Evolution-X-Devices/kernel_xiaomi_sm8150
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'ASB-2023-09-05_4.14-stable' of https://android.googlesource.com/kernel/common into android13-4.14-msmnile

Browse Source 
https://source.android.com/docs/security/bulletin/2023-09-01

* tag 'ASB-2023-09-05_4.14-stable' of https://android.googlesource.com/kernel/common:
  Linux 4.14.325
  Revert "ARM: ep93xx: fix missing-prototype warnings"
  Revert "MIPS: Alchemy: fix dbdma2"
  Linux 4.14.324
  dma-buf/sw_sync: Avoid recursive lock during fence signal
  scsi: core: raid_class: Remove raid_component_add()
  scsi: snic: Fix double free in snic_tgt_create()
  rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
  media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
  lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
  batman-adv: Fix batadv_v_ogm_aggr_send memory leak
  batman-adv: Fix TT global entry leak when client roamed back
  batman-adv: Do not get eth header before batadv_check_management_packet
  batman-adv: Trigger events for auto adjusted MTU
  ibmveth: Use dcbf rather than dcbfl
  ipvs: fix racy memcpy in proc_do_sync_threshold
  ipvs: Improve robustness to the ipvs sysctl
  igb: Avoid starting unnecessary workqueues
  sock: annotate data-races around prot->memory_pressure
  tracing: Fix memleak due to race between current_tracer and trace
  net: phy: broadcom: stub c45 read/write for 54810
  net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
  net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
  af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  ASoC: rt5665: add missed regulator_bulk_disable
  netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
  test_firmware: prevent race conditions by a correct implementation of locking
  binder: fix memory leak in binder_init()
  serial: 8250: Fix oops for port->pm on uart_change_pm()
  mmc: wbsd: fix double mmc_free_host() in wbsd_init()
  cifs: Release folio lock on fscache read hit.
  ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
  net: do not allow gso_size to be set to GSO_BY_FRAGS
  sock: Fix misuse of sk_under_memory_pressure()
  i40e: fix misleading debug logs
  team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  netfilter: nft_dynset: disallow object maps
  xfrm: add NULL check in xfrm_update_ae_params
  ip_vti: fix potential slab-use-after-free in decode_session6
  ip6_vti: fix slab-use-after-free in decode_session6
  net: af_key: fix sadb_x_filter validation
  net: xfrm: Fix xfrm_address_filter OOB read
  fbdev: mmp: fix value check in mmphw_probe()
  drm/amdgpu: Fix potential fence use-after-free v2
  Bluetooth: L2CAP: Fix use-after-free
  pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
  gfs2: Fix possible data races in gfs2_show_options()
  media: platform: mediatek: vpu: fix NULL ptr dereference
  media: v4l2-mem2mem: add lock to protect parameter num_rdy
  FS: JFS: Check for read-only mounted filesystem in txBegin
  FS: JFS: Fix null-ptr-deref Read in txBegin
  MIPS: dec: prom: Address -Warray-bounds warning
  fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
  udf: Fix uninitialized array access for some pathnames
  quota: fix warning in dqgrab()
  quota: Properly disable quotas when add_dquot_ref() fails
  ALSA: emu10k1: roll up loops in DSP setup code for Audigy
  drm/radeon: Fix integer overflow in radeon_cs_parser_init
  lib/mpi: Eliminate unused umul_ppmm definitions for MIPS
  UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer
  UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
  UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
  Linux 4.14.323
  alpha: remove __init annotation from exported page_is_ram()
  scsi: core: Fix possible memory leak if device_add() fails
  scsi: snic: Fix possible memory leak if device_add() fails
  scsi: 53c700: Check that command slot is not NULL
  scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
  scsi: core: Fix legacy /proc parsing buffer overflow
  netfilter: nf_tables: report use refcount overflow
  btrfs: don't stop integrity writeback too early
  IB/hfi1: Fix possible panic during hotplug remove
  drivers: net: prevent tun_build_skb() to exceed the packet size limit
  dccp: fix data-race around dp->dccps_mss_cache
  bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
  net/packet: annotate data-races around tp->status
  drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
  x86: Move gds_ucode_mitigated() declaration to header
  x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
  usb: dwc3: Properly handle processing of pending events
  usb-storage: alauda: Fix uninit-value in alauda_check_media()
  iio: cros_ec: Fix the allocation size for cros_ec_command
  test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
  nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
  radix tree test suite: fix incorrect allocation size for pthreads
  dmaengine: pl330: Return DMA_PAUSED when transaction is paused
  ipv6: adjust ndisc_is_useropt() to also return true for PIO
  mmc: moxart: read scr register without changing byte order
  sparc: fix up arch_cpu_finalize_init() build breakage.
  Linux 4.14.322
  drm/edid: fix objtool warning in drm_cvt_modes()
  mtd: rawnand: omap_elm: Fix incorrect type in assignment
  test_firmware: fix a memory leak with reqs buffer
  ext2: Drop fragment support
  net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
  Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  fs/sysv: Null check to prevent null-ptr-deref bug
  USB: zaurus: Add ID for A-300/B-500/C-700
  libceph: fix potential hang in ceph_osdc_notify()
  loop: Select I/O scheduler 'none' from inside add_disk()
  tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
  tcp_metrics: annotate data-races around tm->tcpm_net
  tcp_metrics: annotate data-races around tm->tcpm_vals[]
  tcp_metrics: annotate data-races around tm->tcpm_lock
  tcp_metrics: annotate data-races around tm->tcpm_stamp
  tcp_metrics: fix addr_same() helper
  ip6mr: Fix skb_under_panic in ip6mr_cache_report()
  net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
  net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
  net: add missing data-race annotation for sk_ll_usec
  net: add missing data-race annotations around sk->sk_peek_off
  perf test uprobe_from_different_cu: Skip if there is no gcc
  net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
  word-at-a-time: use the same return type for has_zero regardless of endianness
  perf: Fix function pointer case
  net/sched: cls_u32: Fix reference counter leak leading to overflow
  net/sched: sch_qfq: account for stab overhead in qfq_enqueue
  net/sched: cls_fw: Fix improper refcount update leads to use-after-free
  drm/client: Fix memory leak in drm_client_target_cloned
  dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
  ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
  s390/dasd: fix hanging device after quiesce/resume
  irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
  tpm_tis: Explicitly check for error code
  hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
  staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
  Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
  usb: xhci-mtk: set the dma max_seg_size
  usb: ohci-at91: Fix the unhandle interrupt when resume
  can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
  USB: serial: simple: sort driver entries
  USB: serial: simple: add Kaufmann RKS+CAN VCP
  USB: serial: option: add Quectel EC200A module support
  USB: serial: option: support Quectel EM060K_128
  tracing: Fix warning in trace_buffered_event_disable()
  ring-buffer: Fix wrong stat of cpu_buffer->read
  ata: pata_ns87415: mark ns87560_tf_read static
  dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
  block: Fix a source code comment in include/uapi/linux/blkzoned.h
  ASoC: fsl_spdif: Silence output on stop
  benet: fix return value check in be_lancer_xmit_workarounds()
  platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
  team: reset team's flags when down link is P2P device
  bonding: reset bond's flags when down link is P2P device
  tcp: Reduce chance of collisions in inet6_hashfn().
  ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
  ethernet: atheros: fix return value check in atl1e_tso_csum()
  i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
  gpio: tps68470: Make tps68470_gpio_output() always set the initial value
  tcp: annotate data-races around fastopenq.max_qlen
  tcp: annotate data-races around tp->notsent_lowat
  tcp: annotate data-races around rskq_defer_accept
  netfilter: nf_tables: fix spurious set element insertion failure
  llc: Don't drop packet from non-root netns.
  fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
  net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
  pinctrl: amd: Use amd_pinconf_set() for all config options
  fbdev: imxfb: warn about invalid left/right margin
  spi: bcm63xx: fix max prepend length
  igb: Fix igb_down hung on surprise removal
  wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
  bpf: Address KCSAN report on bpf_lru_list
  sched/fair: Don't balance task to its current running CPU
  posix-timers: Ensure timer ID search-loop limit is valid
  md/raid10: prevent soft lockup while flush writes
  md: fix data corruption for raid456 when reshape restart while grow up
  nbd: Add the maximum limit of allocated index in nbd_dev_add
  debugobjects: Recheck debug_objects_enabled before reporting
  ext4: correct inline offset when handling xattrs in inode body
  can: bcm: Fix UAF in bcm_proc_show()
  fuse: revalidate: don't invalidate if interrupted
  perf probe: Add test for regression introduced by switch to die_get_decl_file()
  serial: atmel: don't enable IRQs prematurely
  scsi: qla2xxx: Pointer may be dereferenced
  scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
  scsi: qla2xxx: Fix potential NULL pointer dereference
  scsi: qla2xxx: Wait for io return on terminate rport
  xtensa: ISS: fix call to split_if_spec
  ring-buffer: Fix deadloop issue on reading trace_pipe
  tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
  tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
  Revert "8250: add support for ASIX devices with a FIFO bug"
  meson saradc: fix clock divider mask length
  hwrng: imx-rngc - fix the timeout for init and self check
  fs: dlm: return positive pid value for F_GETLK
  md/raid0: add discard support for the 'original' layout
  misc: pci_endpoint_test: Re-init completion for every test
  PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
  jfs: jfs_dmap: Validate db_l2nbperpage while mounting
  ext4: only update i_reserved_data_blocks on successful block allocation
  ext4: fix wrong unit use in ext4_mb_clear_bb
  perf intel-pt: Fix CYC timestamps after standalone CBR
  SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
  tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
  net/sched: make psched_mtu() RTNL-less safe
  wifi: airo: avoid uninitialized warning in airo_get_rate()
  ipv6/addrconf: fix a potential refcount underflow for idev
  NTB: ntb_transport: fix possible memory leak while device_register() fails
  ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
  NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
  ntb: idt: Fix error handling in idt_pci_driver_init()
  udp6: fix udp6_ehashfn() typo
  net: mvneta: fix txq_map in case of txq_number==1
  workqueue: clean up WORK_* constant types, clarify masking
  netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
  netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
  netfilter: nf_tables: unbind non-anonymous set if rule construction fails
  netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
  netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  spi: spi-fsl-spi: allow changing bits_per_word while CS is still active
  spi: spi-fsl-spi: relax message sanity checking a little
  spi: spi-fsl-spi: remove always-true conditional in fsl_spi_do_one_msg
  ARM: orion5x: fix d2net gpio initialization
  btrfs: fix race when deleting quota root from the dirty cow roots list
  jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
  integrity: Fix possible multiple allocation in integrity_inode_get()
  mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
  mmc: core: disable TRIM on Kingston EMMC04G-M627
  NFSD: add encoding of op_recall flag for write delegation
  sh: dma: Fix DMA channel offset calculation
  net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
  tcp: annotate data races in __tcp_oow_rate_limited()
  net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
  powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
  mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
  spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
  Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
  sctp: fix potential deadlock on &net->sctp.addr_wq_lock
  rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
  mfd: stmpe: Only disable the regulators if they are enabled
  mfd: intel-lpss: Add missing check for platform_get_resource
  mfd: rt5033: Drop rt5033-battery sub-device
  usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
  extcon: Fix kernel doc of property capability fields to avoid warnings
  extcon: Fix kernel doc of property fields to avoid warnings
  media: usb: siano: Fix warning due to null work_func_t function pointer
  media: videodev2.h: Fix struct v4l2_input tuner index comment
  media: usb: Check az6007_read() return value
  sh: j2: Use ioremap() to translate device tree address into kernel memory
  w1: fix loop in w1_fini()
  block: change all __u32 annotations to __be32 in affs_hardblocks.h
  USB: serial: option: add LARA-R6 01B PIDs
  modpost: fix off by one in is_executable_section()
  modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
  modpost: fix section mismatch message for R_ARM_ABS32
  crypto: nx - fix build warnings when DEBUG_FS is not enabled
  pinctrl: at91-pio4: check return value of devm_kasprintf()
  perf dwarf-aux: Fix off-by-one in die_get_varname()
  pinctrl: cherryview: Return correct value if pin in push-pull mode
  PCI: Add pci_clear_master() stub for non-CONFIG_PCI
  scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
  ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
  drm/radeon: fix possible division-by-zero errors
  fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
  soc/fsl/qe: fix usb.c build errors
  ASoC: es8316: Increment max value for ALC Capture Target Volume control
  ARM: ep93xx: fix missing-prototype warnings
  drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
  Input: adxl34x - do not hardcode interrupt trigger type
  ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
  Input: drv260x - sleep between polling GO bit
  radeon: avoid double free in ci_dpm_init()
  netlink: Add __sock_i_ino() for __netlink_diag_dump().
  netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
  lib/ts_bm: reset initial match offset for every block of text
  gtp: Fix use-after-free in __gtp_encap_destroy().
  netlink: do not hard code device address lenth in fdb dumps
  netlink: fix potential deadlock in netlink_set_err()
  wifi: ath9k: convert msecs to jiffies where needed
  wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
  memstick r592: make memstick_debug_get_tpc_name() static
  kexec: fix a memory leak in crash_shrink_memory()
  watchdog/perf: more properly prevent false positives with turbo modes
  watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
  wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
  wifi: ray_cs: Fix an error handling path in ray_probe()
  wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
  wifi: atmel: Fix an error handling path in atmel_probe()
  wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
  wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
  wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
  wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
  evm: Complete description of evm_inode_setattr()
  PM: domains: fix integer overflow issues in genpd_parse_state()
  md/raid10: fix io loss while replacement replace rdev
  md/raid10: fix wrong setting of max_corr_read_errors
  md/raid10: fix overflow of md/safe_mode_delay
  treewide: Remove uninitialized_var() usage
  drm/amdgpu: Validate VM ioctl flags.
  scripts/tags.sh: Resolve gtags empty index generation
  drm/edid: Fix uninitialized variable in drm_cvt_modes()
  fbdev: imsttfb: Fix use after free bug in imsttfb_probe
  x86/smp: Use dedicated cache-line for mwait_play_dead()
  x86/microcode/AMD: Load late on both threads too
  gfs2: Don't deref jdesc in evict
  Linux 4.14.321
  x86: fix backwards merge of GDS/SRSO bit
  xen/netback: Fix buffer overrun triggered by unusual packet
  Documentation/x86: Fix backwards on/off logic about YMM support
  x86/xen: Fix secondary processors' FPU initialization
  KVM: Add GDS_NO support to KVM
  x86/speculation: Add Kconfig option for GDS
  x86/speculation: Add force option to GDS mitigation
  x86/speculation: Add Gather Data Sampling mitigation
  x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
  x86/fpu: Mark init functions __init
  x86/fpu: Remove cpuinfo argument from init functions
  init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()
  init: Invoke arch_cpu_finalize_init() earlier
  init: Remove check_bugs() leftovers
  um/cpu: Switch to arch_cpu_finalize_init()
  sparc/cpu: Switch to arch_cpu_finalize_init()
  sh/cpu: Switch to arch_cpu_finalize_init()
  mips/cpu: Switch to arch_cpu_finalize_init()
  m68k/cpu: Switch to arch_cpu_finalize_init()
  ia64/cpu: Switch to arch_cpu_finalize_init()
  ARM: cpu: Switch to arch_cpu_finalize_init()
  x86/cpu: Switch to arch_cpu_finalize_init()
  init: Provide arch_cpu_finalize_init()

