Commit graph

842,041 commits

Author SHA1 Message Date
Eric Dumazet
f3e92cb8e2 neigh: fix use-after-free read in pneigh_get_next
Nine years ago, I added RCU handling to neighbours, not pneighbours.
(pneigh are not commonly used)

Unfortunately I missed that /proc dump operations would use a
common entry and exit point : neigh_seq_start() and neigh_seq_stop()

We need to read_lock(tbl->lock) or risk use-after-free while
iterating the pneigh structures.

We might later convert pneigh to RCU and revert this patch.

sysbot reported :

BUG: KASAN: use-after-free in pneigh_get_next.isra.0+0x24b/0x280 net/core/neighbour.c:3158
Read of size 8 at addr ffff888097f2a700 by task syz-executor.0/9825

CPU: 1 PID: 9825 Comm: syz-executor.0 Not tainted 5.2.0-rc4+ #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
 __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 pneigh_get_next.isra.0+0x24b/0x280 net/core/neighbour.c:3158
 neigh_seq_next+0xdb/0x210 net/core/neighbour.c:3240
 seq_read+0x9cf/0x1110 fs/seq_file.c:258
 proc_reg_read+0x1fc/0x2c0 fs/proc/inode.c:221
 do_loop_readv_writev fs/read_write.c:714 [inline]
 do_loop_readv_writev fs/read_write.c:701 [inline]
 do_iter_read+0x4a4/0x660 fs/read_write.c:935
 vfs_readv+0xf0/0x160 fs/read_write.c:997
 kernel_readv fs/splice.c:359 [inline]
 default_file_splice_read+0x475/0x890 fs/splice.c:414
 do_splice_to+0x127/0x180 fs/splice.c:877
 splice_direct_to_actor+0x2d2/0x970 fs/splice.c:954
 do_splice_direct+0x1da/0x2a0 fs/splice.c:1063
 do_sendfile+0x597/0xd00 fs/read_write.c:1464
 __do_sys_sendfile64 fs/read_write.c:1525 [inline]
 __se_sys_sendfile64 fs/read_write.c:1511 [inline]
 __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1511
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4592c9
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f4aab51dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004592c9
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000246 R12: 00007f4aab51e6d4
R13: 00000000004c689d R14: 00000000004db828 R15: 00000000ffffffff

Allocated by task 9827:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_kmalloc mm/kasan/common.c:489 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:503
 __do_kmalloc mm/slab.c:3660 [inline]
 __kmalloc+0x15c/0x740 mm/slab.c:3669
 kmalloc include/linux/slab.h:552 [inline]
 pneigh_lookup+0x19c/0x4a0 net/core/neighbour.c:731
 arp_req_set_public net/ipv4/arp.c:1010 [inline]
 arp_req_set+0x613/0x720 net/ipv4/arp.c:1026
 arp_ioctl+0x652/0x7f0 net/ipv4/arp.c:1226
 inet_ioctl+0x2a0/0x340 net/ipv4/af_inet.c:926
 sock_do_ioctl+0xd8/0x2f0 net/socket.c:1043
 sock_ioctl+0x3ed/0x780 net/socket.c:1194
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 9824:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
 __cache_free mm/slab.c:3432 [inline]
 kfree+0xcf/0x220 mm/slab.c:3755
 pneigh_ifdown_and_unlock net/core/neighbour.c:812 [inline]
 __neigh_ifdown+0x236/0x2f0 net/core/neighbour.c:356
 neigh_ifdown+0x20/0x30 net/core/neighbour.c:372
 arp_ifdown+0x1d/0x21 net/ipv4/arp.c:1274
 inetdev_destroy net/ipv4/devinet.c:319 [inline]
 inetdev_event+0xa14/0x11f0 net/ipv4/devinet.c:1544
 notifier_call_chain+0xc2/0x230 kernel/notifier.c:95
 __raw_notifier_call_chain kernel/notifier.c:396 [inline]
 raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:403
 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1749
 call_netdevice_notifiers_extack net/core/dev.c:1761 [inline]
 call_netdevice_notifiers net/core/dev.c:1775 [inline]
 rollback_registered_many+0x9b9/0xfc0 net/core/dev.c:8178
 rollback_registered+0x109/0x1d0 net/core/dev.c:8220
 unregister_netdevice_queue net/core/dev.c:9267 [inline]
 unregister_netdevice_queue+0x1ee/0x2c0 net/core/dev.c:9260
 unregister_netdevice include/linux/netdevice.h:2631 [inline]
 __tun_detach+0xd8a/0x1040 drivers/net/tun.c:724
 tun_detach drivers/net/tun.c:741 [inline]
 tun_chr_close+0xe0/0x180 drivers/net/tun.c:3451
 __fput+0x2ff/0x890 fs/file_table.c:280
 ____fput+0x16/0x20 fs/file_table.c:313
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:185 [inline]
 exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:168
 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:279 [inline]
 do_syscall_64+0x58e/0x680 arch/x86/entry/common.c:304
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff888097f2a700
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 64-byte region [ffff888097f2a700, ffff888097f2a740)
The buggy address belongs to the page:
page:ffffea00025fca80 refcount:1 mapcount:0 mapping:ffff8880aa400340 index:0x0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea000250d548 ffffea00025726c8 ffff8880aa400340
raw: 0000000000000000 ffff888097f2a000 0000000100000020 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888097f2a600: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
 ffff888097f2a680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888097f2a700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff888097f2a780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888097f2a800: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc

Fixes: 767e97e1e0 ("neigh: RCU conversion of struct neighbour")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-16 14:15:58 -07:00
Eric Dumazet
2e05fcae83 tcp: fix compile error if !CONFIG_SYSCTL
tcp_tx_skb_cache_key and tcp_rx_skb_cache_key must be available
even if CONFIG_SYSCTL is not set.

Fixes: 0b7d7f6b22 ("tcp: add tcp_tx_skb_cache sysctl")
Fixes: ede61ca474 ("tcp: add tcp_rx_skb_cache sysctl")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-16 14:15:07 -07:00
Dexuan Cui
d424a2afd7 hv_sock: Suppress bogus "may be used uninitialized" warnings
gcc 8.2.0 may report these bogus warnings under some condition:

warning: ‘vnew’ may be used uninitialized in this function
warning: ‘hvs_new’ may be used uninitialized in this function

Actually, the 2 pointers are only initialized and used if the variable
"conn_from_host" is true. The code is not buggy here.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-16 14:00:51 -07:00
Ivan Vecera
718f4a2537 be2net: Fix number of Rx queues used for flow hashing
Number of Rx queues used for flow hashing returned by the driver is
incorrect and this bug prevents user to use the last Rx queue in
indirection table.

Let's say we have a NIC with 6 combined queues:

[root@sm-03 ~]# ethtool -l enp4s0f0
Channel parameters for enp4s0f0:
Pre-set maximums:
RX:             5
TX:             5
Other:          0
Combined:       6
Current hardware settings:
RX:             0
TX:             0
Other:          0
Combined:       6

Default indirection table maps all (6) queues equally but the driver
reports only 5 rings available.

[root@sm-03 ~]# ethtool -x enp4s0f0
RX flow hash indirection table for enp4s0f0 with 5 RX ring(s):
    0:      0     1     2     3     4     5     0     1
    8:      2     3     4     5     0     1     2     3
   16:      4     5     0     1     2     3     4     5
   24:      0     1     2     3     4     5     0     1
...

