Merge branch 'cve-2019-3016' into kvm-next-5.6

From Boris Ostrovsky: The KVM hypervisor may provide a guest with ability to defer remote TLB flush when the remote VCPU is not running. When this feature is used, the TLB flush will happen only when the remote VPCU is scheduled to run again. This will avoid unnecessary (and expensive) IPIs. Under certain circumstances, when a guest initiates such deferred action, the hypervisor may miss the request. It is also possible that the guest may mistakenly assume that it has already marked remote VCPU as needing a flush when in fact that request had already been processed by the hypervisor. In both cases this will result in an invalid translation being present in a vCPU, potentially allowing accesses to memory locations in that guest's address space that should not be accessible. Note that only intra-guest memory is vulnerable. The five patches address both of these problems: 1. The first patch makes sure the hypervisor doesn't accidentally clear a guest's remote flush request 2. The rest of the patches prevent the race between hypervisor acknowledging a remote flush request and guest issuing a new one.

Paolo Bonzini committed 6 years ago

Commit 4cbc4182 parents 1d5920c a6bd81139 files · +338 −183Browse files

Unified · Split

39 files

Documentation/devicetree/bindings/spi/spi-controller.yaml +2 −2
arch/arc/include/asm/entry-arcv2.h +4 −4
arch/arc/include/asm/hugepage.h +0 −1
arch/arc/kernel/asm-offsets.c +9 −1
arch/arc/plat-eznps/Kconfig +1 −1
arch/arm64/include/asm/pgtable-prot.h +2 −3
arch/arm64/include/asm/pgtable.h +3 −7
arch/arm64/mm/fault.c +1 −1
arch/x86/include/asm/kvm_host.h +2 −2
arch/x86/kvm/x86.c +43 −26
drivers/char/tpm/tpm_tis_core.c +15 −19
drivers/regulator/axp20x-regulator.c +7 −4
drivers/regulator/bd70528-regulator.c +0 −1
drivers/rtc/rtc-mc146818-lib.c +1 −14
drivers/rtc/rtc-mt6397.c +25 −14
drivers/rtc/rtc-sun6i.c +16 −0
drivers/spi/spi-dw.c +12 −3
drivers/spi/spi-dw.h +1 −0
drivers/spi/spi-fsl-dspi.c +10 −14
drivers/spi/spi-uniphier.c +19 −12
drivers/spi/spi.c +8 −14
drivers/watchdog/Kconfig +2 −0
drivers/watchdog/imx7ulp_wdt.c +1 −1
drivers/watchdog/orion_wdt.c +2 −2
drivers/watchdog/rn5t618_wdt.c +1 −0
drivers/watchdog/w83627hf_wdt.c +1 −1
include/linux/kvm_host.h +5 −0
include/linux/kvm_types.h +8 −1
include/linux/mfd/mt6397/rtc.h +8 −0
include/linux/spi/spi.h +2 −2
include/trace/events/preemptirq.h +4 −4
kernel/trace/fgraph.c +14 −0
kernel/trace/ftrace.c +3 −3
kernel/trace/trace_events_inject.c +1 −1
kernel/trace/trace_sched_wakeup.c +3 −1
kernel/trace/trace_seq.c +1 −1
kernel/trace/trace_stack.c +5 −0
mm/mmap.c +0 −6
virt/kvm/kvm_main.c +96 −17

Documentation/devicetree/bindings/spi/spi-controller.yaml+2−2

@@ -111,7 +111,7 @@ patternProperties: · 110 unmodified lines
111	spi-rx-bus-width:	111	spi-rx-bus-width:
112	allOf:	112	allOf:
113	- $ref: /schemas/types.yaml#/definitions/uint32	113	- $ref: /schemas/types.yaml#/definitions/uint32
114	- enum: [ 1, 2, 4 ]	114	- enum: [ 1, 2, 4, 8 ]
115	- default: 1	115	- default: 1
116	description:	116	description:
117	Bus width to the SPI bus used for MISO.	117	Bus width to the SPI bus used for MISO.
@@ -123,7 +123,7 @@ patternProperties: · 5 unmodified lines
123	spi-tx-bus-width:	123	spi-tx-bus-width:
124	allOf:	124	allOf:
125	- $ref: /schemas/types.yaml#/definitions/uint32	125	- $ref: /schemas/types.yaml#/definitions/uint32
126	- enum: [ 1, 2, 4 ]	126	- enum: [ 1, 2, 4, 8 ]
127	- default: 1	127	- default: 1
128	description:	128	description:
129	Bus width to the SPI bus used for MOSI.	129	Bus width to the SPI bus used for MOSI.

arch/arc/include/asm/entry-arcv2.h+4−4

@@ -162,7 +162,7 @@ · 161 unmodified lines
162	#endif	162	#endif
163		163
164	#ifdef CONFIG_ARC_HAS_ACCL_REGS	164	#ifdef CONFIG_ARC_HAS_ACCL_REGS
165	ST2 r58, r59, PT_sp + 12	165	ST2 r58, r59, PT_r58
166	#endif	166	#endif
167		167
168	.endm	168	.endm
@@ -172,8 +172,8 @@ · 3 unmodified lines
172		172
173	LD2 gp, fp, PT_r26 ; gp (r26), fp (r27)	173	LD2 gp, fp, PT_r26 ; gp (r26), fp (r27)
174		174
175	ld r12, [sp, PT_sp + 4]	175	ld r12, [sp, PT_r12]
176	ld r30, [sp, PT_sp + 8]	176	ld r30, [sp, PT_r30]
177		177
178	; Restore SP (into AUX_USER_SP) only if returning to U mode	178	; Restore SP (into AUX_USER_SP) only if returning to U mode
179	; - for K mode, it will be implicitly restored as stack is unwound	179	; - for K mode, it will be implicitly restored as stack is unwound
@@ -190,7 +190,7 @@ · 10 unmodified lines
190	#endif	190	#endif
191		191
192	#ifdef CONFIG_ARC_HAS_ACCL_REGS	192	#ifdef CONFIG_ARC_HAS_ACCL_REGS
193	LD2 r58, r59, PT_sp + 12	193	LD2 r58, r59, PT_r58
194	#endif	194	#endif
195	.endm	195	.endm
196		196

arch/arc/include/asm/hugepage.h+0−1

@@ -8,7 +8,6 @@ · 7 unmodified lines
8	#define _ASM_ARC_HUGEPAGE_H	8	#define _ASM_ARC_HUGEPAGE_H
9		9
10	#include <linux/types.h>	10	#include <linux/types.h>
11	#define __ARCH_USE_5LEVEL_HACK
12	#include <asm-generic/pgtable-nopmd.h>	11	#include <asm-generic/pgtable-nopmd.h>
13		12
14	static inline pte_t pmd_pte(pmd_t pmd)	13	static inline pte_t pmd_pte(pmd_t pmd)

arch/arc/kernel/asm-offsets.c+9−1

@@ -66,7 +66,15 @@ int main(void) · 65 unmodified lines
66		66
67	DEFINE(SZ_CALLEE_REGS, sizeof(struct callee_regs));	67	DEFINE(SZ_CALLEE_REGS, sizeof(struct callee_regs));
68	DEFINE(SZ_PT_REGS, sizeof(struct pt_regs));	68	DEFINE(SZ_PT_REGS, sizeof(struct pt_regs));
69	DEFINE(PT_user_r25, offsetof(struct pt_regs, user_r25));	69
		70	#ifdef CONFIG_ISA_ARCV2
		71	OFFSET(PT_r12, pt_regs, r12);
		72	OFFSET(PT_r30, pt_regs, r30);
		73	#endif
		74	#ifdef CONFIG_ARC_HAS_ACCL_REGS
		75	OFFSET(PT_r58, pt_regs, r58);
		76	OFFSET(PT_r59, pt_regs, r59);
		77	#endif
70		78
71	return 0;	79	return 0;
72	}	80	}

