Push to branch refs/heads/master:
61718ee3175ce93d7d832a6eb89c427c2d9ac4da -->
68f705428e49eb41a041c548b478173ff547f404
Documentation/ABI/testing/sysfs-devices-system-cpu | 16 +
Documentation/cgroups/cpusets.txt | 6 +-
Documentation/gcov.txt | 4 +
Documentation/kernel-parameters.txt | 59 +-
Documentation/speculation.txt | 90 ++
Documentation/x86/pti.txt | 186 ++++
Makefile | 9 +-
arch/alpha/include/asm/types.h | 14 +-
arch/alpha/kernel/osf_sys.c | 8 +-
arch/arm/include/asm/cputype.h | 3 +
arch/arm/kernel/hw_breakpoint.c | 16 +
arch/arm/kernel/ptrace.c | 2 +-
arch/arm/kernel/return_address.c | 4 -
arch/arm/kernel/traps.c | 28 +-
arch/arm/mach-pxa/Kconfig | 1 +
arch/arm/mm/dma-mapping.c | 4 +-
arch/arm/mm/mmap.c | 12 +-
arch/cris/arch-v10/lib/Makefile | 3 -
arch/cris/boot/rescue/Makefile | 8 +
arch/frv/mm/elf-fdpic.c | 6 +-
arch/ia64/kernel/sys_ia64.c | 18 +-
arch/ia64/mm/hugetlbpage.c | 4 +-
arch/m32r/include/asm/io.h | 11 +-
arch/m32r/kernel/ptrace.c | 7 +-
arch/mips/Makefile | 4 +-
arch/mips/ar7/clock.c | 3 +
arch/mips/ar7/platform.c | 1 +
arch/mips/bcm63xx/clk.c | 3 +
arch/mips/cavium-octeon/octeon-memcpy.S | 20 +-
arch/mips/configs/ip27_defconfig | 1 -
arch/mips/include/asm/checksum.h | 2 +
arch/mips/include/asm/kprobes.h | 3 +-
arch/mips/kernel/branch.c | 5 +-
arch/mips/kernel/entry.S | 3 +
arch/mips/kernel/kgdb.c | 48 +-
arch/mips/kernel/mips_ksyms.c | 8 +-
arch/mips/kernel/syscall.c | 2 +-
arch/mips/mm/Makefile | 4 +-
arch/mips/mm/mmap.c | 19 +-
arch/mips/mm/page-funcs.S | 50 ++
arch/mips/mm/page.c | 67 +-
arch/parisc/include/asm/bitops.h | 8 +-
arch/parisc/include/asm/bitsperlong.h | 2 -
arch/parisc/include/asm/swab.h | 5 +-
arch/parisc/kernel/sys_parisc.c | 40 +-
arch/parisc/kernel/syscall.S | 11 +-
arch/parisc/kernel/syscall_table.S | 2 +-
arch/powerpc/boot/4xx.c | 2 +-
arch/powerpc/boot/ps3-head.S | 5 -
arch/powerpc/boot/ps3.c | 8 +-
arch/powerpc/include/asm/page.h | 12 +
arch/powerpc/include/asm/ppc-opcode.h | 8 +-
arch/powerpc/include/asm/qe.h | 1 +
arch/powerpc/include/asm/reg.h | 4 +-
arch/powerpc/kernel/align.c | 27 +-
arch/powerpc/kernel/hw_breakpoint.c | 4 +-
arch/powerpc/kernel/ibmebus.c | 16 +-
arch/powerpc/kernel/idle_power7.S | 2 +-
arch/powerpc/kernel/kprobes.c | 12 +
arch/powerpc/kernel/nvram_64.c | 6 +-
arch/powerpc/kernel/ptrace.c | 7 +
arch/powerpc/kernel/setup_64.c | 25 +
arch/powerpc/kernel/vdso64/datapage.S | 2 +-
arch/powerpc/kernel/vdso64/gettimeofday.S | 2 +-
arch/powerpc/lib/copyuser_64.S | 2 +-
arch/powerpc/lib/sstep.c | 13 +
arch/powerpc/mm/hash_utils_64.c | 2 +-
arch/powerpc/mm/slice.c | 24 +-
arch/s390/boot/compressed/misc.c | 35 +-
arch/s390/include/asm/syscall.h | 6 +
arch/s390/include/asm/system.h | 18 +-
arch/s390/kernel/compat_linux.c | 1 +
arch/s390/kernel/dis.c | 4 +-
arch/s390/mm/gup.c | 7 +-
arch/sh/boards/mach-se/770x/setup.c | 24 +-
arch/sh/include/cpu-sh4/cpu/sh7722.h | 2 +-
arch/sh/include/cpu-sh4/cpu/sh7757.h | 8 +-
arch/sh/include/mach-se/mach/se.h | 1 +
arch/sh/mm/mmap.c | 29 +-
arch/sparc/kernel/leon_kernel.c | 56 +-
arch/sparc/kernel/sys_sparc_32.c | 2 +-
arch/sparc/kernel/sys_sparc_64.c | 30 +-
arch/sparc/mm/hugetlbpage.c | 27 +-
arch/tile/kernel/setup.c | 3 +-
arch/tile/mm/hugetlbpage.c | 26 +-
arch/x86/Kconfig | 14 +
arch/x86/Makefile | 8 +
arch/x86/boot/boot.h | 2 +-
arch/x86/boot/compressed/misc.h | 1 +
arch/x86/crypto/salsa20_glue.c | 7 -
arch/x86/ia32/ia32entry.S | 63 +-
arch/x86/include/asm/alternative-asm.h | 58 +-
arch/x86/include/asm/alternative.h | 96 +-
arch/x86/include/asm/asm.h | 17 +-
arch/x86/include/asm/bitops.h | 2 +
arch/x86/include/asm/cmdline.h | 8 +
arch/x86/include/asm/cpufeature.h | 33 +-
arch/x86/include/asm/desc.h | 2 +-
arch/x86/include/asm/elf.h | 7 +-
arch/x86/include/asm/hardirq.h | 2 +-
arch/x86/include/asm/hw_irq.h | 2 +-
arch/x86/include/asm/intel-family.h | 68 ++
arch/x86/include/asm/kaiser.h | 141 +++
arch/x86/include/asm/kvm_host.h | 4 +-
arch/x86/include/asm/kvm_para.h | 4 +-
arch/x86/include/asm/mmu.h | 6 -
arch/x86/include/asm/mmu_context.h | 76 +-
arch/x86/include/asm/msr-index.h | 3 +
arch/x86/include/asm/msr.h | 2 +
arch/x86/include/asm/nospec-branch.h | 199 +++++
arch/x86/include/asm/pgtable.h | 27 +-
arch/x86/include/asm/pgtable_64.h | 24 +-
arch/x86/include/asm/pgtable_types.h | 29 +-
arch/x86/include/asm/processor-flags.h | 3 +
arch/x86/include/asm/processor.h | 8 +-
arch/x86/include/asm/system.h | 68 +-
arch/x86/include/asm/thread_info.h | 3 -
arch/x86/include/asm/tlbflush.h | 180 ++--
arch/x86/include/asm/traps.h | 1 +
arch/x86/include/asm/uaccess.h | 31 +-
arch/x86/include/asm/uaccess_32.h | 12 +
arch/x86/include/asm/uaccess_64.h | 22 +-
arch/x86/include/asm/vsyscall.h | 1 +
arch/x86/include/asm/xen/hypercall.h | 5 +-
arch/x86/kernel/acpi/boot.c | 8 +
arch/x86/kernel/alternative.c | 313 ++++---
arch/x86/kernel/cpu/Makefile | 4 +-
arch/x86/kernel/cpu/amd.c | 28 +-
arch/x86/kernel/cpu/bugs.c | 307 ++++++-
arch/x86/kernel/cpu/bugs_64.c | 33 -
arch/x86/kernel/cpu/common.c | 124 ++-
arch/x86/kernel/cpu/mcheck/mce.c | 5 +
arch/x86/kernel/cpu/perf_event.c | 12 +
arch/x86/kernel/cpu/perf_event_intel_ds.c | 54 +-
arch/x86/kernel/entry_32.S | 26 +-
arch/x86/kernel/entry_64.S | 155 +++-
arch/x86/kernel/espfix_64.c | 10 +
arch/x86/kernel/ftrace.c | 12 +
arch/x86/kernel/head_64.S | 29 +-
arch/x86/kernel/hpet.c | 3 +
arch/x86/kernel/init_task.c | 2 +-
arch/x86/kernel/irq_32.c | 9 +-
arch/x86/kernel/irqinit.c | 2 +-
arch/x86/kernel/kprobes.c | 23 +-
arch/x86/kernel/kvm.c | 22 +-
arch/x86/kernel/ldt.c | 27 +-
arch/x86/kernel/paravirt_patch_64.c | 2 -
arch/x86/kernel/pci-calgary_64.c | 2 +-
arch/x86/kernel/process_64.c | 2 +-
arch/x86/kernel/reboot.c | 6 +
arch/x86/kernel/setup.c | 7 +
arch/x86/kernel/smpboot.c | 20 +-
arch/x86/kernel/sys_x86_64.c | 29 +-
arch/x86/kernel/vmlinux.lds.S | 7 +
arch/x86/kernel/vsyscall_64.c | 7 +-
arch/x86/kvm/emulate.c | 36 +-
arch/x86/kvm/lapic.c | 2 +-
arch/x86/kvm/mmu.c | 7 +-
arch/x86/kvm/mmu.h | 1 +
arch/x86/kvm/svm.c | 79 +-
arch/x86/kvm/vmx.c | 134 +--
arch/x86/kvm/x86.c | 172 ++--
arch/x86/kvm/x86.h | 2 +
arch/x86/lib/Makefile | 4 +-
arch/x86/lib/checksum_32.S | 7 +-
arch/x86/lib/clear_page_64.S | 4 +-
arch/x86/lib/cmdline.c | 215 +++++
arch/x86/lib/copy_page_64.S | 2 +-
arch/x86/lib/copy_user_64.S | 15 +-
arch/x86/lib/getuser.S | 8 +
arch/x86/lib/memcpy_64.S | 8 +-
arch/x86/lib/memmove_64.S | 2 +-
arch/x86/lib/memset_64.S | 8 +-
arch/x86/lib/msr.c | 89 +-
arch/x86/lib/retpoline-export.c | 25 +
arch/x86/lib/retpoline.S | 45 +
arch/x86/lib/usercopy_32.c | 5 +
arch/x86/lib/x86-opcode-map.txt | 2 +-
arch/x86/mm/Makefile | 4 +-
arch/x86/mm/hugetlbpage.c | 24 +-
arch/x86/mm/init.c | 43 +-
arch/x86/mm/init_64.c | 10 +
arch/x86/mm/kaiser.c | 455 ++++++++++
arch/x86/mm/numa_32.c | 1 +
arch/x86/mm/pgtable.c | 27 +-
arch/x86/mm/tlb.c | 112 ++-
arch/x86/oprofile/op_model_ppro.c | 4 +-
arch/x86/pci/fixup.c | 52 +-
arch/x86/pci/xen.c | 23 +-
arch/x86/um/ptrace_64.c | 2 +-
arch/x86/xen/enlighten.c | 6 +
arch/x86/xen/smp.c | 6 +-
arch/xtensa/kernel/pci-dma.c | 4 +
arch/xtensa/kernel/xtensa_ksyms.c | 7 +-
arch/xtensa/mm/cache.c | 12 +-
block/blk-core.c | 5 +-
block/bsg.c | 3 +
crypto/ahash.c | 203 +++--
crypto/algapi.c | 13 +
crypto/gcm.c | 8 +-
crypto/hmac.c | 6 +-
crypto/salsa20_generic.c | 7 -
crypto/shash.c | 13 +-
drivers/Makefile | 1 +
drivers/acpi/Makefile | 1 -
drivers/acpi/acpica/nsrepair.c | 2 +-
drivers/acpi/apei/erst.c | 2 +-
drivers/acpi/apei/ghes.c | 3 +-
drivers/acpi/power.c | 2 +-
drivers/acpi/sbshc.c | 4 +-
drivers/ata/ahci.c | 38 +
drivers/ata/libata-scsi.c | 14 +-
drivers/ata/pata_amd.c | 1 +
drivers/ata/pata_cs5536.c | 1 +
drivers/ata/sata_mv.c | 3 +
drivers/base/Kconfig | 3 +
drivers/base/bus.c | 2 +-
drivers/base/cpu.c | 49 ++
drivers/base/dma-mapping.c | 4 +-
drivers/base/isa.c | 10 +-
drivers/base/power/domain.c | 4 +-
drivers/base/regmap/regcache-lzo.c | 8 +-
drivers/bcma/main.c | 4 +
drivers/block/DAC960.c | 18 +-
drivers/block/drbd/drbd_main.c | 9 +-
drivers/block/nbd.c | 34 +-
drivers/block/xen-blkback/blkback.c | 23 +-
drivers/block/xen-blkback/common.h | 19 +-
drivers/bluetooth/ath3k.c | 2 +
drivers/bluetooth/btusb.c | 1 +
drivers/char/lp.c | 6 +-
drivers/char/mem.c | 87 +-
drivers/char/tpm/tpm.c | 9 +-
drivers/crypto/caam/caamalg.c | 4 +-
drivers/crypto/n2_core.c | 3 +
drivers/crypto/talitos.c | 4 +-
drivers/dma/ep93xx_dma.c | 2 +
drivers/edac/i7300_edac.c | 1 +
drivers/edac/mce_amd.h | 2 -
drivers/firewire/net.c | 8 +-
drivers/gpio/gpio-tegra.c | 6 +-
drivers/gpu/drm/i915/i915_dma.c | 8 +-
drivers/gpu/drm/i915/i915_drv.c | 7 -
drivers/gpu/drm/i915/i915_drv.h | 5 +-
drivers/gpu/drm/i915/intel_display.c | 12 +-
drivers/gpu/drm/radeon/radeon_bios.c | 68 +-
drivers/gpu/drm/radeon/radeon_combios.c | 7 +
drivers/gpu/drm/ttm/ttm_bo.c | 4 +-
drivers/gpu/drm/ttm/ttm_page_alloc.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 74 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 2 +
drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c | 4 +-
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 9 +-
drivers/hid/hid-core.c | 3 +
drivers/hid/hid-cypress.c | 3 +
drivers/hid/hid-ids.h | 2 +
drivers/hid/usbhid/hid-core.c | 12 +-
drivers/hid/usbhid/hid-quirks.c | 2 +
drivers/hv/hv.c | 27 +-
drivers/hv/hv_util.c | 10 +-
drivers/hwmon/asus_atk0110.c | 3 +
drivers/hwmon/ds620.c | 2 +-
drivers/hwmon/pmbus/pmbus_core.c | 21 +-
drivers/hwmon/w83781d.c | 6 +-
drivers/i2c/busses/i2c-tiny-usb.c | 25 +-
drivers/i2c/i2c-core.c | 15 +-
drivers/i2c/i2c-dev.c | 2 +-
drivers/idle/intel_idle.c | 2 +-
drivers/infiniband/core/cache.c | 57 +-
drivers/infiniband/core/cma.c | 5 +
drivers/infiniband/core/device.c | 26 +-
drivers/infiniband/core/mad.c | 2 +-
drivers/infiniband/core/multicast.c | 7 +-
drivers/infiniband/core/uverbs_cmd.c | 26 +-
drivers/infiniband/core/uverbs_main.c | 10 +-
drivers/infiniband/core/verbs.c | 44 +-
drivers/infiniband/hw/cxgb3/iwch_provider.c | 5 +-
drivers/infiniband/hw/cxgb4/cq.c | 7 +-
drivers/infiniband/hw/mlx4/cq.c | 5 +-
drivers/infiniband/hw/mlx4/main.c | 1 +
drivers/infiniband/hw/mlx4/qp.c | 4 +-
drivers/infiniband/hw/qib/qib_iba7322.c | 2 +-
drivers/infiniband/hw/qib/qib_rc.c | 3 +-
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 11 +-
drivers/infiniband/ulp/ipoib/ipoib_main.c | 1 +
drivers/infiniband/ulp/srp/ib_srp.c | 23 +-
drivers/input/ff-core.c | 13 +-
drivers/input/joystick/iforce/iforce-usb.c | 3 +
drivers/input/joystick/xpad.c | 218 ++++-
drivers/input/misc/adxl34x.c | 2 +-
drivers/input/misc/cm109.c | 4 +
drivers/input/misc/uinput.c | 18 +
drivers/input/misc/yealink.c | 4 +
drivers/input/mouse/elantech.c | 2 +-
drivers/input/mouse/trackpoint.c | 10 +-
drivers/input/mouse/trackpoint.h | 3 +-
drivers/input/serio/i8042-x86ia64io.h | 41 +
drivers/input/serio/i8042.c | 12 +-
drivers/input/tablet/gtco.c | 17 +-
drivers/input/tablet/hanwang.c | 3 +
drivers/input/tablet/kbtab.c | 3 +
drivers/iommu/amd_iommu.c | 6 +-
drivers/iommu/intel-iommu.c | 8 +-
drivers/isdn/gigaset/bas-gigaset.c | 3 +
drivers/isdn/gigaset/capi.c | 2 +
drivers/isdn/gigaset/ser-gigaset.c | 15 +-
drivers/isdn/hardware/eicon/capi20.h | 60 +-
drivers/isdn/hardware/mISDN/hfcpci.c | 4 +-
drivers/md/dm-bufio.c | 15 +-
drivers/md/dm-crypt.c | 7 +-
