4.4.214-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.4.214-stable review
This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 15 Feb 2020 15:16:40 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.214-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.214-rc1
Mike Snitzer <[email protected]>
dm: fix potential for q->make_request_fn NULL pointer
Nicolai Stange <[email protected]>
libertas: make lbs_ibss_join_existing() return error code on rates overflow
Nicolai Stange <[email protected]>
libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
Qing Xu <[email protected]>
mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
Qing Xu <[email protected]>
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
Geert Uytterhoeven <[email protected]>
pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
Alexey Kardashevskiy <[email protected]>
powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
Alexandre Belloni <[email protected]>
ARM: dts: at91: sama5d3: define clock rate range for tcb1
Alexandre Belloni <[email protected]>
ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
Jose Abreu <[email protected]>
ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
Paul Kocialkowski <[email protected]>
rtc: hym8563: Return -EINVAL if the time is known to be invalid
Bean Huo <[email protected]>
scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
Ranjani Sridharan <[email protected]>
ASoC: pcm: update FE/BE trigger order based on the command
Song Liu <[email protected]>
perf/core: Fix mlock accounting in perf_mmap()
Konstantin Khlebnikov <[email protected]>
clocksource: Prevent double add_timer_on() for watchdog_timer
Ronnie Sahlberg <[email protected]>
cifs: fail i/o on soft mounts if sessionsetup errors out
Miaohe Lin <[email protected]>
KVM: nVMX: vmread should not set rflags to specify success in case of #PF
Sean Christopherson <[email protected]>
KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
Sean Christopherson <[email protected]>
KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
Josef Bacik <[email protected]>
btrfs: flush write bio if we loop in extent_write_cache_pages
Marios Pomonis <[email protected]>
KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
David Hildenbrand <[email protected]>
KVM: x86: drop picdev_in_range()
Wayne Lin <[email protected]>
drm/dp_mst: Remove VCPI while disabling topology mgr
Claudiu Beznea <[email protected]>
drm: atmel-hlcdc: enable clock before configuring timing engine
Filipe Manana <[email protected]>
Btrfs: fix race between adding and putting tree mod seq elements and nodes
David Sterba <[email protected]>
btrfs: remove trivial locking wrappers of tree mod log
Filipe Manana <[email protected]>
Btrfs: fix assertion failure on fsync with NO_HOLES enabled
Trond Myklebust <[email protected]>
NFS: Directory page cache pages need to be locked when read
Thomas Meyer <[email protected]>
NFS: Fix bool initialization/comparison
Trond Myklebust <[email protected]>
NFS: Fix memory leaks and corruption in readdir
Eric Dumazet <[email protected]>
bonding/alb: properly access headers in bond_alb_xmit()
Florian Fainelli <[email protected]>
net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
Andreas Kemnade <[email protected]>
mfd: rn5t618: Mark ADC control register volatile
Marco Felsch <[email protected]>
mfd: da9062: Fix watchdog compatible string
Nathan Chancellor <[email protected]>
net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
Nathan Chancellor <[email protected]>
net: smc911x: Adjust indentation in smc911x_phy_configure
Nathan Chancellor <[email protected]>
ppp: Adjust indentation into ppp_async_input
Nathan Chancellor <[email protected]>
NFC: pn544: Adjust indentation in pn544_hci_check_presence
Nathan Chancellor <[email protected]>
powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
Nathan Chancellor <[email protected]>
ext2: Adjust indentation in ext2_fill_super
Nathan Chancellor <[email protected]>
scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
Nathan Chancellor <[email protected]>
scsi: csiostor: Adjust indentation in csio_device_reset
Bart Van Assche <[email protected]>
scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
Sean Christopherson <[email protected]>
KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
Sean Christopherson <[email protected]>
KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
Sean Christopherson <[email protected]>
KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
Marios Pomonis <[email protected]>
KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
Marios Pomonis <[email protected]>
KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
Marios Pomonis <[email protected]>
KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
Roberto Bergantinos Corpas <[email protected]>
sunrpc: expiry_time should be seconds not timeval
Brian Norris <[email protected]>
mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
Stephen Warren <[email protected]>
ARM: tegra: Enable PLLP bypass during Tegra124 LP1
Josef Bacik <[email protected]>
btrfs: set trans->drity in btrfs_commit_transaction
Chuhong Yuan <[email protected]>
crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
Herbert Xu <[email protected]>
crypto: api - Fix race condition in crypto_spawn_alg
Herbert Xu <[email protected]>
crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
Herbert Xu <[email protected]>
padata: Remove broken queue flushing
Joe Thornber <[email protected]>
dm space map common: fix to ensure new block isn't already in use
Michael Ellerman <[email protected]>
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
Ioanna Alifieraki <[email protected]>
Revert "ovl: modify ovl_permission() to do checks on two inodes"
Sven Van Asbroeck <[email protected]>
power: supply: ltc2941-battery-gauge: fix use-after-free
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix mtcp dump collection failure
Herbert Xu <[email protected]>
crypto: api - Check spawn->alg under lock in crypto_drop_spawn
Yurii Monakov <[email protected]>
PCI: keystone: Fix link training retries initiation
Linus Walleij <[email protected]>
mmc: spi: Toggle SPI polarity, do not hardcode it
Pingfan Liu <[email protected]>
powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
Gustavo A. R. Silva <[email protected]>
lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
Takashi Iwai <[email protected]>
ALSA: dummy: Fix PCM format loop in proc output
Bryan O'Donoghue <[email protected]>
usb: gadget: f_ecm: Use atomic_t to track in-flight request
Bryan O'Donoghue <[email protected]>
usb: gadget: f_ncm: Use atomic_t to track in-flight request
Roger Quadros <[email protected]>
usb: gadget: legacy: set max_speed to super-speed
Navid Emamdoost <[email protected]>
brcmfmac: Fix memory leak in brcmf_usbdev_qinit
Oliver Neukum <[email protected]>
mfd: dln2: More sanity checking for endpoints
Will Deacon <[email protected]>
media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
Eric Dumazet <[email protected]>
tcp: clear tp->segs_{in|out} in tcp_disconnect()Eric Dumazet <[email protected]>
tcp: clear tp->total_retrans in tcp_disconnect()
Cong Wang <[email protected]>
net_sched: fix an OOB access in cls_tcindex
Eric Dumazet <[email protected]>
net: hsr: fix possible NULL deref in hsr_handle_frame()
Eric Dumazet <[email protected]>
cls_rsvp: fix rsvp_policy
Nobuhiro Iwamatsu <[email protected]>
ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_node
Arnd Bergmann <[email protected]>
sparc32: fix struct ipc64_perm type definition
Pawan Gupta <[email protected]>
x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
Johan Hovold <[email protected]>
media: iguanair: fix endpoint sanity check
-------------
Diffstat:
Makefile | 4 +- arch/arc/boot/dts/axs10x_mb.dtsi | 1 + arch/arm/boot/dts/sama5d3.dtsi | 28 +- arch/arm/boot/dts/sama5d3_can.dtsi | 4 +- arch/arm/boot/dts/sama5d3_tcb1.dtsi | 1 + arch/arm/boot/dts/sama5d3_uart.dtsi | 4 +- arch/arm/mach-tegra/sleep-tegra30.S | 11 + arch/powerpc/Kconfig | 1 + arch/powerpc/boot/4xx.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 4 +- arch/powerpc/kvm/book3s_pr.c | 4 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 4 +- arch/powerpc/platforms/pseries/iommu.c | 43 +- arch/sparc/include/uapi/asm/ipcbuf.h | 22 +- arch/x86/kernel/cpu/tsx.c | 13 +- arch/x86/kvm/emulate.c | 28 +- arch/x86/kvm/hyperv.c | 11 +- arch/x86/kvm/i8259.c | 41 +- arch/x86/kvm/ioapic.c | 15 +- arch/x86/kvm/lapic.c | 13 +- arch/x86/kvm/mtrr.c | 9 +- arch/x86/kvm/pmu.h | 18 +- arch/x86/kvm/pmu_intel.c | 24 +- arch/x86/kvm/vmx.c | 4 +- arch/x86/kvm/vmx/vmx.c | 8033 ++++++++++++++++++++ arch/x86/kvm/x86.c | 23 +- crypto/algapi.c | 22 +- crypto/api.c | 3 +- crypto/internal.h | 1 - crypto/pcrypt.c | 1 - drivers/crypto/picoxcell_crypto.c | 15 +- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c | 8 +- drivers/gpu/drm/drm_dp_mst_topology.c | 12 + drivers/md/dm.c | 9 +- drivers/md/persistent-data/dm-space-map-common.c | 27 + drivers/md/persistent-data/dm-space-map-common.h | 2 + drivers/md/persistent-data/dm-space-map-disk.c | 6 +- drivers/md/persistent-data/dm-space-map-metadata.c | 5 +- drivers/media/rc/iguanair.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 12 + drivers/mfd/da9062-core.c | 2 +- drivers/mfd/dln2.c | 13 +- drivers/mfd/rn5t618.c | 1 + drivers/mmc/host/mmc_spi.c | 11 +- drivers/net/bonding/bond_alb.c | 44 +- drivers/net/ethernet/broadcom/bcmsysport.c | 3 + drivers/net/ethernet/dec/tulip/dmfe.c | 7 +- drivers/net/ethernet/dec/tulip/uli526x.c | 4 +- drivers/net/ethernet/smsc/smc911x.c | 2 +- drivers/net/ppp/ppp_async.c | 18 +- drivers/net/wireless/brcm80211/brcmfmac/usb.c | 1 + drivers/net/wireless/libertas/cfg.c | 2 + drivers/net/wireless/mwifiex/scan.c | 7 + drivers/net/wireless/mwifiex/sta_ioctl.c | 1 + drivers/net/wireless/mwifiex/wmm.c | 4 + drivers/nfc/pn544/pn544.c | 2 +- drivers/of/Kconfig | 4 + drivers/of/address.c | 6 +- drivers/pci/host/pci-keystone-dw.c | 2 +- drivers/pinctrl/sh-pfc/pfc-r8a7778.c | 4 +- drivers/power/ltc2941-battery-gauge.c | 2 +- drivers/rtc/rtc-hym8563.c | 2 +- drivers/scsi/csiostor/csio_scsi.c | 2 +- drivers/scsi/qla2xxx/qla_mbx.c | 3 +- drivers/scsi/qla2xxx/qla_nx.c | 8 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/scsi/ufs/ufshcd.c | 3 +- drivers/usb/gadget/function/f_ecm.c | 16 +- drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/legacy/cdc2.c | 2 +- drivers/usb/gadget/legacy/g_ffs.c | 2 +- drivers/usb/gadget/legacy/multi.c | 2 +- drivers/usb/gadget/legacy/ncm.c | 2 +- fs/btrfs/ctree.c | 64 +- fs/btrfs/ctree.h | 6 +- fs/btrfs/delayed-ref.c | 8 +- fs/btrfs/disk-io.c | 1 - fs/btrfs/extent_io.c | 8 + fs/btrfs/tests/btrfs-tests.c | 1 - fs/btrfs/transaction.c | 8 + fs/btrfs/tree-log.c | 7 +- fs/cifs/smb2pdu.c | 10 +- fs/ext2/super.c | 6 +- fs/nfs/callback_proc.c | 2 +- fs/nfs/dir.c | 59 +- fs/nfs/nfs4client.c | 2 +- fs/overlayfs/inode.c | 13 - kernel/events/core.c | 10 +- kernel/padata.c | 46 +- kernel/time/clocksource.c | 11 +- lib/test_kasan.c | 1 + net/hsr/hsr_slave.c | 2 + net/ipv4/tcp.c | 3 + net/sched/cls_rsvp.h | 6 +- net/sched/cls_tcindex.c | 40 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 + sound/drivers/dummy.c | 2 +- sound/soc/qcom/apq8016_sbc.c | 3 +- sound/soc/soc-pcm.c | 95 +- 99 files changed, 8713 insertions(+), 396 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/91 media: iguanair: fix endpoint sanity check
From: Johan Hovold <[email protected]>
[ Upstream commit 1b257870a78b0a9ce98fdfb052c58542022ffb5b ]
Make sure to use the current alternate setting, which need not be the first one by index, when verifying the endpoint descriptors and initialising the URBs.
Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on.
--- drivers/media/rc/iguanair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/iguanair.c +1 -1
@@ -430,7 +430,7 @@ static int iguanair_probe(struct usb_interface *intf,int ret, pipein, pipeout;struct usb_host_interface *idesc; - idesc = intf->altsetting; + idesc = intf->cur_altsetting;if (idesc->desc.bNumEndpoints <2 )return -ENODEV ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/91 x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
In reply to Greg Kroah-HartmanFrom: Pawan Gupta <[email protected]>
[ Upstream commit 5efc6fa9044c3356d6046c6e1da6d02572dbed6b ]
/proc/cpuinfo currently reports Hardware Lock Elision (HLE) feature to be present on boot cpu even if it was disabled during the bootup. This is because cpuinfo_x86->x86_capability HLE bit is not updated after TSX state is changed via the new MSR IA32_TSX_CTRL.
Update the cached HLE bit also since it is expected to change after an update to CPUID_CLEAR bit in MSR IA32_TSX_CTRL.
--- arch/x86/kernel/cpu/tsx.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/x86/kernel/cpu/tsx.c +7 -6
@@ -115,11 +115,12 @@ void __init tsx_init(void)tsx_disable ();/* -* tsx_disable() will change the state of the -* RTM CPUID bit. Clear it here since it is now -* expected to be not set. +* tsx_disable() will change the state of the RTM and HLE CPUID +* bits. Clear them here since they are now expected to be not +* set. */ setup_clear_cpu_cap (X86_FEATURE_RTM ); +setup_clear_cpu_cap (X86_FEATURE_HLE ); }else if (tsx_ctrl_state ==TSX_CTRL_ENABLE ) {/*
@@ -131,10 +132,10 @@ void __init tsx_init(void)tsx_enable ();/* -* tsx_enable() will change the state of the -* RTM CPUID bit. Force it here since it is now -* expected to be set. +* tsx_enable() will change the state of the RTM and HLE CPUID +* bits. Force them here since they are now expected to be set. */ setup_force_cpu_cap (X86_FEATURE_RTM ); +setup_force_cpu_cap (X86_FEATURE_HLE ); } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/91 sparc32: fix struct ipc64_perm type definition
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 34ca70ef7d3a9fa7e89151597db5e37ae1d429b4 ]
As discussed in the strace issue tracker, it appears that the sparc32 sysvipc support has been broken for the past 11 years. It was however working in compat mode, which is how it must have escaped most of the regular testing.
The problem is that a cleanup patch inadvertently changed the uid/gid fields in struct ipc64_perm from 32-bit types to 16-bit types in uapi headers.
Both glibc and uclibc-ng still use the original types, so they should work fine with compat mode, but not natively. Change the definitions to use __kernel_uid32_t and __kernel_gid32_t again.
--- arch/sparc/include/uapi/asm/ipcbuf.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
arch/sparc/include/uapi/asm/ipcbuf.h +11 -11
@@ -14,19 +14,19 @@struct ipc64_perm { -__kernel_key_t key; -__kernel_uid_t uid; -__kernel_gid_t gid; -__kernel_uid_t cuid; -__kernel_gid_t cgid; +__kernel_key_t key; +__kernel_uid32_t uid; +__kernel_gid32_t gid; +__kernel_uid32_t cuid; +__kernel_gid32_t cgid;#ifndef __arch64__ -unsigned short __pad0; +unsigned short __pad0;#endif -__kernel_mode_t mode; -unsigned short __pad1; -unsigned short seq; -unsigned long long __unused1; -unsigned long long __unused2; +__kernel_mode_t mode; +unsigned short __pad1; +unsigned short seq; +unsigned long long __unused1; +unsigned long long __unused2; };#endif /* __SPARC_IPCBUF_H */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/91 ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_node
In reply to Greg Kroah-HartmanFrom: Nobuhiro Iwamatsu <[email protected]>
[ This is a fix specific to 4.4.y and 4.9.y stable trees;
4.14.y and older are not affected ]
The of-node refcount fixes were made in commit 8d1667200850 ("ASoC: qcom:
Fix of-node refcount unbalance in apq8016_sbc_parse_of()"), but not enough in 4.4.y and 4.9.y. The modification of link->codec_of_node is missing. This fixes of-node refcount unbalance to link->codec_of_node.
--- sound/soc/qcom/apq8016_sbc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/qcom/apq8016_sbc.c +2 -1
@@ -112,7 +112,8 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card) link->codec_of_node =of_parse_phandle (codec,"sound-dai" ,0 );if (!link->codec_of_node) {dev_err (card->dev,"error getting codec phandle\n" ); -return ERR_PTR (-EINVAL ); + ret = -EINVAL ; + goto error; } ret =snd_soc_of_get_dai_name (cpu, &link->cpu_dai_name);
Signature · 1 line
2.23.0
Greg Kroah-Hartman
maintainerPATCH 5/91 cls_rsvp: fix rsvp_policy
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit cb3c0e6bdf64d0d124e94ce43cbe4ccbb9b37f51 ]
NLA_BINARY can be confusing, since .len value represents the max size of the blob.
cls_rsvp really wants user space to provide long enough data for TCA_RSVP_DST and TCA_RSVP_SRC attributes.
BUG: KMSAN: uninit-value in rsvp_get net/sched/cls_rsvp.h:258 [inline] BUG: KMSAN: uninit-value in gen_handle net/sched/cls_rsvp.h:402 [inline] BUG: KMSAN: uninit-value in rsvp_change+0x1ae9/0x4220 net/sched/cls_rsvp.h:572 CPU: 1 PID: 13228 Comm: syz-executor.1 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 rsvp_get net/sched/cls_rsvp.h:258 [inline] gen_handle net/sched/cls_rsvp.h:402 [inline] rsvp_change+0x1ae9/0x4220 net/sched/cls_rsvp.h:572 tc_new_tfilter+0x31fe/0x5010 net/sched/cls_api.c:2104 rtnetlink_rcv_msg+0xcb7/0x1570 net/core/rtnetlink.c:5415 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45b349 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f269d43dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f269d43e6d4 RCX: 000000000045b349 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000009c2 R14: 00000000004cb338 R15: 000000000075bfd4
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2774 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4382 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] netlink_sendmsg+0x7d3/0x14d0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- net/sched/cls_rsvp.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/sched/cls_rsvp.h +2 -4
@@ -455,10 +455,8 @@ static u32 gen_tunnel(struct rsvp_head *static const struct nla_policy rsvp_policy[TCA_RSVP_MAX +1 ] = { [TCA_RSVP_CLASSID ] = { .type =NLA_U32 }, - [TCA_RSVP_DST ] = { .type =NLA_BINARY , - .len =RSVP_DST_LEN *sizeof (u32) }, - [TCA_RSVP_SRC ] = { .type =NLA_BINARY , - .len =RSVP_DST_LEN *sizeof (u32) }, + [TCA_RSVP_DST ] = { .len =RSVP_DST_LEN *sizeof (u32) }, + [TCA_RSVP_SRC ] = { .len =RSVP_DST_LEN *sizeof (u32) }, [TCA_RSVP_PINFO ] = { .len =sizeof (struct tc_rsvp_pinfo ) }, };
Greg Kroah-Hartman
maintainerPATCH 6/91 net: hsr: fix possible NULL deref in hsr_handle_frame()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 2b5b8251bc9fe2f9118411f037862ee17cf81e97 ]
hsr_port_get_rcu() can return NULL, so we need to be careful.
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 1 PID: 10249 Comm: syz-executor.5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline] RIP: 0010:hsr_addr_is_self+0x86/0x330 net/hsr/hsr_framereg.c:44 Code: 04 00 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 6b ff 94 f9 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 75 02 00 00 48 8b 43 30 49 39 c6 49 89 47 c0 0f RSP: 0018:ffffc90000da8a90 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87e0cc33 RDX: 0000000000000006 RSI: ffffffff87e035d5 RDI: 0000000000000000 RBP: ffffc90000da8b20 R08: ffff88808e7de040 R09: ffffed1015d2707c R10: ffffed1015d2707b R11: ffff8880ae9383db R12: ffff8880a689bc5e R13: 1ffff920001b5153 R14: 0000000000000030 R15: ffffc90000da8af8 FS: 00007fd7a42be700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32338000 CR3: 00000000a928c000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> hsr_handle_frame+0x1c5/0x630 net/hsr/hsr_slave.c:31 __netif_receive_skb_core+0xfbc/0x30b0 net/core/dev.c:5099 __netif_receive_skb_one_core+0xa8/0x1a0 net/core/dev.c:5196 __netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5312 process_backlog+0x206/0x750 net/core/dev.c:6144 napi_poll net/core/dev.c:6582 [inline] net_rx_action+0x508/0x1120 net/core/dev.c:6650 __do_softirq+0x262/0x98c kernel/softirq.c:292 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082 </IRQ>
--- net/hsr/hsr_slave.c | 2 ++ 1 file changed, 2 insertions(+)
net/hsr/hsr_slave.c +2 -0
@@ -30,6 +30,8 @@ static rx_handler_result_t hsr_handle_frrcu_read_lock ();/* hsr->node_db, hsr->ports */ port =hsr_port_get_rcu (skb->dev); +if (!port) + goto finish_pass;if (hsr_addr_is_self (port->hsr,eth_hdr (skb)->h_source)) {/* Directly kill frames sent by ourselves */
Greg Kroah-Hartman
maintainerPATCH 7/91 net_sched: fix an OOB access in cls_tcindex
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit 599be01ee567b61f4471ee8078870847d0a11e8e ]
As Eric noticed, tcindex_alloc_perfect_hash() uses cp->hash to compute the size of memory allocation, but cp->hash is set again after the allocation, this caused an out-of-bound access.
So we have to move all cp->hash initialization and computation before the memory allocation. Move cp->mask and cp->shift together as cp->hash may need them for computation too.
--- net/sched/cls_tcindex.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-)
net/sched/cls_tcindex.c +20 -20
@@ -267,6 +267,25 @@ tcindex_set_parms(struct net *net, struc cp->fall_through = p->fall_through; cp->tp = tp; +if (tb[TCA_TCINDEX_HASH ]) + cp->hash =nla_get_u32 (tb[TCA_TCINDEX_HASH ]); + +if (tb[TCA_TCINDEX_MASK ]) + cp->mask =nla_get_u16 (tb[TCA_TCINDEX_MASK ]); + +if (tb[TCA_TCINDEX_SHIFT ]) + cp->shift =nla_get_u32 (tb[TCA_TCINDEX_SHIFT ]); + +if (!cp->hash) { +/* Hash not specified, use perfect hash if the upper limit +* of the hashing index is below the threshold. +*/ +if ((cp->mask >> cp->shift) <PERFECT_HASH_THRESHOLD ) + cp->hash = (cp->mask >> cp->shift) +1 ; +else + cp->hash =DEFAULT_HASH_SIZE ; + } +if (p->perfect) {int i;
@@ -274,7 +293,7 @@ tcindex_set_parms(struct net *net, struc sizeof(*r) * cp->hash, GFP_KERNEL);if (!cp->perfect) goto errout; -for (i =0 ; i < cp->hash; i++) +for (i =0 ; i <min (cp->hash, p->hash); i++)tcf_exts_init (&cp->perfect[i].exts,TCA_TCINDEX_ACT ,TCA_TCINDEX_POLICE ); balloc =1 ;
@@ -286,15 +305,6 @@ tcindex_set_parms(struct net *net, strucif (old_r) cr.res = r->res; -if (tb[TCA_TCINDEX_HASH ]) - cp->hash =nla_get_u32 (tb[TCA_TCINDEX_HASH ]); - -if (tb[TCA_TCINDEX_MASK ]) - cp->mask =nla_get_u16 (tb[TCA_TCINDEX_MASK ]); - -if (tb[TCA_TCINDEX_SHIFT ]) - cp->shift =nla_get_u32 (tb[TCA_TCINDEX_SHIFT ]); - err = -EBUSY ;/* Hash already allocated, make sure that we still meet the
@@ -312,16 +322,6 @@ tcindex_set_parms(struct net *net, strucif (tb[TCA_TCINDEX_FALL_THROUGH ]) cp->fall_through =nla_get_u32 (tb[TCA_TCINDEX_FALL_THROUGH ]); -if (!cp->hash) { -/* Hash not specified, use perfect hash if the upper limit -* of the hashing index is below the threshold. -*/ -if ((cp->mask >> cp->shift) <PERFECT_HASH_THRESHOLD ) - cp->hash = (cp->mask >> cp->shift) +1 ; -else - cp->hash =DEFAULT_HASH_SIZE ; - } -if (!cp->perfect && !cp->h) cp->alloc_hash = cp->hash;
Greg Kroah-Hartman
maintainerPATCH 8/91 tcp: clear tp->total_retrans in tcp_disconnect()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit c13c48c00a6bc1febc73902505bdec0967bd7095 ]
total_retrans needs to be cleared in tcp_disconnect().
tcp_disconnect() is rarely used, but it is worth fixing it.
--- net/ipv4/tcp.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp.c +1 -0
@@ -2261,6 +2261,7 @@ int tcp_disconnect(struct sock *sk, int tp->window_clamp =0 ;tcp_set_ca_state (sk, TCP_CA_Open);tcp_clear_retrans (tp); + tp->total_retrans =0 ;inet_csk_delack_init (sk);/* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 * issue in __tcp_select_window()
Greg Kroah-Hartman
maintainerPATCH 9/91 tcp: clear tp->segs_{in|out} in tcp_disconnect()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 784f8344de750a41344f4bbbebb8507a730fc99c ]
tp->segs_in and tp->segs_out need to be cleared in tcp_disconnect().
tcp_disconnect() is rarely used, but it is worth fixing it.
--- net/ipv4/tcp.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/tcp.c +2 -0
@@ -2273,6 +2273,8 @@ int tcp_disconnect(struct sock *sk, intdst_release (sk->sk_rx_dst); sk->sk_rx_dst =NULL ;tcp_saved_syn_free (tp); + tp->segs_in =0 ; + tp->segs_out =0 ; tp->bytes_acked =0 ; tp->bytes_received =0 ;
Greg Kroah-Hartman
maintainerPATCH 10/91 media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 68035c80e129c4cfec659aac4180354530b26527 upstream.
Way back in 2017, fuzzing the 4.14-rc2 USB stack with syzkaller kicked up the following WARNING from the UVC chain scanning code:
| list_add double add: new=ffff880069084010, prev=ffff880069084010, | next=ffff880067d22298. | ------------[ cut here ]------------ | WARNING: CPU: 1 PID: 1846 at lib/list_debug.c:31 __list_add_valid+0xbd/0xf0 | Modules linked in: | CPU: 1 PID: 1846 Comm: kworker/1:2 Not tainted | 4.14.0-rc2-42613-g1488251d1a98 #238 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 | Workqueue: usb_hub_wq hub_event | task: ffff88006b01ca40 task.stack: ffff880064358000 | RIP: 0010:__list_add_valid+0xbd/0xf0 lib/list_debug.c:29 | RSP: 0018:ffff88006435ddd0 EFLAGS: 00010286 | RAX: 0000000000000058 RBX: ffff880067d22298 RCX: 0000000000000000 | RDX: 0000000000000058 RSI: ffffffff85a58800 RDI: ffffed000c86bbac | RBP: ffff88006435dde8 R08: 1ffff1000c86ba52 R09: 0000000000000000 | R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069084010 | R13: ffff880067d22298 R14: ffff880069084010 R15: ffff880067d222a0 | FS: 0000000000000000(0000) GS:ffff88006c900000(0000) knlGS:0000000000000000 | CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | CR2: 0000000020004ff2 CR3: 000000006b447000 CR4: 00000000000006e0 | Call Trace: | __list_add ./include/linux/list.h:59 | list_add_tail+0x8c/0x1b0 ./include/linux/list.h:92 | uvc_scan_chain_forward.isra.8+0x373/0x416 | drivers/media/usb/uvc/uvc_driver.c:1471 | uvc_scan_chain drivers/media/usb/uvc/uvc_driver.c:1585 | uvc_scan_device drivers/media/usb/uvc/uvc_driver.c:1769 | uvc_probe+0x77f2/0x8f00 drivers/media/usb/uvc/uvc_driver.c:2104
Looking into the output from usbmon, the interesting part is the following data packet:
ffff880069c63e00 30710169 C Ci:1:002:0 0 143 = 09028f00 01030080 00090403 00000e01 00000924 03000103 7c003328 010204db
If we drop the lead configuration and interface descriptors, we're left with an output terminal descriptor describing a generic display:
/* Output terminal descriptor */
buf[0] 09
buf[1] 24
buf[2] 03 /* UVC_VC_OUTPUT_TERMINAL */
buf[3] 00 /* ID */
buf[4] 01 /* type == 0x0301 (UVC_OTT_DISPLAY) */
buf[5] 03
buf[6] 7c
buf[7] 00 /* source ID refers to self! */
buf[8] 33
The problem with this descriptor is that it is self-referential: the source ID of 0 matches itself! This causes the 'struct uvc_entity' representing the display to be added to its chain list twice during 'uvc_scan_chain()': once via 'uvc_scan_chain_entity()' when it is processed directly from the 'dev->entities' list and then again immediately afterwards when trying to follow the source ID in 'uvc_scan_chain_forward()'
Add a check before adding an entity to a chain list to ensure that the entity is not already part of a chain.
--- drivers/media/usb/uvc/uvc_driver.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +12 -0
@@ -1411,6 +1411,11 @@ static int uvc_scan_chain_forward(structbreak ;if (forward == prev)continue ; +if (forward->chain.next || forward->chain.prev) { +uvc_trace (UVC_TRACE_DESCR ,"Found reference to " +"entity %d already in chain.\n" , forward->id); +return -EINVAL ; + }switch (UVC_ENTITY_TYPE (forward)) {case UVC_VC_EXTENSION_UNIT :
@@ -1492,6 +1497,13 @@ static int uvc_scan_chain_backward(strucreturn -1 ; } +if (term->chain.next || term->chain.prev) { +uvc_trace (UVC_TRACE_DESCR ,"Found reference to " +"entity %d already in chain.\n" , + term->id); +return -EINVAL ; + } +if (uvc_trace_param &UVC_TRACE_PROBE )printk (" %d" , term->id);
Greg Kroah-Hartman
maintainerPATCH 11/91 mfd: dln2: More sanity checking for endpoints
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 2b8bd606b1e60ca28c765f69c1eedd7d2a2e9dca upstream.
It is not enough to check for the number of endpoints. The types must also be correct.
--- drivers/mfd/dln2.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/mfd/dln2.c +11 -2
@@ -729,6 +729,8 @@ static int dln2_probe(struct usb_interfa const struct usb_device_id *usb_id) {struct usb_host_interface *hostif = interface->cur_altsetting; +struct usb_endpoint_descriptor *epin; +struct usb_endpoint_descriptor *epout;struct device *dev = &interface->dev;struct dln2_dev *dln2;int ret;
@@ -738,12 +740,19 @@ static int dln2_probe(struct usb_interfa hostif->desc.bNumEndpoints < 2)return -ENODEV ; + epin = &hostif->endpoint[0 ].desc; + epout = &hostif->endpoint[1 ].desc; +if (!usb_endpoint_is_bulk_out (epout)) +return -ENODEV ; +if (!usb_endpoint_is_bulk_in (epin)) +return -ENODEV ; + dln2 =kzalloc (sizeof (*dln2),GFP_KERNEL );if (!dln2)return -ENOMEM ; - dln2->ep_out = hostif->endpoint[0 ].desc.bEndpointAddress; - dln2->ep_in = hostif->endpoint[1 ].desc.bEndpointAddress; + dln2->ep_out = epout->bEndpointAddress; + dln2->ep_in = epin->bEndpointAddress; dln2->usb_dev =usb_get_dev (interface_to_usbdev (interface)); dln2->interface = interface;usb_set_intfdata (interface, dln2);
Greg Kroah-Hartman
maintainerPATCH 12/91 brcmfmac: Fix memory leak in brcmf_usbdev_qinit
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
commit 4282dc057d750c6a7dd92953564b15c26b54c22c upstream.
In the implementation of brcmf_usbdev_qinit() the allocated memory for reqs is leaking if usb_alloc_urb() fails. Release reqs in the error handling path.
--- drivers/net/wireless/brcm80211/brcmfmac/usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/brcm80211/brcmfmac/usb.c +1 -0
@@ -426,6 +426,7 @@ fail:usb_free_urb (req->urb);list_del (q->next); } +kfree (reqs);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 13/91 usb: gadget: legacy: set max_speed to super-speed
In reply to Greg Kroah-HartmanFrom: Roger Quadros <[email protected]>
commit 463f67aec2837f981b0a0ce8617721ff59685c00 upstream.
These interfaces do support super-speed so let's not limit maximum speed to high-speed.
--- drivers/usb/gadget/legacy/cdc2.c | 2 +- drivers/usb/gadget/legacy/g_ffs.c | 2 +- drivers/usb/gadget/legacy/multi.c | 2 +- drivers/usb/gadget/legacy/ncm.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/legacy/cdc2.c +1 -1
@@ -229,7 +229,7 @@ static struct usb_composite_driver cdc_d .name = "g_cdc", .dev = &device_desc, .strings = dev_strings, - .max_speed = USB_SPEED_HIGH, + .max_speed = USB_SPEED_SUPER, .bind = cdc_bind, .unbind = cdc_unbind, };
drivers/usb/gadget/legacy/g_ffs.c +1 -1
@@ -153,7 +153,7 @@ static struct usb_composite_driver gfs_d .name = DRIVER_NAME, .dev = &gfs_dev_desc, .strings = gfs_dev_strings, - .max_speed = USB_SPEED_HIGH, + .max_speed = USB_SPEED_SUPER, .bind = gfs_bind, .unbind = gfs_unbind, };
drivers/usb/gadget/legacy/multi.c +1 -1
@@ -486,7 +486,7 @@ static struct usb_composite_driver multi .name = "g_multi", .dev = &device_desc, .strings = dev_strings, - .max_speed = USB_SPEED_HIGH, + .max_speed = USB_SPEED_SUPER, .bind = multi_bind, .unbind = multi_unbind, .needs_serial = 1,
drivers/usb/gadget/legacy/ncm.c +1 -1
@@ -203,7 +203,7 @@ static struct usb_composite_driver ncm_d .name = "g_ncm", .dev = &device_desc, .strings = dev_strings, - .max_speed = USB_SPEED_HIGH, + .max_speed = USB_SPEED_SUPER, .bind = gncm_bind, .unbind = gncm_unbind, };
Greg Kroah-Hartman
maintainerPATCH 14/91 usb: gadget: f_ncm: Use atomic_t to track in-flight request
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit 5b24c28cfe136597dc3913e1c00b119307a20c7e upstream.
Currently ncm->notify_req is used to flag when a request is in-flight. ncm->notify_req is set to NULL and when a request completes it is subsequently reset.
This is fundamentally buggy in that the unbind logic of the NCM driver will unconditionally free ncm->notify_req leading to a NULL pointer dereference.
--- drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_ncm.c +13 -4
@@ -57,6 +57,7 @@ struct f_ncm {struct usb_ep *notify;struct usb_request *notify_req;u8 notify_state; +atomic_t notify_count;bool is_open;const struct ndp_parser_opts *parser_opts;
@@ -480,7 +481,7 @@ static void ncm_do_notify(struct f_ncm *int status;/* notification already in flight? */ -if (!req) +if (atomic_read (&ncm->notify_count))return ; event = req->buf;
@@ -520,7 +521,8 @@ static void ncm_do_notify(struct f_ncm * event->bmRequestType =0xA1 ; event->wIndex =cpu_to_le16 (ncm->ctrl_id); - ncm->notify_req =NULL ; +atomic_inc (&ncm->notify_count); +/* * In double buffering if there is a space in FIFO, * completion callback can be called right after the call,
@@ -530,7 +532,7 @@ static void ncm_do_notify(struct f_ncm * status =usb_ep_queue (ncm->notify, req,GFP_ATOMIC );spin_lock (&ncm->lock);if (status <0 ) { - ncm->notify_req = req; +atomic_dec (&ncm->notify_count);DBG (cdev,"notify --> %d\n" , status); } }
@@ -565,17 +567,19 @@ static void ncm_notify_complete(struct ucase 0 :VDBG (cdev,"Notification %02x sent\n" , event->bNotificationType); +atomic_dec (&ncm->notify_count);break ;case -ECONNRESET :case -ESHUTDOWN : +atomic_set (&ncm->notify_count,0 ); ncm->notify_state =NCM_NOTIFY_NONE ;break ;default :DBG (cdev,"event %02x --> %d\n" , event->bNotificationType, req->status); +atomic_dec (&ncm->notify_count);break ; } - ncm->notify_req = req;ncm_do_notify (ncm);spin_unlock (&ncm->lock); }
@@ -1559,6 +1563,11 @@ static void ncm_unbind(struct usb_config ncm_string_defs[0 ].id =0 ;usb_free_all_descriptors (f); +if (atomic_read (&ncm->notify_count)) { +usb_ep_dequeue (ncm->notify, ncm->notify_req); +atomic_set (&ncm->notify_count,0 ); + } +kfree (ncm->notify_req->buf);usb_ep_free_request (ncm->notify, ncm->notify_req); }
Greg Kroah-Hartman
maintainerPATCH 15/91 usb: gadget: f_ecm: Use atomic_t to track in-flight request
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit d710562e01c48d59be3f60d58b7a85958b39aeda upstream.
Currently ecm->notify_req is used to flag when a request is in-flight. ecm->notify_req is set to NULL and when a request completes it is subsequently reset.
This is fundamentally buggy in that the unbind logic of the ECM driver will unconditionally free ecm->notify_req leading to a NULL pointer dereference.