arch/arc/plat-eznps/Kconfig+1−1

@@ -7,7 +7,7 @@ · 6 unmodified lines
7	menuconfig ARC_PLAT_EZNPS	7	menuconfig ARC_PLAT_EZNPS
8	bool "\"EZchip\" ARC dev platform"	8	bool "\"EZchip\" ARC dev platform"
9	select CPU_BIG_ENDIAN	9	select CPU_BIG_ENDIAN
10	select CLKSRC_NPS	10	select CLKSRC_NPS if !PHYS_ADDR_T_64BIT
11	select EZNPS_GIC	11	select EZNPS_GIC
12	select EZCHIP_NPS_MANAGEMENT_ENET if ETHERNET	12	select EZCHIP_NPS_MANAGEMENT_ENET if ETHERNET
13	help	13	help

arch/arm64/include/asm/pgtable-prot.h+2−3

 #define PAGE_SHARED_EXEC	__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE)
 #define PAGE_READONLY		__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
 #define PAGE_READONLY_EXEC	__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN)
-#define PAGE_EXECONLY		__pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN)
 #define __P000  PAGE_NONE
 #define __P001  PAGE_READONLY
 #define __P010  PAGE_READONLY
 #define __P011  PAGE_READONLY
-#define __P100  PAGE_EXECONLY
+#define __P100  PAGE_READONLY_EXEC
 #define __P101  PAGE_READONLY_EXEC
 #define __P110  PAGE_READONLY_EXEC
 #define __P111  PAGE_READONLY_EXEC
 #define __S001  PAGE_READONLY
 #define __S010  PAGE_SHARED
 #define __S011  PAGE_SHARED
-#define __S100  PAGE_EXECONLY
+#define __S100  PAGE_READONLY_EXEC
 #define __S101  PAGE_READONLY_EXEC
 #define __S110  PAGE_SHARED_EXEC
 #define __S111  PAGE_SHARED_EXEC

arch/arm64/include/asm/pgtable.h+3−7

 #define pte_dirty(pte)		(pte_sw_dirty(pte) || pte_hw_dirty(pte))
 #define pte_valid(pte)		(!!(pte_val(pte) & PTE_VALID))
-/*
- * Execute-only user mappings do not have the PTE_USER bit set. All valid
- * kernel mappings have the PTE_UXN bit set.
- */
 #define pte_valid_not_user(pte) \
-	((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
+	((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
 #define pte_valid_young(pte) \
 	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
 #define pte_valid_user(pte) \
 /*
  * p??_access_permitted() is true for valid user mappings (subject to the
- * write permission check) other than user execute-only which do not have the
+ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit
- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
+ * set.
  */
 #define pte_access_permitted(pte, write) \
 	(pte_valid_user(pte) && (!(write) || pte_write(pte)))

arch/arm64/mm/fault.c+1−1

@@ -445,7 +445,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, · 444 unmodified lines
445	const struct fault_info *inf;	445	const struct fault_info *inf;
446	struct mm_struct *mm = current->mm;	446	struct mm_struct *mm = current->mm;
447	vm_fault_t fault, major = 0;	447	vm_fault_t fault, major = 0;
448	unsigned long vm_flags = VM_READ \| VM_WRITE;	448	unsigned long vm_flags = VM_READ \| VM_WRITE \| VM_EXEC;
449	unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY \| FAULT_FLAG_KILLABLE;	449	unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY \| FAULT_FLAG_KILLABLE;
450		450
451	if (kprobe_page_fault(regs, esr))	451	if (kprobe_page_fault(regs, esr))

arch/x86/include/asm/kvm_host.h+2−2

 	bool pvclock_set_guest_stopped_request;
 	struct {
+		u8 preempted;
 		u64 msr_val;
 		u64 last_steal;
-		struct gfn_to_hva_cache stime;
+		struct gfn_to_pfn_cache cache;
-		struct kvm_steal_time steal;
 	} st;
 	u64 tsc_offset;

arch/x86/kvm/x86.c+43−26

 static void record_steal_time(struct kvm_vcpu *vcpu)
 {
+	struct kvm_host_map map;
+	struct kvm_steal_time *st;
 	if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
 		return;
-	if (unlikely(kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+	/* -EAGAIN is returned in atomic context so we can just return. */
-		&vcpu->arch.st.steal, sizeof(struct kvm_steal_time))))
+	if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT,
+			&map, &vcpu->arch.st.cache, false))
 		return;
+	st = map.hva +
+		offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
 	/*
 	 * Doing a TLB flush here, on the guest's behalf, can avoid
 	 * expensive IPIs.
 	 */
 	trace_kvm_pv_tlb_flush(vcpu->vcpu_id,
-		vcpu->arch.st.steal.preempted & KVM_VCPU_FLUSH_TLB);
+		st->preempted & KVM_VCPU_FLUSH_TLB);
-	if (xchg(&vcpu->arch.st.steal.preempted, 0) & KVM_VCPU_FLUSH_TLB)
+	if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
 		kvm_vcpu_flush_tlb(vcpu, false);
-	if (vcpu->arch.st.steal.version & 1)
+	vcpu->arch.st.preempted = 0;
-		vcpu->arch.st.steal.version += 1;  /* first time write, random junk */
-	vcpu->arch.st.steal.version += 1;
+	if (st->version & 1)
+		st->version += 1;  /* first time write, random junk */
-	kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+	st->version += 1;
-		&vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
 	smp_wmb();
-	vcpu->arch.st.steal.steal += current->sched_info.run_delay -
+	st->steal += current->sched_info.run_delay -
 		vcpu->arch.st.last_steal;
 	vcpu->arch.st.last_steal = current->sched_info.run_delay;
-	kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
-		&vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
 	smp_wmb();
-	vcpu->arch.st.steal.version += 1;
+	st->version += 1;
-	kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+	kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, false);
-		&vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
 }
 int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 		if (data & KVM_STEAL_RESERVED_MASK)
 			return 1;
-		if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
-						data & KVM_STEAL_VALID_BITS,
-						sizeof(struct kvm_steal_time)))
-			return 1;
 		vcpu->arch.st.msr_val = data;
 		if (!(data & KVM_MSR_ENABLED))
 static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
 {
+	struct kvm_host_map map;
+	struct kvm_steal_time *st;
 	if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
 		return;
-	vcpu->arch.st.steal.preempted = KVM_VCPU_PREEMPTED;
+	if (vcpu->arch.st.preempted)
+		return;
+	if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT, &map,
+			&vcpu->arch.st.cache, true))
+		return;
+	st = map.hva +
+		offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
+	st->preempted = vcpu->arch.st.preempted = KVM_VCPU_PREEMPTED;
-	kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.st.stime,
+	kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, true);
-			&vcpu->arch.st.steal.preempted,
-			offsetof(struct kvm_steal_time, preempted),
-			sizeof(vcpu->arch.st.steal.preempted));
 }
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 {
+	struct gfn_to_pfn_cache *cache = &vcpu->arch.st.cache;
 	int idx;
+	kvm_release_pfn(cache->pfn, cache->dirty, cache);
 	kvmclock_reset(vcpu);
 	kvm_x86_ops->vcpu_free(vcpu);
 void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
 {
+	struct kvm_vcpu *vcpu;
+	int i;
 	/*
 	 * memslots->generation has been incremented.
 	 * mmio generation may have reached its maximum value.
 	 */
 	kvm_mmu_invalidate_mmio_sptes(kvm, gen);
+	/* Force re-initialization of steal_time cache */
+	kvm_for_each_vcpu(i, vcpu, kvm)
+		kvm_vcpu_kick(vcpu);
 }
 int kvm_arch_prepare_memory_region(struct kvm *kvm,