drivers/md/dm-mpath.c | 34 +-
drivers/md/dm-snap.c | 48 +-
drivers/md/dm-table.c | 56 +-
drivers/md/dm-thin-metadata.c | 18 +-
drivers/md/dm.c | 22 +-
drivers/md/linear.c | 29 +-
drivers/md/linear.h | 1 +
drivers/md/md.c | 7 +
drivers/md/persistent-data/dm-btree.c | 19 +-
drivers/md/raid1.c | 5 +-
drivers/md/raid5.c | 8 +-
drivers/media/common/tuners/max2165.c | 9 +-
drivers/media/common/tuners/tda18212.c | 2 +-
drivers/media/common/tuners/tda18218.c | 2 +-
drivers/media/common/tuners/xc4000.c | 2 +-
drivers/media/dvb/dm1105/Kconfig | 2 +-
drivers/media/dvb/dvb-usb/dib0700_core.c | 5 +-
drivers/media/dvb/dvb-usb/dibusb-common.c | 16 +-
drivers/media/dvb/dvb-usb/digitv.c | 4 +
drivers/media/dvb/dvb-usb/dvb-usb-firmware.c | 33 +-
drivers/media/dvb/dvb-usb/dw2102.c | 170 +++-
drivers/media/dvb/dvb-usb/mxl111sf.c | 1 -
drivers/media/dvb/dvb-usb/ttusb2.c | 36 +-
drivers/media/dvb/frontends/mb86a20s.c | 12 +-
drivers/media/dvb/frontends/tda8261_cfg.h | 2 +-
drivers/media/dvb/siano/smsusb.c | 17 +-
drivers/media/media-device.c | 3 +
drivers/media/rc/imon.c | 5 +
drivers/media/rc/ir-lirc-codec.c | 9 +-
drivers/media/rc/ir-raw.c | 13 +-
drivers/media/rc/ite-cir.c | 2 +
drivers/media/rc/mceusb.c | 9 +-
drivers/media/rc/redrat3.c | 52 +-
drivers/media/video/Makefile | 7 +-
drivers/media/video/cx231xx/cx231xx-audio.c | 41 +-
drivers/media/video/cx231xx/cx231xx-avcore.c | 5 +-
drivers/media/video/cx231xx/cx231xx-cards.c | 163 ++--
drivers/media/video/cx231xx/cx231xx-core.c | 3 +-
drivers/media/video/davinci/vpfe_capture.c | 1 +
drivers/media/video/em28xx/em28xx-audio.c | 2 +-
drivers/media/video/gspca/konica.c | 3 +
drivers/media/video/omap/omap_vout.c | 3 +-
drivers/media/video/ov2640.c | 6 +-
drivers/media/video/pvrusb2/pvrusb2-eeprom.c | 13 +-
drivers/media/video/saa7164/saa7164-buffer.c | 4 +-
drivers/media/video/saa7164/saa7164-bus.c | 96 +-
drivers/media/video/saa7164/saa7164-core.c | 13 +-
drivers/media/video/saa7164/saa7164-fw.c | 6 +-
drivers/media/video/saa7164/saa7164-types.h | 4 +-
drivers/media/video/saa7164/saa7164.h | 4 +-
drivers/media/video/usbvision/usbvision-video.c | 9 +-
drivers/media/video/uvc/uvc_ctrl.c | 7 +
drivers/media/video/v4l2-compat-ioctl32.c | 973 +++++++++++++--------
drivers/media/video/v4l2-ioctl.c | 6 +-
drivers/media/video/videobuf2-core.c | 4 +-
drivers/media/video/zr364xx.c | 8 +
drivers/mfd/mfd-core.c | 2 +
drivers/misc/eeprom/at24.c | 6 +
drivers/misc/enclosure.c | 14 +-
drivers/misc/vmw_balloon.c | 14 +-
drivers/mmc/card/block.c | 3 +-
drivers/mmc/host/mxs-mmc.c | 10 +-
drivers/mmc/host/omap_hsmmc.c | 7 +-
drivers/mmc/host/s3cmci.c | 6 +-
drivers/mmc/host/sdhci.c | 10 +-
drivers/mmc/host/ushc.c | 3 +
drivers/mtd/devices/sst25l.c | 2 +-
drivers/mtd/nand/nand_base.c | 9 +-
drivers/mtd/ubi/upd.c | 8 +-
drivers/net/can/ti_hecc.c | 19 +-
drivers/net/can/usb/ems_usb.c | 2 +
drivers/net/can/usb/esd_usb2.c | 4 +-
drivers/net/ethernet/8390/ax88796.c | 7 +-
drivers/net/ethernet/amd/nmclan_cs.c | 4 +-
drivers/net/ethernet/cirrus/ep93xx_eth.c | 4 +
drivers/net/ethernet/ethoc.c | 3 +-
.../net/ethernet/freescale/fs_enet/fs_enet-main.c | 16 +-
drivers/net/ethernet/freescale/fs_enet/fs_enet.h | 1 +
drivers/net/ethernet/freescale/ucc_geth.c | 8 +-
drivers/net/ethernet/intel/e1000e/ich8lan.c | 10 +-
drivers/net/ethernet/intel/e1000e/lib.c | 11 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 2 +-
drivers/net/ethernet/korina.c | 8 +-
drivers/net/ethernet/marvell/sky2.c | 13 +
drivers/net/ethernet/mellanox/mlx4/cmd.c | 19 +-
drivers/net/ethernet/mellanox/mlx4/cq.c | 38 +-
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 15 +-
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 7 +
drivers/net/ethernet/mellanox/mlx4/en_rx.c | 8 +-
drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +-
drivers/net/ethernet/mellanox/mlx4/fw.h | 1 +
drivers/net/ethernet/mellanox/mlx4/icm.c | 7 +-
drivers/net/ethernet/mellanox/mlx4/main.c | 2 +
drivers/net/ethernet/mellanox/mlx4/mlx4.h | 2 +
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c | 2 +-
drivers/net/ethernet/realtek/atp.c | 58 +-
drivers/net/ethernet/realtek/atp.h | 2 -
drivers/net/ethernet/realtek/r8169.c | 1 -
drivers/net/ethernet/sfc/mcdi_mac.c | 25 +-
drivers/net/ethernet/toshiba/tc35815.c | 2 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 10 +-
drivers/net/irda/irda-usb.c | 2 +-
drivers/net/macvtap.c | 10 +-
drivers/net/phy/marvell.c | 70 +-
drivers/net/phy/phy.c | 2 +-
drivers/net/ppp/pppoe.c | 11 +-
drivers/net/tun.c | 24 +-
drivers/net/usb/catc.c | 56 +-
drivers/net/usb/cdc_ether.c | 5 +-
drivers/net/usb/cx82310_eth.c | 7 +-
drivers/net/usb/rtl8150.c | 34 +-
drivers/net/usb/smsc75xx.c | 8 +-
drivers/net/usb/smsc95xx.c | 11 +-
drivers/net/wimax/i2400m/usb.c | 3 +
drivers/net/wireless/adm8211.c | 3 +-
drivers/net/wireless/ath/ath5k/mac80211-ops.c | 3 +-
drivers/net/wireless/ath/ath6kl/hif.h | 2 +-
drivers/net/wireless/ath/ath6kl/sdio.c | 4 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 12 +
.../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 2 +-
drivers/net/wireless/brcm80211/brcmsmac/aiutils.c | 3 -
drivers/net/wireless/mwifiex/cfg80211.c | 36 +-
drivers/net/wireless/mwifiex/debugfs.c | 3 +-
drivers/net/wireless/ray_cs.c | 4 +-
drivers/net/wireless/rayctl.h | 4 +-
drivers/net/wireless/rt2x00/rt2x00usb.c | 6 +-
drivers/net/wireless/rtlwifi/regd.c | 46 +-
drivers/net/wireless/rtlwifi/regd.h | 1 +
drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 5 +-
drivers/net/wireless/rtlwifi/rtl8192de/dm.c | 6 +-
drivers/net/wireless/rtlwifi/rtl8192se/phy.c | 3 +
drivers/net/wireless/wl1251/main.c | 1 +
drivers/net/wireless/wl12xx/wl12xx.h | 2 +-
drivers/net/wireless/zd1211rw/zd_usb.c | 3 +
drivers/net/xen-netfront.c | 4 +-
drivers/of/fdt.c | 2 +
drivers/parisc/dino.c | 2 +-
drivers/parisc/lba_pci.c | 33 +
drivers/pci/hotplug/rpadlpar_core.c | 10 +-
drivers/pci/hotplug/shpchp_hpc.c | 2 +
drivers/pci/pci-driver.c | 8 +-
drivers/pci/pci-sysfs.c | 10 +-
drivers/pci/pci.c | 13 +-
drivers/pci/pcie/aer/aerdrv_core.c | 9 +-
drivers/pci/proc.c | 20 +-
drivers/pci/quirks.c | 26 +-
drivers/platform/x86/intel_mid_powerbtn.c | 2 +-
drivers/platform/x86/samsung-laptop.c | 2 +-
drivers/power/pda_power.c | 44 +-
drivers/regulator/tps65910-regulator.c | 6 +
drivers/rtc/interface.c | 16 +-
drivers/rtc/rtc-m41t80.c | 157 +---
drivers/rtc/rtc-nuc900.c | 2 +-
drivers/s390/char/con3270.c | 11 +-
drivers/s390/char/vmlogrdr.c | 2 +-
drivers/s390/cio/qdio_thinint.c | 8 +-
drivers/s390/scsi/zfcp_aux.c | 5 +
drivers/s390/scsi/zfcp_dbf.c | 206 ++++-
drivers/s390/scsi/zfcp_dbf.h | 64 +-
drivers/s390/scsi/zfcp_erp.c | 87 +-
drivers/s390/scsi/zfcp_ext.h | 10 +-
drivers/s390/scsi/zfcp_fc.h | 6 +-
drivers/s390/scsi/zfcp_fsf.c | 25 +-
drivers/s390/scsi/zfcp_fsf.h | 5 +-
drivers/s390/scsi/zfcp_reqlist.h | 30 +-
drivers/s390/scsi/zfcp_scsi.c | 86 +-
drivers/scsi/aacraid/aachba.c | 48 +-
drivers/scsi/aacraid/commsup.c | 36 +-
drivers/scsi/aacraid/src.c | 21 +-
drivers/scsi/advansys.c | 3 +-
drivers/scsi/aic94xx/aic94xx_sds.c | 5 +-
drivers/scsi/arcmsr/arcmsr_hba.c | 9 -
drivers/scsi/bfa/bfad_debugfs.c | 5 +-
drivers/scsi/bnx2i/bnx2i_iscsi.c | 3 +-
drivers/scsi/ibmvscsi/ibmvfc.c | 1 -
drivers/scsi/libiscsi.c | 2 +-
drivers/scsi/libsas/sas_ata.c | 6 +-
drivers/scsi/libsas/sas_scsi_host.c | 61 +-
drivers/scsi/lpfc/lpfc_init.c | 2 +
drivers/scsi/mac_esp.c | 35 +-
drivers/scsi/megaraid/megaraid_sas.h | 2 +-
drivers/scsi/megaraid/megaraid_sas_base.c | 13 +-
drivers/scsi/mpt2sas/mpt2sas_scsih.c | 7 +-
drivers/scsi/mvsas/mv_94xx.c | 2 +-
drivers/scsi/qla2xxx/qla_attr.c | 71 +-
drivers/scsi/qla2xxx/qla_bsg.c | 12 +-
drivers/scsi/qla2xxx/qla_def.h | 1 +
drivers/scsi/qla2xxx/qla_os.c | 9 +-
drivers/scsi/scsi_debug.c | 1 +
drivers/scsi/scsi_lib.c | 10 +-
drivers/scsi/scsi_scan.c | 5 +-
drivers/scsi/scsi_sysfs.c | 4 -
drivers/scsi/scsi_transport_iscsi.c | 2 +-
drivers/scsi/sd.c | 34 +-
drivers/scsi/sg.c | 12 +-
drivers/scsi/sr.c | 6 +-
drivers/scsi/sun_esp.c | 9 +-
drivers/ssb/pci.c | 1 +
drivers/staging/bcm/Kconfig | 1 +
drivers/staging/comedi/drivers/vmk80xx.c | 2 +
drivers/staging/cxt1e1/functions.c | 9 -
drivers/staging/cxt1e1/pmcc4.h | 1 -
drivers/staging/gma500/psb_drv.c | 3 +
drivers/staging/gma500/psb_intel_lvds.c | 18 +-
drivers/staging/hv/netvsc_drv.c | 4 +
drivers/staging/iio/accel/lis3l02dq_core.c | 2 +-
drivers/staging/iio/adc/ad7298_ring.c | 2 +-
drivers/staging/iio/adc/ad7606_core.c | 2 +-
drivers/staging/iio/gyro/adis16080_core.c | 2 +-
drivers/staging/iio/impedance-analyzer/ad5933.c | 17 +-
drivers/staging/iio/light/tsl2563.c | 2 +-
drivers/staging/iio/meter/ade7759.c | 2 +-
drivers/staging/iio/resolver/ad2s1210.c | 2 +-
drivers/staging/media/as102/as102_fw.c | 28 +-
drivers/staging/media/lirc/lirc_zilog.c | 8 +-
drivers/staging/rtl8712/rtl871x_recv.c | 7 +-
drivers/staging/slicoss/slicoss.c | 2 +-
drivers/staging/usbip/stub_dev.c | 3 +-
drivers/staging/usbip/stub_main.c | 9 +-
drivers/staging/usbip/stub_rx.c | 67 +-
drivers/staging/usbip/stub_tx.c | 15 +-
drivers/staging/usbip/usbip_common.c | 85 +-
drivers/staging/usbip/usbip_common.h | 4 +-
.../staging/usbip/userspace/libsrc/usbip_common.c | 2 +-
.../staging/usbip/userspace/libsrc/vhci_driver.c | 8 +-
drivers/staging/usbip/userspace/src/utils.c | 9 +-
drivers/staging/usbip/vhci_hcd.c | 62 +-
drivers/staging/usbip/vhci_rx.c | 26 +-
drivers/staging/usbip/vhci_sysfs.c | 20 +-
drivers/staging/usbip/vhci_tx.c | 3 +-
drivers/staging/vme/bridges/vme_ca91cx42.c | 2 +-
drivers/staging/vt6655/device_main.c | 8 +-
drivers/staging/wlan-ng/p80211netdev.c | 2 +
drivers/staging/wlan-ng/prism2fw.c | 157 ++--
drivers/target/iscsi/iscsi_target_parameters.c | 16 -
drivers/target/iscsi/iscsi_target_tpg.c | 1 -
drivers/thermal/thermal_sys.c | 2 +-
drivers/tty/n_hdlc.c | 143 ++-
drivers/tty/n_tty.c | 4 +-
drivers/tty/serial/8250_pci.c | 16 +
drivers/tty/serial/msm_serial.c | 1 +
drivers/tty/serial/mxs-auart.c | 10 +-
drivers/tty/serial/sh-sci.c | 10 +-
drivers/tty/sysrq.c | 4 +-
drivers/tty/tty_ldisc.c | 7 +
drivers/tty/vt/vt.c | 13 +-
drivers/usb/class/cdc-acm.c | 20 +-
drivers/usb/class/usbtmc.c | 9 +-
drivers/usb/core/config.c | 62 +-
drivers/usb/core/devio.c | 36 +-
drivers/usb/core/driver.c | 21 +
drivers/usb/core/file.c | 9 +-
drivers/usb/core/hcd.c | 6 +-
drivers/usb/core/hub.c | 41 +-
drivers/usb/core/quirks.c | 33 +-
drivers/usb/dwc3/gadget.c | 6 +
drivers/usb/dwc3/gadget.h | 14 +-
drivers/usb/gadget/composite.c | 14 +-
drivers/usb/gadget/dummy_hcd.c | 68 +-
drivers/usb/gadget/f_acm.c | 4 +-
drivers/usb/gadget/f_hid.c | 51 +-
drivers/usb/gadget/f_mass_storage.c | 13 +-
drivers/usb/gadget/inode.c | 89 +-
drivers/usb/gadget/u_ether.c | 7 -
drivers/usb/host/ehci-dbg.c | 2 +-
drivers/usb/host/pci-quirks.c | 8 +-
drivers/usb/host/r8a66597-hcd.c | 6 +-
drivers/usb/host/uhci-pci.c | 4 +
drivers/usb/host/xhci-hub.c | 40 +
drivers/usb/host/xhci-mem.c | 63 +-
drivers/usb/host/xhci-pci.c | 32 +-
drivers/usb/host/xhci-ring.c | 55 +-
drivers/usb/host/xhci.c | 68 +-
drivers/usb/host/xhci.h | 6 +-
drivers/usb/misc/idmouse.c | 3 +
drivers/usb/misc/iowarrior.c | 23 +-
drivers/usb/misc/legousbtower.c | 35 +-
drivers/usb/misc/usbtest.c | 5 +-
drivers/usb/misc/uss720.c | 5 +
