Contents of /trunk/kernel-magellan/patches-3.14/0100-3.14.1-all-fixes.patch
Parent Directory | Revision Log
Revision 2437 -
(show annotations)
(download)
Thu Jun 5 08:04:56 2014 UTC (10 years, 3 months ago) by niro
File size: 37902 byte(s)
Thu Jun 5 08:04:56 2014 UTC (10 years, 3 months ago) by niro
File size: 37902 byte(s)
-linux-3.14.5
1 | diff --git a/Makefile b/Makefile |
2 | index e5ac8a62e6e5..7d0b6992d9ed 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 14 |
8 | -SUBLEVEL = 0 |
9 | +SUBLEVEL = 1 |
10 | EXTRAVERSION = |
11 | NAME = Shuffling Zombie Juror |
12 | |
13 | diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts |
14 | index ea16d782af58..4f31b2eb5cdf 100644 |
15 | --- a/arch/arc/boot/dts/nsimosci.dts |
16 | +++ b/arch/arc/boot/dts/nsimosci.dts |
17 | @@ -11,13 +11,16 @@ |
18 | |
19 | / { |
20 | compatible = "snps,nsimosci"; |
21 | - clock-frequency = <80000000>; /* 80 MHZ */ |
22 | + clock-frequency = <20000000>; /* 20 MHZ */ |
23 | #address-cells = <1>; |
24 | #size-cells = <1>; |
25 | interrupt-parent = <&intc>; |
26 | |
27 | chosen { |
28 | - bootargs = "console=tty0 consoleblank=0"; |
29 | + /* this is for console on PGU */ |
30 | + /* bootargs = "console=tty0 consoleblank=0"; */ |
31 | + /* this is for console on serial */ |
32 | + bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=ttyS0,115200n8 consoleblank=0 debug"; |
33 | }; |
34 | |
35 | aliases { |
36 | @@ -44,15 +47,14 @@ |
37 | }; |
38 | |
39 | uart0: serial@c0000000 { |
40 | - compatible = "snps,dw-apb-uart"; |
41 | + compatible = "ns8250"; |
42 | reg = <0xc0000000 0x2000>; |
43 | interrupts = <11>; |
44 | - #clock-frequency = <80000000>; |
45 | clock-frequency = <3686400>; |
46 | baud = <115200>; |
47 | reg-shift = <2>; |
48 | reg-io-width = <4>; |
49 | - status = "okay"; |
50 | + no-loopback-test = <1>; |
51 | }; |
52 | |
53 | pgu0: pgu@c9000000 { |
54 | diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig |
55 | index 451af30914f6..c01ba35a4eff 100644 |
56 | --- a/arch/arc/configs/nsimosci_defconfig |
57 | +++ b/arch/arc/configs/nsimosci_defconfig |
58 | @@ -54,6 +54,7 @@ CONFIG_SERIO_ARC_PS2=y |
59 | CONFIG_SERIAL_8250=y |
60 | CONFIG_SERIAL_8250_CONSOLE=y |
61 | CONFIG_SERIAL_8250_DW=y |
62 | +CONFIG_SERIAL_OF_PLATFORM=y |
63 | CONFIG_SERIAL_ARC=y |
64 | CONFIG_SERIAL_ARC_CONSOLE=y |
65 | # CONFIG_HW_RANDOM is not set |
66 | diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig |
67 | index dbdd2231c75d..b2e322939256 100644 |
68 | --- a/arch/m68k/Kconfig |
69 | +++ b/arch/m68k/Kconfig |
70 | @@ -17,6 +17,7 @@ config M68K |
71 | select FPU if MMU |
72 | select ARCH_WANT_IPC_PARSE_VERSION |
73 | select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE |
74 | + select HAVE_FUTEX_CMPXCHG if MMU && FUTEX |
75 | select HAVE_MOD_ARCH_SPECIFIC |
76 | select MODULES_USE_ELF_REL |
77 | select MODULES_USE_ELF_RELA |
78 | diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig |
79 | index 65a07750f4f9..bb74b21f007a 100644 |
80 | --- a/arch/s390/Kconfig |
81 | +++ b/arch/s390/Kconfig |
82 | @@ -117,6 +117,7 @@ config S390 |
83 | select HAVE_FUNCTION_GRAPH_TRACER |
84 | select HAVE_FUNCTION_TRACER |
85 | select HAVE_FUNCTION_TRACE_MCOUNT_TEST |
86 | + select HAVE_FUTEX_CMPXCHG if FUTEX |
87 | select HAVE_KERNEL_BZIP2 |
88 | select HAVE_KERNEL_GZIP |
89 | select HAVE_KERNEL_LZ4 |
90 | diff --git a/arch/x86/crypto/ghash-clmulni-intel_asm.S b/arch/x86/crypto/ghash-clmulni-intel_asm.S |
91 | index 586f41aac361..185fad49d86f 100644 |
92 | --- a/arch/x86/crypto/ghash-clmulni-intel_asm.S |
93 | +++ b/arch/x86/crypto/ghash-clmulni-intel_asm.S |
94 | @@ -24,10 +24,6 @@ |
95 | .align 16 |
96 | .Lbswap_mask: |
97 | .octa 0x000102030405060708090a0b0c0d0e0f |
98 | -.Lpoly: |
99 | - .octa 0xc2000000000000000000000000000001 |
100 | -.Ltwo_one: |
101 | - .octa 0x00000001000000000000000000000001 |
102 | |
103 | #define DATA %xmm0 |
104 | #define SHASH %xmm1 |
105 | @@ -134,28 +130,3 @@ ENTRY(clmul_ghash_update) |
106 | .Lupdate_just_ret: |
107 | ret |
108 | ENDPROC(clmul_ghash_update) |
109 | - |
110 | -/* |
111 | - * void clmul_ghash_setkey(be128 *shash, const u8 *key); |
112 | - * |
113 | - * Calculate hash_key << 1 mod poly |
114 | - */ |
115 | -ENTRY(clmul_ghash_setkey) |
116 | - movaps .Lbswap_mask, BSWAP |
117 | - movups (%rsi), %xmm0 |
118 | - PSHUFB_XMM BSWAP %xmm0 |
119 | - movaps %xmm0, %xmm1 |
120 | - psllq $1, %xmm0 |
121 | - psrlq $63, %xmm1 |
122 | - movaps %xmm1, %xmm2 |
123 | - pslldq $8, %xmm1 |
124 | - psrldq $8, %xmm2 |
125 | - por %xmm1, %xmm0 |
126 | - # reduction |
127 | - pshufd $0b00100100, %xmm2, %xmm1 |
128 | - pcmpeqd .Ltwo_one, %xmm1 |
129 | - pand .Lpoly, %xmm1 |
130 | - pxor %xmm1, %xmm0 |
131 | - movups %xmm0, (%rdi) |
132 | - ret |
133 | -ENDPROC(clmul_ghash_setkey) |
134 | diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c |
135 | index 6759dd1135be..d785cf2c529c 100644 |
136 | --- a/arch/x86/crypto/ghash-clmulni-intel_glue.c |
137 | +++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c |
138 | @@ -30,8 +30,6 @@ void clmul_ghash_mul(char *dst, const be128 *shash); |
139 | void clmul_ghash_update(char *dst, const char *src, unsigned int srclen, |
140 | const be128 *shash); |
141 | |
142 | -void clmul_ghash_setkey(be128 *shash, const u8 *key); |
143 | - |
144 | struct ghash_async_ctx { |
145 | struct cryptd_ahash *cryptd_tfm; |
146 | }; |
147 | @@ -58,13 +56,23 @@ static int ghash_setkey(struct crypto_shash *tfm, |
148 | const u8 *key, unsigned int keylen) |
149 | { |
150 | struct ghash_ctx *ctx = crypto_shash_ctx(tfm); |
151 | + be128 *x = (be128 *)key; |
152 | + u64 a, b; |
153 | |
154 | if (keylen != GHASH_BLOCK_SIZE) { |
155 | crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); |