drivers/char/tpm/tpm_tis_core.c+15−19

 	if (wait_startup(chip, 0) != 0) {
 		rc = -ENODEV;
-		goto err_start;
+		goto out_err;
 	}
 	/* Take control of the TPM's interrupt hardware and shut it off */
 	rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask);
 	if (rc < 0)
-		goto err_start;
+		goto out_err;
 	intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT |
 		   TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT;
 	rc = tpm_chip_start(chip);
 	if (rc)
-		goto err_start;
+		goto out_err;
 	rc = tpm2_probe(chip);
+	tpm_chip_stop(chip);
 	if (rc)
-		goto err_probe;
+		goto out_err;
 	rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor);
 	if (rc < 0)
-		goto err_probe;
+		goto out_err;
 	priv->manufacturer_id = vendor;
 	rc = tpm_tis_read8(priv, TPM_RID(0), &rid);
 	if (rc < 0)
-		goto err_probe;
+		goto out_err;
 	dev_info(dev, "%s TPM (device-id 0x%X, rev-id %d)\n",
 		 (chip->flags & TPM_CHIP_FLAG_TPM2) ? "2.0" : "1.2",
 	probe = probe_itpm(chip);
 	if (probe < 0) {
 		rc = -ENODEV;
-		goto err_probe;
+		goto out_err;
 	}
 	/* Figure out the capabilities */
 	rc = tpm_tis_read32(priv, TPM_INTF_CAPS(priv->locality), &intfcaps);
 	if (rc < 0)
-		goto err_probe;
+		goto out_err;
 	dev_dbg(dev, "TPM interface capabilities (0x%x):\n",
 		intfcaps);
 		if (tpm_get_timeouts(chip)) {
 			dev_err(dev, "Could not get TPM timeouts and durations\n");
 			rc = -ENODEV;
-			goto err_probe;
+			goto out_err;
 		}
-		chip->flags |= TPM_CHIP_FLAG_IRQ;
 		if (irq) {
 			tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED,
 						 irq);
 		}
 	}
-	tpm_chip_stop(chip);
 	rc = tpm_chip_register(chip);
 	if (rc)
-		goto err_start;
+		goto out_err;
-	return 0;
-err_probe:
+	if (chip->ops->clk_enable != NULL)
-	tpm_chip_stop(chip);
+		chip->ops->clk_enable(chip, false);
-err_start:
+	return 0;
+out_err:
 	if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL))
 		chip->ops->clk_enable(chip, false);

drivers/regulator/axp20x-regulator.c+7−4

 		int i;
 		for (i = 0; i < rate_count; i++) {
-			if (ramp <= slew_rates[i])
+			if (ramp > slew_rates[i])
-				cfg = AXP20X_DCDC2_LDO3_V_RAMP_LDO3_RATE(i);
-			else
 				break;
+			if (id == AXP20X_DCDC2)
+				cfg = AXP20X_DCDC2_LDO3_V_RAMP_DCDC2_RATE(i);
+			else
+				cfg = AXP20X_DCDC2_LDO3_V_RAMP_LDO3_RATE(i);
 		}
 		if (cfg == 0xff) {
 		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO1_MASK),
 	AXP_DESC(AXP22X, ELDO2, "eldo2", "eldoin", 700, 3300, 100,
 		 AXP22X_ELDO2_V_OUT, AXP22X_ELDO2_V_OUT_MASK,
-		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO1_MASK),
+		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO2_MASK),
 	AXP_DESC(AXP22X, ELDO3, "eldo3", "eldoin", 700, 3300, 100,
 		 AXP22X_ELDO3_V_OUT, AXP22X_ELDO3_V_OUT_MASK,
 		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_ELDO3_MASK),

drivers/regulator/bd70528-regulator.c+0−1

@@ -101,7 +101,6 @@ static const struct regulator_ops bd70528_ldo_ops = { · 100 unmodified lines
101	.set_voltage_sel = regulator_set_voltage_sel_regmap,	101	.set_voltage_sel = regulator_set_voltage_sel_regmap,
102	.get_voltage_sel = regulator_get_voltage_sel_regmap,	102	.get_voltage_sel = regulator_get_voltage_sel_regmap,
103	.set_voltage_time_sel = regulator_set_voltage_time_sel,	103	.set_voltage_time_sel = regulator_set_voltage_time_sel,
104	.set_ramp_delay = bd70528_set_ramp_delay,
105	};	104	};
106		105
107	static const struct regulator_ops bd70528_led_ops = {	106	static const struct regulator_ops bd70528_led_ops = {

drivers/rtc/rtc-mc146818-lib.c+1−14

@@ -172,20 +172,7 @@ int mc146818_set_time(struct rtc_time *time) · 171 unmodified lines
172	save_control = CMOS_READ(RTC_CONTROL);	172	save_control = CMOS_READ(RTC_CONTROL);
173	CMOS_WRITE((save_control\|RTC_SET), RTC_CONTROL);	173	CMOS_WRITE((save_control\|RTC_SET), RTC_CONTROL);
174	save_freq_select = CMOS_READ(RTC_FREQ_SELECT);	174	save_freq_select = CMOS_READ(RTC_FREQ_SELECT);
175		175	CMOS_WRITE((save_freq_select\|RTC_DIV_RESET2), RTC_FREQ_SELECT);
176	#ifdef CONFIG_X86
177	if ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
178	boot_cpu_data.x86 == 0x17) \|\|
179	boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) {
180	CMOS_WRITE((save_freq_select & (~RTC_DIV_RESET2)),
181	RTC_FREQ_SELECT);
182	save_freq_select &= ~RTC_DIV_RESET2;
183	} else
184	CMOS_WRITE((save_freq_select \| RTC_DIV_RESET2),
185	RTC_FREQ_SELECT);
186	#else
187	CMOS_WRITE((save_freq_select \| RTC_DIV_RESET2), RTC_FREQ_SELECT);
188	#endif
189		176
190	#ifdef CONFIG_MACH_DECSTATION	177	#ifdef CONFIG_MACH_DECSTATION
191	CMOS_WRITE(real_yrs, RTC_DEC_YEAR);	178	CMOS_WRITE(real_yrs, RTC_DEC_YEAR);

