- Kernel - mailweb.openeuler.org

[PATCH 01/13] bpf: remove duplicated include from syscall.c
by Yang Yingliang 28 Nov '20

28 Nov '20

From: YueHaibing <yuehaibing(a)huawei.com> mainline inclusion from mainline-v4.20-rc1 commit efbaec89c642cd1d4977fc6df9923697e1598d4e category: other bugzilla: 43460 CVE: NA --------------------------------------- Remove duplicated include. Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: liuxin <liuxin264(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/bpf/syscall.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index cb473159a55c..3e9ff9897c7c 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -30,7 +30,6 @@ #include <linux/cred.h> #include <linux/timekeeping.h> #include <linux/ctype.h> -#include <linux/btf.h> #include <linux/nospec.h> #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \ -- 2.25.1

1 12

[PATCH 00/91] backport stable-4.19.160
by Yang Yingliang 28 Nov '20

28 Nov '20

Aaron Lewis (1): selftests: kvm: Fix the segment descriptor layout to match the actual layout Alejandro Concepcion Rodriguez (1): can: dev: can_restart(): post buffer from the right context Anant Thazhemadam (2): can: af_can: prevent potential access of uninitialized member in can_rcv() can: af_can: prevent potential access of uninitialized member in canfd_rcv() Arvind Sankar (1): efi/x86: Free efi_pgd with free_pages() Aya Levin (1): net/mlx4_core: Fix init_hca fields offset Brian O'Keefe (1): staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Can Guo (1): scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Chen Yu (1): x86/microcode/intel: Check patch signature before saving microcode for early loading Chen-Yu Tsai (4): Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Colin Ian King (1): can: peak_usb: fix potential integer overflow on shift of a int Dan Carpenter (2): Input: adxl34x - clean up a data type in adxl34x_probe() ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Darrick J. Wong (4): vfs: remove lockdep bogosity in __sb_start_write xfs: fix the minrecs logic when dealing with inode root child blocks xfs: strengthen rmap record flags checking xfs: revert "xfs: fix rmap key and record comparison functions" Dongli Zhang (1): page_frag: Recover from memory pressure Edwin Peer (1): bnxt_en: read EEPROM A2h address using page 0 Fabio Estevam (1): ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Felix Fietkau (2): mac80211: minstrel: remove deferred sampling code mac80211: minstrel: fix tx status processing corner case Filip Moc (1): net: usb: qmi_wwan: Set DTR quirk for MR400 Florian Fainelli (1): net: Have netpoll bring-up DSA management interface Fugang Duan (1): tty: serial: imx: keep console clocks always on Gerald Schaefer (1): mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman (1): Linux 4.19.160 Hans de Goede (3): ACPI: button: Add DMI quirk for Medion Akoya E2228T iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Heiner Kallweit (1): net: bridge: add missing counters to ndo_get_stats64 callback Ido Schimmel (1): mlxsw: core: Use variable timeout for EMAD retries Jan Kara (1): ext4: fix bogus warning in ext4_update_dx_flag() Jernej Skrabec (3): arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node Jianqun Xu (1): pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Jimmy Assarsson (1): can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits Joakim Tjernlund (1): ALSA: usb-audio: Add delay quirk for all Logitech USB devices Joel Stanley (2): net/ncsi: Fix netlink registration net: ftgmac100: Fix crash when removing driver Johannes Berg (1): mac80211: free sta in sta_info_insert_finish() on errors Leo Yan (1): perf lock: Don't free "lock_seq_stat" if read_count isn't zero Luo Meng (1): fail_function: Remove a redundant mutex unlock Marc Kleine-Budde (1): can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Max Filippov (1): xtensa: disable preemption around cache alias management calls Michał Mirosław (3): regulator: fix memory leak with repeated set_machine_constraints() regulator: avoid resolve_supply() infinite recursion regulator: workaround self-referent regulators Mickaël Salaün (2): ptrace: Set PF_SUPERPRIV when checking capability seccomp: Set PF_SUPERPRIV when checking capability Necip Fazil Yildiran (1): Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Nenad Peric (1): arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Nishanth Menon (1): regulator: ti-abb: Fix array out of bound read access on the first transition Paul Moore (2): netlabel: fix our progress tracking in netlbl_unlabel_staticlist() netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() PeiSen Hou (1): ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Randy Dunlap (1): MIPS: export has_transparent_hugepage() for modules Ryan Sharpelletti (1): tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Sean Nyekjaer (1): regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Sebastian Andrzej Siewior (1): atm: nicstar: Unmap DMA on send error Sergey Matyukevich (1): arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Srinivasa Rao Mandadapu (1): ASoC: qcom: lpass-platform: Fix memory leak Stefan Haberland (1): s390/dasd: fix null pointer dereference for ERP requests Subash Abhinov