shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 03:15:31 +09:00
Code Issues Packages Projects Releases Wiki Activity
1,050,386 Commits 55 Branches 2,486 Tags
28358ebf2adb31117893813992fefcfd359a6a16
Commit Graph

1050386 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Suren Baghdasaryan
28358ebf2a FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap 
oom-reaper and process_mrelease system call should protect against
races with exit_mmap which can destroy page tables while they
walk the VMA tree. oom-reaper protects from that race by setting
MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
before taking and releasing mmap_write_lock. process_mrelease has
to elevate mm->mm_users to prevent such race. Both oom-reaper and
process_mrelease hold mmap_read_lock when walking the VMA tree.
The locking rules and mechanisms could be simpler if exit_mmap takes
mmap_write_lock while executing destructive operations such as
free_pgtables.
Change exit_mmap to hold the mmap_write_lock when calling
free_pgtables. Operations like unmap_vmas() and unlock_range() are not
destructive and could run under mmap_read_lock but for simplicity we
take one mmap_write_lock during almost the entire operation. Note
also that because oom-reaper checks VM_LOCKED flag, unlock_range()
should not be allowed to race with it.
In most cases this lock should be uncontended. Previously, Kirill
reported ~4% regression caused by a similar change [1]. We reran the
same test and although the individual results are quite noisy, the
percentiles show lower regression with 1.6% being the worst case [2].
The change allows oom-reaper and process_mrelease to execute safely
under mmap_read_lock without worries that exit_mmap might destroy page
tables from under them.

[1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
[2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/

Signed-off-by: Suren Baghdasaryan <surenb@google.com>

Link: https://lore.kernel.org/all/20211124235906.14437-1-surenb@google.com/

Bug: 130172058
Bug: 189803002
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: Ic87272d09a0b68a1b0e968e8f1a1510fd6fc776a
 2022-01-06 17:49:28 +00:00
Lecopzer Chen
9ec6b2ff43 ANDROID: add initial symbol list for mtktv 
1. ABI diff by
BUILD_CONFIG=common/build.config.gki.aarch64 build/build_abi.sh -j64

2. symbol added:
Leaf changes summary: 370 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 353 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 17 Added variables
Function symbols changes summary: 0 Removed, 2 Added function symbols not referenced by debug info
Variable symbols changes summary: 0 Removed, 0 Added variable symbol not referenced by debug info