--- drivers/usb/gadget/function/f_ecm.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_ecm.c +12 -4
@@ -56,6 +56,7 @@ struct f_ecm {struct usb_ep *notify;struct usb_request *notify_req;u8 notify_state; +atomic_t notify_count;bool is_open;/* FIXME is_open needs some irq-ish locking
@@ -384,7 +385,7 @@ static void ecm_do_notify(struct f_ecm *int status;/* notification already in flight? */ -if (!req) +if (atomic_read (&ecm->notify_count))return ; event = req->buf;
@@ -424,10 +425,10 @@ static void ecm_do_notify(struct f_ecm * event->bmRequestType =0xA1 ; event->wIndex =cpu_to_le16 (ecm->ctrl_id); - ecm->notify_req =NULL ; +atomic_inc (&ecm->notify_count); status =usb_ep_queue (ecm->notify, req,GFP_ATOMIC );if (status <0 ) { - ecm->notify_req = req; +atomic_dec (&ecm->notify_count);DBG (cdev,"notify --> %d\n" , status); } }
@@ -452,17 +453,19 @@ static void ecm_notify_complete(struct uswitch (req->status) {case 0 :/* no fault */ +atomic_dec (&ecm->notify_count);break ;case -ECONNRESET :case -ESHUTDOWN : +atomic_set (&ecm->notify_count,0 ); ecm->notify_state =ECM_NOTIFY_NONE ;break ;default :DBG (cdev,"event %02x --> %d\n" , event->bNotificationType, req->status); +atomic_dec (&ecm->notify_count);break ; } - ecm->notify_req = req;ecm_do_notify (ecm); }
@@ -909,6 +912,11 @@ static void ecm_unbind(struct usb_configusb_free_all_descriptors (f); +if (atomic_read (&ecm->notify_count)) { +usb_ep_dequeue (ecm->notify, ecm->notify_req); +atomic_set (&ecm->notify_count,0 ); + } +kfree (ecm->notify_req->buf);usb_ep_free_request (ecm->notify, ecm->notify_req); }
Greg Kroah-Hartman
maintainerPATCH 16/91 ALSA: dummy: Fix PCM format loop in proc output
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2acf25f13ebe8beb40e97a1bbe76f36277c64f1e upstream.
The loop termination for iterating over all formats should contain SNDRV_PCM_FORMAT_LAST, not less than it.
--- sound/drivers/dummy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/drivers/dummy.c +1 -1
@@ -925,7 +925,7 @@ static void print_formats(struct snd_dum {int i; -for (i =0 ; i <SNDRV_PCM_FORMAT_LAST ; i++) { +for (i =0 ; i <=SNDRV_PCM_FORMAT_LAST ; i++) {if (dummy->pcm_hw.formats & (1ULL << i))snd_iprintf (buffer," %s" ,snd_pcm_format_name (i)); }
Greg Kroah-Hartman
maintainerPATCH 17/91 lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 3e21d9a501bf99aee2e5835d7f34d8c823f115b5 upstream.
In case memory resources for _ptr2_ were allocated, release them before return.
Notice that in case _ptr1_ happens to be NULL, krealloc() behaves exactly like kmalloc().
Addresses-Coverity-ID: 1490594 ("Resource leak")
--- lib/test_kasan.c | 1 + 1 file changed, 1 insertion(+)
lib/test_kasan.c +1 -0
@@ -93,6 +93,7 @@ static noinline void __init kmalloc_oob_if (!ptr1 || !ptr2) {pr_err ("Allocation failed\n" );kfree (ptr1); +kfree (ptr2);return ; }
Greg Kroah-Hartman
maintainerPATCH 18/91 powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
In reply to Greg Kroah-HartmanFrom: Pingfan Liu <[email protected]>
commit fbee6ba2dca30d302efe6bddb3a886f5e964a257 upstream.
In lmb_is_removable(), if a section is not present, it should continue to test the rest of the sections in the block. But the current code fails to do so.
--- arch/powerpc/platforms/pseries/hotplug-memory.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/hotplug-memory.c +3 -1
@@ -205,8 +205,10 @@ static bool lmb_is_removable(struct of_dfor (i =0 ; i < scns_per_block; i++) { pfn =PFN_DOWN (phys_addr); -if (!pfn_present (pfn)) +if (!pfn_present (pfn)) { + phys_addr +=MIN_MEMORY_BLOCK_SIZE ;continue ; + } rc &=is_mem_section_removable (pfn,PAGES_PER_SECTION ); phys_addr +=MIN_MEMORY_BLOCK_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 19/91 mmc: spi: Toggle SPI polarity, do not hardcode it
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit af3ed119329cf9690598c5a562d95dfd128e91d6 upstream.
The code in mmc_spi_initsequence() tries to send a burst with high chipselect and for this reason hardcodes the device into SPI_CS_HIGH.
This is not good because the SPI_CS_HIGH flag indicates logical "asserted" CS not always the physical level. In some cases the signal is inverted in the GPIO library and in that case SPI_CS_HIGH is already set, and enforcing SPI_CS_HIGH again will actually drive it low.
Instead of hard-coding this, toggle the polarity so if the default is LOW it goes high to assert chipselect but if it is already high then toggle it low instead.
--- drivers/mmc/host/mmc_spi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/mmc/host/mmc_spi.c +8 -3
@@ -1153,17 +1153,22 @@ static void mmc_spi_initsequence(struct* SPI protocol. Another is that when chipselect is released while * the card returns BUSY status, the clock must issue several cycles * with chipselect high before the card will stop driving its output. +* +* SPI_CS_HIGH means "asserted" here. In some cases like when using +* GPIOs for chip select, SPI_CS_HIGH is set but this will be logically +* inverted by gpiolib, so if we want to ascertain to drive it high +* we should toggle the default with an XOR as we do here. */ - host->spi->mode |=SPI_CS_HIGH ; + host->spi->mode ^=SPI_CS_HIGH ;if (spi_setup (host->spi) !=0 ) {/* Just warn; most cards work without it. */ dev_warn (&host->spi->dev,"can't change chip-select polarity\n" ); - host->spi->mode &= ~SPI_CS_HIGH ; + host->spi->mode ^=SPI_CS_HIGH ; }else {mmc_spi_readbytes (host,18 ); - host->spi->mode &= ~SPI_CS_HIGH ; + host->spi->mode ^=SPI_CS_HIGH ;if (spi_setup (host->spi) !=0 ) {/* Wot, we can't get the same setup we had before? */ dev_err(&host->spi->dev,
Greg Kroah-Hartman
maintainerPATCH 20/91 PCI: keystone: Fix link training retries initiation
In reply to Greg Kroah-HartmanFrom: Yurii Monakov <[email protected]>
[ Upstream commit 6df19872d881641e6394f93ef2938cffcbdae5bb ]
ks_pcie_stop_link() function does not clear LTSSM_EN_VAL bit so link training was not triggered more than once after startup. In configurations where link can be unstable during early boot, for example, under low temperature, it will never be established.
--- drivers/pci/host/pci-keystone-dw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/host/pci-keystone-dw.c +1 -1
@@ -450,7 +450,7 @@ void ks_dw_pcie_initiate_link_train(struct keystone_pcie *ks_pcie)/* Disable Link training */ val =readl (ks_pcie->va_app_base +CMD_STATUS ); val &= ~LTSSM_EN_VAL ; -writel (LTSSM_EN_VAL | val, ks_pcie->va_app_base +CMD_STATUS ); +writel (val, ks_pcie->va_app_base +CMD_STATUS );/* Initiate Link Training */ val =readl (ks_pcie->va_app_base +CMD_STATUS );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/91 crypto: api - Check spawn->alg under lock in crypto_drop_spawn
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
commit 7db3b61b6bba4310f454588c2ca6faf2958ad79f upstream.
We need to check whether spawn->alg is NULL under lock as otherwise the algorithm could be removed from under us after we have checked it and found it to be non-NULL. This could cause us to remove the spawn from a non-existent list.
--- crypto/algapi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
crypto/algapi.c +2 -4
@@ -653,11 +653,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn);void crypto_drop_spawn (struct crypto_spawn *spawn) { -if (!spawn->alg) -return ; -down_write (&crypto_alg_sem); -list_del (&spawn->list); +if (spawn->alg) +list_del (&spawn->list);up_write (&crypto_alg_sem); }EXPORT_SYMBOL_GPL (crypto_drop_spawn);
Greg Kroah-Hartman
maintainerPATCH 22/91 scsi: qla2xxx: Fix mtcp dump collection failure
In reply to Greg Kroah-HartmanFrom: Quinn Tran <[email protected]>
commit 641e0efddcbde52461e017136acd3ce7f2ef0c14 upstream.
MTCP dump failed due to MB Reg 10 was picking garbage data from stack memory.
--- drivers/scsi/qla2xxx/qla_mbx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_mbx.c +1 -2
@@ -5455,9 +5455,8 @@ qla2x00_dump_mctp_data(scsi_qla_host_t * mcp->mb[7 ] =LSW (MSD (req_dma)); mcp->mb[8 ] =MSW (addr);/* Setting RAM ID to valid */ - mcp->mb[10 ] |=BIT_7 ;/* For MCTP RAM ID is 0x40 */ - mcp->mb[10 ] |=0x40 ; + mcp->mb[10 ] =BIT_7 |0x40 ; mcp->out_mb |=MBX_10 |MBX_8 |MBX_7 |MBX_6 |MBX_5 |MBX_4 |MBX_3 |MBX_2 |MBX_1 |MBX_0 ;
Greg Kroah-Hartman
maintainerPATCH 23/91 power: supply: ltc2941-battery-gauge: fix use-after-free
In reply to Greg Kroah-HartmanFrom: Sven Van Asbroeck <[email protected]>
commit a60ec78d306c6548d4adbc7918b587a723c555cc upstream.
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This could mean that the work function is still running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that that the work is properly cancelled, no longer running, and unable to re-schedule itself.
This issue was detected with the help of Coccinelle.
--- drivers/power/ltc2941-battery-gauge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/ltc2941-battery-gauge.c +1 -1
@@ -364,7 +364,7 @@ static int ltc294x_i2c_remove(struct i2c {struct ltc294x_info *info =i2c_get_clientdata (client); -cancel_delayed_work (&info->work); +cancel_delayed_work_sync (&info->work);power_supply_unregister (info->supply);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 24/91 Revert "ovl: modify ovl_permission() to do checks on two inodes"
In reply to Greg Kroah-HartmanFrom: Ioanna Alifieraki <[email protected]>
This reverts commit b24be4acd17a8963a29b2a92e1d80b9ddf759c95 which is commit c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 upstream.
Commit b24be4acd17a ("ovl: modify ovl_permission() to do checks on two inodes") (stable kernel id) breaks r/w access in overlayfs when setting ACL to files, in 4.4 stable kernel. There is an available reproducer in [1].
To reproduce the issue :$./make-overlay.sh$./test.shst_mode is 100644
open failed: -1
cat: /tmp/overlay/animal: Permission denied <---- Breaks access -rw-r--r-- 1 jo jo 0 Oct 11 09:57 /tmp/overlay/animal
There are two options to fix this; (a) backport commit ce31513a9114 ("ovl: copyattr after setting POSIX ACL") to 4.4 or (b) revert offending commit b24be4acd17a ("ovl: modify ovl_permission() to do checks on two inodes"). Following option (a) entails high risk of regression since commit ce31513a9114 ("ovl: copyattr after setting POSIX ACL") has many dependencies on other commits that need to be backported too (~18 commits).
This patch proceeds with reverting commit b24be4acd17a ("ovl: modify ovl_permission() to do checks on two inodes"). The reverted commit is associated with CVE-2018-16597, however the test-script provided in [3] shows that 4.4 kernel is NOT affected by this cve and therefore it's safe to revert it.
The offending commit was introduced upstream in v4.8-rc1. At this point had nothing to do with any CVE. It was related with CVE-2018-16597 as it was the fix for bug [2]. Later on it was backported to stable 4.4.
The test-script [3] tests whether 4.4 kernel is affected by CVE-2018-16597. It tests the reproducer found in [2] plus a few more cases. The correct output of the script is failure with "Permission denied" when a normal user tries to overwrite root owned files. For more details please refer to [4].
[1] https://gist.github.com/thomas-holmes/711bcdb28e2b8e6d1c39c1d99d292af7
[2] https://bugzilla.suse.com/show_bug.cgi?id=1106512#c0
[3] https://launchpadlibrarian.net/459694705/test_overlay_permission.sh
[4] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1851243
--- fs/overlayfs/inode.c | 13 ------------- 1 file changed, 13 deletions(-)
fs/overlayfs/inode.c +0 -13
@@ -9,7 +9,6 @@#include <linux/fs.h> #include <linux/slab.h> -#include <linux/cred.h> #include <linux/xattr.h> #include "overlayfs.h"
@@ -92,7 +91,6 @@ int ovl_permission(struct inode *inode,struct ovl_entry *oe;struct dentry *alias =NULL ;struct inode *realinode; -const struct cred *old_cred;struct dentry *realdentry;bool is_upper;int err;
@@ -145,18 +143,7 @@ int ovl_permission(struct inode *inode, goto out_dput; } -/* -* Check overlay inode with the creds of task and underlying inode -* with creds of mounter -*/ - err =generic_permission (inode, mask); -if (err) - goto out_dput; - - old_cred =ovl_override_creds (inode->i_sb); err =__inode_permission (realinode, mask); -revert_creds (old_cred); - out_dput:dput (alias);return err;
Greg Kroah-Hartman
maintainerPATCH 25/91 of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit dabf6b36b83a18d57e3d4b9d50544ed040d86255 upstream.
There's an OF helper called of_dma_is_coherent(), which checks if a device has a "dma-coherent" property to see if the device is coherent for DMA.
But on some platforms devices are coherent by default, and on some platforms it's not possible to update existing device trees to add the "dma-coherent" property.
So add a Kconfig symbol to allow arch code to tell of_dma_is_coherent() that devices are coherent by default, regardless of the presence of the property.
Select that symbol on powerpc when NOT_COHERENT_CACHE is not set, ie. when the system has a coherent cache.
--- arch/powerpc/Kconfig | 1 + drivers/of/Kconfig | 4 ++++ drivers/of/address.c | 6 +++++- 3 files changed, 10 insertions(+), 1 deletion(-)
arch/powerpc/Kconfig +1 -0
@@ -93,6 +93,7 @@ config PPC select BINFMT_ELF select ARCH_HAS_ELF_RANDOMIZE select OF + select OF_DMA_DEFAULT_COHERENT if !NOT_COHERENT_CACHE select OF_EARLY_FLATTREE select OF_RESERVED_MEM select HAVE_FTRACE_MCOUNT_RECORD
drivers/of/Kconfig +4 -0
@@ -112,4 +112,8 @@ config OF_OVERLAY While this option is selected automatically when needed, you can enable it manually to improve device tree unit test coverage. +config OF_DMA_DEFAULT_COHERENT + # arches should select this if DMA is coherent by default for OF devices + bool + endif # OF
drivers/of/address.c +5 -1
@@ -1009,12 +1009,16 @@ EXPORT_SYMBOL_GPL(of_dma_get_range);* @np: device node * * It returns true if "dma-coherent" property was found -* for this device in DT. +* for this device in the DT, or if DMA is coherent by +* default for OF devices on the current platform. */ bool of_dma_is_coherent (struct device_node *np) {struct device_node *node =of_node_get (np); +if (IS_ENABLED (CONFIG_OF_DMA_DEFAULT_COHERENT )) +return true; +while (node) {if (of_property_read_bool (node,"dma-coherent" )) {of_node_put (node);
Greg Kroah-Hartman
maintainerPATCH 26/91 dm space map common: fix to ensure new block isnt already in use
In reply to Greg Kroah-HartmanFrom: Joe Thornber <[email protected]>
commit 4feaef830de7ffdd8352e1fe14ad3bf13c9688f8 upstream.
The space-maps track the reference counts for disk blocks allocated by both the thin-provisioning and cache targets. There are variants for tracking metadata blocks and data blocks.
Transactionality is implemented by never touching blocks from the previous transaction, so we can rollback in the event of a crash.
When allocating a new block we need to ensure the block is free (has reference count of 0) in both the current and previous transaction. Prior to this fix we were doing this by searching for a free block in the previous transaction, and relying on a 'begin' counter to track where the last allocation in the current transaction was. This 'begin' field was not being updated in all code paths (eg, increment of a data block reference count due to breaking sharing of a neighbour block in the same btree leaf).
This fix keeps the 'begin' field, but now it's just a hint to speed up the search. Instead the current transaction is searched for a free block, and then the old transaction is double checked to ensure it's free. Much simpler.
This fixes reports of sm_disk_new_block()'s BUG_ON() triggering when DM thin-provisioning's snapshots are heavily used.
--- drivers/md/persistent-data/dm-space-map-common.c | 27 +++++++++++++++++++++ drivers/md/persistent-data/dm-space-map-common.h | 2 + drivers/md/persistent-data/dm-space-map-disk.c | 6 +++- drivers/md/persistent-data/dm-space-map-metadata.c | 5 +++ 4 files changed, 37 insertions(+), 3 deletions(-)
drivers/md/persistent-data/dm-space-map-common.c +27 -0
@@ -382,6 +382,33 @@ int sm_ll_find_free_block(struct ll_diskreturn -ENOSPC ; } +int sm_ll_find_common_free_block (struct ll_disk *old_ll,struct ll_disk *new_ll, +dm_block_t begin,dm_block_t end,dm_block_t *b) +{ +int r; +uint32_t count; + +do { + r =sm_ll_find_free_block (new_ll, begin, new_ll->nr_blocks, b); +if (r) +break ; + +/* double check this block wasn't used in the old transaction */ +if (*b >= old_ll->nr_blocks) + count =0 ; +else { + r =sm_ll_lookup (old_ll, *b, &count); +if (r) +break ; + +if (count) + begin = *b +1 ; + } + }while (count); + +return r; +} +static int sm_ll_mutate (struct ll_disk *ll,dm_block_t b,int (*mutator)(void *context,uint32_t old,uint32_t *new),void *context,enum allocation_event *ev)
drivers/md/persistent-data/dm-space-map-common.h +2 -0
@@ -109,6 +109,8 @@ int sm_ll_lookup_bitmap(struct ll_disk *int sm_ll_lookup (struct ll_disk *ll,dm_block_t b,uint32_t *result);int sm_ll_find_free_block (struct ll_disk *ll,dm_block_t begin,dm_block_t end,dm_block_t *result); +int sm_ll_find_common_free_block (struct ll_disk *old_ll,struct ll_disk *new_ll, +dm_block_t begin,dm_block_t end,dm_block_t *result);int sm_ll_insert (struct ll_disk *ll,dm_block_t b,uint32_t ref_count,enum allocation_event *ev);int sm_ll_inc (struct ll_disk *ll,dm_block_t b,enum allocation_event *ev);int sm_ll_dec (struct ll_disk *ll,dm_block_t b,enum allocation_event *ev);
drivers/md/persistent-data/dm-space-map-disk.c +4 -2
@@ -167,8 +167,10 @@ static int sm_disk_new_block(struct dm_senum allocation_event ev; struct sm_disk *smd = container_of(sm, struct sm_disk, sm); -/* FIXME: we should loop round a couple of times */ - r =sm_ll_find_free_block (&smd->old_ll, smd->begin, smd->old_ll.nr_blocks, b); +/* +* Any block we allocate has to be free in both the old and current ll. +*/ + r =sm_ll_find_common_free_block (&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b);if (r)return r;
drivers/md/persistent-data/dm-space-map-metadata.c +4 -1
@@ -447,7 +447,10 @@ static int sm_metadata_new_block_(structenum allocation_event ev; struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm); - r =sm_ll_find_free_block (&smm->old_ll, smm->begin, smm->old_ll.nr_blocks, b); +/* +* Any block we allocate has to be free in both the old and current ll. +*/ + r =sm_ll_find_common_free_block (&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b);if (r)return r;
Greg Kroah-Hartman
maintainerPATCH 27/91 padata: Remove broken queue flushing
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 07928d9bfc81640bab36f5190e8725894d93b659 ]
The function padata_flush_queues is fundamentally broken because it cannot force padata users to complete the request that is underway. IOW padata has to passively wait for the completion of any outstanding work.
As it stands flushing is used in two places. Its use in padata_stop is simply unnecessary because nothing depends on the queues to be flushed afterwards.
The other use in padata_replace is more substantial as we depend on it to free the old pd structure. This patch instead uses the pd->refcnt to dynamically free the pd structure once all requests are complete.
--- kernel/padata.c | 46 ++++++++++++---------------------------------- 1 file changed, 12 insertions(+), 34 deletions(-)
kernel/padata.c +12 -34
@@ -33,6 +33,8 @@#define MAX_OBJ_NUM 1000 +static void padata_free_pd (struct parallel_data *pd); +static int padata_index_to_cpu (struct parallel_data *pd,int cpu_index) {int cpu, target_cpu;
@@ -300,6 +302,7 @@ static void padata_serial_worker(struct work_struct *serial_work)struct padata_serial_queue *squeue;struct parallel_data *pd;LIST_HEAD (local_list); +int cnt;local_bh_disable (); squeue = container_of(serial_work, struct padata_serial_queue, work);
@@ -309,6 +312,8 @@ static void padata_serial_worker(struct work_struct *serial_work)list_replace_init (&squeue->serial.list, &local_list);spin_unlock (&squeue->serial.lock); + cnt =0 ; +while (!list_empty (&local_list)) {struct padata_priv *padata;
@@ -318,9 +323,12 @@ static void padata_serial_worker(struct work_struct *serial_work)list_del_init (&padata->list); padata->serial (padata); -atomic_dec (&pd->refcnt); + cnt++; }local_bh_enable (); + +if (atomic_sub_and_test (cnt, &pd->refcnt)) +padata_free_pd (pd); }/**
@@ -443,8 +451,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,setup_timer (&pd->timer, padata_reorder_timer, (unsigned long )pd);atomic_set (&pd->seq_nr,-1 );atomic_set (&pd->reorder_objects,0 ); -atomic_set (&pd->refcnt,0 ); - pd->pinst = pinst; +atomic_set (&pd->refcnt,1 );spin_lock_init (&pd->lock);return pd;
@@ -468,31 +475,6 @@ static void padata_free_pd(struct parallel_data *pd)kfree (pd); } -/* Flush all objects out of the padata queues. */ -static void padata_flush_queues (struct parallel_data *pd) -{ -int cpu; -struct padata_parallel_queue *pqueue; -struct padata_serial_queue *squeue; - -for_each_cpu (cpu, pd->cpumask.pcpu) { - pqueue =per_cpu_ptr (pd->pqueue, cpu); -flush_work (&pqueue->work); - } - -del_timer_sync (&pd->timer); - -if (atomic_read (&pd->reorder_objects)) -padata_reorder (pd); - -for_each_cpu (cpu, pd->cpumask.cbcpu) { - squeue =per_cpu_ptr (pd->squeue, cpu); -flush_work (&squeue->work); - } - -BUG_ON (atomic_read (&pd->refcnt) !=0 ); -} -static void __padata_start (struct padata_instance *pinst) { pinst->flags |=PADATA_INIT ;
@@ -506,10 +488,6 @@ static void __padata_stop(struct padata_instance *pinst) pinst->flags &= ~PADATA_INIT ;synchronize_rcu (); - -get_online_cpus (); -padata_flush_queues (pinst->pd); -put_online_cpus (); }/* Replace the internal control structure with a new one. */
@@ -530,8 +508,8 @@ static void padata_replace(struct padata_instance *pinst,if (!cpumask_equal (pd_old->cpumask.cbcpu, pd_new->cpumask.cbcpu)) notification_mask |=PADATA_CPU_SERIAL ; -padata_flush_queues (pd_old); -padata_free_pd (pd_old); +if (atomic_dec_and_test (&pd_old->refcnt)) +padata_free_pd (pd_old);if (notification_mask) blocking_notifier_call_chain(&pinst->cpumask_change_notifier,
Signature · 1 line
2.20.1
PATCH v2 1/1 padata: Remove broken queue flushing
From: Herbert Xu <[email protected]>
[ Upstream commit 07928d9bfc81640bab36f5190e8725894d93b659 ]
The function padata_flush_queues is fundamentally broken because it cannot force padata users to complete the request that is underway. IOW padata has to passively wait for the completion of any outstanding work.
As it stands flushing is used in two places. Its use in padata_stop is simply unnecessary because nothing depends on the queues to be flushed afterwards.
The other use in padata_replace is more substantial as we depend on it to free the old pd structure. This patch instead uses the pd->refcnt to dynamically free the pd structure once all requests are complete.
--- kernel/padata.c | 45 ++++++++++++--------------------------------- 1 file changed, 12 insertions(+), 33 deletions(-)
kernel/padata.c +12 -33
@@ -33,6 +33,8 @@#define MAX_OBJ_NUM 1000 +static void padata_free_pd (struct parallel_data *pd); +static int padata_index_to_cpu (struct parallel_data *pd,int cpu_index) {int cpu, target_cpu;
@@ -300,6 +302,7 @@ static void padata_serial_worker(struct work_struct *serial_work)struct padata_serial_queue *squeue;struct parallel_data *pd;LIST_HEAD (local_list); +int cnt;local_bh_disable (); squeue = container_of(serial_work, struct padata_serial_queue, work);
@@ -309,6 +312,8 @@ static void padata_serial_worker(struct work_struct *serial_work)list_replace_init (&squeue->serial.list, &local_list);spin_unlock (&squeue->serial.lock); + cnt =0 ; +while (!list_empty (&local_list)) {struct padata_priv *padata;
@@ -318,9 +323,12 @@ static void padata_serial_worker(struct work_struct *serial_work)list_del_init (&padata->list); padata->serial (padata); -atomic_dec (&pd->refcnt); + cnt++; }local_bh_enable (); + +if (atomic_sub_and_test (cnt, &pd->refcnt)) +padata_free_pd (pd); }/**
@@ -443,7 +451,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,setup_timer (&pd->timer, padata_reorder_timer, (unsigned long )pd);atomic_set (&pd->seq_nr,-1 );atomic_set (&pd->reorder_objects,0 ); -atomic_set (&pd->refcnt,0 ); +atomic_set (&pd->refcnt,1 ); pd->pinst = pinst;spin_lock_init (&pd->lock);
@@ -468,31 +476,6 @@ static void padata_free_pd(struct parallel_data *pd)kfree (pd); } -/* Flush all objects out of the padata queues. */ -static void padata_flush_queues (struct parallel_data *pd) -{ -int cpu; -struct padata_parallel_queue *pqueue; -struct padata_serial_queue *squeue; - -for_each_cpu (cpu, pd->cpumask.pcpu) { - pqueue =per_cpu_ptr (pd->pqueue, cpu); -flush_work (&pqueue->work); - } - -del_timer_sync (&pd->timer); - -if (atomic_read (&pd->reorder_objects)) -padata_reorder (pd); - -for_each_cpu (cpu, pd->cpumask.cbcpu) { - squeue =per_cpu_ptr (pd->squeue, cpu); -flush_work (&squeue->work); - } - -BUG_ON (atomic_read (&pd->refcnt) !=0 ); -} -static void __padata_start (struct padata_instance *pinst) { pinst->flags |=PADATA_INIT ;
@@ -506,10 +489,6 @@ static void __padata_stop(struct padata_instance *pinst) pinst->flags &= ~PADATA_INIT ;synchronize_rcu (); - -get_online_cpus (); -padata_flush_queues (pinst->pd); -put_online_cpus (); }/* Replace the internal control structure with a new one. */
@@ -530,8 +509,8 @@ static void padata_replace(struct padata_instance *pinst,if (!cpumask_equal (pd_old->cpumask.cbcpu, pd_new->cpumask.cbcpu)) notification_mask |=PADATA_CPU_SERIAL ; -padata_flush_queues (pd_old); -padata_free_pd (pd_old); +if (atomic_dec_and_test (&pd_old->refcnt)) +padata_free_pd (pd_old);if (notification_mask) blocking_notifier_call_chain(&pinst->cpumask_change_notifier,
Signature · 1 line
2.25.0
Greg Kroah-Hartman
maintainerPATCH 28/91 crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
commit e8d998264bffade3cfe0536559f712ab9058d654 upstream.
We should not be modifying the original request's MAY_SLEEP flag upon completion. It makes no sense to do so anyway.
--- crypto/pcrypt.c | 1 - 1 file changed, 1 deletion(-)
crypto/pcrypt.c +0 -1
@@ -130,7 +130,6 @@ static void pcrypt_aead_done(struct crypstruct padata_priv *padata =pcrypt_request_padata (preq); padata->info = err; - req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP ;padata_do_serial (padata); }
Greg Kroah-Hartman
maintainerPATCH 29/91 crypto: api - Fix race condition in crypto_spawn_alg
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
commit 73669cc556462f4e50376538d77ee312142e8a8a upstream.
The function crypto_spawn_alg is racy because it drops the lock before shooting the dying algorithm. The algorithm could disappear altogether before we shoot it.
This patch fixes it by moving the shooting into the locked section.
--- crypto/algapi.c | 16 +++++----------- crypto/api.c | 3 +-- crypto/internal.h | 1 - 3 files changed, 6 insertions(+), 14 deletions(-)
crypto/algapi.c +5 -11
@@ -663,22 +663,16 @@ EXPORT_SYMBOL_GPL(crypto_drop_spawn);static struct crypto_alg *crypto_spawn_alg (struct crypto_spawn *spawn) {struct crypto_alg *alg; -struct crypto_alg *alg2;down_read (&crypto_alg_sem); alg = spawn->alg; - alg2 = alg; -if (alg2) - alg2 =crypto_mod_get (alg2); -up_read (&crypto_alg_sem); - -if (!alg2) { -if (alg) -crypto_shoot_alg (alg); -return ERR_PTR (-EAGAIN ); +if (alg && !crypto_mod_get (alg)) { + alg->cra_flags |=CRYPTO_ALG_DYING ; + alg =NULL ; } +up_read (&crypto_alg_sem); -return alg; +return alg ?:ERR_PTR (-EAGAIN ); } struct crypto_tfm *crypto_spawn_tfm(struct crypto_spawn *spawn, u32 type,
crypto/api.c +1 -2
@@ -355,13 +355,12 @@ static unsigned int crypto_ctxsize(strucreturn len; } -void crypto_shoot_alg (struct crypto_alg *alg) +static void crypto_shoot_alg (struct crypto_alg *alg) {down_write (&crypto_alg_sem); alg->cra_flags |=CRYPTO_ALG_DYING ;up_write (&crypto_alg_sem); } -EXPORT_SYMBOL_GPL (crypto_shoot_alg);struct crypto_tfm *__crypto_alloc_tfm (struct crypto_alg *alg,u32 type,u32 mask)
crypto/internal.h +0 -1
@@ -87,7 +87,6 @@ void crypto_alg_tested(const char *name,void crypto_remove_spawns (struct crypto_alg *alg,struct list_head *list,struct crypto_alg *nalg);void crypto_remove_final (struct list_head *list); -void crypto_shoot_alg (struct crypto_alg *alg);struct crypto_tfm *__crypto_alloc_tfm (struct crypto_alg *alg,u32 type,u32 mask); void *crypto_create_tfm(struct crypto_alg *alg,
Greg Kroah-Hartman
maintainerPATCH 30/91 crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
commit 7f8c36fe9be46862c4f3c5302f769378028a34fa upstream.
Since tasklet is needed to be initialized before registering IRQ handler, adjust the position of tasklet_init to fix the wrong order.
Besides, to fix the missed tasklet_kill, this patch adds a helper function and uses devm_add_action to kill the tasklet automatically.
--- drivers/crypto/picoxcell_crypto.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/crypto/picoxcell_crypto.c +13 -2
@@ -1610,6 +1610,11 @@ static bool spacc_is_compatible(struct preturn false; } +static void spacc_tasklet_kill (void *data) +{ +tasklet_kill (data); +} +static int spacc_probe (struct platform_device *pdev) {int i, err, ret = -EINVAL ;
@@ -1652,6 +1657,14 @@ static int spacc_probe(struct platform_dreturn -ENXIO ; } +tasklet_init (&engine->complete, spacc_spacc_complete, + (unsigned long )engine); + + ret =devm_add_action (&pdev->dev, spacc_tasklet_kill, + &engine->complete); +if (ret) +return ret; +if (devm_request_irq (&pdev->dev, irq->start, spacc_spacc_irq,0 , engine->name, engine)) {dev_err (engine->dev,"failed to request IRQ\n" );
@@ -1714,8 +1727,6 @@ static int spacc_probe(struct platform_dINIT_LIST_HEAD (&engine->completed);INIT_LIST_HEAD (&engine->in_progress); engine->in_flight =0 ; -tasklet_init (&engine->complete, spacc_spacc_complete, - (unsigned long )engine);platform_set_drvdata (pdev, engine);
Greg Kroah-Hartman
maintainerPATCH 31/91 btrfs: set trans->drity in btrfs_commit_transaction
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit d62b23c94952e78211a383b7d90ef0afbd9a3717 upstream.
If we abort a transaction we have the following sequence
if (!trans->dirty && list_empty(&trans->new_bgs))
return;
WRITE_ONCE(trans->transaction->aborted, err);
The idea being if we didn't modify anything with our trans handle then we don't really need to abort the whole transaction, maybe the other trans handles are fine and we can carry on.
However in the case of create_snapshot we add a pending_snapshot object to our transaction and then commit the transaction. We don't actually modify anything. sync() behaves the same way, attach to an existing transaction and commit it. This means that if we have an IO error in the right places we could abort the committing transaction with our trans->dirty being not set and thus not set transaction->aborted.
This is a problem because in the create_snapshot() case we depend on pending->error being set to something, or btrfs_commit_transaction returning an error.
If we are not the trans handle that gets to commit the transaction, and we're waiting on the commit to happen we get our return value from cur_trans->aborted. If this was not set to anything because sync() hit an error in the transaction commit before it could modify anything then cur_trans->aborted would be 0. Thus we'd return 0 from btrfs_commit_transaction() in create_snapshot.
This is a problem because we then try to do things with pending_snapshot->snap, which will be NULL because we didn't create the snapshot, and then we'll get a NULL pointer dereference like the following
"BUG: kernel NULL pointer dereference, address: 00000000000001f0"
RIP: 0010:btrfs_orphan_cleanup+0x2d/0x330 Call Trace: ? btrfs_mksubvol.isra.31+0x3f2/0x510 btrfs_mksubvol.isra.31+0x4bc/0x510 ? __sb_start_write+0xfa/0x200 ? mnt_want_write_file+0x24/0x50 btrfs_ioctl_snap_create_transid+0x16c/0x1a0 btrfs_ioctl_snap_create_v2+0x11e/0x1a0 btrfs_ioctl+0x1534/0x2c10 ? free_debug_processing+0x262/0x2a3 do_vfs_ioctl+0xa6/0x6b0 ? do_sys_open+0x188/0x220 ? syscall_trace_enter+0x1f8/0x330 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4a/0x1b0
In order to fix this we need to make sure anybody who calls commit_transaction has trans->dirty set so that they properly set the trans->transaction->aborted value properly so any waiters know bad things happened.
This was found while I was running generic/475 with my modified fsstress, it reproduced within a few runs. I ran with this patch all night and didn't see the problem again.
--- fs/btrfs/transaction.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/btrfs/transaction.c +8 -0
@@ -1814,6 +1814,14 @@ int btrfs_commit_transaction(struct btrfstruct btrfs_inode *btree_ino =BTRFS_I (root->fs_info->btree_inode);int ret; +/* +* Some places just start a transaction to commit it. We need to make +* sure that if this commit fails that the abort code actually marks the +* transaction as failed, so set trans->dirty to make the abort code do +* the right thing. +*/ + trans->dirty = true; +/* Stop the commit early if ->aborted is set */ if (unlikely (ACCESS_ONCE (cur_trans->aborted))) { ret = cur_trans->aborted;
Greg Kroah-Hartman
maintainerPATCH 32/91 ARM: tegra: Enable PLLP bypass during Tegra124 LP1
In reply to Greg Kroah-HartmanFrom: Stephen Warren <[email protected]>
commit 1a3388d506bf5b45bb283e6a4c4706cfb4897333 upstream.
For a little over a year, U-Boot has configured the flow controller to perform automatic RAM re-repair on off->on power transitions of the CPU rail[1]. This is mandatory for correct operation of Tegra124. However, RAM re-repair relies on certain clocks, which the kernel must enable and leave running. PLLP is one of those clocks. This clock is shut down during LP1 in order to save power. Enable bypass (which I believe routes osc_div_clk, essentially the crystal clock, to the PLL output) so that this clock signal toggles even though the PLL is not active. This is required so that LP1 power mode (system suspend) operates correctly.
The bypass configuration must then be undone when resuming from LP1, so that all peripheral clocks run at the expected rate. Without this, many peripherals won't work correctly; for example, the UART baud rate would be incorrect.
NVIDIA's downstream kernel code only does this if not compiled for Tegra30, so the added code is made conditional upon the chip ID. NVIDIA's downstream code makes this change conditional upon the active CPU cluster. The upstream kernel currently doesn't support cluster switching, so this patch doesn't test the active CPU cluster ID.
[1] 3cc7942a4ae5 ARM: tegra: implement RAM repair
--- arch/arm/mach-tegra/sleep-tegra30.S | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/arm/mach-tegra/sleep-tegra30.S +11 -0
@@ -379,6 +379,14 @@ _pll_m_c_x_done: pll_locked r1, r0, CLK_RESET_PLLC_BASE pll_locked r1, r0, CLK_RESET_PLLX_BASE + tegra_get_soc_id TEGRA_APB_MISC_BASE, r1 + cmp r1, #TEGRA30 + beq 1f + ldr r1, [r0, #CLK_RESET_PLLP_BASE] + bic r1, r1, #(1<<31) @ disable PllP bypass + str r1, [r0, #CLK_RESET_PLLP_BASE] +1: + mov32 r7, TEGRA_TMRUS_BASE ldr r1, [r7] add r1, r1, #LOCK_DELAY
@@ -638,7 +646,10 @@ tegra30_switch_cpu_to_clk32k: str r0, [r4, #PMC_PLLP_WB0_OVERRIDE] /* disable PLLP, PLLA, PLLC and PLLX */ + tegra_get_soc_id TEGRA_APB_MISC_BASE, r1 + cmp r1, #TEGRA30 ldr r0, [r5, #CLK_RESET_PLLP_BASE] + orrne r0, r0, #(1 << 31) @ enable PllP bypass on fast cluster bic r0, r0, #(1 << 30) str r0, [r5, #CLK_RESET_PLLP_BASE] ldr r0, [r5, #CLK_RESET_PLLA_BASE]
Greg Kroah-Hartman
maintainerPATCH 33/91 mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit 65b1aae0d9d5962faccc06bdb8e91a2a0b09451c upstream.