Kasiviswanathan (1): net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Sven Van Asbroeck (2): lan743x: fix issue causing intermittent kernel log warnings lan743x: prevent entire kernel HANG on open, for some platforms Takashi Iwai (1): ALSA: mixart: Fix mutex deadlock Takashi Sakamoto (1): ALSA: ctl: fix error path at adding user-defined element set Thomas Richter (1): s390/cpum_sf.c: fix file permission for cpum_sfb_size Tobias Waldekranz (1): net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Vamshi K Sthambamkadi (1): efivarfs: fix memory leak in efivarfs_create() Vladyslav Tarasiuk (1): net/mlx5: Disable QoS when min_rates on all VFs are zero Wang Hai (2): devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Will Deacon (1): arm64: psci: Avoid printing in cpu_psci_cpu_die() Wu Bo (1): can: m_can: m_can_handle_state_change(): fix state change Xie He (1): net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Xin Long (1): sctp: change to hold/put transport for proto_unreach_timer Xiongfeng Wang (1): drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Yi-Hung Wei (1): ip_tunnels: Set tunnel option flag when tunnel metadata is present Yicong Yang (1): libfs: fix error cast of negative value in simple_attr_write() Zhang Changzhong (4): ah6: fix error return code in ah6_input() net: b44: fix error return code in b44_init_one() qed: fix error return code in qed_iwarp_ll2_start() qlcnic: fix error return code in qlcnic_83xx_restart_hw() Zhang Qilong (2): can: ti_hecc: Fix memleak in ti_hecc_probe MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Makefile | 2 +- arch/arm/boot/dts/imx50-evk.dts | 2 +- arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +- .../boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- .../boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 -- .../arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +- .../boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +- .../dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +- .../dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +- .../dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +- .../allwinner/sun50i-h5-orangepi-prime.dts | 2 +- arch/arm64/kernel/psci.c | 5 +- arch/mips/alchemy/common/clock.c | 9 ++- arch/mips/mm/tlb-r4k.c | 1 + arch/s390/kernel/perf_cpum_sf.c | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 63 +++---------------- arch/x86/platform/efi/efi_64.c | 24 +++---- arch/xtensa/mm/cache.c | 14 +++++ drivers/acpi/button.c | 13 +++- drivers/atm/nicstar.c | 2 + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 + drivers/iio/accel/kxcjk-1013.c | 51 +++++++++++++-- drivers/input/misc/adxl34x.c | 2 +- drivers/input/touchscreen/Kconfig | 1 + drivers/net/can/dev.c | 2 +- drivers/net/can/m_can/m_can.c | 4 +- drivers/net/can/ti_hecc.c | 13 ++-- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/mcba_usb.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 +- drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++--- drivers/net/ethernet/broadcom/b44.c | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 4 ++ drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +- drivers/net/ethernet/mellanox/mlx4/fw.h | 4 +- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +- drivers/net/ethernet/microchip/lan743x_main.c | 13 ++-- drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 +++- .../ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 +- .../ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 ++ drivers/net/geneve.c | 3 +- drivers/net/usb/qmi_wwan.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/regulator/core.c | 38 ++++++----- drivers/regulator/pfuze100-regulator.c | 13 ++-- drivers/regulator/ti-abb-regulator.c | 12 +++- drivers/s390/block/dasd.c | 6 ++ drivers/scsi/ufs/ufshcd.c | 6 +- drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 1 + drivers/tty/serial/imx.c | 20 +----- fs/efivarfs/super.c | 1 + fs/ext4/ext4.h | 3 +- fs/libfs.c | 6 +- fs/super.c | 33 ++-------- fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++--- fs/xfs/scrub/bmap.c | 8 +-- fs/xfs/scrub/btree.c | 45 +++++++------ include/net/ip_tunnels.h | 7 ++- kernel/fail_function.c | 5 +- kernel/ptrace.c | 16 ++--- kernel/seccomp.c | 5 +- mm/huge_memory.c | 9 ++- mm/page_alloc.c | 5 ++ net/bridge/br_device.c | 1 + net/can/af_can.c | 38 ++++++++--- net/core/devlink.c | 6 +- net/core/netpoll.c | 22 +++++-- net/ipv4/inet_diag.c | 4 +- net/ipv4/tcp_bbr.c | 2 +- net/ipv6/ah6.c | 3 +- net/mac80211/rc80211_minstrel.c | 27 ++------ net/mac80211/rc80211_minstrel.h | 1 - net/mac80211/sta_info.c | 14 ++--- net/ncsi/ncsi-manage.c | 5 -- net/ncsi/ncsi-netlink.c | 22 +------ net/ncsi/ncsi-netlink.h | 3 - net/netlabel/netlabel_unlabeled.c | 17 +++-- net/sctp/input.c | 4 +- net/sctp/sm_sideeffect.c | 4 +- net/sctp/transport.c | 2 +- net/x25/af_x25.c | 1 + sound/core/control.c | 2 +- .../fireworks/fireworks_transaction.c | 4 +- sound/pci/hda/patch_realtek.c | 50 ++++++++++++++- sound/pci/mixart/mixart_core.c | 5 +- sound/soc/qcom/lpass-platform.c | 5 +- sound/usb/quirks.c | 10 +-- tools/perf/builtin-lock.c | 2 +- tools/testing/selftests/kvm/include/x86.h | 2 +- tools/testing/selftests/kvm/lib/x86.c | 3 +- 93 files changed, 517 insertions(+), 377 deletions(-) -- 2.25.1