353 Added functions:

  [A] 'function buffer_head* __bread_gfp(block_device*, sector_t, unsigned int, gfp_t)'
  [A] 'function void __brelse(buffer_head*)'
  [A] 'function int __cpufreq_driver_target(cpufreq_policy*, unsigned int, unsigned int)'
  [A] 'function buffer_head* __getblk_gfp(block_device*, sector_t, unsigned int, gfp_t)'
  [A] 'function int __iio_device_register(iio_dev*, module*)'
  [A] 'function void __insert_inode_hash(inode*, unsigned long int)'
  [A] 'function unsigned int __kfifo_in_r(__kfifo*, void*, unsigned int, size_t)'
  [A] 'function unsigned int __kfifo_out_r(__kfifo*, void*, unsigned int, size_t)'
  [A] 'function void __lock_buffer(buffer_head*)'
  [A] 'function int __media_device_register(media_device*, module*)'
  [A] 'function int __mmc_claim_host(mmc_host*, mmc_ctx*, atomic_t*)'
  [A] 'function void __module_put_and_exit(module*, long int)'
  [A] 'function int __platform_register_drivers(platform_driver* const*, unsigned int, module*)'
  [A] 'function regmap* __regmap_init_i2c(i2c_client*, const regmap_config*, lock_class_key*, const char*)'
  [A] 'function void* __symbol_get(const char*)'
  [A] 'function void __symbol_put(const char*)'
  [A] 'function int __trace_bprintk(unsigned long int, const char*, ...)'
  [A] 'function int __trace_bputs(unsigned long int, const char*)'
  [A] 'function int __trace_puts(unsigned long int, const char*, int)'
  [A] 'function void __wait_on_buffer(buffer_head*)'
  [A] 'function unsigned long int _snd_pcm_stream_lock_irqsave(snd_pcm_substream*)'
  [A] 'function int alloc_contig_range(unsigned long int, unsigned long int, unsigned int, gfp_t)'
  [A] 'function file* anon_inode_getfile(const char*, const file_operations*, void*, int)'
  [A] 'function backlight_device* backlight_device_register(const char*, device*, void*, const backlight_ops*, const backlight_properties*)'
  [A] 'function void backlight_device_unregister(backlight_device*)'
  [A] 'function void baswap(bdaddr_t*, const bdaddr_t*)'
  [A] 'function int bitmap_find_free_region(unsigned long int*, unsigned int, int)'
  [A] 'function void bitmap_release_region(unsigned long int*, unsigned int, int)'
  [A] 'function int block_is_partially_uptodate(page*, unsigned long int, unsigned long int)'
  [A] 'function void bt_procfs_cleanup(net*, const char*)'
  [A] 'function int bt_procfs_init(net*, const char*, bt_sock_list*, int (seq_file*, void*)*)'
  [A] 'function void bt_sock_link(bt_sock_list*, sock*)'
  [A] 'function int bt_sock_register(int, const net_proto_family*)'
  [A] 'function void bt_sock_unlink(bt_sock_list*, sock*)'
  [A] 'function void bt_sock_unregister(int)'
  [A] 'function int buffer_migrate_page(address_space*, page*, page*, migrate_mode)'
  [A] 'function void cec_transmit_done_ts(cec_adapter*, u8, u8, u8, u8, u8, ktime_t)'
  [A] 'function device* class_find_device(class*, device*, void*, int (device*, void*)*)'
  [A] 'function void clear_inode(inode*)'
  [A] 'function void clk_bulk_put_all(int, clk_bulk_data*)'
  [A] 'function int clk_hw_set_parent(clk_hw*, clk_hw*)'
  [A] 'function clk* clk_register_composite(device*, const char*, const char* const*, int, clk_hw*, const clk_ops*, clk_hw*, const clk_ops*, clk_hw*, const clk_ops*, unsigned long int)'
  [A] 'function clk* clk_register_divider_table(device*, const char*, const char*, unsigned long int, void*, u8, u8, u8, const clk_div_table*, spinlock_t*)'
  [A] 'function void cpufreq_dbs_governor_exit(cpufreq_policy*)'
  [A] 'function int cpufreq_dbs_governor_init(cpufreq_policy*)'
  [A] 'function void cpufreq_dbs_governor_limits(cpufreq_policy*)'
  [A] 'function int cpufreq_dbs_governor_start(cpufreq_policy*)'
  [A] 'function void cpufreq_dbs_governor_stop(cpufreq_policy*)'
  [A] 'function int cpufreq_register_governor(cpufreq_governor*)'
  [A] 'function int cpufreq_table_index_unsorted(cpufreq_policy*, unsigned int, unsigned int)'
  [A] 'function void cpufreq_unregister_governor(cpufreq_governor*)'
  [A] 'function void cpufreq_update_policy(unsigned int)'
  [A] 'function u32 crc32_be(u32, const unsigned char*, size_t)'
  [A] 'function void create_empty_buffers(page*, unsigned long int, unsigned long int)'
  [A] 'function int crypto_register_alg(crypto_alg*)'
  [A] 'function void crypto_unregister_alg(crypto_alg*)'
  [A] 'function void crypto_unregister_scomp(scomp_alg*)'
  [A] 'function void d_add(dentry*, inode*)'