We called rcu_read_lock(), so we need to call rcu_read_unlock() before we return.
--- drivers/net/wireless/mwifiex/sta_ioctl.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mwifiex/sta_ioctl.c +1 -0
@@ -232,6 +232,7 @@ static int mwifiex_process_country_ie(stif (country_ie_len > (IEEE80211_COUNTRY_STRING_LEN +MWIFIEX_MAX_TRIPLET_802_11D )) { +rcu_read_unlock ();mwifiex_dbg (priv->adapter,ERROR ,"11D: country_ie_len overflow!, deauth AP\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 34/91 sunrpc: expiry_time should be seconds not timeval
In reply to Greg Kroah-HartmanFrom: Roberto Bergantinos Corpas <[email protected]>
commit 3d96208c30f84d6edf9ab4fac813306ac0d20c10 upstream.
When upcalling gssproxy, cache_head.expiry_time is set as a timeval, not seconds since boot. As such, RPC cache expiry logic will not clean expired objects created under auth.rpcsec.context cache.
This has proven to cause kernel memory leaks on field. Using 64 bit variants of getboottime/timespec
Expiration times have worked this way since 2010's c5b29f885afe "sunrpc:
use seconds since boot in expiry cache". The gssproxy code introduced in 2012 added gss_proxy_save_rsc and introduced the bug. That's a while for this to lurk, but it required a bit of an extreme case to make it obvious.
--- net/sunrpc/auth_gss/svcauth_gss.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sunrpc/auth_gss/svcauth_gss.c +4 -0
@@ -1173,6 +1173,7 @@ static int gss_proxy_save_rsc(struct cacdprintk ("RPC: No creds found!\n" ); goto out; }else { +struct timespec64 boot;/* steal creds */ rsci.cred = ud->creds;
@@ -1193,6 +1194,9 @@ static int gss_proxy_save_rsc(struct cac &expiry, GFP_KERNEL);if (status) goto out; + +getboottime64 (&boot); + expiry -= boot.tv_sec; } rsci.h.expiry_time = expiry;
Greg Kroah-Hartman
maintainerPATCH 35/91 KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 125ffc5e0a56a3eded608dc51e09d5ebf72cf652 upstream.
This fixes Spectre-v1/L1TF vulnerabilities in vmx_read_guest_seg_selector(), vmx_read_guest_seg_base(), vmx_read_guest_seg_limit() and vmx_read_guest_seg_ar(). When invoked from emulation, these functions contain index computations based on the (attacker-influenced) segment value. Using constants prevents the attack.
--- arch/x86/kvm/emulate.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
arch/x86/kvm/emulate.c +14 -2
@@ -5041,16 +5041,28 @@ int x86_decode_insn(struct x86_emulate_c ctxt->ad_bytes = def_ad_bytes ^6 ;break ;case 0x26 :/* ES override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_ES ; +break ;case 0x2e :/* CS override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_CS ; +break ;case 0x36 :/* SS override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_SS ; +break ;case 0x3e :/* DS override */ has_seg_override = true; - ctxt->seg_override = (ctxt->b >>3 ) &3 ; + ctxt->seg_override =VCPU_SREG_DS ;break ;case 0x64 :/* FS override */ + has_seg_override = true; + ctxt->seg_override =VCPU_SREG_FS ; +break ;case 0x65 :/* GS override */ has_seg_override = true; - ctxt->seg_override = ctxt->b &7 ; + ctxt->seg_override =VCPU_SREG_GS ;break ; case 0x40 ... 0x4f: /* REX */if (mode !=X86EMUL_MODE_PROT64 )
Greg Kroah-Hartman
maintainerPATCH 36/91 KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit ea740059ecb37807ba47b84b33d1447435a8d868 upstream.
This fixes a Spectre-v1/L1TF vulnerability in __kvm_set_dr() and kvm_get_dr().
Both kvm_get_dr() and kvm_set_dr() (a wrapper of __kvm_set_dr()) are exported symbols so KVM should tream them conservatively from a security perspective.
--- arch/x86/kvm/x86.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/x86/kvm/x86.c +7 -2
@@ -53,6 +53,7 @@#include <linux/pvclock_gtod.h> #include <linux/kvm_irqfd.h> #include <linux/irqbypass.h> +#include <linux/nospec.h> #include <trace/events/kvm.h> #define CREATE_TRACE_POINTS
@@ -873,9 +874,11 @@ static u64 kvm_dr6_fixed(struct kvm_vcpustatic int __kvm_set_dr (struct kvm_vcpu *vcpu,int dr,unsigned long val) { +size_t size =ARRAY_SIZE (vcpu->arch.db); +switch (dr) { case 0 ... 3: - vcpu->arch.db[dr] = val; + vcpu->arch.db[array_index_nospec (dr, size)] = val;if (!(vcpu->guest_debug &KVM_GUESTDBG_USE_HW_BP )) vcpu->arch.eff_db[dr] = val;break ;
@@ -912,9 +915,11 @@ EXPORT_SYMBOL_GPL(kvm_set_dr);int kvm_get_dr (struct kvm_vcpu *vcpu,int dr,unsigned long *val) { +size_t size =ARRAY_SIZE (vcpu->arch.db); +switch (dr) { case 0 ... 3: - *val = vcpu->arch.db[dr]; + *val = vcpu->arch.db[array_index_nospec (dr, size)];break ;case 4 :/* fall through */
Greg Kroah-Hartman
maintainerPATCH 37/91 KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 8618793750071d66028584a83ed0b4fa7eb4f607 upstream.
This fixes Spectre-v1/L1TF vulnerabilities in kvm_hv_msr_get_crash_data() and kvm_hv_msr_set_crash_data().
These functions contain index computations that use the (attacker-controlled) MSR number.
--- arch/x86/kvm/hyperv.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/kvm/hyperv.c +7 -4
@@ -26,6 +26,7 @@#include "hyperv.h" #include <linux/kvm_host.h> +#include <linux/nospec.h> #include <trace/events/kvm.h> #include "trace.h"
@@ -53,11 +54,12 @@ static int kvm_hv_msr_get_crash_data(str u32 index, u64 *pdata) { struct kvm_hv *hv = &vcpu->kvm->arch.hyperv; +size_t size =ARRAY_SIZE (hv->hv_crash_param); -if (WARN_ON_ONCE (index >=ARRAY_SIZE (hv->hv_crash_param))) +if (WARN_ON_ONCE (index >= size))return -EINVAL ; - *pdata = hv->hv_crash_param[index]; + *pdata = hv->hv_crash_param[array_index_nospec (index, size)];return 0 ; }
@@ -96,11 +98,12 @@ static int kvm_hv_msr_set_crash_data(str u32 index, u64 data) {struct kvm_hv *hv = &vcpu->kvm->arch.hyperv; +size_t size =ARRAY_SIZE (hv->hv_crash_param); -if (WARN_ON_ONCE (index >=ARRAY_SIZE (hv->hv_crash_param))) +if (WARN_ON_ONCE (index >= size))return -EINVAL ; - hv->hv_crash_param[index] = data; + hv->hv_crash_param[array_index_nospec (index, size)] = data;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 38/91 KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 670564559ca35b439c8d8861fc399451ddf95137 upstream.
This fixes a Spectre-v1/L1TF vulnerability in ioapic_write_indirect(). This function contains index computations based on the (attacker-controlled) IOREGSEL register.
This patch depends on patch
"KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks".
--- arch/x86/kvm/ioapic.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/ioapic.c +2 -0
@@ -36,6 +36,7 @@#include <linux/io.h> #include <linux/slab.h> #include <linux/export.h> +#include <linux/nospec.h> #include <asm/processor.h> #include <asm/page.h> #include <asm/current.h>
@@ -289,6 +290,7 @@ static void ioapic_write_indirect(structioapic_debug ("change redir index %x val %x\n" , index, val);if (index >=IOAPIC_NUM_PINS )return ; + index =array_index_nospec (index,IOAPIC_NUM_PINS ); e = &ioapic->redirtbl[index]; mask_before = e->fields.mask;/* Preserve read-only fields */
Greg Kroah-Hartman
maintainerPATCH 39/91 KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 13c5183a4e643cc2b03a22d0e582c8e17bb7457d upstream.
This fixes a Spectre-v1/L1TF vulnerability in the get_gp_pmc() and get_fixed_pmc() functions.
They both contain index computations based on the (attacker-controlled) MSR number.
--- arch/x86/kvm/pmu.h | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
arch/x86/kvm/pmu.h +14 -4
@@ -1,6 +1,8 @@#ifndef __KVM_X86_PMU_H#define __KVM_X86_PMU_H +#include <linux/nospec.h> +#define vcpu_to_pmu (vcpu) (&(vcpu)->arch.pmu)#define pmu_to_vcpu (pmu) (container_of((pmu), struct kvm_vcpu, arch.pmu))#define pmc_to_pmu (pmc) (&(pmc)->vcpu->arch.pmu)
@@ -80,8 +82,12 @@ static inline bool pmc_is_enabled(structstatic inline struct kvm_pmc *get_gp_pmc (struct kvm_pmu *pmu,u32 msr,u32 base) { -if (msr >= base && msr < base + pmu->nr_arch_gp_counters) -return &pmu->gp_counters[msr - base]; +if (msr >= base && msr < base + pmu->nr_arch_gp_counters) { +u32 index =array_index_nospec (msr - base, + pmu->nr_arch_gp_counters); + +return &pmu->gp_counters[index]; + }return NULL ; }
@@ -91,8 +97,12 @@ static inline struct kvm_pmc *get_fixed_ {int base =MSR_CORE_PERF_FIXED_CTR0 ; -if (msr >= base && msr < base + pmu->nr_arch_fixed_counters) -return &pmu->fixed_counters[msr - base]; +if (msr >= base && msr < base + pmu->nr_arch_fixed_counters) { +u32 index =array_index_nospec (msr - base, + pmu->nr_arch_fixed_counters); + +return &pmu->fixed_counters[index]; + }return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 40/91 KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 8c86405f606ca8508b8d9280680166ca26723695 upstream.
This fixes a Spectre-v1/L1TF vulnerability in ioapic_read_indirect(). This function contains index computations based on the (attacker-controlled) IOREGSEL register.
--- arch/x86/kvm/ioapic.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/x86/kvm/ioapic.c +7 -6
@@ -74,13 +74,14 @@ static unsigned long ioapic_read_indirecdefault : {u32 redir_index = (ioapic->ioregsel -0x10 ) >>1 ; -u64 redir_content; +u64 redir_content = ~0ULL ; -if (redir_index <IOAPIC_NUM_PINS ) - redir_content = - ioapic->redirtbl[redir_index].bits; -else - redir_content = ~0ULL ; +if (redir_index <IOAPIC_NUM_PINS ) { +u32 index =array_index_nospec ( + redir_index,IOAPIC_NUM_PINS ); + + redir_content = ioapic->redirtbl[index].bits; + } result = (ioapic->ioregsel &0x1 ) ? (redir_content >> 32) & 0xffffffff :
Greg Kroah-Hartman
maintainerPATCH 41/91 KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 6ec4c5eee1750d5d17951c4e1960d953376a0dda upstream.
This fixes a Spectre-v1/L1TF vulnerability in set_msr_mce() and get_msr_mce().
Both functions contain index computations based on the (attacker-controlled) MSR number.
--- arch/x86/kvm/x86.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/x86/kvm/x86.c +8 -2
@@ -1994,7 +1994,10 @@ static int set_msr_mce(struct kvm_vcpu *default :if (msr >=MSR_IA32_MC0_CTL && msr <MSR_IA32_MCx_CTL (bank_num)) { -u32 offset = msr -MSR_IA32_MC0_CTL ; +u32 offset =array_index_nospec ( + msr -MSR_IA32_MC0_CTL , +MSR_IA32_MCx_CTL (bank_num) -MSR_IA32_MC0_CTL ); +/* only 0 or all 1s can be written to IA32_MCi_CTL * some Linux kernels though clear bit 10 in bank 4 to * workaround a BIOS/GART TBL issue on AMD K8s, ignore
@@ -2355,7 +2358,10 @@ static int get_msr_mce(struct kvm_vcpu *default :if (msr >=MSR_IA32_MC0_CTL && msr <MSR_IA32_MCx_CTL (bank_num)) { -u32 offset = msr -MSR_IA32_MC0_CTL ; +u32 offset =array_index_nospec ( + msr -MSR_IA32_MC0_CTL , +MSR_IA32_MCx_CTL (bank_num) -MSR_IA32_MC0_CTL ); + data = vcpu->arch.mce_banks[offset];break ; }
Greg Kroah-Hartman
maintainerPATCH 42/91 KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 3c9053a2cae7ba2ba73766a34cea41baa70f57f7 upstream.
This fixes a Spectre-v1/L1TF vulnerability in x86_decode_insn(). kvm_emulate_instruction() (an ancestor of x86_decode_insn()) is an exported symbol, so KVM should treat it conservatively from a security perspective.
--- arch/x86/kvm/emulate.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/kvm/emulate.c +9 -3
@@ -23,6 +23,7 @@#include <linux/kvm_host.h> #include "kvm_cache_regs.h" #include <linux/module.h> +#include <linux/nospec.h> #include <asm/kvm_emulate.h> #include <linux/stringify.h> #include <asm/debugreg.h>
@@ -5146,10 +5147,15 @@ done_prefixes: }break ;case Escape: -if (ctxt->modrm >0xbf ) - opcode = opcode.u.esc->high[ctxt->modrm -0xc0 ]; -else +if (ctxt->modrm >0xbf ) { +size_t size =ARRAY_SIZE (opcode.u.esc->high); +u32 index =array_index_nospec ( + ctxt->modrm -0xc0 , size); + + opcode = opcode.u.esc->high[index]; + }else { opcode = opcode.u.esc->op[(ctxt->modrm >>3 ) &7 ]; + }break ;case InstrDual:if ((ctxt->modrm >>6 ) ==3 )
Greg Kroah-Hartman
maintainerPATCH 43/91 KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
commit 25a5edea71b7c154b6a0b8cec14c711cafa31d26 upstream.
This fixes a Spectre-v1/L1TF vulnerability in fixed_msr_to_seg_unit(). This function contains index computations based on the (attacker-controlled) MSR number.
--- arch/x86/kvm/mtrr.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/x86/kvm/mtrr.c +7 -2
@@ -17,6 +17,7 @@*/ #include <linux/kvm_host.h> +#include <linux/nospec.h> #include <asm/mtrr.h> #include "cpuid.h"
@@ -202,11 +203,15 @@ static bool fixed_msr_to_seg_unit(u32 msbreak ; case MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000: *seg =1 ; - *unit = msr - MSR_MTRRfix16K_80000; + *unit =array_index_nospec ( + msr - MSR_MTRRfix16K_80000, + MSR_MTRRfix16K_A0000 - MSR_MTRRfix16K_80000 +1 );break ; case MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000: *seg =2 ; - *unit = msr - MSR_MTRRfix4K_C0000; + *unit =array_index_nospec ( + msr - MSR_MTRRfix4K_C0000, + MSR_MTRRfix4K_F8000 - MSR_MTRRfix4K_C0000 +1 );break ;default :return false;
Greg Kroah-Hartman
maintainerPATCH 44/91 KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 1a978d9d3e72ddfa40ac60d26301b154247ee0bc upstream.
Call kvm_vcpu_uninit() if vcore creation fails to avoid leaking any resources allocated by kvm_vcpu_init(), i.e. the vcpu->run page.
--- arch/powerpc/kvm/book3s_hv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kvm/book3s_hv.c +3 -1
@@ -1669,7 +1669,7 @@ static struct kvm_vcpu *kvmppc_core_vcpumutex_unlock (&kvm->lock);if (!vcore) - goto free_vcpu; + goto uninit_vcpu;spin_lock (&vcore->lock); ++vcore->num_threads;
@@ -1685,6 +1685,8 @@ static struct kvm_vcpu *kvmppc_core_vcpureturn vcpu; +uninit_vcpu: +kvm_vcpu_uninit (vcpu); free_vcpu:kmem_cache_free (kvm_vcpu_cache, vcpu); out:
Greg Kroah-Hartman
maintainerPATCH 45/91 KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit cb10bf9194f4d2c5d830eddca861f7ca0fecdbb4 upstream.
Explicitly free the shared page if kvmppc_mmu_init() fails during kvmppc_core_vcpu_create(), as the page is freed only in kvmppc_core_vcpu_free(), which is not reached via kvm_vcpu_uninit().
--- arch/powerpc/kvm/book3s_pr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kvm/book3s_pr.c +3 -1
@@ -1434,10 +1434,12 @@ static struct kvm_vcpu *kvmppc_core_vcpu err =kvmppc_mmu_init (vcpu);if (err <0 ) - goto uninit_vcpu; + goto free_shared_page;return vcpu; +free_shared_page: +free_page ((unsigned long )vcpu->arch.shared); uninit_vcpu:kvm_vcpu_uninit (vcpu); free_shadow_vcpu:
Greg Kroah-Hartman
maintainerPATCH 46/91 KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 16be9ddea268ad841457a59109963fff8c9de38d upstream.
Free the vCPU's wbinvd_dirty_mask if vCPU creation fails after kvm_arch_vcpu_init(), e.g. when installing the vCPU's file descriptor. Do the freeing by calling kvm_arch_vcpu_free() instead of open coding the freeing. This adds a likely superfluous, but ultimately harmless, call to kvmclock_reset(), which only clears vcpu->arch.pv_time_enabled. Using kvm_arch_vcpu_free() allows for additional cleanup in the future.
--- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/x86.c +1 -1
@@ -7498,7 +7498,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vckvm_mmu_unload (vcpu);vcpu_put (vcpu); - kvm_x86_ops->vcpu_free (vcpu); +kvm_arch_vcpu_free (vcpu); }void kvm_vcpu_reset (struct kvm_vcpu *vcpu,bool init_event)
Greg Kroah-Hartman
maintainerPATCH 47/91 scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
commit 3f5f7335e5e234e340b48ecb24c2aba98a61f934 upstream.
Since qla82xx_get_fw_size() returns a number in CPU-endian format, change its return type from __le32 into u32. This patch does not change any functionality.
--- drivers/scsi/qla2xxx/qla_nx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/qla2xxx/qla_nx.c +4 -4
@@ -10,6 +10,7 @@#include <linux/ratelimit.h> #include <linux/vmalloc.h> #include <scsi/scsi_tcq.h> +#include <asm/unaligned.h> #define MASK (n) ((1ULL<<(n))-1)#define MN_WIN (addr) (((addr & 0x1fc0000) >> 1) | \
@@ -1600,8 +1601,7 @@ qla82xx_get_bootld_offset(struct qla_hw_return (u8 *)&ha->hablob->fw->data[offset]; } -static __le32 -qla82xx_get_fw_size (struct qla_hw_data *ha) +static u32 qla82xx_get_fw_size (struct qla_hw_data *ha) {struct qla82xx_uri_data_desc *uri_desc =NULL ;
@@ -1612,7 +1612,7 @@ qla82xx_get_fw_size(struct qla_hw_data *return cpu_to_le32 (uri_desc->size); } -return cpu_to_le32 (*(u32 *)&ha->hablob->fw->data[FW_SIZE_OFFSET ]); +return get_unaligned_le32 (&ha->hablob->fw->data[FW_SIZE_OFFSET ]); } static u8 *
@@ -1803,7 +1803,7 @@ qla82xx_fw_load_from_blob(struct qla_hw_ } flashaddr =FLASH_ADDR_START ; - size = (__force u32 )qla82xx_get_fw_size (ha) /8 ; + size =qla82xx_get_fw_size (ha) /8 ; ptr64 = (u64 *)qla82xx_get_fw_offs (ha);for (i =0 ; i < size; i++) {
Greg Kroah-Hartman
maintainerPATCH 48/91 scsi: csiostor: Adjust indentation in csio_device_reset
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit a808a04c861782e31fc30e342a619c144aaee14a upstream.
Clang warns:
../drivers/scsi/csiostor/csio_scsi.c:1386:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
csio_lnodes_exit(hw, 1);
^
../drivers/scsi/csiostor/csio_scsi.c:1382:2: note: previous statement is
here
if (*buf != '1')
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/scsi/csiostor/csio_scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/csiostor/csio_scsi.c +1 -1
@@ -1383,7 +1383,7 @@ csio_device_reset(struct device *dev,return -EINVAL ;/* Delete NPIV lnodes */ -csio_lnodes_exit (hw,1 ); +csio_lnodes_exit (hw,1 );/* Block upper IOs */ csio_lnodes_block_request (hw);
Greg Kroah-Hartman
maintainerPATCH 49/91 scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit aa8679736a82386551eb9f3ea0e6ebe2c0e99104 upstream.
Clang warns:
../drivers/scsi/qla4xxx/ql4_os.c:4148:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
if (ha->fw_dump)
^
../drivers/scsi/qla4xxx/ql4_os.c:4144:2: note: previous statement is
here
if (ha->queues)
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/scsi/qla4xxx/ql4_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla4xxx/ql4_os.c +1 -1
@@ -4150,7 +4150,7 @@ static void qla4xxx_mem_free(struct scsidma_free_coherent (&ha->pdev->dev, ha->queues_len, ha->queues, ha->queues_dma); -if (ha->fw_dump) +if (ha->fw_dump)vfree (ha->fw_dump); ha->queues_len =0 ;
Greg Kroah-Hartman
maintainerPATCH 50/91 ext2: Adjust indentation in ext2_fill_super
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit d9e9866803f7b6c3fdd35d345e97fb0b2908bbbc upstream.
Clang warns:
../fs/ext2/super.c:1076:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
^
../fs/ext2/super.c:1074:2: note: previous statement is here
if (EXT2_BLOCKS_PER_GROUP(sb) == 0)
^1 warning generated.
This warning occurs because there is a space before the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- fs/ext2/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext2/super.c +3 -3
@@ -1051,9 +1051,9 @@ static int ext2_fill_super(struct super_if (EXT2_BLOCKS_PER_GROUP (sb) ==0 ) goto cantfind_ext2; - sbi->s_groups_count = ((le32_to_cpu (es->s_blocks_count) - -le32_to_cpu (es->s_first_data_block) -1 ) - /EXT2_BLOCKS_PER_GROUP (sb)) +1 ; + sbi->s_groups_count = ((le32_to_cpu (es->s_blocks_count) - +le32_to_cpu (es->s_first_data_block) -1 ) + /EXT2_BLOCKS_PER_GROUP (sb)) +1 ; db_count = (sbi->s_groups_count +EXT2_DESC_PER_BLOCK (sb) -1 ) /EXT2_DESC_PER_BLOCK (sb); sbi->s_group_desc =kmalloc (db_count *sizeof (struct buffer_head *),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 51/91 powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit c3aae14e5d468d18dbb5d7c0c8c7e2968cc14aad upstream.
Clang warns:
../arch/powerpc/boot/4xx.c:231:3: warning: misleading indentation; statement is not part of the previous 'else' [-Wmisleading-indentation]
val = SDRAM0_READ(DDR0_42);
^
../arch/powerpc/boot/4xx.c:227:2: note: previous statement is here
else
^This is because there is a space at the beginning of this line; remove it so that the indentation is consistent according to the Linux kernel coding style and clang no longer warns.
--- arch/powerpc/boot/4xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/boot/4xx.c +1 -1
@@ -232,7 +232,7 @@ void ibm4xx_denali_fixup_memsize(void) dpath =8 ;/* 64 bits */ /* get address pins (rows) */ - val =SDRAM0_READ (DDR0_42 ); + val =SDRAM0_READ (DDR0_42 ); row =DDR_GET_VAL (val,DDR_APIN ,DDR_APIN_SHIFT );if (row > max_row)
Greg Kroah-Hartman
maintainerPATCH 52/91 NFC: pn544: Adjust indentation in pn544_hci_check_presence
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 5080832627b65e3772a35d1dced68c64e2b24442 upstream.
Clang warns
../drivers/nfc/pn544/pn544.c:696:4: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
return nfc_hci_send_cmd(hdev, NFC_HCI_RF_READER_A_GATE, ^../drivers/nfc/pn544/pn544.c:692:3: note: previous statement is here
if (target->nfcid1_len != 4 && target->nfcid1_len != 7 &&
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/nfc/pn544/pn544.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nfc/pn544/pn544.c +1 -1
@@ -704,7 +704,7 @@ static int pn544_hci_check_presence(stru target->nfcid1_len != 10)return -EOPNOTSUPP ; -return nfc_hci_send_cmd (hdev,NFC_HCI_RF_READER_A_GATE , +return nfc_hci_send_cmd (hdev,NFC_HCI_RF_READER_A_GATE ,PN544_RF_READER_CMD_ACTIVATE_NEXT , target->nfcid1, target->nfcid1_len,NULL ); } else if (target->supported_protocols & (NFC_PROTO_JEWEL_MASK |
Greg Kroah-Hartman
maintainerPATCH 53/91 ppp: Adjust indentation into ppp_async_input
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 08cbc75f96029d3092664213a844a5e25523aa35 upstream.
Clang warns:
../drivers/net/ppp/ppp_async.c:877:6: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
ap->rpkt = skb;
^
../drivers/net/ppp/ppp_async.c:875:5: note: previous statement is here
if (!skb)
^1 warning generated.
This warning occurs because there is a space before the tab on this line. Clean up this entire block's indentation so that it is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/net/ppp/ppp_async.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ppp/ppp_async.c +9 -9
@@ -878,15 +878,15 @@ ppp_async_input(struct asyncppp *ap, con skb =dev_alloc_skb (ap->mru +PPP_HDRLEN +2 );if (!skb) goto nomem; - ap->rpkt = skb; - } -if (skb->len ==0 ) { -/* Try to get the payload 4-byte aligned. -* This should match the -* PPP_ALLSTATIONS/PPP_UI/compressed tests in -* process_input_packet, but we do not have -* enough chars here to test buf[1] and buf[2]. -*/ + ap->rpkt = skb; + } +if (skb->len ==0 ) { +/* Try to get the payload 4-byte aligned. +* This should match the +* PPP_ALLSTATIONS/PPP_UI/compressed tests in +* process_input_packet, but we do not have +* enough chars here to test buf[1] and buf[2]. +*/ if (buf[0 ] !=PPP_ALLSTATIONS )skb_reserve (skb,2 + (buf[0 ] &1 )); }
Greg Kroah-Hartman
maintainerPATCH 54/91 net: smc911x: Adjust indentation in smc911x_phy_configure
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 5c61e223004b3b5c3f1dd25718e979bc17a3b12d upstream.
Clang warns:
../drivers/net/ethernet/smsc/smc911x.c:939:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
if (!lp->ctl_rfduplx)
^
../drivers/net/ethernet/smsc/smc911x.c:936:2: note: previous statement
is here
if (lp->ctl_rspeed != 100)
^1 warning generated.
This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
--- drivers/net/ethernet/smsc/smc911x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/smsc/smc911x.c +1 -1
@@ -945,7 +945,7 @@ static void smc911x_phy_configure(structif (lp->ctl_rspeed !=100 ) my_ad_caps &= ~(ADVERTISE_100BASE4 |ADVERTISE_100FULL |ADVERTISE_100HALF ); -if (!lp->ctl_rfduplx) +if (!lp->ctl_rfduplx) my_ad_caps &= ~(ADVERTISE_100FULL |ADVERTISE_10FULL );/* Update our Auto-Neg Advertisement Register */
Greg Kroah-Hartman
maintainerPATCH 55/91 net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit fe06bf3d83ef0d92f35a24e03297172e92ce9ce3 upstream.
Clang warns:
../drivers/net/ethernet/dec/tulip/uli526x.c:1812:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
switch (mode) {
^
../drivers/net/ethernet/dec/tulip/uli526x.c:1809:2: note: previous
statement is here
if (cr6set)
^1 warning generated.
../drivers/net/ethernet/dec/tulip/dmfe.c:2217:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
switch(mode) {
^
../drivers/net/ethernet/dec/tulip/dmfe.c:2214:2: note: previous
statement is here
if (cr6set)
^1 warning generated.
This warning occurs because there is a space before the tab on these lines. Remove them so that the indentation is consistent with the Linux kernel coding style and clang no longer warns.
While we are here, adjust the default block in dmfe_init_module to have a proper break between the label and assignment and add a space between the switch and opening parentheses to avoid a checkpatch warning.
--- drivers/net/ethernet/dec/tulip/dmfe.c | 7 ++++--- drivers/net/ethernet/dec/tulip/uli526x.c | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/dec/tulip/dmfe.c +4 -3
@@ -2228,15 +2228,16 @@ static int __init dmfe_init_module(void)if (cr6set) dmfe_cr6_user_set = cr6set; -switch (mode) { -case DMFE_10MHF : +switch (mode) { +case DMFE_10MHF :case DMFE_100MHF :case DMFE_10MFD :case DMFE_100MFD :case DMFE_1M_HPNA : dmfe_media_mode = mode;break ; -default :dmfe_media_mode =DMFE_AUTO ; +default : + dmfe_media_mode =DMFE_AUTO ;break ; }
drivers/net/ethernet/dec/tulip/uli526x.c +2 -2
@@ -1813,8 +1813,8 @@ static int __init uli526x_init_module(voif (cr6set) uli526x_cr6_user_set = cr6set; -switch (mode) { -case ULI526X_10MHF : +switch (mode) { +case ULI526X_10MHF :case ULI526X_100MHF :case ULI526X_10MFD :case ULI526X_100MFD :
Greg Kroah-Hartman
maintainerPATCH 56/91 mfd: da9062: Fix watchdog compatible string
In reply to Greg Kroah-HartmanFrom: Marco Felsch <[email protected]>
commit 1112ba02ff1190ca9c15a912f9269e54b46d2d82 upstream.
The watchdog driver compatible is "dlg,da9062-watchdog" and not "dlg,da9062-wdt". Therefore the mfd-core can't populate the of_node and fwnode. As result the watchdog driver can't parse the devicetree.
--- drivers/mfd/da9062-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/da9062-core.c +1 -1
@@ -142,7 +142,7 @@ static const struct mfd_cell da9062_devs .name = "da9062-watchdog", .num_resources = ARRAY_SIZE(da9062_wdt_resources), .resources = da9062_wdt_resources, - .of_compatible = "dlg,da9062-wdt", + .of_compatible = "dlg,da9062-watchdog", }, { .name = "da9062-thermal",
Greg Kroah-Hartman
maintainerPATCH 57/91 mfd: rn5t618: Mark ADC control register volatile
In reply to Greg Kroah-HartmanFrom: Andreas Kemnade <[email protected]>
commit 2f3dc25c0118de03a00ddc88b61f7216854f534d upstream.
There is a bit which gets cleared after conversion.
--- drivers/mfd/rn5t618.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/rn5t618.c +1 -0
@@ -28,6 +28,7 @@ static bool rn5t618_volatile_reg(structcase RN5T618_WATCHDOGCNT :case RN5T618_DCIRQ : case RN5T618_ILIMDATAH ... RN5T618_AIN0DATAL: +case RN5T618_ADCCNT3 : case RN5T618_IR_ADC1 ... RN5T618_IR_ADC3:case RN5T618_IR_GPR :case RN5T618_IR_GPF :
Greg Kroah-Hartman
maintainerPATCH 58/91 net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 263a425a482fc495d6d3f9a29b9103a664c38b69 ]
After a number of suspend and resume cycles, it is possible for the RBUF to be stuck in Wake-on-LAN mode, despite the MPD enable bit being cleared which instructed the RBUF to exit that mode.
Avoid creating that problematic condition by clearing the RX_EN and TX_EN bits in the UniMAC prior to disable the Magic Packet Detector logic which is guaranteed to make the RBUF exit Wake-on-LAN mode.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bcmsysport.c +3 -0
@@ -1997,6 +1997,9 @@ static int bcm_sysport_resume(struct devumac_reset (priv); +/* Disable the UniMAC RX/TX */ +umac_enable_set (priv,CMD_RX_EN |CMD_TX_EN ,0 ); +/* We may have been suspended and never received a WOL event that * would turn off MPD detection, take care of that now */
Greg Kroah-Hartman
maintainerPATCH 59/91 bonding/alb: properly access headers in bond_alb_xmit()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 38f88c45404293bbc027b956def6c10cbd45c616 ]
syzbot managed to send an IPX packet through bond_alb_xmit() and af_packet and triggered a use-after-free.
First, bond_alb_xmit() was using ipx_hdr() helper to reach the IPX header, but ipx_hdr() was using the transport offset instead of the network offset. In the particular syzbot report transport offset was 0xFFFF
This patch removes ipx_hdr() since it was only (mis)used from bonding.
Then we need to make sure IPv4/IPv6/IPX headers are pulled in skb->head before dereferencing anything.
BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108 (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: [<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline] [<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53 [<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282 [<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline] [<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline] [<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422 [<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469 [<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 [<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline] [<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224 [<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline] [<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline] [<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline] [<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627 [<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238 [<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278 [<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline] [<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252 [<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline] [<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684 [<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996 [<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline] [<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004
--- drivers/net/bonding/bond_alb.c | 44 +++++++++++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 12 deletions(-)
drivers/net/bonding/bond_alb.c +32 -12
@@ -1371,26 +1371,31 @@ int bond_alb_xmit(struct sk_buff *skb, sbool do_tx_balance = true;u32 hash_index =0 ;const u8 *hash_start =NULL ; -struct ipv6hdr *ip6hdr;skb_reset_mac_header (skb); eth_data =eth_hdr (skb);switch (ntohs (skb->protocol)) {case ETH_P_IP : { -const struct iphdr *iph =ip_hdr (skb); +const struct iphdr *iph;if (ether_addr_equal_64bits (eth_data->h_dest, mac_bcast) || - (iph->daddr == ip_bcast) || - (iph->protocol ==IPPROTO_IGMP )) { + (!pskb_network_may_pull (skb,sizeof (*iph)))) { + do_tx_balance = false; +break ; + } + iph =ip_hdr (skb); +if (iph->daddr == ip_bcast || iph->protocol ==IPPROTO_IGMP ) { do_tx_balance = false;break ; } hash_start = (char *)&(iph->daddr); hash_size =sizeof (iph->daddr); - }break ; -case ETH_P_IPV6 : + } +case ETH_P_IPV6 : { +const struct ipv6hdr *ip6hdr; +/* IPv6 doesn't really use broadcast mac address, but leave * that here just in case. */
@@ -1407,7 +1412,11 @@ int bond_alb_xmit(struct sk_buff *skb, sbreak ; } -/* Additianally, DAD probes should not be tx-balanced as that +if (!pskb_network_may_pull (skb,sizeof (*ip6hdr))) { + do_tx_balance = false; +break ; + } +/* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. */
@@ -1417,17 +1426,26 @@ int bond_alb_xmit(struct sk_buff *skb, sbreak ; } - hash_start = (char *)&(ipv6_hdr (skb)->daddr); - hash_size =sizeof (ipv6_hdr (skb)->daddr); + hash_start = (char *)&ip6hdr->daddr; + hash_size =sizeof (ip6hdr->daddr);break ; -case ETH_P_IPX : -if (ipx_hdr (skb)->ipx_checksum !=IPX_NO_CHECKSUM ) { + } +case ETH_P_IPX : { +const struct ipxhdr *ipxhdr; + +if (pskb_network_may_pull (skb,sizeof (*ipxhdr))) { + do_tx_balance = false; +break ; + } + ipxhdr = (struct ipxhdr *)skb_network_header (skb); + +if (ipxhdr->ipx_checksum !=IPX_NO_CHECKSUM ) {/* something is wrong with this packet */ do_tx_balance = false;break ; } -if (ipx_hdr (skb)->ipx_type !=IPX_TYPE_NCP ) { +if (ipxhdr->ipx_type !=IPX_TYPE_NCP ) {/* The only protocol worth balancing in * this family since it has an "ARP" like * mechanism
@@ -1436,9 +1454,11 @@ int bond_alb_xmit(struct sk_buff *skb, sbreak ; } + eth_data =eth_hdr (skb); hash_start = (char *)eth_data->h_dest; hash_size =ETH_ALEN ;break ; + }case ETH_P_ARP : do_tx_balance = false;if (bond_info->rlb_enabled)
Greg Kroah-Hartman
maintainerPATCH 60/91 NFS: Fix memory leaks and corruption in readdir
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 4b310319c6a8ce708f1033d57145e2aa027a883c ]
nfs_readdir_xdr_to_array() must not exit without having initialised the array, so that the page cache deletion routines can safely call nfs_readdir_clear_array().
Furthermore, we should ensure that if we exit nfs_readdir_filler() with an error, we free up any page contents to prevent a leak if we try to fill the page again.