 Conflicts:
	drivers/usb/dwc3/gadget.c

Change-Id: I768a646cf224b88cc616358f481218f16671094b
This commit is contained in:
Michael Bestas
2023-09-19 18:27:08 +03:00
parent 4ed49ad658 ad961d38d4
commit eee597de47
447 changed files with 2654 additions and 1700 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
Documentation/ABI/testing/sysfs-devices-system-cpu
View File

@@ -375,16 +375,17 @@ Description: information about CPUs heterogeneity.
cpu_capacity: capacity of cpu#.
What: /sys/devices/system/cpu/vulnerabilities
/sys/devices/system/cpu/vulnerabilities/meltdown
/sys/devices/system/cpu/vulnerabilities/spectre_v1
/sys/devices/system/cpu/vulnerabilities/spectre_v2
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
/sys/devices/system/cpu/vulnerabilities/l1tf
/sys/devices/system/cpu/vulnerabilities/mds
/sys/devices/system/cpu/vulnerabilities/meltdown
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
/sys/devices/system/cpu/vulnerabilities/spectre_v1
/sys/devices/system/cpu/vulnerabilities/spectre_v2
/sys/devices/system/cpu/vulnerabilities/srbds
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data
Date: January 2018
Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
Description: Information about CPU vulnerabilities

109
Documentation/admin-guide/hw-vuln/gather_data_sampling.rst Normal file
View File

@@ -0,0 +1,109 @@
.. SPDX-License-Identifier: GPL-2.0
GDS - Gather Data Sampling
==========================
Gather Data Sampling is a hardware vulnerability which allows unprivileged
speculative access to data which was previously stored in vector registers.
Problem
-------
When a gather instruction performs loads from memory, different data elements
are merged into the destination vector register. However, when a gather
instruction that is transiently executed encounters a fault, stale data from
architectural or internal vector registers may get transiently forwarded to the
destination vector register instead. This will allow a malicious attacker to
infer stale data using typical side channel techniques like cache timing
attacks. GDS is a purely sampling-based attack.
The attacker uses gather instructions to infer the stale vector register data.
The victim does not need to do anything special other than use the vector
registers. The victim does not need to use gather instructions to be
vulnerable.
Because the buffers are shared between Hyper-Threads cross Hyper-Thread attacks
are possible.
Attack scenarios
----------------
Without mitigation, GDS can infer stale data across virtually all
permission boundaries:
Non-enclaves can infer SGX enclave data
Userspace can infer kernel data
Guests can infer data from hosts
Guest can infer guest from other guests
Users can infer data from other users
Because of this, it is important to ensure that the mitigation stays enabled in
lower-privilege contexts like guests and when running outside SGX enclaves.
The hardware enforces the mitigation for SGX. Likewise, VMMs should ensure
that guests are not allowed to disable the GDS mitigation. If a host erred and
allowed this, a guest could theoretically disable GDS mitigation, mount an
attack, and re-enable it.
Mitigation mechanism
--------------------
This issue is mitigated in microcode. The microcode defines the following new
bits:
================================ === ============================
IA32_ARCH_CAPABILITIES[GDS_CTRL] R/O Enumerates GDS vulnerability
and mitigation support.
IA32_ARCH_CAPABILITIES[GDS_NO] R/O Processor is not vulnerable.
IA32_MCU_OPT_CTRL[GDS_MITG_DIS] R/W Disables the mitigation
0 by default.
IA32_MCU_OPT_CTRL[GDS_MITG_LOCK] R/W Locks GDS_MITG_DIS=0. Writes
to GDS_MITG_DIS are ignored
Can't be cleared once set.
================================ === ============================
GDS can also be mitigated on systems that don't have updated microcode by
disabling AVX. This can be done by setting gather_data_sampling="force" or
"clearcpuid=avx" on the kernel command-line.
If used, these options will disable AVX use by turning off XSAVE YMM support.
However, the processor will still enumerate AVX support. Userspace that
does not follow proper AVX enumeration to check both AVX *and* XSAVE YMM
support will break.
Mitigation control on the kernel command line
---------------------------------------------
The mitigation can be disabled by setting "gather_data_sampling=off" or
"mitigations=off" on the kernel command line. Not specifying either will default
to the mitigation being enabled. Specifying "gather_data_sampling=force" will
use the microcode mitigation when available or disable AVX on affected systems
where the microcode hasn't been updated to include the mitigation.
GDS System Information
------------------------
The kernel provides vulnerability status information through sysfs. For
GDS this can be accessed by the following sysfs file:
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
The possible values contained in this file are:
============================== =============================================
Not affected Processor not vulnerable.
Vulnerable Processor vulnerable and mitigation disabled.
Vulnerable: No microcode Processor vulnerable and microcode is missing
mitigation.
Mitigation: AVX disabled,
no microcode Processor is vulnerable and microcode is missing
mitigation. AVX disabled as mitigation.
Mitigation: Microcode Processor is vulnerable and mitigation is in
effect.
Mitigation: Microcode (locked) Processor is vulnerable and mitigation is in
effect and cannot be disabled.
Unknown: Dependent on
hypervisor status Running on a virtual guest processor that is
affected but with no way to know if host
processor is mitigated or vulnerable.
============================== =============================================
GDS Default mitigation
----------------------
The updated microcode will enable the mitigation by default. The kernel's
default action is to leave the mitigation enabled.

1
Documentation/admin-guide/hw-vuln/index.rst
View File

@@ -16,3 +16,4 @@ are configurable at compile, boot or run time.
multihit.rst
special-register-buffer-data-sampling.rst
processor_mmio_stale_data.rst
gather_data_sampling.rst

43
Documentation/admin-guide/kernel-parameters.txt
View File

@@ -1250,6 +1250,26 @@
Format: off | on
default: on
gather_data_sampling=
[X86,INTEL] Control the Gather Data Sampling (GDS)
mitigation.
Gather Data Sampling is a hardware vulnerability which
allows unprivileged speculative access to data which was
previously stored in vector registers.
This issue is mitigated by default in updated microcode.
The mitigation may have a performance impact but can be
disabled. On systems without the microcode mitigation
disabling AVX serves as a mitigation.
force: Disable AVX to mitigate systems without
microcode mitigation. No effect if the microcode
mitigation is present. Known to cause crashes in
userspace with buggy AVX enumeration.
off: Disable GDS mitigation.
gcov_persist= [GCOV] When non-zero (default), profiling data for
kernel modules is saved and remains accessible via
debugfs, even when the module is unloaded/reloaded.
@@ -2460,22 +2480,23 @@
Disable all optional CPU mitigations. This
improves system performance, but it may also
expose users to several CPU vulnerabilities.
Equivalent to: nopti [X86,PPC]
Equivalent to: gather_data_sampling=off [X86]
kpti=0 [ARM64]
nospectre_v1 [PPC]
nobp=0 [S390]
nospectre_v1 [X86]
nospectre_v2 [X86,PPC,S390,ARM64]
spectre_v2_user=off [X86]
spec_store_bypass_disable=off [X86,PPC]
ssbd=force-off [ARM64]
kvm.nx_huge_pages=off [X86]
l1tf=off [X86]
mds=off [X86]
tsx_async_abort=off [X86]
kvm.nx_huge_pages=off [X86]
mmio_stale_data=off [X86]
no_entry_flush [PPC]
no_uaccess_flush [PPC]
mmio_stale_data=off [X86]
nobp=0 [S390]
nopti [X86,PPC]
nospectre_v1 [PPC]
nospectre_v1 [X86]
nospectre_v2 [X86,PPC,S390,ARM64]
spec_store_bypass_disable=off [X86,PPC]
spectre_v2_user=off [X86]
ssbd=force-off [ARM64]
tsx_async_abort=off [X86]
Exceptions:
This does not have any effect on

24
Documentation/admin-guide/security-bugs.rst
View File

@@ -42,20 +42,18 @@ disclosure is from immediate (esp. if it's already publicly known)
to a few weeks. As a basic default policy, we expect report date to
disclosure date to be on the order of 7 days.
Coordination
------------
Coordination with other groups
------------------------------
Fixes for sensitive bugs, such as those that might lead to privilege
escalations, may need to be coordinated with the private
<linux-distros@vs.openwall.org> mailing list so that distribution vendors
are well prepared to issue a fixed kernel upon public disclosure of the
upstream fix. Distros will need some time to test the proposed patch and
will generally request at least a few days of embargo, and vendor update
publication prefers to happen Tuesday through Thursday. When appropriate,
the security team can assist with this coordination, or the reporter can
include linux-distros from the start. In this case, remember to prefix
the email Subject line with "[vs]" as described in the linux-distros wiki:
<http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists>
The kernel security team strongly recommends that reporters of potential
security issues NEVER contact the "linux-distros" mailing list until
AFTER discussing it with the kernel security team. Do not Cc: both
lists at once. You may contact the linux-distros mailing list after a
fix has been agreed on and you fully understand the requirements that
doing so will impose on you and the kernel community.
The different lists have different goals and the linux-distros rules do
not contribute to actually fixing any potential security problems.
CVE assignment
--------------