Now change indirection table somehow:

[root@sm-03 ~]# ethtool -X enp4s0f0 weight 1 1
[root@sm-03 ~]# ethtool -x enp4s0f0
RX flow hash indirection table for enp4s0f0 with 6 RX ring(s):
    0:      0     0     0     0     0     0     0     0
...
   64:      1     1     1     1     1     1     1     1
...

Now it is not possible to change mapping back to equal (default) state:

[root@sm-03 ~]# ethtool -X enp4s0f0 equal 6
Cannot set RX flow hash configuration: Invalid argument

Fixes: 594ad54a2c ("be2net: Add support for setting and getting rx flow hash options")
Reported-by: Tianhao <tizhao@redhat.com>
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-16 13:47:41 -07:00
Govindarajulu Varadarajan
36b2f61a42 net: handle 802.1P vlan 0 packets properly
When stack receives pkt: [802.1P vlan 0][802.1AD vlan 100][IPv4],
vlan_do_receive() returns false if it does not find vlan_dev. Later
__netif_receive_skb_core() fails to find packet type handler for
skb->protocol 801.1AD and drops the packet.

801.1P header with vlan id 0 should be handled as untagged packets.
This patch fixes it by checking if vlan_id is 0 and processes next vlan
header.

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-16 13:45:14 -07:00
Olof Johansson
80d1d46525 Fixes for omap variants
Three fixes mostly for dra7 SoC variants that have some devices disabled
 compared to the base SoC. These got broken by the change of making devices
 probe with ti-sysc interconnect target module and went unnnoticed for a
 while. And there is no clkcel bit for timer12 unlike timer1. Also included
 is a GPIO direction fix for phytec SDIO card detection.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEkgNvrZJU/QSQYIcQG9Q+yVyrpXMFAlz+CUURHHRvbnlAYXRv
 bWlkZS5jb20ACgkQG9Q+yVyrpXN0fA/6Avr8yF2fN/EyHhab6dK5r6WkxCmk0Dpg
 RnlunnQ+2dN5IDT5AbNpou/2kr/aEqnzQfzHez7eD7+JURllcpm7oUoiS6h6iWTK
 Koyau7BtFA9Zy5R9vXjITaAseKTlD4l/KF8coMvSiZ2fa/ApuP33BW+2edwv27EF
 jB44F01vGKkjpX8k3CsG2nrPzrhydLNAgEXHGTSXV9OU4nfgpE/LYhfTn7Cw63wr
 tCcAJdTCF9envRGd+m6uYWKbsjYbWYCywS17RqsMBGdcWeoFXYRR00fJfZ2dhPFO
 xEYhgNqyVU08VBASMOZTmMjUz5nlJPTPMISM9DPjD5XRmY9vby1kO1kZBOybKS4e
 oHj26sWhCqCpA5jAq+I3LcFHIxJDNITg2u06u58SxbZHml3Y5wFUGn+gvcjB5xuW
 k/ASGpawv3dA1MyfoCgZJrprdv0/YnFuVvW/TAa13cW/AUWseRyJcJlI6BI0cBPN
 GH/wTQkKERNo+ugclbGNlz27VELoL4lsiSJALp8UOLEOg80nxoXLMlwVs9lqCW0w
 Invewxaz00iDa0hjpdvuFiqwE67bC4I0wtS69NgR8BL+84UZmVj1oCdFA2njyell
 TPj15GJK4ofND2r4FvFY7lnpVOvt3EpaiQ1Cmvn5YXXsTovQ7OiOQkLbnTs/hTFI
 ekUIQgEuMq4=
 =g05K
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v5.2/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Fixes for omap variants

Three fixes mostly for dra7 SoC variants that have some devices disabled
compared to the base SoC. These got broken by the change of making devices
probe with ti-sysc interconnect target module and went unnnoticed for a
while. And there is no clkcel bit for timer12 unlike timer1. Also included
is a GPIO direction fix for phytec SDIO card detection.

* tag 'omap-for-v5.2/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: am335x phytec boards: Fix cd-gpios active level
  ARM: dts: dra72x: Disable usb4_tm target module
  ARM: dts: Drop bogus CLKSEL for timer12 on dra7

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:33:51 -07:00
Olof Johansson
d5d3652af1 DaVinci fixes for v5.2 kernel.
This addresses an issue with probe of IO expander on DA850 EVM. There is
 also a WARN_ON() fix on DA850 and DA830 devices.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJdA63xAAoJEGFBu2jqvgRNx8YP/1V8mA2qGQTwvU7/qv6BPXQs
 uPgN3zDJ5O+4k1vPJolxLzFq2o1ttFFEBz0uWjPkpKylNZWgmMwUgAkfU2/nbhwh
 PWXZzob/fGzydoxZHHY3yYqGQkRMIE0hgoKnm1/ByT1ErOewF/8SN6yxe/ylgLey
 e4LzEBh/anD1mZNqGyXiD3MAGS1lBx4iwM91S2aaZapLvzeSmPK/qkibs3U3x13u
 A97W+hmx+Oy5ZCYJCod5No9umP5MT++G5j/OaUQFC56VZdWEt/x+Sm6yCIyPNBks
 LhH5pKfkg6BMgMfL4v77QV/94eKiH7qeKeIYrS88wmoyvcPBUlTSJPaKWgHBZk2Q
 bsln3mdsWq/3ogmslz4GtPWn5jFIvyNOTTjCUd2iOparLU3Bjfe8Fwg67M/vGCXC
 NSr6fCxApp0IhVmgmQmOAv4UHoOGTOjmt//oUv4dn7NqpqaP8Hdt+KxDK6loHUjG
 uPcXjuf6oKIMeuwpinshIm3Ygv2sKmNxJf4Be2ZUDi5XEKpXWW1tIaJZevc1rLKT
 PWo5wCCSb8udZhF8BprmhWqqpUAjS6TdZVqC0i8z5rpL8da5OzWvlbMrZBprTcVA
 9Of39mXp93zVOTacCkagDab/Pw83JG9zdQ9VIb0lJvzEh+k4MqvVx4gmzXBJe1Gd
 GPVjR1GYWM07Jw4+vbDT
 =1gFV
 -----END PGP SIGNATURE-----

Merge tag 'davinci-fixes-for-v5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes

DaVinci fixes for v5.2 kernel.

This addresses an issue with probe of IO expander on DA850 EVM. There is
also a WARN_ON() fix on DA850 and DA830 devices.