--- fs/nfs/dir.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
fs/nfs/dir.c +17 -2
@@ -169,6 +169,17 @@ typedef struct { unsigned int eof:1; } nfs_readdir_descriptor_t; +static +void nfs_readdir_init_array (struct page *page) +{ +struct nfs_cache_array *array; + + array =kmap_atomic (page); +memset (array,0 ,sizeof (struct nfs_cache_array )); + array->eof_index =-1 ; +kunmap_atomic (array); +} +/* * The caller is responsible for calling nfs_readdir_release_array(page) */
@@ -202,6 +213,7 @@ void nfs_readdir_clear_array(struct page *page) array =kmap_atomic (page);for (i =0 ; i < array->size; i++)kfree (array->array[i].string.name); + array->size =0 ;kunmap_atomic (array); }
@@ -622,6 +634,8 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,int status = -ENOMEM ;unsigned int array_size =ARRAY_SIZE (pages); +nfs_readdir_init_array (page); + entry.prev_cookie =0 ; entry.cookie = desc->last_cookie; entry.eof =0 ;
@@ -642,8 +656,8 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page, status =PTR_ERR (array); goto out_label_free; } -memset (array,0 ,sizeof (struct nfs_cache_array )); - array->eof_index =-1 ; + + array =kmap (page); status =nfs_readdir_alloc_pages (pages, array_size);if (status <0 )
@@ -698,6 +712,7 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)unlock_page (page);return 0 ; error: +nfs_readdir_clear_array (page);unlock_page (page);return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/91 NFS: Fix bool initialization/comparison
In reply to Greg Kroah-HartmanFrom: Thomas Meyer <[email protected]>
[ Upstream commit 6089dd0d731028531fb1148be9fd33274ff90da4 ]
Bool initializations should use true and false. Bool tests don't need comparisons.
--- fs/nfs/callback_proc.c | 2 +- fs/nfs/dir.c | 10 +++++----- fs/nfs/nfs4client.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-)
fs/nfs/callback_proc.c +1 -1
@@ -368,7 +368,7 @@ static bool referring_call_exists(struct nfs_client *clp,uint32_t nrclists, struct referring_call_list *rclists) { - bool status = 0; + bool status = false;int i, j;struct nfs4_session *session;struct nfs4_slot_table *tbl;
fs/nfs/dir.c +5 -5
@@ -289,7 +289,7 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri desc->cache_entry_index = index;return 0 ; out_eof: - desc->eof =1 ; + desc->eof = true;return -EBADCOOKIE ; }
@@ -343,7 +343,7 @@ int nfs_readdir_search_for_cookie(struct nfs_cache_array *array, nfs_readdir_desif (array->eof_index >=0 ) { status = -EBADCOOKIE ;if (*desc->dir_cookie == array->last_cookie) - desc->eof =1 ; + desc->eof = true; } out:return status;
@@ -791,7 +791,7 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc) ent = &array->array[i];if (!dir_emit (desc->ctx, ent->string.name, ent->string.len,nfs_compat_user_ino64 (ent->ino), ent->d_type)) { - desc->eof =1 ; + desc->eof = true;break ; } desc->ctx->pos++;
@@ -803,7 +803,7 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc) ctx->duped =1 ; }if (array->eof_index >=0 ) - desc->eof =1 ; + desc->eof = true;nfs_readdir_release_array (desc->page); out:
@@ -905,7 +905,7 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)if (res == -EBADCOOKIE ) { res =0 ;/* This means either end of directory */ -if (*desc->dir_cookie && desc->eof ==0 ) { +if (*desc->dir_cookie && !desc->eof) {/* Or that the server has 'lost' a cookie */ res =uncached_readdir (desc);if (res ==0 )
fs/nfs/nfs4client.c +1 -1
@@ -751,7 +751,7 @@ nfs4_find_client_sessionid(struct net *net, const struct sockaddr *addr,spin_lock (&nn->nfs_client_lock);list_for_each_entry (clp, &nn->nfs_client_list, cl_share_link) { -if (nfs4_cb_match_client (addr, clp, minorversion) == false) +if (!nfs4_cb_match_client (addr, clp, minorversion))continue ;if (!nfs4_has_session (clp))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/91 NFS: Directory page cache pages need to be locked when read
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 114de38225d9b300f027e2aec9afbb6e0def154b ]
When a NFS directory page cache page is removed from the page cache, its contents are freed through a call to nfs_readdir_clear_array(). To prevent the removal of the page cache entry until after we've finished reading it, we must take the page lock.
--- fs/nfs/dir.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-)
fs/nfs/dir.c +19 -11
@@ -720,8 +720,6 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)static void cache_page_release (nfs_readdir_descriptor_t *desc) { -if (!desc->page->mapping) -nfs_readdir_clear_array (desc->page);page_cache_release (desc->page); desc->page =NULL ; }
@@ -735,19 +733,28 @@ struct page *get_cache_page(nfs_readdir_descriptor_t *desc)/* * Returns 0 if desc->dir_cookie was found on page desc->page_index +* and locks the page to prevent removal from the page cache. */ static -int find_cache_page (nfs_readdir_descriptor_t *desc) +int find_and_lock_cache_page (nfs_readdir_descriptor_t *desc) {int res; desc->page =get_cache_page (desc);if (IS_ERR (desc->page))return PTR_ERR (desc->page); - - res =nfs_readdir_search_array (desc); + res =lock_page_killable (desc->page);if (res !=0 ) -cache_page_release (desc); + goto error; + res = -EAGAIN ; +if (desc->page->mapping !=NULL ) { + res =nfs_readdir_search_array (desc); +if (res ==0 ) +return 0 ; + } +unlock_page (desc->page); +error: +cache_page_release (desc);return res; }
@@ -762,7 +769,7 @@ int readdir_search_pagecache(nfs_readdir_descriptor_t *desc) desc->last_cookie =0 ; }do { - res =find_cache_page (desc); + res =find_and_lock_cache_page (desc); }while (res == -EAGAIN );return res; }
@@ -807,7 +814,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc)nfs_readdir_release_array (desc->page); out: -cache_page_release (desc);dfprintk (DIRCACHE ,"NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n" , (unsigned long long )*desc->dir_cookie, res);return res;
@@ -853,13 +859,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc) status =nfs_do_filldir (desc); + out_release: +nfs_readdir_clear_array (desc->page); +cache_page_release (desc); out:dfprintk (DIRCACHE ,"NFS: %s: returns %d\n" , __func__, status);return status; - out_release: -cache_page_release (desc); - goto out; }/* The file offset position represents the dirent entry number. A
@@ -925,6 +931,8 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)break ; res =nfs_do_filldir (desc); +unlock_page (desc->page); +cache_page_release (desc);if (res <0 )break ; }while (!desc->eof);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/91 Btrfs: fix assertion failure on fsync with NO_HOLES enabled
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit 0ccc3876e4b2a1559a4dbe3126dda4459d38a83b ]
Back in commit a89ca6f24ffe4 ("Btrfs: fix fsync after truncate when no_holes feature is enabled") I added an assertion that is triggered when an inline extent is found to assert that the length of the (uncompressed) data the extent represents is the same as the i_size of the inode, since that is true most of the time I couldn't find or didn't remembered about any exception at that time. Later on the assertion was expanded twice to deal with a case of a compressed inline extent representing a range that matches the sector size followed by an expanding truncate, and another case where fallocate can update the i_size of the inode without adding or updating existing extents (if the fallocate range falls entirely within the first block of the file). These two expansion/fixes of the assertion were done by commit 7ed586d0a8241 ("Btrfs: fix assertion on fsync of regular file when using no-holes feature") and commit 6399fb5a0b69a ("Btrfs: fix assertion failure during fsync in no-holes mode"). These however missed the case where an falloc expands the i_size of an inode to exactly the sector size and inline extent exists, for example:
$ mkfs.btrfs -f -O no-holes /dev/sdc $ mount /dev/sdc /mnt
$ xfs_io -f -c "pwrite -S 0xab 0 1096" /mnt/foobar wrote 1096/1096 bytes at offset 0 1 KiB, 1 ops; 0.0002 sec (4.448 MiB/sec and 4255.3191 ops/sec)
$ xfs_io -c "falloc 1096 3000" /mnt/foobar $ xfs_io -c "fsync" /mnt/foobar Segmentation fault
$ dmesg [701253.602385] assertion failed: len == i_size || (len == fs_info->sectorsize && btrfs_file_extent_compression(leaf, extent) != BTRFS_COMPRESS_NONE) || (len < i_size && i_size < fs_info->sectorsize), file: fs/btrfs/tree-log.c, line: 4727 [701253.602962] ------------[ cut here ]------------ [701253.603224] kernel BUG at fs/btrfs/ctree.h:3533! [701253.603503] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [701253.603774] CPU: 2 PID: 7192 Comm: xfs_io Tainted: G W 5.0.0-rc8-btrfs-next-45 #1 [701253.604054] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [701253.604650] RIP: 0010:assfail.constprop.23+0x18/0x1a [btrfs] (...) [701253.605591] RSP: 0018:ffffbb48c186bc48 EFLAGS: 00010286 [701253.605914] RAX: 00000000000000de RBX: ffff921d0a7afc08 RCX: 0000000000000000 [701253.606244] RDX: 0000000000000000 RSI: ffff921d36b16868 RDI: ffff921d36b16868 [701253.606580] RBP: ffffbb48c186bcf0 R08: 0000000000000000 R09: 0000000000000000 [701253.606913] R10: 0000000000000003 R11: 0000000000000000 R12: ffff921d05d2de18 [701253.607247] R13: ffff921d03b54000 R14: 0000000000000448 R15: ffff921d059ecf80 [701253.607769] FS: 00007f14da906700(0000) GS:ffff921d36b00000(0000) knlGS:0000000000000000 [701253.608163] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [701253.608516] CR2: 000056087ea9f278 CR3: 00000002268e8001 CR4: 00000000003606e0 [701253.608880] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [701253.609250] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [701253.609608] Call Trace: [701253.609994] btrfs_log_inode+0xdfb/0xe40 [btrfs] [701253.610383] btrfs_log_inode_parent+0x2be/0xa60 [btrfs] [701253.610770] ? do_raw_spin_unlock+0x49/0xc0 [701253.611150] btrfs_log_dentry_safe+0x4a/0x70 [btrfs] [701253.611537] btrfs_sync_file+0x3b2/0x440 [btrfs] [701253.612010] ? do_sysinfo+0xb0/0xf0 [701253.612552] do_fsync+0x38/0x60 [701253.612988] __x64_sys_fsync+0x10/0x20 [701253.613360] do_syscall_64+0x60/0x1b0 [701253.613733] entry_SYSCALL_64_after_hwframe+0x49/0xbe [701253.614103] RIP: 0033:0x7f14da4e66d0 (...) [701253.615250] RSP: 002b:00007fffa670fdb8 EFLAGS: 00000246 ORIG_RAX: 000000000000004a [701253.615647] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f14da4e66d0 [701253.616047] RDX: 000056087ea9c260 RSI: 000056087ea9c260 RDI: 0000000000000003 [701253.616450] RBP: 0000000000000001 R08: 0000000000000020 R09: 0000000000000010 [701253.616854] R10: 000000000000009b R11: 0000000000000246 R12: 000056087ea9c260 [701253.617257] R13: 000056087ea9c240 R14: 0000000000000000 R15: 000056087ea9dd10 (...) [701253.619941] ---[ end trace e088d74f132b6da5 ]---
Updating the assertion again to allow for this particular case would result in a meaningless assertion, plus there is currently no risk of logging content that would result in any corruption after a log replay if the size of the data encoded in an inline extent is greater than the inode's i_size (which is not currently possibe either with or without compression), therefore just remove the assertion.
--- fs/btrfs/tree-log.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
fs/btrfs/tree-log.c +1 -6
@@ -4404,13 +4404,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans, struct btrfs_file_extent_item);if (btrfs_file_extent_type (leaf, extent) == -BTRFS_FILE_EXTENT_INLINE ) { - len =btrfs_file_extent_inline_len (leaf, - path->slots[0 ], - extent); -ASSERT (len == i_size); +BTRFS_FILE_EXTENT_INLINE )return 0 ; - } len =btrfs_file_extent_num_bytes (leaf, extent);/* Last extent goes beyond i_size, no need to log a hole. */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/91 btrfs: remove trivial locking wrappers of tree mod log
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
[ Upstream commit b1a09f1ec540408abf3a50d15dff5d9506932693 ]
The wrappers are trivial and do not bring any extra value on top of the plain locking primitives.
--- fs/btrfs/ctree.c | 58 ++++++++++++++++-------------------------------- 1 file changed, 19 insertions(+), 39 deletions(-)
fs/btrfs/ctree.c +19 -39
@@ -332,26 +332,6 @@ struct tree_mod_elem {struct tree_mod_root old_root; }; -static inline void tree_mod_log_read_lock (struct btrfs_fs_info *fs_info) -{ -read_lock (&fs_info->tree_mod_log_lock); -} - -static inline void tree_mod_log_read_unlock (struct btrfs_fs_info *fs_info) -{ -read_unlock (&fs_info->tree_mod_log_lock); -} - -static inline void tree_mod_log_write_lock (struct btrfs_fs_info *fs_info) -{ -write_lock (&fs_info->tree_mod_log_lock); -} - -static inline void tree_mod_log_write_unlock (struct btrfs_fs_info *fs_info) -{ -write_unlock (&fs_info->tree_mod_log_lock); -} -/* * Pull a new tree mod seq number for our operation. */
@@ -371,14 +351,14 @@ static inline u64 btrfs_inc_tree_mod_seq(struct btrfs_fs_info *fs_info)u64 btrfs_get_tree_mod_seq (struct btrfs_fs_info *fs_info,struct seq_list *elem) { -tree_mod_log_write_lock (fs_info); +write_lock (&fs_info->tree_mod_log_lock);spin_lock (&fs_info->tree_mod_seq_lock);if (!elem->seq) { elem->seq =btrfs_inc_tree_mod_seq (fs_info);list_add_tail (&elem->list, &fs_info->tree_mod_seq_list); }spin_unlock (&fs_info->tree_mod_seq_lock); -tree_mod_log_write_unlock (fs_info); +write_unlock (&fs_info->tree_mod_log_lock);return elem->seq; }
@@ -420,7 +400,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,* anything that's lower than the lowest existing (read: blocked) * sequence number can be removed from the tree. */ -tree_mod_log_write_lock (fs_info); +write_lock (&fs_info->tree_mod_log_lock); tm_root = &fs_info->tree_mod_log;for (node =rb_first (tm_root); node; node = next) { next =rb_next (node);
@@ -430,7 +410,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,rb_erase (node, tm_root);kfree (tm); } -tree_mod_log_write_unlock (fs_info); +write_unlock (&fs_info->tree_mod_log_lock); }/*
@@ -441,7 +421,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,* operations, or the shifted logical of the affected block for all other * operations. * -* Note: must be called with write lock (tree_mod_log_write_lock). +* Note: must be called with write lock for fs_info::tree_mod_log_lock. */ static noinline int__tree_mod_log_insert (struct btrfs_fs_info *fs_info,struct tree_mod_elem *tm)
@@ -481,7 +461,7 @@ __tree_mod_log_insert(struct btrfs_fs_info *fs_info, struct tree_mod_elem *tm)* Determines if logging can be omitted. Returns 1 if it can. Otherwise, it * returns zero with the tree_mod_log_lock acquired. The caller must hold * this until all tree mod log insertions are recorded in the rb tree and then -* call tree_mod_log_write_unlock() to release. +* write unlock fs_info::tree_mod_log_lock. */ static inline int tree_mod_dont_log (struct btrfs_fs_info *fs_info,struct extent_buffer *eb) {
@@ -491,9 +471,9 @@ static inline int tree_mod_dont_log(struct btrfs_fs_info *fs_info,if (eb &&btrfs_header_level (eb) ==0 )return 1 ; -tree_mod_log_write_lock (fs_info); +write_lock (&fs_info->tree_mod_log_lock);if (list_empty (&(fs_info)->tree_mod_seq_list)) { -tree_mod_log_write_unlock (fs_info); +write_unlock (&fs_info->tree_mod_log_lock);return 1 ; }
@@ -557,7 +537,7 @@ tree_mod_log_insert_key(struct btrfs_fs_info *fs_info, } ret =__tree_mod_log_insert (fs_info, tm); -tree_mod_log_write_unlock (fs_info); +write_unlock (&eb->fs_info->tree_mod_log_lock);if (ret)kfree (tm);
@@ -621,7 +601,7 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info, ret =__tree_mod_log_insert (fs_info, tm);if (ret) goto free_tms; -tree_mod_log_write_unlock (fs_info); +write_unlock (&eb->fs_info->tree_mod_log_lock);kfree (tm_list);return 0 ;
@@ -632,7 +612,7 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info,kfree (tm_list[i]); }if (locked) -tree_mod_log_write_unlock (fs_info); +write_unlock (&eb->fs_info->tree_mod_log_lock);kfree (tm_list);kfree (tm);
@@ -713,7 +693,7 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,if (!ret) ret =__tree_mod_log_insert (fs_info, tm); -tree_mod_log_write_unlock (fs_info); +write_unlock (&fs_info->tree_mod_log_lock);if (ret) goto free_tms;kfree (tm_list);
@@ -741,7 +721,7 @@ __tree_mod_log_search(struct btrfs_fs_info *fs_info, u64 start, u64 min_seq,struct tree_mod_elem *found =NULL ;u64 index = start >>PAGE_CACHE_SHIFT ; -tree_mod_log_read_lock (fs_info); +read_lock (&fs_info->tree_mod_log_lock); tm_root = &fs_info->tree_mod_log; node = tm_root->rb_node;while (node) {
@@ -769,7 +749,7 @@ __tree_mod_log_search(struct btrfs_fs_info *fs_info, u64 start, u64 min_seq,break ; } } -tree_mod_log_read_unlock (fs_info); +read_unlock (&fs_info->tree_mod_log_lock);return found; }
@@ -850,7 +830,7 @@ tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst, goto free_tms; } -tree_mod_log_write_unlock (fs_info); +write_unlock (&fs_info->tree_mod_log_lock);kfree (tm_list);return 0 ;
@@ -862,7 +842,7 @@ tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,kfree (tm_list[i]); }if (locked) -tree_mod_log_write_unlock (fs_info); +write_unlock (&fs_info->tree_mod_log_lock);kfree (tm_list);return ret;
@@ -922,7 +902,7 @@ tree_mod_log_free_eb(struct btrfs_fs_info *fs_info, struct extent_buffer *eb) goto free_tms; ret =__tree_mod_log_free_eb (fs_info, tm_list, nritems); -tree_mod_log_write_unlock (fs_info); +write_unlock (&eb->fs_info->tree_mod_log_lock);if (ret) goto free_tms;kfree (tm_list);
@@ -1284,7 +1264,7 @@ __tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,unsigned long p_size =sizeof (struct btrfs_key_ptr ); n =btrfs_header_nritems (eb); -tree_mod_log_read_lock (fs_info); +read_lock (&fs_info->tree_mod_log_lock);while (tm && tm->seq >= time_seq) {/* * all the operations are recorded with the operator used for
@@ -1339,7 +1319,7 @@ __tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,if (tm->index != first_tm->index)break ; } -tree_mod_log_read_unlock (fs_info); +read_unlock (&fs_info->tree_mod_log_lock);btrfs_set_header_nritems (eb, n); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/91 Btrfs: fix race between adding and putting tree mod seq elements and nodes
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit 7227ff4de55d931bbdc156c8ef0ce4f100c78a5b ]
There is a race between adding and removing elements to the tree mod log list and rbtree that can lead to use-after-free problems.
Consider the following example that explains how/why the problems happens:
1) Task A has mod log element with sequence number 200. It currently is the only element in the mod log list;
2) Task A calls btrfs_put_tree_mod_seq() because it no longer needs to access the tree mod log. When it enters the function, it initializes 'min_seq' to (u64)-1. Then it acquires the lock 'tree_mod_seq_lock' before checking if there are other elements in the mod seq list. Since the list it empty, 'min_seq' remains set to (u64)-1. Then it unlocks the lock 'tree_mod_seq_lock';
3) Before task A acquires the lock 'tree_mod_log_lock', task B adds itself to the mod seq list through btrfs_get_tree_mod_seq() and gets a sequence number of 201;
4) Some other task, name it task C, modifies a btree and because there elements in the mod seq list, it adds a tree mod elem to the tree mod log rbtree. That node added to the mod log rbtree is assigned a sequence number of 202;
5) Task B, which is doing fiemap and resolving indirect back references, calls btrfs get_old_root(), with 'time_seq' == 201, which in turn calls tree_mod_log_search() - the search returns the mod log node from the rbtree with sequence number 202, created by task C;
6) Task A now acquires the lock 'tree_mod_log_lock', starts iterating the mod log rbtree and finds the node with sequence number 202. Since 202 is less than the previously computed 'min_seq', (u64)-1, it removes the node and frees it;
7) Task B still has a pointer to the node with sequence number 202, and it dereferences the pointer itself and through the call to __tree_mod_log_rewind(), resulting in a use-after-free problem.
This issue can be triggered sporadically with the test case generic/561 from fstests, and it happens more frequently with a higher number of duperemove processes. When it happens to me, it either freezes the VM or it produces a trace like the following before crashing:
[ 1245.321140] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [ 1245.321200] CPU: 1 PID: 26997 Comm: pool Not tainted 5.5.0-rc6-btrfs-next-52 #1 [ 1245.321235] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 [ 1245.321287] RIP: 0010:rb_next+0x16/0x50 [ 1245.321307] Code: .... [ 1245.321372] RSP: 0018:ffffa151c4d039b0 EFLAGS: 00010202 [ 1245.321388] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8ae221363c80 RCX: 6b6b6b6b6b6b6b6b [ 1245.321409] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8ae221363c80 [ 1245.321439] RBP: ffff8ae20fcc4688 R08: 0000000000000002 R09: 0000000000000000 [ 1245.321475] R10: ffff8ae20b120910 R11: 00000000243f8bb1 R12: 0000000000000038 [ 1245.321506] R13: ffff8ae221363c80 R14: 000000000000075f R15: ffff8ae223f762b8 [ 1245.321539] FS: 00007fdee1ec7700(0000) GS:ffff8ae236c80000(0000) knlGS:0000000000000000 [ 1245.321591] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1245.321614] CR2: 00007fded4030c48 CR3: 000000021da16003 CR4: 00000000003606e0 [ 1245.321642] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1245.321668] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1245.321706] Call Trace: [ 1245.321798] __tree_mod_log_rewind+0xbf/0x280 [btrfs] [ 1245.321841] btrfs_search_old_slot+0x105/0xd00 [btrfs] [ 1245.321877] resolve_indirect_refs+0x1eb/0xc60 [btrfs] [ 1245.321912] find_parent_nodes+0x3dc/0x11b0 [btrfs] [ 1245.321947] btrfs_check_shared+0x115/0x1c0 [btrfs] [ 1245.321980] ? extent_fiemap+0x59d/0x6d0 [btrfs] [ 1245.322029] extent_fiemap+0x59d/0x6d0 [btrfs] [ 1245.322066] do_vfs_ioctl+0x45a/0x750 [ 1245.322081] ksys_ioctl+0x70/0x80 [ 1245.322092] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1245.322113] __x64_sys_ioctl+0x16/0x20 [ 1245.322126] do_syscall_64+0x5c/0x280 [ 1245.322139] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1245.322155] RIP: 0033:0x7fdee3942dd7 [ 1245.322177] Code: .... [ 1245.322258] RSP: 002b:00007fdee1ec6c88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1245.322294] RAX: ffffffffffffffda RBX: 00007fded40210d8 RCX: 00007fdee3942dd7 [ 1245.322314] RDX: 00007fded40210d8 RSI: 00000000c020660b RDI: 0000000000000004 [ 1245.322337] RBP: 0000562aa89e7510 R08: 0000000000000000 R09: 00007fdee1ec6d44 [ 1245.322369] R10: 0000000000000073 R11: 0000000000000246 R12: 00007fdee1ec6d48 [ 1245.322390] R13: 00007fdee1ec6d40 R14: 00007fded40210d0 R15: 00007fdee1ec6d50 [ 1245.322423] Modules linked in: .... [ 1245.323443] ---[ end trace 01de1e9ec5dff3cd ]---
Fix this by ensuring that btrfs_put_tree_mod_seq() computes the minimum sequence number and iterates the rbtree while holding the lock 'tree_mod_log_lock' in write mode. Also get rid of the 'tree_mod_seq_lock' lock, since it is now redundant.
--- fs/btrfs/ctree.c | 8 ++------ fs/btrfs/ctree.h | 6 ++---- fs/btrfs/delayed-ref.c | 8 ++++---- fs/btrfs/disk-io.c | 1 - fs/btrfs/tests/btrfs-tests.c | 1 - 5 files changed, 8 insertions(+), 16 deletions(-)
fs/btrfs/ctree.c +2 -6
@@ -352,12 +352,10 @@ u64 btrfs_get_tree_mod_seq(struct btrfs_fs_info *fs_info, struct seq_list *elem) {write_lock (&fs_info->tree_mod_log_lock); -spin_lock (&fs_info->tree_mod_seq_lock);if (!elem->seq) { elem->seq =btrfs_inc_tree_mod_seq (fs_info);list_add_tail (&elem->list, &fs_info->tree_mod_seq_list); } -spin_unlock (&fs_info->tree_mod_seq_lock);write_unlock (&fs_info->tree_mod_log_lock);return elem->seq;
@@ -377,7 +375,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,if (!seq_putting)return ; -spin_lock (&fs_info->tree_mod_seq_lock); +write_lock (&fs_info->tree_mod_log_lock);list_del (&elem->list); elem->seq =0 ;
@@ -388,19 +386,17 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,* blocker with lower sequence number exists, we * cannot remove anything from the log */ -spin_unlock (&fs_info->tree_mod_seq_lock); +write_unlock (&fs_info->tree_mod_log_lock);return ; } min_seq = cur_elem->seq; } } -spin_unlock (&fs_info->tree_mod_seq_lock);/* * anything that's lower than the lowest existing (read: blocked) * sequence number can be removed from the tree. */ -write_lock (&fs_info->tree_mod_log_lock); tm_root = &fs_info->tree_mod_log;for (node =rb_first (tm_root); node; node = next) { next =rb_next (node);
fs/btrfs/ctree.h +2 -4
@@ -1576,14 +1576,12 @@ struct btrfs_fs_info {struct list_head delayed_iputs;struct mutex cleaner_delayed_iput_mutex; -/* this protects tree_mod_seq_list */ -spinlock_t tree_mod_seq_lock;atomic64_t tree_mod_seq; -struct list_head tree_mod_seq_list; -/* this protects tree_mod_log */ +/* this protects tree_mod_log and tree_mod_seq_list */ rwlock_t tree_mod_log_lock;struct rb_root tree_mod_log; +struct list_head tree_mod_seq_list;atomic_t nr_async_submits;atomic_t async_submit_draining;
fs/btrfs/delayed-ref.c +4 -4
@@ -279,7 +279,7 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,if (head->is_data)return ; -spin_lock (&fs_info->tree_mod_seq_lock); +read_lock (&fs_info->tree_mod_log_lock);if (!list_empty (&fs_info->tree_mod_seq_list)) {struct seq_list *elem;
@@ -287,7 +287,7 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans, struct seq_list, list); seq = elem->seq; } -spin_unlock (&fs_info->tree_mod_seq_lock); +read_unlock (&fs_info->tree_mod_log_lock); ref = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node, list);
@@ -315,7 +315,7 @@ int btrfs_check_delayed_seq(struct btrfs_fs_info *fs_info,struct seq_list *elem;int ret =0 ; -spin_lock (&fs_info->tree_mod_seq_lock); +read_lock (&fs_info->tree_mod_log_lock);if (!list_empty (&fs_info->tree_mod_seq_list)) { elem =list_first_entry (&fs_info->tree_mod_seq_list, struct seq_list, list);
@@ -328,7 +328,7 @@ int btrfs_check_delayed_seq(struct btrfs_fs_info *fs_info, } } -spin_unlock (&fs_info->tree_mod_seq_lock); +read_unlock (&fs_info->tree_mod_log_lock);return ret; }
fs/btrfs/disk-io.c +0 -1
@@ -2481,7 +2481,6 @@ int open_ctree(struct super_block *sb,spin_lock_init (&fs_info->delayed_iput_lock);spin_lock_init (&fs_info->defrag_inodes_lock);spin_lock_init (&fs_info->free_chunk_lock); -spin_lock_init (&fs_info->tree_mod_seq_lock);spin_lock_init (&fs_info->super_lock);spin_lock_init (&fs_info->qgroup_op_lock);spin_lock_init (&fs_info->buffer_lock);
fs/btrfs/tests/btrfs-tests.c +0 -1
@@ -109,7 +109,6 @@ struct btrfs_fs_info *btrfs_alloc_dummy_fs_info(void)spin_lock_init (&fs_info->qgroup_op_lock);spin_lock_init (&fs_info->super_lock);spin_lock_init (&fs_info->fs_roots_radix_lock); -spin_lock_init (&fs_info->tree_mod_seq_lock);mutex_init (&fs_info->qgroup_ioctl_lock);mutex_init (&fs_info->qgroup_rescan_lock);rwlock_init (&fs_info->tree_mod_log_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/91 drm: atmel-hlcdc: enable clock before configuring timing engine
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 2c1fb9d86f6820abbfaa38a6836157c76ccb4e7b ]
Changing pixel clock source without having this clock source enabled will block the timing engine and the next operations after (in this case setting ATMEL_HLCDC_CFG(5) settings in atmel_hlcdc_crtc_mode_set_nofb() will fail). It is recomended (although in datasheet this is not present) to actually enabled pixel clock source before doing any changes on timing enginge (only SAM9X60 datasheet specifies that the peripheral clock and pixel clock must be enabled before using LCD controller).
--- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c +7 -1
@@ -63,7 +63,11 @@ static void atmel_hlcdc_crtc_mode_set_nofb(struct drm_crtc *c)struct videomode vm;unsigned long prate;unsigned int cfg; -int div; +int div, ret; + + ret =clk_prepare_enable (crtc->dc->hlcdc->sys_clk); +if (ret) +return ; vm.vfront_porch = adj->crtc_vsync_start - adj->crtc_vdisplay; vm.vback_porch = adj->crtc_vtotal - adj->crtc_vsync_end;
@@ -119,6 +123,8 @@ static void atmel_hlcdc_crtc_mode_set_nofb(struct drm_crtc *c)ATMEL_HLCDC_VSPSU |ATMEL_HLCDC_VSPHO |ATMEL_HLCDC_GUARDTIME_MASK , cfg); + +clk_disable_unprepare (crtc->dc->hlcdc->sys_clk); } static bool atmel_hlcdc_crtc_mode_fixup(struct drm_crtc *crtc,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/91 drm/dp_mst: Remove VCPI while disabling topology mgr
In reply to Greg Kroah-HartmanFrom: Wayne Lin <[email protected]>
[ Upstream commit 64e62bdf04ab8529f45ed0a85122c703035dec3a ]
[Why]
This patch is trying to address the issue observed when hotplug DP daisy chain monitors.
e.g.
src-mstb-mstb-sst -> src (unplug) mstb-mstb-sst -> src-mstb-mstb-sst (plug in again)
Once unplug a DP MST capable device, driver will call drm_dp_mst_topology_mgr_set_mst() to disable MST. In this function, it cleans data of topology manager while disabling mst_state. However, it doesn't clean up the proposed_vcpis of topology manager. If proposed_vcpi is not reset, once plug in MST daisy chain monitors later, code will fail at checking port validation while trying to allocate payloads.
When MST capable device is plugged in again and try to allocate payloads by calling drm_dp_update_payload_part1(), this function will iterate over all proposed virtual channels to see if any proposed VCPI's num_slots is greater than 0. If any proposed VCPI's num_slots is greater than 0 and the port which the specific virtual channel directed to is not in the topology, code then fails at the port validation. Since there are stale VCPI allocations from the previous topology enablement in proposed_vcpi[], code will fail at port validation and reurn EINVAL.
[How]
Clean up the data of stale proposed_vcpi[] and reset mgr->proposed_vcpis to NULL while disabling mst in drm_dp_mst_topology_mgr_set_mst().
Changes since v1:
*Add on more details in commit message to describe the issue which the patch is trying to fix
--- drivers/gpu/drm/drm_dp_mst_topology.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/drm_dp_mst_topology.c +12 -0
@@ -2039,6 +2039,7 @@ static bool drm_dp_get_vc_payload_bw(int dp_link_bw,int drm_dp_mst_topology_mgr_set_mst (struct drm_dp_mst_topology_mgr *mgr,bool mst_state) {int ret =0 ; +int i =0 ;struct drm_dp_mst_branch *mstb =NULL ;mutex_lock (&mgr->lock);
@@ -2103,10 +2104,21 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms/* this can fail if the device is gone */ drm_dp_dpcd_writeb (mgr->aux,DP_MSTM_CTRL ,0 ); ret =0 ; +mutex_lock (&mgr->payload_lock);memset (mgr->payloads,0 , mgr->max_payloads *sizeof (struct drm_dp_payload )); mgr->payload_mask =0 ;set_bit (0 , &mgr->payload_mask); +for (i =0 ; i < mgr->max_payloads; i++) { +struct drm_dp_vcpi *vcpi = mgr->proposed_vcpis[i]; + +if (vcpi) { + vcpi->vcpi =0 ; + vcpi->num_slots =0 ; + } + mgr->proposed_vcpis[i] =NULL ; + } mgr->vcpi_mask =0 ; +mutex_unlock (&mgr->payload_lock); } out_unlock:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/91 KVM: x86: drop picdev_in_range()
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
[ Upstream commit 9fecaa9e32ae7370878e5967d8874b6f58360b10 ]
We already have the exact same checks a couple of lines below.
--- arch/x86/kvm/i8259.c | 35 ++++++++++++----------------------- 1 file changed, 12 insertions(+), 23 deletions(-)
arch/x86/kvm/i8259.c +12 -23
@@ -456,46 +456,33 @@ static u32 elcr_ioport_read(void *opaque, u32 addr1)return s->elcr; } -static int picdev_in_range (gpa_t addr) -{ -switch (addr) { -case 0x20 : -case 0x21 : -case 0xa0 : -case 0xa1 : -case 0x4d0 : -case 0x4d1 : -return 1 ; -default : -return 0 ; - } -} -static int picdev_write (struct kvm_pic *s,gpa_t addr,int len,const void *val) {unsigned char data = *(unsigned char *)val; -if (!picdev_in_range (addr)) -return -EOPNOTSUPP ;if (len !=1 ) {pr_pic_unimpl ("non byte write\n" );return 0 ; } -pic_lock (s);switch (addr) {case 0x20 :case 0x21 :case 0xa0 :case 0xa1 : +pic_lock (s);pic_ioport_write (&s->pics[addr >>7 ], addr, data); +pic_unlock (s);break ;case 0x4d0 :case 0x4d1 : +pic_lock (s);elcr_ioport_write (&s->pics[addr &1 ], addr, data); +pic_unlock (s);break ; +default : +return -EOPNOTSUPP ; } -pic_unlock (s);return 0 ; }
@@ -503,29 +490,31 @@ static int picdev_read(struct kvm_pic *s, gpa_t addr, int len, void *val) { unsigned char data = 0; -if (!picdev_in_range (addr)) -return -EOPNOTSUPP ;if (len !=1 ) {memset (val,0 , len);pr_pic_unimpl ("non byte read\n" );return 0 ; } -pic_lock (s);switch (addr) {case 0x20 :case 0x21 :case 0xa0 :case 0xa1 : +pic_lock (s); data =pic_ioport_read (&s->pics[addr >>7 ], addr); +pic_unlock (s);break ;case 0x4d0 :case 0x4d1 : +pic_lock (s); data =elcr_ioport_read (&s->pics[addr &1 ], addr); +pic_unlock (s);break ; +default : +return -EOPNOTSUPP ; } *(unsigned char *)val = data; -pic_unlock (s);return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/91 KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
[ Upstream commit 14e32321f3606e4b0970200b6e5e47ee6f1e6410 ]
This fixes a Spectre-v1/L1TF vulnerability in picdev_write(). It replaces index computations based on the (attacked-controlled) port number with constants through a minor refactoring.
--- arch/x86/kvm/i8259.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kvm/i8259.c +5 -1
@@ -468,10 +468,14 @@ static int picdev_write(struct kvm_pic *s,switch (addr) {case 0x20 :case 0x21 : +pic_lock (s); +pic_ioport_write (&s->pics[0 ], addr, data); +pic_unlock (s); +break ;case 0xa0 :case 0xa1 :pic_lock (s); -pic_ioport_write (&s->pics[addr >>7 ], addr, data); +pic_ioport_write (&s->pics[1 ], addr, data);pic_unlock (s);break ;case 0x4d0 :
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/91 KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
[ Upstream commit 66061740f1a487f4ed54fde75e724709f805da53 ]
This fixes Spectre-v1/L1TF vulnerabilities in intel_find_fixed_event() and intel_rdpmc_ecx_to_pmc().kvm_rdpmc() (ancestor of intel_find_fixed_event()) and reprogram_fixed_counter() (ancestor of intel_rdpmc_ecx_to_pmc()) are exported symbols so KVM should treat them conservatively from a security perspective.
--- arch/x86/kvm/pmu_intel.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
arch/x86/kvm/pmu_intel.c +16 -8
@@ -87,10 +87,14 @@ static unsigned intel_find_arch_event(struct kvm_pmu *pmu,static unsigned intel_find_fixed_event (int idx) { -if (idx >=ARRAY_SIZE (fixed_pmc_events)) +u32 event; +size_t size =ARRAY_SIZE (fixed_pmc_events); + +if (idx >= size)return PERF_COUNT_HW_MAX ; -return intel_arch_events[fixed_pmc_events[idx]].event_type; + event = fixed_pmc_events[array_index_nospec (idx, size)]; +return intel_arch_events[event].event_type; }/* check if a PMC is enabled by comparising it with globl_ctrl bits. */
@@ -131,15 +135,19 @@ static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,struct kvm_pmu *pmu =vcpu_to_pmu (vcpu);bool fixed = idx & (1u <<30 );struct kvm_pmc *counters; +unsigned int num_counters; idx &= ~(3u <<30 ); -if (!fixed && idx >= pmu->nr_arch_gp_counters) -return NULL ; -if (fixed && idx >= pmu->nr_arch_fixed_counters) +if (fixed) { + counters = pmu->fixed_counters; + num_counters = pmu->nr_arch_fixed_counters; + }else { + counters = pmu->gp_counters; + num_counters = pmu->nr_arch_gp_counters; + } +if (idx >= num_counters)return NULL ; - counters = fixed ? pmu->fixed_counters : pmu->gp_counters; - -return &counters[idx]; +return &counters[array_index_nospec (idx, num_counters)]; }static bool intel_is_valid_msr (struct kvm_vcpu *vcpu,u32 msr)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/91 KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
In reply to Greg Kroah-HartmanFrom: Marios Pomonis <[email protected]>
[ Upstream commit 4bf79cb089f6b1c6c632492c0271054ce52ad766 ]
This fixes a Spectre-v1/L1TF vulnerability in kvm_lapic_reg_write(). This function contains index computations based on the (attacker-controlled) MSR number.