2
Makefile
View File

@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 4
PATCHLEVEL = 14
SUBLEVEL = 320
SUBLEVEL = 325
EXTRAVERSION =
NAME = Petit Gorille

3
arch/Kconfig
View File

@@ -237,6 +237,9 @@ config ARCH_HAS_FORTIFY_SOURCE
config ARCH_HAS_SET_MEMORY
bool
config ARCH_HAS_CPU_FINALIZE_INIT
bool
# Select if arch init_task initializer is different to init/init_task.c
config ARCH_INIT_TASK
bool

20
arch/alpha/include/asm/bugs.h
View File

@@ -1,20 +0,0 @@
/*
* include/asm-alpha/bugs.h
*
* Copyright (C) 1994 Linus Torvalds
*/
/*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Needs:
* void check_bugs(void);
*/
/*
* I don't know of any alpha bugs yet.. Nice chip
*/
static void check_bugs(void)
{
}

3
arch/alpha/kernel/setup.c
View File

@@ -469,8 +469,7 @@ setup_memory(void *kernel_end)
extern void setup_memory(void *);
#endif /* !CONFIG_DISCONTIGMEM */
int __init
page_is_ram(unsigned long pfn)
int page_is_ram(unsigned long pfn)
{
struct memclust_struct * cluster;
struct memdesc_struct * memdesc;

1
arch/arm/Kconfig
View File

@@ -3,6 +3,7 @@ config ARM
bool
default y
select ARCH_CLOCKSOURCE_DATA
select ARCH_HAS_CPU_FINALIZE_INIT if MMU
select ARCH_HAS_DEBUG_VIRTUAL
select ARCH_HAS_DEVMEM_IS_ALLOWED
select ARCH_HAS_ELF_RANDOMIZE

1
arch/arm/boot/dts/bcm5301x.dtsi
View File

@@ -449,7 +449,6 @@
"spi_lr_session_done",
"spi_lr_overread";
clocks = <&iprocmed>;
clock-names = "iprocmed";
num-cs = <2>;
#address-cells = <1>;
#size-cells = <0>;

4
arch/arm/include/asm/bugs.h
View File

@@ -1,6 +1,4 @@
/*
* arch/arm/include/asm/bugs.h
*
* Copyright (C) 1995-2003 Russell King
*
* This program is free software; you can redistribute it and/or modify
@@ -13,10 +11,8 @@
extern void check_writebuffer_bugs(void);
#ifdef CONFIG_MMU
extern void check_bugs(void);
extern void check_other_bugs(void);
#else
#define check_bugs() do { } while (0)
#define check_other_bugs() do { } while (0)
#endif

3
arch/arm/kernel/bugs.c
View File

@@ -1,5 +1,6 @@
// SPDX-Identifier: GPL-2.0
#include <linux/init.h>
#include <linux/cpu.h>
#include <asm/bugs.h>
#include <asm/proc-fns.h>
@@ -11,7 +12,7 @@ void check_other_bugs(void)
#endif
}
void __init check_bugs(void)
void __init arch_cpu_finalize_init(void)
{
check_writebuffer_bugs();
check_other_bugs();

3
arch/arm/mach-orion5x/board-dt.c
View File

@@ -63,6 +63,9 @@ static void __init orion5x_dt_init(void)
if (of_machine_is_compatible("maxtor,shared-storage-2"))
mss2_init();
if (of_machine_is_compatible("lacie,d2-network"))
d2net_init();
of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL);
}

6
arch/arm/mach-orion5x/common.h
View File

@@ -75,6 +75,12 @@ extern void mss2_init(void);
static inline void mss2_init(void) {}
#endif
#ifdef CONFIG_MACH_D2NET_DT
void d2net_init(void);
#else
static inline void d2net_init(void) {}
#endif
/*****************************************************************************
* Helpers to access Orion registers
****************************************************************************/

2
arch/arm/mach-sa1100/assabet.c
View File

@@ -518,7 +518,7 @@ static void __init map_sa1100_gpio_regs( void )
*/
static void __init get_assabet_scr(void)
{
unsigned long uninitialized_var(scr), i;
unsigned long scr, i;
GPDR |= 0x3fc; /* Configure GPIO 9:2 as outputs */
GPSR = 0x3fc; /* Write 0xFF to GPIO 9:2 */

1
arch/ia64/Kconfig
View File

@@ -12,6 +12,7 @@ menu "Processor type and features"
config IA64
bool
select ARCH_HAS_CPU_FINALIZE_INIT
select ARCH_MIGHT_HAVE_PC_PARPORT
select ARCH_MIGHT_HAVE_PC_SERIO
select PCI if (!IA64_HP_SIM)

20
arch/ia64/include/asm/bugs.h
View File

@@ -1,20 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Needs:
* void check_bugs(void);
*
* Based on <asm-alpha/bugs.h>.
*
* Modified 1998, 1999, 2003
* David Mosberger-Tang <davidm@hpl.hp.com>, Hewlett-Packard Co.
*/
#ifndef _ASM_IA64_BUGS_H
#define _ASM_IA64_BUGS_H
#include <asm/processor.h>
extern void check_bugs (void);
#endif /* _ASM_IA64_BUGS_H */

2
arch/ia64/kernel/process.c
View File

@@ -448,7 +448,7 @@ static void
do_copy_task_regs (struct task_struct *task, struct unw_frame_info *info, void *arg)
{
unsigned long mask, sp, nat_bits = 0, ar_rnat, urbs_end, cfm;
unsigned long uninitialized_var(ip); /* GCC be quiet */
unsigned long ip;
elf_greg_t *dst = arg;
struct pt_regs *pt;
char nat;

3
arch/ia64/kernel/setup.c
View File

@@ -1053,8 +1053,7 @@ cpu_init (void)
platform_cpu_init();
}
void __init
check_bugs (void)
void __init arch_cpu_finalize_init(void)
{
ia64_patch_mckinley_e9((unsigned long) __start___mckinley_e9_bundles,
(unsigned long) __end___mckinley_e9_bundles);

2
arch/ia64/mm/discontig.c
View File

@@ -185,7 +185,7 @@ static void *per_cpu_node_setup(void *cpu_data, int node)
void __init setup_per_cpu_areas(void)
{
struct pcpu_alloc_info *ai;
struct pcpu_group_info *uninitialized_var(gi);
struct pcpu_group_info *gi;
unsigned int *cpu_map;
void *base;
unsigned long base_offset;

2
arch/ia64/mm/tlb.c
View File

@@ -339,7 +339,7 @@ EXPORT_SYMBOL(flush_tlb_range);
void ia64_tlb_init(void)
{
ia64_ptce_info_t uninitialized_var(ptce_info); /* GCC be quiet */
ia64_ptce_info_t ptce_info;
u64 tr_pgbits;
long status;
pal_vm_info_1_u_t vm_info_1;

1
arch/m68k/Kconfig
View File

@@ -2,6 +2,7 @@
config M68K
bool
default y
select ARCH_HAS_CPU_FINALIZE_INIT if MMU
select ARCH_MIGHT_HAVE_PC_PARPORT if ISA
select ARCH_NO_COHERENT_DMA_MMAP if !MMU
select HAVE_IDE

21
arch/m68k/include/asm/bugs.h
View File

@@ -1,21 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
* include/asm-m68k/bugs.h
*
* Copyright (C) 1994 Linus Torvalds
*/
/*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Needs:
* void check_bugs(void);
*/
#ifdef CONFIG_MMU
extern void check_bugs(void); /* in arch/m68k/kernel/setup.c */
#else
static void check_bugs(void)
{
}
#endif

3
arch/m68k/kernel/setup_mm.c
View File

@@ -10,6 +10,7 @@
*/
#include <linux/kernel.h>
#include <linux/cpu.h>
#include <linux/mm.h>
#include <linux/sched.h>
#include <linux/delay.h>
@@ -549,7 +550,7 @@ static int __init proc_hardware_init(void)
module_init(proc_hardware_init);
#endif
void check_bugs(void)
void __init arch_cpu_finalize_init(void)
{
#if defined(CONFIG_FPU) && !defined(CONFIG_M68KFPU_EMU)
if (m68k_fputype == 0) {

1
arch/mips/Kconfig
View File

@@ -4,6 +4,7 @@ config MIPS
default y
select ARCH_BINFMT_ELF_STATE
select ARCH_CLOCKSOURCE_DATA
select ARCH_HAS_CPU_FINALIZE_INIT
select ARCH_DISCARD_MEMBLOCK
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST

27
arch/mips/alchemy/common/dbdma.c
View File

@@ -30,7 +30,6 @@
*
*/
#include <linux/dma-map-ops.h> /* for dma_default_coherent */
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/slab.h>
@@ -624,18 +623,17 @@ u32 au1xxx_dbdma_put_source(u32 chanid, dma_addr_t buf, int nbytes, u32 flags)
dp->dscr_cmd0 &= ~DSCR_CMD0_IE;
/*
* There is an erratum on certain Au1200/Au1550 revisions that could
* result in "stale" data being DMA'ed. It has to do with the snoop
* logic on the cache eviction buffer. dma_default_coherent is set
* to false on these parts.
* There is an errata on the Au1200/Au1550 parts that could result
* in "stale" data being DMA'ed. It has to do with the snoop logic on
* the cache eviction buffer. DMA_NONCOHERENT is on by default for
* these parts. If it is fixed in the future, these dma_cache_inv will
* just be nothing more than empty macros. See io.h.
*/
if (!dma_default_coherent)
dma_cache_wback_inv(KSEG0ADDR(buf), nbytes);
dma_cache_wback_inv((unsigned long)buf, nbytes);
dp->dscr_cmd0 |= DSCR_CMD0_V; /* Let it rip */
wmb(); /* drain writebuffer */
dma_cache_wback_inv((unsigned long)dp, sizeof(*dp));
ctp->chan_ptr->ddma_dbell = 0;
wmb(); /* force doorbell write out to dma engine */
/* Get next descriptor pointer. */
ctp->put_ptr = phys_to_virt(DSCR_GET_NXTPTR(dp->dscr_nxtptr));
@@ -687,18 +685,17 @@ u32 au1xxx_dbdma_put_dest(u32 chanid, dma_addr_t buf, int nbytes, u32 flags)
dp->dscr_source1, dp->dscr_dest0, dp->dscr_dest1);
#endif
/*
* There is an erratum on certain Au1200/Au1550 revisions that could
* result in "stale" data being DMA'ed. It has to do with the snoop
* logic on the cache eviction buffer. dma_default_coherent is set
* to false on these parts.
* There is an errata on the Au1200/Au1550 parts that could result in
* "stale" data being DMA'ed. It has to do with the snoop logic on the
* cache eviction buffer. DMA_NONCOHERENT is on by default for these
* parts. If it is fixed in the future, these dma_cache_inv will just
* be nothing more than empty macros. See io.h.
*/
if (!dma_default_coherent)
dma_cache_inv(KSEG0ADDR(buf), nbytes);
dma_cache_inv((unsigned long)buf, nbytes);
dp->dscr_cmd0 |= DSCR_CMD0_V; /* Let it rip */
wmb(); /* drain writebuffer */
dma_cache_wback_inv((unsigned long)dp, sizeof(*dp));
ctp->chan_ptr->ddma_dbell = 0;
wmb(); /* force doorbell write out to dma engine */
/* Get next descriptor pointer. */
ctp->put_ptr = phys_to_virt(DSCR_GET_NXTPTR(dp->dscr_nxtptr));