drivers/usb/mon/mon_bin.c | 8 +-
drivers/usb/musb/musbhsdma.h | 2 +-
drivers/usb/musb/tusb6010_omap.c | 13 +-
drivers/usb/renesas_usbhs/common.c | 10 +-
drivers/usb/renesas_usbhs/fifo.c | 23 +-
drivers/usb/renesas_usbhs/mod_gadget.c | 6 +-
drivers/usb/renesas_usbhs/mod_host.c | 6 +-
drivers/usb/renesas_usbhs/pipe.h | 6 +-
drivers/usb/serial/ark3116.c | 38 +-
drivers/usb/serial/ch341.c | 216 +++--
drivers/usb/serial/console.c | 1 +
drivers/usb/serial/cp210x.c | 9 +
drivers/usb/serial/cyberjack.c | 3 +
drivers/usb/serial/digi_acceleport.c | 52 +-
drivers/usb/serial/ftdi_sio.c | 46 +-
drivers/usb/serial/ftdi_sio_ids.h | 19 +
drivers/usb/serial/garmin_gps.c | 23 +-
drivers/usb/serial/io_edgeport.c | 53 +-
drivers/usb/serial/io_ti.c | 29 +-
drivers/usb/serial/ir-usb.c | 21 +-
drivers/usb/serial/iuu_phoenix.c | 5 +
drivers/usb/serial/keyspan_pda.c | 27 +-
drivers/usb/serial/kl5kusb105.c | 44 +-
drivers/usb/serial/kobil_sct.c | 5 +
drivers/usb/serial/mct_u232.c | 10 +-
drivers/usb/serial/mos7720.c | 51 +-
drivers/usb/serial/mos7840.c | 12 +-
drivers/usb/serial/omninet.c | 10 +-
drivers/usb/serial/option.c | 38 +-
drivers/usb/serial/oti6858.c | 8 +
drivers/usb/serial/pl2303.c | 9 +
drivers/usb/serial/pl2303.h | 1 +
drivers/usb/serial/safe_serial.c | 5 +
drivers/usb/serial/spcp8x5.c | 7 +
drivers/usb/serial/ssu100.c | 31 +-
drivers/usb/serial/ti_usb_3410_5052.c | 19 +-
drivers/usb/storage/ene_ub6250.c | 90 +-
drivers/usb/storage/isd200.c | 5 +-
drivers/usb/storage/transport.c | 7 +-
drivers/usb/storage/unusual_devs.h | 14 +
drivers/usb/wusbcore/wa-hc.c | 3 +
drivers/uwb/hwa-rc.c | 5 +
drivers/uwb/i1480/dfu/usb.c | 8 +-
drivers/uwb/lc-rc.c | 16 +-
drivers/uwb/uwbd.c | 12 +-
drivers/video/Kconfig | 2 -
drivers/video/Makefile | 1 +
drivers/video/aty/atyfb_base.c | 2 +-
drivers/video/efifb.c | 6 +-
drivers/video/fbcmap.c | 26 +-
drivers/video/udlfb.c | 10 +-
drivers/video/xen-fbfront.c | 4 +-
drivers/virtio/virtio_balloon.c | 4 +
drivers/watchdog/pcwd_usb.c | 3 +
drivers/xen/biomerge.c | 3 +-
fs/9p/vfs_inode.c | 3 +
fs/9p/vfs_inode_dotl.c | 3 +
fs/autofs4/dev-ioctl.c | 2 +-
fs/autofs4/waitq.c | 45 +-
fs/bio.c | 22 +-
fs/block_dev.c | 2 +-
fs/btrfs/acl.c | 21 +-
fs/btrfs/extent-tree.c | 14 +-
fs/btrfs/ioctl.c | 8 +-
fs/btrfs/tree-log.c | 3 +-
fs/ceph/mds_client.c | 4 +-
fs/cifs/cifssmb.c | 27 +-
fs/cifs/dir.c | 8 +
fs/cifs/netmisc.c | 6 +-
fs/coda/upcall.c | 3 +-
fs/compat.c | 10 +-
fs/compat_ioctl.c | 1 -
fs/configfs/symlink.c | 3 +-
fs/dcache.c | 1 +
fs/dlm/user.c | 4 +
fs/ecryptfs/ecryptfs_kernel.h | 25 +-
fs/ecryptfs/keystore.c | 11 +-
fs/ecryptfs/messaging.c | 8 +-
fs/eventpoll.c | 38 +-
fs/exec.c | 34 +-
fs/ext2/acl.c | 45 +-
fs/ext3/acl.c | 50 +-
fs/ext4/acl.c | 45 +-
fs/ext4/ext4.h | 1 +
fs/ext4/extents.c | 2 +
fs/ext4/inode.c | 100 ++-
fs/ext4/mballoc.c | 11 +-
fs/ext4/namei.c | 18 +-
fs/ext4/super.c | 96 +-
fs/fcntl.c | 13 +-
fs/fscache/object-list.c | 7 +
fs/fuse/cuse.c | 2 +-
fs/fuse/dir.c | 63 +-
fs/fuse/file.c | 3 +-
fs/hugetlbfs/inode.c | 4 +-
fs/internal.h | 2 +-
fs/ioprio.c | 2 +
fs/isofs/inode.c | 8 +-
fs/isofs/isofs.h | 2 +-
fs/isofs/rock.h | 2 +-
fs/isofs/util.c | 2 +-
fs/jbd2/transaction.c | 4 +-
fs/namespace.c | 26 +-
fs/nfs/client.c | 1 +
fs/nfs/file.c | 2 +-
fs/nfs/nfs4proc.c | 44 +-
fs/nfs/nfs4state.c | 3 +
fs/nfs/nfs4xdr.c | 2 +
fs/nfsd/auth.c | 3 +
fs/nfsd/nfs3xdr.c | 12 +-
fs/nfsd/nfssvc.c | 36 +
fs/nfsd/nfsxdr.c | 10 +-
fs/nfsd/vfs.c | 67 +-
fs/nilfs2/btree.c | 2 +-
fs/nilfs2/recovery.c | 4 +-
fs/nilfs2/segment.c | 6 +-
fs/nilfs2/super.c | 5 +-
fs/notify/inode_mark.c | 46 +-
fs/ocfs2/acl.c | 24 +-
fs/ocfs2/alloc.c | 26 +-
fs/ocfs2/dlmglue.c | 10 +
fs/ocfs2/file.c | 9 +-
fs/ocfs2/stackglue.c | 6 +
fs/ocfs2/stackglue.h | 3 +
fs/partitions/check.c | 4 +-
fs/proc/array.c | 2 +-
fs/proc/base.c | 12 +-
fs/proc/namespaces.c | 4 +-
fs/proc/task_mmu.c | 4 -
fs/read_write.c | 4 +-
fs/reiserfs/super.c | 12 +-
fs/reiserfs/xattr_acl.c | 46 +-
fs/splice.c | 1 +
fs/timerfd.c | 17 +-
fs/ubifs/dir.c | 16 +-
fs/ubifs/journal.c | 8 +-
fs/ubifs/tnc.c | 29 +-
fs/ubifs/ubifs.h | 1 +
fs/ubifs/xattr.c | 24 +
fs/udf/file.c | 9 +-
fs/udf/inode.c | 4 +-
fs/ufs/inode.c | 5 +-
fs/ufs/super.c | 18 +
fs/ufs/truncate.c | 6 -
fs/ufs/util.h | 10 +-
fs/xattr.c | 2 +-
fs/xfs/xfs_dfrag.c | 7 +-
fs/xfs/xfs_dinode.h | 9 +-
fs/xfs/xfs_ialloc.c | 2 +-
fs/xfs/xfs_log.c | 7 -
include/asm-generic/dma-mapping-broken.h | 3 -
include/asm-generic/siginfo.h | 4 +-
include/asm-generic/topology.h | 6 +-
include/asm-generic/vmlinux.lds.h | 7 +
include/crypto/internal/hash.h | 18 +
include/linux/bitops.h | 3 +
include/linux/blkdev.h | 1 +
include/linux/can.h | 1 +
include/linux/can/core.h | 7 +-
include/linux/cpu.h | 19 +-
include/linux/cpumask.h | 17 +
include/linux/cpuset.h | 4 +-
include/linux/cred.h | 1 +
include/linux/device-mapper.h | 70 +-
include/linux/dma-mapping.h | 2 -
include/linux/fdtable.h | 5 +-
include/linux/filter.h | 6 +-
include/linux/fscache.h | 2 +-
include/linux/init.h | 9 +-
include/linux/input.h | 1 +
include/linux/kaiser.h | 52 ++
include/linux/kconfig.h | 23 +-
include/linux/key.h | 2 +
include/linux/kprobes.h | 4 +-
include/linux/list.h | 11 +
include/linux/lockd/lockd.h | 3 +-
include/linux/lockdep.h | 2 +-
include/linux/mlx4/device.h | 1 +
include/linux/mm.h | 53 +-
include/linux/mmu_context.h | 7 +
include/linux/mmzone.h | 3 +-
include/linux/module.h | 9 +
include/linux/mtd/map.h | 2 +-
include/linux/netdevice.h | 9 +-
include/linux/netfilter/nf_conntrack_common.h | 9 +
include/linux/nospec.h | 59 ++
include/linux/pci_ids.h | 1 +
include/linux/percpu-defs.h | 32 +-
include/linux/perf_event.h | 6 -
include/linux/ptrace.h | 24 +-
include/linux/sched.h | 26 +-
include/linux/signal.h | 24 +-
include/linux/skbuff.h | 8 +
include/linux/spi/spidev.h | 1 +
include/linux/stddef.h | 10 +
include/linux/usb/ch11.h | 3 +
include/linux/usb/ch9.h | 22 +
include/linux/usb/hcd.h | 4 +-
include/linux/usb/quirks.h | 6 +
include/net/bluetooth/hci_core.h | 1 -
include/net/bluetooth/l2cap.h | 1 +
include/net/cipso_ipv4.h | 4 +
include/net/ip6_fib.h | 35 +-
include/net/ip6_route.h | 2 +-
include/net/red.h | 11 +
include/net/sctp/sctp.h | 6 +
include/net/sctp/structs.h | 8 +-
include/net/sock.h | 27 +-
include/net/tcp.h | 7 +-
include/net/xfrm.h | 11 +-
include/rdma/ib_sa.h | 6 +-
include/rdma/ib_verbs.h | 34 +
include/scsi/libsas.h | 14 +-
include/scsi/scsi_device.h | 1 +
include/scsi/scsi_devinfo.h | 1 +
include/sound/seq_kernel.h | 3 +-
include/sound/seq_virmidi.h | 1 +
include/sound/timer.h | 2 +
include/trace/events/kvm.h | 7 +-
include/trace/events/syscalls.h | 1 +
init/main.c | 2 +
ipc/mqueue.c | 4 +-
ipc/shm.c | 9 +-
kernel/audit_watch.c | 12 +-
kernel/cpu.c | 24 +-
kernel/cpuset.c | 9 +-
kernel/debug/kdb/kdb_io.c | 2 +-
kernel/events/core.c | 430 +++++++--
kernel/extable.c | 2 +
kernel/fork.c | 6 +
kernel/futex.c | 29 +-
kernel/futex_compat.c | 2 +-
kernel/gcov/Kconfig | 30 +
kernel/gcov/Makefile | 32 +-
kernel/gcov/base.c | 38 +-
kernel/gcov/fs.c | 27 +-
kernel/gcov/gcc_3_4.c | 115 +++
kernel/gcov/gcc_4_7.c | 565 ++++++++++++
kernel/gcov/gcov.h | 65 +-
kernel/groups.c | 5 +-
kernel/hrtimer.c | 2 +
kernel/irq/irqdesc.c | 24 +-
kernel/kprobes.c | 12 +-
kernel/module.c | 11 +
kernel/padata.c | 2 +-
kernel/params.c | 2 +-
kernel/posix-timers.c | 37 +-
kernel/ptrace.c | 56 +-
kernel/rtmutex.c | 68 +-
kernel/sched.c | 10 +-
kernel/signal.c | 20 +-
kernel/sysctl.c | 4 +-
kernel/time/alarmtimer.c | 12 +-
kernel/trace/blktrace.c | 76 +-
kernel/trace/ring_buffer.c | 22 +-
kernel/trace/trace.c | 2 +-
kernel/trace/trace_kprobe.c | 18 +-
kernel/trace/trace_selftest.c | 2 +-
kernel/uid16.c | 1 +
lib/cmdline.c | 6 +-
lib/cpumask.c | 32 +
lib/genalloc.c | 3 +-
lib/vsprintf.c | 2 +-
mm/filemap.c | 5 +
mm/huge_memory.c | 20 +-
mm/memory.c | 49 --
mm/mempolicy.c | 54 +-
mm/migrate.c | 45 +-
mm/mmap.c | 191 ++--
mm/mmu_context.c | 2 +-
mm/mprotect.c | 6 +-
mm/page_alloc.c | 20 +-
mm/page_cgroup.c | 3 +
mm/process_vm_access.c | 2 +-
mm/slab.c | 4 +-
mm/swapfile.c | 2 +
mm/vmstat.c | 3 +-
net/8021q/vlan.c | 6 +-
net/9p/client.c | 7 +-
net/9p/trans_virtio.c | 13 +-
net/batman-adv/bat_iv_ogm.c | 4 +-
net/bluetooth/bnep/core.c | 3 +
net/bluetooth/cmtp/core.c | 3 +
net/bluetooth/hci_conn.c | 16 -
net/bluetooth/hci_sock.c | 3 +-
net/bluetooth/hidp/core.c | 2 +
net/bluetooth/l2cap_core.c | 63 +-
net/bluetooth/l2cap_sock.c | 6 +
net/bridge/br_ioctl.c | 5 +-
net/bridge/br_netlink.c | 7 +-
net/can/af_can.c | 24 +-
net/can/af_can.h | 3 +-
net/can/bcm.c | 59 +-
net/can/gw.c | 2 +-
net/can/raw.c | 7 +-
net/ceph/messenger.c | 13 +
net/ceph/osdmap.c | 1 +
net/core/dev.c | 8 +-
net/core/drop_monitor.c | 39 +-
net/core/filter.c | 10 +-
net/core/rtnetlink.c | 8 +-
net/core/skbuff.c | 20 +-
net/core/sock.c | 83 +-
net/dccp/ccids/ccid2.c | 3 +
net/dccp/input.c | 3 +-
net/dccp/ipv4.c | 34 +-
net/dccp/ipv6.c | 30 +-
net/dccp/probe.c | 14 +-
net/dccp/proto.c | 9 +
net/decnet/dn_route.c | 9 +-
net/ipv4/af_inet.c | 2 +-
net/ipv4/cipso_ipv4.c | 4 +
net/ipv4/esp4.c | 1 +
net/ipv4/fib_frontend.c | 9 +-
net/ipv4/igmp.c | 75 +-
net/ipv4/inet_connection_sock.c | 2 +
net/ipv4/ip_output.c | 2 +-
net/ipv4/ip_sockglue.c | 3 +-
net/ipv4/ipmr.c | 4 +-
net/ipv4/netfilter/nf_nat_snmp_basic.c | 19 +-
net/ipv4/ping.c | 11 +-
net/ipv4/raw.c | 119 ++-
net/ipv4/route.c | 12 +
net/ipv4/tcp.c | 10 +
net/ipv4/tcp_input.c | 11 +-
net/ipv4/tcp_ipv4.c | 21 +-
net/ipv4/tcp_lp.c | 6 +-
net/ipv4/tcp_output.c | 24 +-
net/ipv4/xfrm4_input.c | 11 +-
net/ipv6/addrconf.c | 35 +-
net/ipv6/af_inet6.c | 10 +-
net/ipv6/esp6.c | 3 +-
net/ipv6/exthdrs.c | 2 +-
net/ipv6/ip6_fib.c | 47 +-
net/ipv6/ip6_output.c | 40 +-
net/ipv6/ip6_tunnel.c | 54 +-
net/ipv6/ip6mr.c | 1 +
net/ipv6/mcast.c | 50 +-
net/ipv6/raw.c | 7 +-
net/ipv6/route.c | 16 +-
net/ipv6/tcp_ipv6.c | 10 +-
net/ipv6/udp.c | 6 +-
net/ipv6/xfrm6_input.c | 9 +-
net/ipv6/xfrm6_mode_ro.c | 2 +
net/ipv6/xfrm6_mode_transport.c | 2 +
net/ipv6/xfrm6_policy.c | 6 +-
net/ipx/af_ipx.c | 5 +-
net/irda/irqueue.c | 34 +-
net/iucv/af_iucv.c | 8 +-
net/key/af_key.c | 117 ++-
net/l2tp/l2tp_core.c | 263 ++++--
net/l2tp/l2tp_core.h | 36 +-
net/l2tp/l2tp_debugfs.c | 10 +-
net/l2tp/l2tp_eth.c | 164 ++--
net/l2tp/l2tp_ip.c | 71 +-
net/l2tp/l2tp_netlink.c | 126 +--
net/l2tp/l2tp_ppp.c | 393 +++++----
net/llc/llc_conn.c | 3 +
net/llc/llc_sap.c | 3 +
net/mac80211/key.c | 54 +-
net/mac80211/mesh.c | 2 +-
net/mac80211/rx.c | 51 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_conntrack_core.c | 28 +-
net/netfilter/nf_conntrack_netlink.c | 34 +-
net/netfilter/nf_conntrack_sip.c | 5 +-
net/netfilter/xt_TCPMSS.c | 43 +-
net/netfilter/xt_TCPOPTSTRIP.c | 19 +-
net/netfilter/xt_socket.c | 12 +-
net/packet/af_packet.c | 205 +++--
net/rds/rdma.c | 6 +-
net/rose/rose_in.c | 3 +-
net/rxrpc/ar-key.c | 64 +-
net/sched/act_api.c | 5 +-
net/sched/act_csum.c | 8 +-
net/sched/act_nat.c | 18 +-
net/sched/act_pedit.c | 24 +-
net/sched/cls_api.c | 7 +-
net/sched/em_meta.c | 9 +-
net/sched/sch_api.c | 2 +
net/sched/sch_cbq.c | 10 +-
net/sched/sch_choke.c | 3 +
net/sched/sch_drr.c | 2 +-
net/sched/sch_dsmark.c | 13 +-
net/sched/sch_gred.c | 3 +
net/sched/sch_hfsc.c | 4 +-
net/sched/sch_htb.c | 10 +-
net/sched/sch_mq.c | 10 +-
net/sched/sch_mqprio.c | 19 +-