156 | return -EINVAL; |
157 | } |
158 | |
159 | - clmul_ghash_setkey(&ctx->shash, key); |
160 | + /* perform multiplication by 'x' in GF(2^128) */ |
161 | + a = be64_to_cpu(x->a); |
162 | + b = be64_to_cpu(x->b); |
163 | + |
164 | + ctx->shash.a = (__be64)((b << 1) | (a >> 63)); |
165 | + ctx->shash.b = (__be64)((a << 1) | (b >> 63)); |
166 | + |
167 | + if (a >> 63) |
168 | + ctx->shash.b ^= cpu_to_be64(0xc2); |
169 | |
170 | return 0; |
171 | } |
172 | diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h |
173 | index acd86c850414..f949715e3957 100644 |
174 | --- a/arch/x86/include/asm/efi.h |
175 | +++ b/arch/x86/include/asm/efi.h |
176 | @@ -130,7 +130,8 @@ extern void efi_memory_uc(u64 addr, unsigned long size); |
177 | extern void __init efi_map_region(efi_memory_desc_t *md); |
178 | extern void __init efi_map_region_fixed(efi_memory_desc_t *md); |
179 | extern void efi_sync_low_kernel_mappings(void); |
180 | -extern void efi_setup_page_tables(void); |
181 | +extern int efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages); |
182 | +extern void efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages); |
183 | extern void __init old_map_region(efi_memory_desc_t *md); |
184 | extern void __init runtime_code_page_mkexec(void); |
185 | extern void __init efi_runtime_mkexec(void); |
186 | diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h |
187 | index 1aa9ccd43223..94e40f1efdfd 100644 |
188 | --- a/arch/x86/include/asm/pgtable_types.h |
189 | +++ b/arch/x86/include/asm/pgtable_types.h |
190 | @@ -385,6 +385,8 @@ extern pte_t *lookup_address(unsigned long address, unsigned int *level); |
191 | extern phys_addr_t slow_virt_to_phys(void *__address); |
192 | extern int kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address, |
193 | unsigned numpages, unsigned long page_flags); |
194 | +void kernel_unmap_pages_in_pgd(pgd_t *root, unsigned long address, |
195 | + unsigned numpages); |
196 | #endif /* !__ASSEMBLY__ */ |
197 | |
198 | #endif /* _ASM_X86_PGTABLE_DEFS_H */ |
199 | diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c |
200 | index b3b19f46c016..a3488689e301 100644 |
201 | --- a/arch/x86/mm/pageattr.c |
202 | +++ b/arch/x86/mm/pageattr.c |
203 | @@ -692,6 +692,18 @@ static bool try_to_free_pmd_page(pmd_t *pmd) |
204 | return true; |
205 | } |
206 | |
207 | +static bool try_to_free_pud_page(pud_t *pud) |
208 | +{ |
209 | + int i; |
210 | + |
211 | + for (i = 0; i < PTRS_PER_PUD; i++) |
212 | + if (!pud_none(pud[i])) |
213 | + return false; |
214 | + |
215 | + free_page((unsigned long)pud); |
216 | + return true; |
217 | +} |
218 | + |
219 | static bool unmap_pte_range(pmd_t *pmd, unsigned long start, unsigned long end) |
220 | { |
221 | pte_t *pte = pte_offset_kernel(pmd, start); |
222 | @@ -805,6 +817,16 @@ static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) |
223 | */ |
224 | } |
225 | |
226 | +static void unmap_pgd_range(pgd_t *root, unsigned long addr, unsigned long end) |
227 | +{ |
228 | + pgd_t *pgd_entry = root + pgd_index(addr); |
229 | + |
230 | + unmap_pud_range(pgd_entry, addr, end); |
231 | + |
232 | + if (try_to_free_pud_page((pud_t *)pgd_page_vaddr(*pgd_entry))) |
233 | + pgd_clear(pgd_entry); |
234 | +} |
235 | + |
236 | static int alloc_pte_page(pmd_t *pmd) |
237 | { |
238 | pte_t *pte = (pte_t *)get_zeroed_page(GFP_KERNEL | __GFP_NOTRACK); |
239 | @@ -999,9 +1021,8 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, |
240 | static int populate_pgd(struct cpa_data *cpa, unsigned long addr) |
241 | { |
242 | pgprot_t pgprot = __pgprot(_KERNPG_TABLE); |
243 | - bool allocd_pgd = false; |
244 | - pgd_t *pgd_entry; |
245 | pud_t *pud = NULL; /* shut up gcc */ |
246 | + pgd_t *pgd_entry; |
247 | int ret; |
248 | |
249 | pgd_entry = cpa->pgd + pgd_index(addr); |
250 | @@ -1015,7 +1036,6 @@ static int populate_pgd(struct cpa_data *cpa, unsigned long addr) |
251 | return -1; |
252 | |
253 | set_pgd(pgd_entry, __pgd(__pa(pud) | _KERNPG_TABLE)); |
254 | - allocd_pgd = true; |
255 | } |
256 | |
257 | pgprot_val(pgprot) &= ~pgprot_val(cpa->mask_clr); |
258 | @@ -1023,19 +1043,11 @@ static int populate_pgd(struct cpa_data *cpa, unsigned long addr) |
259 | |
260 | ret = populate_pud(cpa, addr, pgd_entry, pgprot); |
261 | if (ret < 0) { |
262 | - unmap_pud_range(pgd_entry, addr, |
263 | + unmap_pgd_range(cpa->pgd, addr, |
264 | addr + (cpa->numpages << PAGE_SHIFT)); |
265 | - |
266 | - if (allocd_pgd) { |
267 | - /* |
268 | - * If I allocated this PUD page, I can just as well |
269 | - * free it in this error path. |
270 | - */ |
271 | - pgd_clear(pgd_entry); |
272 | - free_page((unsigned long)pud); |
273 | - } |
274 | return ret; |
275 | } |
276 | + |
277 | cpa->numpages = ret; |
278 | return 0; |
279 | } |
280 | @@ -1861,6 +1873,12 @@ out: |
281 | return retval; |
282 | } |
283 | |
284 | +void kernel_unmap_pages_in_pgd(pgd_t *root, unsigned long address, |
285 | + unsigned numpages) |
286 | +{ |
287 | + unmap_pgd_range(root, address, address + (numpages << PAGE_SHIFT)); |
288 | +} |
289 | + |
290 | /* |
291 | * The testcases use internal knowledge of the implementation that shouldn't |
292 | * be exposed to the rest of the kernel. Include these directly here. |
293 | diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c |
294 | index b97acecf3fd9..abb81b0ad83f 100644 |
295 | --- a/arch/x86/platform/efi/efi.c |
296 | +++ b/arch/x86/platform/efi/efi.c |
297 | @@ -939,14 +939,36 @@ static void __init efi_map_regions_fixed(void) |
298 | |
299 | } |
300 | |
301 | +static void *realloc_pages(void *old_memmap, int old_shift) |
302 | +{ |
303 | + void *ret; |
304 | + |
305 | + ret = (void *)__get_free_pages(GFP_KERNEL, old_shift + 1); |
306 | + if (!ret) |