17
arch/mips/include/asm/bugs.h
View File

@@ -1,17 +1,11 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Copyright (C) 2007 Maciej W. Rozycki
*
* Needs:
* void check_bugs(void);
*/
#ifndef _ASM_BUGS_H
#define _ASM_BUGS_H
#include <linux/bug.h>
#include <linux/delay.h>
#include <linux/smp.h>
#include <asm/cpu.h>
@@ -31,17 +25,6 @@ static inline void check_bugs_early(void)
#endif
}
static inline void check_bugs(void)
{
unsigned int cpu = smp_processor_id();
cpu_data[cpu].udelay_val = loops_per_jiffy;
check_bugs32();
#ifdef CONFIG_64BIT
check_bugs64();
#endif
}
static inline int r4k_daddiu_bug(void)
{
#ifdef CONFIG_64BIT

2
arch/mips/include/asm/dec/prom.h
View File

@@ -74,7 +74,7 @@ static inline bool prom_is_rex(u32 magic)
*/
typedef struct {
int pagesize;
unsigned char bitmap[0];
unsigned char bitmap[];
} memmap;

13
arch/mips/kernel/setup.c
View File

@@ -11,6 +11,8 @@
* Copyright (C) 2000, 2001, 2002, 2007 Maciej W. Rozycki
*/
#include <linux/init.h>
#include <linux/cpu.h>
#include <linux/delay.h>
#include <linux/ioport.h>
#include <linux/export.h>
#include <linux/screen_info.h>
@@ -1060,3 +1062,14 @@ static int __init debugfs_mips(void)
}
arch_initcall(debugfs_mips);
#endif
void __init arch_cpu_finalize_init(void)
{
unsigned int cpu = smp_processor_id();
cpu_data[cpu].udelay_val = loops_per_jiffy;
check_bugs32();
if (IS_ENABLED(CONFIG_CPU_R4X00_BUGS64))
check_bugs64();
}

20
arch/parisc/include/asm/bugs.h
View File

@@ -1,20 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
* include/asm-parisc/bugs.h
*
* Copyright (C) 1999 Mike Shaver
*/
/*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Needs:
* void check_bugs(void);
*/
#include <asm/processor.h>
static inline void check_bugs(void)
{
// identify_cpu(&boot_cpu_data);
}

2
arch/powerpc/Kconfig.debug
View File

@@ -231,7 +231,7 @@ config PPC_EARLY_DEBUG_40x
config PPC_EARLY_DEBUG_CPM
bool "Early serial debugging for Freescale CPM-based serial ports"
depends on SERIAL_CPM
depends on SERIAL_CPM=y
help
Select this to enable early debugging for Freescale chips
using a CPM-based serial port. This assumes that the bootwrapper

18
arch/powerpc/include/asm/bugs.h
View File

@@ -1,18 +0,0 @@
#ifndef _ASM_POWERPC_BUGS_H
#define _ASM_POWERPC_BUGS_H
/*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*/
/*
* This file is included by 'init/main.c' to check for
* architecture-dependent bugs.
*/
static inline void check_bugs(void) { }
#endif /* _ASM_POWERPC_BUGS_H */

2
arch/powerpc/include/asm/word-at-a-time.h
View File

@@ -34,7 +34,7 @@ static inline long find_zero(unsigned long mask)
return leading_zero_bits >> 3;
}
static inline bool has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c)
static inline unsigned long has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c)
{
unsigned long rhs = val | c->low_bits;
*data = rhs;

2
arch/powerpc/platforms/52xx/mpc52xx_pic.c
View File

@@ -340,7 +340,7 @@ static int mpc52xx_irqhost_map(struct irq_domain *h, unsigned int virq,
{
int l1irq;
int l2irq;
struct irq_chip *uninitialized_var(irqchip);
struct irq_chip *irqchip;
void *hndlr;
int type;
u32 reg;

2
arch/s390/kernel/smp.c
View File

@@ -147,7 +147,7 @@ static int pcpu_sigp_retry(struct pcpu *pcpu, u8 order, u32 parm)
static inline int pcpu_stopped(struct pcpu *pcpu)
{
u32 uninitialized_var(status);
u32 status;
if (__pcpu_sigp(pcpu->address, SIGP_SENSE,
0, &status) != SIGP_CC_STATUS_STORED)

1
arch/sh/Kconfig
View File

@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
config SUPERH
def_bool y
select ARCH_HAS_CPU_FINALIZE_INIT
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
select ARCH_MIGHT_HAVE_PC_PARPORT
select ARCH_NO_COHERENT_DMA_MMAP if !MMU

37
arch/sh/drivers/dma/dma-sh.c
View File

@@ -21,6 +21,18 @@
#include <cpu/dma-register.h>
#include <cpu/dma.h>
/*
* Some of the SoCs feature two DMAC modules. In such a case, the channels are
* distributed equally among them.
*/
#ifdef SH_DMAC_BASE1
#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2)
#else
#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS
#endif
#define SH_DMAC_CH_SZ 0x10
/*
* Define the default configuration for dual address memory-memory transfer.
* The 0x400 value represents auto-request, external->external.
@@ -32,7 +44,7 @@ static unsigned long dma_find_base(unsigned int chan)
unsigned long base = SH_DMAC_BASE0;
#ifdef SH_DMAC_BASE1
if (chan >= 6)
if (chan >= SH_DMAC_NR_MD_CH)
base = SH_DMAC_BASE1;
#endif
@@ -43,13 +55,13 @@ static unsigned long dma_base_addr(unsigned int chan)
{
unsigned long base = dma_find_base(chan);
/* Normalize offset calculation */
if (chan >= 9)
chan -= 6;
if (chan >= 4)
base += 0x10;
chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ;
return base + (chan * 0x10);
/* DMAOR is placed inside the channel register space. Step over it. */
if (chan >= DMAOR)
base += SH_DMAC_CH_SZ;
return base + chan;
}
#ifdef CONFIG_SH_DMA_IRQ_MULTI
@@ -253,12 +265,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan)
#define NR_DMAOR 1
#endif
/*
* DMAOR bases are broken out amongst channel groups. DMAOR0 manages
* channels 0 - 5, DMAOR1 6 - 11 (optional).
*/
#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6))
#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6)
#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \
SH_DMAC_NR_MD_CH) + DMAOR)
#define dmaor_write_reg(n, data) __raw_writew(data, \
dma_find_base((n) * \
SH_DMAC_NR_MD_CH) + DMAOR)
static inline int dmaor_reset(int no)
{

78
arch/sh/include/asm/bugs.h
View File

@@ -1,78 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef __ASM_SH_BUGS_H
#define __ASM_SH_BUGS_H
/*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Needs:
* void check_bugs(void);
*/
/*
* I don't know of any Super-H bugs yet.
*/
#include <asm/processor.h>
extern void select_idle_routine(void);
static void __init check_bugs(void)
{
extern unsigned long loops_per_jiffy;
char *p = &init_utsname()->machine[2]; /* "sh" */
select_idle_routine();
current_cpu_data.loops_per_jiffy = loops_per_jiffy;
switch (current_cpu_data.family) {
case CPU_FAMILY_SH2:
*p++ = '2';
break;
case CPU_FAMILY_SH2A:
*p++ = '2';
*p++ = 'a';
break;
case CPU_FAMILY_SH3:
*p++ = '3';
break;
case CPU_FAMILY_SH4:
*p++ = '4';
break;
case CPU_FAMILY_SH4A:
*p++ = '4';
*p++ = 'a';
break;
case CPU_FAMILY_SH4AL_DSP:
*p++ = '4';
*p++ = 'a';
*p++ = 'l';
*p++ = '-';
*p++ = 'd';
*p++ = 's';
*p++ = 'p';
break;
case CPU_FAMILY_SH5:
*p++ = '6';
*p++ = '4';
break;
case CPU_FAMILY_UNKNOWN:
/*
* Specifically use CPU_FAMILY_UNKNOWN rather than
* default:, so we're able to have the compiler whine
* about unhandled enumerations.
*/
break;
}
printk("CPU: %s\n", get_cpu_subtype(&current_cpu_data));
#ifndef __LITTLE_ENDIAN__
/* 'eb' means 'Endian Big' */
*p++ = 'e';
*p++ = 'b';
#endif
*p = '\0';
}
#endif /* __ASM_SH_BUGS_H */

2
arch/sh/include/asm/processor.h
View File

@@ -173,6 +173,8 @@ extern unsigned int instruction_size(unsigned int insn);
#define instruction_size(insn) (4)
#endif
void select_idle_routine(void);
#endif /* __ASSEMBLY__ */
#ifdef CONFIG_SUPERH32

2
arch/sh/kernel/cpu/sh2/probe.c
View File

@@ -24,7 +24,7 @@ static int __init scan_cache(unsigned long node, const char *uname,
if (!of_flat_dt_is_compatible(node, "jcore,cache"))
return 0;
j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4);
return 1;
}

1
arch/sh/kernel/idle.c
View File

@@ -18,6 +18,7 @@
#include <linux/smp.h>
#include <linux/atomic.h>
#include <asm/pgalloc.h>
#include <asm/processor.h>
#include <asm/smp.h>
#include <asm/bl_bit.h>

55
arch/sh/kernel/setup.c
View File

@@ -43,6 +43,7 @@
#include <asm/smp.h>
#include <asm/mmu_context.h>
#include <asm/mmzone.h>
#include <asm/processor.h>
#include <asm/sparsemem.h>
/*
@@ -354,3 +355,57 @@ int test_mode_pin(int pin)
{
return sh_mv.mv_mode_pins() & pin;
}
void __init arch_cpu_finalize_init(void)
{
char *p = &init_utsname()->machine[2]; /* "sh" */
select_idle_routine();
current_cpu_data.loops_per_jiffy = loops_per_jiffy;
switch (current_cpu_data.family) {
case CPU_FAMILY_SH2:
*p++ = '2';
break;
case CPU_FAMILY_SH2A:
*p++ = '2';
*p++ = 'a';
break;
case CPU_FAMILY_SH3:
*p++ = '3';
break;
case CPU_FAMILY_SH4:
*p++ = '4';
break;
case CPU_FAMILY_SH4A:
*p++ = '4';
*p++ = 'a';
break;
case CPU_FAMILY_SH4AL_DSP:
*p++ = '4';
*p++ = 'a';
*p++ = 'l';
*p++ = '-';
*p++ = 'd';
*p++ = 's';
*p++ = 'p';
break;
case CPU_FAMILY_UNKNOWN:
/*
* Specifically use CPU_FAMILY_UNKNOWN rather than
* default:, so we're able to have the compiler whine
* about unhandled enumerations.
*/
break;
}
pr_info("CPU: %s\n", get_cpu_subtype(&current_cpu_data));
#ifndef __LITTLE_ENDIAN__
/* 'eb' means 'Endian Big' */
*p++ = 'e';
*p++ = 'b';
#endif
*p = '\0';
}

1
arch/sparc/Kconfig
View File

@@ -47,6 +47,7 @@ config SPARC
config SPARC32
def_bool !64BIT
select ARCH_HAS_CPU_FINALIZE_INIT if !SMP
select GENERIC_ATOMIC64
select CLZ_TAB
select HAVE_UID16

18
arch/sparc/include/asm/bugs.h
View File

@@ -1,18 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
/* include/asm/bugs.h: Sparc probes for various bugs.
*
* Copyright (C) 1996, 2007 David S. Miller (davem@davemloft.net)
*/
#ifdef CONFIG_SPARC32
#include <asm/cpudata.h>
#endif
extern unsigned long loops_per_jiffy;
static void __init check_bugs(void)
{
#if defined(CONFIG_SPARC32) && !defined(CONFIG_SMP)
cpu_data(0).udelay_val = loops_per_jiffy;
#endif
}

7
arch/sparc/kernel/setup_32.c
View File

@@ -422,3 +422,10 @@ static int __init topology_init(void)
}
subsys_initcall(topology_init);
#if defined(CONFIG_SPARC32) && !defined(CONFIG_SMP)
void __init arch_cpu_finalize_init(void)
{
cpu_data(0).udelay_val = loops_per_jiffy;
}
#endif

