mss", |
1907 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
1908 | index 3d7b59ecc76c..a69606031e5f 100644 |
1909 | --- a/net/ipv4/tcp_output.c |
1910 | +++ b/net/ipv4/tcp_output.c |
1911 | @@ -1580,7 +1580,7 @@ u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now, |
1912 | */ |
1913 | segs = max_t(u32, bytes / mss_now, min_tso_segs); |
1914 | |
1915 | - return min_t(u32, segs, sk->sk_gso_max_segs); |
1916 | + return segs; |
1917 | } |
1918 | EXPORT_SYMBOL(tcp_tso_autosize); |
1919 | |
1920 | @@ -1592,8 +1592,10 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now) |
1921 | const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; |
1922 | u32 tso_segs = ca_ops->tso_segs_goal ? ca_ops->tso_segs_goal(sk) : 0; |
1923 | |
1924 | - return tso_segs ? : |
1925 | - tcp_tso_autosize(sk, mss_now, sysctl_tcp_min_tso_segs); |
1926 | + if (!tso_segs) |
1927 | + tso_segs = tcp_tso_autosize(sk, mss_now, |
1928 | + sysctl_tcp_min_tso_segs); |
1929 | + return min_t(u32, tso_segs, sk->sk_gso_max_segs); |
1930 | } |
1931 | |
1932 | /* Returns the portion of skb which can be sent right away */ |
1933 | @@ -1907,6 +1909,24 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk) |
1934 | } |
1935 | } |
1936 | |
1937 | +static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len) |
1938 | +{ |
1939 | + struct sk_buff *skb, *next; |
1940 | + |
1941 | + skb = tcp_send_head(sk); |
1942 | + tcp_for_write_queue_from_safe(skb, next, sk) { |
1943 | + if (len <= skb->len) |
1944 | + break; |
1945 | + |
1946 | + if (unlikely(TCP_SKB_CB(skb)->eor)) |
1947 | + return false; |
1948 | + |
1949 | + len -= skb->len; |
1950 | + } |
1951 | + |
1952 | + return true; |
1953 | +} |
1954 | + |
1955 | /* Create a new MTU probe if we are ready. |
1956 | * MTU probe is regularly attempting to increase the path MTU by |
1957 | * deliberately sending larger packets. This discovers routing |
1958 | @@ -1979,6 +1999,9 @@ static int tcp_mtu_probe(struct sock *sk) |
1959 | return 0; |
1960 | } |
1961 | |
1962 | + if (!tcp_can_coalesce_send_queue_head(sk, probe_size)) |
1963 | + return -1; |
1964 | + |
1965 | /* We're allowed to probe. Build it now. */ |
1966 | nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false); |
1967 | if (!nskb) |
1968 | @@ -2014,6 +2037,10 @@ static int tcp_mtu_probe(struct sock *sk) |
1969 | /* We've eaten all the data from this skb. |
1970 | * Throw it away. */ |
1971 | TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags; |
1972 | + /* If this is the last SKB we copy and eor is set |
1973 | + * we need to propagate it to the new skb. |
1974 | + */ |
1975 | + TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor; |
1976 | tcp_unlink_write_queue(skb, sk); |
1977 | sk_wmem_free_skb(sk, skb); |
1978 | } else { |
1979 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
1980 | index bef4a94ce1a0..4cd943096afa 100644 |
1981 | --- a/net/ipv4/udp.c |
1982 | +++ b/net/ipv4/udp.c |
1983 | @@ -1713,6 +1713,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, |
1984 | err = udplite_checksum_init(skb, uh); |
1985 | if (err) |
1986 | return err; |
1987 | + |
1988 | + if (UDP_SKB_CB(skb)->partial_cov) { |
1989 | + skb->csum = inet_compute_pseudo(skb, proto); |
1990 | + return 0; |
1991 | + } |
1992 | } |
1993 | |
1994 | /* Note, we are only interested in != 0 or == 0, thus the |
1995 | diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c |
1996 | index c0cbcb259f5a..1dc023ca98fd 100644 |
1997 | --- a/net/ipv6/ip6_checksum.c |
1998 | +++ b/net/ipv6/ip6_checksum.c |
1999 | @@ -72,6 +72,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto) |
2000 | err = udplite_checksum_init(skb, uh); |
2001 | if (err) |
2002 | return err; |
2003 | + |
2004 | + if (UDP_SKB_CB(skb)->partial_cov) { |