drivers/rtc/rtc-mt6397.c+25−14

 		irqen = irqsta & ~RTC_IRQ_EN_AL;
 		mutex_lock(&rtc->lock);
 		if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
-				 irqen) < 0)
+				 irqen) == 0)
 			mtk_rtc_write_trigger(rtc);
 		mutex_unlock(&rtc->lock);
 	alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
 	mutex_unlock(&rtc->lock);
-	tm->tm_sec = data[RTC_OFFSET_SEC];
+	tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
-	tm->tm_min = data[RTC_OFFSET_MIN];
+	tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
-	tm->tm_hour = data[RTC_OFFSET_HOUR];
+	tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
-	tm->tm_mday = data[RTC_OFFSET_DOM];
+	tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
-	tm->tm_mon = data[RTC_OFFSET_MTH];
+	tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
-	tm->tm_year = data[RTC_OFFSET_YEAR];
+	tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
 	tm->tm_year += RTC_MIN_YEAR_OFFSET;
 	tm->tm_mon--;
 	tm->tm_year -= RTC_MIN_YEAR_OFFSET;
 	tm->tm_mon++;
-	data[RTC_OFFSET_SEC] = tm->tm_sec;
-	data[RTC_OFFSET_MIN] = tm->tm_min;
-	data[RTC_OFFSET_HOUR] = tm->tm_hour;
-	data[RTC_OFFSET_DOM] = tm->tm_mday;
-	data[RTC_OFFSET_MTH] = tm->tm_mon;
-	data[RTC_OFFSET_YEAR] = tm->tm_year;
 	mutex_lock(&rtc->lock);
+	ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
+			       data, RTC_OFFSET_COUNT);
+	if (ret < 0)
+		goto exit;
+	data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
+				(tm->tm_sec & RTC_AL_SEC_MASK));
+	data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
+				(tm->tm_min & RTC_AL_MIN_MASK));
+	data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
+				(tm->tm_hour & RTC_AL_HOU_MASK));
+	data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
+				(tm->tm_mday & RTC_AL_DOM_MASK));
+	data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
+				(tm->tm_mon & RTC_AL_MTH_MASK));
+	data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
+				(tm->tm_year & RTC_AL_YEA_MASK));
 	if (alm->enabled) {
 		ret = regmap_bulk_write(rtc->regmap,
 					rtc->addr_base + RTC_AL_SEC,

drivers/rtc/rtc-sun6i.c+16−0

@@ -379,6 +379,22 @@ static void __init sun50i_h6_rtc_clk_init(struct device_node *node) · 378 unmodified lines
379	CLK_OF_DECLARE_DRIVER(sun50i_h6_rtc_clk, "allwinner,sun50i-h6-rtc",	379	CLK_OF_DECLARE_DRIVER(sun50i_h6_rtc_clk, "allwinner,sun50i-h6-rtc",
380	sun50i_h6_rtc_clk_init);	380	sun50i_h6_rtc_clk_init);
381		381
		382	/*
		383	* The R40 user manual is self-conflicting on whether the prescaler is
		384	* fixed or configurable. The clock diagram shows it as fixed, but there
		385	* is also a configurable divider in the RTC block.
		386	*/
		387	static const struct sun6i_rtc_clk_data sun8i_r40_rtc_data = {
		388	.rc_osc_rate = 16000000,
		389	.fixed_prescaler = 512,
		390	};
		391	static void __init sun8i_r40_rtc_clk_init(struct device_node *node)
		392	{
		393	sun6i_rtc_clk_init(node, &sun8i_r40_rtc_data);
		394	}
		395	CLK_OF_DECLARE_DRIVER(sun8i_r40_rtc_clk, "allwinner,sun8i-r40-rtc",
		396	sun8i_r40_rtc_clk_init);
		397
382	static const struct sun6i_rtc_clk_data sun8i_v3_rtc_data = {	398	static const struct sun6i_rtc_clk_data sun8i_v3_rtc_data = {
383	.rc_osc_rate = 32000,	399	.rc_osc_rate = 32000,
384	.has_out_clk = 1,	400	.has_out_clk = 1,

drivers/spi/spi-dw.c+12−3

@@ -172,9 +172,11 @@ static inline u32 rx_max(struct dw_spi *dws) · 171 unmodified lines
172		172
173	static void dw_writer(struct dw_spi *dws)	173	static void dw_writer(struct dw_spi *dws)
174	{	174	{
175	u32 max = tx_max(dws);	175	u32 max;
176	u16 txw = 0;	176	u16 txw = 0;
177		177
		178	spin_lock(&dws->buf_lock);
		179	max = tx_max(dws);
178	while (max--) {	180	while (max--) {
179	/* Set the tx word if the transfer's original "tx" is not null */	181	/* Set the tx word if the transfer's original "tx" is not null */
180	if (dws->tx_end - dws->len) {	182	if (dws->tx_end - dws->len) {
@@ -186,13 +188,16 @@ static void dw_writer(struct dw_spi *dws) · 5 unmodified lines
186	dw_write_io_reg(dws, DW_SPI_DR, txw);	188	dw_write_io_reg(dws, DW_SPI_DR, txw);
187	dws->tx += dws->n_bytes;	189	dws->tx += dws->n_bytes;
188	}	190	}
		191	spin_unlock(&dws->buf_lock);
189	}	192	}
190		193
191	static void dw_reader(struct dw_spi *dws)	194	static void dw_reader(struct dw_spi *dws)
192	{	195	{
193	u32 max = rx_max(dws);	196	u32 max;
194	u16 rxw;	197	u16 rxw;
195		198
		199	spin_lock(&dws->buf_lock);
		200	max = rx_max(dws);
196	while (max--) {	201	while (max--) {
197	rxw = dw_read_io_reg(dws, DW_SPI_DR);	202	rxw = dw_read_io_reg(dws, DW_SPI_DR);
198	/* Care rx only if the transfer's original "rx" is not null */	203	/* Care rx only if the transfer's original "rx" is not null */
@@ -204,6 +209,7 @@ static void dw_reader(struct dw_spi *dws) · 5 unmodified lines
204	}	209	}
205	dws->rx += dws->n_bytes;	210	dws->rx += dws->n_bytes;
206	}	211	}
		212	spin_unlock(&dws->buf_lock);
207	}	213	}
208		214
209	static void int_error_stop(struct dw_spi dws, const char msg)	215	static void int_error_stop(struct dw_spi dws, const char msg)
@@ -276,18 +282,20 @@ static int dw_spi_transfer_one(struct spi_controller *master, · 66 unmodified lines
276	{	282	{
277	struct dw_spi *dws = spi_controller_get_devdata(master);	283	struct dw_spi *dws = spi_controller_get_devdata(master);
278	struct chip_data *chip = spi_get_ctldata(spi);	284	struct chip_data *chip = spi_get_ctldata(spi);
		285	unsigned long flags;
279	u8 imask = 0;	286	u8 imask = 0;
280	u16 txlevel = 0;	287	u16 txlevel = 0;
281	u32 cr0;	288	u32 cr0;
282	int ret;	289	int ret;
283		290
284	dws->dma_mapped = 0;	291	dws->dma_mapped = 0;
285		292	spin_lock_irqsave(&dws->buf_lock, flags);
286	dws->tx = (void *)transfer->tx_buf;	293	dws->tx = (void *)transfer->tx_buf;
287	dws->tx_end = dws->tx + transfer->len;	294	dws->tx_end = dws->tx + transfer->len;
288	dws->rx = transfer->rx_buf;	295	dws->rx = transfer->rx_buf;
289	dws->rx_end = dws->rx + transfer->len;	296	dws->rx_end = dws->rx + transfer->len;
290	dws->len = transfer->len;	297	dws->len = transfer->len;
		298	spin_unlock_irqrestore(&dws->buf_lock, flags);
291		299
292	spi_enable_chip(dws, 0);	300	spi_enable_chip(dws, 0);
293		301
@@ -471,6 +479,7 @@ int dw_spi_add_host(struct device dev, struct dw_spi dws) · 177 unmodified lines
471	dws->type = SSI_MOTO_SPI;	479	dws->type = SSI_MOTO_SPI;
472	dws->dma_inited = 0;	480	dws->dma_inited = 0;
473	dws->dma_addr = (dma_addr_t)(dws->paddr + DW_SPI_DR);	481	dws->dma_addr = (dma_addr_t)(dws->paddr + DW_SPI_DR);
		482	spin_lock_init(&dws->buf_lock);
474		483
475	spi_controller_set_devdata(master, dws);	484	spi_controller_set_devdata(master, dws);
476		485