1 91

[PATCH 01/14] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Yang Yingliang 28 Nov '20

28 Nov '20

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 13

kernel sig meeting
by openEuler conference 26 Nov '20

26 Nov '20

2 1

[PATCH 00/26] KVM RISC-V Support
by MingWang Li 25 Nov '20

25 Nov '20

From: Mingwang Li <limingwang(a)huawei.com> euleros inclusion category: feature bugzilla: NA CVE: NA This series adds initial KVM RISC-V support. Currently, we are able to boot Linux on RV64/RV32 Guest with multiple VCPUs. This series can be found in riscv_kvm_v15 branch at: https//github.com/avpatel/linux.git Link: https://gitee.com/openeuler/kernel/issues/I26X9V Alistair Francis (1): Revert "riscv: Use latest system call ABI" Anup Patel (20): RISC-V: Add fragmented config for debug options RISC-V: Enable CPU Hotplug in defconfigs RISC-V: Add Microchip PolarFire kconfig option RISC-V: Initial DTS for Microchip ICICLE board RISC-V: Enable drivers for Microchip PolarFire ICICLE board RISC-V: Add missing jump label initialization RISC-V: Add hypervisor extension related CSR defines RISC-V: Add initial skeletal KVM support RISC-V: KVM: Implement VCPU create, init and destroy functions RISC-V: KVM: Implement VCPU interrupts and requests handling RISC-V: KVM: Implement KVM_GET_ONE_REG/KVM_SET_ONE_REG ioctls RISC-V: KVM: Implement VCPU world-switch RISC-V: KVM: Handle MMIO exits for VCPU RISC-V: KVM: Handle WFI exits for VCPU RISC-V: KVM: Implement VMID allocator RISC-V: KVM: Implement stage2 page table programming RISC-V: KVM: Implement MMU notifiers RISC-V: KVM: Document RISC-V specific parts of KVM API RISC-V: KVM: Add MAINTAINERS entry RISC-V: Enable KVM for RV64 and RV32 Atish Patra (4): RISC-V: KVM: Add timer functionality RISC-V: KVM: FP lazy save/restore RISC-V: KVM: Implement ONE REG interface for FP registers RISC-V: KVM: Add SBI v0.1 support m34782 (1): Microchip Polarfire SoC Clock Driver Documentation/virt/kvm/api.rst | 193 +++- MAINTAINERS | 11 + arch/riscv/Kconfig | 2 + arch/riscv/Kconfig.socs | 7 + arch/riscv/Makefile | 2 + arch/riscv/boot/dts/Makefile | 1 + arch/riscv/boot/dts/microchip/Makefile | 2 + .../boot/dts/microchip/icicle-kit-es.dts | 307 +++++ arch/riscv/configs/defconfig | 30 +- arch/riscv/configs/extra_debug.config | 21 + arch/riscv/configs/rv32_defconfig | 26 +- arch/riscv/include/asm/csr.h | 89 ++ arch/riscv/include/asm/kvm_host.h | 279 +++++ arch/riscv/include/asm/kvm_types.h | 7 + arch/riscv/include/asm/kvm_vcpu_timer.h | 44 + arch/riscv/include/asm/pgtable-bits.h | 1 + arch/riscv/include/uapi/asm/kvm.h | 128 +++ arch/riscv/include/uapi/asm/unistd.h | 5 +- arch/riscv/kernel/asm-offsets.c | 156 +++ arch/riscv/kernel/setup.c | 1 + arch/riscv/kvm/Kconfig | 36 + arch/riscv/kvm/Makefile | 15 + arch/riscv/kvm/main.c | 118 ++ arch/riscv/kvm/mmu.c | 860 ++++++++++++++ arch/riscv/kvm/tlb.S | 74 ++ arch/riscv/kvm/vcpu.c | 1012 +++++++++++++++++ arch/riscv/kvm/vcpu_exit.c | 701 ++++++++++++ arch/riscv/kvm/vcpu_sbi.c | 173 +++ arch/riscv/kvm/vcpu_switch.S | 400 +++++++ arch/riscv/kvm/vcpu_timer.c | 225 ++++ arch/riscv/kvm/vm.c | 81 ++ arch/riscv/kvm/vmid.c | 120 ++ drivers/clk/Kconfig | 5 + drivers/clk/Makefile | 1 + drivers/clk/microchip/Makefile | 2 + drivers/clk/microchip/clk-pfsoc.c | 508 +++++++++ drivers/clocksource/timer-riscv.c | 8 + include/clocksource/timer-riscv.h | 16 + include/uapi/linux/kvm.h | 8 + 39 files changed, 5621 insertions(+), 54 deletions(-) create mode 100644 arch/riscv/boot/dts/microchip/Makefile create mode 100644 arch/riscv/boot/dts/microchip/icicle-kit-es.dts create mode 100644 arch/riscv/configs/extra_debug.config create mode 100644 arch/riscv/include/asm/kvm_host.h create mode 100644 arch/riscv/include/asm/kvm_types.h create mode 100644 arch/riscv/include/asm/kvm_vcpu_timer.h create mode 100644 arch/riscv/include/uapi/asm/kvm.h create mode 100644 arch/riscv/kvm/Kconfig create mode 100644 arch/riscv/kvm/Makefile create mode 100644 arch/riscv/kvm/main.c create mode 100644 arch/riscv/kvm/mmu.c create mode 100644 arch/riscv/kvm/tlb.S create mode 100644 arch/riscv/kvm/vcpu.c create mode 100644 arch/riscv/kvm/vcpu_exit.c create mode 100644 arch/riscv/kvm/vcpu_sbi.c create mode 100644 arch/riscv/kvm/vcpu_switch.S create mode 100644 arch/riscv/kvm/vcpu_timer.c create mode 100644 arch/riscv/kvm/vm.c create mode 100644 arch/riscv/kvm/vmid.c create mode 100644 drivers/clk/microchip/clk-pfsoc.c create mode 100644 include/clocksource/timer-riscv.h -- 2.19.1