net/sched/sch_multiq.c | 9 +-
net/sched/sch_netem.c | 4 +-
net/sched/sch_qfq.c | 2 +-
net/sched/sch_red.c | 2 +
net/sched/sch_tbf.c | 5 +-
net/sctp/ipv6.c | 163 ++--
net/sctp/protocol.c | 12 +-
net/sctp/sm_sideeffect.c | 20 +-
net/sctp/sm_statefuns.c | 12 +-
net/sctp/socket.c | 72 +-
net/sctp/transport.c | 4 +-
net/sctp/ulpevent.c | 2 +-
net/socket.c | 19 +-
net/sunrpc/auth_gss/svcauth_gss.c | 3 +-
net/sunrpc/svcauth_unix.c | 2 +
net/tipc/bearer.h | 16 +
net/tipc/eth_media.c | 12 +-
net/unix/garbage.c | 18 +-
net/wireless/core.c | 7 +-
net/wireless/nl80211.c | 10 +-
net/wireless/util.c | 14 +-
net/wireless/wext-compat.c | 3 +-
commit 68f705428e49eb41a041c548b478173ff547f404
Author: Ben Hutchings <b...@decadent.org.uk>
Date: Mon Mar 19 18:58:41 2018 +0000
Linux 3.2.101
commit 8c88e12bec09a4076540c46b07c42fb541c31560
Author: Paul Gortmaker <paul.gortma...@windriver.com>
Date: Wed Apr 18 21:58:43 2012 +0200
cris: Remove old legacy "-traditional" flag from arch-v10/lib/Makefile
commit 7b91747d42a1012e3781dd09fa638d113809e3fd upstream.
Most of these have been purged years ago. This one silently lived
on until commit 69349c2dc01c489eccaa4c472542c08e370c6d7e
"kconfig: fix IS_ENABLED to not require all options to be defined"
In the above, we use some macro trickery to create a conditional that
is valid in CPP and in C usage. However that trickery doesn't sit
well if you have the legacy "-traditional" flag enabled. You'll get:
AS arch/cris/arch-v10/lib/checksum.o
In file included from <command-line>:4:0:
include/linux/kconfig.h:23:0: error: syntax error in macro parameter list
make[2]: *** [arch/cris/arch-v10/lib/checksum.o] Error 1
Everything builds fine w/o "-traditional" so simply drop it from this
location as well.
Signed-off-by: Paul Gortmaker <paul.gortma...@windriver.com>
Signed-off-by: Jesper Nilsson <jesper.nils...@axis.com>
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit f7e4e4b3187795e50dcb4da5244b397ce5ca4a77
Author: Arnd Bergmann <a...@arndb.de>
Date: Thu Feb 15 16:16:57 2018 +0100
x86: fix build warnign with 32-bit PAE
I ran into a 4.9 build warning in randconfig testing, starting with the
KAISER patches:
arch/x86/kernel/ldt.c: In function 'alloc_ldt_struct':
arch/x86/include/asm/pgtable_types.h:208:24: error: large integer
implicitly truncated to unsigned type [-Werror=overflow]
#define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
^
arch/x86/kernel/ldt.c:81:6: note: in expansion of macro '__PAGE_KERNEL'
__PAGE_KERNEL);
^~~~~~~~~~~~~
I originally ran into this last year when the patches were part of
linux-next,
and tried to work around it by using the proper 'pteval_t' types
consistently,
but that caused additional problems.
This takes a much simpler approach, and makes the argument type of the dummy
helper always 64-bit, which is wide enough for any page table layout and
won't hurt since this call is just an empty stub anyway.
Fixes: 8f0baadf2bea ("kaiser: merged update")
Signed-off-by: Arnd Bergmann <a...@arndb.de>
Acked-by: Kees Cook <keesc...@chromium.org>
Acked-by: Hugh Dickins <hu...@google.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 68f7d993a826bc3f8542b61ca85673eb15e43b86
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:02:49 2018 -0800
x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec
commit 304ec1b050310548db33063e567123fae8fd0301 upstream.
Quoting Linus:
I do think that it would be a good idea to very expressly document
the fact that it's not that the user access itself is unsafe. I do
agree that things like "get_user()" want to be protected, but not
because of any direct bugs or problems with get_user() and friends,
but simply because get_user() is an excellent source of a pointer
that is obviously controlled from a potentially attacking user
space. So it's a prime candidate for then finding _subsequent_
accesses that can then be used to perturb the cache.
__uaccess_begin_nospec() covers __get_user() and copy_from_iter() where the
limit check is far away from the user pointer de-reference. In those cases
a barrier_nospec() prevents speculation with a potential pointer to
privileged memory. uaccess_try_nospec covers get_user_try.
Suggested-by: Linus Torvalds <torva...@linux-foundation.org>
Suggested-by: Andi Kleen <a...@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: Kees Cook <keesc...@chromium.org>
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Al Viro <v...@zeniv.linux.org.uk>
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727416953.33451.10508284228526170604.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- There's no SMAP support, so use barrier_nospec() directly instead of
__uaccess_begin_nospec()
- Convert several more functions to use barrier_nospec(), that are just
wrappers in mainline
- There's no 'case 8' in __copy_to_user_inatomic()
- Adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit db24e93e36ab2d3591bfd6008b37a5c82a91610c
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:02:39 2018 -0800
x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec
commit b3bbfb3fb5d25776b8e3f361d2eedaabb0b496cd upstream.
For __get_user() paths, do not allow the kernel to speculate on the value
of a user controlled pointer. In addition to the 'stac' instruction for
Supervisor Mode Access Protection (SMAP), a barrier_nospec() causes the
access_ok() result to resolve in the pipeline before the CPU might take any
speculative action on the pointer value. Given the cost of 'stac' the
speculation barrier is placed after 'stac' to hopefully overlap the cost of
disabling SMAP with the cost of flushing the instruction pipeline.
Since __get_user is a major kernel interface that deals with user
controlled pointers, the __uaccess_begin_nospec() mechanism will prevent
speculative execution past an access_ok() permission check. While
speculative execution past access_ok() is not enough to lead to a kernel
memory leak, it is a necessary precondition.
To be clear, __uaccess_begin_nospec() is addressing a class of potential
problems near __get_user() usages.
Note, that while the barrier_nospec() in __uaccess_begin_nospec() is used
to protect __get_user(), pointer masking similar to array_index_nospec()
will be used for get_user() since it incorporates a bounds check near the
usage.
uaccess_try_nospec provides the same mechanism for get_user_try.
No functional changes.
Suggested-by: Linus Torvalds <torva...@linux-foundation.org>
Suggested-by: Andi Kleen <a...@linux.intel.com>
Suggested-by: Ingo Molnar <mi...@redhat.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Cc: Kees Cook <keesc...@chromium.org>
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Al Viro <v...@zeniv.linux.org.uk>
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727415922.33451.5796614273104346583.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- There's no SMAP support, so only add uaccess_try_nospec()
- Use current_thread_info() and save the previous error state, matching
uaccess_try()]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 1c6a0a70d462cffbad854123c47f51906539ca2d
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Fri Feb 16 13:20:54 2018 -0800
nospec: Include <asm/barrier.h> dependency
commit eb6174f6d1be16b19cfa43dac296bfed003ce1a6 upstream.
The nospec.h header expects the per-architecture header file
<asm/barrier.h> to optionally define array_index_mask_nospec(). Include
that dependency to prevent inadvertent fallback to the default
array_index_mask_nospec() implementation.
The default implementation may not provide a full mitigation
on architectures that perform data value speculation.
Reported-by: Christian Borntraeger <borntrae...@de.ibm.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Cc: Andy Lutomirski <l...@kernel.org>
Cc: Arjan van de Ven <ar...@linux.intel.com>
Cc: Borislav Petkov <b...@alien8.de>
Cc: Dave Hansen <dave.han...@linux.intel.com>
Cc: David Woodhouse <dw...@infradead.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoim...@redhat.com>
Cc: Linus Torvalds <torva...@linux-foundation.org>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Will Deacon <will.dea...@arm.com>
Cc: linux-a...@vger.kernel.org
Link:
http://lkml.kernel.org/r/151881605404.17395.1341935530792574707.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar <mi...@kernel.org>
[bwh: Backported to 3.2: include <asm/system.h> instead]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 97c29e9247635d48f38c9de5674543cf6d295c8a
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Fri Feb 16 13:20:42 2018 -0800
nospec: Kill array_index_nospec_mask_check()
commit 1d91c1d2c80cb70e2e553845e278b87a960c04da upstream.
There are multiple problems with the dynamic sanity checking in
array_index_nospec_mask_check():
* It causes unnecessary overhead in the 32-bit case since integer sized
@index values will no longer cause the check to be compiled away like
in the 64-bit case.
* In the 32-bit case it may trigger with user controllable input when
the expectation is that should only trigger during development of new
kernel enabling.
* The macro reuses the input parameter in multiple locations which is
broken if someone passes an expression like 'index++' to
array_index_nospec().
Reported-by: Linus Torvalds <torva...@linux-foundation.org>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Cc: Andy Lutomirski <l...@kernel.org>
Cc: Arjan van de Ven <ar...@linux.intel.com>
Cc: Borislav Petkov <b...@alien8.de>
Cc: Dave Hansen <dave.han...@linux.intel.com>
Cc: David Woodhouse <dw...@infradead.org>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Josh Poimboeuf <jpoim...@redhat.com>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Will Deacon <will.dea...@arm.com>
Cc: linux-a...@vger.kernel.org
Link:
http://lkml.kernel.org/r/151881604278.17395.6605847763178076520.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar <mi...@kernel.org>
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit a0297ead3b507d5a59d476d33f97f3f4f0662356
Author: Will Deacon <will.dea...@arm.com>
Date: Mon Feb 5 14:16:06 2018 +0000
nospec: Move array_index_nospec() parameter checking into separate macro
commit 8fa80c503b484ddc1abbd10c7cb2ab81f3824a50 upstream.
For architectures providing their own implementation of
array_index_mask_nospec() in asm/barrier.h, attempting to use WARN_ONCE() to
complain about out-of-range parameters using WARN_ON() results in a mess
of mutually-dependent include files.
Rather than unpick the dependencies, simply have the core code in nospec.h
perform the checking for us.
Signed-off-by: Will Deacon <will.dea...@arm.com>
Acked-by: Thomas Gleixner <t...@linutronix.de>
Cc: Dan Williams <dan.j.willi...@intel.com>
Cc: Linus Torvalds <torva...@linux-foundation.org>
Cc: Peter Zijlstra <pet...@infradead.org>
Link:
http://lkml.kernel.org/r/1517840166-15399-1-git-send-email-will.dea...@arm.com
Signed-off-by: Ingo Molnar <mi...@kernel.org>
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 934a72b07a2dca0014fe47fd388ed2ba0c5c64d7
Author: Dan Carpenter <dan.carpen...@oracle.com>
Date: Wed Feb 14 10:14:17 2018 +0300
x86/spectre: Fix an error message
commit 9de29eac8d2189424d81c0d840cd0469aa3d41c8 upstream.