307 | + goto out; |
308 | + |
309 | + /* |
310 | + * A first-time allocation doesn't have anything to copy. |
311 | + */ |
312 | + if (!old_memmap) |
313 | + return ret; |
314 | + |
315 | + memcpy(ret, old_memmap, PAGE_SIZE << old_shift); |
316 | + |
317 | +out: |
318 | + free_pages((unsigned long)old_memmap, old_shift); |
319 | + return ret; |
320 | +} |
321 | + |
322 | /* |
323 | - * Map efi memory ranges for runtime serivce and update new_memmap with virtual |
324 | - * addresses. |
325 | + * Map the efi memory ranges of the runtime services and update new_mmap with |
326 | + * virtual addresses. |
327 | */ |
328 | -static void * __init efi_map_regions(int *count) |
329 | +static void * __init efi_map_regions(int *count, int *pg_shift) |
330 | { |
331 | + void *p, *new_memmap = NULL; |
332 | + unsigned long left = 0; |
333 | efi_memory_desc_t *md; |
334 | - void *p, *tmp, *new_memmap = NULL; |
335 | |
336 | for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { |
337 | md = p; |
338 | @@ -961,20 +983,23 @@ static void * __init efi_map_regions(int *count) |
339 | efi_map_region(md); |
340 | get_systab_virt_addr(md); |
341 | |
342 | - tmp = krealloc(new_memmap, (*count + 1) * memmap.desc_size, |
343 | - GFP_KERNEL); |
344 | - if (!tmp) |
345 | - goto out; |
346 | - new_memmap = tmp; |
347 | + if (left < memmap.desc_size) { |
348 | + new_memmap = realloc_pages(new_memmap, *pg_shift); |
349 | + if (!new_memmap) |
350 | + return NULL; |
351 | + |
352 | + left += PAGE_SIZE << *pg_shift; |
353 | + (*pg_shift)++; |
354 | + } |
355 | + |
356 | memcpy(new_memmap + (*count * memmap.desc_size), md, |
357 | memmap.desc_size); |
358 | + |
359 | + left -= memmap.desc_size; |
360 | (*count)++; |
361 | } |
362 | |
363 | return new_memmap; |
364 | -out: |
365 | - kfree(new_memmap); |
366 | - return NULL; |
367 | } |
368 | |
369 | /* |
370 | @@ -1000,9 +1025,9 @@ out: |
371 | */ |
372 | void __init efi_enter_virtual_mode(void) |
373 | { |
374 | - efi_status_t status; |
375 | + int err, count = 0, pg_shift = 0; |
376 | void *new_memmap = NULL; |
377 | - int err, count = 0; |
378 | + efi_status_t status; |
379 | |
380 | efi.systab = NULL; |
381 | |
382 | @@ -1019,20 +1044,24 @@ void __init efi_enter_virtual_mode(void) |
383 | efi_map_regions_fixed(); |
384 | } else { |
385 | efi_merge_regions(); |
386 | - new_memmap = efi_map_regions(&count); |
387 | + new_memmap = efi_map_regions(&count, &pg_shift); |
388 | if (!new_memmap) { |
389 | pr_err("Error reallocating memory, EFI runtime non-functional!\n"); |
390 | return; |
391 | } |
392 | - } |
393 | |
394 | - err = save_runtime_map(); |
395 | - if (err) |
396 | - pr_err("Error saving runtime map, efi runtime on kexec non-functional!!\n"); |
397 | + err = save_runtime_map(); |
398 | + if (err) |
399 | + pr_err("Error saving runtime map, efi runtime on kexec non-functional!!\n"); |
400 | + } |
401 | |
402 | BUG_ON(!efi.systab); |
403 | |
404 | - efi_setup_page_tables(); |
405 | + if (!efi_setup) { |
406 | + if (efi_setup_page_tables(__pa(new_memmap), 1 << pg_shift)) |
407 | + return; |
408 | + } |
409 | + |
410 | efi_sync_low_kernel_mappings(); |
411 | |
412 | if (!efi_setup) { |
413 | @@ -1072,7 +1101,35 @@ void __init efi_enter_virtual_mode(void) |
414 | |
415 | efi_runtime_mkexec(); |
416 | |
417 | - kfree(new_memmap); |
418 | + |
419 | + /* |
420 | + * We mapped the descriptor array into the EFI pagetable above but we're |
421 | + * not unmapping it here. Here's why: |
422 | + * |
423 | + * We're copying select PGDs from the kernel page table to the EFI page |
424 | + * table and when we do so and make changes to those PGDs like unmapping |
425 | + * stuff from them, those changes appear in the kernel page table and we |
426 | + * go boom. |
427 | + * |
428 | + * From setup_real_mode(): |
429 | + * |
430 | + * ... |
431 | + * trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd; |
432 | + * |
433 | + * In this particular case, our allocation is in PGD 0 of the EFI page |
434 | + * table but we've copied that PGD from PGD[272] of the EFI page table: |
435 | + * |
436 | + * pgd_index(__PAGE_OFFSET = 0xffff880000000000) = 272 |
437 | + * |
438 | + * where the direct memory mapping in kernel space is. |
439 | + * |
440 | + * new_memmap's VA comes from that direct mapping and thus clearing it, |
441 | + * it would get cleared in the kernel page table too. |
442 | + * |
443 | + * efi_cleanup_page_tables(__pa(new_memmap), 1 << pg_shift); |
444 | + */ |
445 | + if (!efi_setup) |
446 | + free_pages((unsigned long)new_memmap, pg_shift); |
447 | |
448 | /* clean DUMMY object */ |
449 | efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID, |
450 | diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c |
451 | index 0b74cdf7f816..9ee3491e31fb 100644 |
452 | --- a/arch/x86/platform/efi/efi_32.c |
453 | +++ b/arch/x86/platform/efi/efi_32.c |
454 | @@ -40,7 +40,12 @@ |
455 | static unsigned long efi_rt_eflags; |
456 | |
457 | void efi_sync_low_kernel_mappings(void) {} |
458 | -void efi_setup_page_tables(void) {} |
459 | +void __init efi_dump_pagetable(void) {} |
460 | +int efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) |
461 | +{ |
462 | + return 0; |
463 | +} |
464 | +void efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages) {} |
465 | |
466 | void __init efi_map_region(efi_memory_desc_t *md) |
467 | { |
468 | diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c |
469 | index 0c2a234fef1e..666b74a09092 100644 |
470 | --- a/arch/x86/platform/efi/efi_64.c |
471 | +++ b/arch/x86/platform/efi/efi_64.c |
472 | @@ -137,12 +137,38 @@ void efi_sync_low_kernel_mappings(void) |
473 | sizeof(pgd_t) * num_pgds); |
474 | } |
475 | |
476 | -void efi_setup_page_tables(void) |