--- arch/x86/kvm/lapic.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
arch/x86/kvm/lapic.c +10 -3
@@ -36,6 +36,7 @@#include <asm/delay.h> #include <linux/atomic.h> #include <linux/jump_label.h> +#include <linux/nospec.h> #include "kvm_cache_regs.h" #include "irq.h" #include "trace.h"
@@ -1432,15 +1433,21 @@ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)case APIC_LVTTHMR :case APIC_LVTPC :case APIC_LVT1 : -case APIC_LVTERR : +case APIC_LVTERR : {/* TODO: Check vector */ +size_t size; +u32 index; +if (!kvm_apic_sw_enabled (apic)) val |=APIC_LVT_MASKED ; - val &= apic_lvt_mask[(reg -APIC_LVTT ) >>4 ]; + size =ARRAY_SIZE (apic_lvt_mask); + index =array_index_nospec ( + (reg -APIC_LVTT ) >>4 , size); + val &= apic_lvt_mask[index];apic_set_reg (apic, reg, val); -break ; + }case APIC_LVTT :if (!kvm_apic_sw_enabled (apic))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/91 btrfs: flush write bio if we loop in extent_write_cache_pages
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 96bf313ecb33567af4cb53928b0c951254a02759 ]
There exists a deadlock with range_cyclic that has existed forever. If we loop around with a bio already built we could deadlock with a writer who has the page locked that we're attempting to write but is waiting on a page in our bio to be written out. The task traces are as follows
PID: 1329874 TASK: ffff889ebcdf3800 CPU: 33 COMMAND: "kworker/u113:5"
#0 [ffffc900297bb658] __schedule at ffffffff81a4c33f
#1 [ffffc900297bb6e0] schedule at ffffffff81a4c6e3
#2 [ffffc900297bb6f8] io_schedule at ffffffff81a4ca42
#3 [ffffc900297bb708] __lock_page at ffffffff811f145b
#4 [ffffc900297bb798] __process_pages_contig at ffffffff814bc502 #5 [ffffc900297bb8c8] lock_delalloc_pages at ffffffff814bc684 #6 [ffffc900297bb900] find_lock_delalloc_range at ffffffff814be9ff #7 [ffffc900297bb9a0] writepage_delalloc at ffffffff814bebd0 #8 [ffffc900297bba18] __extent_writepage at ffffffff814bfbf2 #9 [ffffc900297bba98] extent_write_cache_pages at ffffffff814bffbd
PID: 2167901 TASK: ffff889dc6a59c00 CPU: 14 COMMAND:
"aio-dio-invalid"
#0 [ffffc9003b50bb18] __schedule at ffffffff81a4c33f #1 [ffffc9003b50bba0] schedule at ffffffff81a4c6e3 #2 [ffffc9003b50bbb8] io_schedule at ffffffff81a4ca42 #3 [ffffc9003b50bbc8] wait_on_page_bit at ffffffff811f24d6 #4 [ffffc9003b50bc60] prepare_pages at ffffffff814b05a7 #5 [ffffc9003b50bcd8] btrfs_buffered_write at ffffffff814b1359 #6 [ffffc9003b50bdb0] btrfs_file_write_iter at ffffffff814b5933 #7 [ffffc9003b50be38] new_sync_write at ffffffff8128f6a8 #8 [ffffc9003b50bec8] vfs_write at ffffffff81292b9d #9 [ffffc9003b50bf00] ksys_pwrite64 at ffffffff81293032
I used drgn to find the respective pages we were stuck on
page_entry.page 0xffffea00fbfc7500 index 8148 bit 15 pid 2167901 page_entry.page 0xffffea00f9bb7400 index 7680 bit 0 pid 1329874
As you can see the kworker is waiting for bit 0 (PG_locked) on index 7680, and aio-dio-invalid is waiting for bit 15 (PG_writeback) on index 8148. aio-dio-invalid has 7680, and the kworker epd looks like the following
crash> struct extent_page_data ffffc900297bbbb0
struct extent_page_data {
bio = 0xffff889f747ed830,
tree = 0xffff889eed6ba448,
extent_locked = 0,
sync_io = 0
}Probably worth mentioning as well that it waits for writeback of the page to complete while holding a lock on it (at prepare_pages()).
Using drgn I walked the bio pages looking for page 0xffffea00fbfc7500 which is the one we're waiting for writeback on
bio = Object(prog, 'struct bio', address=0xffff889f747ed830) for i in range(0, bio.bi_vcnt.value_()):
bv = bio.bi_io_vec[i]
if bv.bv_page.value_() == 0xffffea00fbfc7500:
print("FOUND IT")which validated what I suspected.
The fix for this is simple, flush the epd before we loop back around to the beginning of the file during writeout.
--- fs/btrfs/extent_io.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/btrfs/extent_io.c +8 -0
@@ -4164,6 +4164,14 @@ static int extent_write_cache_pages(struct extent_io_tree *tree,*/ scanned =1 ; index =0 ; + +/* +* If we're looping we could run into a page that is locked by a +* writer and that writer could be waiting on writeback for a +* page in our current bio, and thus deadlock, so flush the +* write bio here. +*/ +flush_write_bio (data); goto retry; }btrfs_add_delayed_iput (inode);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/91 KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit e30a7d623dccdb3f880fbcad980b0cb589a1da45 ]
Remove the bogus 64-bit only condition from the check that disables MMIO spte optimization when the system supports the max PA, i.e. doesn't have any reserved PA bits. 32-bit KVM always uses PAE paging for the shadow MMU, and per Intel's SDM:
PAE paging translates 32-bit linear addresses to 52-bit physical addresses.
The kernel's restrictions on max physical addresses are limits on how much memory the kernel can reasonably use, not what physical addresses are supported by hardware.
--- arch/x86/kvm/x86.c | 2 -- 1 file changed, 2 deletions(-)
arch/x86/kvm/x86.c +0 -2
@@ -5885,14 +5885,12 @@ static void kvm_set_mmio_spte_mask(void)/* Set the present bit. */ mask |=1ull ; -#ifdef CONFIG_X86_64 /* * If reserved bit is not supported, clear the present bit to disable * mmio page fault. */ if (maxphyaddr ==52 ) mask &= ~1ull ; -#endif kvm_mmu_set_mmio_spte_mask (mask); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/91 KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit fe6ed369fca98e99df55c932b85782a5687526b5 ]
Reject writes to RTIT address MSRs if the data being written is a non-canonical address as the MSRs are subject to canonical checks, e.g. KVM will trigger an unchecked #GP when loading the values to hardware during pt_guest_enter().
--- arch/x86/kvm/vmx/vmx.c | 8033 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 8033 insertions(+) create mode 100644 arch/x86/kvm/vmx/vmx.c
arch/x86/kvm/vmx/vmx.c new file +8033 -0
@@ -0,0 +1,8033 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* +* Kernel-based Virtual Machine driver for Linux +* +* This module enables machines with Intel VT-x extensions to run virtual +* machines without emulation or binary translation. +* +* Copyright (C) 2006 Qumranet, Inc. +* Copyright 2010 Red Hat, Inc. and/or its affiliates. +* +* Authors: +* Avi Kivity <[email protected]> +* Yaniv Kamay <[email protected]> +*/ + +#include <linux/frame.h> +#include <linux/highmem.h> +#include <linux/hrtimer.h> +#include <linux/kernel.h> +#include <linux/kvm_host.h> +#include <linux/module.h> +#include <linux/moduleparam.h> +#include <linux/mod_devicetable.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/sched/smt.h> +#include <linux/slab.h> +#include <linux/tboot.h> +#include <linux/trace_events.h> + +#include <asm/apic.h> +#include <asm/asm.h> +#include <asm/cpu.h> +#include <asm/debugreg.h> +#include <asm/desc.h> +#include <asm/fpu/internal.h> +#include <asm/io.h> +#include <asm/irq_remapping.h> +#include <asm/kexec.h> +#include <asm/perf_event.h> +#include <asm/mce.h> +#include <asm/mmu_context.h> +#include <asm/mshyperv.h> +#include <asm/spec-ctrl.h> +#include <asm/virtext.h> +#include <asm/vmx.h> + +#include "capabilities.h" +#include "cpuid.h" +#include "evmcs.h" +#include "irq.h" +#include "kvm_cache_regs.h" +#include "lapic.h" +#include "mmu.h" +#include "nested.h" +#include "ops.h" +#include "pmu.h" +#include "trace.h" +#include "vmcs.h" +#include "vmcs12.h" +#include "vmx.h" +#include "x86.h" + +MODULE_AUTHOR ("Qumranet" ); +MODULE_LICENSE ("GPL" ); + +static const struct x86_cpu_id vmx_cpu_id[] = { +X86_FEATURE_MATCH (X86_FEATURE_VMX ), + {} +}; +MODULE_DEVICE_TABLE (x86cpu, vmx_cpu_id); + +bool __read_mostly enable_vpid =1 ; +module_param_named (vpid, enable_vpid, bool,0444 ); + +static bool __read_mostly enable_vnmi =1 ; +module_param_named (vnmi, enable_vnmi, bool,S_IRUGO ); + +bool __read_mostly flexpriority_enabled =1 ; +module_param_named (flexpriority, flexpriority_enabled, bool,S_IRUGO ); + +bool __read_mostly enable_ept =1 ; +module_param_named (ept, enable_ept, bool,S_IRUGO ); + +bool __read_mostly enable_unrestricted_guest =1 ; +module_param_named (unrestricted_guest, + enable_unrestricted_guest, bool,S_IRUGO ); + +bool __read_mostly enable_ept_ad_bits =1 ; +module_param_named (eptad, enable_ept_ad_bits, bool,S_IRUGO ); + +static bool __read_mostly emulate_invalid_guest_state = true; +module_param (emulate_invalid_guest_state, bool,S_IRUGO ); + +static bool __read_mostly fasteoi =1 ; +module_param (fasteoi, bool,S_IRUGO ); + +static bool __read_mostly enable_apicv =1 ; +module_param (enable_apicv, bool,S_IRUGO ); + +/* +* If nested=1, nested virtualization is supported, i.e., guests may use +* VMX and be a hypervisor for its own guests. If nested=0, guests may not +* use VMX instructions. +*/ +static bool __read_mostly nested =1 ; +module_param (nested, bool,S_IRUGO ); + +bool __read_mostly enable_pml =1 ; +module_param_named (pml, enable_pml, bool,S_IRUGO ); + +static bool __read_mostly dump_invalid_vmcs =0 ; +module_param (dump_invalid_vmcs, bool,0644 ); + +#define MSR_BITMAP_MODE_X2APIC 1 +#define MSR_BITMAP_MODE_X2APIC_APICV 2 + +#define KVM_VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL + +/* Guest_tsc -> host_tsc conversion requires 64-bit division. */ +static int __read_mostly cpu_preemption_timer_multi; +static bool __read_mostly enable_preemption_timer =1 ; +#ifdef CONFIG_X86_64 +module_param_named (preemption_timer, enable_preemption_timer, bool,S_IRUGO ); +#endif + +#define KVM_VM_CR0_ALWAYS_OFF (X86_CR0_NW | X86_CR0_CD) +#define KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR0_NE +#define KVM_VM_CR0_ALWAYS_ON \ + (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | \ + X86_CR0_WP | X86_CR0_PG | X86_CR0_PE) +#define KVM_CR4_GUEST_OWNED_BITS \ + (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \ + | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_TSD) + +#define KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR4_VMXE +#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE) +#define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE) + +#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM)) + +#define MSR_IA32_RTIT_STATUS_MASK (~(RTIT_STATUS_FILTEREN | \ + RTIT_STATUS_CONTEXTEN | RTIT_STATUS_TRIGGEREN | \ + RTIT_STATUS_ERROR | RTIT_STATUS_STOPPED | \ + RTIT_STATUS_BYTECNT)) + +#define MSR_IA32_RTIT_OUTPUT_BASE_MASK \ + (~((1UL << cpuid_query_maxphyaddr(vcpu)) - 1) | 0x7f) + +/* +* These 2 parameters are used to config the controls for Pause-Loop Exiting: +* ple_gap: upper bound on the amount of time between two successive +* executions of PAUSE in a loop. Also indicate if ple enabled. +* According to test, this time is usually smaller than 128 cycles. +* ple_window: upper bound on the amount of time a guest is allowed to execute +* in a PAUSE loop. Tests indicate that most spinlocks are held for +* less than 2^12 cycles +* Time is measured based on a counter that runs at the same rate as the TSC, +* refer SDM volume 3b section 21.6.13 & 22.1.3. +*/ +static unsigned int ple_gap =KVM_DEFAULT_PLE_GAP ; +module_param (ple_gap, uint,0444 ); + +static unsigned int ple_window =KVM_VMX_DEFAULT_PLE_WINDOW ; +module_param (ple_window, uint,0444 ); + +/* Default doubles per-vcpu window every exit. */ +static unsigned int ple_window_grow =KVM_DEFAULT_PLE_WINDOW_GROW ; +module_param (ple_window_grow, uint,0444 ); + +/* Default resets per-vcpu window every exit to ple_window. */ +static unsigned int ple_window_shrink =KVM_DEFAULT_PLE_WINDOW_SHRINK ; +module_param (ple_window_shrink, uint,0444 ); + +/* Default is to compute the maximum so we can never overflow. */ +static unsigned int ple_window_max =KVM_VMX_DEFAULT_PLE_WINDOW_MAX ; +module_param (ple_window_max, uint,0444 ); + +/* Default is SYSTEM mode, 1 for host-guest mode */ +int __read_mostly pt_mode =PT_MODE_SYSTEM ; +module_param (pt_mode, int,S_IRUGO ); + +static DEFINE_STATIC_KEY_FALSE (vmx_l1d_should_flush); +static DEFINE_STATIC_KEY_FALSE (vmx_l1d_flush_cond); +static DEFINE_MUTEX (vmx_l1d_flush_mutex); + +/* Storage for pre module init parameter parsing */ +static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param =VMENTER_L1D_FLUSH_AUTO ; + +static const struct { +const char *option; +bool for_parse; +} vmentry_l1d_param[] = { + [VMENTER_L1D_FLUSH_AUTO ] = {"auto" , true}, + [VMENTER_L1D_FLUSH_NEVER ] = {"never" , true}, + [VMENTER_L1D_FLUSH_COND ] = {"cond" , true}, + [VMENTER_L1D_FLUSH_ALWAYS ] = {"always" , true}, + [VMENTER_L1D_FLUSH_EPT_DISABLED ] = {"EPT disabled" , false}, + [VMENTER_L1D_FLUSH_NOT_REQUIRED ] = {"not required" , false}, +}; + +#define L1D_CACHE_ORDER 4 +static void *vmx_l1d_flush_pages; + +static int vmx_setup_l1d_flush (enum vmx_l1d_flush_state l1tf) +{ +struct page *page; +unsigned int i; + +if (!boot_cpu_has_bug (X86_BUG_L1TF )) { + l1tf_vmx_mitigation =VMENTER_L1D_FLUSH_NOT_REQUIRED ; +return 0 ; + } + +if (!enable_ept) { + l1tf_vmx_mitigation =VMENTER_L1D_FLUSH_EPT_DISABLED ; +return 0 ; + } + +if (boot_cpu_has (X86_FEATURE_ARCH_CAPABILITIES )) { +u64 msr; + +rdmsrl (MSR_IA32_ARCH_CAPABILITIES , msr); +if (msr &ARCH_CAP_SKIP_VMENTRY_L1DFLUSH ) { + l1tf_vmx_mitigation =VMENTER_L1D_FLUSH_NOT_REQUIRED ; +return 0 ; + } + } + +/* If set to auto use the default l1tf mitigation method */ +if (l1tf ==VMENTER_L1D_FLUSH_AUTO ) { +switch (l1tf_mitigation) { +case L1TF_MITIGATION_OFF : + l1tf =VMENTER_L1D_FLUSH_NEVER ; +break ; +case L1TF_MITIGATION_FLUSH_NOWARN : +case L1TF_MITIGATION_FLUSH : +case L1TF_MITIGATION_FLUSH_NOSMT : + l1tf =VMENTER_L1D_FLUSH_COND ; +break ; +case L1TF_MITIGATION_FULL : +case L1TF_MITIGATION_FULL_FORCE : + l1tf =VMENTER_L1D_FLUSH_ALWAYS ; +break ; + } + }else if (l1tf_mitigation ==L1TF_MITIGATION_FULL_FORCE ) { + l1tf =VMENTER_L1D_FLUSH_ALWAYS ; + } + +if (l1tf !=VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages && + !boot_cpu_has (X86_FEATURE_FLUSH_L1D )) { +/* +* This allocation for vmx_l1d_flush_pages is not tied to a VM +* lifetime and so should not be charged to a memcg. +*/ + page =alloc_pages (GFP_KERNEL ,L1D_CACHE_ORDER ); +if (!page) +return -ENOMEM ; + vmx_l1d_flush_pages =page_address (page); + +/* +* Initialize each page with a different pattern in +* order to protect against KSM in the nested +* virtualization case. +*/ +for (i =0 ; i <1u <<L1D_CACHE_ORDER ; ++i) { +memset (vmx_l1d_flush_pages + i *PAGE_SIZE , i +1 , +PAGE_SIZE ); + } + } + + l1tf_vmx_mitigation = l1tf; + +if (l1tf !=VMENTER_L1D_FLUSH_NEVER ) +static_branch_enable (&vmx_l1d_should_flush); +else +static_branch_disable (&vmx_l1d_should_flush); + +if (l1tf ==VMENTER_L1D_FLUSH_COND ) +static_branch_enable (&vmx_l1d_flush_cond); +else +static_branch_disable (&vmx_l1d_flush_cond); +return 0 ; +} + +static int vmentry_l1d_flush_parse (const char *s) +{ +unsigned int i; + +if (s) { +for (i =0 ; i <ARRAY_SIZE (vmentry_l1d_param); i++) { +if (vmentry_l1d_param[i].for_parse && +sysfs_streq (s, vmentry_l1d_param[i].option)) +return i; + } + } +return -EINVAL ; +} + +static int vmentry_l1d_flush_set (const char *s,const struct kernel_param *kp) +{ +int l1tf, ret; + + l1tf =vmentry_l1d_flush_parse (s); +if (l1tf <0 ) +return l1tf; + +if (!boot_cpu_has (X86_BUG_L1TF )) +return 0 ; + +/* +* Has vmx_init() run already? If not then this is the pre init +* parameter parsing. In that case just store the value and let +* vmx_init() do the proper setup after enable_ept has been +* established. +*/ +if (l1tf_vmx_mitigation ==VMENTER_L1D_FLUSH_AUTO ) { + vmentry_l1d_flush_param = l1tf; +return 0 ; + } + +mutex_lock (&vmx_l1d_flush_mutex); + ret =vmx_setup_l1d_flush (l1tf); +mutex_unlock (&vmx_l1d_flush_mutex); +return ret; +} + +static int vmentry_l1d_flush_get (char *s,const struct kernel_param *kp) +{ +if (WARN_ON_ONCE (l1tf_vmx_mitigation >=ARRAY_SIZE (vmentry_l1d_param))) +return sprintf (s,"???\n" ); + +return sprintf (s,"%s\n" , vmentry_l1d_param[l1tf_vmx_mitigation].option); +} + +static const struct kernel_param_ops vmentry_l1d_flush_ops = { + .set = vmentry_l1d_flush_set, + .get = vmentry_l1d_flush_get, +}; +module_param_cb (vmentry_l1d_flush, &vmentry_l1d_flush_ops,NULL ,0644 ); + +static bool guest_state_valid (struct kvm_vcpu *vcpu); +static u32 vmx_segment_access_rights (struct kvm_segment *var); +static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap, +u32 msr,int type); + +void vmx_vmexit (void ); + +#define vmx_insn_failed(fmt...) \ +do { \ + WARN_ONCE(1, fmt); \ + pr_warn_ratelimited(fmt); \ +} while (0) + +asmlinkage void vmread_error(unsigned long field, bool fault) +{ +if (fault) +kvm_spurious_fault (); +else +vmx_insn_failed ("kvm: vmread failed: field=%lx\n" , field); +} + +noinline void vmwrite_error(unsigned long field, unsigned long value) +{ +vmx_insn_failed ("kvm: vmwrite failed: field=%lx val=%lx err=%d\n" , + field, value,vmcs_read32 (VM_INSTRUCTION_ERROR )); +} + +noinline void vmclear_error(struct vmcs *vmcs, u64 phys_addr) +{ +vmx_insn_failed ("kvm: vmclear failed: %p/%llx\n" , vmcs, phys_addr); +} + +noinline void vmptrld_error(struct vmcs *vmcs, u64 phys_addr) +{ +vmx_insn_failed ("kvm: vmptrld failed: %p/%llx\n" , vmcs, phys_addr); +} + +noinline void invvpid_error(unsigned long ext, u16 vpid, gva_t gva) +{ +vmx_insn_failed ("kvm: invvpid failed: ext=0x%lx vpid=%u gva=0x%lx\n" , + ext, vpid, gva); +} + +noinline void invept_error(unsigned long ext, u64 eptp, gpa_t gpa) +{ +vmx_insn_failed ("kvm: invept failed: ext=0x%lx eptp=%llx gpa=0x%llx\n" , + ext, eptp, gpa); +} + +static DEFINE_PER_CPU(struct vmcs *, vmxarea); +DEFINE_PER_CPU (struct vmcs *, current_vmcs); +/* +* We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed +* when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it. +*/ +static DEFINE_PER_CPU(struct list_head, loaded_vmcss_on_cpu); + +/* +* We maintian a per-CPU linked-list of vCPU, so in wakeup_handler() we +* can find which vCPU should be waken up. +*/ +static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu); +static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock); + +static DECLARE_BITMAP(vmx_vpid_bitmap, VMX_NR_VPIDS); +static DEFINE_SPINLOCK (vmx_vpid_lock); + +struct vmcs_config vmcs_config; +struct vmx_capability vmx_capability; + +#define VMX_SEGMENT_FIELD (seg) \ + [VCPU_SREG_##seg] = { \ + .selector = GUEST_##seg##_SELECTOR, \ + .base = GUEST_##seg##_BASE, \ + .limit = GUEST_##seg##_LIMIT, \ + .ar_bytes = GUEST_##seg##_AR_BYTES, \ + } + +static const struct kvm_vmx_segment_field { +unsigned selector; +unsigned base; +unsigned limit; +unsigned ar_bytes; +} kvm_vmx_segment_fields[] = { +VMX_SEGMENT_FIELD (CS ), +VMX_SEGMENT_FIELD (DS ), +VMX_SEGMENT_FIELD (ES ), +VMX_SEGMENT_FIELD (FS ), +VMX_SEGMENT_FIELD (GS ), +VMX_SEGMENT_FIELD (SS ), +VMX_SEGMENT_FIELD (TR ), +VMX_SEGMENT_FIELD (LDTR ), +}; + +u64 host_efer; +static unsigned long host_idt_base; + +/* +* Though SYSCALL is only supported in 64-bit mode on Intel CPUs, kvm +* will emulate SYSCALL in legacy mode if the vendor string in guest +* CPUID.0:{EBX,ECX,EDX} is "AuthenticAMD" or "AMDisbetter!" To +* support this emulation, IA32_STAR must always be included in +* vmx_msr_index[], even in i386 builds. +*/ +const u32 vmx_msr_index[] = { +#ifdef CONFIG_X86_64 + MSR_SYSCALL_MASK, MSR_LSTAR, MSR_CSTAR, +#endif + MSR_EFER, MSR_TSC_AUX, MSR_STAR, + MSR_IA32_TSX_CTRL, +}; + +#if IS_ENABLED(CONFIG_HYPERV) +static bool __read_mostly enlightened_vmcs = true; +module_param(enlightened_vmcs, bool, 0444); + +/* check_ept_pointer() should be under protection of ept_pointer_lock. */ +static void check_ept_pointer_match(struct kvm *kvm) +{ + struct kvm_vcpu *vcpu; + u64 tmp_eptp = INVALID_PAGE; + int i; + + kvm_for_each_vcpu(i, vcpu, kvm) { + if (!VALID_PAGE(tmp_eptp)) { + tmp_eptp = to_vmx(vcpu)->ept_pointer; + } else if (tmp_eptp != to_vmx(vcpu)->ept_pointer) { + to_kvm_vmx(kvm)->ept_pointers_match + = EPT_POINTERS_MISMATCH; + return; + } + } + + to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH; +} + +static int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush, + void *data) +{ + struct kvm_tlb_range *range = data; + + return hyperv_fill_flush_guest_mapping_list(flush, range->start_gfn, + range->pages); +} + +static inline int __hv_remote_flush_tlb_with_range(struct kvm *kvm, + struct kvm_vcpu *vcpu, struct kvm_tlb_range *range) +{ + u64 ept_pointer = to_vmx(vcpu)->ept_pointer; + + /* + * FLUSH_GUEST_PHYSICAL_ADDRESS_SPACE hypercall needs address + * of the base of EPT PML4 table, strip off EPT configuration + * information. + */ + if (range) + return hyperv_flush_guest_mapping_range(ept_pointer & PAGE_MASK, + kvm_fill_hv_flush_list_func, (void *)range); + else + return hyperv_flush_guest_mapping(ept_pointer & PAGE_MASK); +} + +static int hv_remote_flush_tlb_with_range(struct kvm *kvm, + struct kvm_tlb_range *range) +{ + struct kvm_vcpu *vcpu; + int ret = 0, i; + + spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock); + + if (to_kvm_vmx(kvm)->ept_pointers_match == EPT_POINTERS_CHECK) + check_ept_pointer_match(kvm); + + if (to_kvm_vmx(kvm)->ept_pointers_match != EPT_POINTERS_MATCH) { + kvm_for_each_vcpu(i, vcpu, kvm) { + /* If ept_pointer is invalid pointer, bypass flush request. */ + if (VALID_PAGE(to_vmx(vcpu)->ept_pointer)) + ret |= __hv_remote_flush_tlb_with_range( + kvm, vcpu, range); + } + } else { + ret = __hv_remote_flush_tlb_with_range(kvm, + kvm_get_vcpu(kvm, 0), range); + } + + spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock); + return ret; +} +static int hv_remote_flush_tlb(struct kvm *kvm) +{ + return hv_remote_flush_tlb_with_range(kvm, NULL); +} + +static int hv_enable_direct_tlbflush(struct kvm_vcpu *vcpu) +{ + struct hv_enlightened_vmcs *evmcs; + struct hv_partition_assist_pg **p_hv_pa_pg = + &vcpu->kvm->arch.hyperv.hv_pa_pg; + /* + * Synthetic VM-Exit is not enabled in current code and so All + * evmcs in singe VM shares same assist page. + */ + if (!*p_hv_pa_pg) + *p_hv_pa_pg = kzalloc(PAGE_SIZE, GFP_KERNEL); + + if (!*p_hv_pa_pg) + return -ENOMEM; + + evmcs = (struct hv_enlightened_vmcs *)to_vmx(vcpu)->loaded_vmcs->vmcs; + + evmcs->partition_assist_page = + __pa(*p_hv_pa_pg); + evmcs->hv_vm_id = (unsigned long)vcpu->kvm; + evmcs->hv_enlightenments_control.nested_flush_hypercall = 1; + + return 0; +} + +#endif /* IS_ENABLED(CONFIG_HYPERV) */ + +/* + * Comment's format: document - errata name - stepping - processor name. + * Refer from + * https://www.virtualbox.org/svn/vbox/trunk/src/VBox/VMM/VMMR0/HMR0.cpp + */ +static u32 vmx_preemption_cpu_tfms[] = { +/* 323344.pdf - BA86 - D0 - Xeon 7500 Series */ +0x000206E6, +/* 323056.pdf - AAX65 - C2 - Xeon L3406 */ +/* 322814.pdf - AAT59 - C2 - i7-600, i5-500, i5-400 and i3-300 Mobile */ +/* 322911.pdf - AAU65 - C2 - i5-600, i3-500 Desktop and Pentium G6950 */ +0x00020652, +/* 322911.pdf - AAU65 - K0 - i5-600, i3-500 Desktop and Pentium G6950 */ +0x00020655, +/* 322373.pdf - AAO95 - B1 - Xeon 3400 Series */ +/* 322166.pdf - AAN92 - B1 - i7-800 and i5-700 Desktop */ +/* + * 320767.pdf - AAP86 - B1 - + * i7-900 Mobile Extreme, i7-800 and i7-700 Mobile + */ +0x000106E5, +/* 321333.pdf - AAM126 - C0 - Xeon 3500 */ +0x000106A0, +/* 321333.pdf - AAM126 - C1 - Xeon 3500 */ +0x000106A1, +/* 320836.pdf - AAJ124 - C0 - i7-900 Desktop Extreme and i7-900 Desktop */ +0x000106A4, + /* 321333.pdf - AAM126 - D0 - Xeon 3500 */ + /* 321324.pdf - AAK139 - D0 - Xeon 5500 */ + /* 320836.pdf - AAJ124 - D0 - i7-900 Extreme and i7-900 Desktop */ +0x000106A5, + /* Xeon E3-1220 V2 */ +0x000306A8, +}; + +static inline bool cpu_has_broken_vmx_preemption_timer(void) +{ + u32 eax = cpuid_eax(0x00000001), i; + + /* Clear the reserved bits */ + eax &= ~(0x3U << 14 | 0xfU << 28); + for (i = 0; i < ARRAY_SIZE(vmx_preemption_cpu_tfms); i++) + if (eax == vmx_preemption_cpu_tfms[i]) + return true; + + return false; +} + +static inline bool cpu_need_virtualize_apic_accesses(struct kvm_vcpu *vcpu) +{ + return flexpriority_enabled && lapic_in_kernel(vcpu); +} + +static inline bool report_flexpriority(void) +{ + return flexpriority_enabled; +} + +static inline int __find_msr_index(struct vcpu_vmx *vmx, u32 msr) +{ + int i; + + for (i = 0; i < vmx->nmsrs; ++i) + if (vmx_msr_index[vmx->guest_msrs[i].index] == msr) + return i; + return -1; +} + +struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr) +{ + int i; + + i = __find_msr_index(vmx, msr); + if (i >= 0) + return &vmx->guest_msrs[i]; + return NULL; +} + +static int vmx_set_guest_msr(struct vcpu_vmx *vmx, struct shared_msr_entry *msr, u64 data) +{ + int ret = 0; + + u64 old_msr_data = msr->data; + msr->data = data; + if (msr - vmx->guest_msrs < vmx->save_nmsrs) { + preempt_disable(); + ret = kvm_set_shared_msr(msr->index, msr->data, + msr->mask); + preempt_enable(); + if (ret) + msr->data = old_msr_data; + } + return ret; +} + +void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs) +{ + vmcs_clear(loaded_vmcs->vmcs); + if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched) + vmcs_clear(loaded_vmcs->shadow_vmcs); + loaded_vmcs->cpu = -1; + loaded_vmcs->launched = 0; +} + +#ifdef CONFIG_KEXEC_CORE +/* + * This bitmap is used to indicate whether the vmclear + * operation is enabled on all cpus. All disabled by + * default. + */ +static cpumask_t crash_vmclear_enabled_bitmap = CPU_MASK_NONE; + +static inline void crash_enable_local_vmclear(int cpu) +{ + cpumask_set_cpu(cpu, &crash_vmclear_enabled_bitmap); +} + +static inline void crash_disable_local_vmclear(int cpu) +{ + cpumask_clear_cpu(cpu, &crash_vmclear_enabled_bitmap); +} + +static inline int crash_local_vmclear_enabled(int cpu) +{ + return cpumask_test_cpu(cpu, &crash_vmclear_enabled_bitmap); +} + +static void crash_vmclear_local_loaded_vmcss(void) +{ + int cpu = raw_smp_processor_id(); + struct loaded_vmcs *v; + + if (!crash_local_vmclear_enabled(cpu)) + return; + + list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu), + loaded_vmcss_on_cpu_link) + vmcs_clear(v->vmcs); +} +#else +static inline void crash_enable_local_vmclear(int cpu) { } +static inline void crash_disable_local_vmclear(int cpu) { } +#endif /* CONFIG_KEXEC_CORE */ + +static void __loaded_vmcs_clear(void *arg) +{ + struct loaded_vmcs *loaded_vmcs = arg; + int cpu = raw_smp_processor_id(); + + if (loaded_vmcs->cpu != cpu) + return; /* vcpu migration can race with cpu offline */ + if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs) + per_cpu(current_vmcs, cpu) = NULL; + crash_disable_local_vmclear(cpu); + list_del(&loaded_vmcs->loaded_vmcss_on_cpu_link); + + /* + * we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link + * is before setting loaded_vmcs->vcpu to -1 which is done in + * loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist + * then adds the vmcs into percpu list before it is deleted. + */ + smp_wmb(); + + loaded_vmcs_init(loaded_vmcs); + crash_enable_local_vmclear(cpu); +} + +void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs) +{ + int cpu = loaded_vmcs->cpu; + + if (cpu != -1) + smp_call_function_single(cpu, + __loaded_vmcs_clear, loaded_vmcs, 1); +} + +static bool vmx_segment_cache_test_set(struct vcpu_vmx *vmx, unsigned seg, + unsigned field) +{ + bool ret; + u32 mask = 1 << (seg * SEG_FIELD_NR + field); + + if (!kvm_register_is_available(&vmx->vcpu, VCPU_EXREG_SEGMENTS)) { + kvm_register_mark_available(&vmx->vcpu, VCPU_EXREG_SEGMENTS); + vmx->segment_cache.bitmask = 0; + } + ret = vmx->segment_cache.bitmask & mask; + vmx->segment_cache.bitmask |= mask; + return ret; +} + +static u16 vmx_read_guest_seg_selector(struct vcpu_vmx *vmx, unsigned seg) +{ + u16 *p = &vmx->segment_cache.seg[seg].selector; + + if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_SEL)) + *p = vmcs_read16(kvm_vmx_segment_fields[seg].selector); + return *p; +} + +static ulong vmx_read_guest_seg_base(struct vcpu_vmx *vmx, unsigned seg) +{ + ulong *p = &vmx->segment_cache.seg[seg].base; + + if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_BASE)) + *p = vmcs_readl(kvm_vmx_segment_fields[seg].base); + return *p; +} + +static u32 vmx_read_guest_seg_limit(struct vcpu_vmx *vmx, unsigned seg) +{ + u32 *p = &vmx->segment_cache.seg[seg].limit; + + if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_LIMIT)) + *p = vmcs_read32(kvm_vmx_segment_fields[seg].limit); + return *p; +} + +static u32 vmx_read_guest_seg_ar(struct vcpu_vmx *vmx, unsigned seg) +{ + u32 *p = &vmx->segment_cache.seg[seg].ar; + + if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_AR)) + *p = vmcs_read32(kvm_vmx_segment_fields[seg].ar_bytes); + return *p; +} + +void update_exception_bitmap(struct kvm_vcpu *vcpu) +{ + u32 eb; + + eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) | + (1u << DB_VECTOR) | (1u << AC_VECTOR); + /* + * Guest access to VMware backdoor ports could legitimately + * trigger #GP because of TSS I/O permission bitmap. + * We intercept those #GP and allow access to them anyway + * as VMware does. + */ + if (enable_vmware_backdoor) + eb |= (1u << GP_VECTOR); + if ((vcpu->guest_debug & + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) == + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) + eb |= 1u << BP_VECTOR; + if (to_vmx(vcpu)->rmode.vm86_active) + eb = ~0; + if (enable_ept) + eb &= ~(1u << PF_VECTOR); /* bypass_guest_pf = 0 */ + + /* When we are running a nested L2 guest and L1 specified for it a + * certain exception bitmap, we must trap the same exceptions and pass + * them to L1. When running L2, we will only handle the exceptions + * specified above if L1 did not want them. + */ + if (is_guest_mode(vcpu)) + eb |= get_vmcs12(vcpu)->exception_bitmap; + + vmcs_write32(EXCEPTION_BITMAP, eb); +} + +/* + * Check if MSR is intercepted for currently loaded MSR bitmap. + */ +static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr) +{ + unsigned long *msr_bitmap; + int f = sizeof(unsigned long); + + if (!cpu_has_vmx_msr_bitmap()) + return true; + + msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap; + + if (msr <= 0x1fff) { + return !!test_bit(msr, msr_bitmap + 0x800 / f); + } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) { + msr &= 0x1fff; + return !!test_bit(msr, msr_bitmap + 0xc00 / f); + } + + return true; +} + +static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx, + unsigned long entry, unsigned long exit) +{ + vm_entry_controls_clearbit(vmx, entry); + vm_exit_controls_clearbit(vmx, exit); +} + +int vmx_find_msr_index(struct vmx_msrs *m, u32 msr) +{ + unsigned int i; + + for (i = 0; i < m->nr; ++i) { + if (m->val[i].index == msr) + return i; + } + return -ENOENT; +} + +static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr) +{ + int i; + struct msr_autoload *m = &vmx->msr_autoload; + + switch (msr) { + case MSR_EFER: + if (cpu_has_load_ia32_efer()) { + clear_atomic_switch_msr_special(vmx, + VM_ENTRY_LOAD_IA32_EFER, + VM_EXIT_LOAD_IA32_EFER); + return; + } + break; + case MSR_CORE_PERF_GLOBAL_CTRL: + if (cpu_has_load_perf_global_ctrl()) { + clear_atomic_switch_msr_special(vmx, + VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL, + VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL); + return; + } + break; + } + i = vmx_find_msr_index(&m->guest, msr); + if (i < 0) + goto skip_guest; + --m->guest.nr; + m->guest.val[i] = m->guest.val[m->guest.nr]; + vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr); + +skip_guest: + i = vmx_find_msr_index(&m->host, msr); + if (i < 0) + return; + + --m->host.nr; + m->host.val[i] = m->host.val[m->host.nr]; + vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr); +} + +static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx, + unsigned long entry, unsigned long exit, + unsigned long guest_val_vmcs, unsigned long host_val_vmcs, + u64 guest_val, u64 host_val) +{ + vmcs_write64(guest_val_vmcs, guest_val); + if (host_val_vmcs != HOST_IA32_EFER) + vmcs_write64(host_val_vmcs, host_val); + vm_entry_controls_setbit(vmx, entry); + vm_exit_controls_setbit(vmx, exit); +} + +static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr, + u64 guest_val, u64 host_val, bool entry_only) +{ + int i, j = 0; + struct msr_autoload *m = &vmx->msr_autoload; + + switch (msr) { + case MSR_EFER: + if (cpu_has_load_ia32_efer()) { + add_atomic_switch_msr_special(vmx, + VM_ENTRY_LOAD_IA32_EFER, + VM_EXIT_LOAD_IA32_EFER, + GUEST_IA32_EFER, + HOST_IA32_EFER, + guest_val, host_val); + return; + } + break; + case MSR_CORE_PERF_GLOBAL_CTRL: + if (cpu_has_load_perf_global_ctrl()) { + add_atomic_switch_msr_special(vmx, + VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL, + VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL, + GUEST_IA32_PERF_GLOBAL_CTRL, + HOST_IA32_PERF_GLOBAL_CTRL, + guest_val, host_val); + return; + } + break; + case MSR_IA32_PEBS_ENABLE: + /* PEBS needs a quiescent period after being disabled (to write + * a record). Disabling PEBS through VMX MSR swapping doesn't + * provide that period, so a CPU could write host's record into + * guest's memory. + */ + wrmsrl(MSR_IA32_PEBS_ENABLE, 0); + } + + i = vmx_find_msr_index(&m->guest, msr); + if (!entry_only) + j = vmx_find_msr_index(&m->host, msr); + + if ((i < 0 && m->guest.nr == NR_LOADSTORE_MSRS) || + (j < 0 && m->host.nr == NR_LOADSTORE_MSRS)) { + printk_once(KERN_WARNING "Not enough msr switch entries. " + "Can't add msr %x\n", msr); + return; + } + if (i < 0) { + i = m->guest.nr++; + vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr); + } + m->guest.val[i].index = msr; + m->guest.val[i].value = guest_val; + + if (entry_only) + return; + + if (j < 0) { + j = m->host.nr++; + vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr); + } + m->host.val[j].index = msr; + m->host.val[j].value = host_val; +} + +static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset) +{ + u64 guest_efer = vmx->vcpu.arch.efer; + u64 ignore_bits = 0; + + /* Shadow paging assumes NX to be available. */ + if (!enable_ept) + guest_efer |= EFER_NX; + + /* + * LMA and LME handled by hardware; SCE meaningless outside long mode. + */ + ignore_bits |= EFER_SCE; +#ifdef CONFIG_X86_64 + ignore_bits |= EFER_LMA | EFER_LME; + /* SCE is meaningful only in long mode on Intel */ + if (guest_efer & EFER_LMA) + ignore_bits &= ~(u64)EFER_SCE; +#endif + + /* + * On EPT, we can't emulate NX, so we must switch EFER atomically. + * On CPUs that support "load IA32_EFER", always switch EFER + * atomically, since it's faster than switching it manually. + */ + if (cpu_has_load_ia32_efer() || + (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) { + if (!