  [A] 'function dentry* d_add_ci(dentry*, inode*, qstr*)'
  [A] 'function dentry* d_make_root(inode*)'
  [A] 'function dentry* d_obtain_alias(inode*)'
  [A] 'function dentry* d_splice_alias(inode*, dentry*)'
  [A] 'function unsigned int dbs_update(cpufreq_policy*)'
  [A] 'function void debugfs_create_devm_seqfile(device*, const char*, dentry*, int (seq_file*, void*)*)'
  [A] 'function void debugfs_create_regset32(const char*, umode_t, dentry*, debugfs_regset32*)'
  [A] 'function dentry* debugfs_create_symlink(const char*, dentry*, const char*)'
  [A] 'function opp_table* dev_pm_opp_get_opp_table(device*)'
  [A] 'function int dev_pm_opp_init_cpufreq_table(device*, cpufreq_frequency_table**)'
  [A] 'function int dev_pm_opp_of_add_table_indexed(device*, int)'
  [A] 'function int dev_pm_opp_of_cpumask_add_table(const cpumask*)'
  [A] 'function int dev_pm_opp_of_get_sharing_cpus(device*, cpumask*)'
  [A] 'function void dev_pm_opp_put_opp_table(opp_table*)'
  [A] 'function devfreq* devfreq_get_devfreq_by_phandle(device*, const char*, int)'
  [A] 'function int devfreq_remove_governor(devfreq_governor*)'
  [A] 'function unsigned int device_get_child_node_count(device*)'
  [A] 'function fwnode_handle* device_get_next_child_node(device*, fwnode_handle*)'
  [A] 'function int device_match_of_node(device*, void*)'
  [A] 'function regmap* device_node_to_regmap(device_node*)'
  [A] 'function int devm_devfreq_register_notifier(device*, devfreq*, notifier_block*, unsigned int)'
  [A] 'function void devm_devfreq_remove_device(device*, devfreq*)'
  [A] 'function void devm_devfreq_unregister_notifier(device*, devfreq*, notifier_block*, unsigned int)'
  [A] 'function int devm_extcon_register_notifier(device*, extcon_dev*, unsigned int, notifier_block*)'
  [A] 'function gpio_desc* devm_fwnode_gpiod_get_index(device*, fwnode_handle*, const char*, int, gpiod_flags, const char*)'
  [A] 'function gpio_desc* devm_gpiod_get_index_optional(device*, const char*, unsigned int, gpiod_flags)'
  [A] 'function int devm_hwrng_register(device*, hwrng*)'
  [A] 'function int devm_hwspin_lock_unregister(device*, hwspinlock_device*)'
  [A] 'function int devm_led_classdev_register_ext(device*, led_classdev*, led_init_data*)'
  [A] 'function nvmem_device* devm_nvmem_device_get(device*, const char*)'
  [A] 'function phy* devm_of_phy_get_by_index(device*, device_node*, int)'
  [A] 'function pci_host_bridge* devm_pci_alloc_host_bridge(device*, size_t)'
  [A] 'function pwm_device* devm_pwm_get(device*, const char*)'
  [A] 'function int devm_request_pci_bus_resources(device*, list_head*)'
  [A] 'function dma_fence_array* dma_fence_array_create(int, dma_fence**, u64, unsigned int, bool)'
  [A] 'function int dma_supported(device*, u64)'
  [A] 'function void do_exit(long int)'
  [A] 'function int down_timeout(semaphore*, long int)'
  [A] 'function device_driver* driver_find(const char*, bus_type*)'
  [A] 'function void drm_atomic_helper_async_commit(drm_device*, drm_atomic_state*)'
  [A] 'function void drm_atomic_state_default_clear(drm_atomic_state*)'
  [A] 'function void drm_display_mode_from_videomode(const videomode*, drm_display_mode*)'
  [A] 'function int drm_gem_mmap_obj(drm_gem_object*, unsigned long int, vm_area_struct*)'
  [A] 'function drm_display_mode* drm_mode_create(drm_device*)'
  [A] 'function int drm_mode_crtc_set_gamma_size(drm_crtc*, int)'
  [A] 'function drm_property* drm_property_create_signed_range(drm_device*, u32, const char*, int64_t, int64_t)'
  [A] 'function void drm_self_refresh_helper_update_avg_times(drm_atomic_state*, unsigned int, unsigned int)'
  [A] 'function void end_buffer_read_sync(buffer_head*, int)'
  [A] 'function int eth_header(sk_buff*, net_device*, unsigned short int, void*, void*, unsigned int)'
  [A] 'function int eth_header_parse(const sk_buff*, unsigned char*)'
  [A] 'function int follow_pfn(vm_area_struct*, unsigned long int, unsigned long int*)'
  [A] 'function unsigned long int gen_pool_best_fit(unsigned long int*, unsigned long int, unsigned long int, unsigned int, void*, gen_pool*, unsigned long int)'
  [A] 'function void* gen_pool_dma_alloc(gen_pool*, size_t, dma_addr_t*)'
  [A] 'function gen_pool* gen_pool_get(device*, const char*)'
  [A] 'function void gen_pool_set_algo(gen_pool*, genpool_algo_t, void*)'
  [A] 'function phys_addr_t gen_pool_virt_to_phys(gen_pool*, unsigned long int)'