2005 | + skb->csum = ip6_compute_pseudo(skb, proto); |
2006 | + return 0; |
2007 | + } |
2008 | } |
2009 | |
2010 | /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels) |
2011 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c |
2012 | index db6d437002a6..d4d84da28672 100644 |
2013 | --- a/net/ipv6/sit.c |
2014 | +++ b/net/ipv6/sit.c |
2015 | @@ -176,7 +176,7 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn) |
2016 | #ifdef CONFIG_IPV6_SIT_6RD |
2017 | struct ip_tunnel *t = netdev_priv(dev); |
2018 | |
2019 | - if (t->dev == sitn->fb_tunnel_dev) { |
2020 | + if (dev == sitn->fb_tunnel_dev) { |
2021 | ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0); |
2022 | t->ip6rd.relay_prefix = 0; |
2023 | t->ip6rd.prefixlen = 16; |
2024 | diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c |
2025 | index c5a5a6959c1b..ffab94d61e1d 100644 |
2026 | --- a/net/mpls/af_mpls.c |
2027 | +++ b/net/mpls/af_mpls.c |
2028 | @@ -7,6 +7,7 @@ |
2029 | #include <linux/if_arp.h> |
2030 | #include <linux/ipv6.h> |
2031 | #include <linux/mpls.h> |
2032 | +#include <linux/nospec.h> |
2033 | #include <linux/vmalloc.h> |
2034 | #include <net/ip.h> |
2035 | #include <net/dst.h> |
2036 | @@ -756,6 +757,22 @@ static int mpls_nh_build_multi(struct mpls_route_config *cfg, |
2037 | return err; |
2038 | } |
2039 | |
2040 | +static bool mpls_label_ok(struct net *net, unsigned int *index) |
2041 | +{ |
2042 | + bool is_ok = true; |
2043 | + |
2044 | + /* Reserved labels may not be set */ |
2045 | + if (*index < MPLS_LABEL_FIRST_UNRESERVED) |
2046 | + is_ok = false; |
2047 | + |
2048 | + /* The full 20 bit range may not be supported. */ |
2049 | + if (is_ok && *index >= net->mpls.platform_labels) |
2050 | + is_ok = false; |
2051 | + |
2052 | + *index = array_index_nospec(*index, net->mpls.platform_labels); |
2053 | + return is_ok; |
2054 | +} |
2055 | + |
2056 | static int mpls_route_add(struct mpls_route_config *cfg) |
2057 | { |
2058 | struct mpls_route __rcu **platform_label; |
2059 | @@ -774,12 +791,7 @@ static int mpls_route_add(struct mpls_route_config *cfg) |
2060 | index = find_free_label(net); |
2061 | } |
2062 | |
2063 | - /* Reserved labels may not be set */ |
2064 | - if (index < MPLS_LABEL_FIRST_UNRESERVED) |
2065 | - goto errout; |
2066 | - |
2067 | - /* The full 20 bit range may not be supported. */ |
2068 | - if (index >= net->mpls.platform_labels) |
2069 | + if (!mpls_label_ok(net, &index)) |
2070 | goto errout; |
2071 | |
2072 | /* Append makes no sense with mpls */ |
2073 | @@ -840,12 +852,7 @@ static int mpls_route_del(struct mpls_route_config *cfg) |
2074 | |
2075 | index = cfg->rc_label; |
2076 | |
2077 | - /* Reserved labels may not be removed */ |
2078 | - if (index < MPLS_LABEL_FIRST_UNRESERVED) |
2079 | - goto errout; |
2080 | - |
2081 | - /* The full 20 bit range may not be supported */ |
2082 | - if (index >= net->mpls.platform_labels) |
2083 | + if (!mpls_label_ok(net, &index)) |
2084 | goto errout; |
2085 | |
2086 | mpls_route_update(net, index, NULL, &cfg->rc_nlinfo); |
2087 | @@ -1279,10 +1286,9 @@ static int rtm_to_route_config(struct sk_buff *skb, struct nlmsghdr *nlh, |
2088 | &cfg->rc_label)) |
2089 | goto errout; |
2090 | |
2091 | - /* Reserved labels may not be set */ |
2092 | - if (cfg->rc_label < MPLS_LABEL_FIRST_UNRESERVED) |
2093 | + if (!mpls_label_ok(cfg->rc_nlinfo.nl_net, |
2094 | + &cfg->rc_label)) |
2095 | goto errout; |
2096 | - |
2097 | break; |
2098 | } |
2099 | case RTA_VIA: |
2100 | diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c |
2101 | index e1c123d4cdda..c1f59a06da6f 100644 |
2102 | --- a/net/netlink/af_netlink.c |
2103 | +++ b/net/netlink/af_netlink.c |
2104 | @@ -2258,7 +2258,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, |
2105 | if (cb->start) { |