(guest_efer & EFER_LMA)) + guest_efer &= ~EFER_LME; + if (guest_efer != host_efer) + add_atomic_switch_msr(vmx, MSR_EFER, + guest_efer, host_efer, false); + else + clear_atomic_switch_msr(vmx, MSR_EFER); + return false; + } else { + clear_atomic_switch_msr(vmx, MSR_EFER); + + guest_efer &= ~ignore_bits; + guest_efer |= host_efer & ignore_bits; + + vmx->guest_msrs[efer_offset].data = guest_efer; + vmx->guest_msrs[efer_offset].mask = ~ignore_bits; + + return true; + } +} + +#ifdef CONFIG_X86_32 +/* + * On 32-bit kernels, VM exits still load the FS and GS bases from the + * VMCS rather than the segment table. KVM uses this helper to figure + * out the current bases to poke them into the VMCS before entry. + */ +static unsigned long segment_base(u16 selector) +{ + struct desc_struct *table; + unsigned long v; + + if (!(selector & ~SEGMENT_RPL_MASK)) + return 0; + + table = get_current_gdt_ro(); + + if ((selector & SEGMENT_TI_MASK) == SEGMENT_LDT) { + u16 ldt_selector = kvm_read_ldt(); + + if (!(ldt_selector & ~SEGMENT_RPL_MASK)) + return 0; + + table = (struct desc_struct *)segment_base(ldt_selector); + } + v = get_desc_base(&table[selector >> 3]); + return v; +} +#endif + +static inline void pt_load_msr(struct pt_ctx *ctx, u32 addr_range) +{ + u32 i; + + wrmsrl(MSR_IA32_RTIT_STATUS, ctx->status); + wrmsrl(MSR_IA32_RTIT_OUTPUT_BASE, ctx->output_base); + wrmsrl(MSR_IA32_RTIT_OUTPUT_MASK, ctx->output_mask); + wrmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match); + for (i = 0; i < addr_range; i++) { + wrmsrl(MSR_IA32_RTIT_ADDR0_A + i * 2, ctx->addr_a[i]); + wrmsrl(MSR_IA32_RTIT_ADDR0_B + i * 2, ctx->addr_b[i]); + } +} + +static inline void pt_save_msr(struct pt_ctx *ctx, u32 addr_range) +{ + u32 i; + + rdmsrl(MSR_IA32_RTIT_STATUS, ctx->status); + rdmsrl(MSR_IA32_RTIT_OUTPUT_BASE, ctx->output_base); + rdmsrl(MSR_IA32_RTIT_OUTPUT_MASK, ctx->output_mask); + rdmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match); + for (i = 0; i < addr_range; i++) { + rdmsrl(MSR_IA32_RTIT_ADDR0_A + i * 2, ctx->addr_a[i]); + rdmsrl(MSR_IA32_RTIT_ADDR0_B + i * 2, ctx->addr_b[i]); + } +} + +static void pt_guest_enter(struct vcpu_vmx *vmx) +{ + if (pt_mode == PT_MODE_SYSTEM) + return; + + /* + * GUEST_IA32_RTIT_CTL is already set in the VMCS. + * Save host state before VM entry. + */ + rdmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl); + if (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) { + wrmsrl(MSR_IA32_RTIT_CTL, 0); + pt_save_msr(&vmx->pt_desc.host, vmx->pt_desc.addr_range); + pt_load_msr(&vmx->pt_desc.guest, vmx->pt_desc.addr_range); + } +} + +static void pt_guest_exit(struct vcpu_vmx *vmx) +{ + if (pt_mode == PT_MODE_SYSTEM) + return; + + if (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) { + pt_save_msr(&vmx->pt_desc.guest, vmx->pt_desc.addr_range); + pt_load_msr(&vmx->pt_desc.host, vmx->pt_desc.addr_range); + } + + /* Reload host state (IA32_RTIT_CTL will be cleared on VM exit). */ + wrmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl); +} + +void vmx_set_host_fs_gs(struct vmcs_host_state *host, u16 fs_sel, u16 gs_sel, + unsigned long fs_base, unsigned long gs_base) +{ + if (unlikely(fs_sel != host->fs_sel)) { + if (!(fs_sel & 7)) + vmcs_write16(HOST_FS_SELECTOR, fs_sel); + else + vmcs_write16(HOST_FS_SELECTOR, 0); + host->fs_sel = fs_sel; + } + if (unlikely(gs_sel != host->gs_sel)) { + if (!(gs_sel & 7)) + vmcs_write16(HOST_GS_SELECTOR, gs_sel); + else + vmcs_write16(HOST_GS_SELECTOR, 0); + host->gs_sel = gs_sel; + } + if (unlikely(fs_base != host->fs_base)) { + vmcs_writel(HOST_FS_BASE, fs_base); + host->fs_base = fs_base; + } + if (unlikely(gs_base != host->gs_base)) { + vmcs_writel(HOST_GS_BASE, gs_base); + host->gs_base = gs_base; + } +} + +void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct vmcs_host_state *host_state; +#ifdef CONFIG_X86_64 + int cpu = raw_smp_processor_id(); +#endif + unsigned long fs_base, gs_base; + u16 fs_sel, gs_sel; + int i; + + vmx->req_immediate_exit = false; + + /* + * Note that guest MSRs to be saved/restored can also be changed + * when guest state is loaded. This happens when guest transitions + * to/from long-mode by setting MSR_EFER.LMA. + */ + if (!vmx->guest_msrs_ready) { + vmx->guest_msrs_ready = true; + for (i = 0; i < vmx->save_nmsrs; ++i) + kvm_set_shared_msr(vmx->guest_msrs[i].index, + vmx->guest_msrs[i].data, + vmx->guest_msrs[i].mask); + + } + if (vmx->guest_state_loaded) + return; + + host_state = &vmx->loaded_vmcs->host_state; + + /* + * Set host fs and gs selectors. Unfortunately, 22.2.3 does not + * allow segment selectors with cpl > 0 or ti == 1. + */ + host_state->ldt_sel = kvm_read_ldt(); + +#ifdef CONFIG_X86_64 + savesegment(ds, host_state->ds_sel); + savesegment(es, host_state->es_sel); + + gs_base = cpu_kernelmode_gs_base(cpu); + if (likely(is_64bit_mm(current->mm))) { + save_fsgs_for_kvm(); + fs_sel = current->thread.fsindex; + gs_sel = current->thread.gsindex; + fs_base = current->thread.fsbase; + vmx->msr_host_kernel_gs_base = current->thread.gsbase; + } else { + savesegment(fs, fs_sel); + savesegment(gs, gs_sel); + fs_base = read_msr(MSR_FS_BASE); + vmx->msr_host_kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE); + } + + wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base); +#else + savesegment(fs, fs_sel); + savesegment(gs, gs_sel); + fs_base = segment_base(fs_sel); + gs_base = segment_base(gs_sel); +#endif + + vmx_set_host_fs_gs(host_state, fs_sel, gs_sel, fs_base, gs_base); + vmx->guest_state_loaded = true; +} + +static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx) +{ + struct vmcs_host_state *host_state; + + if (!vmx->guest_state_loaded) + return; + + host_state = &vmx->loaded_vmcs->host_state; + + ++vmx->vcpu.stat.host_state_reload; + +#ifdef CONFIG_X86_64 + rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base); +#endif + if (host_state->ldt_sel || (host_state->gs_sel & 7)) { + kvm_load_ldt(host_state->ldt_sel); +#ifdef CONFIG_X86_64 + load_gs_index(host_state->gs_sel); +#else + loadsegment(gs, host_state->gs_sel); +#endif + } + if (host_state->fs_sel & 7) + loadsegment(fs, host_state->fs_sel); +#ifdef CONFIG_X86_64 + if (unlikely(host_state->ds_sel | host_state->es_sel)) { + loadsegment(ds, host_state->ds_sel); + loadsegment(es, host_state->es_sel); + } +#endif + invalidate_tss_limit(); +#ifdef CONFIG_X86_64 + wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base); +#endif + load_fixmap_gdt(raw_smp_processor_id()); + vmx->guest_state_loaded = false; + vmx->guest_msrs_ready = false; +} + +#ifdef CONFIG_X86_64 +static u64 vmx_read_guest_kernel_gs_base(struct vcpu_vmx *vmx) +{ + preempt_disable(); + if (vmx->guest_state_loaded) + rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base); + preempt_enable(); + return vmx->msr_guest_kernel_gs_base; +} + +static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data) +{ + preempt_disable(); + if (vmx->guest_state_loaded) + wrmsrl(MSR_KERNEL_GS_BASE, data); + preempt_enable(); + vmx->msr_guest_kernel_gs_base = data; +} +#endif + +static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu) +{ + struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu); + struct pi_desc old, new; + unsigned int dest; + + /* + * In case of hot-plug or hot-unplug, we may have to undo + * vmx_vcpu_pi_put even if there is no assigned device. And we + * always keep PI.NDST up to date for simplicity: it makes the + * code easier, and CPU migration is not a fast path. + */ + if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu) + return; + + /* + * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change + * PI.NDST: pi_post_block is the one expected to change PID.NDST and the + * wakeup handler expects the vCPU to be on the blocked_vcpu_list that + * matches PI.NDST. Otherwise, a vcpu may not be able to be woken up + * correctly. + */ + if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR || vcpu->cpu == cpu) { + pi_clear_sn(pi_desc); + goto after_clear_sn; + } + + /* The full case. */ + do { + old.control = new.control = pi_desc->control; + + dest = cpu_physical_id(cpu); + + if (x2apic_enabled()) + new.ndst = dest; + else + new.ndst = (dest << 8) & 0xFF00; + + new.sn = 0; + } while (cmpxchg64(&pi_desc->control, old.control, + new.control) != old.control); + +after_clear_sn: + + /* + * Clear SN before reading the bitmap. The VT-d firmware + * writes the bitmap and reads SN atomically (5.2.3 in the + * spec), so it doesn't really have a memory barrier that + * pairs with this, but we cannot do that and we need one. + */ + smp_mb__after_atomic(); + + if (!pi_is_pir_empty(pi_desc)) + pi_set_on(pi_desc); +} + +void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + bool already_loaded = vmx->loaded_vmcs->cpu == cpu; + + if (!already_loaded) { + loaded_vmcs_clear(vmx->loaded_vmcs); + local_irq_disable(); + crash_disable_local_vmclear(cpu); + + /* + * Read loaded_vmcs->cpu should be before fetching + * loaded_vmcs->loaded_vmcss_on_cpu_link. + * See the comments in __loaded_vmcs_clear(). + */ + smp_rmb(); + + list_add(&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link, + &per_cpu(loaded_vmcss_on_cpu, cpu)); + crash_enable_local_vmclear(cpu); + local_irq_enable(); + } + + if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) { + per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs; + vmcs_load(vmx->loaded_vmcs->vmcs); + indirect_branch_prediction_barrier(); + } + + if (!already_loaded) { + void *gdt = get_current_gdt_ro(); + unsigned long sysenter_esp; + + kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); + + /* + * Linux uses per-cpu TSS and GDT, so set these when switching + * processors. See 22.2.4. + */ + vmcs_writel(HOST_TR_BASE, + (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss); + vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */ + + rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp); + vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */ + + vmx->loaded_vmcs->cpu = cpu; + } + + /* Setup TSC multiplier */ + if (kvm_has_tsc_control && + vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio) + decache_tsc_multiplier(vmx); +} + +/* + * Switches to specified vcpu, until a matching vcpu_put(), but assumes + * vcpu mutex is already taken. + */ +void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + + vmx_vcpu_load_vmcs(vcpu, cpu); + + vmx_vcpu_pi_load(vcpu, cpu); + + vmx->host_pkru = read_pkru(); + vmx->host_debugctlmsr = get_debugctlmsr(); +} + +static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu) +{ + struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu); + + if (!kvm_arch_has_assigned_device(vcpu->kvm) || + !irq_remapping_cap(IRQ_POSTING_CAP) || + !kvm_vcpu_apicv_active(vcpu)) + return; + + /* Set SN when the vCPU is preempted */ + if (vcpu->preempted) + pi_set_sn(pi_desc); +} + +static void vmx_vcpu_put(struct kvm_vcpu *vcpu) +{ + vmx_vcpu_pi_put(vcpu); + + vmx_prepare_switch_to_host(to_vmx(vcpu)); +} + +static bool emulation_required(struct kvm_vcpu *vcpu) +{ + return emulate_invalid_guest_state && !guest_state_valid(vcpu); +} + +static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu); + +unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + unsigned long rflags, save_rflags; + + if (!kvm_register_is_available(vcpu, VCPU_EXREG_RFLAGS)) { + kvm_register_mark_available(vcpu, VCPU_EXREG_RFLAGS); + rflags = vmcs_readl(GUEST_RFLAGS); + if (vmx->rmode.vm86_active) { + rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS; + save_rflags = vmx->rmode.save_rflags; + rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS; + } + vmx->rflags = rflags; + } + return vmx->rflags; +} + +void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + unsigned long old_rflags; + + if (enable_unrestricted_guest) { + kvm_register_mark_available(vcpu, VCPU_EXREG_RFLAGS); + vmx->rflags = rflags; + vmcs_writel(GUEST_RFLAGS, rflags); + return; + } + + old_rflags = vmx_get_rflags(vcpu); + vmx->rflags = rflags; + if (vmx->rmode.vm86_active) { + vmx->rmode.save_rflags = rflags; + rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM; + } + vmcs_writel(GUEST_RFLAGS, rflags); + + if ((old_rflags ^ vmx->rflags) & X86_EFLAGS_VM) + vmx->emulation_required = emulation_required(vcpu); +} + +u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu) +{ + u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO); + int ret = 0; + + if (interruptibility & GUEST_INTR_STATE_STI) + ret |= KVM_X86_SHADOW_INT_STI; + if (interruptibility & GUEST_INTR_STATE_MOV_SS) + ret |= KVM_X86_SHADOW_INT_MOV_SS; + + return ret; +} + +void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask) +{ + u32 interruptibility_old = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO); + u32 interruptibility = interruptibility_old; + + interruptibility &= ~(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS); + + if (mask & KVM_X86_SHADOW_INT_MOV_SS) + interruptibility |= GUEST_INTR_STATE_MOV_SS; + else if (mask & KVM_X86_SHADOW_INT_STI) + interruptibility |= GUEST_INTR_STATE_STI; + + if ((interruptibility != interruptibility_old)) + vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, interruptibility); +} + +static int vmx_rtit_ctl_check(struct kvm_vcpu *vcpu, u64 data) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + unsigned long value; + + /* + * Any MSR write that attempts to change bits marked reserved will + * case a #GP fault. + */ + if (data & vmx->pt_desc.ctl_bitmask) + return 1; + + /* + * Any attempt to modify IA32_RTIT_CTL while TraceEn is set will + * result in a #GP unless the same write also clears TraceEn. + */ + if ((vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) && + ((vmx->pt_desc.guest.ctl ^ data) & ~RTIT_CTL_TRACEEN)) + return 1; + + /* + * WRMSR to IA32_RTIT_CTL that sets TraceEn but clears this bit + * and FabricEn would cause #GP, if + * CPUID.(EAX=14H, ECX=0):ECX.SNGLRGNOUT[bit 2] = 0 + */ + if ((data & RTIT_CTL_TRACEEN) && !(data & RTIT_CTL_TOPA) && + !(data & RTIT_CTL_FABRIC_EN) && + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_single_range_output)) + return 1; + + /* + * MTCFreq, CycThresh and PSBFreq encodings check, any MSR write that + * utilize encodings marked reserved will casue a #GP fault. + */ + value = intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc_periods); + if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc) && + !test_bit((data & RTIT_CTL_MTC_RANGE) >> + RTIT_CTL_MTC_RANGE_OFFSET, &value)) + return 1; + value = intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_cycle_thresholds); + if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc) && + !test_bit((data & RTIT_CTL_CYC_THRESH) >> + RTIT_CTL_CYC_THRESH_OFFSET, &value)) + return 1; + value = intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_periods); + if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc) && + !test_bit((data & RTIT_CTL_PSB_FREQ) >> + RTIT_CTL_PSB_FREQ_OFFSET, &value)) + return 1; + + /* + * If ADDRx_CFG is reserved or the encodings is >2 will + * cause a #GP fault. + */ + value = (data & RTIT_CTL_ADDR0) >> RTIT_CTL_ADDR0_OFFSET; + if ((value && (vmx->pt_desc.addr_range < 1)) || (value > 2)) + return 1; + value = (data & RTIT_CTL_ADDR1) >> RTIT_CTL_ADDR1_OFFSET; + if ((value && (vmx->pt_desc.addr_range < 2)) || (value > 2)) + return 1; + value = (data & RTIT_CTL_ADDR2) >> RTIT_CTL_ADDR2_OFFSET; + if ((value && (vmx->pt_desc.addr_range < 3)) || (value > 2)) + return 1; + value = (data & RTIT_CTL_ADDR3) >> RTIT_CTL_ADDR3_OFFSET; + if ((value && (vmx->pt_desc.addr_range < 4)) || (value > 2)) + return 1; + + return 0; +} + +static int skip_emulated_instruction(struct kvm_vcpu *vcpu) +{ + unsigned long rip; + + /* + * Using VMCS.VM_EXIT_INSTRUCTION_LEN on EPT misconfig depends on + * undefined behavior: Intel's SDM doesn't mandate the VMCS field be + * set when EPT misconfig occurs. In practice, real hardware updates + * VM_EXIT_INSTRUCTION_LEN on EPT misconfig, but other hypervisors + * (namely Hyper-V) don't set it due to it being undefined behavior, + * i.e. we end up advancing IP with some random value. + */ + if (!static_cpu_has(X86_FEATURE_HYPERVISOR) || + to_vmx(vcpu)->exit_reason != EXIT_REASON_EPT_MISCONFIG) { + rip = kvm_rip_read(vcpu); + rip += vmcs_read32(VM_EXIT_INSTRUCTION_LEN); + kvm_rip_write(vcpu, rip); + } else { + if (!kvm_emulate_instruction(vcpu, EMULTYPE_SKIP)) + return 0; + } + + /* skipping an emulated instruction also counts */ + vmx_set_interrupt_shadow(vcpu, 0); + + return 1; +} + +static void vmx_clear_hlt(struct kvm_vcpu *vcpu) +{ + /* + * Ensure that we clear the HLT state in the VMCS. We don't need to + * explicitly skip the instruction because if the HLT state is set, + * then the instruction is already executing and RIP has already been + * advanced. + */ + if (kvm_hlt_in_guest(vcpu->kvm) && + vmcs_read32(GUEST_ACTIVITY_STATE) == GUEST_ACTIVITY_HLT) + vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE); +} + +static void vmx_queue_exception(struct kvm_vcpu *vcpu) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + unsigned nr = vcpu->arch.exception.nr; + bool has_error_code = vcpu->arch.exception.has_error_code; + u32 error_code = vcpu->arch.exception.error_code; + u32 intr_info = nr | INTR_INFO_VALID_MASK; + + kvm_deliver_exception_payload(vcpu); + + if (has_error_code) { + vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code); + intr_info |= INTR_INFO_DELIVER_CODE_MASK; + } + + if (vmx->rmode.vm86_active) { + int inc_eip = 0; + if (kvm_exception_is_soft(nr)) + inc_eip = vcpu->arch.event_exit_inst_len; + kvm_inject_realmode_interrupt(vcpu, nr, inc_eip); + return; + } + + WARN_ON_ONCE(vmx->emulation_required); + + if (kvm_exception_is_soft(nr)) { + vmcs_write32(VM_ENTRY_INSTRUCTION_LEN, + vmx->vcpu.arch.event_exit_inst_len); + intr_info |= INTR_TYPE_SOFT_EXCEPTION; + } else + intr_info |= INTR_TYPE_HARD_EXCEPTION; + + vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr_info); + + vmx_clear_hlt(vcpu); +} + +static bool vmx_rdtscp_supported(void) +{ + return cpu_has_vmx_rdtscp(); +} + +static bool vmx_invpcid_supported(void) +{ + return cpu_has_vmx_invpcid(); +} + +/* + * Swap MSR entry in host/guest MSR entry array. + */ +static void move_msr_up(struct vcpu_vmx *vmx, int from, int to) +{ + struct shared_msr_entry tmp; + + tmp = vmx->guest_msrs[to]; + vmx->guest_msrs[to] = vmx->guest_msrs[from]; + vmx->guest_msrs[from] = tmp; +} + +/* + * Set up the vmcs to automatically save and restore system + * msrs. Don't touch the 64-bit msrs if the guest is in legacy + * mode, as fiddling with msrs is very expensive. + */ +static void setup_msrs(struct vcpu_vmx *vmx) +{ + int save_nmsrs, index; + + save_nmsrs = 0; +#ifdef CONFIG_X86_64 + /* + * The SYSCALL MSRs are only needed on long mode guests, and only + * when EFER.SCE is set. + */ + if (is_long_mode(&vmx->vcpu) && (vmx->vcpu.arch.efer & EFER_SCE)) { + index = __find_msr_index(vmx, MSR_STAR); + if (index >= 0) + move_msr_up(vmx, index, save_nmsrs++); + index = __find_msr_index(vmx, MSR_LSTAR); + if (index >= 0) + move_msr_up(vmx, index, save_nmsrs++); + index = __find_msr_index(vmx, MSR_SYSCALL_MASK); + if (index >= 0) + move_msr_up(vmx, index, save_nmsrs++); + } +#endif + index = __find_msr_index(vmx, MSR_EFER); + if (index >= 0 && update_transition_efer(vmx, index)) + move_msr_up(vmx, index, save_nmsrs++); + index = __find_msr_index(vmx, MSR_TSC_AUX); + if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) + move_msr_up(vmx, index, save_nmsrs++); + index = __find_msr_index(vmx, MSR_IA32_TSX_CTRL); + if (index >= 0) + move_msr_up(vmx, index, save_nmsrs++); + + vmx->save_nmsrs = save_nmsrs; + vmx->guest_msrs_ready = false; + + if (cpu_has_vmx_msr_bitmap()) + vmx_update_msr_bitmap(&vmx->vcpu); +} + +static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu) +{ + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + + if (is_guest_mode(vcpu) && + (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING)) + return vcpu->arch.tsc_offset - vmcs12->tsc_offset; + + return vcpu->arch.tsc_offset; +} + +static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset) +{ + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + u64 g_tsc_offset = 0; + + /* + * We're here if L1 chose not to trap WRMSR to TSC. According + * to the spec, this should set L1's TSC; The offset that L1 + * set for L2 remains unchanged, and still needs to be added + * to the newly set TSC to get L2's TSC. + */ + if (is_guest_mode(vcpu) && + (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING)) + g_tsc_offset = vmcs12->tsc_offset; + + trace_kvm_write_tsc_offset(vcpu->vcpu_id, + vcpu->arch.tsc_offset - g_tsc_offset, + offset); + vmcs_write64(TSC_OFFSET, offset + g_tsc_offset); + return offset + g_tsc_offset; +} + +/* + * nested_vmx_allowed() checks whether a guest should be allowed to use VMX + * instructions and MSRs (i.e., nested VMX). Nested VMX is disabled for + * all guests if the "nested" module option is off, and can also be disabled + * for a single guest by disabling its VMX cpuid bit. + */ +bool nested_vmx_allowed(struct kvm_vcpu *vcpu) +{ + return nested && guest_cpuid_has(vcpu, X86_FEATURE_VMX); +} + +static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu, + uint64_t val) +{ + uint64_t valid_bits = to_vmx(vcpu)->msr_ia32_feature_control_valid_bits; + + return !(val & ~valid_bits); +} + +static int vmx_get_msr_feature(struct kvm_msr_entry *msr) +{ + switch (msr->index) { + case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC: + if (!nested) + return 1; + return vmx_get_vmx_msr(&vmcs_config.nested, msr->index, &msr->data); + default: + return 1; + } +} + +/* + * Reads an msr value (of 'msr_index') into 'pdata'. + * Returns 0 on success, non-0 otherwise. + * Assumes vcpu_load() was already called. + */ +static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct shared_msr_entry *msr; + u32 index; + + switch (msr_info->index) { +#ifdef CONFIG_X86_64 + case MSR_FS_BASE: + msr_info->data = vmcs_readl(GUEST_FS_BASE); + break; + case MSR_GS_BASE: + msr_info->data = vmcs_readl(GUEST_GS_BASE); + break; + case MSR_KERNEL_GS_BASE: + msr_info->data = vmx_read_guest_kernel_gs_base(vmx); + break; +#endif + case MSR_EFER: + return kvm_get_msr_common(vcpu, msr_info); + case MSR_IA32_TSX_CTRL: + if (!msr_info->host_initiated && + !(vcpu->arch.arch_capabilities & ARCH_CAP_TSX_CTRL_MSR)) + return 1; + goto find_shared_msr; + case MSR_IA32_UMWAIT_CONTROL: + if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx)) + return 1; + + msr_info->data = vmx->msr_ia32_umwait_control; + break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) + return 1; + + msr_info->data = to_vmx(vcpu)->spec_ctrl; + break; + case MSR_IA32_SYSENTER_CS: + msr_info->data = vmcs_read32(GUEST_SYSENTER_CS); + break; + case MSR_IA32_SYSENTER_EIP: + msr_info->data = vmcs_readl(GUEST_SYSENTER_EIP); + break; + case MSR_IA32_SYSENTER_ESP: + msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP); + break; + case MSR_IA32_BNDCFGS: + if (!kvm_mpx_supported() || + (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_MPX))) + return 1; + msr_info->data = vmcs_read64(GUEST_BNDCFGS); + break; + case MSR_IA32_MCG_EXT_CTL: + if (!msr_info->host_initiated && + !(vmx->msr_ia32_feature_control & + FEATURE_CONTROL_LMCE)) + return 1; + msr_info->data = vcpu->arch.mcg_ext_ctl; + break; + case MSR_IA32_FEATURE_CONTROL: + msr_info->data = vmx->msr_ia32_feature_control; + break; + case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC: + if (!nested_vmx_allowed(vcpu)) + return 1; + return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index, + &msr_info->data); + case MSR_IA32_RTIT_CTL: + if (pt_mode != PT_MODE_HOST_GUEST) + return 1; + msr_info->data = vmx->pt_desc.guest.ctl; + break; + case MSR_IA32_RTIT_STATUS: + if (pt_mode != PT_MODE_HOST_GUEST) + return 1; + msr_info->data = vmx->pt_desc.guest.status; + break; + case MSR_IA32_RTIT_CR3_MATCH: + if ((pt_mode != PT_MODE_HOST_GUEST) || + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_cr3_filtering)) + return 1; + msr_info->data = vmx->pt_desc.guest.cr3_match; + break; + case MSR_IA32_RTIT_OUTPUT_BASE: + if ((pt_mode != PT_MODE_HOST_GUEST) || + (!intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_topa_output) && + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_single_range_output))) + return 1; + msr_info->data = vmx->pt_desc.guest.output_base; + break; + case MSR_IA32_RTIT_OUTPUT_MASK: + if ((pt_mode != PT_MODE_HOST_GUEST) || + (!intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_topa_output) && + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_single_range_output))) + return 1; + msr_info->data = vmx->pt_desc.guest.output_mask; + break; + case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B: + index = msr_info->index - MSR_IA32_RTIT_ADDR0_A; + if ((pt_mode != PT_MODE_HOST_GUEST) || + (index >= 2 * intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_num_address_ranges))) + return 1; + if (is_noncanonical_address(data, vcpu)) + return 1; + if (index % 2) + msr_info->data = vmx->pt_desc.guest.addr_b[index / 2]; + else + msr_info->data = vmx->pt_desc.guest.addr_a[index / 2]; + break; + case MSR_TSC_AUX: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP)) + return 1; + goto find_shared_msr; + default: + find_shared_msr: + msr = find_msr_entry(vmx, msr_info->index); + if (msr) { + msr_info->data = msr->data; + break; + } + return kvm_get_msr_common(vcpu, msr_info); + } + + return 0; +} + +/* + * Writes msr value into the appropriate "register". + * Returns 0 on success, non-0 otherwise. + * Assumes vcpu_load() was already called. + */ +static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct shared_msr_entry *msr; + int ret = 0; + u32 msr_index = msr_info->index; + u64 data = msr_info->data; + u32 index; + + switch (msr_index) { + case MSR_EFER: + ret = kvm_set_msr_common(vcpu, msr_info); + break; +#ifdef CONFIG_X86_64 + case MSR_FS_BASE: + vmx_segment_cache_clear(vmx); + vmcs_writel(GUEST_FS_BASE, data); + break; + case MSR_GS_BASE: + vmx_segment_cache_clear(vmx); + vmcs_writel(GUEST_GS_BASE, data); + break; + case MSR_KERNEL_GS_BASE: + vmx_write_guest_kernel_gs_base(vmx, data); + break; +#endif + case MSR_IA32_SYSENTER_CS: + if (is_guest_mode(vcpu)) + get_vmcs12(vcpu)->guest_sysenter_cs = data; + vmcs_write32(GUEST_SYSENTER_CS, data); + break; + case MSR_IA32_SYSENTER_EIP: + if (is_guest_mode(vcpu)) + get_vmcs12(vcpu)->guest_sysenter_eip = data; + vmcs_writel(GUEST_SYSENTER_EIP, data); + break; + case MSR_IA32_SYSENTER_ESP: + if (is_guest_mode(vcpu)) + get_vmcs12(vcpu)->guest_sysenter_esp = data; + vmcs_writel(GUEST_SYSENTER_ESP, data); + break; + case MSR_IA32_DEBUGCTLMSR: + if (is_guest_mode(vcpu) && get_vmcs12(vcpu)->vm_exit_controls & + VM_EXIT_SAVE_DEBUG_CONTROLS) + get_vmcs12(vcpu)->guest_ia32_debugctl = data; + + ret = kvm_set_msr_common(vcpu, msr_info); + break; + + case MSR_IA32_BNDCFGS: + if (!kvm_mpx_supported() || + (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_MPX))) + return 1; + if (is_noncanonical_address(data & PAGE_MASK, vcpu) || + (data & MSR_IA32_BNDCFGS_RSVD)) + return 1; + vmcs_write64(GUEST_BNDCFGS, data); + break; + case MSR_IA32_UMWAIT_CONTROL: + if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx)) + return 1; + + /* The reserved bit 1 and non-32 bit [63:32] should be zero */ + if (data & (BIT_ULL(1) | GENMASK_ULL(63, 32))) + return 1; + + vmx->msr_ia32_umwait_control = data; + break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) + return 1; + + /* The STIBP bit doesn't fault even if it's not advertised */ + if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD)) + return 1; + + vmx->spec_ctrl = data; + + if (!data) + break; + + /* + * For non-nested: + * When it's written (to non-zero) for the first time, pass + * it through. + * + * For nested: + * The handling of the MSR bitmap for L2 guests is done in + * nested_vmx_prepare_msr_bitmap. We should not touch the + * vmcs02.msr_bitmap here since it gets completely overwritten + * in the merging. We update the vmcs01 here for L1 as well + * since it will end up touching the MSR anyway now. + */ + vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, + MSR_IA32_SPEC_CTRL, + MSR_TYPE_RW); + break; + case MSR_IA32_TSX_CTRL: + if (!msr_info->host_initiated && + !(vcpu->arch.arch_capabilities & ARCH_CAP_TSX_CTRL_MSR)) + return 1; + if (data & ~(TSX_CTRL_RTM_DISABLE | TSX_CTRL_CPUID_CLEAR)) + return 1; + goto find_shared_msr; + case MSR_IA32_PRED_CMD: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) + return 1; + + if (data & ~PRED_CMD_IBPB) + return 1; + + if (!data) + break; + + wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); + + /* + * For non-nested: + * When it's written (to non-zero) for the first time, pass + * it through. + * + * For nested: + * The handling of the MSR bitmap for L2 guests is done in + * nested_vmx_prepare_msr_bitmap. We should not touch the + * vmcs02.msr_bitmap here since it gets completely overwritten + * in the merging. + */ + vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, + MSR_TYPE_W); + break; + case MSR_IA32_CR_PAT: + if (!kvm_pat_valid(data)) + return 1; + + if (is_guest_mode(vcpu) && + get_vmcs12(vcpu)->vm_exit_controls & VM_EXIT_SAVE_IA32_PAT) + get_vmcs12(vcpu)->guest_ia32_pat = data; + + if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { + vmcs_write64(GUEST_IA32_PAT, data); + vcpu->arch.pat = data; + break; + } + ret = kvm_set_msr_common(vcpu, msr_info); + break; + case MSR_IA32_TSC_ADJUST: + ret = kvm_set_msr_common(vcpu, msr_info); + break; + case MSR_IA32_MCG_EXT_CTL: + if ((!msr_info->host_initiated && + !(to_vmx(vcpu)->msr_ia32_feature_control & + FEATURE_CONTROL_LMCE)) || + (data & ~MCG_EXT_CTL_LMCE_EN)) + return 1; + vcpu->arch.mcg_ext_ctl = data; + break; + case MSR_IA32_FEATURE_CONTROL: + if (!vmx_feature_control_msr_valid(vcpu, data) || + (to_vmx(vcpu)->msr_ia32_feature_control & + FEATURE_CONTROL_LOCKED && !msr_info->host_initiated)) + return 1; + vmx->msr_ia32_feature_control = data; + if (msr_info->host_initiated && data == 0) + vmx_leave_nested(vcpu); + break; + case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC: + if (!msr_info->host_initiated) + return 1; /* they are read-only */ + if (!nested_vmx_allowed(vcpu)) + return 1; + return vmx_set_vmx_msr(vcpu, msr_index, data); + case MSR_IA32_RTIT_CTL: + if ((pt_mode != PT_MODE_HOST_GUEST) || + vmx_rtit_ctl_check(vcpu, data) || + vmx->nested.vmxon) + return 1; + vmcs_write64(GUEST_IA32_RTIT_CTL, data); + vmx->pt_desc.guest.ctl = data; + pt_update_intercept_for_msr(vmx); + break; + case MSR_IA32_RTIT_STATUS: + if ((pt_mode != PT_MODE_HOST_GUEST) || + (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) || + (data & MSR_IA32_RTIT_STATUS_MASK)) + return 1; + vmx->pt_desc.guest.status = data; + break; + case MSR_IA32_RTIT_CR3_MATCH: + if ((pt_mode != PT_MODE_HOST_GUEST) || + (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) || + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_cr3_filtering)) + return 1; + vmx->pt_desc.guest.cr3_match = data; + break; + case MSR_IA32_RTIT_OUTPUT_BASE: + if ((pt_mode != PT_MODE_HOST_GUEST) || + (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) || + (!intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_topa_output) && + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_single_range_output)) || + (data & MSR_IA32_RTIT_OUTPUT_BASE_MASK)) + return 1; + vmx->pt_desc.guest.output_base = data; + break; + case MSR_IA32_RTIT_OUTPUT_MASK: + if ((pt_mode != PT_MODE_HOST_GUEST) || + (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) || + (!intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_topa_output) && + !intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_single_range_output))) + return 1; + vmx->pt_desc.guest.output_mask = data; + break; + case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B: + index = msr_info->index - MSR_IA32_RTIT_ADDR0_A; + if ((pt_mode != PT_MODE_HOST_GUEST) || + (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) || + (index >= 2 * intel_pt_validate_cap(vmx->pt_desc.caps, + PT_CAP_num_address_ranges))) + return 1; + if (is_noncanonical_address(data, vcpu)) + return 1; + if (index % 2) + vmx->pt_desc.guest.addr_b[index / 2] = data; + else + vmx->pt_desc.guest.addr_a[index / 2] = data; + break; + case MSR_TSC_AUX: + if (!msr_info->host_initiated && + !