477 | +int efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) |
478 | { |
479 | + pgd_t *pgd; |
480 | + |
481 | + if (efi_enabled(EFI_OLD_MEMMAP)) |
482 | + return 0; |
483 | + |
484 | efi_scratch.efi_pgt = (pgd_t *)(unsigned long)real_mode_header->trampoline_pgd; |
485 | + pgd = __va(efi_scratch.efi_pgt); |
486 | |
487 | - if (!efi_enabled(EFI_OLD_MEMMAP)) |
488 | - efi_scratch.use_pgd = true; |
489 | + /* |
490 | + * It can happen that the physical address of new_memmap lands in memory |
491 | + * which is not mapped in the EFI page table. Therefore we need to go |
492 | + * and ident-map those pages containing the map before calling |
493 | + * phys_efi_set_virtual_address_map(). |
494 | + */ |
495 | + if (kernel_map_pages_in_pgd(pgd, pa_memmap, pa_memmap, num_pages, _PAGE_NX)) { |
496 | + pr_err("Error ident-mapping new memmap (0x%lx)!\n", pa_memmap); |
497 | + return 1; |
498 | + } |
499 | + |
500 | + efi_scratch.use_pgd = true; |
501 | + |
502 | + |
503 | + return 0; |
504 | +} |
505 | + |
506 | +void efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages) |
507 | +{ |
508 | + pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); |
509 | + |
510 | + kernel_unmap_pages_in_pgd(pgd, pa_memmap, num_pages); |
511 | } |
512 | |
513 | static void __init __map_region(efi_memory_desc_t *md, u64 va) |
514 | diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c |
515 | index 02125e6a9109..5a4da94aefb0 100644 |
516 | --- a/drivers/isdn/isdnloop/isdnloop.c |
517 | +++ b/drivers/isdn/isdnloop/isdnloop.c |
518 | @@ -518,9 +518,9 @@ static isdnloop_stat isdnloop_cmd_table[] = |
519 | static void |
520 | isdnloop_fake_err(isdnloop_card *card) |
521 | { |
522 | - char buf[60]; |
523 | + char buf[64]; |
524 | |
525 | - sprintf(buf, "E%s", card->omsg); |
526 | + snprintf(buf, sizeof(buf), "E%s", card->omsg); |
527 | isdnloop_fake(card, buf, -1); |
528 | isdnloop_fake(card, "NAK", -1); |
529 | } |
530 | @@ -903,6 +903,8 @@ isdnloop_parse_cmd(isdnloop_card *card) |
531 | case 7: |
532 | /* 0x;EAZ */ |
533 | p += 3; |
534 | + if (strlen(p) >= sizeof(card->eazlist[0])) |
535 | + break; |
536 | strcpy(card->eazlist[ch - 1], p); |
537 | break; |
538 | case 8: |
539 | @@ -1070,6 +1072,12 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp) |
540 | return -EBUSY; |
541 | if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef))) |
542 | return -EFAULT; |
543 | + |
544 | + for (i = 0; i < 3; i++) { |
545 | + if (!memchr(sdef.num[i], 0, sizeof(sdef.num[i]))) |
546 | + return -EINVAL; |
547 | + } |
548 | + |
549 | spin_lock_irqsave(&card->isdnloop_lock, flags); |
550 | switch (sdef.ptype) { |
551 | case ISDN_PTYPE_EURO: |
552 | @@ -1127,7 +1135,7 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) |
553 | { |
554 | ulong a; |
555 | int i; |
556 | - char cbuf[60]; |
557 | + char cbuf[80]; |
558 | isdn_ctrl cmd; |
559 | isdnloop_cdef cdef; |
560 | |
561 | @@ -1192,7 +1200,6 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) |
562 | break; |
563 | if ((c->arg & 255) < ISDNLOOP_BCH) { |
564 | char *p; |
565 | - char dial[50]; |
566 | char dcode[4]; |
567 | |
568 | a = c->arg; |
569 | @@ -1204,10 +1211,10 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) |
570 | } else |
571 | /* Normal Dial */ |
572 | strcpy(dcode, "CAL"); |
573 | - strcpy(dial, p); |
574 | - sprintf(cbuf, "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1), |
575 | - dcode, dial, c->parm.setup.si1, |
576 | - c->parm.setup.si2, c->parm.setup.eazmsn); |
577 | + snprintf(cbuf, sizeof(cbuf), |
578 | + "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1), |
579 | + dcode, p, c->parm.setup.si1, |
580 | + c->parm.setup.si2, c->parm.setup.eazmsn); |
581 | i = isdnloop_writecmd(cbuf, strlen(cbuf), 0, card); |
582 | } |
583 | break; |
584 | diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c |
585 | index ce75de9bae9e..4a79edaf3885 100644 |
586 | --- a/drivers/net/ethernet/cadence/at91_ether.c |
587 | +++ b/drivers/net/ethernet/cadence/at91_ether.c |
588 | @@ -342,6 +342,9 @@ static int __init at91ether_probe(struct platform_device *pdev) |
589 | } |
590 | clk_enable(lp->pclk); |
591 | |
592 | + lp->hclk = ERR_PTR(-ENOENT); |
593 | + lp->tx_clk = ERR_PTR(-ENOENT); |
594 | + |
595 | /* Install the interrupt handler */ |
596 | dev->irq = platform_get_irq(pdev, 0); |
597 | res = devm_request_irq(&pdev->dev, dev->irq, at91ether_interrupt, 0, dev->name, dev); |
598 | diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c |
599 | index 174a92f5fe51..7645a3ce3854 100644 |
600 | --- a/drivers/net/ethernet/sfc/ef10.c |
601 | +++ b/drivers/net/ethernet/sfc/ef10.c |
602 | @@ -565,10 +565,17 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx) |
603 | * several of each (in fact that's the only option if host |
604 | * page size is >4K). So we may allocate some extra VIs just |
605 | * for writing PIO buffers through. |
606 | + * |
607 | + * The UC mapping contains (min_vis - 1) complete VIs and the |
608 | + * first half of the next VI. Then the WC mapping begins with |
609 | + * the second half of this last VI. |
610 | */ |
611 | uc_mem_map_size = PAGE_ALIGN((min_vis - 1) * EFX_VI_PAGE_SIZE + |
612 | ER_DZ_TX_PIOBUF); |
613 | if (nic_data->n_piobufs) { |
614 | + /* pio_write_vi_base rounds down to give the number of complete |
615 | + * VIs inside the UC mapping. |
616 | + */ |
617 | pio_write_vi_base = uc_mem_map_size / EFX_VI_PAGE_SIZE; |
618 | wc_mem_map_size = (PAGE_ALIGN((pio_write_vi_base + |
619 | nic_data->n_piobufs) * |
620 | diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c |
621 | index 83d464347021..f06c790fba5a 100644 |
622 | --- a/drivers/net/ethernet/sfc/efx.c |
623 | +++ b/drivers/net/ethernet/sfc/efx.c |