If i == ARRAY_SIZE(mitigation_options) then we accidentally print
garbage from one space beyond the end of the mitigation_options[] array.
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>
Cc: Andy Lutomirski <l...@kernel.org>
Cc: Borislav Petkov <b...@suse.de>
Cc: David Woodhouse <d...@amazon.co.uk>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: KarimAllah Ahmed <karah...@amazon.de>
Cc: Linus Torvalds <torva...@linux-foundation.org>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: kernel-janit...@vger.kernel.org
Fixes: 9005c6834c0f ("x86/spectre: Simplify spectre_v2 command line
parsing")
Link: http://lkml.kernel.org/r/20180214071416.GA26677@mwanda
Signed-off-by: Ingo Molnar <mi...@kernel.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit a5d80bba16148fd5b2a57d494874c82e847197c3
Author: David Woodhouse <d...@amazon.co.uk>
Date: Sat Jan 27 16:24:32 2018 +0000
x86/cpufeatures: Clean up Spectre v2 related CPUID flags
commit 2961298efe1ea1b6fc0d7ee8b76018fa6c0bcef2 upstream.
We want to expose the hardware features simply in /proc/cpuinfo as "ibrs",
"ibpb" and "stibp". Since AMD has separate CPUID bits for those, use them
as the user-visible bits.
When the Intel SPEC_CTRL bit is set which indicates both IBRS and IBPB
capability, set those (AMD) bits accordingly. Likewise if the Intel STIBP
bit is set, set the AMD STIBP that's used for the generic hardware
capability.
Hide the rest from /proc/cpuinfo by putting "" in the comments. Including
RETPOLINE and RETPOLINE_AMD which shouldn't be visible there. There are
patches to make the sysfs vulnerabilities information non-readable by
non-root, and the same should apply to all information about which
mitigations are actually in use. Those *shouldn't* appear in /proc/cpuinfo.
The feature bit for whether IBPB is actually used, which is needed for
ALTERNATIVEs, is renamed to X86_FEATURE_USE_IBPB.
Originally-by: Borislav Petkov <b...@suse.de>
Signed-off-by: David Woodhouse <d...@amazon.co.uk>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: a...@linux.intel.com
Cc: dave.han...@intel.com
Cc: karah...@amazon.de
Cc: ar...@linux.intel.com
Cc: torva...@linux-foundation.org
Cc: pet...@infradead.org
Cc: b...@alien8.de
Cc: pbonz...@redhat.com
Cc: tim.c.c...@linux.intel.com
Cc: gre...@linux-foundation.org
Link:
https://lkml.kernel.org/r/1517070274-12128-2-git-send-email-d...@amazon.co.uk
[bwh: For 3.2, just apply the part that hides fake CPU feature bits]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 52e39c02a9af258b2d0e957f10c0559e0ad00e97
Author: Darren Kenny <darren.ke...@oracle.com>
Date: Fri Feb 2 19:12:20 2018 +0000
x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
commit af189c95a371b59f493dbe0f50c0a09724868881 upstream.
Fixes: 117cc7a908c83 ("x86/retpoline: Fill return stack buffer on vmexit")
Signed-off-by: Darren Kenny <darren.ke...@oracle.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.w...@oracle.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Cc: Andi Kleen <a...@linux.intel.com>
Cc: Borislav Petkov <b...@alien8.de>
Cc: Masami Hiramatsu <mhira...@kernel.org>
Cc: Arjan van de Ven <ar...@linux.intel.com>
Cc: David Woodhouse <d...@amazon.co.uk>
Link:
https://lkml.kernel.org/r/20180202191220.blvgkgutojecx...@starbug-vm.ie.oracle.com
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit f420262b43b5a09cae0f945311082649f078c833
Author: KarimAllah Ahmed <karah...@amazon.de>
Date: Thu Feb 1 11:27:21 2018 +0000
x86/spectre: Simplify spectre_v2 command line parsing
commit 9005c6834c0ffdfe46afa76656bd9276cca864f6 upstream.
[dwmw2: Use ARRAY_SIZE]
Signed-off-by: KarimAllah Ahmed <karah...@amazon.de>
Signed-off-by: David Woodhouse <d...@amazon.co.uk>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: pet...@infradead.org
Cc: b...@alien8.de
Link:
https://lkml.kernel.org/r/1517484441-1420-3-git-send-email-d...@amazon.co.uk
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 2066f5c4135f7d919a10bd6ff1f79d900e44aab8
Author: David Woodhouse <d...@amazon.co.uk>
Date: Thu Feb 1 11:27:20 2018 +0000
x86/retpoline: Avoid retpolines for built-in __init functions
commit 66f793099a636862a71c59d4a6ba91387b155e0c upstream.
There's no point in building init code with retpolines, since it runs before
any potentially hostile userspace does. And before the retpoline is actually
ALTERNATIVEd into place, for much of it.
Signed-off-by: David Woodhouse <d...@amazon.co.uk>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: karah...@amazon.de
Cc: pet...@infradead.org
Cc: b...@alien8.de
Link:
https://lkml.kernel.org/r/1517484441-1420-2-git-send-email-d...@amazon.co.uk
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit eba7e6e7249cfaf779eb1e19bad1a3feff01b758
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Wed Jan 31 17:47:03 2018 -0800
x86/kvm: Update spectre-v1 mitigation
commit 085331dfc6bbe3501fb936e657331ca943827600 upstream.
Commit 75f139aaf896 "KVM: x86: Add memory barrier on vmcs field lookup"
added a raw 'asm("lfence");' to prevent a bounds check bypass of
'vmcs_field_to_offset_table'.
The lfence can be avoided in this path by using the array_index_nospec()
helper designed for these types of fixes.
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Acked-by: Paolo Bonzini <pbonz...@redhat.com>
Cc: Andrew Honig <aho...@google.com>
Cc: k...@vger.kernel.org
Cc: Jim Mattson <jmatt...@google.com>
Link:
https://lkml.kernel.org/r/151744959670.6342.3001723920950249067.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- Replace max_vmcs_field with the local size variable
- Adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 1a3f15cb660eff3aa21c8af234eb362b9c69d1ae
Author: Josh Poimboeuf <jpoim...@redhat.com>
Date: Tue Jan 30 22:13:33 2018 -0600
x86/paravirt: Remove 'noreplace-paravirt' cmdline option
commit 12c69f1e94c89d40696e83804dd2f0965b5250cd upstream.
The 'noreplace-paravirt' option disables paravirt patching, leaving the
original pv indirect calls in place.
That's highly incompatible with retpolines, unless we want to uglify
paravirt even further and convert the paravirt calls to retpolines.
As far as I can tell, the option doesn't seem to be useful for much
other than introducing surprising corner cases and making the kernel
vulnerable to Spectre v2. It was probably a debug option from the early
paravirt days. So just remove it.
Signed-off-by: Josh Poimboeuf <jpoim...@redhat.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Reviewed-by: Juergen Gross <jgr...@suse.com>
Cc: Andrea Arcangeli <aarca...@redhat.com>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Andi Kleen <a...@linux.intel.com>
Cc: Ashok Raj <ashok....@intel.com>
Cc: Greg KH <gre...@linuxfoundation.org>
Cc: Jun Nakajima <jun.nakaj...@intel.com>
Cc: Tim Chen <tim.c.c...@linux.intel.com>
Cc: Rusty Russell <ru...@rustcorp.com.au>
Cc: Dave Hansen <dave.han...@intel.com>
Cc: Asit Mallick <asit.k.mall...@intel.com>
Cc: Andy Lutomirski <l...@kernel.org>
Cc: Linus Torvalds <torva...@linux-foundation.org>
Cc: Jason Baron <jba...@akamai.com>
Cc: Paolo Bonzini <pbonz...@redhat.com>
Cc: Alok Kataria <akata...@vmware.com>
Cc: Arjan Van De Ven <arjan.van.de....@intel.com>
Cc: David Woodhouse <dw...@infradead.org>
Cc: Dan Williams <dan.j.willi...@intel.com>
Link: https://lkml.kernel.org/r/20180131041333.2x6blhxirc2kclrq@treble
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 879a92de02e3847701c440c03807e44206cf25ea
Author: Colin Ian King <colin.k...@canonical.com>
Date: Tue Jan 30 19:32:18 2018 +0000
x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
commit e698dcdfcda41efd0984de539767b4cddd235f1e upstream.
Trivial fix to spelling mistake in pr_err error message text.
Signed-off-by: Colin Ian King <colin.k...@canonical.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: Andi Kleen <a...@linux.intel.com>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: kernel-janit...@vger.kernel.org
Cc: Andy Lutomirski <l...@kernel.org>
Cc: Borislav Petkov <b...@suse.de>
Cc: David Woodhouse <d...@amazon.co.uk>
Link:
https://lkml.kernel.org/r/20180130193218.9271-1-colin.k...@canonical.com
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 0a1595d2924df1f2380bb230bee05b0432624688
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:03:21 2018 -0800
x86/spectre: Report get_user mitigation for spectre_v1
commit edfbae53dab8348fca778531be9f4855d2ca0360 upstream.
Reflect the presence of get_user(), __get_user(), and 'syscall' protections
in sysfs. The expectation is that new and better tooling will allow the
kernel to grow more usages of array_index_nospec(), for now, only claim
mitigation for __user pointer de-references.
Reported-by: Jiri Slaby <jsl...@suse.cz>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: torva...@linux-foundation.org
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727420158.33451.11658324346540434635.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit b2fddb5b3cbe2ac7d18e62c9588a6cbee9cd7383
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:03:05 2018 -0800
vfs, fdtable: Prevent bounds-check bypass via speculative execution
commit 56c30ba7b348b90484969054d561f711ba196507 upstream.
'fd' is a user controlled value that is used as a data dependency to
read from the 'fdt->fd' array. In order to avoid potential leaks of
kernel memory values, block speculative execution of the instruction
stream that could issue reads based on an invalid 'file *' returned from
__fcheck_files.
Co-developed-by: Elena Reshetova <elena.reshet...@intel.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Al Viro <v...@zeniv.linux.org.uk>
Cc: torva...@linux-foundation.org
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727418500.33451.17392199002892248656.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 429edb965dd15507f143cdd08637b0dbfa282f0e
Author: Ben Hutchings <b...@decadent.org.uk>
Date: Fri Mar 9 00:11:14 2018 +0000
x86/syscall: Sanitize syscall table de-references under speculation
commit 2fbd7af5af8665d18bcefae3e9700be07e22b681 upstream.
The upstream version of this, touching C code, was written by Dan Williams,
with the following description:
> The syscall table base is a user controlled function pointer in kernel
> space. Use array_index_nospec() to prevent any out of bounds speculation.
>
> While retpoline prevents speculating into a userspace directed target it
> does not stop the pointer de-reference, the concern is leaking memory
> relative to the syscall table base, by observing instruction cache
> behavior.
The x86_64 assembly version for 4.4 was written by Jiri Slaby, with
the following description:
> In 4.4.118, we have commit c8961332d6da (x86/syscall: Sanitize syscall
> table de-references under speculation), which is a backport of upstream
> commit 2fbd7af5af86. But it fixed only the C part of the upstream patch
> -- the IA32 sysentry. So it ommitted completely the assembly part -- the
> 64bit sysentry.
>
> Fix that in this patch by explicit array_index_mask_nospec written in
> assembly. The same was used in lib/getuser.S.
>
> However, to have "sbb" working properly, we have to switch from "cmp"
> against (NR_syscalls-1) to (NR_syscalls), otherwise the last syscall
> number would be "and"ed by 0. It is because the original "ja" relies on
> "CF" or "ZF", but we rely only on "CF" in "sbb". That means: switch to
> "jae" conditional jump too.
>
> Final note: use rcx for mask as this is exactly what is overwritten by
> the 4th syscall argument (r10) right after.
In 3.2 the x86_32 syscall table lookup is also written in assembly.
So I've taken Jiri's version and added similar masking in entry_32.S,
using edx as the temporary. edx is clobbered by SAVE_REGS and seems
to be free at this point.
The ia32 compat syscall table lookup on x86_64 is also written in
assembly, so I've added the same masking in ia32entry.S, using r8 as
the temporary since it is always clobbered by the following
instructions.
The x86_64 entry code also lacks syscall masking for x32.
Cc: Dan Williams <dan.j.willi...@intel.com>
Cc: Jiri Slaby <jsl...@suse.cz>
Cc: Jan Beulich <jbeul...@suse.com>
Cc: Linus Torvalds <torva...@linux-foundation.org>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Andy Lutomirski <l...@kernel.org>
Cc: a...@linux.intel.com
Cc: Jinpu Wang <jinpu.w...@profitbricks.com>
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit ea524f029c3507acc7a42f68eaf4ac5a519bc41d
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:02:54 2018 -0800
x86/get_user: Use pointer masking to limit speculation
commit c7f631cb07e7da06ac1d231ca178452339e32a94 upstream.
Quoting Linus:
I do think that it would be a good idea to very expressly document
the fact that it's not that the user access itself is unsafe. I do
agree that things like "get_user()" want to be protected, but not
because of any direct bugs or problems with get_user() and friends,
but simply because get_user() is an excellent source of a pointer
that is obviously controlled from a potentially attacking user
space. So it's a prime candidate for then finding _subsequent_
accesses that can then be used to perturb the cache.
Unlike the __get_user() case get_user() includes the address limit check
near the pointer de-reference. With that locality the speculation can be
mitigated with pointer narrowing rather than a barrier, i.e.
array_index_nospec(). Where the narrowing is performed by:
cmp %limit, %ptr
sbb %mask, %mask
and %mask, %ptr
With respect to speculation the value of %ptr is either less than %limit
or NULL.
Co-developed-by: Linus Torvalds <torva...@linux-foundation.org>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: Kees Cook <keesc...@chromium.org>
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Al Viro <v...@zeniv.linux.org.uk>
Cc: Andy Lutomirski <l...@kernel.org>
Cc: torva...@linux-foundation.org
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727417469.33451.11804043010080838495.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2:
- Drop changes to 32-bit implementation of __get_user_8
- Adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 507089d2b9540f698a9b8648207da02edeedfcf0
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:02:33 2018 -0800
x86: Introduce barrier_nospec
commit b3d7ad85b80bbc404635dca80f5b129f6242bc7a upstream.
Rename the open coded form of this instruction sequence from
rdtsc_ordered() into a generic barrier primitive, barrier_nospec().
One of the mitigations for Spectre variant1 vulnerabilities is to fence
speculative execution after successfully validating a bounds check. I.e.
force the result of a bounds check to resolve in the instruction pipeline
to ensure speculative execution honors that result before potentially
operating on out-of-bounds data.
No functional changes.
Suggested-by: Linus Torvalds <torva...@linux-foundation.org>
Suggested-by: Andi Kleen <a...@linux.intel.com>
Suggested-by: Ingo Molnar <mi...@redhat.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Cc: Kees Cook <keesc...@chromium.org>
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Al Viro <v...@zeniv.linux.org.uk>
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727415361.33451.9049453007262764675.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2: update rdtsc_barrier() instead of rdtsc_ordered()]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit b75b708ffa363a3e5500fdd3f377500a2be7fd31
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:02:28 2018 -0800
x86: Implement array_index_mask_nospec
commit babdde2698d482b6c0de1eab4f697cf5856c5859 upstream.
array_index_nospec() uses a mask to sanitize user controllable array
indexes, i.e. generate a 0 mask if 'index' >= 'size', and a ~0 mask
otherwise. While the default array_index_mask_nospec() handles the
carry-bit from the (index - size) result in software.
The x86 array_index_mask_nospec() does the same, but the carry-bit is
handled in the processor CF flag without conditional instructions in the
control flow.