drivers/spi/spi-dw.h+1−0

@@ -119,6 +119,7 @@ struct dw_spi { · 118 unmodified lines
119	size_t len;	119	size_t len;
120	void *tx;	120	void *tx;
121	void *tx_end;	121	void *tx_end;
		122	spinlock_t buf_lock;
122	void *rx;	123	void *rx;
123	void *rx_end;	124	void *rx_end;
124	int dma_mapped;	125	int dma_mapped;

drivers/spi/spi-fsl-dspi.c+10−14

 	struct spi_transfer			*cur_transfer;
 	struct spi_message			*cur_msg;
 	struct chip_data			*cur_chip;
+	size_t					progress;
 	size_t					len;
 	const void				*tx;
 	void					*rx;
 	dspi->tx_cmd |= SPI_PUSHR_CMD_CTCNT;
 	if (dspi->devtype_data->xspi_mode && dspi->bits_per_word > 16) {
-		/* Write two TX FIFO entries first, and then the corresponding
+		/* Write the CMD FIFO entry first, and then the two
-		 * CMD FIFO entry.
+		 * corresponding TX FIFO entries.
 		 */
 		u32 data = dspi_pop_tx(dspi);
-		if (dspi->cur_chip->ctar_val & SPI_CTAR_LSBFE) {
-			/* LSB */
-			tx_fifo_write(dspi, data & 0xFFFF);
-			tx_fifo_write(dspi, data >> 16);
-		} else {
-			/* MSB */
-			tx_fifo_write(dspi, data >> 16);
-			tx_fifo_write(dspi, data & 0xFFFF);
-		}
 		cmd_fifo_write(dspi);
+		tx_fifo_write(dspi, data & 0xFFFF);
+		tx_fifo_write(dspi, data >> 16);
 	} else {
 		/* Write one entry to both TX FIFO and CMD FIFO
 		 * simultaneously.
 	u32 spi_tcr;
 	spi_take_timestamp_post(dspi->ctlr, dspi->cur_transfer,
-				dspi->tx - dspi->bytes_per_word, !dspi->irq);
+				dspi->progress, !dspi->irq);
 	/* Get transfer counter (in number of SPI transfers). It was
 	 * reset to 0 when transfer(s) were started.
 	spi_tcnt = SPI_TCR_GET_TCNT(spi_tcr);
 	/* Update total number of bytes that were transferred */
 	msg->actual_length += spi_tcnt * dspi->bytes_per_word;
+	dspi->progress += spi_tcnt;
 	trans_mode = dspi->devtype_data->trans_mode;
 	if (trans_mode == DSPI_EOQ_MODE)
 		return 0;
 	spi_take_timestamp_pre(dspi->ctlr, dspi->cur_transfer,
-			       dspi->tx, !dspi->irq);
+			       dspi->progress, !dspi->irq);
 	if (trans_mode == DSPI_EOQ_MODE)
 		dspi_eoq_write(dspi);
 		dspi->rx = transfer->rx_buf;
 		dspi->rx_end = dspi->rx + transfer->len;
 		dspi->len = transfer->len;
+		dspi->progress = 0;
 		/* Validated transfer specific frame size (defaults applied) */
 		dspi->bits_per_word = transfer->bits_per_word;
 		if (transfer->bits_per_word <= 8)
 				     SPI_CTARE_DTCP(1));
 		spi_take_timestamp_pre(dspi->ctlr, dspi->cur_transfer,
-				       dspi->tx, !dspi->irq);
+				       dspi->progress, !dspi->irq);
 		trans_mode = dspi->devtype_data->trans_mode;
 		switch (trans_mode) {

drivers/spi/spi-uniphier.c+19−12

 	}
 }
-static void uniphier_spi_fill_tx_fifo(struct uniphier_spi_priv *priv)
+static void uniphier_spi_set_fifo_threshold(struct uniphier_spi_priv *priv,
+					    unsigned int threshold)
 {
-	unsigned int fifo_threshold, fill_bytes;
 	u32 val;
-	fifo_threshold = DIV_ROUND_UP(priv->rx_bytes,
-				bytes_per_word(priv->bits_per_word));
-	fifo_threshold = min(fifo_threshold, SSI_FIFO_DEPTH);
-	fill_bytes = fifo_threshold - (priv->rx_bytes - priv->tx_bytes);
-	/* set fifo threshold */
 	val = readl(priv->base + SSI_FC);
 	val &= ~(SSI_FC_TXFTH_MASK | SSI_FC_RXFTH_MASK);
-	val |= FIELD_PREP(SSI_FC_TXFTH_MASK, fifo_threshold);
+	val |= FIELD_PREP(SSI_FC_TXFTH_MASK, SSI_FIFO_DEPTH - threshold);
-	val |= FIELD_PREP(SSI_FC_RXFTH_MASK, fifo_threshold);
+	val |= FIELD_PREP(SSI_FC_RXFTH_MASK, threshold);
 	writel(val, priv->base + SSI_FC);
+}
+static void uniphier_spi_fill_tx_fifo(struct uniphier_spi_priv *priv)
+{
+	unsigned int fifo_threshold, fill_words;
+	unsigned int bpw = bytes_per_word(priv->bits_per_word);
+	fifo_threshold = DIV_ROUND_UP(priv->rx_bytes, bpw);
+	fifo_threshold = min(fifo_threshold, SSI_FIFO_DEPTH);
+	uniphier_spi_set_fifo_threshold(priv, fifo_threshold);
+	fill_words = fifo_threshold -
+		DIV_ROUND_UP(priv->rx_bytes - priv->tx_bytes, bpw);
-	while (fill_bytes--)
+	while (fill_words--)
 		uniphier_spi_send(priv);
 }

drivers/spi/spi.c+8−14

  *			    advances its @tx buffer pointer monotonically.
  * @ctlr: Pointer to the spi_controller structure of the driver
  * @xfer: Pointer to the transfer being timestamped
- * @tx: Pointer to the current word within the xfer->tx_buf that the driver is
+ * @progress: How many words (not bytes) have been transferred so far
- *	preparing to transmit right now.
  * @irqs_off: If true, will disable IRQs and preemption for the duration of the
  *	      transfer, for less jitter in time measurement. Only compatible
  *	      with PIO drivers. If true, must follow up with
  */
 void spi_take_timestamp_pre(struct spi_controller *ctlr,
 			    struct spi_transfer *xfer,
-			    const void *tx, bool irqs_off)
+			    size_t progress, bool irqs_off)
 {
-	u8 bytes_per_word = DIV_ROUND_UP(xfer->bits_per_word, 8);
 	if (!xfer->ptp_sts)
 		return;
 	if (xfer->timestamped_pre)
 		return;
-	if (tx < (xfer->tx_buf + xfer->ptp_sts_word_pre * bytes_per_word))
+	if (progress < xfer->ptp_sts_word_pre)
 		return;
 	/* Capture the resolution of the timestamp */
-	xfer->ptp_sts_word_pre = (tx - xfer->tx_buf) / bytes_per_word;
+	xfer->ptp_sts_word_pre = progress;
 	xfer->timestamped_pre = true;
  *			     timestamped.
  * @ctlr: Pointer to the spi_controller structure of the driver
  * @xfer: Pointer to the transfer being timestamped
- * @tx: Pointer to the current word within the xfer->tx_buf that the driver has
+ * @progress: How many words (not bytes) have been transferred so far
- *	just transmitted.
  * @irqs_off: If true, will re-enable IRQs and preemption for the local CPU.
  */
 void spi_take_timestamp_post(struct spi_controller *ctlr,
 			     struct spi_transfer *xfer,
-			     const void *tx, bool irqs_off)
+			     size_t progress, bool irqs_off)
 {
-	u8 bytes_per_word = DIV_ROUND_UP(xfer->bits_per_word, 8);
 	if (!xfer->ptp_sts)
 		return;
 	if (xfer->timestamped_post)
 		return;
-	if (tx < (xfer->tx_buf + xfer->ptp_sts_word_post * bytes_per_word))
+	if (progress < xfer->ptp_sts_word_post)
 		return;
 	ptp_read_system_postts(xfer->ptp_sts);
 	}
 	/* Capture the resolution of the timestamp */
-	xfer->ptp_sts_word_post = (tx - xfer->tx_buf) / bytes_per_word;
+	xfer->ptp_sts_word_post = progress;
 	xfer->timestamped_post = true;
 }