624 | @@ -1603,6 +1603,8 @@ static int efx_probe_nic(struct efx_nic *efx) |
625 | if (rc) |
626 | goto fail1; |
627 | |
628 | + efx_set_channels(efx); |
629 | + |
630 | rc = efx->type->dimension_resources(efx); |
631 | if (rc) |
632 | goto fail2; |
633 | @@ -1613,7 +1615,6 @@ static int efx_probe_nic(struct efx_nic *efx) |
634 | efx->rx_indir_table[i] = |
635 | ethtool_rxfh_indir_default(i, efx->rss_spread); |
636 | |
637 | - efx_set_channels(efx); |
638 | netif_set_real_num_tx_queues(efx->net_dev, efx->n_tx_channels); |
639 | netif_set_real_num_rx_queues(efx->net_dev, efx->n_rx_channels); |
640 | |
641 | diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c |
642 | index 1236812c7be6..d091e52b00e1 100644 |
643 | --- a/drivers/net/vxlan.c |
644 | +++ b/drivers/net/vxlan.c |
645 | @@ -871,6 +871,9 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[], |
646 | if (err) |
647 | return err; |
648 | |
649 | + if (vxlan->default_dst.remote_ip.sa.sa_family != ip.sa.sa_family) |
650 | + return -EAFNOSUPPORT; |
651 | + |
652 | spin_lock_bh(&vxlan->hash_lock); |
653 | err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags, |
654 | port, vni, ifindex, ndm->ndm_flags); |
655 | @@ -2612,9 +2615,10 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, |
656 | vni = nla_get_u32(data[IFLA_VXLAN_ID]); |
657 | dst->remote_vni = vni; |
658 | |
659 | + /* Unless IPv6 is explicitly requested, assume IPv4 */ |
660 | + dst->remote_ip.sa.sa_family = AF_INET; |
661 | if (data[IFLA_VXLAN_GROUP]) { |
662 | dst->remote_ip.sin.sin_addr.s_addr = nla_get_be32(data[IFLA_VXLAN_GROUP]); |
663 | - dst->remote_ip.sa.sa_family = AF_INET; |
664 | } else if (data[IFLA_VXLAN_GROUP6]) { |
665 | if (!IS_ENABLED(CONFIG_IPV6)) |
666 | return -EPFNOSUPPORT; |
667 | diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c |
668 | index 6abf74e1351f..5bc871513505 100644 |
669 | --- a/drivers/net/wireless/iwlwifi/mvm/rs.c |
670 | +++ b/drivers/net/wireless/iwlwifi/mvm/rs.c |
671 | @@ -211,9 +211,9 @@ static const struct rs_tx_column rs_tx_columns[] = { |
672 | .next_columns = { |
673 | RS_COLUMN_LEGACY_ANT_B, |
674 | RS_COLUMN_SISO_ANT_A, |
675 | + RS_COLUMN_SISO_ANT_B, |
676 | RS_COLUMN_MIMO2, |
677 | - RS_COLUMN_INVALID, |
678 | - RS_COLUMN_INVALID, |
679 | + RS_COLUMN_MIMO2_SGI, |
680 | }, |
681 | }, |
682 | [RS_COLUMN_LEGACY_ANT_B] = { |
683 | @@ -221,10 +221,10 @@ static const struct rs_tx_column rs_tx_columns[] = { |
684 | .ant = ANT_B, |
685 | .next_columns = { |
686 | RS_COLUMN_LEGACY_ANT_A, |
687 | + RS_COLUMN_SISO_ANT_A, |
688 | RS_COLUMN_SISO_ANT_B, |
689 | RS_COLUMN_MIMO2, |
690 | - RS_COLUMN_INVALID, |
691 | - RS_COLUMN_INVALID, |
692 | + RS_COLUMN_MIMO2_SGI, |
693 | }, |
694 | }, |
695 | [RS_COLUMN_SISO_ANT_A] = { |
696 | @@ -234,8 +234,8 @@ static const struct rs_tx_column rs_tx_columns[] = { |
697 | RS_COLUMN_SISO_ANT_B, |
698 | RS_COLUMN_MIMO2, |
699 | RS_COLUMN_SISO_ANT_A_SGI, |
700 | - RS_COLUMN_INVALID, |
701 | - RS_COLUMN_INVALID, |
702 | + RS_COLUMN_SISO_ANT_B_SGI, |
703 | + RS_COLUMN_MIMO2_SGI, |
704 | }, |
705 | .checks = { |
706 | rs_siso_allow, |
707 | @@ -248,8 +248,8 @@ static const struct rs_tx_column rs_tx_columns[] = { |
708 | RS_COLUMN_SISO_ANT_A, |
709 | RS_COLUMN_MIMO2, |
710 | RS_COLUMN_SISO_ANT_B_SGI, |
711 | - RS_COLUMN_INVALID, |
712 | - RS_COLUMN_INVALID, |
713 | + RS_COLUMN_SISO_ANT_A_SGI, |
714 | + RS_COLUMN_MIMO2_SGI, |
715 | }, |
716 | .checks = { |
717 | rs_siso_allow, |
718 | @@ -263,8 +263,8 @@ static const struct rs_tx_column rs_tx_columns[] = { |
719 | RS_COLUMN_SISO_ANT_B_SGI, |
720 | RS_COLUMN_MIMO2_SGI, |
721 | RS_COLUMN_SISO_ANT_A, |
722 | - RS_COLUMN_INVALID, |
723 | - RS_COLUMN_INVALID, |
724 | + RS_COLUMN_SISO_ANT_B, |
725 | + RS_COLUMN_MIMO2, |
726 | }, |
727 | .checks = { |
728 | rs_siso_allow, |
729 | @@ -279,8 +279,8 @@ static const struct rs_tx_column rs_tx_columns[] = { |
730 | RS_COLUMN_SISO_ANT_A_SGI, |
731 | RS_COLUMN_MIMO2_SGI, |
732 | RS_COLUMN_SISO_ANT_B, |
733 | - RS_COLUMN_INVALID, |
734 | - RS_COLUMN_INVALID, |
735 | + RS_COLUMN_SISO_ANT_A, |
736 | + RS_COLUMN_MIMO2, |
737 | }, |
738 | .checks = { |
739 | rs_siso_allow, |
740 | @@ -292,10 +292,10 @@ static const struct rs_tx_column rs_tx_columns[] = { |
741 | .ant = ANT_AB, |
742 | .next_columns = { |
743 | RS_COLUMN_SISO_ANT_A, |
744 | + RS_COLUMN_SISO_ANT_B, |
745 | + RS_COLUMN_SISO_ANT_A_SGI, |
746 | + RS_COLUMN_SISO_ANT_B_SGI, |
747 | RS_COLUMN_MIMO2_SGI, |
748 | - RS_COLUMN_INVALID, |
749 | - RS_COLUMN_INVALID, |
750 | - RS_COLUMN_INVALID, |
751 | }, |
752 | .checks = { |
753 | rs_mimo_allow, |
754 | @@ -307,10 +307,10 @@ static const struct rs_tx_column rs_tx_columns[] = { |
755 | .sgi = true, |
756 | .next_columns = { |
757 | RS_COLUMN_SISO_ANT_A_SGI, |
758 | + RS_COLUMN_SISO_ANT_B_SGI, |
759 | + RS_COLUMN_SISO_ANT_A, |
760 | + RS_COLUMN_SISO_ANT_B, |
761 | RS_COLUMN_MIMO2, |
762 | - RS_COLUMN_INVALID, |
763 | - RS_COLUMN_INVALID, |
764 | - RS_COLUMN_INVALID, |
765 | }, |
766 | .checks = { |
767 | rs_mimo_allow, |
768 | diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h |
769 | index ae413a2cbee7..4bf5b334664e 100644 |
770 | --- a/drivers/net/xen-netback/common.h |
771 | +++ b/drivers/net/xen-netback/common.h |
772 | @@ -113,6 +113,11 @@ struct xenvif { |
773 | domid_t domid; |
774 | unsigned int handle; |
775 | |
776 | + /* Is this interface disabled? True when backend discovers |
777 | + * frontend is rogue. |
778 | + */ |
779 | + bool disabled; |
780 | + |
781 | /* Use NAPI for guest TX */ |
782 | struct napi_struct napi; |
783 | /* When feature-split-event-channels = 0, tx_irq = rx_irq. */ |
784 | diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c |
785 | index 301cc037fda8..2e92d52c0a6d 100644 |