2106 | ret = cb->start(cb); |
2107 | if (ret) |
2108 | - goto error_unlock; |
2109 | + goto error_put; |
2110 | } |
2111 | |
2112 | nlk->cb_running = true; |
2113 | @@ -2278,6 +2278,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, |
2114 | */ |
2115 | return -EINTR; |
2116 | |
2117 | +error_put: |
2118 | + module_put(control->module); |
2119 | error_unlock: |
2120 | sock_put(sk); |
2121 | mutex_unlock(nlk->cb_mutex); |
2122 | diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c |
2123 | index 49c28e8ef01b..11702016c900 100644 |
2124 | --- a/net/netlink/genetlink.c |
2125 | +++ b/net/netlink/genetlink.c |
2126 | @@ -1103,6 +1103,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, |
2127 | { |
2128 | struct sk_buff *tmp; |
2129 | struct net *net, *prev = NULL; |
2130 | + bool delivered = false; |
2131 | int err; |
2132 | |
2133 | for_each_net_rcu(net) { |
2134 | @@ -1114,14 +1115,21 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, |
2135 | } |
2136 | err = nlmsg_multicast(prev->genl_sock, tmp, |
2137 | portid, group, flags); |
2138 | - if (err) |
2139 | + if (!err) |
2140 | + delivered = true; |
2141 | + else if (err != -ESRCH) |
2142 | goto error; |
2143 | } |
2144 | |
2145 | prev = net; |
2146 | } |
2147 | |
2148 | - return nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); |
2149 | + err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); |
2150 | + if (!err) |
2151 | + delivered = true; |
2152 | + else if (err != -ESRCH) |
2153 | + goto error; |
2154 | + return delivered ? 0 : -ESRCH; |
2155 | error: |
2156 | kfree_skb(skb); |
2157 | return err; |
2158 | diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c |
2159 | index 5dab1ff3a6c2..59d328603312 100644 |
2160 | --- a/net/rxrpc/output.c |
2161 | +++ b/net/rxrpc/output.c |
2162 | @@ -391,7 +391,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, |
2163 | (char *)&opt, sizeof(opt)); |
2164 | if (ret == 0) { |
2165 | ret = kernel_sendmsg(conn->params.local->socket, &msg, |
2166 | - iov, 1, iov[0].iov_len); |
2167 | + iov, 2, len); |
2168 | |
2169 | opt = IPV6_PMTUDISC_DO; |
2170 | kernel_setsockopt(conn->params.local->socket, |
2171 | diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c |
2172 | index 5d015270e454..11f69d4c5619 100644 |
2173 | --- a/net/sctp/ipv6.c |
2174 | +++ b/net/sctp/ipv6.c |
2175 | @@ -324,8 +324,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, |
2176 | final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); |
2177 | bdst = ip6_dst_lookup_flow(sk, fl6, final_p); |
2178 | |
2179 | - if (!IS_ERR(bdst) && |
2180 | - ipv6_chk_addr(dev_net(bdst->dev), |
2181 | + if (IS_ERR(bdst)) |
2182 | + continue; |
2183 | + |
2184 | + if (ipv6_chk_addr(dev_net(bdst->dev), |
2185 | &laddr->a.v6.sin6_addr, bdst->dev, 1)) { |
2186 | if (!IS_ERR_OR_NULL(dst)) |
2187 | dst_release(dst); |
2188 | @@ -334,8 +336,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, |
2189 | } |
2190 | |
2191 | bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); |
2192 | - if (matchlen > bmatchlen) |
2193 | + if (matchlen > bmatchlen) { |
2194 | + dst_release(bdst); |
2195 | continue; |
2196 | + } |
2197 | |
2198 | if (!IS_ERR_OR_NULL(dst)) |
2199 | dst_release(dst); |
2200 | diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c |
2201 | index 7b523e3f551f..fb7b7632316a 100644 |
2202 | --- a/net/sctp/protocol.c |
2203 | +++ b/net/sctp/protocol.c |
2204 | @@ -510,22 +510,20 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr, |
2205 | if (IS_ERR(rt)) |
2206 | continue; |
2207 | |
2208 | - if (!dst) |
2209 | - dst = &rt->dst; |
2210 | - |
2211 | /* Ensure the src address belongs to the output |
2212 | * interface. |
2213 | */ |
2214 | odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr, |
2215 | false); |