* tag 'davinci-fixes-for-v5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci:
  ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
  ARM: davinci: da850-evm: call regulator_has_full_constraints()

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:33:13 -07:00
Olof Johansson
75d91ba475 mvebu fixes for 5.2 (part 1)
Fixing defconfig allowing to use Ethernet again on Armada 38x based
 boards
 -----BEGIN PGP SIGNATURE-----
 
 iF0EABECAB0WIQQYqXDMF3cvSLY+g9cLBhiOFHI71QUCXQNQDAAKCRALBhiOFHI7
 1dqXAJ9ght2djbWrvtPLbfr10y7kkYFQHgCfbupD05I+H4+aGx7pnIvdvZ21qYU=
 =SU1/
 -----END PGP SIGNATURE-----

Merge tag 'mvebu-fixes-5.2-1' of git://git.infradead.org/linux-mvebu into fixes

mvebu fixes for 5.2 (part 1)

Fixing defconfig allowing to use Ethernet again on Armada 38x based
boards

* tag 'mvebu-fixes-5.2-1' of git://git.infradead.org/linux-mvebu:
  ARM: mvebu_v7_defconfig: fix Ethernet on Clearfog

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:32:47 -07:00
Olof Johansson
5a55a16123 Texas Instruments AM65x fixes for v5.2
- Fix up a Kbuild warning when SOC_TI is not set
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEtQ6szHmfiBT7fujkyvq9MXlQGhEFAlz40JIQHHQta3Jpc3Rv
 QHRpLmNvbQAKCRDK+r0xeVAaEUWYD/9Ebsf9dHqBquzeeYPjcK5SmXRZCHA5wka+
 vsRAg+MvdhJ9z0ALGNgb60baivqR0xWcbffOequRVianMnArWpXctGtQzzxKv8uz
 C96ww9/+TZll13ZrPi70YZXUeT7R4FVh6qUmEuc/DLQwzVOgyOPJ4uu1kDvc/rQ6
 EYxRfY6HocD6kLnG/wXiclHtIopZq+EoxFbCF4aejqqiVm0Xx2wN4kdvHn2Uuzjd
 9wFNb5vbK9kL77WiNcSHHoiguFb1ZgKGjDxHdKmpw9ZryhPGSlpsHTmSnZhBNFBU
 0wJNJe6MMCRWE0jNy12zNSuML8592pHAydAgPdCHE+QphN2JfqdNbTOhiWof+cdm
 NR3Fn9H9iiCW+QoH38tKd8QGNtk29HKi8oT9N58WjvUXB8lZUv3Mk+Vlp4Y4W0C/
 Y1QYGNqzaH21O/mWJ3Pb3bSY7y3qLpvgtO5uL+EROALSTcffLBoOIoLG0PWZqv+h
 kBXczzHZq3Zr2juPr25Hw5sRBxJ51/aHLFLs47jGcfXae31qVEmOI3LYqG1mZlsV
 x8xfLLIhxPAKkhhBN3m3Dn4j2WytznAWRyxqalMZUKFRP28ir5s72WgfUtsrdfjY
 utCxUUmOKEUpvZ1KS2EQhvowCEw7VDvSVZAHCuSXf9MloW5EySe4db2E1HQvMrYA
 dAgbKEP9NA==
 =Guww
 -----END PGP SIGNATURE-----

Merge tag 'am654-fixes-for-v5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux into fixes

Texas Instruments AM65x fixes for v5.2

- Fix up a Kbuild warning when SOC_TI is not set

* tag 'am654-fixes-for-v5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux:
  arm64: arch_k3: Fix kconfig dependency warning

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:30:30 -07:00
Olof Johansson
9f22081ea2 This pull request contains Broadcom ARM-based SoCs Device Tree fixes for
5.2-rc1, please pull the following:
 
 - Florian fixes the remaining Broadcom DTS files to have a valid
 device_type = "memory" property which was missed during the removal of
 skeleton.dtsi
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAlzi3CQACgkQh9CWnEQH
 BwSFkg/+OJtdBwVrNwmXlw4B9di/oh1SRO8XgK+gn6siEVhlYr+qgyIRoKF0ZHcU
 SdQfq8vLisUnccY3IhFymhNrqdKnkuRgFLAQsY5tt0nhTKmZXRfeNlHiloKbjT2y
 bzkD4sA9J+QOawu1cskB8DNlgNHmUsdMN0eZLjaIvQtYB7e6XhxZu6U84O8wQk33
 gKM3+ukAS/MXyQOJt1MfbaGu/M30u+YPtWUqeueKQ5sqUlRum8GymgUXn9DngRv0
 t2eeBGXepwbs5LTMBKmeP/hQXvdSf6zaGO0UGzvp8v/k8Kxxf1oII54Nrk6aA2zy
 h+YFouiuRSO+NrYdFEJJq0ZoQ93YvDM+B31HIrGO1KZk72P4m6yjqstRD5jiS11o
 8OH2KQfv83xMuFA3IfKqw7NClSJn3FPYrSb6ZWSkuLq3xaPucytio2BtNLq2q611
 2EJJsAPp+xV6wh9pCr/gcBg3vsDbk9Vw8uJYMjTds6WGy62JqQvYBfTTjh6mXqWo
 kAVV2+cN0rOTABeFtbwU3xh5ygyVievzAEHhWWC1tHnCYJFlFpIackFWfqIvudm5
 ETMsTQsFZ/OKPkzzJlzKSZjnSrsS/oEqpSuG5SQoqrT/Ih6fy5UBrseNUwMKOPL8
 ch7XVLyPPkiYEkzhB7nFBkEeQoiuekcBFj/M5EnjA3J88Z7MZKA=
 =rECv
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-5.2/devicetree-fixes' of https://github.com/Broadcom/stblinux into fixes

This pull request contains Broadcom ARM-based SoCs Device Tree fixes for
5.2-rc1, please pull the following:

- Florian fixes the remaining Broadcom DTS files to have a valid
device_type = "memory" property which was missed during the removal of
skeleton.dtsi

* tag 'arm-soc/for-5.2/devicetree-fixes' of https://github.com/Broadcom/stblinux:
  ARM: dts: bcm: Add missing device_type = "memory" property

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:29:08 -07:00
Olof Johansson
6515a2ceac Fixes for omap variants for dra7 mmc voltage and boot issues
This series contains dra7 mmc voltage fixes, and fixes to the recent
 changes to probe devices with device tree data insteas of legacy
 platform data:
 
 - Two fixes for dra7 mmc that needs 1.8V mode disabled as in case of a
   reset, the bootrom will try to access the mmc card at 3.3V potentially
   damaging the card
 
 - Two regression fixes for am335x d_can. We must allow devices with no
   control registers for ti-sysc interconnect target module driver for
   at least d_can, and we remove the incorrect control registers for
   d_can. And we must configure the osc clock for d_can as otherwise
   register access may fail depending on the bootloader version
 
 - Four regression fixes for dra7 variant dts files to tag rtc and usb4
   as disabled for dra71x and dra76x. These SoC variants do not have
   these devices, and got accidentally enabled when the L4 interconnect
   got defined in the dra7-l4.dtsi for the dra7 SoC family
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEkgNvrZJU/QSQYIcQG9Q+yVyrpXMFAlzuLFwRHHRvbnlAYXRv
 bWlkZS5jb20ACgkQG9Q+yVyrpXM39Q/8CNz88ctxQupl8zqzAEq3Tr78Z9XdIlmR
 BEk3buRQmUZKd+v1M7k1aP97MFDaBjLM4qIEZRoT7WYuWSD04J6EzjCKOQrAMDMh
 cauv7X5ysNvyQNGUlEXxNIdFy5fB+jqfAqZ/R6dpiRAMXd7OtFMnBkyQR27WXyYM
 2hIVpGwGZJDatTyqdZo2/QW4vEktD/4kzs+iaojMDmePjsIw+engwa+/D0TrnXfk
 dhW5Ay+irME2+gepBeFOXVBRZNiXgl7Y7fgynMpgbYMxwfsbJiYUh2UF/myP7mMt
 bnyIwhRUr2jg4W5+PpCzt1KXh4jirdcREBW5SLWQNcmZ2WA1KklgKSUXcwgUPbAP
 hdgxyMRKFJFGrpCH3U6U9UBXOprO9Niumw8zEna/fQoY5XfN4GrnbZomqdyTon+6
 GzMivM1NnmMIUHd0EWrzxe2pbVLk2vNRH1x/dCvQ38HcnXaTH4gGWqbHZRxkUH7S
 ZkswHZQS32lOI7zK9EMlwfM5fa2QragnkH3e99CNH4ztr9cBs/p5ge2/ZRz0DOru
 vTEd1j69EMlvHyDjPtD3h+P4534hlEcclvHDrqINKQgWwn59zFy8LGgLL6YAT+n/
 cT1VJkWKCN2IPM0VXrFSmWIyQmplgevA1tF1/XdaYSs5NdNJOYXxTQsmludgq1il
 pQ1EK2psBPU=
 =Ajjk
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v5.2/fixes-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Fixes for omap variants for dra7 mmc voltage and boot issues