1
arch/um/Kconfig.common
View File

@@ -2,6 +2,7 @@
config UML
bool
default y
select ARCH_HAS_CPU_FINALIZE_INIT
select ARCH_HAS_KCOV
select HAVE_ARCH_AUDITSYSCALL
select HAVE_ARCH_SECCOMP_FILTER

7
arch/um/include/asm/bugs.h
View File

@@ -1,7 +0,0 @@
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef __UM_BUGS_H
#define __UM_BUGS_H
void check_bugs(void);
#endif

3
arch/um/kernel/um_arch.c
View File

@@ -3,6 +3,7 @@
* Licensed under the GPL
*/
#include <linux/cpu.h>
#include <linux/delay.h>
#include <linux/init.h>
#include <linux/mm.h>
@@ -352,7 +353,7 @@ void __init setup_arch(char **cmdline_p)
setup_hostinfo(host_info, sizeof host_info);
}
void __init check_bugs(void)
void __init arch_cpu_finalize_init(void)
{
arch_check_bugs();
os_check_bugs();

20
arch/x86/Kconfig
View File

@@ -46,6 +46,7 @@ config X86
select ARCH_CLOCKSOURCE_DATA
select ARCH_DISCARD_MEMBLOCK
select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
select ARCH_HAS_CPU_FINALIZE_INIT
select ARCH_HAS_DEBUG_VIRTUAL
select ARCH_HAS_DEVMEM_IS_ALLOWED
select ARCH_HAS_ELF_RANDOMIZE
@@ -2386,6 +2387,25 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
def_bool y
depends on X86_64 || X86_PAE
config GDS_FORCE_MITIGATION
bool "Force GDS Mitigation"
depends on CPU_SUP_INTEL
default n
help
Gather Data Sampling (GDS) is a hardware vulnerability which allows
unprivileged speculative access to data which was previously stored in
vector registers.
This option is equivalent to setting gather_data_sampling=force on the
command line. The microcode mitigation is used if present, otherwise
AVX is disabled as a mitigation. On affected systems that are missing
the microcode any userspace code that unconditionally uses AVX will
break with this option set.
Setting this option on systems not vulnerable to GDS has no effect.
If in doubt, say N.
config ARCH_ENABLE_HUGEPAGE_MIGRATION
def_bool y
depends on X86_64 && HUGETLB_PAGE && MIGRATION

4
arch/x86/entry/vdso/vma.c
View File

@@ -227,8 +227,8 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
/* Round the lowest possible end address up to a PMD boundary. */
end = (start + len + PMD_SIZE - 1) & PMD_MASK;
if (end >= TASK_SIZE_MAX)
end = TASK_SIZE_MAX;
if (end >= DEFAULT_MAP_WINDOW)
end = DEFAULT_MAP_WINDOW;
end -= len;
if (end > start) {

2
arch/x86/include/asm/bugs.h
View File

@@ -4,8 +4,6 @@
#include <asm/processor.h>
extern void check_bugs(void);
#if defined(CONFIG_CPU_SUP_INTEL)
void check_mpx_erratum(struct cpuinfo_x86 *c);
#else

1
arch/x86/include/asm/cpufeatures.h
View File

@@ -408,5 +408,6 @@
#define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */
#define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */
#define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
#define X86_BUG_GDS X86_BUG(29) /* CPU is affected by Gather Data Sampling */
#endif /* _ASM_X86_CPUFEATURES_H */

2
arch/x86/include/asm/fpu/internal.h
View File

@@ -42,7 +42,7 @@ extern int dump_fpu(struct pt_regs *ptregs, struct user_i387_struct *fpstate);
extern void fpu__init_cpu(void);
extern void fpu__init_system_xstate(void);
extern void fpu__init_cpu_xstate(void);
extern void fpu__init_system(struct cpuinfo_x86 *c);
extern void fpu__init_system(void);
extern void fpu__init_check_bugs(void);
extern void fpu__resume_cpu(void);
extern u64 fpu__get_supported_xfeatures_mask(void);

2
arch/x86/include/asm/mem_encrypt.h
View File

@@ -64,6 +64,8 @@ static inline void __init sme_early_init(void) { }
static inline void __init sme_encrypt_kernel(struct boot_params *bp) { }
static inline void __init sme_enable(struct boot_params *bp) { }
static inline void mem_encrypt_init(void) { }
#endif /* CONFIG_AMD_MEM_ENCRYPT */
/*

11
arch/x86/include/asm/msr-index.h
View File

@@ -138,6 +138,15 @@
* Not susceptible to Post-Barrier
* Return Stack Buffer Predictions.
*/
#define ARCH_CAP_GDS_CTRL BIT(25) /*
* CPU is vulnerable to Gather
* Data Sampling (GDS) and
* has controls for mitigation.
*/
#define ARCH_CAP_GDS_NO BIT(26) /*
* CPU is not vulnerable to Gather
* Data Sampling (GDS).
*/
#define MSR_IA32_FLUSH_CMD 0x0000010b
#define L1D_FLUSH BIT(0) /*
@@ -156,6 +165,8 @@
#define MSR_IA32_MCU_OPT_CTRL 0x00000123
#define RNGDS_MITG_DIS BIT(0)
#define FB_CLEAR_DIS BIT(3) /* CPU Fill buffer clear disable */
#define GDS_MITG_DIS BIT(4) /* Disable GDS mitigation */
#define GDS_MITG_LOCKED BIT(5) /* GDS mitigation locked */
#define MSR_IA32_SYSENTER_CS 0x00000174
#define MSR_IA32_SYSENTER_ESP 0x00000175

2
arch/x86/include/asm/processor.h
View File

@@ -992,4 +992,6 @@ enum taa_mitigations {
TAA_MITIGATION_TSX_DISABLED,
};
extern bool gds_ucode_mitigated(void);
#endif /* _ASM_X86_PROCESSOR_H */

209
arch/x86/kernel/cpu/bugs.c
View File

@@ -9,7 +9,6 @@
* - Andrew D. Balsa (code cleanup).
*/
#include <linux/init.h>
#include <linux/utsname.h>
#include <linux/cpu.h>
#include <linux/module.h>
#include <linux/nospec.h>
@@ -25,10 +24,8 @@
#include <asm/msr.h>
#include <asm/vmx.h>
#include <asm/paravirt.h>
#include <asm/alternative.h>
#include <asm/hypervisor.h>
#include <asm/pgtable.h>
#include <asm/set_memory.h>
#include <asm/intel-family.h>
#include <asm/e820/api.h>
#include <linux/bpf.h>
@@ -47,6 +44,7 @@ static void __init md_clear_select_mitigation(void);
static void __init taa_select_mitigation(void);
static void __init mmio_select_mitigation(void);
static void __init srbds_select_mitigation(void);
static void __init gds_select_mitigation(void);
/* The base value of the SPEC_CTRL MSR without task-specific bits set */
u64 x86_spec_ctrl_base;
@@ -115,21 +113,8 @@ EXPORT_SYMBOL_GPL(mds_idle_clear);
DEFINE_STATIC_KEY_FALSE(mmio_stale_data_clear);
EXPORT_SYMBOL_GPL(mmio_stale_data_clear);
void __init check_bugs(void)
void __init cpu_select_mitigations(void)
{
identify_boot_cpu();
/*
* identify_boot_cpu() initialized SMT support information, let the
* core code know.
*/
cpu_smt_check_topology();
if (!IS_ENABLED(CONFIG_SMP)) {
pr_info("CPU: ");
print_cpu_info(&boot_cpu_data);
}
/*
* Read the SPEC_CTRL MSR to account for reserved bits which may
* have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
@@ -165,39 +150,7 @@ void __init check_bugs(void)
l1tf_select_mitigation();
md_clear_select_mitigation();
srbds_select_mitigation();
arch_smt_update();
#ifdef CONFIG_X86_32
/*
* Check whether we are able to run this kernel safely on SMP.
*
* - i386 is no longer supported.
* - In order to run on anything without a TSC, we need to be
* compiled for a i486.
*/
if (boot_cpu_data.x86 < 4)
panic("Kernel requires i486+ for 'invlpg' and other features");
init_utsname()->machine[1] =
'0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
alternative_instructions();
fpu__init_check_bugs();
#else /* CONFIG_X86_64 */
alternative_instructions();
/*
* Make sure the first 2MB area is not mapped by huge pages
* There are typically fixed size MTRRs in there and overlapping
* MTRRs into large pages causes slow downs.
*
* Right now we don't do that with gbpages because there seems
* very little benefit for that case.
*/
if (!direct_gbpages)
set_memory_4k((unsigned long)__va(0), 1);
#endif
gds_select_mitigation();
}
/*
@@ -648,6 +601,149 @@ static int __init srbds_parse_cmdline(char *str)
}
early_param("srbds", srbds_parse_cmdline);
#undef pr_fmt
#define pr_fmt(fmt) "GDS: " fmt
enum gds_mitigations {
GDS_MITIGATION_OFF,
GDS_MITIGATION_UCODE_NEEDED,
GDS_MITIGATION_FORCE,
GDS_MITIGATION_FULL,
GDS_MITIGATION_FULL_LOCKED,
GDS_MITIGATION_HYPERVISOR,
};
#if IS_ENABLED(CONFIG_GDS_FORCE_MITIGATION)
static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE;
#else
static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;
#endif
static const char * const gds_strings[] = {
[GDS_MITIGATION_OFF] = "Vulnerable",
[GDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode",
[GDS_MITIGATION_FORCE] = "Mitigation: AVX disabled, no microcode",
[GDS_MITIGATION_FULL] = "Mitigation: Microcode",
[GDS_MITIGATION_FULL_LOCKED] = "Mitigation: Microcode (locked)",
[GDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status",
};
bool gds_ucode_mitigated(void)
{
return (gds_mitigation == GDS_MITIGATION_FULL ||
gds_mitigation == GDS_MITIGATION_FULL_LOCKED);
}
EXPORT_SYMBOL_GPL(gds_ucode_mitigated);
void update_gds_msr(void)
{
u64 mcu_ctrl_after;
u64 mcu_ctrl;
switch (gds_mitigation) {
case GDS_MITIGATION_OFF:
rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
mcu_ctrl |= GDS_MITG_DIS;
break;
case GDS_MITIGATION_FULL_LOCKED:
/*
* The LOCKED state comes from the boot CPU. APs might not have
* the same state. Make sure the mitigation is enabled on all
* CPUs.
*/
case GDS_MITIGATION_FULL:
rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
mcu_ctrl &= ~GDS_MITG_DIS;
break;
case GDS_MITIGATION_FORCE:
case GDS_MITIGATION_UCODE_NEEDED:
case GDS_MITIGATION_HYPERVISOR:
return;
};
wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
/*
* Check to make sure that the WRMSR value was not ignored. Writes to
* GDS_MITG_DIS will be ignored if this processor is locked but the boot
* processor was not.
*/
rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl_after);
WARN_ON_ONCE(mcu_ctrl != mcu_ctrl_after);
}
static void __init gds_select_mitigation(void)
{
u64 mcu_ctrl;
if (!boot_cpu_has_bug(X86_BUG_GDS))
return;
if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
gds_mitigation = GDS_MITIGATION_HYPERVISOR;
goto out;
}
if (cpu_mitigations_off())
gds_mitigation = GDS_MITIGATION_OFF;
/* Will verify below that mitigation _can_ be disabled */
/* No microcode */
if (!(x86_read_arch_cap_msr() & ARCH_CAP_GDS_CTRL)) {
if (gds_mitigation == GDS_MITIGATION_FORCE) {
/*
* This only needs to be done on the boot CPU so do it
* here rather than in update_gds_msr()
*/
setup_clear_cpu_cap(X86_FEATURE_AVX);
pr_warn("Microcode update needed! Disabling AVX as mitigation.\n");
} else {
gds_mitigation = GDS_MITIGATION_UCODE_NEEDED;
}
goto out;
}
/* Microcode has mitigation, use it */
if (gds_mitigation == GDS_MITIGATION_FORCE)
gds_mitigation = GDS_MITIGATION_FULL;
rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
if (mcu_ctrl & GDS_MITG_LOCKED) {
if (gds_mitigation == GDS_MITIGATION_OFF)
pr_warn("Mitigation locked. Disable failed.\n");
/*
* The mitigation is selected from the boot CPU. All other CPUs
* _should_ have the same state. If the boot CPU isn't locked
* but others are then update_gds_msr() will WARN() of the state
* mismatch. If the boot CPU is locked update_gds_msr() will
* ensure the other CPUs have the mitigation enabled.
*/
gds_mitigation = GDS_MITIGATION_FULL_LOCKED;
}
update_gds_msr();
out:
pr_info("%s\n", gds_strings[gds_mitigation]);
}
static int __init gds_parse_cmdline(char *str)
{
if (!str)
return -EINVAL;
if (!boot_cpu_has_bug(X86_BUG_GDS))
return 0;
if (!strcmp(str, "off"))
gds_mitigation = GDS_MITIGATION_OFF;
else if (!strcmp(str, "force"))
gds_mitigation = GDS_MITIGATION_FORCE;
return 0;
}
early_param("gather_data_sampling", gds_parse_cmdline);
#undef pr_fmt
#define pr_fmt(fmt) "Spectre V1 : " fmt
@@ -2194,6 +2290,11 @@ static ssize_t retbleed_show_state(char *buf)
return sprintf(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
}
static ssize_t gds_show_state(char *buf)
{
return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]);
}
static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
char *buf, unsigned int bug)
{
@@ -2240,6 +2341,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
case X86_BUG_RETBLEED:
return retbleed_show_state(buf);
case X86_BUG_GDS:
return gds_show_state(buf);
default:
break;
}
@@ -2304,4 +2408,9 @@ ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, cha
{
return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED);
}
ssize_t cpu_show_gds(struct device *dev, struct device_attribute *attr, char *buf)
{
return cpu_show_common(dev, attr, buf, X86_BUG_GDS);
}
#endif