2216 | if (!odev || odev->ifindex != fl4->flowi4_oif) { |
2217 | - if (&rt->dst != dst) |
2218 | + if (!dst) |
2219 | + dst = &rt->dst; |
2220 | + else |
2221 | dst_release(&rt->dst); |
2222 | continue; |
2223 | } |
2224 | |
2225 | - if (dst != &rt->dst) |
2226 | - dst_release(dst); |
2227 | + dst_release(dst); |
2228 | dst = &rt->dst; |
2229 | break; |
2230 | } |
2231 | diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c |
2232 | index 9e9690b7afe1..fc67d356b5fa 100644 |
2233 | --- a/net/sctp/sm_make_chunk.c |
2234 | +++ b/net/sctp/sm_make_chunk.c |
2235 | @@ -1373,9 +1373,14 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc, |
2236 | sctp_chunkhdr_t *chunk_hdr; |
2237 | struct sk_buff *skb; |
2238 | struct sock *sk; |
2239 | + int chunklen; |
2240 | + |
2241 | + chunklen = SCTP_PAD4(sizeof(*chunk_hdr) + paylen); |
2242 | + if (chunklen > SCTP_MAX_CHUNK_LEN) |
2243 | + goto nodata; |
2244 | |
2245 | /* No need to allocate LL here, as this is only a chunk. */ |
2246 | - skb = alloc_skb(SCTP_PAD4(sizeof(sctp_chunkhdr_t) + paylen), gfp); |
2247 | + skb = alloc_skb(chunklen, gfp); |
2248 | if (!skb) |
2249 | goto nodata; |
2250 | |
2251 | diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c |
2252 | index 293f3f213776..ceb162a9dcfd 100644 |
2253 | --- a/sound/pci/hda/hda_intel.c |
2254 | +++ b/sound/pci/hda/hda_intel.c |
2255 | @@ -180,7 +180,7 @@ static const struct kernel_param_ops param_ops_xint = { |
2256 | }; |
2257 | #define param_check_xint param_check_int |
2258 | |
2259 | -static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; |
2260 | +static int power_save = -1; |
2261 | module_param(power_save, xint, 0644); |
2262 | MODULE_PARM_DESC(power_save, "Automatic power-saving timeout " |
2263 | "(in second, 0 = disable)."); |
2264 | @@ -2042,6 +2042,24 @@ static int azx_probe(struct pci_dev *pci, |
2265 | return err; |
2266 | } |
2267 | |
2268 | +#ifdef CONFIG_PM |
2269 | +/* On some boards setting power_save to a non 0 value leads to clicking / |
2270 | + * popping sounds when ever we enter/leave powersaving mode. Ideally we would |
2271 | + * figure out how to avoid these sounds, but that is not always feasible. |
2272 | + * So we keep a list of devices where we disable powersaving as its known |
2273 | + * to causes problems on these devices. |
2274 | + */ |
2275 | +static struct snd_pci_quirk power_save_blacklist[] = { |
2276 | + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ |
2277 | + SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0), |
2278 | + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ |
2279 | + SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0), |
2280 | + /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ |
2281 | + SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), |
2282 | + {} |
2283 | +}; |
2284 | +#endif /* CONFIG_PM */ |
2285 | + |
2286 | /* number of codec slots for each chipset: 0 = default slots (i.e. 4) */ |
2287 | static unsigned int azx_max_codecs[AZX_NUM_DRIVERS] = { |
2288 | [AZX_DRIVER_NVIDIA] = 8, |
2289 | @@ -2054,6 +2072,7 @@ static int azx_probe_continue(struct azx *chip) |
2290 | struct hdac_bus *bus = azx_bus(chip); |
2291 | struct pci_dev *pci = chip->pci; |
2292 | int dev = chip->dev_index; |
2293 | + int val; |
2294 | int err; |
2295 | |
2296 | hda->probe_continued = 1; |
2297 | @@ -2129,7 +2148,22 @@ static int azx_probe_continue(struct azx *chip) |
2298 | |
2299 | chip->running = 1; |
2300 | azx_add_card_list(chip); |
2301 | - snd_hda_set_power_save(&chip->bus, power_save * 1000); |
2302 | + |
2303 | + val = power_save; |
2304 | +#ifdef CONFIG_PM |
2305 | + if (val == -1) { |
2306 | + const struct snd_pci_quirk *q; |
2307 | + |
2308 | + val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; |