This series contains dra7 mmc voltage fixes, and fixes to the recent
changes to probe devices with device tree data insteas of legacy
platform data:

- Two fixes for dra7 mmc that needs 1.8V mode disabled as in case of a
  reset, the bootrom will try to access the mmc card at 3.3V potentially
  damaging the card

- Two regression fixes for am335x d_can. We must allow devices with no
  control registers for ti-sysc interconnect target module driver for
  at least d_can, and we remove the incorrect control registers for
  d_can. And we must configure the osc clock for d_can as otherwise
  register access may fail depending on the bootloader version

- Four regression fixes for dra7 variant dts files to tag rtc and usb4
  as disabled for dra71x and dra76x. These SoC variants do not have
  these devices, and got accidentally enabled when the L4 interconnect
  got defined in the dra7-l4.dtsi for the dra7 SoC family

* tag 'omap-for-v5.2/fixes-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: dra71x: Disable usb4_tm target module
  ARM: dts: dra71x: Disable rtc target module
  ARM: dts: dra76x: Disable usb4_tm target module
  ARM: dts: dra76x: Disable rtc target module
  ARM: dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values
  ARM: dts: am57xx-idk: Remove support for voltage switching for SD card
  bus: ti-sysc: Handle devices with no control registers
  ARM: dts: Configure osc clock for d_can on am335x

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:27:36 -07:00
Olof Johansson
4bded29983 i.MX fixes for 5.2:
- A build fix for soc-imx8 driver which needs SOC_BUS support.  To
    avoid dealing with the dependency for every single i.MX SoC bus
    driver, we selects at from architecture level.
  - A fix on i.MX SCU firmware driver to ensure SCU irq is enabled only
    after IPC is ready.
  - A regression fix on cpuidle-imx6sx driver, which causes some
    characters loss on serial communication.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJc50FAAAoJEFBXWFqHsHzOt4wIAJJ4MLXCMKj2oVWXimkF3DAF
 g9M7ridrarhPAXowuTYV4FuW7me7nPxr5VTmwVIJE23wEKdaOd7cg0tkmvMi0tG6
 3TlNwCsEjJx+9rtGF196SZfR9HinLziAc4x7Qcl88xlQTQEIptvx6AMPit7Gy0je
 MJ0PzLA1l+tazo7dXvMjZ+LkxlvLTSB/RuBciA8sgOvwsdbG1Azz/AduSLxO7e/T
 ZSmEElTluqIKVxH5sbVY0T7mxWat7l5As28nx27cWDHGPoDMOt/TWiCTAvFR0d6T
 m+bW6xcvy63Z2II1Er//ig4rwcmK1mcUv+3i63/sIkFxl9fa0H4WnTu67T+/mck=
 =zbC7
 -----END PGP SIGNATURE-----

Merge tag 'imx-fixes-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes

i.MX fixes for 5.2:
 - A build fix for soc-imx8 driver which needs SOC_BUS support.  To
   avoid dealing with the dependency for every single i.MX SoC bus
   driver, we selects at from architecture level.
 - A fix on i.MX SCU firmware driver to ensure SCU irq is enabled only
   after IPC is ready.
 - A regression fix on cpuidle-imx6sx driver, which causes some
   characters loss on serial communication.

* tag 'imx-fixes-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
  firmware: imx: SCU irq should ONLY be enabled after SCU IPC is ready
  arm64: imx: Fix build error without CONFIG_SOC_BUS

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:26:55 -07:00
Olof Johansson
9925a6d9b7 This pull request contains MAINTAINERS file update for Broadcom
ARM/ARM64 SoCs, please pull the following:
 
 - Stefan updates his email address under the BCM2835 entry
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAlzi6OsACgkQh9CWnEQH
 BwQ0NBAA6M9k7pS95OAcPVvYPQNr+C4d91oZnbPE6KTwRG1HJBu60+T+Yotk5bGb
 1Ub86vIARX/SFm6YAIcekyzYVLg2LbqJ7yK51eBDuj7LC8ZvLTKPJMVISoUWHCI4
 sLk7H0pNNElx1AHURpAB6/h1vlZVpnWdL3dpvH7MSTnzr0DSqORuDT4NXEXwp36V
 cTZh96yP7k0NM4nq74UxcDm2HteQJzUEYnQo+FUQBlzUdnsdTAo9HD4idRZQIAqA
 k9HE0pC/DsxdaqVZPF56od5+aXOfWZZV0EOkeeNMDUB4paMXWM6uaHe6HiNkgUNc
 hyQnUAbwT4R2ABwOQZVktnzleAta7WW0xEu8QFQwtr9SaTKl76bjRq4/oJL7Dvif
 TlR00HLCsiW6pbtZtHZENu3Rasu2uC65YZk6hwdwt5PVIlIapmxqHXSTDhra/2vR
 iTrwOak1Psw/+xFFV1qyKOuMkLO6DwZNz+XpHSKCyhgcZMPHOjokdkxMnmpUphM1
 q+vxzp5cA7oBKm2OwIo2/01d3nssWbsm1lHrHL37wBZ+czL9Zec8qTfkDnGltWnD
 Y9MCRouAVKnXqPaYZYLhjY6lG4y34tt2lG7vZQGyKwjC+c9IyvF0biiPj/crdiTg
 zWz8As8lUF1XeALzwFQV25WpWtjdu6e4G9ZFkkh5ldQsh008maA=
 =L52t
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-5.2/maintainers' of https://github.com/Broadcom/stblinux into fixes

This pull request contains MAINTAINERS file update for Broadcom
ARM/ARM64 SoCs, please pull the following:

- Stefan updates his email address under the BCM2835 entry

* tag 'arm-soc/for-5.2/maintainers' of https://github.com/Broadcom/stblinux:
  MAINTAINERS: Update Stefan Wahren email address

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:25:50 -07:00
Olof Johansson
c1d6f4adf4 This pull request contains Broadcom ARM/ARM64/MIPS SoCs device drivers
fixes for 5.2-rc1, please pull the following:
 