Suggested-by: Linus Torvalds <torva...@linux-foundation.org>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727414808.33451.1873237130672785331.st...@dwillia2-desk3.amr.corp.intel.com
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 9c6bfff3c4e1599b4f8ee495a30d270163a8e1d4
Author: Dan Williams <dan.j.willi...@intel.com>
Date: Mon Jan 29 17:02:22 2018 -0800
array_index_nospec: Sanitize speculative array de-references
commit f3804203306e098dae9ca51540fcd5eb700d7f40 upstream.
array_index_nospec() is proposed as a generic mechanism to mitigate
against Spectre-variant-1 attacks, i.e. an attack that bypasses boundary
checks via speculative execution. The array_index_nospec()
implementation is expected to be safe for current generation CPUs across
multiple architectures (ARM, x86).
Based on an original implementation by Linus Torvalds, tweaked to remove
speculative flows by Alexei Starovoitov, and tweaked again by Linus to
introduce an x86 assembly implementation for the mask generation.
Co-developed-by: Linus Torvalds <torva...@linux-foundation.org>
Co-developed-by: Alexei Starovoitov <a...@kernel.org>
Suggested-by: Cyril Novikov <cnovi...@lynx.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: kernel-harden...@lists.openwall.com
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Catalin Marinas <catalin.mari...@arm.com>
Cc: Will Deacon <will.dea...@arm.com>
Cc: Russell King <li...@armlinux.org.uk>
Cc: gre...@linuxfoundation.org
Cc: torva...@linux-foundation.org
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727414229.33451.18411580953862676575.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 4717376f567ad94a481ea5c2d153c34f1df24cf8
Author: Mark Rutland <mark.rutl...@arm.com>
Date: Mon Jan 29 17:02:16 2018 -0800
Documentation: Document array_index_nospec
commit f84a56f73dddaeac1dba8045b007f742f61cd2da upstream.
Document the rationale and usage of the new array_index_nospec() helper.
Signed-off-by: Mark Rutland <mark.rutl...@arm.com>
Signed-off-by: Will Deacon <will.dea...@arm.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Reviewed-by: Kees Cook <keesc...@chromium.org>
Cc: linux-a...@vger.kernel.org
Cc: Jonathan Corbet <cor...@lwn.net>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: gre...@linuxfoundation.org
Cc: kernel-harden...@lists.openwall.com
Cc: torva...@linux-foundation.org
Cc: a...@linux.intel.com
Link:
https://lkml.kernel.org/r/151727413645.33451.15878817161436755393.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit f5216764b9941ef92dc24ac700ffdb07e429d6f3
Author: Dou Liyang <douly.f...@cn.fujitsu.com>
Date: Tue Jan 30 14:13:50 2018 +0800
x86/spectre: Check CONFIG_RETPOLINE in command line parser
commit 9471eee9186a46893726e22ebb54cade3f9bc043 upstream.
The spectre_v2 option 'auto' does not check whether CONFIG_RETPOLINE is
enabled. As a consequence it fails to emit the appropriate warning and sets
feature flags which have no effect at all.
Add the missing IS_ENABLED() check.
Fixes: da285121560e ("x86/spectre: Add boot time option to select Spectre
v2 mitigation")
Signed-off-by: Dou Liyang <douly.f...@cn.fujitsu.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: a...@linux.intel.com
Cc: pet...@infradead.org
Cc: Tomohiro" <misono.tomoh...@jp.fujitsu.com>
Cc: dave.han...@intel.com
Cc: b...@alien8.de
Cc: ar...@linux.intel.com
Cc: d...@amazon.co.uk
Link:
https://lkml.kernel.org/r/f5892721-7528-3647-08fb-f8d10e65a...@cn.fujitsu.com
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit eb95998118d0cf06c631ae85d912e2b0713b75c4
Author: Thomas Gleixner <t...@linutronix.de>
Date: Sat Jan 27 15:45:14 2018 +0100
x86/cpu/bugs: Make retpoline module warning conditional
commit e383095c7fe8d218e00ec0f83e4b95ed4e627b02 upstream.
If sysfs is disabled and RETPOLINE not defined:
arch/x86/kernel/cpu/bugs.c:97:13: warning: âspectre_v2_bad_moduleâ
defined but not used
[-Wunused-variable]
static bool spectre_v2_bad_module;
Hide it.
Fixes: caf7501a1b4e ("module/retpoline: Warn about missing retpoline in
module")
Reported-by: Borislav Petkov <b...@alien8.de>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: Andi Kleen <a...@linux.intel.com>
Cc: David Woodhouse <dw...@infradead.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit fa64bf862747c1ad76df753b2b40c7557debfc28
Author: Borislav Petkov <b...@suse.de>
Date: Fri Jan 26 13:11:39 2018 +0100
x86/bugs: Drop one "mitigation" from dmesg
commit 55fa19d3e51f33d9cd4056d25836d93abf9438db upstream.
Make
[ 0.031118] Spectre V2 mitigation: Mitigation: Full generic retpoline
into
[ 0.031118] Spectre V2: Mitigation: Full generic retpoline
to reduce the mitigation mitigations strings.
Signed-off-by: Borislav Petkov <b...@suse.de>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: r...@redhat.com
Cc: a...@linux.intel.com
Cc: pet...@infradead.org
Cc: David Woodhouse <dw...@infradead.org>
Cc: ji...@kernel.org
Cc: l...@amacapital.net
Cc: dave.han...@intel.com
Cc: torva...@linux-foundation.org
Cc: keesc...@google.com
Cc: Josh Poimboeuf <jpoim...@redhat.com>
Cc: tim.c.c...@linux.intel.com
Cc: p...@google.com
Link: https://lkml.kernel.org/r/20180126121139.31959-5...@alien8.de
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit cf291cc405a50e7adfb21f808df8bcf32ef77209
Author: Borislav Petkov <b...@suse.de>
Date: Fri Jan 26 13:11:37 2018 +0100
x86/nospec: Fix header guards names
commit 7a32fc51ca938e67974cbb9db31e1a43f98345a9 upstream.
... to adhere to the _ASM_X86_ naming scheme.
No functional change.
Signed-off-by: Borislav Petkov <b...@suse.de>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: r...@redhat.com
Cc: a...@linux.intel.com
Cc: pet...@infradead.org
Cc: David Woodhouse <dw...@infradead.org>
Cc: ji...@kernel.org
Cc: l...@amacapital.net
Cc: dave.han...@intel.com
Cc: torva...@linux-foundation.org
Cc: keesc...@google.com
Cc: Josh Poimboeuf <jpoim...@redhat.com>
Cc: tim.c.c...@linux.intel.com
Cc: gre...@linux-foundation.org
Cc: p...@google.com
Link: https://lkml.kernel.org/r/20180126121139.31959-3...@alien8.de
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit 8e871207e06c72304f63447afc022668dc874011
Author: Andi Kleen <a...@linux.intel.com>
Date: Thu Jan 25 15:50:28 2018 -0800
module/retpoline: Warn about missing retpoline in module
commit caf7501a1b4ec964190f31f9c3f163de252273b8 upstream.
There's a risk that a kernel which has full retpoline mitigations becomes
vulnerable when a module gets loaded that hasn't been compiled with the
right compiler or the right option.
To enable detection of that mismatch at module load time, add a module info
string "retpoline" at build time when the module was compiled with
retpoline support. This only covers compiled C source, but assembler source
or prebuilt object files are not checked.
If a retpoline enabled kernel detects a non retpoline protected module at
load time, print a warning and report it in the sysfs vulnerability file.
[ tglx: Massaged changelog ]
Signed-off-by: Andi Kleen <a...@linux.intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: David Woodhouse <dw...@infradead.org>
Cc: gre...@linuxfoundation.org
Cc: torva...@linux-foundation.org
Cc: j...@kernel.org
Cc: ar...@linux.intel.com
Link: https://lkml.kernel.org/r/20180125235028.31211-1-a...@firstfloor.org
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit b36b29d519821c7a43f2257dcd33e687d5c2e61f
Author: Waiman Long <long...@redhat.com>
Date: Mon Jan 22 17:09:34 2018 -0500
x86/retpoline: Remove the esp/rsp thunk
commit 1df37383a8aeabb9b418698f0bcdffea01f4b1b2 upstream.
It doesn't make sense to have an indirect call thunk with esp/rsp as
retpoline code won't work correctly with the stack pointer register.
Removing it will help compiler writers to catch error in case such
a thunk call is emitted incorrectly.
Fixes: 76b043848fd2 ("x86/retpoline: Add initial retpoline support")
Suggested-by: Jeff Law <l...@redhat.com>
Signed-off-by: Waiman Long <long...@redhat.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Acked-by: David Woodhouse <d...@amazon.co.uk>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Cc: Kees Cook <keesc...@google.com>
Cc: Andi Kleen <a...@linux.intel.com>
Cc: Tim Chen <tim.c.c...@linux.intel.com>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Linus Torvalds <torva...@linux-foundation.org>
Cc: Jiri Kosina <ji...@kernel.org>
Cc: Andy Lutomirski <l...@amacapital.net>
Cc: Dave Hansen <dave.han...@intel.com>
Cc: Josh Poimboeuf <jpoim...@redhat.com>
Cc: Arjan van de Ven <ar...@linux.intel.com>
Cc: Greg Kroah-Hartman <gre...@linux-foundation.org>
Cc: Paul Turner <p...@google.com>
Link:
https://lkml.kernel.org/r/1516658974-27852-1-git-send-email-long...@redhat.com
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
commit b163da2afbc11675a02cbb4c8537559a5fcc3fbd
Author: David Woodhouse <d...@amazon.co.uk>
Date: Fri Jan 12 17:49:25 2018 +0000
x86/retpoline: Fill RSB on context switch for affected CPUs
commit c995efd5a740d9cbafbf58bde4973e8b50b4d761 upstream.
On context switch from a shallow call stack to a deeper one, as the CPU
does 'ret' up the deeper side it may encounter RSB entries (predictions for
where the 'ret' goes to) which were populated in userspace.
This is problematic if neither SMEP nor KPTI (the latter of which marks
userspace pages as NX for the kernel) are active, as malicious code in
userspace may then be executed speculatively.
Overwrite the CPU's return prediction stack with calls which are predicted
to return to an infinite loop, to "capture" speculation if this
happens. This is required both for retpoline, and also in conjunction with
IBRS for !SMEP && !KPTI.
On Skylake+ the problem is slightly different, and an *underflow* of the
RSB may cause errant branch predictions to occur. So there it's not so much
overwrite, as *filling* the RSB to attempt to prevent it getting
empty. This is only a partial solution for Skylake+ since there are many
other conditions which may result in the RSB becoming empty. The full
solution on Skylake+ is to use IBRS, which will prevent the problem even
when the RSB becomes empty. With IBRS, the RSB-stuffing will not be
required on context switch.
[ tglx: Added missing vendor check and slighty massaged comments and
changelog ]
[js] backport to 4.4 -- __switch_to_asm does not exist there, we
have to patch the switch_to macros for both x86_32 and x86_64.
Signed-off-by: David Woodhouse <d...@amazon.co.uk>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Acked-by: Arjan van de Ven <ar...@linux.intel.com>
Cc: gno...@lxorguk.ukuu.org.uk
Cc: Rik van Riel <r...@redhat.com>
Cc: Andi Kleen <a...@linux.intel.com>
Cc: Josh Poimboeuf <jpoim...@redhat.com>
diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu
b/Documentation/ABI/testing/sysfs-devices-system-cpu
index e7be75b..8e7ecfe 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -201,3 +201,19 @@ Description: Disable L3 cache indices
All AMD processors with L3 caches provide this functionality.
For details, see BKDGs at
http://developer.amd.com/documentation/guides/Pages/default.aspx
+
+What: /sys/devices/system/cpu/vulnerabilities
+ /sys/devices/system/cpu/vulnerabilities/meltdown
+ /sys/devices/system/cpu/vulnerabilities/spectre_v1
+ /sys/devices/system/cpu/vulnerabilities/spectre_v2
+Date: January 2018
+Contact: Linux kernel mailing list <linux-ker...@vger.kernel.org>
+Description: Information about CPU vulnerabilities
+
+ The files are named after the code names of CPU
+ vulnerabilities. The output of those files reflects the
+ state of the CPUs in the system. Possible output values:
+
+ "Not affected" CPU is not affected by the vulnerability
+ "Vulnerable" CPU is affected and no mitigation in effect
+ "Mitigation: $M" CPU is affected and mitigation $M is in effect
diff --git a/Documentation/cgroups/cpusets.txt
b/Documentation/cgroups/cpusets.txt
index 5c51ed4..eedecbb 100644
--- a/Documentation/cgroups/cpusets.txt
+++ b/Documentation/cgroups/cpusets.txt
@@ -345,14 +345,14 @@ the named feature on.
The implementation is simple.
Setting the flag 'cpuset.memory_spread_page' turns on a per-process flag
-PF_SPREAD_PAGE for each task that is in that cpuset or subsequently
+PFA_SPREAD_PAGE for each task that is in that cpuset or subsequently
joins that cpuset. The page allocation calls for the page cache
-is modified to perform an inline check for this PF_SPREAD_PAGE task
+is modified to perform an inline check for this PFA_SPREAD_PAGE task
flag, and if set, a call to a new routine cpuset_mem_spread_node()
returns the node to prefer for the allocation.
Similarly, setting 'cpuset.memory_spread_slab' turns on the flag
-PF_SPREAD_SLAB, and appropriately marked slab caches will allocate
+PFA_SPREAD_SLAB, and appropriately marked slab caches will allocate
pages from the node returned by cpuset_mem_spread_node().
The cpuset_mem_spread_node() routine is also simple. It uses the
diff --git a/Documentation/gcov.txt b/Documentation/gcov.txt
index e7ca647..7b72778 100644
--- a/Documentation/gcov.txt
+++ b/Documentation/gcov.txt
@@ -50,6 +50,10 @@ Configure the kernel with:
CONFIG_DEBUG_FS=y
CONFIG_GCOV_KERNEL=y
+select the gcc's gcov format, default is autodetect based on gcc version:
+
+ CONFIG_GCOV_FORMAT_AUTODETECT=y
+
and to get coverage data for the entire kernel:
CONFIG_GCOV_PROFILE_ALL=y
diff --git a/Documentation/kernel-parameters.txt
b/Documentation/kernel-parameters.txt
index ac601c4..ff397db 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1753,6 +1753,11 @@ bytes respectively. Such letter suffixes can also be
entirely omitted.
register save and restore. The kernel will only save
legacy floating-point registers on task switch.
+ nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2
+ (indirect branch prediction) vulnerability. System may
+ allow data leaks with this option, which is equivalent
+ to spectre_v2=off.
+
noxsave [BUGS=X86] Disables x86 extended register state save
and restore using xsave. The kernel will fallback to
enabling legacy floating-point and sse state.
@@ -1799,6 +1804,8 @@ bytes respectively. Such letter suffixes can also be
entirely omitted.
nointroute [IA-64]
+ noinvpcid [X86] Disable the INVPCID cpu feature.
+
nojitter [IA-64] Disables jitter checking for ITC timers.
no-kvmclock [X86,KVM] Disable paravirtualized KVM clock driver
@@ -1827,11 +1834,11 @@ bytes respectively. Such letter suffixes can also be
entirely omitted.
nopat [X86] Disable PAT (page attribute table extension of
pagetables) support.
+ nopcid [X86-64] Disable the PCID cpu feature.
+
norandmaps Don't use address space randomization. Equivalent to
echo 0 > /proc/sys/kernel/randomize_va_space
- noreplace-paravirt [X86,IA-64,PV_OPS] Don't patch paravirt_ops
-
noreplace-smp [X86-32,SMP] Don't replace SMP instructions
with UP alternatives
@@ -2239,6 +2246,21 @@ bytes respectively. Such letter suffixes can also be
entirely omitted.
pt. [PARIDE]
See Documentation/blockdev/paride.txt.
+ pti= [X86_64] Control Page Table Isolation of user and
+ kernel address spaces. Disabling this feature
+ removes hardening, but improves performance of
+ system calls and interrupts.