1 26

[PATCH 0/7] fixes CVE-2020-4788
by Yang Yingliang 24 Nov '20

24 Nov '20

Andrew Donnellan (1): powerpc: Fix __clear_user() with KUAP enabled Christophe Leroy (2): powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends Daniel Axtens (1): powerpc/64s: move some exception handlers out of line Nicholas Piggin (3): powerpc/64s: flush L1D on kernel entry powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses .../admin-guide/kernel-parameters.txt | 7 + .../powerpc/include/asm/book3s/64/kup-radix.h | 22 +++ arch/powerpc/include/asm/exception-64s.h | 9 +- arch/powerpc/include/asm/feature-fixups.h | 19 +++ arch/powerpc/include/asm/futex.h | 4 + arch/powerpc/include/asm/kup.h | 40 +++++ arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + arch/powerpc/include/asm/uaccess.h | 147 ++++++++++++++---- arch/powerpc/kernel/exceptions-64s.S | 96 +++++++----- arch/powerpc/kernel/setup_64.c | 122 ++++++++++++++- arch/powerpc/kernel/vmlinux.lds.S | 14 ++ arch/powerpc/lib/checksum_wrappers.c | 4 + arch/powerpc/lib/feature-fixups.c | 104 +++++++++++++ arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/platforms/powernv/setup.c | 17 ++ arch/powerpc/platforms/pseries/setup.c | 8 + 18 files changed, 553 insertions(+), 81 deletions(-) create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h -- 2.25.1

1 7

[PATCH 00/14] backport stable-4.19.159
by Yang Yingliang 23 Nov '20

23 Nov '20

Andrew Donnellan (1): powerpc: Fix __clear_user() with KUAP enabled Christophe Leroy (3): powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends powerpc/8xx: Always fault when _PAGE_ACCESSED is not set Daniel Axtens (1): powerpc/64s: move some exception handlers out of line David Edmondson (1): KVM: x86: clflushopt should be treated as a no-op by emulation Greg Kroah-Hartman (1): Linux 4.19.159 Johannes Berg (1): mac80211: always wind down STA state Nicholas Piggin (3): powerpc/64s: flush L1D on kernel entry powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses Nick Desaulniers (1): ACPI: GED: fix -Wformat Salvatore Bonaccorso (1): Revert "perf cs-etm: Move definition of 'traceid_list' global variable from header file" Zhang Changzhong (1): can: proc: can_remove_proc(): silence remove_proc_entry warning .../admin-guide/kernel-parameters.txt | 7 + Makefile | 2 +- .../powerpc/include/asm/book3s/64/kup-radix.h | 22 +++ arch/powerpc/include/asm/exception-64s.h | 9 +- arch/powerpc/include/asm/feature-fixups.h | 19 +++ arch/powerpc/include/asm/futex.h | 4 + arch/powerpc/include/asm/kup.h | 40 +++++ arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + arch/powerpc/include/asm/uaccess.h | 147 ++++++++++++++---- arch/powerpc/kernel/exceptions-64s.S | 96 +++++++----- arch/powerpc/kernel/head_8xx.S | 8 +- arch/powerpc/kernel/setup_64.c | 122 ++++++++++++++- arch/powerpc/kernel/vmlinux.lds.S | 14 ++ arch/powerpc/lib/checksum_wrappers.c | 4 + arch/powerpc/lib/feature-fixups.c | 104 +++++++++++++ arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/platforms/powernv/setup.c | 17 ++ arch/powerpc/platforms/pseries/setup.c | 8 + arch/x86/kvm/emulate.c | 8 +- drivers/acpi/evged.c | 2 +- net/can/proc.c | 6 +- net/mac80211/sta_info.c | 18 +++ tools/perf/util/cs-etm.c | 3 - tools/perf/util/cs-etm.h | 3 + 26 files changed, 589 insertions(+), 95 deletions(-) create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h -- 2.25.1