 - Florian fixes the biuctrl driver not to create an error condition/path
   upon unsupported CPU and also fixes the biuctrl driver writes to used
   a data barrier which is necessary given the HW block design
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAlzi3HcACgkQh9CWnEQH
 BwRX5xAA3w2lgnQhD5mHnD63Ah7YhUfJuXtA7HLbEGzZTRRbHNrrBxNYns7oMCMS
 NGclRQyUVjpxfypP+ApHiDDadN0nKX+my1TM6RCvxpHswe5CN81OJa1vNOzbgwl6
 QcqIqbr0f0jx5lxmyUZKdpweHNnr5tJd9vV4ezL/7XMO0+QYflNn9q2d2BfBFRw6
 ELKcQe3rOwh/bcotakK6d+pOLw3I9v+R1Or8/k9xlhdlLUbYPJnP6EQLNQi5QeSn
 ONFd9k2936fI16o+RK6cdiH/0hMl4CsrYCT86DDYOtvJJf0gmGr/1hXHQnqB4Joi
 wsNJri2lVspg3qVPtaICNZCAQFvkfMj6TfTRORyqdmnBOQkywVKBwhipK1azwluk
 88WunpHCyUUoBXgY8BH/SoUBlKHhz4MPhgNGWOHUbilH5BwHC9WYU9Wof87vZTOM
 pj8QhgIiPtLA7n/UsA4hPofNEYzuaY91IY2mrq78WNRq7xS+YOPza1Tg7jPbBM9L
 KKxPvC/3+ueScT11XU1ubELuYKYM9AnMvE0Cy63og9h+2Ijh2TVhLkWp0Puw88NV
 /QKgsDkDklFQnXyVoWJjB8FuvkfV/kT0lUIyJ+wLbJyNIb/LAX+hWZjUmEmqjwRo
 4jpoOzyxsM5sNAnczQ51LzdMCgyJZgQ/o1u9xlTidZVkDovwx7Y=
 =VOdD
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-5.2/drivers-fixes' of https://github.com/Broadcom/stblinux into fixes

This pull request contains Broadcom ARM/ARM64/MIPS SoCs device drivers
fixes for 5.2-rc1, please pull the following:

- Florian fixes the biuctrl driver not to create an error condition/path
  upon unsupported CPU and also fixes the biuctrl driver writes to used
  a data barrier which is necessary given the HW block design

* tag 'arm-soc/for-5.2/drivers-fixes' of https://github.com/Broadcom/stblinux:
  soc: bcm: brcmstb: biuctrl: Register writes require a barrier
  soc: brcmstb: Fix error path for unsupported CPUs

Signed-off-by: Olof Johansson <olof@lixom.net>
2019-06-16 13:24:59 -07:00
Linus Torvalds
9e0babf2c0 Linux 5.2-rc5 v5.2-rc5 2019-06-16 08:49:45 -10:00
Linus Torvalds
963172d9c7 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Thomas Gleixner:
 "The accumulated fixes from this and last week:

   - Fix vmalloc TLB flush and map range calculations which lead to
     stale TLBs, spurious faults and other hard to diagnose issues.

   - Use fault_in_pages_writable() for prefaulting the user stack in the
     FPU code as it's less fragile than the current solution

   - Use the PF_KTHREAD flag when checking for a kernel thread instead
     of current->mm as the latter can give the wrong answer due to
     use_mm()

   - Compute the vmemmap size correctly for KASLR and 5-Level paging.
     Otherwise this can end up with a way too small vmemmap area.

   - Make KASAN and 5-level paging work again by making sure that all
     invalid bits are masked out when computing the P4D offset. This
     worked before but got broken recently when the LDT remap area was
     moved.

   - Prevent a NULL pointer dereference in the resource control code
     which can be triggered with certain mount options when the
     requested resource is not available.

   - Enforce ordering of microcode loading vs. perf initialization on
     secondary CPUs. Otherwise perf tries to access a non-existing MSR
     as the boot CPU marked it as available.

   - Don't stop the resource control group walk early otherwise the
     control bitmaps are not updated correctly and become inconsistent.

   - Unbreak kgdb by returning 0 on success from
     kgdb_arch_set_breakpoint() instead of an error code.

   - Add more Icelake CPU model defines so depending changes can be
     queued in other trees"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback
  x86/kasan: Fix boot with 5-level paging and KASAN
  x86/fpu: Don't use current->mm to check for a kthread
  x86/kgdb: Return 0 from kgdb_arch_set_breakpoint()
  x86/resctrl: Prevent NULL pointer dereference when local MBM is disabled
  x86/resctrl: Don't stop walking closids when a locksetup group is found
  x86/fpu: Update kernel's FPU state before using for the fsave header
  x86/mm/KASLR: Compute the size of the vmemmap section properly
  x86/fpu: Use fault_in_pages_writeable() for pre-faulting
  x86/CPU: Add more Icelake model numbers
  mm/vmalloc: Avoid rare case of flushing TLB with weird arguments
  mm/vmalloc: Fix calculation of direct map addr range
2019-06-16 07:28:14 -10:00
Linus Torvalds
efba92d58f Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Thomas Gleixner:
 "A set of small fixes:

   - Repair the ktime_get_coarse() functions so they actually deliver
     what they are supposed to: tick granular time stamps. The current
     code missed to add the accumulated nanoseconds part of the
     timekeeper so the resulting granularity was 1 second.

   - Prevent the tracer from infinitely recursing into time getter
     functions in the arm architectured timer by marking these functions
     notrace

   - Fix a trivial compiler warning caused by wrong qualifier ordering"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timekeeping: Repair ktime_get_coarse*() granularity
  clocksource/drivers/arm_arch_timer: Don't trace count reader functions
  clocksource/drivers/timer-ti-dm: Change to new style declaration
2019-06-16 07:22:56 -10:00
Linus Torvalds
f763cf8e47 Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull RAS fixes from Thomas Gleixner:
 "Two small fixes for RAS:

   - Use a proper search algorithm to find the correct element in the
     CEC array. The replacement was a better choice than fixing the
     crash causes by the original search function with horrible duct
     tape.

   - Move the timer based decay function into thread context so it can
     actually acquire the mutex which protects the CEC array to prevent
     corruption"

* 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  RAS/CEC: Convert the timer callback to a workqueue
  RAS/CEC: Fix binary search function
2019-06-16 07:19:15 -10:00
Eric Dumazet
967c05aee4 tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
If mtu probing is enabled tcp_mtu_probing() could very well end up
with a too small MSS.

Use the new sysctl tcp_min_snd_mss to make sure MSS search
is performed in an acceptable range.

CVE-2019-11479 -- tcp mss hardcoded to 48

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Cc: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 18:47:31 -07:00
Eric Dumazet
5f3e2bf008 tcp: add tcp_min_snd_mss sysctl
Some TCP peers announce a very small MSS option in their SYN and/or
SYN/ACK messages.

This forces the stack to send packets with a very high network/cpu
overhead.

Linux has enforced a minimal value of 48. Since this value includes
the size of TCP options, and that the options can consume up to 40
bytes, this means that each segment can include only 8 bytes of payload.

In some cases, it can be useful to increase the minimal value
to a saner value.

We still let the default to 48 (TCP_MIN_SND_MSS), for compatibility
reasons.

Note that TCP_MAXSEG socket option enforces a minimal value
of (TCP_MIN_MSS). David Miller increased this minimal value
in commit c39508d6f1 ("tcp: Make TCP_MAXSEG minimum more correct.")
from 64 to 88.

We might in the future merge TCP_MIN_SND_MSS and TCP_MIN_MSS.

CVE-2019-11479 -- tcp mss hardcoded to 48

Signed-off-by: Eric Dumazet <edumazet@google.com>
Suggested-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 18:47:31 -07:00
Eric Dumazet
f070ef2ac6 tcp: tcp_fragment() should apply sane memory limits
Jonathan Looney reported that a malicious peer can force a sender
to fragment its retransmit queue into tiny skbs, inflating memory
usage and/or overflow 32bit counters.