117
arch/x86/kernel/cpu/common.c
View File

@@ -10,14 +10,20 @@
#include <linux/sched/mm.h>
#include <linux/sched/clock.h>
#include <linux/sched/task.h>
#include <linux/sched/smt.h>
#include <linux/init.h>
#include <linux/kprobes.h>
#include <linux/kgdb.h>
#include <linux/mem_encrypt.h>
#include <linux/smp.h>
#include <linux/cpu.h>
#include <linux/io.h>
#include <linux/syscore_ops.h>
#include <asm/stackprotector.h>
#include <linux/utsname.h>
#include <asm/alternative.h>
#include <asm/perf_event.h>
#include <asm/mmu_context.h>
#include <asm/archrandom.h>
@@ -53,6 +59,7 @@
#ifdef CONFIG_X86_LOCAL_APIC
#include <asm/uv/uv.h>
#endif
#include <asm/set_memory.h>
#include "cpu.h"
@@ -991,6 +998,12 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
#define MMIO_SBDS BIT(2)
/* CPU is affected by RETbleed, speculating where you would not expect it */
#define RETBLEED BIT(3)
/* CPU is affected by SMT (cross-thread) return predictions */
#define SMT_RSB BIT(4)
/* CPU is affected by SRSO */
#define SRSO BIT(5)
/* CPU is affected by GDS */
#define GDS BIT(6)
static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
@@ -1003,18 +1016,20 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS),
VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(CANNONLAKE_MOBILE,X86_STEPPING_ANY, RETBLEED),
VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPING_ANY, MMIO | GDS),
VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO | GDS),
VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(TIGERLAKE_L, X86_STEPPING_ANY, GDS),
VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS),
VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_X, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
@@ -1137,6 +1152,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
!(ia32_cap & ARCH_CAP_PBRSB_NO))
setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
/*
* Check if CPU is vulnerable to GDS. If running in a virtual machine on
* an affected processor, the VMM may have disabled the use of GATHER by
* disabling AVX2. The only way to do this in HW is to clear XCR0[2],
* which means that AVX will be disabled.
*/
if (cpu_matches(cpu_vuln_blacklist, GDS) && !(ia32_cap & ARCH_CAP_GDS_NO) &&
boot_cpu_has(X86_FEATURE_AVX))
setup_force_cpu_bug(X86_BUG_GDS);
if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
return;
@@ -1203,8 +1228,6 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
cpu_set_bug_bits(c);
fpu__init_system(c);
#ifdef CONFIG_X86_32
/*
* Regardless of whether PCID is enumerated, the SDM says
@@ -1563,6 +1586,8 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c)
validate_apic_and_package_id(c);
x86_spec_ctrl_setup_ap();
update_srbds_msr();
if (boot_cpu_has_bug(X86_BUG_GDS))
update_gds_msr();
}
static __init int setup_noclflush(char *arg)
@@ -1879,8 +1904,6 @@ void cpu_init(void)
clear_all_debug_regs();
dbg_restore_debug_regs();
fpu__init_cpu();
if (is_uv_system())
uv_cpu_init();
@@ -1943,8 +1966,6 @@ void cpu_init(void)
clear_all_debug_regs();
dbg_restore_debug_regs();
fpu__init_cpu();
load_fixmap_gdt(cpu);
}
#endif
@@ -1995,3 +2016,69 @@ void microcode_check(void)
pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n");
pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
}
void __init arch_cpu_finalize_init(void)
{
identify_boot_cpu();
/*
* identify_boot_cpu() initialized SMT support information, let the
* core code know.
*/
cpu_smt_check_topology();
if (!IS_ENABLED(CONFIG_SMP)) {
pr_info("CPU: ");
print_cpu_info(&boot_cpu_data);
}
cpu_select_mitigations();
arch_smt_update();
if (IS_ENABLED(CONFIG_X86_32)) {
/*
* Check whether this is a real i386 which is not longer
* supported and fixup the utsname.
*/
if (boot_cpu_data.x86 < 4)
panic("Kernel requires i486+ for 'invlpg' and other features");
init_utsname()->machine[1] =
'0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
}
/*
* Must be before alternatives because it might set or clear
* feature bits.
*/
fpu__init_system();
fpu__init_cpu();
alternative_instructions();
if (IS_ENABLED(CONFIG_X86_64)) {
/*
* Make sure the first 2MB area is not mapped by huge pages
* There are typically fixed size MTRRs in there and overlapping
* MTRRs into large pages causes slow downs.
*
* Right now we don't do that with gbpages because there seems
* very little benefit for that case.
*/
if (!direct_gbpages)
set_memory_4k((unsigned long)__va(0), 1);
} else {
fpu__init_check_bugs();
}
/*
* This needs to be called before any devices perform DMA
* operations that might use the SWIOTLB bounce buffers. It will
* mark the bounce buffers as decrypted so that their usage will
* not cause "plain-text" data to be decrypted when accessed. It
* must be called after late_time_init() so that Hyper-V x86/x64
* hypercalls work when the SWIOTLB bounce buffers are decrypted.
*/
mem_encrypt_init();
}

2
arch/x86/kernel/cpu/cpu.h
View File

@@ -67,9 +67,11 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
extern int detect_ht_early(struct cpuinfo_x86 *c);
unsigned int aperfmperf_get_khz(int cpu);
void cpu_select_mitigations(void);
extern void x86_spec_ctrl_setup_ap(void);
extern void update_srbds_msr(void);
extern void update_gds_msr(void);
extern u64 x86_read_arch_cap_msr(void);

2
arch/x86/kernel/cpu/microcode/amd.c
View File

@@ -532,7 +532,7 @@ static enum ucode_state apply_microcode_amd(int cpu)
rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
/* need to apply patch? */
if (rev >= mc_amd->hdr.patch_id) {
if (rev > mc_amd->hdr.patch_id) {
ret = UCODE_OK;
goto out;
}

8
arch/x86/kernel/fpu/init.c
View File

@@ -49,7 +49,7 @@ void fpu__init_cpu(void)
fpu__init_cpu_xstate();
}
static bool fpu__probe_without_cpuid(void)
static bool __init fpu__probe_without_cpuid(void)
{
unsigned long cr0;
u16 fsw, fcw;
@@ -67,7 +67,7 @@ static bool fpu__probe_without_cpuid(void)
return fsw == 0 && (fcw & 0x103f) == 0x003f;
}
static void fpu__init_system_early_generic(struct cpuinfo_x86 *c)
static void __init fpu__init_system_early_generic(void)
{
if (!boot_cpu_has(X86_FEATURE_CPUID) &&
!test_bit(X86_FEATURE_FPU, (unsigned long *)cpu_caps_cleared)) {
@@ -297,10 +297,10 @@ static void __init fpu__init_parse_early_param(void)
* Called on the boot CPU once per system bootup, to set up the initial
* FPU state that is later cloned into all processes:
*/
void __init fpu__init_system(struct cpuinfo_x86 *c)
void __init fpu__init_system(void)
{
fpu__init_parse_early_param();
fpu__init_system_early_generic(c);
fpu__init_system_early_generic();
/*
* The FPU has to be operational for some of the

8
arch/x86/kernel/fpu/xstate.c
View File

@@ -811,6 +811,14 @@ void __init fpu__init_system_xstate(void)
fpu__init_prepare_fx_sw_frame();
setup_init_fpu_buf();
setup_xstate_comp();
/*
* CPU capabilities initialization runs before FPU init. So
* X86_FEATURE_OSXSAVE is not set. Now that XSAVE is completely
* functional, set the feature bit so depending code works.
*/
setup_force_cpu_cap(X86_FEATURE_OSXSAVE);
print_xstate_offset_size();
pr_info("x86/fpu: Enabled xstate features 0x%llx, context size is %d bytes, using '%s' format.\n",

10
arch/x86/kernel/quirks.c
View File

@@ -96,7 +96,7 @@ static void ich_force_hpet_resume(void)
static void ich_force_enable_hpet(struct pci_dev *dev)
{
u32 val;
u32 uninitialized_var(rcba);
u32 rcba;
int err = 0;
if (hpet_address || force_hpet_address)
@@ -186,7 +186,7 @@ static void hpet_print_force_info(void)
static void old_ich_force_hpet_resume(void)
{
u32 val;
u32 uninitialized_var(gen_cntl);
u32 gen_cntl;
if (!force_hpet_address || !cached_dev)
return;
@@ -208,7 +208,7 @@ static void old_ich_force_hpet_resume(void)
static void old_ich_force_enable_hpet(struct pci_dev *dev)
{
u32 val;
u32 uninitialized_var(gen_cntl);
u32 gen_cntl;
if (hpet_address || force_hpet_address)
return;
@@ -299,7 +299,7 @@ static void vt8237_force_hpet_resume(void)
static void vt8237_force_enable_hpet(struct pci_dev *dev)
{
u32 uninitialized_var(val);
u32 val;
if (hpet_address || force_hpet_address)
return;
@@ -430,7 +430,7 @@ static void nvidia_force_hpet_resume(void)
static void nvidia_force_enable_hpet(struct pci_dev *dev)
{
u32 uninitialized_var(val);
u32 val;
if (hpet_address || force_hpet_address)
return;