2309 | + q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist); |
2310 | + if (q && val) { |
2311 | + dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n", |
2312 | + q->subvendor, q->subdevice); |
2313 | + val = 0; |
2314 | + } |
2315 | + } |
2316 | +#endif /* CONFIG_PM */ |
2317 | + snd_hda_set_power_save(&chip->bus, val * 1000); |
2318 | if (azx_has_pm_runtime(chip) || hda->use_vga_switcheroo) |
2319 | pm_runtime_put_autosuspend(&pci->dev); |
2320 | |
2321 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
2322 | index 89c166b97e81..974b74e91ef0 100644 |
2323 | --- a/sound/pci/hda/patch_realtek.c |
2324 | +++ b/sound/pci/hda/patch_realtek.c |
2325 | @@ -4480,13 +4480,14 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec, |
2326 | |
2327 | if (action == HDA_FIXUP_ACT_PRE_PROBE) { |
2328 | spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; |
2329 | + snd_hda_apply_pincfgs(codec, pincfgs); |
2330 | + } else if (action == HDA_FIXUP_ACT_INIT) { |
2331 | /* Enable DOCK device */ |
2332 | snd_hda_codec_write(codec, 0x17, 0, |
2333 | AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0); |
2334 | /* Enable DOCK device */ |
2335 | snd_hda_codec_write(codec, 0x19, 0, |
2336 | AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0); |
2337 | - snd_hda_apply_pincfgs(codec, pincfgs); |
2338 | } |
2339 | } |
2340 | |
2341 | diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h |
2342 | index 8a59d4782a0f..69bf5cf1e91e 100644 |
2343 | --- a/sound/usb/quirks-table.h |
2344 | +++ b/sound/usb/quirks-table.h |
2345 | @@ -3277,4 +3277,51 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), |
2346 | } |
2347 | }, |
2348 | |
2349 | +{ |
2350 | + /* |
2351 | + * Bower's & Wilkins PX headphones only support the 48 kHz sample rate |
2352 | + * even though it advertises more. The capture interface doesn't work |
2353 | + * even on windows. |
2354 | + */ |
2355 | + USB_DEVICE(0x19b5, 0x0021), |
2356 | + .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { |
2357 | + .ifnum = QUIRK_ANY_INTERFACE, |
2358 | + .type = QUIRK_COMPOSITE, |
2359 | + .data = (const struct snd_usb_audio_quirk[]) { |
2360 | + { |
2361 | + .ifnum = 0, |
2362 | + .type = QUIRK_AUDIO_STANDARD_MIXER, |
2363 | + }, |
2364 | + /* Capture */ |
2365 | + { |
2366 | + .ifnum = 1, |
2367 | + .type = QUIRK_IGNORE_INTERFACE, |
2368 | + }, |
2369 | + /* Playback */ |
2370 | + { |
2371 | + .ifnum = 2, |
2372 | + .type = QUIRK_AUDIO_FIXED_ENDPOINT, |
2373 | + .data = &(const struct audioformat) { |
2374 | + .formats = SNDRV_PCM_FMTBIT_S16_LE, |
2375 | + .channels = 2, |
2376 | + .iface = 2, |
2377 | + .altsetting = 1, |
2378 | + .altset_idx = 1, |
2379 | + .attributes = UAC_EP_CS_ATTR_FILL_MAX | |
2380 | + UAC_EP_CS_ATTR_SAMPLE_RATE, |
2381 | + .endpoint = 0x03, |
2382 | + .ep_attr = USB_ENDPOINT_XFER_ISOC, |
2383 | + .rates = SNDRV_PCM_RATE_48000, |
2384 | + .rate_min = 48000, |
2385 | + .rate_max = 48000, |
2386 | + .nr_rates = 1, |
2387 | + .rate_table = (unsigned int[]) { |
2388 | + 48000 |
2389 | + } |
2390 | + } |
2391 | + }, |
2392 | + } |
2393 | + } |
2394 | +}, |
2395 | + |
2396 | #undef USB_DEVICE_VENDOR_SPEC |
2397 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c |
2398 | index 1b20768e781d..eaae7252f60c 100644 |
2399 | --- a/virt/kvm/kvm_main.c |
2400 | +++ b/virt/kvm/kvm_main.c |
2401 | @@ -976,8 +976,7 @@ int __kvm_set_memory_region(struct kvm *kvm, |
2402 | /* Check for overlaps */ |
2403 | r = -EEXIST; |
2404 | kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) { |
2405 | - if ((slot->id >= KVM_USER_MEM_SLOTS) || |
2406 | - (slot->id == id)) |
2407 | + if (slot->id == id) |
2408 | continue; |
2409 | if (!((base_gfn + npages <= slot->base_gfn) || |
2410 | (base_gfn >= slot->base_gfn + slot->npages))) |