TCP allows an application to queue up to sk_sndbuf bytes,
so we need to give some allowance for non malicious splitting
of retransmit queue.

A new SNMP counter is added to monitor how many times TCP
did not allow to split an skb if the allowance was exceeded.

Note that this counter might increase in the case applications
use SO_SNDBUF socket option to lower sk_sndbuf.

CVE-2019-11478 : tcp_fragment, prevent fragmenting a packet when the
	socket is already using more than half the allowed space

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 18:47:31 -07:00
Eric Dumazet
3b4929f65b tcp: limit payload size of sacked skbs
Jonathan Looney reported that TCP can trigger the following crash
in tcp_shifted_skb() :

	BUG_ON(tcp_skb_pcount(skb) < pcount);

This can happen if the remote peer has advertized the smallest
MSS that linux TCP accepts : 48

An skb can hold 17 fragments, and each fragment can hold 32KB
on x86, or 64KB on PowerPC.

This means that the 16bit witdh of TCP_SKB_CB(skb)->tcp_gso_segs
can overflow.

Note that tcp_sendmsg() builds skbs with less than 64KB
of payload, so this problem needs SACK to be enabled.
SACK blocks allow TCP to coalesce multiple skbs in the retransmit
queue, thus filling the 17 fragments to maximal capacity.

CVE-2019-11477 -- u16 overflow of TCP_SKB_CB(skb)->tcp_gso_segs

Fixes: 832d11c5cd ("tcp: Try to restore large SKBs while SACK processing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 18:47:31 -07:00
David S. Miller
1eb4169c1e Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Alexei Starovoitov says:

====================
pull-request: bpf 2019-06-15

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) fix stack layout of JITed x64 bpf code, from Alexei.

2) fix out of bounds memory access in bpf_sk_storage, from Arthur.

3) fix lpm trie walk, from Jonathan.

4) fix nested bpf_perf_event_output, from Matt.

5) and several other fixes.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 18:19:47 -07:00
David S. Miller
5db2e7c791 Revert "net: phylink: set the autoneg state in phylink_phy_change"
This reverts commit ef7bfa8472.

Russell King espressed some strong opposition to this
change, explaining that this is trying to make phylink
behave outside of how it has been designed.

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 18:10:30 -07:00
Matt Mullins
9594dc3c7e bpf: fix nested bpf tracepoints with per-cpu data
BPF_PROG_TYPE_RAW_TRACEPOINTs can be executed nested on the same CPU, as
they do not increment bpf_prog_active while executing.

This enables three levels of nesting, to support
  - a kprobe or raw tp or perf event,
  - another one of the above that irq context happens to call, and
  - another one in nmi context
(at most one of which may be a kprobe or perf event).

Fixes: 20b9d7ac48 ("bpf: avoid excessive stack usage for perf_sample_data")
Signed-off-by: Matt Mullins <mmullins@fb.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2019-06-15 16:33:35 -07:00
Arthur Fabre
85749218e3 bpf: Fix out of bounds memory access in bpf_sk_storage
bpf_sk_storage maps use multiple spin locks to reduce contention.
The number of locks to use is determined by the number of possible CPUs.
With only 1 possible CPU, bucket_log == 0, and 2^0 = 1 locks are used.

When updating elements, the correct lock is determined with hash_ptr().
Calling hash_ptr() with 0 bits is undefined behavior, as it does:

x >> (64 - bits)

Using the value results in an out of bounds memory access.
In my case, this manifested itself as a page fault when raw_spin_lock_bh()
is called later, when running the self tests:

./tools/testing/selftests/bpf/test_verifier 773 775
[   16.366342] BUG: unable to handle page fault for address: ffff8fe7a66f93f8

Force the minimum number of locks to two.

Signed-off-by: Arthur Fabre <afabre@cloudflare.com>
Fixes: 6ac99e8f23 ("bpf: Introduce bpf sk local storage")
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2019-06-15 14:37:56 -07:00
Stephen Barber
42f5cda5ea vsock/virtio: set SOCK_DONE on peer shutdown
Set the SOCK_DONE flag to match the TCP_CLOSING state when a peer has
shut down and there is nothing left to read.

This fixes the following bug:
1) Peer sends SHUTDOWN(RDWR).
2) Socket enters TCP_CLOSING but SOCK_DONE is not set.
3) read() returns -ENOTCONN until close() is called, then returns 0.

Signed-off-by: Stephen Barber <smbarber@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 14:01:09 -07:00
Linus Walleij
760c80b70b net: dsa: rtl8366: Fix up VLAN filtering
We get this regression when using RTL8366RB as part of a bridge
with OpenWrt:

WARNING: CPU: 0 PID: 1347 at net/switchdev/switchdev.c:291
	 switchdev_port_attr_set_now+0x80/0xa4
lan0: Commit of attribute (id=7) failed.
(...)
realtek-smi switch lan0: failed to initialize vlan filtering on this port

This is because it is trying to disable VLAN filtering
on VLAN0, as we have forgot to add 1 to the port number
to get the right VLAN in rtl8366_vlan_filtering(): when
we initialize the VLAN we associate VLAN1 with port 0,
VLAN2 with port 1 etc, so we need to add 1 to the port
offset.

Fixes: d8652956cf ("net: dsa: realtek-smi: Add Realtek SMI driver")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 13:40:30 -07:00
Ioana Ciornei
ef7bfa8472 net: phylink: set the autoneg state in phylink_phy_change
The phy_state field of phylink should carry only valid information
especially when this can be passed to the .mac_config callback.
Update the an_enabled field with the autoneg state in the
phylink_phy_change function.

Fixes: 9525ae8395 ("phylink: add phylink infrastructure")
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-15 13:29:32 -07:00
Linus Torvalds
e01e060fe0 platform-drivers-x86 for v5.2-3
Couple of driver enumeration issues have been fixed for Mellanox.
 ASUS laptops got a regression with backlight, which is fixed now.
 Dell computers got a wrong mode (tablet versus laptop) after resume,
 that is fixed now.
 
 The following is an automated git shortlog grouped by driver:
 
 asus-wmi:
  -  Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
 
 intel-vbtn:
  -  Report switch events when event wakes device
 
 mlx-platform:
  -  Fix parent device in i2c-mux-reg device registration
 
 platform/mellanox:
  -  mlxreg-hotplug: Add devm_free_irq call to remove flow
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqaflIX74DDDzMJJtb7wzTHR8rCgFAl0FJxcACgkQb7wzTHR8
 rCirlhAAqtceFp9MwqM3EaHkgurK/zMdq3dw62/TKFQfK6n0MaxYeE6G43BI7vBX
 XOoqNzOH3vDELGrZaP1DfmXpd6xASngd57p2qElHUYVqqVHgkqORcuIG5VJpzKsY
 1+GRey4eWJ114G16tpGi/MH+i44ro+Y+WJV/F0qbZHRDANenW/VCl1EDWYYf4SYX
 9QGKtQWkmGKMzklorhIHiTmrg3HoH08tddR5zStTr88Db8/hErnCtp8Xfm48cJ2J
 4mLEXuta0bh2W9WbG2prFL14FE12iawLjDQH67r1XpYtXb+LN1n/f7nq+AgdSTbH
 raEYkmhARGbxUjwuW46hDUBHFMkgRY4VG+VyBeGgAZAFtSTbyV5XtQIoV1541sW5
 7R4hjta8Gb/6r40L6izAyy23KVjI9wygt++fpSwRtf3/77yICMWHq3Uel4RuX/gX
 AWiyrGoOPb3BVwk+Hx1ME6HNMupV0OLTdS+eS0nUH1MTdidawAZ+xM+Y7D7BPJKd
 116lHuGlQcMzvP6r+cGAQiptzQvRP+NzuSfbY7H7YY+11dQGm4XULWbFC6q28EgY
 42REhawu0PXpMWUQRPK7ZcqFKiqE+nJiKmAuRpzpC9nlr3aaPKP6KCU0eBbYbeyZ
 N4rOB8y6MBqm2HgFL9yh9l0tcnMF7o9P5NU/aztZEndL6/LMxQA=
 =/H6h
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v5.2-3' of git://git.infradead.org/linux-platform-drivers-x86