  [A] 'function int generic_error_remove_page(address_space*, page*)'
  [A] 'function dentry* generic_fh_to_dentry(super_block*, fid*, int, int, inode* (super_block*, typedef u64, typedef u32)*)'
  [A] 'function dentry* generic_fh_to_parent(super_block*, fid*, int, int, inode* (super_block*, typedef u64, typedef u32)*)'
  [A] 'function int generic_file_mmap(file*, vm_area_struct*)'
  [A] 'function int generic_file_open(inode*, file*)'
  [A] 'function ssize_t generic_file_read_iter(kiocb*, iov_iter*)'
  [A] 'function ssize_t generic_file_splice_read(file*, loff_t*, pipe_inode_info*, size_t, unsigned int)'
  [A] 'function ssize_t generic_read_dir(file*, char*, size_t, loff_t*)'
  [A] 'function int get_kernel_pages(const kvec*, int, int, page**)'
  [A] 'function long int get_user_pages_locked(unsigned long int, unsigned long int, unsigned int, page**, int*)'
  [A] 'function long int get_user_pages_remote(mm_struct*, unsigned long int, unsigned long int, unsigned int, page**, vm_area_struct**, int*)'
  [A] 'function void gov_update_cpu_data(dbs_data*)'
  [A] 'function int gpiod_cansleep(const gpio_desc*)'
  [A] 'function int gpiod_is_active_low(const gpio_desc*)'
  [A] 'function int i2c_bit_add_numbered_bus(i2c_adapter*)'
  [A] 'function void i2c_clients_command(i2c_adapter*, unsigned int, void*)'
  [A] 'function void ida_destroy(ida*)'
  [A] 'function inode* iget5_locked(super_block*, unsigned long int, int (inode*, void*)*, int (inode*, void*)*, void*)'
  [A] 'function inode* igrab(inode*)'
  [A] 'function void ihold(inode*)'
  [A] 'function int in_egroup_p(kgid_t)'
  [A] 'function void inode_init_once(inode*)'
  [A] 'function void invalidate_bh_lrus()'
  [A] 'function void io_schedule()'
  [A] 'function void* ioremap_cache(phys_addr_t, size_t)'
  [A] 'function void irq_domain_free_irqs_parent(irq_domain*, unsigned int, unsigned int)'
  [A] 'function irq_data* irq_domain_get_irq_data(irq_domain*, unsigned int)'
  [A] 'function irq_desc* irq_to_desc(unsigned int)'
  [A] 'function bool is_bad_inode(inode*)'
  [A] 'function u64 jiffies64_to_nsecs(u64)'
  [A] 'function int kern_path(const char*, unsigned int, path*)'
  [A] 'function void kernel_sigaction(int, __sighandler_t)'
  [A] 'function void kill_block_super(super_block*)'
  [A] 'function void ktime_get_coarse_real_ts64(timespec64*)'
  [A] 'function bool l2cap_is_socket(socket*)'
  [A] 'function led_default_state led_init_default_state_get(fwnode_handle*)'
  [A] 'function nls_table* load_nls(char*)'
  [A] 'function nls_table* load_nls_default()'
  [A] 'function int lzo1x_1_compress(const unsigned char*, size_t, unsigned char*, size_t*, void*)'
  [A] 'function int lzo1x_decompress_safe(const unsigned char*, size_t, unsigned char*, size_t*)'
  [A] 'function void make_bad_inode(inode*)'
  [A] 'function void mark_buffer_dirty(buffer_head*)'
  [A] 'function media_link* media_create_intf_link(media_entity*, media_interface*, u32)'
  [A] 'function int media_create_pad_link(media_entity*, u16, media_entity*, u16, u32)'
  [A] 'function int media_create_pad_links(const media_device*, const u32, media_entity*, const u16, const u32, media_entity*, const u16, u32, const bool)'
  [A] 'function void media_device_cleanup(media_device*)'
  [A] 'function void media_device_init(media_device*)'
  [A] 'function int media_device_register_entity(media_device*, media_entity*)'
  [A] 'function int media_device_register_entity_notify(media_device*, media_entity_notify*)'
  [A] 'function void media_device_unregister(media_device*)'
  [A] 'function void media_device_unregister_entity(media_entity*)'
  [A] 'function media_intf_devnode* media_devnode_create(media_device*, u32, u32, u32, u32)'
  [A] 'function void media_devnode_remove(media_intf_devnode*)'
  [A] 'function media_link* media_entity_find_link(media_pad*, media_pad*)'
  [A] 'function int media_entity_pads_init(media_entity*, u16, media_pad*)'
  [A] 'function int media_get_pad_index(media_entity*, bool, media_pad_signal_type)'
  [A] 'function void mmc_release_host(mmc_host*)'
  [A] 'function void mmc_wait_for_req(mmc_host*, mmc_request*)'
  [A] 'function dentry* mount_bdev(file_system_type*, int, const char*, void*, int (super_block*, void*, int)*)'
  [A] 'function inode* new_inode(super_block*)'
  [A] 'function clk* of_clk_get_from_provider(of_phandle_args*)'