1 14

[PATCH] vt: Disable KD_FONT_OP_COPY
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> stable inclusion from linux-4.19.156 commit 6612b754ac0c85ca8b1181b5d3ea4461a8c1bbcb CVE: CVE-2020-28974 -------------------------------- commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 upstream. It's buggy: On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote: > We recently discovered a slab-out-of-bounds read in fbcon in the latest > kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that > "fbcon_do_set_font" did not handle "vc->vc_font.data" and > "vc->vc_font.height" correctly, and the patch > <https://lkml.org/lkml/2020/9/27/223> for VT_RESIZEX can't handle this > issue. > > Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and > use KD_FONT_OP_SET again to set a large font.height for tty1. After that, > we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data > in "fbcon_do_set_font", while tty1 retains the original larger > height. Obviously, this will cause an out-of-bounds read, because we can > access a smaller vc_font.data with a larger vc_font.height. Further there was only one user ever. - Android's loadfont, busybox and console-tools only ever use OP_GET and OP_SET - fbset documentation only mentions the kernel cmdline font: option, not anything else. - systemd used OP_COPY before release 232 published in Nov 2016 Now unfortunately the crucial report seems to have gone down with gmane, and the commit message doesn't say much. But the pull request hints at OP_COPY being broken https://github.com/systemd/systemd/pull/3651 So in other words, this never worked, and the only project which foolishly every tried to use it, realized that rather quickly too. Instead of trying to fix security issues here on dead code by adding missing checks, fix the entire thing by removing the functionality. Note that systemd code using the OP_COPY function ignored the return value, so it doesn't matter what we're doing here really - just in case a lone server somewhere happens to be extremely unlucky and running an affected old version of systemd. The relevant code from font_copy_to_all_vcs() in systemd was: /* copy font from active VT, where the font was uploaded to */ cfo.op = KD_FONT_OP_COPY; cfo.height = vcs.v_active-1; /* tty1 == index 0 */ (void) ioctl(vcfd, KDFONTOP, &cfo); Note this just disables the ioctl, garbage collecting the now unused callbacks is left for -next. v2: Tetsuo found the old mail, which allowed me to find it on another archive. Add the link too. Acked-by: Peilin Ye <yepeilin.cs(a)gmail.com> Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com> References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html References: https://github.com/systemd/systemd/pull/3651 Cc: Greg KH <greg(a)kroah.com> Cc: Peilin Ye <yepeilin.cs(a)gmail.com> Cc: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/vt.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 758f522f331e..13ea0579f104 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4574,27 +4574,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) return rc; } -static int con_font_copy(struct vc_data *vc, struct console_font_op *op) -{ - int con = op->height; - int rc; - - - console_lock(); - if (vc->vc_mode != KD_TEXT) - rc = -EINVAL; - else if (!vc->vc_sw->con_font_copy) - rc = -ENOSYS; - else if (con < 0 || !vc_cons_allocated(con)) - rc = -ENOTTY; - else if (con == vc->vc_num) /* nothing to do */ - rc = 0; - else - rc = vc->vc_sw->con_font_copy(vc, con); - console_unlock(); - return rc; -} - int con_font_op(struct vc_data *vc, struct console_font_op *op) { switch (op->op) { @@ -4605,7 +4584,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) case KD_FONT_OP_SET_DEFAULT: return con_font_default(vc, op); case KD_FONT_OP_COPY: - return con_font_copy(vc, op); + /* was buggy and never really used */ + return -EINVAL; } return -ENOSYS; } -- 2.25.1