786 | --- a/drivers/net/xen-netback/interface.c |
787 | +++ b/drivers/net/xen-netback/interface.c |
788 | @@ -62,6 +62,15 @@ static int xenvif_poll(struct napi_struct *napi, int budget) |
789 | struct xenvif *vif = container_of(napi, struct xenvif, napi); |
790 | int work_done; |
791 | |
792 | + /* This vif is rogue, we pretend we've there is nothing to do |
793 | + * for this vif to deschedule it from NAPI. But this interface |
794 | + * will be turned off in thread context later. |
795 | + */ |
796 | + if (unlikely(vif->disabled)) { |
797 | + napi_complete(napi); |
798 | + return 0; |
799 | + } |
800 | + |
801 | work_done = xenvif_tx_action(vif, budget); |
802 | |
803 | if (work_done < budget) { |
804 | @@ -321,6 +330,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid, |
805 | vif->ip_csum = 1; |
806 | vif->dev = dev; |
807 | |
808 | + vif->disabled = false; |
809 | + |
810 | vif->credit_bytes = vif->remaining_credit = ~0UL; |
811 | vif->credit_usec = 0UL; |
812 | init_timer(&vif->credit_timeout); |
813 | diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c |
814 | index 438d0c09b7e6..97030c193afd 100644 |
815 | --- a/drivers/net/xen-netback/netback.c |
816 | +++ b/drivers/net/xen-netback/netback.c |
817 | @@ -192,8 +192,8 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head) |
818 | * into multiple copies tend to give large frags their |
819 | * own buffers as before. |
820 | */ |
821 | - if ((offset + size > MAX_BUFFER_OFFSET) && |
822 | - (size <= MAX_BUFFER_OFFSET) && offset && !head) |
823 | + BUG_ON(size > MAX_BUFFER_OFFSET); |
824 | + if ((offset + size > MAX_BUFFER_OFFSET) && offset && !head) |
825 | return true; |
826 | |
827 | return false; |
828 | @@ -482,6 +482,8 @@ static void xenvif_rx_action(struct xenvif *vif) |
829 | |
830 | while ((skb = skb_dequeue(&vif->rx_queue)) != NULL) { |
831 | RING_IDX max_slots_needed; |
832 | + RING_IDX old_req_cons; |
833 | + RING_IDX ring_slots_used; |
834 | int i; |
835 | |
836 | /* We need a cheap worse case estimate for the number of |
837 | @@ -493,9 +495,28 @@ static void xenvif_rx_action(struct xenvif *vif) |
838 | PAGE_SIZE); |
839 | for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) { |
840 | unsigned int size; |
841 | + unsigned int offset; |
842 | + |
843 | size = skb_frag_size(&skb_shinfo(skb)->frags[i]); |
844 | - max_slots_needed += DIV_ROUND_UP(size, PAGE_SIZE); |
845 | + offset = skb_shinfo(skb)->frags[i].page_offset; |
846 | + |
847 | + /* For a worse-case estimate we need to factor in |
848 | + * the fragment page offset as this will affect the |
849 | + * number of times xenvif_gop_frag_copy() will |
850 | + * call start_new_rx_buffer(). |
851 | + */ |
852 | + max_slots_needed += DIV_ROUND_UP(offset + size, |
853 | + PAGE_SIZE); |
854 | } |
855 | + |
856 | + /* To avoid the estimate becoming too pessimal for some |
857 | + * frontends that limit posted rx requests, cap the estimate |
858 | + * at MAX_SKB_FRAGS. |
859 | + */ |
860 | + if (max_slots_needed > MAX_SKB_FRAGS) |
861 | + max_slots_needed = MAX_SKB_FRAGS; |
862 | + |
863 | + /* We may need one more slot for GSO metadata */ |
864 | if (skb_is_gso(skb) && |
865 | (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 || |
866 | skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)) |
867 | @@ -511,8 +532,12 @@ static void xenvif_rx_action(struct xenvif *vif) |
868 | vif->rx_last_skb_slots = 0; |
869 | |
870 | sco = (struct skb_cb_overlay *)skb->cb; |
871 | + |
872 | + old_req_cons = vif->rx.req_cons; |
873 | sco->meta_slots_used = xenvif_gop_skb(skb, &npo); |
874 | - BUG_ON(sco->meta_slots_used > max_slots_needed); |
875 | + ring_slots_used = vif->rx.req_cons - old_req_cons; |
876 | + |
877 | + BUG_ON(ring_slots_used > max_slots_needed); |
878 | |
879 | __skb_queue_tail(&rxq, skb); |
880 | } |
881 | @@ -655,7 +680,8 @@ static void xenvif_tx_err(struct xenvif *vif, |
882 | static void xenvif_fatal_tx_err(struct xenvif *vif) |
883 | { |
884 | netdev_err(vif->dev, "fatal error; disabling device\n"); |
885 | - xenvif_carrier_off(vif); |
886 | + vif->disabled = true; |
887 | + xenvif_kick_thread(vif); |
888 | } |
889 | |
890 | static int xenvif_count_requests(struct xenvif *vif, |
891 | @@ -1126,7 +1152,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget) |
892 | vif->tx.sring->req_prod, vif->tx.req_cons, |
893 | XEN_NETIF_TX_RING_SIZE); |
894 | xenvif_fatal_tx_err(vif); |
895 | - continue; |
896 | + break; |
897 | } |
898 | |
899 | work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&vif->tx); |
900 | @@ -1548,7 +1574,18 @@ int xenvif_kthread(void *data) |
901 | while (!kthread_should_stop()) { |
902 | wait_event_interruptible(vif->wq, |
903 | rx_work_todo(vif) || |
904 | + vif->disabled || |
905 | kthread_should_stop()); |
906 | + |
907 | + /* This frontend is found to be rogue, disable it in |
908 | + * kthread context. Currently this is only set when |
909 | + * netback finds out frontend sends malformed packet, |
910 | + * but we cannot disable the interface in softirq |
911 | + * context so we defer it here. |
912 | + */ |
913 | + if (unlikely(vif->disabled && netif_carrier_ok(vif->dev))) |
914 | + xenvif_carrier_off(vif); |
915 | + |
916 | if (kthread_should_stop()) |
917 | break; |
918 | |
919 | diff --git a/include/linux/futex.h b/include/linux/futex.h |
920 | index b0d95cac826e..6435f46d6e13 100644 |
921 | --- a/include/linux/futex.h |
922 | +++ b/include/linux/futex.h |
923 | @@ -55,7 +55,11 @@ union futex_key { |
924 | #ifdef CONFIG_FUTEX |
925 | extern void exit_robust_list(struct task_struct *curr); |
926 | extern void exit_pi_state_list(struct task_struct *curr); |
927 | +#ifdef CONFIG_HAVE_FUTEX_CMPXCHG |
928 | +#define futex_cmpxchg_enabled 1 |
929 | +#else |