  [A] 'function thermal_cooling_device* of_cpufreq_cooling_register(cpufreq_policy*)'
  [A] 'function device_node* of_find_node_with_property(device_node*, const char*)'
  [A] 'function int of_get_mac_address(device_node*, u8*)'
  [A] 'function int of_irq_parse_and_map_pci(const pci_dev*, u8, u8)'
  [A] 'function int of_pci_get_devfn(device_node*)'
  [A] 'function int of_pci_parse_bus_range(device_node*, resource*)'
  [A] 'function int of_pci_range_parser_init(of_pci_range_parser*, device_node*)'
  [A] 'function of_pci_range* of_pci_range_parser_one(of_pci_range_parser*, of_pci_range*)'
  [A] 'function int of_pci_range_to_resource(of_pci_range*, device_node*, resource*)'
  [A] 'function page* pagecache_get_page(address_space*, unsigned long int, int, gfp_t)'
  [A] 'function void path_put(const path*)'
  [A] 'function void pci_add_resource(list_head*, resource*)'
  [A] 'function void pci_add_resource_offset(list_head*, resource*, resource_size_t)'
  [A] 'function void pci_bus_add_devices(const pci_bus*)'
  [A] 'function void pci_bus_assign_resources(const pci_bus*)'
  [A] 'function void pci_bus_size_bridges(pci_bus*)'
  [A] 'function u8 pci_common_swizzle(pci_dev*, u8*)'
  [A] 'function void pci_free_resource_list(list_head*)'
  [A] 'function int pci_generic_config_read32(pci_bus*, unsigned int, int, int, u32*)'
  [A] 'function int pci_generic_config_write32(pci_bus*, unsigned int, int, int, u32)'
  [A] 'function irq_domain* pci_msi_create_irq_domain(fwnode_handle*, msi_domain_info*, irq_domain*)'
  [A] 'function void pci_msi_mask_irq(irq_data*)'
  [A] 'function void pci_msi_unmask_irq(irq_data*)'
  [A] 'function int pci_remap_iospace(const resource*, phys_addr_t)'
  [A] 'function void pci_remove_root_bus(pci_bus*)'
  [A] 'function int pci_scan_root_bus_bridge(pci_host_bridge*)'
  [A] 'function void pci_stop_root_bus(pci_bus*)'
  [A] 'function void pci_unmap_iospace(resource*)'
  [A] 'function void pcie_bus_configure_settings(pci_bus*)'
  [A] 'function void pinconf_generic_dump_config(pinctrl_dev*, seq_file*, unsigned long int)'
  [A] 'function int pinctrl_count_index_with_args(const device_node*, const char*)'
  [A] 'function int pinctrl_generic_add_group(pinctrl_dev*, const char*, int*, int, void*)'
  [A] 'function int pinctrl_generic_get_group_count(pinctrl_dev*)'
  [A] 'function const char* pinctrl_generic_get_group_name(pinctrl_dev*, unsigned int)'
  [A] 'function int pinctrl_generic_get_group_pins(pinctrl_dev*, unsigned int, const unsigned int**, unsigned int*)'
  [A] 'function int pinctrl_generic_remove_group(pinctrl_dev*, unsigned int)'
  [A] 'function int pinctrl_parse_index_with_args(const device_node*, const char*, int, of_phandle_args*)'
  [A] 'function int pinctrl_register_and_init(pinctrl_desc*, device*, void*, pinctrl_dev**)'
  [A] 'function void pinctrl_unregister(pinctrl_dev*)'
  [A] 'function int pinmux_generic_add_function(pinctrl_dev*, const char*, const char**, const unsigned int, void*)'
  [A] 'function function_desc* pinmux_generic_get_function(pinctrl_dev*, unsigned int)'
  [A] 'function int pinmux_generic_get_function_count(pinctrl_dev*)'
  [A] 'function int pinmux_generic_get_function_groups(pinctrl_dev*, unsigned int, const char* const**, unsigned int* const)'
  [A] 'function const char* pinmux_generic_get_function_name(pinctrl_dev*, unsigned int)'
  [A] 'function int pinmux_generic_remove_function(pinctrl_dev*, unsigned int)'
  [A] 'function void platform_unregister_drivers(platform_driver* const*, unsigned int)'
  [A] 'function proc_dir_entry* proc_create_single_data(const char*, umode_t, proc_dir_entry*, int (seq_file*, void*)*, void*)'
  [A] 'function int pwm_apply_state(pwm_device*, const pwm_state*)'
  [A] 'function void pwm_free(pwm_device*)'
  [A] 'function pwm_device* pwm_request(int, const char*)'
  [A] 'function int pwmchip_add(pwm_chip*)'
  [A] 'function void pwmchip_remove(pwm_chip*)'
  [A] 'function page* read_cache_page(address_space*, unsigned long int, int (void*, page*)*, void*)'
  [A] 'function int register_filesystem(file_system_type*)'
  [A] 'function int regulator_get_voltage(regulator*)'
  [A] 'function int regulator_set_mode(regulator*, unsigned int)'
  [A] 'function int regulator_set_voltage_time(regulator*, int, int)'
  [A] 'function int remove_proc_subtree(const char*, proc_dir_entry*)'
  [A] 'function device* rpmsg_find_device(device*, rpmsg_channel_info*)'