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP)) + return 1; + /* Check reserved bit, higher 32 bits should be zero */ + if ((data >> 32) != 0) + return 1; + goto find_shared_msr; + + default: + find_shared_msr: + msr = find_msr_entry(vmx, msr_index); + if (msr) + ret = vmx_set_guest_msr(vmx, msr, data); + else + ret = kvm_set_msr_common(vcpu, msr_info); + } + + return ret; +} + +static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg) +{ + kvm_register_mark_available(vcpu, reg); + + switch (reg) { + case VCPU_REGS_RSP: + vcpu->arch.regs[VCPU_REGS_RSP] = vmcs_readl(GUEST_RSP); + break; + case VCPU_REGS_RIP: + vcpu->arch.regs[VCPU_REGS_RIP] = vmcs_readl(GUEST_RIP); + break; + case VCPU_EXREG_PDPTR: + if (enable_ept) + ept_save_pdptrs(vcpu); + break; + case VCPU_EXREG_CR3: + if (enable_unrestricted_guest || (enable_ept && is_paging(vcpu))) + vcpu->arch.cr3 = vmcs_readl(GUEST_CR3); + break; + default: + WARN_ON_ONCE(1); + break; + } +} + +static __init int cpu_has_kvm_support(void) +{ + return cpu_has_vmx(); +} + +static __init int vmx_disabled_by_bios(void) +{ + u64 msr; + + rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); + if (msr & FEATURE_CONTROL_LOCKED) { + /* launched w/ TXT and VMX disabled */ + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX) + && tboot_enabled()) + return 1; + /* launched w/o TXT and VMX only enabled w/ TXT */ + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) + && (msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX) + && !tboot_enabled()) { + printk(KERN_WARNING "kvm: disable TXT in the BIOS or " + "activate TXT before enabling KVM\n"); + return 1; + } + /* launched w/o TXT and VMX disabled */ + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) + && !tboot_enabled()) + return 1; + } + + return 0; +} + +static void kvm_cpu_vmxon(u64 addr) +{ + cr4_set_bits(X86_CR4_VMXE); + intel_pt_handle_vmx(1); + + asm volatile ("vmxon %0" : : "m"(addr)); +} + +static int hardware_enable(void) +{ + int cpu = raw_smp_processor_id(); + u64 phys_addr = __pa(per_cpu(vmxarea, cpu)); + u64 old, test_bits; + + if (cr4_read_shadow() & X86_CR4_VMXE) + return -EBUSY; + + /* + * This can happen if we hot-added a CPU but failed to allocate + * VP assist page for it. + */ + if (static_branch_unlikely(&enable_evmcs) && + !hv_get_vp_assist_page(cpu)) + return -EFAULT; + + INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu)); + INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu)); + spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu)); + + /* + * Now we can enable the vmclear operation in kdump + * since the loaded_vmcss_on_cpu list on this cpu + * has been initialized. + * + * Though the cpu is not in VMX operation now, there + * is no problem to enable the vmclear operation + * for the loaded_vmcss_on_cpu list is empty! + */ + crash_enable_local_vmclear(cpu); + + rdmsrl(MSR_IA32_FEATURE_CONTROL, old); + + test_bits = FEATURE_CONTROL_LOCKED; + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; + if (tboot_enabled()) + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX; + + if ((old & test_bits) != test_bits) { + /* enable and lock */ + wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits); + } + kvm_cpu_vmxon(phys_addr); + if (enable_ept) + ept_sync_global(); + + return 0; +} + +static void vmclear_local_loaded_vmcss(void) +{ + int cpu = raw_smp_processor_id(); + struct loaded_vmcs *v, *n; + + list_for_each_entry_safe(v, n, &per_cpu(loaded_vmcss_on_cpu, cpu), + loaded_vmcss_on_cpu_link) + __loaded_vmcs_clear(v); +} + + +/* Just like cpu_vmxoff(), but with the __kvm_handle_fault_on_reboot() + * tricks. + */ +static void kvm_cpu_vmxoff(void) +{ + asm volatile (__ex("vmxoff")); + + intel_pt_handle_vmx(0); + cr4_clear_bits(X86_CR4_VMXE); +} + +static void hardware_disable(void) +{ + vmclear_local_loaded_vmcss(); + kvm_cpu_vmxoff(); +} + +static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt, + u32 msr, u32 *result) +{ + u32 vmx_msr_low, vmx_msr_high; + u32 ctl = ctl_min | ctl_opt; + + rdmsr(msr, vmx_msr_low, vmx_msr_high); + + ctl &= vmx_msr_high; /* bit == 0 in high word ==> must be zero */ + ctl |= vmx_msr_low; /* bit == 1 in low word ==> must be one */ + + /* Ensure minimum (required) set of control bits are supported. */ + if (ctl_min & ~ctl) + return -EIO; + + *result = ctl; + return 0; +} + +static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf, + struct vmx_capability *vmx_cap) +{ + u32 vmx_msr_low, vmx_msr_high; + u32 min, opt, min2, opt2; + u32 _pin_based_exec_control = 0; + u32 _cpu_based_exec_control = 0; + u32 _cpu_based_2nd_exec_control = 0; + u32 _vmexit_control = 0; + u32 _vmentry_control = 0; + + memset(vmcs_conf, 0, sizeof(*vmcs_conf)); + min = CPU_BASED_HLT_EXITING | +#ifdef CONFIG_X86_64 + CPU_BASED_CR8_LOAD_EXITING | + CPU_BASED_CR8_STORE_EXITING | +#endif + CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING | + CPU_BASED_UNCOND_IO_EXITING | + CPU_BASED_MOV_DR_EXITING | + CPU_BASED_USE_TSC_OFFSETTING | + CPU_BASED_MWAIT_EXITING | + CPU_BASED_MONITOR_EXITING | + CPU_BASED_INVLPG_EXITING | + CPU_BASED_RDPMC_EXITING; + + opt = CPU_BASED_TPR_SHADOW | + CPU_BASED_USE_MSR_BITMAPS | + CPU_BASED_ACTIVATE_SECONDARY_CONTROLS; + if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS, + &_cpu_based_exec_control) < 0) + return -EIO; +#ifdef CONFIG_X86_64 + if ((_cpu_based_exec_control & CPU_BASED_TPR_SHADOW)) + _cpu_based_exec_control &= ~CPU_BASED_CR8_LOAD_EXITING & + ~CPU_BASED_CR8_STORE_EXITING; +#endif + if (_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) { + min2 = 0; + opt2 = SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES | + SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE | + SECONDARY_EXEC_WBINVD_EXITING | + SECONDARY_EXEC_ENABLE_VPID | + SECONDARY_EXEC_ENABLE_EPT | + SECONDARY_EXEC_UNRESTRICTED_GUEST | + SECONDARY_EXEC_PAUSE_LOOP_EXITING | + SECONDARY_EXEC_DESC | + SECONDARY_EXEC_RDTSCP | + SECONDARY_EXEC_ENABLE_INVPCID | + SECONDARY_EXEC_APIC_REGISTER_VIRT | + SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY | + SECONDARY_EXEC_SHADOW_VMCS | + SECONDARY_EXEC_XSAVES | + SECONDARY_EXEC_RDSEED_EXITING | + SECONDARY_EXEC_RDRAND_EXITING | + SECONDARY_EXEC_ENABLE_PML | + SECONDARY_EXEC_TSC_SCALING | + SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE | + SECONDARY_EXEC_PT_USE_GPA | + SECONDARY_EXEC_PT_CONCEAL_VMX | + SECONDARY_EXEC_ENABLE_VMFUNC | + SECONDARY_EXEC_ENCLS_EXITING; + if (adjust_vmx_controls(min2, opt2, + MSR_IA32_VMX_PROCBASED_CTLS2, + &_cpu_based_2nd_exec_control) < 0) + return -EIO; + } +#ifndef CONFIG_X86_64 + if (!(_cpu_based_2nd_exec_control & + SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) + _cpu_based_exec_control &= ~CPU_BASED_TPR_SHADOW; +#endif + + if (!(_cpu_based_exec_control & CPU_BASED_TPR_SHADOW)) + _cpu_based_2nd_exec_control &= ~( + SECONDARY_EXEC_APIC_REGISTER_VIRT | + SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE | + SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY); + + rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP, + &vmx_cap->ept, &vmx_cap->vpid); + + if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) { + /* CR3 accesses and invlpg don't need to cause VM Exits when EPT + enabled */ + _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING | + CPU_BASED_INVLPG_EXITING); + } else if (vmx_cap->ept) { + vmx_cap->ept = 0; + pr_warn_once("EPT CAP should not exist if not support " + "1-setting enable EPT VM-execution control\n"); + } + if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) && + vmx_cap->vpid) { + vmx_cap->vpid = 0; + pr_warn_once("VPID CAP should not exist if not support " + "1-setting enable VPID VM-execution control\n"); + } + + min = VM_EXIT_SAVE_DEBUG_CONTROLS | VM_EXIT_ACK_INTR_ON_EXIT; +#ifdef CONFIG_X86_64 + min |= VM_EXIT_HOST_ADDR_SPACE_SIZE; +#endif + opt = VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL | + VM_EXIT_LOAD_IA32_PAT | + VM_EXIT_LOAD_IA32_EFER | + VM_EXIT_CLEAR_BNDCFGS | + VM_EXIT_PT_CONCEAL_PIP | + VM_EXIT_CLEAR_IA32_RTIT_CTL; + if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS, + &_vmexit_control) < 0) + return -EIO; + + min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING; + opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR | + PIN_BASED_VMX_PREEMPTION_TIMER; + if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS, + &_pin_based_exec_control) < 0) + return -EIO; + + if (cpu_has_broken_vmx_preemption_timer()) + _pin_based_exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER; + if (!(_cpu_based_2nd_exec_control & + SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)) + _pin_based_exec_control &= ~PIN_BASED_POSTED_INTR; + + min = VM_ENTRY_LOAD_DEBUG_CONTROLS; + opt = VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | + VM_ENTRY_LOAD_IA32_PAT | + VM_ENTRY_LOAD_IA32_EFER | + VM_ENTRY_LOAD_BNDCFGS | + VM_ENTRY_PT_CONCEAL_PIP | + VM_ENTRY_LOAD_IA32_RTIT_CTL; + if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS, + &_vmentry_control) < 0) + return -EIO; + + /* + * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they + * can't be used due to an errata where VM Exit may incorrectly clear + * IA32_PERF_GLOBAL_CTRL[34:32]. Workaround the errata by using the + * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL. + */ + if (boot_cpu_data.x86 == 0x6) { + switch (boot_cpu_data.x86_model) { + case 26: /* AAK155 */ + case 30: /* AAP115 */ + case 37: /* AAT100 */ + case 44: /* BC86,AAY89,BD102 */ + case 46: /* BA97 */ + _vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL; + _vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL; + pr_warn_once("kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL " + "does not work properly. Using workaround\n"); + break; + default: + break; + } + } + + + rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high); + + /* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */ + if ((vmx_msr_high & 0x1fff) > PAGE_SIZE) + return -EIO; + +#ifdef CONFIG_X86_64 + /* IA-32 SDM Vol 3B: 64-bit CPUs always have VMX_BASIC_MSR[48]==0. */ + if (vmx_msr_high & (1u<<16)) + return -EIO; +#endif + + /* Require Write-Back (WB) memory type for VMCS accesses. */ + if (((vmx_msr_high >> 18) & 15) != 6) + return -EIO; + + vmcs_conf->size = vmx_msr_high & 0x1fff; + vmcs_conf->order = get_order(vmcs_conf->size); + vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff; + + vmcs_conf->revision_id = vmx_msr_low; + + vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control; + vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control; + vmcs_conf->cpu_based_2nd_exec_ctrl = _cpu_based_2nd_exec_control; + vmcs_conf->vmexit_ctrl = _vmexit_control; + vmcs_conf->vmentry_ctrl = _vmentry_control; + + if (static_branch_unlikely(&enable_evmcs)) + evmcs_sanitize_exec_ctrls(vmcs_conf); + + return 0; +} + +struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags) +{ + int node = cpu_to_node(cpu); + struct page *pages; + struct vmcs *vmcs; + + pages = __alloc_pages_node(node, flags, vmcs_config.order); + if (!pages) + return NULL; + vmcs = page_address(pages); + memset(vmcs, 0, vmcs_config.size); + + /* KVM supports Enlightened VMCS v1 only */ + if (static_branch_unlikely(&enable_evmcs)) + vmcs->hdr.revision_id = KVM_EVMCS_VERSION; + else + vmcs->hdr.revision_id = vmcs_config.revision_id; + + if (shadow) + vmcs->hdr.shadow_vmcs = 1; + return vmcs; +} + +void free_vmcs(struct vmcs *vmcs) +{ + free_pages((unsigned long)vmcs, vmcs_config.order); +} + +/* + * Free a VMCS, but before that VMCLEAR it on the CPU where it was last loaded + */ +void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs) +{ + if (!loaded_vmcs->vmcs) + return; + loaded_vmcs_clear(loaded_vmcs); + free_vmcs(loaded_vmcs->vmcs); + loaded_vmcs->vmcs = NULL; + if (loaded_vmcs->msr_bitmap) + free_page((unsigned long)loaded_vmcs->msr_bitmap); + WARN_ON(loaded_vmcs->shadow_vmcs != NULL); +} + +int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs) +{ + loaded_vmcs->vmcs = alloc_vmcs(false); + if (!loaded_vmcs->vmcs) + return -ENOMEM; + + loaded_vmcs->shadow_vmcs = NULL; + loaded_vmcs->hv_timer_soft_disabled = false; + loaded_vmcs_init(loaded_vmcs); + + if (cpu_has_vmx_msr_bitmap()) { + loaded_vmcs->msr_bitmap = (unsigned long *) + __get_free_page(GFP_KERNEL_ACCOUNT); + if (!loaded_vmcs->msr_bitmap) + goto out_vmcs; + memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE); + + if (IS_ENABLED(CONFIG_HYPERV) && + static_branch_unlikely(&enable_evmcs) && + (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) { + struct hv_enlightened_vmcs *evmcs = + (struct hv_enlightened_vmcs *)loaded_vmcs->vmcs; + + evmcs->hv_enlightenments_control.msr_bitmap = 1; + } + } + + memset(&loaded_vmcs->host_state, 0, sizeof(struct vmcs_host_state)); + memset(&loaded_vmcs->controls_shadow, 0, + sizeof(struct vmcs_controls_shadow)); + + return 0; + +out_vmcs: + free_loaded_vmcs(loaded_vmcs); + return -ENOMEM; +} + +static void free_kvm_area(void) +{ + int cpu; + + for_each_possible_cpu(cpu) { + free_vmcs(per_cpu(vmxarea, cpu)); + per_cpu(vmxarea, cpu) = NULL; + } +} + +static __init int alloc_kvm_area(void) +{ + int cpu; + + for_each_possible_cpu(cpu) { + struct vmcs *vmcs; + + vmcs = alloc_vmcs_cpu(false, cpu, GFP_KERNEL); + if (!vmcs) { + free_kvm_area(); + return -ENOMEM; + } + + /* + * When eVMCS is enabled, alloc_vmcs_cpu() sets + * vmcs->revision_id to KVM_EVMCS_VERSION instead of + * revision_id reported by MSR_IA32_VMX_BASIC. + * + * However, even though not explicitly documented by + * TLFS, VMXArea passed as VMXON argument should + * still be marked with revision_id reported by + * physical CPU. + */ + if (static_branch_unlikely(&enable_evmcs)) + vmcs->hdr.revision_id = vmcs_config.revision_id; + + per_cpu(vmxarea, cpu) = vmcs; + } + return 0; +} + +static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg, + struct kvm_segment *save) +{ + if (!emulate_invalid_guest_state) { + /* + * CS and SS RPL should be equal during guest entry according + * to VMX spec, but in reality it is not always so. Since vcpu + * is in the middle of the transition from real mode to + * protected mode it is safe to assume that RPL 0 is a good + * default value. + */ + if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS) + save->selector &= ~SEGMENT_RPL_MASK; + save->dpl = save->selector & SEGMENT_RPL_MASK; + save->s = 1; + } + vmx_set_segment(vcpu, save, seg); +} + +static void enter_pmode(struct kvm_vcpu *vcpu) +{ + unsigned long flags; + struct vcpu_vmx *vmx = to_vmx(vcpu); + + /* + * Update real mode segment cache. It may be not up-to-date if sement + * register was written while vcpu was in a guest mode. + */ + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS); + + vmx->rmode.vm86_active = 0; + + vmx_segment_cache_clear(vmx); + + vmx_set_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR); + + flags = vmcs_readl(GUEST_RFLAGS); + flags &= RMODE_GUEST_OWNED_EFLAGS_BITS; + flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS; + vmcs_writel(GUEST_RFLAGS, flags); + + vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) | + (vmcs_readl(CR4_READ_SHADOW) & X86_CR4_VME)); + + update_exception_bitmap(vcpu); + + fix_pmode_seg(vcpu, VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]); + fix_pmode_seg(vcpu, VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]); + fix_pmode_seg(vcpu, VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]); + fix_pmode_seg(vcpu, VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]); + fix_pmode_seg(vcpu, VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]); + fix_pmode_seg(vcpu, VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]); +} + +static void fix_rmode_seg(int seg, struct kvm_segment *save) +{ + const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg]; + struct kvm_segment var = *save; + + var.dpl = 0x3; + if (seg == VCPU_SREG_CS) + var.type = 0x3; + + if (!emulate_invalid_guest_state) { + var.selector = var.base >> 4; + var.base = var.base & 0xffff0; + var.limit = 0xffff; + var.g = 0; + var.db = 0; + var.present = 1; + var.s = 1; + var.l = 0; + var.unusable = 0; + var.type = 0x3; + var.avl = 0; + if (save->base & 0xf) + printk_once(KERN_WARNING "kvm: segment base is not " + "paragraph aligned when entering " + "protected mode (seg=%d)", seg); + } + + vmcs_write16(sf->selector, var.selector); + vmcs_writel(sf->base, var.base); + vmcs_write32(sf->limit, var.limit); + vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var)); +} + +static void enter_rmode(struct kvm_vcpu *vcpu) +{ + unsigned long flags; + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct kvm_vmx *kvm_vmx = to_kvm_vmx(vcpu->kvm); + + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS); + vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS); + + vmx->rmode.vm86_active = 1; + + /* + * Very old userspace does not call KVM_SET_TSS_ADDR before entering + * vcpu. Warn the user that an update is overdue. + */ + if (!kvm_vmx->tss_addr) + printk_once(KERN_WARNING "kvm: KVM_SET_TSS_ADDR need to be " + "called before entering vcpu\n"); + + vmx_segment_cache_clear(vmx); + + vmcs_writel(GUEST_TR_BASE, kvm_vmx->tss_addr); + vmcs_write32(GUEST_TR_LIMIT, RMODE_TSS_SIZE - 1); + vmcs_write32(GUEST_TR_AR_BYTES, 0x008b); + + flags = vmcs_readl(GUEST_RFLAGS); + vmx->rmode.save_rflags = flags; + + flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM; + + vmcs_writel(GUEST_RFLAGS, flags); + vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME); + update_exception_bitmap(vcpu); + + fix_rmode_seg(VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]); + fix_rmode_seg(VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]); + fix_rmode_seg(VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]); + fix_rmode_seg(VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]); + fix_rmode_seg(VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]); + fix_rmode_seg(VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]); + + kvm_mmu_reset_context(vcpu); +} + +void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct shared_msr_entry *msr = find_msr_entry(vmx, MSR_EFER); + + if (!msr) + return; + + vcpu->arch.efer = efer; + if (efer & EFER_LMA) { + vm_entry_controls_setbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE); + msr->data = efer; + } else { + vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE); + + msr->data = efer & ~EFER_LME; + } + setup_msrs(vmx); +} + +#ifdef CONFIG_X86_64 + +static void enter_lmode(struct kvm_vcpu *vcpu) +{ + u32 guest_tr_ar; + + vmx_segment_cache_clear(to_vmx(vcpu)); + + guest_tr_ar = vmcs_read32(GUEST_TR_AR_BYTES); + if ((guest_tr_ar & VMX_AR_TYPE_MASK) != VMX_AR_TYPE_BUSY_64_TSS) { + pr_debug_ratelimited("%s: tss fixup for long mode. \n", + __func__); + vmcs_write32(GUEST_TR_AR_BYTES, + (guest_tr_ar & ~VMX_AR_TYPE_MASK) + | VMX_AR_TYPE_BUSY_64_TSS); + } + vmx_set_efer(vcpu, vcpu->arch.efer | EFER_LMA); +} + +static void exit_lmode(struct kvm_vcpu *vcpu) +{ + vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE); + vmx_set_efer(vcpu, vcpu->arch.efer & ~EFER_LMA); +} + +#endif + +static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr) +{ + int vpid = to_vmx(vcpu)->vpid; + + if (!vpid_sync_vcpu_addr(vpid, addr)) + vpid_sync_context(vpid); + + /* + * If VPIDs are not supported or enabled, then the above is a no-op. + * But we don't really need a TLB flush in that case anyway, because + * each VM entry/exit includes an implicit flush when VPID is 0. + */ +} + +static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu) +{ + ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits; + + vcpu->arch.cr0 &= ~cr0_guest_owned_bits; + vcpu->arch.cr0 |= vmcs_readl(GUEST_CR0) & cr0_guest_owned_bits; +} + +static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu) +{ + ulong cr4_guest_owned_bits = vcpu->arch.cr4_guest_owned_bits; + + vcpu->arch.cr4 &= ~cr4_guest_owned_bits; + vcpu->arch.cr4 |= vmcs_readl(GUEST_CR4) & cr4_guest_owned_bits; +} + +static void ept_load_pdptrs(struct kvm_vcpu *vcpu) +{ + struct kvm_mmu *mmu = vcpu->arch.walk_mmu; + + if (!kvm_register_is_dirty(vcpu, VCPU_EXREG_PDPTR)) + return; + + if (is_pae_paging(vcpu)) { + vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]); + vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]); + vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]); + vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]); + } +} + +void ept_save_pdptrs(struct kvm_vcpu *vcpu) +{ + struct kvm_mmu *mmu = vcpu->arch.walk_mmu; + + if (is_pae_paging(vcpu)) { + mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0); + mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1); + mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2); + mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3); + } + + kvm_register_mark_dirty(vcpu, VCPU_EXREG_PDPTR); +} + +static void ept_update_paging_mode_cr0(unsigned long *hw_cr0, + unsigned long cr0, + struct kvm_vcpu *vcpu) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + + if (!kvm_register_is_available(vcpu, VCPU_EXREG_CR3)) + vmx_cache_reg(vcpu, VCPU_EXREG_CR3); + if (!(cr0 & X86_CR0_PG)) { + /* From paging/starting to nonpaging */ + exec_controls_setbit(vmx, CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING); + vcpu->arch.cr0 = cr0; + vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); + } else if (!is_paging(vcpu)) { + /* From nonpaging to paging */ + exec_controls_clearbit(vmx, CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING); + vcpu->arch.cr0 = cr0; + vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); + } + + if (!(cr0 & X86_CR0_WP)) + *hw_cr0 &= ~X86_CR0_WP; +} + +void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) +{ + struct vcpu_vmx *vmx = to_vmx(vcpu); + unsigned long hw_cr0; + + hw_cr0 = (cr0 & ~KVM_VM_CR0_ALWAYS_OFF); + if (enable_unrestricted_guest) + hw_cr0 |= KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST; + else { + hw_cr0 |= KVM_VM_CR0_ALWAYS_ON; + + if (vmx->rmode.vm86_active && (cr0 & X86_CR0_PE)) + enter_pmode(vcpu); + + if (!vmx->rmode.vm86_active && !(cr0 & X86_CR0_PE)) + enter_rmode(vcpu); + } + +#ifdef CONFIG_X86_64 + if (vcpu->arch.efer & EFER_LME) { + if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) + enter_lmode(vcpu); + if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) + exit_lmode(vcpu); + } +#endif + + if (enable_ept && !enable_unrestricted_guest) + ept_update_paging_mode_cr0(&hw_cr0, cr0, vcpu); + + vmcs_writel(CR0_READ_SHADOW, cr0); + vmcs_writel(GUEST_CR0, hw_cr0); + vcpu->arch.cr0 = cr0; + + /* depends on vcpu->arch.cr0 to be set to a new value */ + vmx->emulation_required = emulation_required(vcpu); +} + +static int get_ept_level(struct kvm_vcpu *vcpu) +{ + if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48)) + return 5; + return 4; +} + +u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa) +{ + u64 eptp = VMX_EPTP_MT_WB; + + eptp |= (get_ept_level(vcpu) == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4; + + if (enable_ept_ad_bits && + (!is_guest_mode(vcpu) || nested_ept_ad_enabled(vcpu))) + eptp |= VMX_EPTP_AD_ENABLE_BIT; + eptp |= (root_hpa & PAGE_MASK); + + return eptp; +} + +void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) +{ + struct kvm *kvm = vcpu->kvm; + bool update_guest_cr3 = true; + unsigned long guest_cr3; + u64 eptp; + + guest_cr3 = cr3; + if (enable_ept) { + eptp = construct_eptp(vcpu, cr3); + vmcs_write64(EPT_POINTER, eptp);
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.20.1
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 75/91 KVM: nVMX: vmread should not set rflags to specify success in case of #PF
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit a4d956b9390418623ae5d07933e2679c68b6f83c ]
In case writing to vmread destination operand result in a #PF, vmread should not call nested_vmx_succeed() to set rflags to specify success. Similar to as done in VMPTRST (See handle_vmptrst()).
--- arch/x86/kvm/vmx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx.c +3 -1
@@ -7261,8 +7261,10 @@ static int handle_vmread(struct kvm_vcpu *vcpu)/* _system ok, as nested_vmx_check_permission verified cpl=0 */ if (kvm_write_guest_virt_system (vcpu, gva, &field_value, (is_long_mode (vcpu) ?8 :4 ), - &e)) + &e)) {kvm_inject_page_fault (vcpu, &e); +return 1 ; + } }nested_vmx_succeed (vcpu);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 76/91 cifs: fail i/o on soft mounts if sessionsetup errors out
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit b0dd940e582b6a60296b9847a54012a4b080dc72 upstream.
RHBZ: 1579050
If we have a soft mount we should fail commands for session-setup failures (such as the password having changed/ account being deleted/ ...) and return an error back to the application.
--- fs/cifs/smb2pdu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.c +8 -2
@@ -250,9 +250,14 @@ smb2_reconnect(__le16 smb2_command, stru*/ mutex_lock (&tcon->ses->session_mutex); rc =cifs_negotiate_protocol (0 , tcon->ses); -if (!rc && tcon->ses->need_reconnect) +if (!rc && tcon->ses->need_reconnect) { rc =cifs_setup_session (0 , tcon->ses, nls_codepage); - +if ((rc == -EACCES ) && !tcon->retry) { + rc = -EHOSTDOWN ; +mutex_unlock (&tcon->ses->session_mutex); + goto failed; + } + }if (rc || !tcon->need_reconnect) {mutex_unlock (&tcon->ses->session_mutex); goto out;
@@ -286,6 +291,7 @@ out:case SMB2_SET_INFO : rc = -EAGAIN ; } +failed:unload_nls (nls_codepage);return rc; }
Greg Kroah-Hartman
maintainerPATCH 77/91 clocksource: Prevent double add_timer_on() for watchdog_timer
In reply to Greg Kroah-HartmanFrom: Konstantin Khlebnikov <[email protected]>
commit febac332a819f0e764aa4da62757ba21d18c182b upstream.
Kernel crashes inside QEMU/KVM are observed:
kernel BUG at kernel/time/timer.c:1154! BUG_ON(timer_pending(timer) || !timer->function) in add_timer_on().
At the same time another cpu got:
general protection fault: 0000 [#1] SMP PTI of poinson pointer 0xdead000000000200 in:
__hlist_del at include/linux/list.h:681
(inlined by) detach_timer at kernel/time/timer.c:818 (inlined by) expire_timers at kernel/time/timer.c:1355 (inlined by) __run_timers at kernel/time/timer.c:1686 (inlined by) run_timer_softirq at kernel/time/timer.c:1699
Unfortunately kernel logs are badly scrambled, stacktraces are lost.
Printing the timer->function before the BUG_ON() pointed to clocksource_watchdog().
The execution of clocksource_watchdog() can race with a sequence of clocksource_stop_watchdog() .. clocksource_start_watchdog():
expire_timers()
detach_timer(timer, true);
timer->entry.pprev = NULL;
raw_spin_unlock_irq(&base->lock);
call_timer_fn
clocksource_watchdog()
clocksource_watchdog_kthread() or clocksource_unbind() spin_lock_irqsave(&watchdog_lock, flags); clocksource_stop_watchdog(); del_timer(&watchdog_timer); watchdog_running = 0; spin_unlock_irqrestore(&watchdog_lock, flags); spin_lock_irqsave(&watchdog_lock, flags); clocksource_start_watchdog(); add_timer_on(&watchdog_timer, ...); watchdog_running = 1; spin_unlock_irqrestore(&watchdog_lock, flags);
spin_lock(&watchdog_lock);
add_timer_on(&watchdog_timer, ...);
BUG_ON(timer_pending(timer) || !timer->function);
timer_pending() -> true
BUG()I.e. inside clocksource_watchdog() watchdog_timer could be already armed.
Check timer_pending() before calling add_timer_on(). This is sufficient as all operations are synchronized by watchdog_lock.
--- kernel/time/clocksource.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/time/clocksource.c +9 -2
@@ -272,8 +272,15 @@ static void clocksource_watchdog(unsigne next_cpu =cpumask_next (raw_smp_processor_id (), cpu_online_mask);if (next_cpu >= nr_cpu_ids) next_cpu =cpumask_first (cpu_online_mask); - watchdog_timer.expires +=WATCHDOG_INTERVAL ; -add_timer_on (&watchdog_timer, next_cpu); + +/* +* Arm timer if not already pending: could race with concurrent +* pair clocksource_stop_watchdog() clocksource_start_watchdog(). +*/ +if (!timer_pending (&watchdog_timer)) { + watchdog_timer.expires +=WATCHDOG_INTERVAL ; +add_timer_on (&watchdog_timer, next_cpu); + } out:spin_unlock (&watchdog_lock); }
Greg Kroah-Hartman
maintainerPATCH 78/91 perf/core: Fix mlock accounting in perf_mmap()
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
commit 003461559ef7a9bd0239bae35a22ad8924d6e9ad upstream.
Decreasing sysctl_perf_event_mlock between two consecutive perf_mmap()s of a perf ring buffer may lead to an integer underflow in locked memory accounting. This may lead to the undesired behaviors, such as failures in BPF map creation.
Address this by adjusting the accounting logic to take into account the possibility that the amount of already locked memory may exceed the current limit.
--- kernel/events/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/events/core.c +9 -1
@@ -4887,7 +4887,15 @@ accounting:*/ user_lock_limit *=num_online_cpus (); - user_locked =atomic_long_read (&user->locked_vm) + user_extra; + user_locked =atomic_long_read (&user->locked_vm); + +/* +* sysctl_perf_event_mlock may have changed, so that +* user->locked_vm > user_lock_limit +*/ +if (user_locked > user_lock_limit) + user_locked = user_lock_limit; + user_locked += user_extra;if (user_locked > user_lock_limit) extra = user_locked - user_lock_limit;
Greg Kroah-Hartman
maintainerPATCH 79/91 ASoC: pcm: update FE/BE trigger order based on the command
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
[ Upstream commit acbf27746ecfa96b290b54cc7f05273482ea128a ]
Currently, the trigger orders SND_SOC_DPCM_TRIGGER_PRE/POST determine the order in which FE DAI and BE DAI are triggered. In the case of SND_SOC_DPCM_TRIGGER_PRE, the FE DAI is triggered before the BE DAI and in the case of SND_SOC_DPCM_TRIGGER_POST, the BE DAI is triggered before the FE DAI. And this order remains the same irrespective of the trigger command.
In the case of the SOF driver, during playback, the FW expects the BE DAI to be triggered before the FE DAI during the START trigger. The BE DAI trigger handles the starting of Link DMA and so it must be started before the FE DAI is started to prevent xruns during pause/release. This can be addressed by setting the trigger order for the FE dai link to SND_SOC_DPCM_TRIGGER_POST. But during the STOP trigger, the FW expects the FE DAI to be triggered before the BE DAI. Retaining the same order during the START and STOP commands, results in FW error as the DAI component in the FW is still active.
The issue can be fixed by mirroring the trigger order of FE and BE DAI's during the START and STOP trigger. So, with the trigger order set to SND_SOC_DPCM_TRIGGER_PRE, the FE DAI will be trigger first during SNDRV_PCM_TRIGGER_START/STOP/RESUME and the BE DAI will be triggered first during the STOP/SUSPEND/PAUSE commands. Conversely, with the trigger order set to SND_SOC_DPCM_TRIGGER_POST, the BE DAI will be triggered first during the SNDRV_PCM_TRIGGER_START/STOP/RESUME commands and the FE DAI will be triggered first during the SNDRV_PCM_TRIGGER_STOP/SUSPEND/PAUSE commands.
--- sound/soc/soc-pcm.c | 95 +++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 68 insertions(+), 27 deletions(-)
sound/soc/soc-pcm.c +68 -27
@@ -2026,42 +2026,81 @@ int dpcm_be_dai_trigger(struct snd_soc_p }EXPORT_SYMBOL_GPL (dpcm_be_dai_trigger); +static int dpcm_dai_trigger_fe_be (struct snd_pcm_substream *substream, +int cmd,bool fe_first) +{ +struct snd_soc_pcm_runtime *fe = substream->private_data; +int ret; + +/* call trigger on the frontend before the backend. */ +if (fe_first) { +dev_dbg (fe->dev,"ASoC: pre trigger FE %s cmd %d\n" , + fe->dai_link->name, cmd); + + ret =soc_pcm_trigger (substream, cmd); +if (ret <0 ) +return ret; + + ret =dpcm_be_dai_trigger (fe, substream->stream, cmd); +return ret; + } + +/* call trigger on the frontend after the backend. */ + ret =dpcm_be_dai_trigger (fe, substream->stream, cmd); +if (ret <0 ) +return ret; + +dev_dbg (fe->dev,"ASoC: post trigger FE %s cmd %d\n" , + fe->dai_link->name, cmd); + + ret =soc_pcm_trigger (substream, cmd); + +return ret; +} +static int dpcm_fe_dai_do_trigger (struct snd_pcm_substream *substream,int cmd) {struct snd_soc_pcm_runtime *fe = substream->private_data; -int stream = substream->stream, ret; +int stream = substream->stream; +int ret =0 ;enum snd_soc_dpcm_trigger trigger = fe->dai_link->trigger[stream]; fe->dpcm[stream].runtime_update =SND_SOC_DPCM_UPDATE_FE ;switch (trigger) {case SND_SOC_DPCM_TRIGGER_PRE : -/* call trigger on the frontend before the backend. */ - -dev_dbg (fe->dev,"ASoC: pre trigger FE %s cmd %d\n" , - fe->dai_link->name, cmd); - - ret =soc_pcm_trigger (substream, cmd); -if (ret <0 ) { -dev_err (fe->dev,"ASoC: trigger FE failed %d\n" , ret); - goto out; +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_RESUME : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : + ret =dpcm_dai_trigger_fe_be (substream, cmd, true); +break ; +case SNDRV_PCM_TRIGGER_STOP : +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : + ret =dpcm_dai_trigger_fe_be (substream, cmd, false); +break ; +default : + ret = -EINVAL ; +break ; } - - ret =dpcm_be_dai_trigger (fe, substream->stream, cmd);break ;case SND_SOC_DPCM_TRIGGER_POST : -/* call trigger on the frontend after the backend. */ - - ret =dpcm_be_dai_trigger (fe, substream->stream, cmd); -if (ret <0 ) { -dev_err (fe->dev,"ASoC: trigger FE failed %d\n" , ret); - goto out; +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_RESUME : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : + ret =dpcm_dai_trigger_fe_be (substream, cmd, false); +break ; +case SNDRV_PCM_TRIGGER_STOP : +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : + ret =dpcm_dai_trigger_fe_be (substream, cmd, true); +break ; +default : + ret = -EINVAL ; +break ; } - -dev_dbg (fe->dev,"ASoC: post trigger FE %s cmd %d\n" , - fe->dai_link->name, cmd); - - ret =soc_pcm_trigger (substream, cmd);break ;case SND_SOC_DPCM_TRIGGER_BESPOKE :/* bespoke trigger() - handles both FE and BEs */
@@ -2070,10 +2109,6 @@ static int dpcm_fe_dai_do_trigger(struct fe->dai_link->name, cmd); ret =soc_pcm_bespoke_trigger (substream, cmd); -if (ret <0 ) { -dev_err (fe->dev,"ASoC: trigger FE failed %d\n" , ret); - goto out; - }break ;default : dev_err(fe->dev, "ASoC: invalid trigger cmd %d for %s\n", cmd,
@@ -2082,6 +2117,12 @@ static int dpcm_fe_dai_do_trigger(struct goto out; } +if (ret <0 ) { +dev_err (fe->dev,"ASoC: trigger FE cmd: %d failed: %d\n" , + cmd, ret); + goto out; + } +switch (cmd) {case SNDRV_PCM_TRIGGER_START :case SNDRV_PCM_TRIGGER_RESUME :
Greg Kroah-Hartman
maintainerPATCH 80/91 scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
In reply to Greg Kroah-HartmanFrom: Bean Huo <[email protected]>
commit b9fc5320212efdfb4e08b825aaa007815fd11d16 upstream.