930 | extern int futex_cmpxchg_enabled; |
931 | +#endif |
932 | #else |
933 | static inline void exit_robust_list(struct task_struct *curr) |
934 | { |
935 | diff --git a/init/Kconfig b/init/Kconfig |
936 | index 009a797dd242..d56cb03c1b49 100644 |
937 | --- a/init/Kconfig |
938 | +++ b/init/Kconfig |
939 | @@ -1387,6 +1387,13 @@ config FUTEX |
940 | support for "fast userspace mutexes". The resulting kernel may not |
941 | run glibc-based applications correctly. |
942 | |
943 | +config HAVE_FUTEX_CMPXCHG |
944 | + bool |
945 | + help |
946 | + Architectures should select this if futex_atomic_cmpxchg_inatomic() |
947 | + is implemented and always working. This removes a couple of runtime |
948 | + checks. |
949 | + |
950 | config EPOLL |
951 | bool "Enable eventpoll support" if EXPERT |
952 | default y |
953 | diff --git a/kernel/futex.c b/kernel/futex.c |
954 | index 08ec814ad9d2..6801b3751a95 100644 |
955 | --- a/kernel/futex.c |
956 | +++ b/kernel/futex.c |
957 | @@ -157,7 +157,9 @@ |
958 | * enqueue. |
959 | */ |
960 | |
961 | +#ifndef CONFIG_HAVE_FUTEX_CMPXCHG |
962 | int __read_mostly futex_cmpxchg_enabled; |
963 | +#endif |
964 | |
965 | /* |
966 | * Futex flags used to encode options to functions and preserve them across |
967 | @@ -1450,6 +1452,7 @@ retry: |
968 | hb2 = hash_futex(&key2); |
969 | |
970 | retry_private: |
971 | + hb_waiters_inc(hb2); |
972 | double_lock_hb(hb1, hb2); |
973 | |
974 | if (likely(cmpval != NULL)) { |
975 | @@ -1459,6 +1462,7 @@ retry_private: |
976 | |
977 | if (unlikely(ret)) { |
978 | double_unlock_hb(hb1, hb2); |
979 | + hb_waiters_dec(hb2); |
980 | |
981 | ret = get_user(curval, uaddr1); |
982 | if (ret) |
983 | @@ -1508,6 +1512,7 @@ retry_private: |
984 | break; |
985 | case -EFAULT: |
986 | double_unlock_hb(hb1, hb2); |
987 | + hb_waiters_dec(hb2); |
988 | put_futex_key(&key2); |
989 | put_futex_key(&key1); |
990 | ret = fault_in_user_writeable(uaddr2); |
991 | @@ -1517,6 +1522,7 @@ retry_private: |
992 | case -EAGAIN: |
993 | /* The owner was exiting, try again. */ |
994 | double_unlock_hb(hb1, hb2); |
995 | + hb_waiters_dec(hb2); |
996 | put_futex_key(&key2); |
997 | put_futex_key(&key1); |
998 | cond_resched(); |
999 | @@ -1592,6 +1598,7 @@ retry_private: |
1000 | |
1001 | out_unlock: |
1002 | double_unlock_hb(hb1, hb2); |
1003 | + hb_waiters_dec(hb2); |
1004 | |
1005 | /* |
1006 | * drop_futex_key_refs() must be called outside the spinlocks. During |
1007 | @@ -2875,9 +2882,28 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, |
1008 | return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); |
1009 | } |
1010 | |
1011 | -static int __init futex_init(void) |
1012 | +static void __init futex_detect_cmpxchg(void) |
1013 | { |
1014 | +#ifndef CONFIG_HAVE_FUTEX_CMPXCHG |
1015 | u32 curval; |
1016 | + |
1017 | + /* |
1018 | + * This will fail and we want it. Some arch implementations do |
1019 | + * runtime detection of the futex_atomic_cmpxchg_inatomic() |
1020 | + * functionality. We want to know that before we call in any |
1021 | + * of the complex code paths. Also we want to prevent |
1022 | + * registration of robust lists in that case. NULL is |
1023 | + * guaranteed to fault and we get -EFAULT on functional |
1024 | + * implementation, the non-functional ones will return |
1025 | + * -ENOSYS. |
1026 | + */ |
1027 | + if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT) |
1028 | + futex_cmpxchg_enabled = 1; |
1029 | +#endif |
1030 | +} |
1031 | + |
1032 | +static int __init futex_init(void) |
1033 | +{ |
1034 | unsigned int futex_shift; |
1035 | unsigned long i; |
1036 | |
1037 | @@ -2893,18 +2919,8 @@ static int __init futex_init(void) |
1038 | &futex_shift, NULL, |
1039 | futex_hashsize, futex_hashsize); |
1040 | futex_hashsize = 1UL << futex_shift; |
1041 | - /* |
1042 | - * This will fail and we want it. Some arch implementations do |
1043 | - * runtime detection of the futex_atomic_cmpxchg_inatomic() |
1044 | - * functionality. We want to know that before we call in any |
1045 | - * of the complex code paths. Also we want to prevent |
1046 | - * registration of robust lists in that case. NULL is |
1047 | - * guaranteed to fault and we get -EFAULT on functional |
1048 | - * implementation, the non-functional ones will return |
1049 | - * -ENOSYS. |
1050 | - */ |
1051 | - if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT) |
1052 | - futex_cmpxchg_enabled = 1; |
1053 | + |
1054 | + futex_detect_cmpxchg(); |
1055 | |
1056 | for (i = 0; i < futex_hashsize; i++) { |
1057 | atomic_set(&futex_queues[i].waiters, 0); |
1058 | diff --git a/lib/nlattr.c b/lib/nlattr.c |
1059 | index 18eca7809b08..fc6754720ced 100644 |
1060 | --- a/lib/nlattr.c |
1061 | +++ b/lib/nlattr.c |
1062 | @@ -303,9 +303,15 @@ int nla_memcmp(const struct nlattr *nla, const void *data, |
1063 | */ |
1064 | int nla_strcmp(const struct nlattr *nla, const char *str) |
1065 | { |
1066 | - int len = strlen(str) + 1; |
1067 | - int d = nla_len(nla) - len; |
1068 | + int len = strlen(str); |
1069 | + char *buf = nla_data(nla); |
1070 | + int attrlen = nla_len(nla); |
1071 | + int d; |
1072 | |
1073 | + if (attrlen > 0 && buf[attrlen - 1] == '\0') |
1074 | + attrlen--; |
1075 | + |
1076 | + d = attrlen - len; |
1077 | if (d == 0) |
1078 | d = memcmp(nla_data(nla), str, len); |
1079 | |
1080 | diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c |
1081 | index f2610e157660..7b326529e6a2 100644 |
1082 | --- a/net/ipv6/icmp.c |
1083 | +++ b/net/ipv6/icmp.c |
1084 | @@ -520,7 +520,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info) |
1085 | np->tclass, NULL, &fl6, (struct rt6_info *)dst, |
1086 | MSG_DONTWAIT, np->dontfrag); |
1087 | if (err) { |