25
arch/x86/kernel/smpboot.c
View File

@@ -94,6 +94,17 @@ DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_llc_shared_map);
DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info);
EXPORT_PER_CPU_SYMBOL(cpu_info);
struct mwait_cpu_dead {
unsigned int control;
unsigned int status;
};
/*
* Cache line aligned data for mwait_play_dead(). Separate on purpose so
* that it's unlikely to be touched by other CPUs.
*/
static DEFINE_PER_CPU_ALIGNED(struct mwait_cpu_dead, mwait_cpu_dead);
/* Logical package management. We might want to allocate that dynamically */
static int *physical_to_logical_pkg __read_mostly;
static unsigned long *physical_package_map __read_mostly;;
@@ -232,6 +243,7 @@ static void notrace start_secondary(void *unused)
#endif
load_current_idt();
cpu_init();
fpu__init_cpu();
x86_cpuinit.early_percpu_clock_init();
preempt_disable();
smp_callin();
@@ -1637,10 +1649,10 @@ static bool wakeup_cpu0(void)
*/
static inline void mwait_play_dead(void)
{
struct mwait_cpu_dead *md = this_cpu_ptr(&mwait_cpu_dead);
unsigned int eax, ebx, ecx, edx;
unsigned int highest_cstate = 0;
unsigned int highest_subcstate = 0;
void *mwait_ptr;
int i;
if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
@@ -1674,13 +1686,6 @@ static inline void mwait_play_dead(void)
(highest_subcstate - 1);
}
/*
* This should be a memory location in a cache line which is
* unlikely to be touched by other processors. The actual
* content is immaterial as it is not actually modified in any way.
*/
mwait_ptr = &current_thread_info()->flags;
wbinvd();
while (1) {
@@ -1692,9 +1697,9 @@ static inline void mwait_play_dead(void)
* case where we return around the loop.
*/
mb();
clflush(mwait_ptr);
clflush(md);
mb();
__monitor(mwait_ptr, 0, 0);
__monitor(md, 0, 0);
mb();
__mwait(eax, 0);
/*

3
arch/x86/kvm/x86.c
View File

@@ -1131,6 +1131,9 @@ u64 kvm_get_arch_capabilities(void)
/* Guests don't need to know "Fill buffer clear control" exists */
data &= ~ARCH_CAP_FB_CLEAR_CTRL;
if (!boot_cpu_has_bug(X86_BUG_GDS) || gds_ucode_mitigated())
data |= ARCH_CAP_GDS_NO;
return data;
}

2
arch/x86/xen/smp_pv.c
View File

@@ -27,6 +27,7 @@
#include <asm/desc.h>
#include <asm/pgtable.h>
#include <asm/cpu.h>
#include <asm/fpu/internal.h>
#include <xen/interface/xen.h>
#include <xen/interface/vcpu.h>
@@ -58,6 +59,7 @@ static void cpu_bringup(void)
int cpu;
cpu_init();
fpu__init_cpu();
touch_softlockup_watchdog();
preempt_disable();

18
arch/xtensa/include/asm/bugs.h
View File

@@ -1,18 +0,0 @@
/*
* include/asm-xtensa/bugs.h
*
* This is included by init/main.c to check for architecture-dependent bugs.
*
* Xtensa processors don't have any bugs. :)
*
* This file is subject to the terms and conditions of the GNU General
* Public License. See the file "COPYING" in the main directory of
* this archive for more details.
*/
#ifndef _XTENSA_BUGS_H
#define _XTENSA_BUGS_H
static void check_bugs(void) { }
#endif /* _XTENSA_BUGS_H */

2
arch/xtensa/platforms/iss/network.c
View File

@@ -234,7 +234,7 @@ static int tuntap_probe(struct iss_net_private *lp, int index, char *init)
init += sizeof(TRANSPORT_TUNTAP_NAME) - 1;
if (*init == ',') {
rem = split_if_spec(init + 1, &mac_str, &dev_name);
rem = split_if_spec(init + 1, &mac_str, &dev_name, NULL);
if (rem != NULL) {
pr_err("%s: extra garbage on specification : '%s'\n",
dev->name, rem);

2
drivers/acpi/acpi_pad.c
View File

@@ -95,7 +95,7 @@ static void round_robin_cpu(unsigned int tsk_index)
cpumask_var_t tmp;
int cpu;
unsigned long min_weight = -1;
unsigned long uninitialized_var(preferred_cpu);
unsigned long preferred_cpu;
if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
return;

1
drivers/android/binder.c
View File

@@ -6177,6 +6177,7 @@ err_init_binder_device_failed:
err_alloc_device_names_failed:
debugfs_remove_recursive(binder_debugfs_dir_entry_root);
binder_alloc_shrinker_exit();
return ret;
}

5
drivers/android/binder_alloc.c
View File

@@ -1177,3 +1177,8 @@ void binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
dest, bytes);
}
void binder_alloc_shrinker_exit(void)
{
unregister_shrinker(&binder_shrinker);
list_lru_destroy(&binder_alloc_lru);
}

1
drivers/android/binder_alloc.h
View File

@@ -129,6 +129,7 @@ extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
int is_async);
extern void binder_alloc_init(struct binder_alloc *alloc);
extern int binder_alloc_shrinker_init(void);
extern void binder_alloc_shrinker_exit(void);
extern void binder_alloc_vma_close(struct binder_alloc *alloc);
extern struct binder_buffer *
binder_alloc_prepare_to_free(struct binder_alloc *alloc,

2
drivers/ata/libata-scsi.c
View File

@@ -176,7 +176,7 @@ static ssize_t ata_scsi_park_show(struct device *device,
struct ata_link *link;
struct ata_device *dev;
unsigned long now;
unsigned int uninitialized_var(msecs);
unsigned int msecs;
int rc = 0;
ap = ata_shost_to_port(sdev->host);

2
drivers/ata/pata_ns87415.c
View File

@@ -260,7 +260,7 @@ static u8 ns87560_check_status(struct ata_port *ap)
* LOCKING:
* Inherited from caller.
*/
void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
static void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
{
struct ata_ioports *ioaddr = &ap->ioaddr;

2
drivers/atm/zatm.c
View File

@@ -939,7 +939,7 @@ static int open_tx_first(struct atm_vcc *vcc)
vcc->qos.txtp.max_pcr >= ATM_OC3_PCR);
if (unlimited && zatm_dev->ubr != -1) zatm_vcc->shaper = zatm_dev->ubr;
else {
int uninitialized_var(pcr);
int pcr;
if (unlimited) vcc->qos.txtp.max_sdu = ATM_MAX_AAL5_PDU;
if ((zatm_vcc->shaper = alloc_shaper(vcc->dev,&pcr,

8
drivers/base/cpu.c
View File

@@ -662,6 +662,12 @@ ssize_t __weak cpu_show_retbleed(struct device *dev,
return sysfs_emit(buf, "Not affected\n");
}
ssize_t __weak cpu_show_gds(struct device *dev,
struct device_attribute *attr, char *buf)
{
return sysfs_emit(buf, "Not affected\n");
}
static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
@@ -673,6 +679,7 @@ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);
static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);
static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL);
static struct attribute *cpu_root_vulnerabilities_attrs[] = {
&dev_attr_meltdown.attr,
@@ -686,6 +693,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
&dev_attr_srbds.attr,
&dev_attr_mmio_stale_data.attr,
&dev_attr_retbleed.attr,
&dev_attr_gather_data_sampling.attr,
NULL
};

6
drivers/base/power/domain.c
View File

@@ -2206,10 +2206,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
err = of_property_read_u32(state_node, "min-residency-us", &residency);
if (!err)
genpd_state->residency_ns = 1000 * residency;
genpd_state->residency_ns = 1000LL * residency;
genpd_state->power_on_latency_ns = 1000 * exit_latency;
genpd_state->power_off_latency_ns = 1000 * entry_latency;
genpd_state->power_on_latency_ns = 1000LL * exit_latency;
genpd_state->power_off_latency_ns = 1000LL * entry_latency;
genpd_state->fwnode = &state_node->fwnode;
return 0;

6
drivers/block/drbd/drbd_nl.c
View File

@@ -3394,7 +3394,7 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
{
struct nlattr *resource_filter;
struct drbd_resource *resource;
struct drbd_device *uninitialized_var(device);
struct drbd_device *device;
int minor, err, retcode;
struct drbd_genlmsghdr *dh;
struct device_info device_info;
@@ -3483,7 +3483,7 @@ int drbd_adm_dump_connections(struct sk_buff *skb, struct netlink_callback *cb)
{
struct nlattr *resource_filter;
struct drbd_resource *resource = NULL, *next_resource;
struct drbd_connection *uninitialized_var(connection);
struct drbd_connection *connection;
int err = 0, retcode;
struct drbd_genlmsghdr *dh;
struct connection_info connection_info;
@@ -3645,7 +3645,7 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
{
struct nlattr *resource_filter;
struct drbd_resource *resource;
struct drbd_device *uninitialized_var(device);
struct drbd_device *device;
struct drbd_peer_device *peer_device = NULL;
int minor, err, retcode;
struct drbd_genlmsghdr *dh;

3
drivers/block/loop.c
View File

@@ -1849,7 +1849,8 @@ static int loop_add(struct loop_device **l, int i)
lo->tag_set.queue_depth = 128;
lo->tag_set.numa_node = NUMA_NO_NODE;
lo->tag_set.cmd_size = sizeof(struct loop_cmd);
lo->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_SG_MERGE;
lo->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_SG_MERGE |
BLK_MQ_F_NO_SCHED;
lo->tag_set.driver_data = lo;
err = blk_mq_alloc_tag_set(&lo->tag_set);

3
drivers/block/nbd.c
View File

@@ -1630,7 +1630,8 @@ static int nbd_dev_add(int index)
if (err == -ENOSPC)
err = -EEXIST;
} else {
err = idr_alloc(&nbd_index_idr, nbd, 0, 0, GFP_KERNEL);
err = idr_alloc(&nbd_index_idr, nbd, 0,
(MINORMASK >> part_shift) + 1, GFP_KERNEL);
if (err >= 0)
index = err;
}

6
drivers/char/hw_random/imx-rngc.c
View File

@@ -104,7 +104,7 @@ static int imx_rngc_self_test(struct imx_rngc *rngc)
cmd = readl(rngc->base + RNGC_COMMAND);
writel(cmd | RNGC_CMD_SELF_TEST, rngc->base + RNGC_COMMAND);
ret = wait_for_completion_timeout(&rngc->rng_op_done, RNGC_TIMEOUT);
ret = wait_for_completion_timeout(&rngc->rng_op_done, msecs_to_jiffies(RNGC_TIMEOUT));
if (!ret) {
imx_rngc_irq_mask_clear(rngc);
return -ETIMEDOUT;
@@ -187,9 +187,7 @@ static int imx_rngc_init(struct hwrng *rng)
cmd = readl(rngc->base + RNGC_COMMAND);
writel(cmd | RNGC_CMD_SEED, rngc->base + RNGC_COMMAND);
ret = wait_for_completion_timeout(&rngc->rng_op_done,
RNGC_TIMEOUT);
ret = wait_for_completion_timeout(&rngc->rng_op_done, msecs_to_jiffies(RNGC_TIMEOUT));
if (!ret) {
imx_rngc_irq_mask_clear(rngc);
return -ETIMEDOUT;

10
drivers/char/tpm/tpm_tis_core.c
View File

@@ -209,6 +209,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
int size = 0;
int status;
u32 expected;
int rc;
if (count < TPM_HEADER_SIZE) {
size = -EIO;
@@ -228,8 +229,13 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
goto out;
}
size += recv_data(chip, &buf[TPM_HEADER_SIZE],
expected - TPM_HEADER_SIZE);
rc = recv_data(chip, &buf[TPM_HEADER_SIZE],
expected - TPM_HEADER_SIZE);
if (rc < 0) {
size = rc;
goto out;
}
size += rc;
if (size < expected) {
dev_err(&chip->dev, "Unable to read remainder of result\n");
size = -ETIME;

30
drivers/char/tpm/tpm_vtpm_proxy.c
View File

@@ -700,37 +700,21 @@ static struct miscdevice vtpmx_miscdev = {
.fops = &vtpmx_fops,
};
static int vtpmx_init(void)
{
return misc_register(&vtpmx_miscdev);
}
static void vtpmx_cleanup(void)
{
misc_deregister(&vtpmx_miscdev);
}
static int __init vtpm_module_init(void)
{
int rc;
rc = vtpmx_init();
if (rc) {
pr_err("couldn't create vtpmx device\n");
return rc;
}
workqueue = create_workqueue("tpm-vtpm");
if (!workqueue) {
pr_err("couldn't create workqueue\n");
rc = -ENOMEM;
goto err_vtpmx_cleanup;
return -ENOMEM;
}
return 0;
err_vtpmx_cleanup:
vtpmx_cleanup();
rc = misc_register(&vtpmx_miscdev);
if (rc) {
pr_err("couldn't create vtpmx device\n");
destroy_workqueue(workqueue);
}
return rc;
}
@@ -738,7 +722,7 @@ err_vtpmx_cleanup:
static void __exit vtpm_module_exit(void)
{
destroy_workqueue(workqueue);
vtpmx_cleanup();
misc_deregister(&vtpmx_miscdev);
}
module_init(vtpm_module_init);