Pull x86 platform driver fixes from Andy Shevchenko:

 - fix a couple of Mellanox driver enumeration issues

 - fix ASUS laptop regression with backlight

 - fix Dell computers that got a wrong mode (tablet versus laptop) after
   resume

* tag 'platform-drivers-x86-v5.2-3' of git://git.infradead.org/linux-platform-drivers-x86:
  platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove flow
  platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device registration
  platform/x86: intel-vbtn: Report switch events when event wakes device
  platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
2019-06-15 07:38:54 -10:00
Linus Torvalds
ff39074b1d USB fixes for 5.2-rc5
Here are some small USB driver fixes for 5.2-rc5
 
 Nothing major, just some small gadget fixes, usb-serial new device ids,
 a few new quirks, and some small fixes for some regressions that have
 been found after the big 5.2-rc1 merge.
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXQUTIg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykPJQCfZdiElw3N35bKVf7bhruxSb5DevEAni96uDM7
 jSOSEB/EWqxZEy0ZjU7J
 =cKx4
 -----END PGP SIGNATURE-----

Merge tag 'usb-5.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for 5.2-rc5

  Nothing major, just some small gadget fixes, usb-serial new device
  ids, a few new quirks, and some small fixes for some regressions that
  have been found after the big 5.2-rc1 merge.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-5.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: typec: Make sure an alt mode exist before getting its partner
  usb: gadget: udc: lpc32xx: fix return value check in lpc32xx_udc_probe()
  usb: gadget: dwc2: fix zlp handling
  usb: dwc2: Set actual frame number for completed ISOC transfer for none DDMA
  usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
  usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
  usb: phy: mxs: Disable external charger detect in mxs_phy_hw_init()
  usb: dwc2: Fix DMA cache alignment issues
  usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)
  USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
  USB: usb-storage: Add new ID to ums-realtek
  usb: typec: ucsi: ccg: fix memory leak in do_flash
  USB: serial: option: add Telit 0x1260 and 0x1261 compositions
  USB: serial: pl2303: add Allied Telesis VT-Kit3
  USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
2019-06-15 07:34:23 -10:00
Linus Torvalds
fa1827d773 powerpc fixes for 5.2 #4
One fix for a regression introduced by our 32-bit KASAN support, which broke
 booting on machines with "bootx" early debugging enabled.
 
 A fix for a bug which broke kexec on 32-bit, introduced by changes to the 32-bit
 STRICT_KERNEL_RWX support in v5.1.
 
 Finally two fixes going to stable for our THP split/collapse handling,
 discovered by Nick. The first fixes random crashes and/or corruption in guests
 under sufficient load.
 
 Thanks to:
   Nicholas Piggin, Christophe Leroy, Aaro Koskinen, Mathieu Malaterre.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJdBOivAAoJEFHr6jzI4aWA/T0P/1pmr4JLWzXOPQOGOwS2mmu5
 HhXBFuDflpGiWS31syOhfKhiE2qlwdIcGaclSo1wAgUnMKp+sxVEagF6DEt484r3
 DXs3eRyrGu5vQT7Q6yReuT3Kw2ZR474a5ob00WGAQosBKyJF4ZHWz16ETVWMdAMQ
 TknEEU3hOUnMWWIEvLnZOKT7eJcmzj5IYy1OtLHBjWiHHizGC8PSxdVhiRcD/O6R
 F6C7XrFb7RRj5ran6gxwMbcTvjgu922TSQPOCw93qnXYWLfvWDUXC4yCqY21oHnr
 b3zgJNgIdSoMYxE8pfOH7Y+eaJrbzgnhlS5OJNEz/4NOfGQnJXYcSF8QO6eeVoKM
 L2SkT1Ov+QMmZQjMC5e9OAe7DFHfM59RYFg11eaUqfiaObRsmwu8rqjngITV5Ede
 Ydq3W39XQkjB3aQ4qb0MnEBbVgyQ/y6/T5hoHRlvnb5byFk5Pd3jpub56sq87UGM
 M4GD3YdmT5eBqzGxApddyIiS839PZpdw7g/Ivtp2GYCtiNNZcJqaXvN7IwfcVF3c
 YJrCfhNTUJPjICIL9k9v2RQovGuGZqtM3BHc8PmyVvDxTqtEbh8B9GEg+QC58xp/
 s+UI2sEd/Vg6NVKluIJHau7aEmJlaxYIshqsIhYvPgJRN6KrFMhdfPNx7D+zMlu8
 nbM6Z1n2VFk9Cxb0vA9K
 =MXJI
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-5.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Michael Ellerman:
 "One fix for a regression introduced by our 32-bit KASAN support, which
  broke booting on machines with "bootx" early debugging enabled.

  A fix for a bug which broke kexec on 32-bit, introduced by changes to
  the 32-bit STRICT_KERNEL_RWX support in v5.1.

  Finally two fixes going to stable for our THP split/collapse handling,
  discovered by Nick. The first fixes random crashes and/or corruption
  in guests under sufficient load.

  Thanks to: Nicholas Piggin, Christophe Leroy, Aaro Koskinen, Mathieu
  Malaterre"

* tag 'powerpc-5.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/32s: fix booting with CONFIG_PPC_EARLY_DEBUG_BOOTX
  powerpc/64s: __find_linux_pte() synchronization vs pmdp_invalidate()
  powerpc/64s: Fix THP PMD collapse serialisation
  powerpc: Fix kexec failure on book3s/32
2019-06-15 07:29:32 -10:00
Linus Torvalds
6a71398c6a This includes the following fixes:
- Out of range read of stack trace output
  - Fix for NULL pointer dereference in trace_uprobe_create()
  - Fix to a livepatching / ftrace permission race in the module code
  - Fix for NULL pointer dereference in free_ftrace_func_mapper()
  - A couple of build warning clean ups
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCXQToxhQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qusmAP4/mmJPgsDchnu5ui0wB8BByzJlsPn8
 luXFDuqI4f34zgD+JCmeYbj5LLh98D9XkaaEgP4yz3yKsWeSdwWPCU0vTgo=
 =M/+E
 -----END PGP SIGNATURE-----

Merge tag 'trace-v5.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing fixes from Steven Rostedt:

 - Out of range read of stack trace output

 - Fix for NULL pointer dereference in trace_uprobe_create()

 - Fix to a livepatching / ftrace permission race in the module code

 - Fix for NULL pointer dereference in free_ftrace_func_mapper()

 - A couple of build warning clean ups

* tag 'trace-v5.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
  module: Fix livepatch/ftrace module text permissions race
  tracing/uprobe: Fix obsolete comment on trace_uprobe_create()
  tracing/uprobe: Fix NULL pointer dereference in trace_uprobe_create()
  tracing: Make two symbols static
  tracing: avoid build warning with HAVE_NOP_MCOUNT
  tracing: Fix out-of-range read in trace_stack_print()
2019-06-15 07:24:11 -10:00
Christophe Leroy
82f6e266f8 powerpc/32: fix build failure on book3e with KVM
Build failure was introduced by the commit identified below,
due to missed macro expension leading to wrong called function's name.

arch/powerpc/kernel/head_fsl_booke.o: In function `SystemCall':
arch/powerpc/kernel/head_fsl_booke.S:416: undefined reference to `kvmppc_handler_BOOKE_INTERRUPT_SYSCALL_SPRN_SRR1'
Makefile:1052: recipe for target 'vmlinux' failed

The called function should be kvmppc_handler_8_0x01B(). This patch fixes it.