+
+ on - unconditionally enable
+ off - unconditionally disable
+ auto - kernel detects whether your CPU model is
+ vulnerable to issues that PTI mitigates
+
+ Not specifying this option is equivalent to pti=auto.
+
+ nopti [X86_64]
+ Equivalent to pti=off
+
pty.legacy_count=
[KNL] Number of legacy pty's. Overwrites compiled-in
default number.
@@ -2428,9 +2450,6 @@ bytes respectively. Such letter suffixes can also be
entirely omitted.
smart2= [HW]
Format: <io1>[,<io2>[,...,<io8>]]
- smp-alt-once [X86-32,SMP] On a hotplug CPU system, only
- attempt to substitute SMP alternatives once at boot.
-
smsc-ircc2.nopnp [HW] Don't use PNP to discover SMC devices
smsc-ircc2.ircc_cfg= [HW] Device configuration I/O port
smsc-ircc2.ircc_sir= [HW] SIR base I/O port
@@ -2452,11 +2471,41 @@ bytes respectively. Such letter suffixes can also be
entirely omitted.
specialix= [HW,SERIAL] Specialix multi-serial port adapter
See Documentation/serial/specialix.txt.
+ spectre_v2= [X86] Control mitigation of Spectre variant 2
+ (indirect branch speculation) vulnerability.
+
+ on - unconditionally enable
+ off - unconditionally disable
+ auto - kernel detects whether your CPU model is
+ vulnerable
+
+ Selecting 'on' will, and 'auto' may, choose a
+ mitigation method at run time according to the
+ CPU, the available microcode, the setting of the
+ CONFIG_RETPOLINE configuration option, and the
+ compiler with which the kernel was built.
+
+ Specific mitigations can also be selected manually:
+
+ retpoline - replace indirect branches
+ retpoline,generic - google's original retpoline
+ retpoline,amd - AMD-specific minimal thunk
+
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
+
spia_io_base= [HW,MTD]
spia_fio_base=
spia_pedr=
spia_peddr=
+ stack_guard_gap= [MM]
+ override the default stack gap protection. The value
+ is in page units and it defines how many pages prior
+ to (for stacks growing down) resp. after (for stacks
+ growing up) the main stack are reserved for no other
+ mapping. Default value is 256 pages.
+
stacktrace [FTRACE]
Enabled the stack tracer on boot up.
diff --git a/Documentation/speculation.txt b/Documentation/speculation.txt
new file mode 100644
index 0000000..e9e6cba
--- /dev/null
+++ b/Documentation/speculation.txt
@@ -0,0 +1,90 @@
+This document explains potential effects of speculation, and how undesirable
+effects can be mitigated portably using common APIs.
+
+===========
+Speculation
+===========
+
+To improve performance and minimize average latencies, many contemporary CPUs
+employ speculative execution techniques such as branch prediction, performing
+work which may be discarded at a later stage.
+
+Typically speculative execution cannot be observed from architectural state,
+such as the contents of registers. However, in some cases it is possible to
+observe its impact on microarchitectural state, such as the presence or
+absence of data in caches. Such state may form side-channels which can be
+observed to extract secret information.
+
+For example, in the presence of branch prediction, it is possible for bounds
+checks to be ignored by code which is speculatively executed. Consider the
+following code:
+
+ int load_array(int *array, unsigned int index)
+ {
+ if (index >= MAX_ARRAY_ELEMS)
+ return 0;
+ else
+ return array[index];
+ }
+
+Which, on arm64, may be compiled to an assembly sequence such as:
+
+ CMP <index>, #MAX_ARRAY_ELEMS
+ B.LT less
+ MOV <returnval>, #0
+ RET
+ less:
+ LDR <returnval>, [<array>, <index>]
+ RET
+
+It is possible that a CPU mis-predicts the conditional branch, and
+speculatively loads array[index], even if index >= MAX_ARRAY_ELEMS. This
+value will subsequently be discarded, but the speculated load may affect
+microarchitectural state which can be subsequently measured.
+
+More complex sequences involving multiple dependent memory accesses may
+result in sensitive information being leaked. Consider the following
+code, building on the prior example:
+
+ int load_dependent_arrays(int *arr1, int *arr2, int index)
+ {
+ int val1, val2,
+
+ val1 = load_array(arr1, index);
+ val2 = load_array(arr2, val1);
+
+ return val2;
+ }
+
+Under speculation, the first call to load_array() may return the value
+of an out-of-bounds address, while the second call will influence
+microarchitectural state dependent on this value. This may provide an
+arbitrary read primitive.
+
+====================================
+Mitigating speculation side-channels
+====================================
+
+The kernel provides a generic API to ensure that bounds checks are
+respected even under speculation. Architectures which are affected by
+speculation-based side-channels are expected to implement these
+primitives.
+
+The array_index_nospec() helper in <linux/nospec.h> can be used to
+prevent information from being leaked via side-channels.
+
+A call to array_index_nospec(index, size) returns a sanitized index
+value that is bounded to [0, size) even under cpu speculation
+conditions.
+
+This can be used to protect the earlier load_array() example:
+
+ int load_array(int *array, unsigned int index)
+ {
+ if (index >= MAX_ARRAY_ELEMS)
+ return 0;
+ else {
+ index = array_index_nospec(index, MAX_ARRAY_ELEMS);
+ return array[index];
+ }
+ }
diff --git a/Documentation/x86/pti.txt b/Documentation/x86/pti.txt
new file mode 100644
index 0000000..5cd5843
--- /dev/null
+++ b/Documentation/x86/pti.txt
@@ -0,0 +1,186 @@
+Overview
+========
+
+Page Table Isolation (pti, previously known as KAISER[1]) is a
+countermeasure against attacks on the shared user/kernel address
+space such as the "Meltdown" approach[2].
+
+To mitigate this class of attacks, we create an independent set of
+page tables for use only when running userspace applications. When
+the kernel is entered via syscalls, interrupts or exceptions, the
+page tables are switched to the full "kernel" copy. When the system
+switches back to user mode, the user copy is used again.
+
+The userspace page tables contain only a minimal amount of kernel
+data: only what is needed to enter/exit the kernel such as the
+entry/exit functions themselves and the interrupt descriptor table
+(IDT). There are a few strictly unnecessary things that get mapped
+such as the first C function when entering an interrupt (see
+comments in pti.c).
+
+This approach helps to ensure that side-channel attacks leveraging
+the paging structures do not function when PTI is enabled. It can be
+enabled by setting CONFIG_PAGE_TABLE_ISOLATION=y at compile time.
+Once enabled at compile-time, it can be disabled at boot with the
+'nopti' or 'pti=' kernel parameters (see kernel-parameters.txt).
+
+Page Table Management
+=====================
+
+When PTI is enabled, the kernel manages two sets of page tables.
+The first set is very similar to the single set which is present in
+kernels without PTI. This includes a complete mapping of userspace
+that the kernel can use for things like copy_to_user().
+
+Although _complete_, the user portion of the kernel page tables is
+crippled by setting the NX bit in the top level. This ensures
+that any missed kernel->user CR3 switch will immediately crash
+userspace upon executing its first instruction.
+
+The userspace page tables map only the kernel data needed to enter
+and exit the kernel. This data is entirely contained in the 'struct
+cpu_entry_area' structure which is placed in the fixmap which gives
+each CPU's copy of the area a compile-time-fixed virtual address.
+
+For new userspace mappings, the kernel makes the entries in its
+page tables like normal. The only difference is when the kernel
+makes entries in the top (PGD) level. In addition to setting the
+entry in the main kernel PGD, a copy of the entry is made in the
+userspace page tables' PGD.
+
+This sharing at the PGD level also inherently shares all the lower
+layers of the page tables. This leaves a single, shared set of
+userspace page tables to manage. One PTE to lock, one set of
+accessed bits, dirty bits, etc...
+
+Overhead
+========
+
+Protection against side-channel attacks is important. But,
+this protection comes at a cost:
+
+1. Increased Memory Use
+ a. Each process now needs an order-1 PGD instead of order-0.
+ (Consumes an additional 4k per process).
+ b. The 'cpu_entry_area' structure must be 2MB in size and 2MB
+ aligned so that it can be mapped by setting a single PMD
+ entry. This consumes nearly 2MB of RAM once the kernel
+ is decompressed, but no space in the kernel image itself.
+
+2. Runtime Cost
+ a. CR3 manipulation to switch between the page table copies
+ must be done at interrupt, syscall, and exception entry
+ and exit (it can be skipped when the kernel is interrupted,
+ though.) Moves to CR3 are on the order of a hundred
+ cycles, and are required at every entry and exit.
+ b. A "trampoline" must be used for SYSCALL entry. This
+ trampoline depends on a smaller set of resources than the
+ non-PTI SYSCALL entry code, so requires mapping fewer
+ things into the userspace page tables. The downside is
+ that stacks must be switched at entry time.
+ c. Global pages are disabled for all kernel structures not
+ mapped into both kernel and userspace page tables. This
+ feature of the MMU allows different processes to share TLB
+ entries mapping the kernel. Losing the feature means more
+ TLB misses after a context switch. The actual loss of
+ performance is very small, however, never exceeding 1%.
+ d. Process Context IDentifiers (PCID) is a CPU feature that
+ allows us to skip flushing the entire TLB when switching page
+ tables by setting a special bit in CR3 when the page tables
+ are changed. This makes switching the page tables (at context
+ switch, or kernel entry/exit) cheaper. But, on systems with
+ PCID support, the context switch code must flush both the user
+ and kernel entries out of the TLB. The user PCID TLB flush is
+ deferred until the exit to userspace, minimizing the cost.
+ See intel.com/sdm for the gory PCID/INVPCID details.
+ e. The userspace page tables must be populated for each new
+ process. Even without PTI, the shared kernel mappings
+ are created by copying top-level (PGD) entries into each
+ new process. But, with PTI, there are now *two* kernel
+ mappings: one in the kernel page tables that maps everything
+ and one for the entry/exit structures. At fork(), we need to
+ copy both.
+ f. In addition to the fork()-time copying, there must also
+ be an update to the userspace PGD any time a set_pgd() is done
+ on a PGD used to map userspace. This ensures that the kernel
+ and userspace copies always map the same userspace
+ memory.
+ g. On systems without PCID support, each CR3 write flushes
+ the entire TLB. That means that each syscall, interrupt
+ or exception flushes the TLB.
+ h. INVPCID is a TLB-flushing instruction which allows flushing
+ of TLB entries for non-current PCIDs. Some systems support
+ PCIDs, but do not support INVPCID. On these systems, addresses
+ can only be flushed from the TLB for the current PCID. When
+ flushing a kernel address, we need to flush all PCIDs, so a
+ single kernel address flush will require a TLB-flushing CR3
+ write upon the next use of every PCID.
+
+Possible Future Work
+====================
+1. We can be more careful about not actually writing to CR3
+ unless its value is actually changed.
+2. Allow PTI to be enabled/disabled at runtime in addition to the
+ boot-time switching.
+
+Testing
+========
+
+To test stability of PTI, the following test procedure is recommended,
+ideally doing all of these in parallel:
+
+1. Set CONFIG_DEBUG_ENTRY=y
+2. Run several copies of all of the tools/testing/selftests/x86/ tests
+ (excluding MPX and protection_keys) in a loop on multiple CPUs for
+ several minutes. These tests frequently uncover corner cases in the
+ kernel entry code. In general, old kernels might cause these tests
+ themselves to crash, but they should never crash the kernel.
+3. Run the 'perf' tool in a mode (top or record) that generates many
+ frequent performance monitoring non-maskable interrupts (see "NMI"
+ in /proc/interrupts). This exercises the NMI entry/exit code which
+ is known to trigger bugs in code paths that did not expect to be
+ interrupted, including nested NMIs. Using "-c" boosts the rate of
+ NMIs, and using two -c with separate counters encourages nested NMIs
+ and less deterministic behavior.
+
+ while true; do perf record -c 10000 -e instructions,cycles -a sleep 10;
done
+
+4. Launch a KVM virtual machine.
+5. Run 32-bit binaries on systems supporting the SYSCALL instruction.
+ This has been a lightly-tested code path and needs extra scrutiny.
+
+Debugging
+=========
+
+Bugs in PTI cause a few different signatures of crashes
+that are worth noting here.
+
+ * Failures of the selftests/x86 code. Usually a bug in one of the
+ more obscure corners of entry_64.S
+ * Crashes in early boot, especially around CPU bringup. Bugs
+ in the trampoline code or mappings cause these.
+ * Crashes at the first interrupt. Caused by bugs in entry_64.S,
+ like screwing up a page table switch. Also caused by
+ incorrectly mapping the IRQ handler entry code.
+ * Crashes at the first NMI. The NMI code is separate from main
+ interrupt handlers and can have bugs that do not affect
+ normal interrupts. Also caused by incorrectly mapping NMI
+ code. NMIs that interrupt the entry code must be very
+ careful and can be the cause of crashes that show up when
+ running perf.
+ * Kernel crashes at the first exit to userspace. entry_64.S
+ bugs, or failing to map some of the exit code.
+ * Crashes at first interrupt that interrupts userspace. The paths
+ in entry_64.S that return to userspace are sometimes separate
+ from the ones that return to the kernel.
+ * Double faults: overflowing the kernel stack because of page
+ faults upon page faults. Caused by touching non-pti-mapped
+ data in the entry code, or forgetting to switch to kernel
+ CR3 before calling into C functions which are not pti-mapped.
+ * Userspace segfaults early in boot, sometimes manifesting
+ as mount(8) failing to mount the rootfs. These have
+ tended to be TLB invalidation issues. Usually invalidating
+ the wrong PCID, or otherwise missing an invalidation.
+
+1. https://gruss.cc/files/kaiser.pdf
+2. https://meltdownattack.com/meltdown.pdf
diff --git a/Makefile b/Makefile
index ba25eb9..b571211 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
VERSION = 3
PATCHLEVEL = 2
-SUBLEVEL = 84
+SUBLEVEL = 101
EXTRAVERSION =
-NAME = Saber-toothed Squirrel
+NAME = Sleepy Otter
# *DOCUMENTATION*
# To see a list of typical targets execute "make help"
@@ -559,7 +559,7 @@ endif # $(dot-config)
all: vmlinux
ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
-KBUILD_CFLAGS += -Os
+KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,)
else
KBUILD_CFLAGS += -O2
endif
@@ -631,6 +631,9 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
# disable invalid "can't wrap" optimizations for signed / pointers
KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow)
+# Make sure -fstack-check isn't enabled (like gentoo apparently did)
+KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,)
+
# conserve stack if available
KBUILD_CFLAGS += $(call cc-option,-fconserve-stack)
diff --git a/arch/alpha/include/asm/types.h b/arch/alpha/include/asm/types.h
index 8815443..5993b2a 100644
--- a/arch/alpha/include/asm/types.h
+++ b/arch/alpha/include/asm/types.h
@@ -9,10 +9,18 @@
* need to be careful to avoid a name clashes.
*/
-#ifdef __KERNEL__
-#include <asm-generic/int-ll64.h>
-#else
+/*
+ * This is here because we used to use l64 for alpha
+ * and we don't want to impact user mode with our change to ll64
+ * in the kernel.
+ *
+ * However, some user programs are fine with this. They can
+ * flag __SANE_USERSPACE_TYPES__ to get int-ll64.h here.