  [A] 'function int rpmsg_sendto(rpmsg_endpoint*, void*, int, u32)'
  [A] 'function void rproc_add_carveout(rproc*, rproc_mem_entry*)'
  [A] 'function rproc_mem_entry* rproc_mem_entry_init(device*, void*, dma_addr_t, size_t, u32, int (rproc*, rproc_mem_entry*)*, int (rproc*, rproc_mem_entry*)*, const char*, ...)'
  [A] 'function rproc_mem_entry* rproc_of_resm_mem_entry_init(device*, u32, size_t, u32, const char*, ...)'
  [A] 'function irqreturn_t rproc_vq_interrupt(rproc*, int)'
  [A] 'function int rtc_add_group(rtc_device*, const attribute_group*)'
  [A] 'function int sb_min_blocksize(super_block*, int)'
  [A] 'function int sb_set_blocksize(super_block*, int)'
  [A] 'function int schedule_hrtimeout(ktime_t*, const hrtimer_mode)'
  [A] 'function void serial8250_do_pm(uart_port*, unsigned int, unsigned int)'
  [A] 'function void serial8250_do_set_termios(uart_port*, ktermios*, ktermios*)'
  [A] 'function unsigned int serial8250_modem_status(uart_8250_port*)'
  [A] 'function int serial8250_register_8250_port(const uart_8250_port*)'
  [A] 'function void serial8250_resume_port(int)'
  [A] 'function unsigned char serial8250_rx_chars(uart_8250_port*, unsigned char)'
  [A] 'function void serial8250_suspend_port(int)'
  [A] 'function void serial8250_tx_chars(uart_8250_port*)'
  [A] 'function void serial8250_unregister_port(int)'
  [A] 'function void set_nlink(inode*, unsigned int)'
  [A] 'function void set_user_nice(task_struct*, long int)'
  [A] 'function snd_card* snd_card_ref(int)'
  [A] 'function int snd_devm_card_new(device*, int, const char*, module*, size_t, snd_card**)'
  [A] 'function int snd_info_get_line(snd_info_buffer*, char*, int)'
  [A] 'function int snd_interval_refine(snd_interval*, const snd_interval*)'
  [A] 'function int snd_pcm_format_set_silence(snd_pcm_format_t, void*, unsigned int)'
  [A] 'function int snd_pcm_hw_rule_add(snd_pcm_runtime*, unsigned int, int, snd_pcm_hw_rule_func_t, void*, int, ...)'
  [A] 'function int snd_pcm_stop(snd_pcm_substream*, snd_pcm_state_t)'
  [A] 'function int snd_pcm_stop_xrun(snd_pcm_substream*)'
  [A] 'function void snd_pcm_stream_unlock_irqrestore(snd_pcm_substream*, unsigned long int)'
  [A] 'function int snd_soc_bytes_info_ext(snd_kcontrol*, snd_ctl_elem_info*)'
  [A] 'function void snd_timer_close(snd_timer_instance*)'
  [A] 'function void snd_timer_instance_free(snd_timer_instance*)'
  [A] 'function snd_timer_instance* snd_timer_instance_new(const char*)'
  [A] 'function int snd_timer_open(snd_timer_instance*, snd_timer_id*, unsigned int)'
  [A] 'function int snd_timer_start(snd_timer_instance*, unsigned int)'
  [A] 'function int snd_timer_stop(snd_timer_instance*)'
  [A] 'function int sock_no_bind(socket*, sockaddr*, int)'
  [A] 'function int sock_no_connect(socket*, sockaddr*, int, int)'
  [A] 'function int sock_no_getname(socket*, sockaddr*, int)'
  [A] 'function int sock_no_recvmsg(socket*, msghdr*, size_t, int)'
  [A] 'function int sock_no_sendmsg(socket*, msghdr*, size_t)'
  [A] 'function spi_device* spi_new_device(spi_controller*, spi_board_info*)'
  [A] 'function ssize_t store_sampling_rate(gov_attr_set*, const char*, size_t)'
  [A] 'function int submit_bh(int, int, buffer_head*)'
  [A] 'function void suspend_set_ops(const platform_suspend_ops*)'
  [A] 'function void symbol_put_addr(void*)'
  [A] 'function int sync_dirty_buffer(buffer_head*)'
  [A] 'function int sync_filesystem(super_block*)'
  [A] 'function int sysfs_merge_group(kobject*, const attribute_group*)'
  [A] 'function void sysfs_unmerge_group(kobject*, const attribute_group*)'
  [A] 'function int trace_array_destroy(trace_array*)'
  [A] 'function trace_array* trace_array_get_by_name(const char*)'
  [A] 'function int trace_array_init_printk(trace_array*)'
  [A] 'function int trace_array_printk(trace_array*, unsigned long int, const char*, ...)'
  [A] 'function void truncate_inode_pages_final(address_space*)'
  [A] 'function unsigned int uart_get_divisor(uart_port*, unsigned int)'
  [A] 'function void unload_nls(nls_table*)'
  [A] 'function void unlock_buffer(buffer_head*)'
  [A] 'function void unlock_new_inode(inode*)'
  [A] 'function void unpin_user_pages(page**, unsigned long int)'
  [A] 'function int unregister_filesystem(file_system_type*)'
  [A] 'function int usb_ep_set_halt(usb_ep*)'