Reported-by: Paul Mackerras <paulus@ozlabs.org>
Fixes: 1a4b739bbb ("powerpc/32: implement fast entry for syscalls on BOOKE")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2019-06-16 00:03:38 +10:00
Christophe Leroy
e8732ffa2e powerpc/booke: fix fast syscall entry on SMP
Use r10 instead of r9 to calculate CPU offset as r9 contains
the value from SRR1 which is used later.

Fixes: 1a4b739bbb ("powerpc/32: implement fast entry for syscalls on BOOKE")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2019-06-15 23:44:41 +10:00
Christophe Leroy
b7f8b440f3 powerpc/32s: fix initial setup of segment registers on secondary CPU
The patch referenced below moved the loading of segment registers
out of load_up_mmu() in order to do it earlier in the boot sequence.
However, the secondary CPU still needs it to be done when loading up
the MMU.

Reported-by: Erhard F. <erhard_f@mailbox.org>
Fixes: 215b823707 ("powerpc/32s: set up an early static hash table for KASAN")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2019-06-15 23:43:54 +10:00
Martin Schwidefsky
39c00378e3 Update default configuration
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:27:29 +02:00
Heiko Carstens
4ecf0a43e7 processor: get rid of cpu_relax_yield
stop_machine is the only user left of cpu_relax_yield. Given that it
now has special semantics which are tied to stop_machine introduce a
weak stop_machine_yield function which architectures can override, and
get rid of the generic cpu_relax_yield implementation.

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:55 +02:00
Martin Schwidefsky
38f2c691a4 s390: improve wait logic of stop_machine
The stop_machine loop to advance the state machine and to wait for all
affected CPUs to check-in calls cpu_relax_yield in a tight loop until
the last missing CPUs acknowledged the state transition.

On a virtual system where not all logical CPUs are backed by real CPUs
all the time it can take a while for all CPUs to check-in. With the
current definition of cpu_relax_yield a diagnose 0x44 is done which
tells the hypervisor to schedule *some* other CPU. That can be any
CPU and not necessarily one of the CPUs that need to run in order to
advance the state machine. This can lead to a pretty bad diagnose 0x44
storm until the last missing CPU finally checked-in.

Replace the undirected cpu_relax_yield based on diagnose 0x44 with a
directed yield. Each CPU in the wait loop will pick up the next CPU
in the cpumask of stop_machine. The diagnose 0x9c is used to tell the
hypervisor to run this next CPU instead of the current one. If there
is only a limited number of real CPUs backing the virtual CPUs we
end up with the real CPUs passed around in a round-robin fashion.

[heiko.carstens@de.ibm.com]:
    Use cpumask_next_wrap as suggested by Peter Zijlstra.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:52 +02:00
Heiko Carstens
7928260539 processor: remove spin_cpu_yield
spin_cpu_yield is unused, therefore remove it.

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:49 +02:00
Vasily Gorbik
b4e3133b65 s390/traps: simplify data exception handler
Simplify conditions and remove unnecessary variable in data exception
handler.

Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:45 +02:00
Halil Pasic
39c7dcb158 virtio/s390: make airq summary indicators DMA
The hypervisor needs to interact with the summary indicators, so these
need to be DMA memory as well (at least for protected virtualization
guests).

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:41 +02:00
Halil Pasic
48720ba568 virtio/s390: use DMA memory for ccw I/O and classic notifiers
Before virtio-ccw could get away with not using DMA API for the pieces of
memory it does ccw I/O with. With protected virtualization this has to
change, since the hypervisor needs to read and sometimes also write these
pieces of memory.

The hypervisor is supposed to poke the classic notifiers, if these are
used, out of band with regards to ccw I/O. So these need to be allocated
as DMA memory (which is shared memory for protected virtualization
guests).

Let us factor out everything from struct virtio_ccw_device that needs to
be DMA memory in a satellite that is allocated as such.

Note: The control blocks of I/O instructions do not need to be shared.
These are marshalled by the ultravisor.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:37 +02:00
Halil Pasic
22a4a639b9 virtio/s390: add indirection to indicators access
This will come in handy soon when we pull out the indicators from
virtio_ccw_device to a memory area that is shared with the hypervisor
(in particular for protected virtualization guests).

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:33 +02:00
Halil Pasic
01b3fb1ea0 virtio/s390: use cacheline aligned airq bit vectors
The flag AIRQ_IV_CACHELINE was recently added to airq_iv_create(). Let
us use it! We actually wanted the vector to span a cacheline all along.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:28 +02:00
Halil Pasic
b50623e5db s390/airq: use DMA memory for adapter interrupts
Protected virtualization guests have to use shared pages for airq
notifier bit vectors, because the hypervisor needs to write these bits.

Let us make sure we allocate DMA memory for the notifier bit vectors by
replacing the kmem_cache with a dma_cache and kalloc() with
cio_dma_zalloc().

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Sebastian Ott <sebott@linux.ibm.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:05 +02:00
Halil Pasic
37db8985b2 s390/cio: add basic protected virtualization support
As virtio-ccw devices are channel devices, we need to use the
dma area within the common I/O layer for any communication with
the hypervisor.

Note that we do not need to use that area for control blocks
directly referenced by instructions, e.g. the orb.

It handles neither QDIO in the common code, nor any device type specific
stuff (like channel programs constructed by the DASD driver).

An interesting side effect is that virtio structures are now going to
get allocated in 31 bit addressable storage.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Sebastian Ott <sebott@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:25:00 +02:00
Halil Pasic
bb99332a2b s390/cio: introduce DMA pools to cio
To support protected virtualization cio will need to make sure the
memory used for communication with the hypervisor is DMA memory.

Let us introduce one global pool for cio.

Our DMA pools are implemented as a gen_pool backed with DMA pages. The
idea is to avoid each allocation effectively wasting a page, as we
typically allocate much less than PAGE_SIZE.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Sebastian Ott <sebott@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:24:56 +02:00
Halil Pasic
64e1f0c531 s390/mm: force swiotlb for protected virtualization
On s390, protected virtualization guests have to use bounced I/O
buffers.  That requires some plumbing.

Let us make sure, any device that uses DMA API with direct ops correctly
is spared from the problems, that a hypervisor attempting I/O to a
non-shared page would bring.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Tested-by: Michael Mueller <mimu@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:24:51 +02:00
David Hildenbrand
45488c48e4 s390/crypto: sha: Use -ENODEV instead of -EOPNOTSUPP
Let's use the error value that is typically used if HW support is not
available when trying to load a module - this is also what systemd's
systemd-modules-load.service expects.

Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2019-06-15 12:24:48 +02:00