drivers/watchdog/Kconfig+2−0

 config MAX77620_WATCHDOG
 	tristate "Maxim Max77620 Watchdog Timer"
 	depends on MFD_MAX77620 || COMPILE_TEST
+	select WATCHDOG_CORE
 	help
 	 This is the driver for the Max77620 watchdog timer.
 	 Say 'Y' here to enable the watchdog timer support for
 config TQMX86_WDT
 	tristate "TQ-Systems TQMX86 Watchdog Timer"
 	depends on X86
+	select WATCHDOG_CORE
 	help
 	This is the driver for the hardware watchdog timer in the TQMX86 IO
 	controller found on some of their ComExpress Modules.

drivers/watchdog/imx7ulp_wdt.c+1−1

@@ -112,7 +112,7 @@ static int imx7ulp_wdt_restart(struct watchdog_device *wdog, · 111 unmodified lines
112	{	112	{
113	struct imx7ulp_wdt_device *wdt = watchdog_get_drvdata(wdog);	113	struct imx7ulp_wdt_device *wdt = watchdog_get_drvdata(wdog);
114		114
115	imx7ulp_wdt_enable(wdt->base, true);	115	imx7ulp_wdt_enable(wdog, true);
116	imx7ulp_wdt_set_timeout(&wdt->wdd, 1);	116	imx7ulp_wdt_set_timeout(&wdt->wdd, 1);
117		117
118	/* wait for wdog to fire */	118	/* wait for wdog to fire */

drivers/watchdog/orion_wdt.c+2−2

@@ -602,7 +602,7 @@ static int orion_wdt_probe(struct platform_device *pdev) · 601 unmodified lines
602	set_bit(WDOG_HW_RUNNING, &dev->wdt.status);	602	set_bit(WDOG_HW_RUNNING, &dev->wdt.status);
603		603
604	/* Request the IRQ only after the watchdog is disabled */	604	/* Request the IRQ only after the watchdog is disabled */
605	irq = platform_get_irq(pdev, 0);	605	irq = platform_get_irq_optional(pdev, 0);
606	if (irq > 0) {	606	if (irq > 0) {
607	/*	607	/*
608	* Not all supported platforms specify an interrupt for the	608	* Not all supported platforms specify an interrupt for the
@@ -617,7 +617,7 @@ static int orion_wdt_probe(struct platform_device *pdev) · 8 unmodified lines
617	}	617	}
618		618
619	/* Optional 2nd interrupt for pretimeout */	619	/* Optional 2nd interrupt for pretimeout */
620	irq = platform_get_irq(pdev, 1);	620	irq = platform_get_irq_optional(pdev, 1);
621	if (irq > 0) {	621	if (irq > 0) {
622	orion_wdt_info.options \|= WDIOF_PRETIMEOUT;	622	orion_wdt_info.options \|= WDIOF_PRETIMEOUT;
623	ret = devm_request_irq(&pdev->dev, irq, orion_wdt_pre_irq,	623	ret = devm_request_irq(&pdev->dev, irq, orion_wdt_pre_irq,

drivers/watchdog/rn5t618_wdt.c+1−0

@@ -188,6 +188,7 @@ static struct platform_driver rn5t618_wdt_driver = { · 187 unmodified lines
188		188
189	module_platform_driver(rn5t618_wdt_driver);	189	module_platform_driver(rn5t618_wdt_driver);
190		190
		191	MODULE_ALIAS("platform:rn5t618-wdt");
191	MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");	192	MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
192	MODULE_DESCRIPTION("RN5T618 watchdog driver");	193	MODULE_DESCRIPTION("RN5T618 watchdog driver");
193	MODULE_LICENSE("GPL v2");	194	MODULE_LICENSE("GPL v2");

drivers/watchdog/w83627hf_wdt.c+1−1

@@ -420,7 +420,7 @@ static int wdt_find(int addr) · 419 unmodified lines
420	cr_wdt_csr = NCT6102D_WDT_CSR;	420	cr_wdt_csr = NCT6102D_WDT_CSR;
421	break;	421	break;
422	case NCT6116_ID:	422	case NCT6116_ID:
423	ret = nct6102;	423	ret = nct6116;
424	cr_wdt_timeout = NCT6102D_WDT_TIMEOUT;	424	cr_wdt_timeout = NCT6102D_WDT_TIMEOUT;
425	cr_wdt_control = NCT6102D_WDT_CONTROL;	425	cr_wdt_control = NCT6102D_WDT_CONTROL;
426	cr_wdt_csr = NCT6102D_WDT_CSR;	426	cr_wdt_csr = NCT6102D_WDT_CSR;

include/linux/kvm_host.h+5−0

 void kvm_set_pfn_accessed(kvm_pfn_t pfn);
 void kvm_get_pfn(kvm_pfn_t pfn);
+void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache);
 int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
 			int len);
 int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len);
 kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);
 kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);
 int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);
+int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
+		struct gfn_to_pfn_cache *cache, bool atomic);
 struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);
 void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
+int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
+		  struct gfn_to_pfn_cache *cache, bool dirty, bool atomic);
 unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);
 unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);
 int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,

include/linux/kvm_types.h+8−1

 enum kvm_mr_change;
-#include <asm/types.h>
+#include <linux/types.h>
 /*
  * Address types:
 	struct kvm_memory_slot *memslot;
 };
+struct gfn_to_pfn_cache {
+	u64 generation;
+	gfn_t gfn;
+	kvm_pfn_t pfn;
+	bool dirty;
+};
 #endif /* __KVM_TYPES_H__ */

include/linux/mfd/mt6397/rtc.h+8−0

@@ -46,6 +46,14 @@ · 45 unmodified lines
46		46
47	#define RTC_AL_SEC 0x0018	47	#define RTC_AL_SEC 0x0018
48		48
		49	#define RTC_AL_SEC_MASK 0x003f
		50	#define RTC_AL_MIN_MASK 0x003f
		51	#define RTC_AL_HOU_MASK 0x001f
		52	#define RTC_AL_DOM_MASK 0x001f
		53	#define RTC_AL_DOW_MASK 0x0007
		54	#define RTC_AL_MTH_MASK 0x000f
		55	#define RTC_AL_YEA_MASK 0x007f
		56
49	#define RTC_PDN2 0x002e	57	#define RTC_PDN2 0x002e
50	#define RTC_PDN2_PWRON_ALARM BIT(4)	58	#define RTC_PDN2_PWRON_ALARM BIT(4)
51		59