2
drivers/clk/clk-gate.c
View File

@@ -43,7 +43,7 @@ static void clk_gate_endisable(struct clk_hw *hw, int enable)
{
struct clk_gate *gate = to_clk_gate(hw);
int set = gate->flags & CLK_GATE_SET_TO_DISABLE ? 1 : 0;
unsigned long uninitialized_var(flags);
unsigned long flags;
u32 reg;
set ^= enable;

2
drivers/crypto/nx/Makefile
View File

@@ -1,7 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o
nx-crypto-objs := nx.o \
nx_debugfs.o \
nx-aes-cbc.o \
nx-aes-ecb.o \
nx-aes-gcm.o \
@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \
nx-sha256.o \
nx-sha512.o
nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o
obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o
obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o
nx-compress-objs := nx-842.o

4
drivers/crypto/nx/nx.h
View File

@@ -180,8 +180,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int,
int nx_debugfs_init(struct nx_crypto_driver *);
void nx_debugfs_fini(struct nx_crypto_driver *);
#else
#define NX_DEBUGFS_INIT(drv) (0)
#define NX_DEBUGFS_FINI(drv) (0)
#define NX_DEBUGFS_INIT(drv) do {} while (0)
#define NX_DEBUGFS_FINI(drv) do {} while (0)
#endif
#define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL)

18
drivers/dma-buf/sw_sync.c
View File

@@ -201,6 +201,7 @@ static const struct dma_fence_ops timeline_fence_ops = {
*/
static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
{
LIST_HEAD(signalled);
struct sync_pt *pt, *next;
trace_sync_timeline(obj);
@@ -213,21 +214,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
if (!timeline_fence_signaled(&pt->base))
break;
list_del_init(&pt->link);
dma_fence_get(&pt->base);
list_move_tail(&pt->link, &signalled);
rb_erase(&pt->node, &obj->pt_tree);
/*
* A signal callback may release the last reference to this
* fence, causing it to be freed. That operation has to be
* last to avoid a use after free inside this loop, and must
* be after we remove the fence from the timeline in order to
* prevent deadlocking on timeline->lock inside
* timeline_fence_release().
*/
dma_fence_signal_locked(&pt->base);
}
spin_unlock_irq(&obj->lock);
list_for_each_entry_safe(pt, next, &signalled, link) {
list_del_init(&pt->link);
dma_fence_put(&pt->base);
}
}
/**

18
drivers/dma/pl330.c
View File

@@ -403,6 +403,12 @@ enum desc_status {
* of a channel can be BUSY at any time.
*/
BUSY,
/*
* Pause was called while descriptor was BUSY. Due to hardware
* limitations, only termination is possible for descriptors
* that have been paused.
*/
PAUSED,
/*
* Sitting on the channel work_list but xfer done
* by PL330 core
@@ -1926,7 +1932,7 @@ static inline void fill_queue(struct dma_pl330_chan *pch)
list_for_each_entry(desc, &pch->work_list, node) {
/* If already submitted */
if (desc->status == BUSY)
if (desc->status == BUSY || desc->status == PAUSED)
continue;
ret = pl330_submit_req(pch->thread, desc);
@@ -2191,6 +2197,7 @@ static int pl330_pause(struct dma_chan *chan)
{
struct dma_pl330_chan *pch = to_pchan(chan);
struct pl330_dmac *pl330 = pch->dmac;
struct dma_pl330_desc *desc;
unsigned long flags;
pm_runtime_get_sync(pl330->ddma.dev);
@@ -2200,6 +2207,10 @@ static int pl330_pause(struct dma_chan *chan)
_stop(pch->thread);
spin_unlock(&pl330->lock);
list_for_each_entry(desc, &pch->work_list, node) {
if (desc->status == BUSY)
desc->status = PAUSED;
}
spin_unlock_irqrestore(&pch->lock, flags);
pm_runtime_mark_last_busy(pl330->ddma.dev);
pm_runtime_put_autosuspend(pl330->ddma.dev);
@@ -2290,7 +2301,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
else if (running && desc == running)
transferred =
pl330_get_current_xferred_count(pch, desc);
else if (desc->status == BUSY)
else if (desc->status == BUSY || desc->status == PAUSED)
/*
* Busy but not running means either just enqueued,
* or finished and not yet marked done
@@ -2307,6 +2318,9 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
case DONE:
ret = DMA_COMPLETE;
break;
case PAUSED:
ret = DMA_PAUSED;
break;
case PREP:
case BUSY:
ret = DMA_IN_PROGRESS;

8
drivers/extcon/extcon.c
View File

@@ -204,6 +204,14 @@ struct __extcon_info {
* @attr_name: "name" sysfs entry
* @attr_state: "state" sysfs entry
* @attrs: the array pointing to attr_name and attr_state for attr_g
* @usb_propval: the array of USB connector properties
* @chg_propval: the array of charger connector properties
* @jack_propval: the array of jack connector properties
* @disp_propval: the array of display connector properties
* @usb_bits: the bit array of the USB connector property capabilities
* @chg_bits: the bit array of the charger connector property capabilities
* @jack_bits: the bit array of the jack connector property capabilities
* @disp_bits: the bit array of the display connector property capabilities
*/
struct extcon_cable {
struct extcon_dev *edev;

14
drivers/firewire/ohci.c
View File

@@ -1114,7 +1114,7 @@ static void context_tasklet(unsigned long data)
static int context_add_buffer(struct context *ctx)
{
struct descriptor_buffer *desc;
dma_addr_t uninitialized_var(bus_addr);
dma_addr_t bus_addr;
int offset;
/*
@@ -1304,7 +1304,7 @@ static int at_context_queue_packet(struct context *ctx,
struct fw_packet *packet)
{
struct fw_ohci *ohci = ctx->ohci;
dma_addr_t d_bus, uninitialized_var(payload_bus);
dma_addr_t d_bus, payload_bus;
struct driver_data *driver_data;
struct descriptor *d, *last;
__le32 *header;
@@ -2460,7 +2460,7 @@ static int ohci_set_config_rom(struct fw_card *card,
{
struct fw_ohci *ohci;
__be32 *next_config_rom;
dma_addr_t uninitialized_var(next_config_rom_bus);
dma_addr_t next_config_rom_bus;
ohci = fw_ohci(card);
@@ -2949,10 +2949,10 @@ static struct fw_iso_context *ohci_allocate_iso_context(struct fw_card *card,
int type, int channel, size_t header_size)
{
struct fw_ohci *ohci = fw_ohci(card);
struct iso_context *uninitialized_var(ctx);
descriptor_callback_t uninitialized_var(callback);
u64 *uninitialized_var(channels);
u32 *uninitialized_var(mask), uninitialized_var(regs);
struct iso_context *ctx;
descriptor_callback_t callback;
u64 *channels;
u32 *mask, regs;
int index, ret = -EBUSY;
spin_lock_irq(&ohci->lock);

6
drivers/gpio/gpio-tps68470.c
View File

@@ -99,13 +99,13 @@ static int tps68470_gpio_output(struct gpio_chip *gc, unsigned int offset,
struct tps68470_gpio_data *tps68470_gpio = gpiochip_get_data(gc);
struct regmap *regmap = tps68470_gpio->tps68470_regmap;
/* Set the initial value */
tps68470_gpio_set(gc, offset, value);
/* rest are always outputs */
if (offset >= TPS68470_N_REGULAR_GPIO)
return 0;
/* Set the initial value */
tps68470_gpio_set(gc, offset, value);
return regmap_update_bits(regmap, TPS68470_GPIO_CTL_REG_A(offset),
TPS68470_GPIO_MODE_MASK,
TPS68470_GPIO_MODE_OUT_CMOS);

3
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
View File

@@ -1343,6 +1343,9 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
continue;
r = dma_fence_wait_timeout(fence, true, timeout);
if (r > 0 && fence->error)
r = fence->error;
dma_fence_put(fence);
if (r < 0)
return r;

4
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
View File

@@ -2712,6 +2712,10 @@ int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
struct amdgpu_fpriv *fpriv = filp->driver_priv;
int r;
/* No valid flags defined yet */
if (args->in.flags)
return -EINVAL;
switch (args->in.op) {
case AMDGPU_VM_OP_RESERVE_VMID:
/* current, we only have requirement to reserve vmid from gfxhub */

2
drivers/gpu/drm/bridge/sil-sii8620.c
View File

@@ -1011,7 +1011,7 @@ static void sii8620_set_auto_zone(struct sii8620 *ctx)
static void sii8620_stop_video(struct sii8620 *ctx)
{
u8 uninitialized_var(val);
u8 val;
sii8620_write_seq_static(ctx,
REG_TPI_INTR_EN, 0,

4
drivers/gpu/drm/drm_edid.c
View File

@@ -2681,7 +2681,7 @@ static int drm_cvt_modes(struct drm_connector *connector,
const u8 empty[3] = { 0, 0, 0 };
for (i = 0; i < 4; i++) {
int uninitialized_var(width), height;
int width, height;
cvt = &(timing->data.other_data.data.cvt[i]);
if (!memcmp(cvt->code, empty, 3))
@@ -2689,6 +2689,8 @@ static int drm_cvt_modes(struct drm_connector *connector,
height = (cvt->code[0] + ((cvt->code[1] & 0xf0) << 4) + 1) * 2;
switch (cvt->code[1] & 0x0c) {
/* default - because compiler doesn't see that we've enumerated all cases */
default:
case 0x00:
width = height * 4 / 3;
break;

5
drivers/gpu/drm/drm_fb_helper.c
View File

@@ -2112,6 +2112,9 @@ static bool drm_target_cloned(struct drm_fb_helper *fb_helper,
can_clone = true;
dmt_mode = drm_mode_find_dmt(fb_helper->dev, 1024, 768, 60, false);
if (!dmt_mode)
goto fail;
drm_fb_helper_for_each_connector(fb_helper, i) {
if (!enabled[i])
continue;
@@ -2124,11 +2127,13 @@ static bool drm_target_cloned(struct drm_fb_helper *fb_helper,
if (!modes[i])
can_clone = false;
}
kfree(dmt_mode);
if (can_clone) {
DRM_DEBUG_KMS("can clone using 1024x768\n");
return true;
}
fail:
DRM_INFO("kms: can't enable cloning when we probably wanted to.\n");
return false;
}

6
drivers/gpu/drm/exynos/exynos_drm_dsi.c
View File

@@ -545,9 +545,9 @@ static unsigned long exynos_dsi_pll_find_pms(struct exynos_dsi *dsi,
unsigned long best_freq = 0;
u32 min_delta = 0xffffffff;
u8 p_min, p_max;
u8 _p, uninitialized_var(best_p);
u16 _m, uninitialized_var(best_m);
u8 _s, uninitialized_var(best_s);
u8 _p, best_p;
u16 _m, best_m;
u8 _s, best_s;
p_min = DIV_ROUND_UP(fin, (12 * MHZ));
p_max = fin / (6 * MHZ);

2
drivers/gpu/drm/nouveau/nouveau_connector.c
View File

@@ -945,7 +945,7 @@ nouveau_connector_get_modes(struct drm_connector *connector)
/* Determine display colour depth for everything except LVDS now,
* DP requires this before mode_valid() is called.
*/
if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)
if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS)
nouveau_connector_detect_depth(connector);
/* Find the native mode if this is a digital panel, if we didn't

4
drivers/gpu/drm/panel/panel-simple.c
View File

@@ -407,8 +407,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = {
.num_modes = 1,
.bpc = 8,
.size = {
.width = 105,
.height = 67,
.width = 99,
.height = 58,
},
.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
};

Some files were not shown because too many files have changed in this diff Show More