1 0

[PATCH 1/3] fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Peilin Ye <yepeilin.cs(a)gmail.com> stable inclusion from linux-4.19.151 commit 7b9eaa7241ea2cfa580b854d461be72107a4b35c CVE: CVE-2020-28915 It's prepare for fixing CVE-2020-28915. -------------------------------- commit bb0890b4cd7f8203e3aa99c6d0f062d6acdaad27 upstream. drivers/video/console/newport_con.c is borrowing FONT_EXTRA_WORDS macros from drivers/video/fbdev/core/fbcon.h. To keep things simple, move all definitions into <linux/font.h>. Since newport_con now uses four extra words, initialize the fourth word in newport_set_font() properly. Cc: stable(a)vger.kernel.org Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/7fb8bc9b0abc676ada6b7ac0e0bd4… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/console/newport_con.c | 7 +------ drivers/video/fbdev/core/fbcon.h | 7 ------- drivers/video/fbdev/core/fbcon_rotate.c | 1 + drivers/video/fbdev/core/tileblit.c | 1 + include/linux/font.h | 8 ++++++++ 5 files changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c index 7f2526b43b33..46a6e6568994 100644 --- a/drivers/video/console/newport_con.c +++ b/drivers/video/console/newport_con.c @@ -33,12 +33,6 @@ #define FONT_DATA ((unsigned char *)font_vga_8x16.data) -/* borrowed from fbcon.c */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FONT_EXTRA_WORDS 3 - static unsigned char *font_data[MAX_NR_CONSOLES]; static struct newport_regs *npregs; @@ -519,6 +513,7 @@ static int newport_set_font(int unit, struct console_font *op) FNTSIZE(new_data) = size; FNTCHARCNT(new_data) = op->charcount; REFCOUNT(new_data) = 0; /* usage counter */ + FNTSUM(new_data) = 0; p = new_data; for (i = 0; i < op->charcount; i++) { diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index ac11200fd2d5..609280281a47 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -152,13 +152,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc, #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) -/* Font */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FNTSUM(fd) (((int *)(fd))[-4]) -#define FONT_EXTRA_WORDS 4 - /* * Scroll Method */ diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c index c0d445294aa7..ac72d4f85f7d 100644 --- a/drivers/video/fbdev/core/fbcon_rotate.c +++ b/drivers/video/fbdev/core/fbcon_rotate.c @@ -14,6 +14,7 @@ #include <linux/fb.h> #include <linux/vt_kern.h> #include <linux/console.h> +#include <linux/font.h> #include <asm/types.h> #include "fbcon.h" #include "fbcon_rotate.h" diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c index eb664dbf96f6..adff8d6ffe6f 100644 --- a/drivers/video/fbdev/core/tileblit.c +++ b/drivers/video/fbdev/core/tileblit.c @@ -13,6 +13,7 @@ #include <linux/fb.h> #include <linux/vt_kern.h> #include <linux/console.h> +#include <linux/font.h> #include <asm/types.h> #include "fbcon.h" diff --git a/include/linux/font.h b/include/linux/font.h index d6821769dd1e..0a3639a00b3a 100644 --- a/include/linux/font.h +++ b/include/linux/font.h @@ -57,4 +57,12 @@ extern const struct font_desc *get_default_font(int xres, int yres, /* Max. length for the name of a predefined font */ #define MAX_FONT_NAME 32 +/* Extra word getters */ +#define REFCOUNT(fd) (((int *)(fd))[-1]) +#define FNTSIZE(fd) (((int *)(fd))[-2]) +#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +#define FNTSUM(fd) (((int *)(fd))[-4]) + +#define FONT_EXTRA_WORDS 4 + #endif /* _VIDEO_FONT_H */ -- 2.25.1