include/linux/spi/spi.h+2−2

@@ -689,10 +689,10 @@ extern void spi_finalize_current_transfer(struct spi_controller *ctlr); · 688 unmodified lines
689	/* Helper calls for driver to timestamp transfer */	689	/* Helper calls for driver to timestamp transfer */
690	void spi_take_timestamp_pre(struct spi_controller *ctlr,	690	void spi_take_timestamp_pre(struct spi_controller *ctlr,
691	struct spi_transfer *xfer,	691	struct spi_transfer *xfer,
692	const void *tx, bool irqs_off);	692	size_t progress, bool irqs_off);
693	void spi_take_timestamp_post(struct spi_controller *ctlr,	693	void spi_take_timestamp_post(struct spi_controller *ctlr,
694	struct spi_transfer *xfer,	694	struct spi_transfer *xfer,
695	const void *tx, bool irqs_off);	695	size_t progress, bool irqs_off);
696		696
697	/* the spi driver core manages memory for the spi_controller classdev */	697	/* the spi driver core manages memory for the spi_controller classdev */
698	extern struct spi_controller __spi_alloc_controller(struct device host,	698	extern struct spi_controller __spi_alloc_controller(struct device host,

include/trace/events/preemptirq.h+4−4

@@ -18,13 +18,13 @@ DECLARE_EVENT_CLASS(preemptirq_template, · 17 unmodified lines
18	TP_ARGS(ip, parent_ip),	18	TP_ARGS(ip, parent_ip),
19		19
20	TP_STRUCT__entry(	20	TP_STRUCT__entry(
21	__field(u32, caller_offs)	21	__field(s32, caller_offs)
22	__field(u32, parent_offs)	22	__field(s32, parent_offs)
23	),	23	),
24		24
25	TP_fast_assign(	25	TP_fast_assign(
26	__entry->caller_offs = (u32)(ip - (unsigned long)_stext);	26	__entry->caller_offs = (s32)(ip - (unsigned long)_stext);
27	__entry->parent_offs = (u32)(parent_ip - (unsigned long)_stext);	27	__entry->parent_offs = (s32)(parent_ip - (unsigned long)_stext);
28	),	28	),
29		29
30	TP_printk("caller=%pS parent=%pS",	30	TP_printk("caller=%pS parent=%pS",

kernel/trace/fgraph.c+14−0

@@ -96,6 +96,20 @@ ftrace_push_return_trace(unsigned long ret, unsigned long func, · 95 unmodified lines
96	return 0;	96	return 0;
97	}	97	}
98		98
		99	/*
		100	* Not all archs define MCOUNT_INSN_SIZE which is used to look for direct
		101	* functions. But those archs currently don't support direct functions
		102	* anyway, and ftrace_find_rec_direct() is just a stub for them.
		103	* Define MCOUNT_INSN_SIZE to keep those archs compiling.
		104	*/
		105	#ifndef MCOUNT_INSN_SIZE
		106	/* Make sure this only works without direct calls */
		107	# ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS
		108	# error MCOUNT_INSN_SIZE not defined with direct calls enabled
		109	# endif
		110	# define MCOUNT_INSN_SIZE 0
		111	#endif
		112
99	int function_graph_enter(unsigned long ret, unsigned long func,	113	int function_graph_enter(unsigned long ret, unsigned long func,
100	unsigned long frame_pointer, unsigned long *retp)	114	unsigned long frame_pointer, unsigned long *retp)
101	{	115	{

kernel/trace/ftrace.c+3−3

 	}
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-	avg = rec->time;
+	avg = div64_ul(rec->time, rec->counter);
-	do_div(avg, rec->counter);
 	if (tracing_thresh && (avg < tracing_thresh))
 		goto out;
 #endif
 		 * Divide only 1000 for ns^2 -> us^2 conversion.
 		 * trace_print_graph_duration will divide 1000 again.
 		 */
-		do_div(stddev, rec->counter * (rec->counter - 1) * 1000);
+		stddev = div64_ul(stddev,
+				  rec->counter * (rec->counter - 1) * 1000);
 	}
 	trace_seq_init(&s);

kernel/trace/trace_events_inject.c+1−1

@@ -195,7 +195,7 @@ static int parse_entry(char str, struct trace_event_call call, void **pentry) · 194 unmodified lines
195	unsigned long irq_flags;	195	unsigned long irq_flags;
196	void *entry = NULL;	196	void *entry = NULL;
197	int entry_size;	197	int entry_size;
198	u64 val;	198	u64 val = 0;
199	int len;	199	int len;
200		200
201	entry = trace_alloc_entry(call, &entry_size);	201	entry = trace_alloc_entry(call, &entry_size);

kernel/trace/trace_sched_wakeup.c+3−1

 	if (ret) {
 		pr_info("wakeup trace: Couldn't activate tracepoint"
 			" probe to kernel_sched_migrate_task\n");
-		return;
+		goto fail_deprobe_sched_switch;
 	}
 	wakeup_reset(tr);
 		printk(KERN_ERR "failed to start wakeup tracer\n");
 	return;
+fail_deprobe_sched_switch:
+	unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL);
 fail_deprobe_wake_new:
 	unregister_trace_sched_wakeup_new(probe_wakeup, NULL);
 fail_deprobe:

kernel/trace/trace_seq.c+1−1

@@ -381,7 +381,7 @@ int trace_seq_hex_dump(struct trace_seq s, const char prefix_str, · 380 unmodified lines
381	int prefix_type, int rowsize, int groupsize,	381	int prefix_type, int rowsize, int groupsize,
382	const void *buf, size_t len, bool ascii)	382	const void *buf, size_t len, bool ascii)
383	{	383	{
384	unsigned int save_len = s->seq.len;	384	unsigned int save_len = s->seq.len;
385		385
386	if (s->full)	386	if (s->full)
387	return 0;	387	return 0;

kernel/trace/trace_stack.c+5−0

 	local_irq_restore(flags);
 }
+/* Some archs may not define MCOUNT_INSN_SIZE */
+#ifndef MCOUNT_INSN_SIZE
+# define MCOUNT_INSN_SIZE 0
+#endif
 static void
 stack_trace_call(unsigned long ip, unsigned long parent_ip,
 		 struct ftrace_ops *op, struct pt_regs *pt_regs)

mm/mmap.c+0−6

  * MAP_PRIVATE	r: (no) no	r: (yes) yes	r: (no) yes	r: (no) yes
  *		w: (no) no	w: (no) no	w: (copy) copy	w: (no) no
  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
- *
- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and
- * MAP_PRIVATE:
- *								r: (no) no
- *								w: (no) no
- *								x: (yes) yes
  */
 pgprot_t protection_map[16] __ro_after_init = {
 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,