A non-zero error value likely being returned by ufshcd_scsi_add_wlus() in case of failure of adding the WLs, but ufshcd_probe_hba() doesn't use this value, and doesn't report this failure to upper caller. This patch is to fix this issue.
--- drivers/scsi/ufs/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +2 -1
@@ -4324,7 +4324,8 @@ static int ufshcd_probe_hba(struct ufs_hufshcd_init_icc_levels (hba);/* Add required well known logical units to scsi mid layer */ -if (ufshcd_scsi_add_wlus (hba)) + ret =ufshcd_scsi_add_wlus (hba); +if (ret) goto out;scsi_scan_host (hba->host);
Greg Kroah-Hartman
maintainerPATCH 81/91 rtc: hym8563: Return -EINVAL if the time is known to be invalid
In reply to Greg Kroah-HartmanFrom: Paul Kocialkowski <[email protected]>
commit f236a2a2ebabad0848ad0995af7ad1dc7029e895 upstream.
The current code returns -EPERM when the voltage loss bit is set. Since the bit indicates that the time value is not valid, return -EINVAL instead, which is the appropriate error code for this situation.
--- drivers/rtc/rtc-hym8563.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-hym8563.c +1 -1
@@ -105,7 +105,7 @@ static int hym8563_rtc_read_time(structif (!hym8563->valid) {dev_warn (&client->dev,"no valid clock/calendar values available\n" ); -return -EPERM ; +return -EINVAL ; } ret =i2c_smbus_read_i2c_block_data (client,HYM8563_SEC ,7 , buf);
Greg Kroah-Hartman
maintainerPATCH 82/91 ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
In reply to Greg Kroah-HartmanFrom: Jose Abreu <[email protected]>
commit 7980dff398f86a618f502378fa27cf7e77449afa upstream.
Add a missing property to GMAC node so that multicast filtering works correctly.
--- arch/arc/boot/dts/axs10x_mb.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arc/boot/dts/axs10x_mb.dtsi +1 -0
@@ -44,6 +44,7 @@ interrupt-names = "macirq"; phy-mode = "rgmii"; snps,pbl = < 32 >; + snps,multicast-filter-bins = <256>; clocks = <&apbclk>; clock-names = "stmmaceth"; max-speed = <100>;
Greg Kroah-Hartman
maintainerPATCH 83/91 ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
commit ee0aa926ddb0bd8ba59e33e3803b3b5804e3f5da upstream.
Currently the maximum rate for peripheral clock is calculated based on a typical 133MHz MCK. The maximum frequency is defined in the datasheet as a ratio to MCK. Some sama5d3 platforms are using a 166MHz MCK. Update the device trees to match the maximum rate based on 166MHz.
--- arch/arm/boot/dts/sama5d3.dtsi | 28 ++++++++++++++-------------- arch/arm/boot/dts/sama5d3_can.dtsi | 4 ++-- arch/arm/boot/dts/sama5d3_uart.dtsi | 4 ++-- 3 files changed, 18 insertions(+), 18 deletions(-)
arch/arm/boot/dts/sama5d3.dtsi +14 -14
@@ -1106,49 +1106,49 @@ usart0_clk: usart0_clk { #clock-cells = <0>; reg = <12>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; usart1_clk: usart1_clk { #clock-cells = <0>; reg = <13>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; usart2_clk: usart2_clk { #clock-cells = <0>; reg = <14>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; usart3_clk: usart3_clk { #clock-cells = <0>; reg = <15>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; uart0_clk: uart0_clk { #clock-cells = <0>; reg = <16>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; twi0_clk: twi0_clk { reg = <18>; #clock-cells = <0>; - atmel,clk-output-range = <0 16625000>; + atmel,clk-output-range = <0 41500000>; }; twi1_clk: twi1_clk { #clock-cells = <0>; reg = <19>; - atmel,clk-output-range = <0 16625000>; + atmel,clk-output-range = <0 41500000>; }; twi2_clk: twi2_clk { #clock-cells = <0>; reg = <20>; - atmel,clk-output-range = <0 16625000>; + atmel,clk-output-range = <0 41500000>; }; mci0_clk: mci0_clk {
@@ -1164,19 +1164,19 @@ spi0_clk: spi0_clk { #clock-cells = <0>; reg = <24>; - atmel,clk-output-range = <0 133000000>; + atmel,clk-output-range = <0 166000000>; }; spi1_clk: spi1_clk { #clock-cells = <0>; reg = <25>; - atmel,clk-output-range = <0 133000000>; + atmel,clk-output-range = <0 166000000>; }; tcb0_clk: tcb0_clk { #clock-cells = <0>; reg = <26>; - atmel,clk-output-range = <0 133000000>; + atmel,clk-output-range = <0 166000000>; }; pwm_clk: pwm_clk {
@@ -1187,7 +1187,7 @@ adc_clk: adc_clk { #clock-cells = <0>; reg = <29>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; dma0_clk: dma0_clk {
@@ -1218,13 +1218,13 @@ ssc0_clk: ssc0_clk { #clock-cells = <0>; reg = <38>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; ssc1_clk: ssc1_clk { #clock-cells = <0>; reg = <39>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; sha_clk: sha_clk {
arch/arm/boot/dts/sama5d3_can.dtsi +2 -2
@@ -37,13 +37,13 @@ can0_clk: can0_clk { #clock-cells = <0>; reg = <40>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; can1_clk: can1_clk { #clock-cells = <0>; reg = <41>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; }; };
arch/arm/boot/dts/sama5d3_uart.dtsi +2 -2
@@ -42,13 +42,13 @@ uart0_clk: uart0_clk { #clock-cells = <0>; reg = <16>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; uart1_clk: uart1_clk { #clock-cells = <0>; reg = <17>; - atmel,clk-output-range = <0 66000000>; + atmel,clk-output-range = <0 83000000>; }; }; };
Greg Kroah-Hartman
maintainerPATCH 84/91 ARM: dts: at91: sama5d3: define clock rate range for tcb1
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
commit a7e0f3fc01df4b1b7077df777c37feae8c9e8b6d upstream.
The clock rate range for the TCB1 clock is missing. define it in the device tree.
--- arch/arm/boot/dts/sama5d3_tcb1.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/sama5d3_tcb1.dtsi +1 -0
@@ -23,6 +23,7 @@ tcb1_clk: tcb1_clk { #clock-cells = <0>; reg = <27>; + atmel,clk-output-range = <0 166000000>; }; }; };
Greg Kroah-Hartman
maintainerPATCH 85/91 powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
commit 7559d3d295f3365ea7ac0c0274c05e633fe4f594 upstream.
By default a pseries guest supports a H_PUT_TCE hypercall which maps a single IOMMU page in a DMA window. Additionally the hypervisor may support H_PUT_TCE_INDIRECT/H_STUFF_TCE which update multiple TCEs at once; this is advertised via the device tree /rtas/ibm,hypertas-functions property which Linux converts to FW_FEATURE_MULTITCE.
FW_FEATURE_MULTITCE is checked when dma_iommu_ops is used; however the code managing the huge DMA window (DDW) ignores it and calls H_PUT_TCE_INDIRECT even if it is explicitly disabled via the "multitce=off" kernel command line parameter.
This adds FW_FEATURE_MULTITCE checking to the DDW code path.
This changes tce_build_pSeriesLP to take liobn and page size as the huge window does not have iommu_table descriptor which usually the place to store these numbers.
--- arch/powerpc/platforms/pseries/iommu.c | 43 ++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 14 deletions(-)
arch/powerpc/platforms/pseries/iommu.c +29 -14
@@ -202,10 +202,10 @@ static unsigned long tce_get_pseries(strreturn be64_to_cpu (*tcep); } -static void tce_free_pSeriesLP (struct iommu_table *,long ,long ); +static void tce_free_pSeriesLP (unsigned long liobn,long ,long );static void tce_freemulti_pSeriesLP (struct iommu_table *,long ,long ); -static int tce_build_pSeriesLP (struct iommu_table *tbl,long tcenum, +static int tce_build_pSeriesLP (unsigned long liobn,long tcenum,long tceshift,long npages,unsigned long uaddr,enum dma_data_direction direction,struct dma_attrs *attrs)
@@ -216,25 +216,25 @@ static int tce_build_pSeriesLP(struct ioint ret =0 ;long tcenum_start = tcenum, npages_start = npages; - rpn =__pa (uaddr) >>TCE_SHIFT ; + rpn =__pa (uaddr) >> tceshift; proto_tce =TCE_PCI_READ ;if (direction !=DMA_TO_DEVICE ) proto_tce |=TCE_PCI_WRITE ;while (npages--) { - tce = proto_tce | (rpn &TCE_RPN_MASK ) <<TCE_RPN_SHIFT ; - rc =plpar_tce_put ((u64 )tbl->it_index, (u64 )tcenum <<12 , tce); + tce = proto_tce | (rpn &TCE_RPN_MASK ) << tceshift; + rc =plpar_tce_put ((u64 )liobn, (u64 )tcenum << tceshift, tce);if (unlikely (rc ==H_NOT_ENOUGH_RESOURCES )) { ret = (int )rc; -tce_free_pSeriesLP (tbl, tcenum_start, +tce_free_pSeriesLP (liobn, tcenum_start, (npages_start - (npages +1 )));break ; }if (rc &&printk_ratelimit ()) {printk ("tce_build_pSeriesLP: plpar_tce_put failed. rc=%lld\n" , rc); -printk ("\tindex = 0x%llx\n" , (u64 )tbl->it_index); +printk ("\tindex = 0x%llx\n" , (u64 )liobn);printk ("\ttcenum = 0x%llx\n" , (u64 )tcenum);printk ("\ttce val = 0x%llx\n" , tce );dump_stack ();
@@ -263,7 +263,8 @@ static int tce_buildmulti_pSeriesLP(struunsigned long flags;if ((npages ==1 ) || !firmware_has_feature (FW_FEATURE_MULTITCE )) { -return tce_build_pSeriesLP (tbl, tcenum, npages, uaddr, +return tce_build_pSeriesLP (tbl->it_index, tcenum, + tbl->it_page_shift, npages, uaddr, direction, attrs); }
@@ -279,8 +280,9 @@ static int tce_buildmulti_pSeriesLP(stru/* If allocation fails, fall back to the loop implementation */ if (!tcep) {local_irq_restore (flags); -return tce_build_pSeriesLP (tbl, tcenum, npages, uaddr, - direction, attrs); +return tce_build_pSeriesLP (tbl->it_index, tcenum, + tbl->it_page_shift, + npages, uaddr, direction, attrs); }__this_cpu_write (tce_page, tcep); }
@@ -331,16 +333,16 @@ static int tce_buildmulti_pSeriesLP(strureturn ret; } -static void tce_free_pSeriesLP (struct iommu_table *tbl,long tcenum,long npages) +static void tce_free_pSeriesLP (unsigned long liobn,long tcenum,long npages) {u64 rc;while (npages--) { - rc =plpar_tce_put ((u64 )tbl->it_index, (u64 )tcenum <<12 ,0 ); + rc =plpar_tce_put ((u64 )liobn, (u64 )tcenum <<12 ,0 );if (rc &&printk_ratelimit ()) {printk ("tce_free_pSeriesLP: plpar_tce_put failed. rc=%lld\n" , rc); -printk ("\tindex = 0x%llx\n" , (u64 )tbl->it_index); +printk ("\tindex = 0x%llx\n" , (u64 )liobn);printk ("\ttcenum = 0x%llx\n" , (u64 )tcenum);dump_stack (); }
@@ -355,7 +357,7 @@ static void tce_freemulti_pSeriesLP(struu64 rc;if (!firmware_has_feature (FW_FEATURE_MULTITCE )) -return tce_free_pSeriesLP (tbl, tcenum, npages); +return tce_free_pSeriesLP (tbl->it_index, tcenum, npages); rc =plpar_tce_stuff ((u64 )tbl->it_index, (u64 )tcenum <<12 ,0 , npages);
@@ -470,6 +472,19 @@ static int tce_setrange_multi_pSeriesLP(u64 rc =0 ;long l, limit; +if (!firmware_has_feature (FW_FEATURE_MULTITCE )) { +unsigned long tceshift =be32_to_cpu (maprange->tce_shift); +unsigned long dmastart = (start_pfn <<PAGE_SHIFT ) + +be64_to_cpu (maprange->dma_base); +unsigned long tcenum = dmastart >> tceshift; +unsigned long npages = num_pfn <<PAGE_SHIFT >> tceshift; +void *uaddr =__va (start_pfn <<PAGE_SHIFT ); + +return tce_build_pSeriesLP (be32_to_cpu (maprange->liobn), + tcenum, tceshift, npages, (unsigned long ) uaddr, +DMA_BIDIRECTIONAL ,0 ); + } +local_irq_disable ();/* to protect tcep and the page behind it */ tcep =__this_cpu_read (tce_page);
Greg Kroah-Hartman
maintainerPATCH 86/91 pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 805f635703b2562b5ddd822c62fc9124087e5dd5 upstream.
The FN_SDSELF_B and FN_SD1_CLK_B enum IDs are used twice, which means one set of users must be wrong. Replace them by the correct enum IDs.
--- drivers/pinctrl/sh-pfc/pfc-r8a7778.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/sh-pfc/pfc-r8a7778.c +2 -2
@@ -2324,7 +2324,7 @@ static const struct pinmux_cfg_reg pinmuFN_ATAG0_A ,0 ,FN_REMOCON_B ,0 ,/* IP0_11_8 [4] */ FN_SD1_DAT2_A ,FN_MMC_D2 ,0 ,FN_BS , -FN_ATADIR0_A ,0 ,FN_SDSELF_B ,0 , +FN_ATADIR0_A ,0 ,FN_SDSELF_A ,0 ,FN_PWM4_B ,0 ,0 ,0 ,0 ,0 ,0 ,0 , /* IP0_7_5 [3] */
@@ -2366,7 +2366,7 @@ static const struct pinmux_cfg_reg pinmuFN_TS_SDAT0_A ,0 ,0 ,0 ,0 ,0 ,0 ,0 ,/* IP1_10_8 [3] */ -FN_SD1_CLK_B ,FN_MMC_D6 ,0 ,FN_A24 , +FN_SD1_CD_A ,FN_MMC_D6 ,0 ,FN_A24 ,FN_DREQ1_A ,0 ,FN_HRX0_B ,FN_TS_SPSYNC0_A ,/* IP1_7_5 [3] */ FN_A23, FN_HTX0_B, FN_TX2_B, FN_DACK2_A,
Greg Kroah-Hartman
maintainerPATCH 87/91 mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
In reply to Greg Kroah-HartmanFrom: Qing Xu <[email protected]>
[ Upstream commit 3a9b153c5591548612c3955c9600a98150c81875 ]
mwifiex_ret_wmm_get_status() calls memcpy() without checking the destination size.Since the source is given from remote AP which contains illegal wmm elements , this may trigger a heap buffer overflow.
Fix it by putting the length check before calling memcpy().
--- drivers/net/wireless/mwifiex/wmm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/mwifiex/wmm.c +4 -0
@@ -978,6 +978,10 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,"WMM Parameter Set Count: %d\n" , wmm_param_ie->qos_info_bitmap & mask); +if (wmm_param_ie->vend_hdr.len +2 > +sizeof (struct ieee_types_wmm_parameter )) +break ; +memcpy ((u8 *) &priv->curr_bss_params.bss_descriptor. wmm_ie, wmm_param_ie, wmm_param_ie->vend_hdr.len +2 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 88/91 mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
In reply to Greg Kroah-HartmanFrom: Qing Xu <[email protected]>
[ Upstream commit b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d ]
mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking the destination size may trigger a buffer overflower, which a local user could use to cause denial of service or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().
--- drivers/net/wireless/mwifiex/scan.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/mwifiex/scan.c +7 -0
@@ -2568,6 +2568,13 @@ mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv, vs_param_set->header.len =cpu_to_le16 ((((u16 ) priv->vs_ie[id].ie[1 ]) &0x00FF ) +2 ); +if (le16_to_cpu (vs_param_set->header.len) > +MWIFIEX_MAX_VSIE_LEN ) { +mwifiex_dbg (priv->adapter,ERROR , +"Invalid param length!\n" ); +break ; + } +memcpy (vs_param_set->ie, priv->vs_ie[id].ie,le16_to_cpu (vs_param_set->header.len)); *buffer += le16_to_cpu(vs_param_set->header.len) +
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 89/91 libertas: dont exit from lbs_ibss_join_existing() with RCU read lock held
In reply to Greg Kroah-HartmanFrom: Nicolai Stange <[email protected]>
[ Upstream commit c7bf1fb7ddca331780b9a733ae308737b39f1ad4 ]
Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor") introduced a bounds check on the number of supplied rates to lbs_ibss_join_existing().
Unfortunately, it introduced a return path from within a RCU read side critical section without a corresponding rcu_read_unlock(). Fix this.
--- drivers/net/wireless/libertas/cfg.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/libertas/cfg.c +1 -0
@@ -1853,6 +1853,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv, rates_max = rates_eid[1 ];if (rates_max >MAX_RATES ) {lbs_deb_join ("invalid rates" ); +rcu_read_unlock (); goto out; } rates = cmd.bss.rates;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 90/91 libertas: make lbs_ibss_join_existing() return error code on rates overflow
In reply to Greg Kroah-HartmanFrom: Nicolai Stange <[email protected]>
[ Upstream commit 1754c4f60aaf1e17d886afefee97e94d7f27b4cb ]
Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss descriptor") introduced a bounds check on the number of supplied rates to lbs_ibss_join_existing() and made it to return on overflow.
However, the aforementioned commit doesn't set the return value accordingly and thus, lbs_ibss_join_existing() would return with zero even though it failed.
Make lbs_ibss_join_existing return -EINVAL in case the bounds check on the number of supplied rates fails.
--- drivers/net/wireless/libertas/cfg.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/libertas/cfg.c +1 -0
@@ -1854,6 +1854,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,if (rates_max >MAX_RATES ) {lbs_deb_join ("invalid rates" );rcu_read_unlock (); + ret = -EINVAL ; goto out; } rates = cmd.bss.rates;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 91/91 dm: fix potential for q->make_request_fn NULL pointer
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
commit 47ace7e012b9f7ad71d43ac9063d335ea3d6820b upstream.
Move blk_queue_make_request() to dm.c:alloc_dev() so that q->make_request_fn is never NULL during the lifetime of a DM device (even one that is created without a DM table).
Otherwise generic_make_request() will crash simply by doing:
dmsetup create -n test
mount /dev/dm-N /mnt
While at it, move ->congested_data initialization out of dm.c:alloc_dev() and into the bio-based specific init method.
Depends-on: c12c9a3c3860c ("dm: various cleanups to md->queue initialization code")
[smb: adjusted for context and dm_init_md_queue() exitsting in older
kernels, and congested_data embedded in backing_dev_info, and dm_init_normal_md_queue() was called dm_init_old_md_queue()]
--- drivers/md/dm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/md/dm.c +7 -2
@@ -2293,7 +2293,6 @@ static void dm_init_md_queue(struct mapp* - must do so here (in alloc_dev callchain) before queue is used */ md->queue->queuedata = md; - md->queue->backing_dev_info.congested_data = md; }static void dm_init_old_md_queue (struct mapped_device *md)
@@ -2304,6 +2303,7 @@ static void dm_init_old_md_queue(struct/* * Initialize aspects of queue that aren't relevant for blk-mq */ + md->queue->backing_dev_info.congested_data = md; md->queue->backing_dev_info.congested_fn = dm_any_congested;blk_queue_bounce_limit (md->queue,BLK_BOUNCE_ANY ); }
@@ -2386,6 +2386,12 @@ static struct mapped_device *alloc_dev(i goto bad;dm_init_md_queue (md); +/* +* default to bio-based required ->make_request_fn until DM +* table is loaded and md->type established. If request-based +* table is loaded: blk-mq will override accordingly. +*/ +blk_queue_make_request (md->queue, dm_make_request); md->disk =alloc_disk (1 );if (!md->disk)
@@ -2849,7 +2855,6 @@ int dm_setup_md_queue(struct mapped_devibreak ;case DM_TYPE_BIO_BASED :dm_init_old_md_queue (md); -blk_queue_make_request (md->queue, dm_make_request);/* * DM handles splitting bios as needed. Free the bio_split bioset * since it won't be used (saves 1 process per bio-based DM device).
Hi Greg,
Quoted 8 lines
From: [email protected] <[email protected]> On Behalf Of Greg Kroah-Hartman
Sent: 13 February 2020 15:19This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No issues seen for CIP configs.
Build logs: https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/pipelines/117668767
Pipeline: https://gitlab.com/cip-project/cip-testing/linux-cip-pipelines/-/blob/ba32334b/trees/linux-4.4.y.yml
Kind regards, Chris
Quoted 412 lines
Responses should be made by Sat, 15 Feb 2020 15:16:40 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-
review/patch-4.4.214-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-
rc.git linux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 4.4.214-rc1Mike Snitzer <[email protected]>
dm: fix potential for q->make_request_fn NULL pointerNicolai Stange <[email protected]>
libertas: makelbs_ibss_join_existing()return error code on rates overflowNicolai Stange <[email protected]>
libertas: don't exit fromlbs_ibss_join_existing()with RCU read lock heldQing Xu <[email protected]>
mwifiex: Fix possible buffer overflows inmwifiex_cmd_append_vsie_tlv()Qing Xu <[email protected]>
mwifiex: Fix possible buffer overflows inmwifiex_ret_wmm_get_status()Geert Uytterhoeven <[email protected]>
pinctrl: sh-pfc: r8a7778: Fix duplicateSDSELF_BandSD1_CLK_BAlexey Kardashevskiy <[email protected]>
powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce
for DDWAlexandre Belloni <[email protected]>
ARM: dts: at91: sama5d3: define clock rate range for tcb1Alexandre Belloni <[email protected]>
ARM: dts: at91: sama5d3: fix maximum peripheral clock ratesJose Abreu <[email protected]>
ARC: [plat-axs10x]: Add missing multicast filter number to GMAC nodePaul Kocialkowski <[email protected]>
rtc: hym8563: Return-EINVALif the time is known to be invalidBean Huo <[email protected]>
scsi: ufs: Fixufshcd_probe_hba()reture value in caseufshcd_scsi_add_wlus()failsRanjani Sridharan <[email protected]>
ASoC: pcm: update FE/BE trigger order based on the commandSong Liu <[email protected]>
perf/core: Fix mlock accounting inperf_mmap()Konstantin Khlebnikov <[email protected]>
clocksource: Prevent doubleadd_timer_on()forwatchdog_timerRonnie Sahlberg <[email protected]>
cifs: fail i/o on soft mounts if sessionsetup errors outMiaohe Lin <[email protected]>
KVM: nVMX: vmread should not set rflags to specify success in case of #PFSean Christopherson <[email protected]>
KVM: VMX: Add non-canonical check on writes to RTIT address MSRsSean Christopherson <[email protected]>
KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVMJosef Bacik <[email protected]>
btrfs: flush write bio if we loop inextent_write_cache_pagesMarios Pomonis <[email protected]>
KVM: x86: Protectkvm_lapic_reg_write()from Spectre-v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protectpmu_intel.cfrom Spectre-v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Refactorpicdev_write()to prevent Spectre-v1/L1TF attacksDavid Hildenbrand <[email protected]>
KVM: x86: droppicdev_in_range()Wayne Lin <[email protected]>
drm/dp_mst: Remove VCPI while disabling topology mgrClaudiu Beznea <[email protected]>
drm: atmel-hlcdc: enable clock before configuring timing engineFilipe Manana <[email protected]>
Btrfs: fix race between adding and putting tree mod seq elements and
nodesDavid Sterba <[email protected]>
btrfs: remove trivial locking wrappers of tree mod logFilipe Manana <[email protected]>
Btrfs: fix assertion failure on fsync withNO_HOLESenabledTrond Myklebust <[email protected]>
NFS: Directory page cache pages need to be locked when readThomas Meyer <[email protected]>
NFS: Fix bool initialization/comparisonTrond Myklebust <[email protected]>
NFS: Fix memory leaks and corruption in readdirEric Dumazet <[email protected]>
bonding/alb: properly access headers inbond_alb_xmit()Florian Fainelli <[email protected]>
net: systemport: Avoid RBUF stuck in Wake-on-LAN modeAndreas Kemnade <[email protected]>
mfd: rn5t618: Mark ADC control register volatileMarco Felsch <[email protected]>
mfd: da9062: Fix watchdog compatible stringNathan Chancellor <[email protected]>
net: tulip: Adjust indentation in {dmfe, uli526x}_init_moduleNathan Chancellor <[email protected]>
net: smc911x: Adjust indentation insmc911x_phy_configureNathan Chancellor <[email protected]>
ppp: Adjust indentation intoppp_async_inputNathan Chancellor <[email protected]>
NFC: pn544: Adjust indentation inpn544_hci_check_presenceNathan Chancellor <[email protected]>
powerpc/44x: Adjust indentation inibm4xx_denali_fixup_memsizeNathan Chancellor <[email protected]>
ext2: Adjust indentation inext2_fill_superNathan Chancellor <[email protected]>
scsi: qla4xxx: Adjust indentation inqla4xxx_mem_freeNathan Chancellor <[email protected]>
scsi: csiostor: Adjust indentation incsio_device_resetBart Van Assche <[email protected]>
scsi: qla2xxx: Fix the endianness of theqla82xx_get_fw_size()return typeSean Christopherson <[email protected]>
KVM: x86: Freewbinvd_dirty_maskif vCPU creation failsSean Christopherson <[email protected]>
KVM: PPC: Book3S PR: Free shared page if mmu initialization failsSean Christopherson <[email protected]>
KVM: PPC: Book3S HV: Uninit vCPU if vcore creation failsMarios Pomonis <[email protected]>
KVM: x86: Protect MSR-based index computations infixed_msr_to_seg_unit()from Spectre-v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protectx86_decode_insnfrom Spectre-v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF
attacks inx86.cMarios Pomonis <[email protected]>
KVM: x86: Protectioapic_read_indirect()from Spectre-v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protect MSR-based index computations inpmu.hfrom Spectre-
v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protectioapic_write_indirect()from Spectre-v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-
v1/L1TF attacksMarios Pomonis <[email protected]>
KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF
attacksMarios Pomonis <[email protected]>
KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacksRoberto Bergantinos Corpas <[email protected]>
sunrpc:expiry_timeshould be seconds not timevalBrian Norris <[email protected]>
mwifiex: fix unbalanced locking inmwifiex_process_country_ie()Stephen Warren <[email protected]>
ARM: tegra: Enable PLLP bypass during Tegra124 LP1Josef Bacik <[email protected]>
btrfs: set trans->drity in btrfs_commit_transactionChuhong Yuan <[email protected]>
crypto: picoxcell - adjust the position oftasklet_initand fix missedtasklet_killHerbert Xu <[email protected]>
crypto: api - Fix race condition incrypto_spawn_algHerbert Xu <[email protected]>
crypto: pcrypt - Do not clearMAY_SLEEPflag in original requestHerbert Xu <[email protected]>
padata: Remove broken queue flushingJoe Thornber <[email protected]>
dm space map common: fix to ensure new block isn't already in useMichael Ellerman <[email protected]>
of: AddOF_DMA_DEFAULT_COHERENT& select it on powerpcIoanna Alifieraki <[email protected]>
Revert "ovl: modifyovl_permission()to do checks on two inodes"Sven Van Asbroeck <[email protected]>
power: supply: ltc2941-battery-gauge: fix use-after-freeQuinn Tran <[email protected]>
scsi: qla2xxx: Fix mtcp dump collection failureHerbert Xu <[email protected]>
crypto: api - Check spawn->alg under lock in crypto_drop_spawnYurii Monakov <[email protected]>
PCI: keystone: Fix link training retries initiationLinus Walleij <[email protected]>
mmc: spi: Toggle SPI polarity, do not hardcode itPingfan Liu <[email protected]>
powerpc/pseries: Advance pfn if section is not present inlmb_is_removable()Gustavo A. R. Silva <[email protected]>
lib/test_kasan.c: fix memory leak inkmalloc_oob_krealloc_more()Takashi Iwai <[email protected]>
ALSA: dummy: Fix PCM format loop in proc outputBryan O'Donoghue <[email protected]>
usb: gadget:f_ecm: Useatomic_tto track in-flight requestBryan O'Donoghue <[email protected]>
usb: gadget:f_ncm: Useatomic_tto track in-flight requestRoger Quadros <[email protected]>
usb: gadget: legacy: setmax_speedto super-speedNavid Emamdoost <[email protected]>
brcmfmac: Fix memory leak inbrcmf_usbdev_qinitOliver Neukum <[email protected]>
mfd: dln2: More sanity checking for endpointsWill Deacon <[email protected]>
media: uvcvideo: Avoid cyclic entity chains due to malformed USB
descriptorsEric Dumazet <[email protected]>
tcp: clear tp->segs_{in|out} in tcp_disconnect()Eric Dumazet <[email protected]>
tcp: clear tp->total_retrans in tcp_disconnect()Cong Wang <[email protected]>
net_sched: fix an OOB access incls_tcindexEric Dumazet <[email protected]>
net: hsr: fix possible NULL deref inhsr_handle_frame()Eric Dumazet <[email protected]>
cls_rsvp: fixrsvp_policyNobuhiro Iwamatsu <[email protected]>
ASoC: qcom: Fix of-node refcount unbalance to link->codec_of_nodeArnd Bergmann <[email protected]>
sparc32: fix structipc64_permtype definitionPawan Gupta <[email protected]>
x86/cpu: Update cached HLE state on write toTSX_CTRL_CPUID_CLEARJohan Hovold <[email protected]>
media: iguanair: fix endpoint sanity check-------------
Diffstat:
Makefile | 4 +- arch/arc/boot/dts/axs10x_mb.dtsi | 1 + arch/arm/boot/dts/sama5d3.dtsi | 28 +- arch/arm/boot/dts/sama5d3_can.dtsi | 4 +- arch/arm/boot/dts/sama5d3_tcb1.dtsi | 1 + arch/arm/boot/dts/sama5d3_uart.dtsi | 4 +- arch/arm/mach-tegra/sleep-tegra30.S | 11 + arch/powerpc/Kconfig | 1 + arch/powerpc/boot/4xx.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 4 +- arch/powerpc/kvm/book3s_pr.c | 4 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 4 +- arch/powerpc/platforms/pseries/iommu.c | 43 +- arch/sparc/include/uapi/asm/ipcbuf.h | 22 +- arch/x86/kernel/cpu/tsx.c | 13 +- arch/x86/kvm/emulate.c | 28 +- arch/x86/kvm/hyperv.c | 11 +- arch/x86/kvm/i8259.c | 41 +- arch/x86/kvm/ioapic.c | 15 +- arch/x86/kvm/lapic.c | 13 +- arch/x86/kvm/mtrr.c | 9 +- arch/x86/kvm/pmu.h | 18 +- arch/x86/kvm/pmu_intel.c | 24 +- arch/x86/kvm/vmx.c | 4 +- arch/x86/kvm/vmx/vmx.c | 8033 ++++++++++++++++++++ arch/x86/kvm/x86.c | 23 +- crypto/algapi.c | 22 +- crypto/api.c | 3 +- crypto/internal.h | 1 - crypto/pcrypt.c | 1 - drivers/crypto/picoxcell_crypto.c | 15 +- drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c | 8 +- drivers/gpu/drm/drm_dp_mst_topology.c | 12 + drivers/md/dm.c | 9 +- drivers/md/persistent-data/dm-space-map-common.c | 27 + drivers/md/persistent-data/dm-space-map-common.h | 2 + drivers/md/persistent-data/dm-space-map-disk.c | 6 +- drivers/md/persistent-data/dm-space-map-metadata.c | 5 +- drivers/media/rc/iguanair.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 12 + drivers/mfd/da9062-core.c | 2 +- drivers/mfd/dln2.c | 13 +- drivers/mfd/rn5t618.c | 1 + drivers/mmc/host/mmc_spi.c | 11 +- drivers/net/bonding/bond_alb.c | 44 +- drivers/net/ethernet/broadcom/bcmsysport.c | 3 + drivers/net/ethernet/dec/tulip/dmfe.c | 7 +- drivers/net/ethernet/dec/tulip/uli526x.c | 4 +- drivers/net/ethernet/smsc/smc911x.c | 2 +- drivers/net/ppp/ppp_async.c | 18 +- drivers/net/wireless/brcm80211/brcmfmac/usb.c | 1 + drivers/net/wireless/libertas/cfg.c | 2 + drivers/net/wireless/mwifiex/scan.c | 7 + drivers/net/wireless/mwifiex/sta_ioctl.c | 1 + drivers/net/wireless/mwifiex/wmm.c | 4 + drivers/nfc/pn544/pn544.c | 2 +- drivers/of/Kconfig | 4 + drivers/of/address.c | 6 +- drivers/pci/host/pci-keystone-dw.c | 2 +- drivers/pinctrl/sh-pfc/pfc-r8a7778.c | 4 +- drivers/power/ltc2941-battery-gauge.c | 2 +- drivers/rtc/rtc-hym8563.c | 2 +- drivers/scsi/csiostor/csio_scsi.c | 2 +- drivers/scsi/qla2xxx/qla_mbx.c | 3 +- drivers/scsi/qla2xxx/qla_nx.c | 8 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/scsi/ufs/ufshcd.c | 3 +- drivers/usb/gadget/function/f_ecm.c | 16 +- drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/legacy/cdc2.c | 2 +- drivers/usb/gadget/legacy/g_ffs.c | 2 +- drivers/usb/gadget/legacy/multi.c | 2 +- drivers/usb/gadget/legacy/ncm.c | 2 +- fs/btrfs/ctree.c | 64 +- fs/btrfs/ctree.h | 6 +- fs/btrfs/delayed-ref.c | 8 +- fs/btrfs/disk-io.c | 1 - fs/btrfs/extent_io.c | 8 + fs/btrfs/tests/btrfs-tests.c | 1 - fs/btrfs/transaction.c | 8 + fs/btrfs/tree-log.c | 7 +- fs/cifs/smb2pdu.c | 10 +- fs/ext2/super.c | 6 +- fs/nfs/callback_proc.c | 2 +- fs/nfs/dir.c | 59 +- fs/nfs/nfs4client.c | 2 +- fs/overlayfs/inode.c | 13 - kernel/events/core.c | 10 +- kernel/padata.c | 46 +- kernel/time/clocksource.c | 11 +- lib/test_kasan.c | 1 + net/hsr/hsr_slave.c | 2 + net/ipv4/tcp.c | 3 + net/sched/cls_rsvp.h | 6 +- net/sched/cls_tcindex.c | 40 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 + sound/drivers/dummy.c | 2 +- sound/soc/qcom/apq8016_sbc.c | 3 +- sound/soc/soc-pcm.c | 95 +- 99 files changed, 8713 insertions(+), 396 deletions(-)
Greg Kroah-Hartman
maintainerQuoted 11 lines · Chris Paterson
Hi Greg,
Quoted 8 lines
From: [email protected] <[email protected]> On Behalf Of Greg Kroah-Hartman
Sent: 13 February 2020 15:19This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 4 lines
No issues seen for CIP configs.
Build logs: https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/pipelines/117668767
Pipeline: https://gitlab.com/cip-project/cip-testing/linux-cip-pipelines/-/blob/ba32334b/trees/linux-4.4.y.yml
Great, thanks for testing 2 of these and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 15 Feb 2020 15:16:40 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.214-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 15 Feb 2020 15:16:40 +0000. Anything received after that time might be too late.
Build results:
total: 170 pass: 170 fail: 0 Qemu test results: total: 328 pass: 328 fail: 0
Guenter
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 15 Feb 2020 15:16:40 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.214-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v4.4:
6 builds: 6 pass, 0 fail
12 boots: 12 pass, 0 fail
19 tests: 19 pass, 0 failLinux version: 4.4.214-rc1-ga4539ca32651
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.214 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 15 Feb 2020 15:16:40 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.214-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.4.214-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: a4539ca32651f32bc7c45d0f09be1fb9fca3ec71
git describe: v4.4.213-92-ga4539ca32651
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.213-92-ga4539ca32651
No regressions (compared to build v4.4.213)
No fixes (compared to build v4.4.213)
Ran 19878 total tests in the following environments and test suites.
Environments
--------------
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* build
* kselftest
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* perf
* prep-tmp-disk
* spectre-meltdown-checker-test
* kvm-unit-tests
* v4l2-compliance
* install-android-platform-tools-r2600
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
* ssuite
Summary
------------------------------------------------------------------------
kernel: 4.4.214-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git branch: 4.4.214-rc1-hikey-20200213-647
git commit: 6ace76afa8ec0a1c445e766c7e1b86b8b551a94f
git describe: 4.4.214-rc1-hikey-20200213-647
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.214-rc1-hikey-20200213-647
No regressions (compared to build 4.4.214-rc1-hikey-20200213-646)
No fixes (compared to build 4.4.214-rc1-hikey-20200213-646)
Ran 1576 total tests in the following environments and test suites.
Environments
--------------
- hi6220-hikey - arm64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org