  [A] 'function int usb_gadget_map_request(usb_gadget*, usb_request*, int)'
  [A] 'function void usb_gadget_unmap_request(usb_gadget*, usb_request*, int)'
  [A] 'function usb_dr_mode usb_get_dr_mode(device*)'
  [A] 'function void v4l2_ctrl_auto_cluster(unsigned int, v4l2_ctrl**, u8, bool)'
  [A] 'function int v4l2_ctrl_handler_setup(v4l2_ctrl_handler*)'
  [A] 'function __poll_t v4l2_ctrl_poll(file*, poll_table_struct*)'
  [A] 'function void v4l2_ctrl_request_complete(media_request*, v4l2_ctrl_handler*)'
  [A] 'function int v4l2_ctrl_request_setup(media_request*, v4l2_ctrl_handler*)'
  [A] 'function int v4l2_ctrl_subdev_log_status(v4l2_subdev*)'
  [A] 'function int v4l2_ctrl_subscribe_event(v4l2_fh*, const v4l2_event_subscription*)'
  [A] 'function int v4l2_device_register_subdev(v4l2_device*, v4l2_subdev*)'
  [A] 'function void v4l2_device_unregister_subdev(v4l2_subdev*)'
  [A] 'function void v4l2_event_queue(video_device*, const v4l2_event*)'
  [A] 'function void v4l2_event_queue_fh(v4l2_fh*, const v4l2_event*)'
  [A] 'function int v4l2_event_subscribe(v4l2_fh*, const v4l2_event_subscription*, unsigned int, const v4l2_subscribed_event_ops*)'
  [A] 'function int v4l2_event_unsubscribe(v4l2_fh*, const v4l2_event_subscription*)'
  [A] 'function int v4l2_fh_is_singular(v4l2_fh*)'
  [A] 'function void v4l2_i2c_subdev_init(v4l2_subdev*, i2c_client*, const v4l2_subdev_ops*)'
  [A] 'function void v4l2_m2m_buf_copy_metadata(const vb2_v4l2_buffer*, vb2_v4l2_buffer*, bool)'
  [A] 'function int v4l2_m2m_dqbuf(file*, v4l2_m2m_ctx*, v4l2_buffer*)'
  [A] 'function int v4l2_m2m_ioctl_create_bufs(file*, void*, v4l2_create_buffers*)'
  [A] 'function int v4l2_m2m_ioctl_expbuf(file*, void*, v4l2_exportbuffer*)'
  [A] 'function int v4l2_m2m_ioctl_prepare_buf(file*, void*, v4l2_buffer*)'
  [A] 'function int v4l2_m2m_ioctl_qbuf(file*, void*, v4l2_buffer*)'
  [A] 'function int v4l2_m2m_querybuf(file*, v4l2_m2m_ctx*, v4l2_buffer*)'
  [A] 'function int v4l2_m2m_register_media_controller(v4l2_m2m_dev*, video_device*, int)'
  [A] 'function int v4l2_m2m_reqbufs(file*, v4l2_m2m_ctx*, v4l2_requestbuffers*)'
  [A] 'function void v4l2_m2m_request_queue(media_request*)'
  [A] 'function int v4l2_m2m_streamoff(file*, v4l2_m2m_ctx*, v4l2_buf_type)'
  [A] 'function int v4l2_m2m_streamon(file*, v4l2_m2m_ctx*, v4l2_buf_type)'
  [A] 'function void v4l2_m2m_try_schedule(v4l2_m2m_ctx*)'
  [A] 'function void v4l2_m2m_unregister_media_controller(v4l2_m2m_dev*)'
  [A] 'function void v4l2_spi_subdev_init(v4l2_subdev*, spi_device*, const v4l2_subdev_ops*)'
  [A] 'function int v4l2_src_change_event_subscribe(v4l2_fh*, const v4l2_event_subscription*)'
  [A] 'function void v4l2_subdev_init(v4l2_subdev*, const v4l2_subdev_ops*)'
  [A] 'function void v4l_bound_align_image(u32*, unsigned int, unsigned int, unsigned int, u32*, unsigned int, unsigned int, unsigned int, unsigned int)'
  [A] 'function int vb2_core_dqbuf(vb2_queue*, unsigned int*, void*, bool)'
  [A] 'function int vb2_core_expbuf(vb2_queue*, int*, unsigned int, unsigned int, unsigned int, unsigned int)'
  [A] 'function __poll_t vb2_core_poll(vb2_queue*, file*, poll_table*)'
  [A] 'function int vb2_core_qbuf(vb2_queue*, unsigned int, void*, media_request*)'
  [A] 'function void vb2_core_querybuf(vb2_queue*, unsigned int, void*)'
  [A] 'function int vb2_core_queue_init(vb2_queue*)'
  [A] 'function void vb2_core_queue_release(vb2_queue*)'
  [A] 'function int vb2_core_reqbufs(vb2_queue*, vb2_memory, unsigned int*)'
  [A] 'function int vb2_core_streamoff(vb2_queue*, unsigned int)'
  [A] 'function int vb2_core_streamon(vb2_queue*, unsigned int)'
  [A] 'function int vb2_request_validate(media_request*)'
  [A] 'function loff_t vfs_llseek(file*, loff_t, int)'
  [A] 'function void videomode_from_timing(const display_timing*, videomode*)'
  [A] 'function int vm_iomap_memory(vm_area_struct*, phys_addr_t, unsigned long int)'
  [A] 'function int xhci_add_endpoint(usb_hcd*, usb_device*, usb_host_endpoint*)'
  [A] 'function int xhci_check_bandwidth(usb_hcd*, usb_device*)'
  [A] 'function int xhci_drop_endpoint(usb_hcd*, usb_device*, usb_host_endpoint*)'
  [A] 'function unsigned int xhci_get_endpoint_index(usb_endpoint_descriptor*)'
  [A] 'function xhci_ep_ctx* xhci_get_ep_ctx(xhci_hcd*, xhci_container_ctx*, unsigned int)'
  [A] 'function void xhci_reset_bandwidth(usb_hcd*, usb_device*)'
  [A] 'function void yield()'