virt/kvm/kvm_main.c+96−17

@@ -1817,26 +1817,72 @@ struct page gfn_to_page(struct kvm kvm, gfn_t gfn) · 1816 unmodified lines
1817	}	1817	}
1818	EXPORT_SYMBOL_GPL(gfn_to_page);	1818	EXPORT_SYMBOL_GPL(gfn_to_page);
1819		1819
1820	static int __kvm_map_gfn(struct kvm_memory_slot *slot, gfn_t gfn,	1820	void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache)
1821	struct kvm_host_map *map)	1821	{
		1822	if (pfn == 0)
		1823	return;
		1824
		1825	if (cache)
		1826	cache->pfn = cache->gfn = 0;
		1827
		1828	if (dirty)
		1829	kvm_release_pfn_dirty(pfn);
		1830	else
		1831	kvm_release_pfn_clean(pfn);
		1832	}
		1833
		1834	static void kvm_cache_gfn_to_pfn(struct kvm_memory_slot *slot, gfn_t gfn,
		1835	struct gfn_to_pfn_cache *cache, u64 gen)
		1836	{
		1837	kvm_release_pfn(cache->pfn, cache->dirty, cache);
		1838
		1839	cache->pfn = gfn_to_pfn_memslot(slot, gfn);
		1840	cache->gfn = gfn;
		1841	cache->dirty = false;
		1842	cache->generation = gen;
		1843	}
		1844
		1845	static int __kvm_map_gfn(struct kvm_memslots *slots, gfn_t gfn,
		1846	struct kvm_host_map *map,
		1847	struct gfn_to_pfn_cache *cache,
		1848	bool atomic)
1822	{	1849	{
1823	kvm_pfn_t pfn;	1850	kvm_pfn_t pfn;
1824	void *hva = NULL;	1851	void *hva = NULL;
1825	struct page *page = KVM_UNMAPPED_PAGE;	1852	struct page *page = KVM_UNMAPPED_PAGE;
		1853	struct kvm_memory_slot *slot = __gfn_to_memslot(slots, gfn);
		1854	u64 gen = slots->generation;
1826		1855
1827	if (!map)	1856	if (!map)
1828	return -EINVAL;	1857	return -EINVAL;
1829		1858
1830	pfn = gfn_to_pfn_memslot(slot, gfn);	1859	if (cache) {
		1860	if (!cache->pfn \|\| cache->gfn != gfn \|\|
		1861	cache->generation != gen) {
		1862	if (atomic)
		1863	return -EAGAIN;
		1864	kvm_cache_gfn_to_pfn(slot, gfn, cache, gen);
		1865	}
		1866	pfn = cache->pfn;
		1867	} else {
		1868	if (atomic)
		1869	return -EAGAIN;
		1870	pfn = gfn_to_pfn_memslot(slot, gfn);
		1871	}
1831	if (is_error_noslot_pfn(pfn))	1872	if (is_error_noslot_pfn(pfn))
1832	return -EINVAL;	1873	return -EINVAL;
1833		1874
1834	if (pfn_valid(pfn)) {	1875	if (pfn_valid(pfn)) {
1835	page = pfn_to_page(pfn);	1876	page = pfn_to_page(pfn);
1836	hva = kmap(page);	1877	if (atomic)
		1878	hva = kmap_atomic(page);
		1879	else
		1880	hva = kmap(page);
1837	#ifdef CONFIG_HAS_IOMEM	1881	#ifdef CONFIG_HAS_IOMEM
1838	} else {	1882	} else if (!atomic) {
1839	hva = memremap(pfn_to_hpa(pfn), PAGE_SIZE, MEMREMAP_WB);	1883	hva = memremap(pfn_to_hpa(pfn), PAGE_SIZE, MEMREMAP_WB);
		1884	} else {
		1885	return -EINVAL;
1840	#endif	1886	#endif
1841	}	1887	}
1842		1888
@@ -1851,14 +1897,25 @@ static int __kvm_map_gfn(struct kvm_memory_slot *slot, gfn_t gfn, · 8 unmodified lines
1851	return 0;	1897	return 0;
1852	}	1898	}
1853		1899
		1900	int kvm_map_gfn(struct kvm_vcpu vcpu, gfn_t gfn, struct kvm_host_map map,
		1901	struct gfn_to_pfn_cache *cache, bool atomic)
		1902	{
		1903	return __kvm_map_gfn(kvm_memslots(vcpu->kvm), gfn, map,
		1904	cache, atomic);
		1905	}
		1906	EXPORT_SYMBOL_GPL(kvm_map_gfn);
		1907
1854	int kvm_vcpu_map(struct kvm_vcpu vcpu, gfn_t gfn, struct kvm_host_map map)	1908	int kvm_vcpu_map(struct kvm_vcpu vcpu, gfn_t gfn, struct kvm_host_map map)
1855	{	1909	{
1856	return __kvm_map_gfn(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn, map);	1910	return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map,
		1911	NULL, false);
1857	}	1912	}
1858	EXPORT_SYMBOL_GPL(kvm_vcpu_map);	1913	EXPORT_SYMBOL_GPL(kvm_vcpu_map);
1859		1914
1860	void kvm_vcpu_unmap(struct kvm_vcpu vcpu, struct kvm_host_map map,	1915	static void __kvm_unmap_gfn(struct kvm_memory_slot *memslot,
1861	bool dirty)	1916	struct kvm_host_map *map,
		1917	struct gfn_to_pfn_cache *cache,
		1918	bool dirty, bool atomic)
1862	{	1919	{
1863	if (!map)	1920	if (!map)
1864	return;	1921	return;
@@ -1866,23 +1923,45 @@ void kvm_vcpu_unmap(struct kvm_vcpu vcpu, struct kvm_host_map map, · 1 unmodified line
1866	if (!map->hva)	1923	if (!map->hva)
1867	return;	1924	return;
1868		1925
1869	if (map->page != KVM_UNMAPPED_PAGE)	1926	if (map->page != KVM_UNMAPPED_PAGE) {
1870	kunmap(map->page);	1927	if (atomic)
		1928	kunmap_atomic(map->hva);
		1929	else
		1930	kunmap(map->page);
		1931	}
1871	#ifdef CONFIG_HAS_IOMEM	1932	#ifdef CONFIG_HAS_IOMEM
1872	else	1933	else if (!atomic)
1873	memunmap(map->hva);	1934	memunmap(map->hva);
		1935	else
		1936	WARN_ONCE(1, "Unexpected unmapping in atomic context");
1874	#endif	1937	#endif
1875		1938
1876	if (dirty) {	1939	if (dirty)
1877	kvm_vcpu_mark_page_dirty(vcpu, map->gfn);	1940	mark_page_dirty_in_slot(memslot, map->gfn);
1878	kvm_release_pfn_dirty(map->pfn);	1941
1879	} else {	1942	if (cache)
1880	kvm_release_pfn_clean(map->pfn);	1943	cache->dirty \|= dirty;
1881	}	1944	else
		1945	kvm_release_pfn(map->pfn, dirty, NULL);
1882		1946
1883	map->hva = NULL;	1947	map->hva = NULL;
1884	map->page = NULL;	1948	map->page = NULL;
1885	}	1949	}
		1950
		1951	int kvm_unmap_gfn(struct kvm_vcpu vcpu, struct kvm_host_map map,
		1952	struct gfn_to_pfn_cache *cache, bool dirty, bool atomic)
		1953	{
		1954	__kvm_unmap_gfn(gfn_to_memslot(vcpu->kvm, map->gfn), map,
		1955	cache, dirty, atomic);
		1956	return 0;
		1957	}
		1958	EXPORT_SYMBOL_GPL(kvm_unmap_gfn);
		1959
		1960	void kvm_vcpu_unmap(struct kvm_vcpu vcpu, struct kvm_host_map map, bool dirty)
		1961	{
		1962	__kvm_unmap_gfn(kvm_vcpu_gfn_to_memslot(vcpu, map->gfn), map, NULL,
		1963	dirty, false);
		1964	}
1886	EXPORT_SYMBOL_GPL(kvm_vcpu_unmap);	1965	EXPORT_SYMBOL_GPL(kvm_vcpu_unmap);
1887		1966
1888	struct page kvm_vcpu_gfn_to_page(struct kvm_vcpu vcpu, gfn_t gfn)	1967	struct page kvm_vcpu_gfn_to_page(struct kvm_vcpu vcpu, gfn_t gfn)

Merge branch 'cve-2019-3016' into kvm-next-5.6

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code