1088 | - ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS); |
1089 | + ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS); |
1090 | ip6_flush_pending_frames(sk); |
1091 | } else { |
1092 | err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, |
1093 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c |
1094 | index 64d6073731d3..3702d179506d 100644 |
1095 | --- a/net/ipv6/ip6_output.c |
1096 | +++ b/net/ipv6/ip6_output.c |
1097 | @@ -1566,8 +1566,8 @@ int ip6_push_pending_frames(struct sock *sk) |
1098 | if (proto == IPPROTO_ICMPV6) { |
1099 | struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); |
1100 | |
1101 | - ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type); |
1102 | - ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS); |
1103 | + ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type); |
1104 | + ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); |
1105 | } |
1106 | |
1107 | err = ip6_local_out(skb); |
1108 | diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c |
1109 | index e1e47350784b..08b367c6b9cf 100644 |
1110 | --- a/net/ipv6/mcast.c |
1111 | +++ b/net/ipv6/mcast.c |
1112 | @@ -1620,11 +1620,12 @@ static void mld_sendpack(struct sk_buff *skb) |
1113 | dst_output); |
1114 | out: |
1115 | if (!err) { |
1116 | - ICMP6MSGOUT_INC_STATS_BH(net, idev, ICMPV6_MLD2_REPORT); |
1117 | - ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS); |
1118 | - IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_OUTMCAST, payload_len); |
1119 | - } else |
1120 | - IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTDISCARDS); |
1121 | + ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT); |
1122 | + ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); |
1123 | + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len); |
1124 | + } else { |
1125 | + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); |
1126 | + } |
1127 | |
1128 | rcu_read_unlock(); |
1129 | return; |
1130 | diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c |
1131 | index 587bbdcb22b4..bda74291c3e0 100644 |
1132 | --- a/net/ipv6/ping.c |
1133 | +++ b/net/ipv6/ping.c |
1134 | @@ -182,8 +182,8 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, |
1135 | MSG_DONTWAIT, np->dontfrag); |
1136 | |
1137 | if (err) { |
1138 | - ICMP6_INC_STATS_BH(sock_net(sk), rt->rt6i_idev, |
1139 | - ICMP6_MIB_OUTERRORS); |
1140 | + ICMP6_INC_STATS(sock_net(sk), rt->rt6i_idev, |
1141 | + ICMP6_MIB_OUTERRORS); |
1142 | ip6_flush_pending_frames(sk); |
1143 | } else { |
1144 | err = icmpv6_push_pending_frames(sk, &fl6, |
1145 | diff --git a/net/rds/iw.c b/net/rds/iw.c |
1146 | index 7826d46baa70..589935661d66 100644 |
1147 | --- a/net/rds/iw.c |
1148 | +++ b/net/rds/iw.c |
1149 | @@ -239,7 +239,8 @@ static int rds_iw_laddr_check(__be32 addr) |
1150 | ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin); |
1151 | /* due to this, we will claim to support IB devices unless we |
1152 | check node_type. */ |
1153 | - if (ret || cm_id->device->node_type != RDMA_NODE_RNIC) |
1154 | + if (ret || !cm_id->device || |
1155 | + cm_id->device->node_type != RDMA_NODE_RNIC) |
1156 | ret = -EADDRNOTAVAIL; |
1157 | |
1158 | rdsdebug("addr %pI4 ret %d node type %d\n", |
1159 | diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c |
1160 | index b332e2cc0954..e294b86c8d88 100644 |
1161 | --- a/security/selinux/hooks.c |
1162 | +++ b/security/selinux/hooks.c |
1163 | @@ -1418,15 +1418,33 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent |
1164 | isec->sid = sbsec->sid; |
1165 | |
1166 | if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) { |
1167 | - if (opt_dentry) { |
1168 | - isec->sclass = inode_mode_to_security_class(inode->i_mode); |
1169 | - rc = selinux_proc_get_sid(opt_dentry, |
1170 | - isec->sclass, |
1171 | - &sid); |
1172 | - if (rc) |
1173 | - goto out_unlock; |
1174 | - isec->sid = sid; |
1175 | - } |
1176 | + /* We must have a dentry to determine the label on |
1177 | + * procfs inodes */ |
1178 | + if (opt_dentry) |
1179 | + /* Called from d_instantiate or |
1180 | + * d_splice_alias. */ |
1181 | + dentry = dget(opt_dentry); |
1182 | + else |
1183 | + /* Called from selinux_complete_init, try to |
1184 | + * find a dentry. */ |
1185 | + dentry = d_find_alias(inode); |
1186 | + /* |
1187 | + * This can be hit on boot when a file is accessed |
1188 | + * before the policy is loaded. When we load policy we |
1189 | + * may find inodes that have no dentry on the |
1190 | + * sbsec->isec_head list. No reason to complain as |
1191 | + * these will get fixed up the next time we go through |
1192 | + * inode_doinit() with a dentry, before these inodes |
1193 | + * could be used again by userspace. |
1194 | + */ |
1195 | + if (!dentry) |
1196 | + goto out_unlock; |
1197 | + isec->sclass = inode_mode_to_security_class(inode->i_mode); |
1198 | + rc = selinux_proc_get_sid(dentry, isec->sclass, &sid); |
1199 | + dput(dentry); |
1200 | + if (rc) |
1201 | + goto out_unlock; |
1202 | + isec->sid = sid; |
1203 | } |
1204 | break; |
1205 | } |
1206 | diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c |
1207 | index e354ab1ec20f..a8dec9e9e876 100644 |
1208 | --- a/sound/pci/hda/hda_intel.c |
1209 | +++ b/sound/pci/hda/hda_intel.c |
1210 | @@ -297,9 +297,9 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 }; |
1211 | #define ULI_NUM_CAPTURE 5 |
1212 | #define ULI_NUM_PLAYBACK 6 |
1213 | |
1214 | -/* ATI HDMI may have up to 8 playbacks and 0 capture */ |
1215 | +/* ATI HDMI has 1 playback and 0 capture */ |
1216 | #define ATIHDMI_NUM_CAPTURE 0 |
1217 | -#define ATIHDMI_NUM_PLAYBACK 8 |
1218 | +#define ATIHDMI_NUM_PLAYBACK 1 |
1219 | |
1220 | /* TERA has 4 playback and 3 capture */ |
1221 | #define TERA_NUM_CAPTURE 3 |