+ */
+#if !defined(__SANE_USERSPACE_TYPES__) && !defined(__KERNEL__)
#include <asm-generic/int-l64.h>
+#else
+#include <asm-generic/int-ll64.h>
#endif
#ifndef __ASSEMBLY__
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 01e8715..13a99b4 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1026,8 +1026,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *,
ustatus, int, options,
if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
return -EFAULT;
- err = 0;
- err |= put_user(status, ustatus);
+ err = put_user(status, ustatus);
+ if (ret < 0)
+ return err ? err : ret;
+
err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
@@ -1147,7 +1149,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned
long len,
/* At this point: (!vma || addr < vma->vm_end). */
if (limit - len < addr)
return -ENOMEM;
- if (!vma || addr + len <= vma->vm_start)
+ if (!vma || addr + len <= vm_start_gap(vma))
return addr;
addr = vma->vm_end;
vma = vma->vm_next;
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index cb47d28..a6f926b 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -25,6 +25,9 @@
#define CPUID_EXT_ISAR4 "c2, 4"
#define CPUID_EXT_ISAR5 "c2, 5"
+/* Qualcomm implemented cores */
+#define ARM_CPU_PART_SCORPION 0x510002d0
+
extern unsigned int processor_id;
#ifdef CONFIG_CPU_CP15
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 2bc1a8e..bdafb83 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -1001,6 +1001,22 @@ static int __init arch_hw_breakpoint_init(void)
return 0;
}
+ /*
+ * Scorpion CPUs (at least those in APQ8060) seem to set DBGPRSR.SPD
+ * whenever a WFI is issued, even if the core is not powered down, in
+ * violation of the architecture. When DBGPRSR.SPD is set, accesses to
+ * breakpoint and watchpoint registers are treated as undefined, so
+ * this results in boot time and runtime failures when these are
+ * accessed and we unexpectedly take a trap.
+ *
+ * It's not clear if/how this can be worked around, so we blacklist
+ * Scorpion CPUs to avoid these issues.
+ */
+ if ((read_cpuid_id() & 0xff00fff0) == ARM_CPU_PART_SCORPION) {
+ pr_info("Scorpion CPU detected. Hardware breakpoints and
watchpoints disabled\n");
+ return 0;
+ }
+
/* Determine how many BRPs/WRPs are available. */
core_num_brps = get_num_brps();
core_num_wrps = get_num_wrps();
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 8b17fb4..b73ae6e 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -593,7 +593,7 @@ static int gpr_set(struct task_struct *target,
const void *kbuf, const void __user *ubuf)
{
int ret;
- struct pt_regs newregs;
+ struct pt_regs newregs = *task_pt_regs(target);
ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
&newregs,
diff --git a/arch/arm/kernel/return_address.c b/arch/arm/kernel/return_address.c
index 8085417..0697db6 100644
--- a/arch/arm/kernel/return_address.c
+++ b/arch/arm/kernel/return_address.c
@@ -58,10 +58,6 @@ void *return_address(unsigned int level)
#else /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */
-#if defined(CONFIG_ARM_UNWIND)
-#warning "TODO: return_address should use unwind tables"
-#endif
-
void *return_address(unsigned int level)
{
return NULL;
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index d45fd22..9be66c1 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -130,30 +130,26 @@ static void dump_mem(const char *lvl, const char *str,
unsigned long bottom,
set_fs(fs);
}
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
{
unsigned long addr = instruction_pointer(regs);
const int thumb = thumb_mode(regs);
const int width = thumb ? 4 : 8;
- mm_segment_t fs;
char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
int i;
/*
- * We need to switch to kernel mode so that we can use __get_user
- * to safely read from kernel space. Note that we now dump the
- * code first, just in case the backtrace kills us.
+ * Note that we now dump the code first, just in case the backtrace
+ * kills us.
*/
- fs = get_fs();
- set_fs(KERNEL_DS);
for (i = -4; i < 1 + !!thumb; i++) {
unsigned int val, bad;
if (thumb)
- bad = __get_user(val, &((u16 *)addr)[i]);
+ bad = get_user(val, &((u16 *)addr)[i]);
else
- bad = __get_user(val, &((u32 *)addr)[i]);
+ bad = get_user(val, &((u32 *)addr)[i]);
if (!bad)
p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
@@ -164,8 +160,20 @@ static void dump_instr(const char *lvl, struct pt_regs
*regs)
}
}
printk("%sCode: %s\n", lvl, str);
+}
- set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+ mm_segment_t fs;
+
+ if (!user_mode(regs)) {
+ fs = get_fs();
+ set_fs(KERNEL_DS);
+ __dump_instr(lvl, regs);
+ set_fs(fs);
+ } else {
+ __dump_instr(lvl, regs);
+ }
}
#ifdef CONFIG_ARM_UNWIND
diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig
index 61d3c72..c4100aa 100644
--- a/arch/arm/mach-pxa/Kconfig
+++ b/arch/arm/mach-pxa/Kconfig
@@ -563,6 +563,7 @@ config ARCH_PXA_ESERIES
bool "PXA based Toshiba e-series PDAs"
select PXA25x
select FB_W100
+ select FB
config MACH_E330
bool "Toshiba e330"
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index e1dd92c..f796101 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -374,7 +374,7 @@ dma_alloc_coherent(struct device *dev, size_t size,
dma_addr_t *handle, gfp_t gf
return memory;
return __dma_alloc(dev, size, handle, gfp,
- pgprot_dmacoherent(pgprot_kernel));
+ pgprot_dmacoherent(PAGE_KERNEL));
}
EXPORT_SYMBOL(dma_alloc_coherent);
@@ -386,7 +386,7 @@ void *
dma_alloc_writecombine(struct device *dev, size_t size, dma_addr_t *handle,
gfp_t gfp)
{
return __dma_alloc(dev, size, handle, gfp,
- pgprot_writecombine(pgprot_kernel));
+ pgprot_writecombine(PAGE_KERNEL));
}
EXPORT_SYMBOL(dma_alloc_writecombine);
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 44b628e..4497b5e 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -30,7 +30,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
{
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
- unsigned long start_addr;
+ unsigned long start_addr, vm_start;
int do_align = 0;
int aliasing = cache_is_vipt_aliasing();
@@ -62,7 +62,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr &&
- (!vma || addr + len <= vma->vm_start))
+ (!vma || addr + len <= vm_start_gap(vma)))
return addr;
}
if (len > mm->cached_hole_size) {
@@ -96,15 +96,17 @@ full_search:
}
return -ENOMEM;
}
- if (!vma || addr + len <= vma->vm_start) {
+ if (vma)
+ vm_start = vm_start_gap(vma);
+ if (!vma || addr + len <= vm_start) {
/*
* Remember the place where we stopped the search:
*/
mm->free_area_cache = addr + len;
return addr;
}
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
+ if (addr + mm->cached_hole_size < vm_start)
+ mm->cached_hole_size = vm_start - addr;
addr = vma->vm_end;
if (do_align)
addr = COLOUR_ALIGN(addr, pgoff);
diff --git a/arch/cris/arch-v10/lib/Makefile b/arch/cris/arch-v10/lib/Makefile
index 36e9a9c..725153e 100644
--- a/arch/cris/arch-v10/lib/Makefile
+++ b/arch/cris/arch-v10/lib/Makefile
@@ -2,8 +2,5 @@
# Makefile for Etrax-specific library files..
#
-
-EXTRA_AFLAGS := -traditional
-
lib-y = checksum.o checksumcopy.o string.o usercopy.o memset.o csumcpfruser.o
diff --git a/arch/cris/boot/rescue/Makefile b/arch/cris/boot/rescue/Makefile
index 52bd0bd..d98edbb 100644
--- a/arch/cris/boot/rescue/Makefile
+++ b/arch/cris/boot/rescue/Makefile
@@ -10,6 +10,9 @@
asflags-y += $(LINUXINCLUDE)
ccflags-y += -O2 $(LINUXINCLUDE)
+
+ifdef CONFIG_ETRAX_AXISFLASHMAP
+
arch-$(CONFIG_ETRAX_ARCH_V10) = v10
arch-$(CONFIG_ETRAX_ARCH_V32) = v32
@@ -28,6 +31,11 @@ $(obj)/rescue.bin: $(obj)/rescue.o FORCE
$(call if_changed,objcopy)
cp -p $(obj)/rescue.bin $(objtree)
+else
+$(obj)/rescue.bin:
+
+endif
+
$(obj)/testrescue.bin: $(obj)/testrescue.o
$(OBJCOPY) $(OBJCOPYFLAGS) $(obj)/testrescue.o tr.bin
# Pad it to 784 bytes
diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
index 385fd30..96eca58 100644
--- a/arch/frv/mm/elf-fdpic.c
+++ b/arch/frv/mm/elf-fdpic.c
@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp,
unsigned long addr, unsi
addr = PAGE_ALIGN(addr);
vma = find_vma(current->mm, addr);
if (TASK_SIZE - len >= addr &&
- (!vma || addr + len <= vma->vm_start))
+ (!vma || addr + len <= vm_start_gap(vma)))
goto success;
}
@@ -89,7 +89,7 @@ unsigned long arch_get_unmapped_area(struct file *filp,
unsigned long addr, unsi
for (; vma; vma = vma->vm_next) {
if (addr > limit)
break;
- if (addr + len <= vma->vm_start)
+ if (addr + len <= vm_start_gap(vma))
goto success;
addr = vma->vm_end;
}
@@ -104,7 +104,7 @@ unsigned long arch_get_unmapped_area(struct file *filp,
unsigned long addr, unsi
for (; vma; vma = vma->vm_next) {
if (addr > limit)
break;
- if (addr + len <= vma->vm_start)
+ if (addr + len <= vm_start_gap(vma))
goto success;
addr = vma->vm_end;
}
diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
index 609d500..77c0aff 100644
--- a/arch/ia64/kernel/sys_ia64.c
+++ b/arch/ia64/kernel/sys_ia64.c
@@ -27,7 +27,8 @@ arch_get_unmapped_area (struct file *filp, unsigned long
addr, unsigned long len
long map_shared = (flags & MAP_SHARED);
unsigned long start_addr, align_mask = PAGE_SIZE - 1;
struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
+ struct vm_area_struct *vma, *prev;
+ unsigned long prev_end;
if (len > RGN_MAP_LIMIT)
return -ENOMEM;
@@ -58,7 +59,17 @@ arch_get_unmapped_area (struct file *filp, unsigned long
addr, unsigned long len
full_search:
start_addr = addr = (addr + align_mask) & ~align_mask;
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ for (vma = find_vma_prev(mm, addr, &prev); ; prev = vma,
+ vma = vma->vm_next) {
+ if (prev) {
+ prev_end = vm_end_gap(prev);
+ if (addr < prev_end) {
+ addr = (prev_end + align_mask) & ~align_mask;
+ /* If vma already violates gap, forget it */
+ if (vma && addr > vma->vm_start)
+ addr = vma->vm_start;
+ }
+ }
/* At this point: (!vma || addr < vma->vm_end). */
if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len <
REGION_OFFSET(addr)) {
if (start_addr != TASK_UNMAPPED_BASE) {
@@ -68,12 +79,11 @@ arch_get_unmapped_area (struct file *filp, unsigned long
addr, unsigned long len
}
return -ENOMEM;
}
- if (!vma || addr + len <= vma->vm_start) {
+ if (!vma || addr + len <= vm_start_gap(vma)) {
/* Remember the address where we stopped this search:
*/
mm->free_area_cache = addr + len;
return addr;
}
- addr = (vma->vm_end + align_mask) & ~align_mask;
}
}
diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index 5ca674b..66a1ec0 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c
@@ -171,9 +171,9 @@ unsigned long hugetlb_get_unmapped_area(struct file *file,
unsigned long addr, u
/* At this point: (!vmm || addr < vmm->vm_end). */
if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
return -ENOMEM;
- if (!vmm || (addr + len) <= vmm->vm_start)
+ if (!vmm || (addr + len) <= vm_start_gap(vmm))
return addr;
- addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
+ addr = ALIGN(vm_end_gap(vmm), HPAGE_SIZE);
}
}
diff --git a/arch/m32r/include/asm/io.h b/arch/m32r/include/asm/io.h
index 4010f1f..cea944c 100644
--- a/arch/m32r/include/asm/io.h
+++ b/arch/m32r/include/asm/io.h
@@ -67,6 +67,7 @@ static inline void __iomem *ioremap(unsigned long offset,
unsigned long size)
extern void iounmap(volatile void __iomem *addr);
#define ioremap_nocache(off,size) ioremap(off,size)
+#define ioremap_wc ioremap_nocache
/*
* IO bus memory addresses are also 1:1 with the physical address
@@ -162,13 +163,21 @@ static inline void _writel(unsigned long l, unsigned long
addr)
#define __raw_writew writew
#define __raw_writel writel
-#define ioread8 read
+#define ioread8 readb
#define ioread16 readw
#define ioread32 readl
#define iowrite8 writeb
#define iowrite16 writew
#define iowrite32 writel
+#define ioread8_rep(p, dst, count) insb((unsigned long)(p), (dst), (count))
+#define ioread16_rep(p, dst, count) insw((unsigned long)(p), (dst), (count))
+#define ioread32_rep(p, dst, count) insl((unsigned long)(p), (dst), (count))
+
+#define iowrite8_rep(p, src, count) outsb((unsigned long)(p), (src), (count))
+#define iowrite16_rep(p, src, count) outsw((unsigned long)(p), (src), (count))
+#define iowrite32_rep(p, src, count) outsl((unsigned long)(p), (src), (count))
+
#define mmiowb()
#define flush_write_buffers() do { } while (0) /* M32R_FIXME */
diff --git a/arch/m32r/kernel/ptrace.c b/arch/m32r/kernel/ptrace.c
index 2074375..20c5b5c 100644
--- a/arch/m32r/kernel/ptrace.c
+++ b/arch/m32r/kernel/ptrace.c
@@ -592,17 +592,16 @@ void user_enable_single_step(struct task_struct *child)
if (access_process_vm(child, pc&~3, &insn, sizeof(insn), 0)
!= sizeof(insn))
- return -EIO;
+ return;
compute_next_pc(insn, pc, &next_pc, child);
if (next_pc & 0x80000000)
- return -EIO;
+ return;
if (embed_debug_trap(child, next_pc))
- return -EIO;
+ return;
invalidate_cache();
- return 0;
}
void user_disable_single_step(struct task_struct *child)
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index aaf7444..97ba1d6 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -285,11 +285,11 @@ CLEAN_FILES += vmlinux.32 vmlinux.64
archprepare:
ifdef CONFIG_MIPS32_N32
- @echo ' Checking missing-syscalls for N32'
+ @$(kecho) ' Checking missing-syscalls for N32'
$(Q)$(MAKE) $(build)=. missing-syscalls
missing_syscalls_flags="-mabi=n32"
endif
ifdef CONFIG_MIPS32_O32
- @echo ' Checking missing-syscalls for O32'
+ @$(kecho) ' Checking missing-syscalls for O32'
$(Q)$(MAKE) $(build)=. missing-syscalls
missing_syscalls_flags="-mabi=32"
endif
diff --git a/arch/mips/ar7/clock.c b/arch/mips/ar7/clock.c
index 2460f9d..320e5b8 100644
--- a/arch/mips/ar7/clock.c
+++ b/arch/mips/ar7/clock.c
@@ -430,6 +430,9 @@ EXPORT_SYMBOL(clk_disable);
unsigned long clk_get_rate(struct clk *clk)
{
+ if (!clk)
+ return 0;
+
return clk->rate;
}
EXPORT_SYMBOL(clk_get_rate);
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 33ffecf..8e64ab59 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -541,6 +541,7 @@ static int __init ar7_register_uarts(void)
uart_port.type = PORT_AR7;
uart_port.uartclk = clk_get_rate(bus_clk) / 2;
uart_port.iotype = UPIO_MEM32;
+ uart_port.flags = UPF_FIXED_TYPE;
uart_port.regshift = 2;
uart_port.line = 0;
diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c
index 2c68ee9..2bbf5f7 100644
--- a/arch/mips/bcm63xx/clk.c
+++ b/arch/mips/bcm63xx/clk.c
@@ -193,6 +193,9 @@ EXPORT_SYMBOL(clk_disable);
unsigned long clk_get_rate(struct clk *clk)
_______________________________________________
unionfs-cvs mailing list: http://unionfs.filesystems.org/
unionfs-cvs@fsl.cs.sunysb.edu
http://www.fsl.cs.sunysb.edu/mailman/listinfo/unionfs-cvs