1 2

[PATCH] speakup: Do not let the line discipline be used several times
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v5.10 commit d4122754442799187d5d537a9c039a49a67e57f1 category: bugfix bugzilla: NA CVE: CVE-2020-28941 -------------------------------- Speakup has only one speakup_tty variable to store the tty it is managing. This makes sense since its codebase currently assumes that there is only one user who controls the screen reading. That however means that we have to forbid using the line discipline several times, otherwise the second closure would try to free a NULL ldisc_data, leading to general protection fault: 0000 [#1] SMP KASAN PTI RIP: 0010:spk_ttyio_ldisc_close+0x2c/0x60 Call Trace: tty_ldisc_release+0xa2/0x340 tty_release_struct+0x17/0xd0 tty_release+0x9d9/0xcc0 __fput+0x231/0x740 task_work_run+0x12c/0x1a0 do_exit+0x9b5/0x2230 ? release_task+0x1240/0x1240 ? __do_page_fault+0x562/0xa30 do_group_exit+0xd5/0x2a0 __x64_sys_exit_group+0x35/0x40 do_syscall_64+0x89/0x2b0 ? page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Cc: stable(a)vger.kernel.org Reported-by: 秦世松 <qinshisong1205(a)gmail.com> Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Tested-by: Shisong Qin <qinshisong1205(a)gmail.com> Link: https://lore.kernel.org/r/20201110183541.fzgnlwhjpgqzjeth@function Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/accessibility/speakup/spk_ttyio.c [yyl: spk_ttyio.c is in drivers/staging/ in kernel-4.19] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/staging/speakup/spk_ttyio.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c index 93742dbdee77..6c754ddf1257 100644 --- a/drivers/staging/speakup/spk_ttyio.c +++ b/drivers/staging/speakup/spk_ttyio.c @@ -49,15 +49,25 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty) if (tty->ops->write == NULL) return -EOPNOTSUPP; + + mutex_lock(&speakup_tty_mutex); + if (speakup_tty) { + mutex_unlock(&speakup_tty_mutex); + return -EBUSY; + } speakup_tty = tty; ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL); - if (!ldisc_data) + if (!ldisc_data) { + speakup_tty = NULL; + mutex_unlock(&speakup_tty_mutex); return -ENOMEM; + } sema_init(&ldisc_data->sem, 0); ldisc_data->buf_free = true; speakup_tty->disc_data = ldisc_data; + mutex_unlock(&speakup_tty_mutex); return 0; } -- 2.25.1

1 0