17 Added variables:

  [A] 'const clk_ops clk_divider_ops'
  [A] 'const clk_ops clk_gate_ops'
  [A] 'const clk_ops clk_mux_ops'
  [A] 'int console_printk[4]'
  [A] 'const dma_fence_ops dma_fence_array_ops'
  [A] 'const vm_operations_struct drm_gem_cma_vm_ops'
  [A] 'irq_chip dummy_irq_chip'
  [A] 'const fwnode_operations irqchip_fwnode_ops'
  [A] 'int overflowgid'
  [A] 'int overflowuid'
  [A] 'const kernel_param_ops param_ops_short'
  [A] 'const kernel_param_ops param_ops_ushort'
  [A] 'workqueue_struct* pm_wq'
  [A] 'int snd_ecards_limit'
  [A] 'const dev_pm_ops snd_soc_pm_ops'
  [A] 'const uuid_t uuid_null'
  [A] 'const vb2_mem_ops vb2_dma_contig_memops'

2 Added function symbols not referenced by debug info:

  [A] __arm_smccc_hvc
  [A] memchr

Bug: 211722396
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
Change-Id: Ieb488bd9cdacbc71ac7564a1e7dd925da5c0ba30
 2022-01-06 16:27:38 +00:00
Quentin Perret
12f8b6f54b FROMGIT: KVM: arm64: pkvm: Unshare guest structs during teardown 
Make use of the newly introduced unshare hypercall during guest teardown
to unmap guest-related data structures from the hyp stage-1.

Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-15-qperret@google.com
(cherry picked from commit 52b28657eb
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: Ic8ec2c74d3e803e4d5f0df37d144d2c2eb0e9ad3
 2022-01-06 11:05:20 +00:00
Will Deacon
b45ecf7774 FROMGIT: KVM: arm64: Expose unshare hypercall to the host 
Introduce an unshare hypercall which can be used to unmap memory from
the hypervisor stage-1 in nVHE protected mode. This will be useful to
update the EL2 ownership state of pages during guest teardown, and
avoids keeping dangling mappings to unreferenced portions of memory.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-14-qperret@google.com
(cherry picked from commit b8cc6eb5bd
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I0b2839046914a0fd9a6d0077383d53dc84a8ac3d
 2022-01-06 11:05:20 +00:00
Will Deacon
2d57dde147 FROMGIT: KVM: arm64: Implement do_unshare() helper for unsharing memory 
Tearing down a previously shared memory region results in the borrower
losing access to the underlying pages and returning them to the "owned"
state in the owner.

Implement a do_unshare() helper, along the same lines as do_share(), to
provide this functionality for the host-to-hyp case.

Reviewed-by: Andrew Walbran <qwandor@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-13-qperret@google.com
(cherry picked from commit 376a240f03
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I07aa6194099325c955f48ab608c4b601664419e5
 2022-01-06 11:05:20 +00:00
Will Deacon
ba98bc064b FROMGIT: KVM: arm64: Implement __pkvm_host_share_hyp() using do_share() 
__pkvm_host_share_hyp() shares memory between the host and the
hypervisor so implement it as an invocation of the new do_share()
mechanism.

Note that double-sharing is no longer permitted (as this allows us to
reduce the number of page-table walks significantly), but is thankfully
no longer relied upon by the host.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-12-qperret@google.com
(cherry picked from commit 1ee32109fd
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I9f5877b6ea7b9bf735a90492fbca16f485e73110
 2022-01-06 11:05:20 +00:00
Will Deacon
2477c5eb2b FROMGIT: KVM: arm64: Implement do_share() helper for sharing memory 
By default, protected KVM isolates memory pages so that they are
accessible only to their owner: be it the host kernel, the hypervisor
at EL2 or (in future) the guest. Establishing shared-memory regions
between these components therefore involves a transition for each page
so that the owner can share memory with a borrower under a certain set
of permissions.

Introduce a do_share() helper for safely sharing a memory region between
two components. Currently, only host-to-hyp sharing is implemented, but
the code is easily extended to handle other combinations and the
permission checks for each component are reusable.

Reviewed-by: Andrew Walbran <qwandor@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-11-qperret@google.com
(cherry picked from commit e82edcc75c
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I3ee4486ab08faa24015ac608979e3596b27806a2
 2022-01-06 11:05:19 +00:00
Will Deacon
32cc9591f0 FROMGIT: KVM: arm64: Introduce wrappers for host and hyp spin lock accessors 
In preparation for adding additional locked sections for manipulating
page-tables at EL2, introduce some simple wrappers around the host and
hypervisor locks so that it's a bit easier to read and bit more difficult
to take the wrong lock (or even take them in the wrong order).

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-10-qperret@google.com
(cherry picked from commit 61d99e33e7
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I413e2d7f514db507a1aca9a21f04115e97f72c00
 2022-01-06 11:05:19 +00:00
Will Deacon
d9acb48aed FROMGIT: KVM: arm64: Extend pkvm_page_state enumeration to handle absent pages 
Explicitly name the combination of SW0 | SW1 as reserved in the pte and
introduce a new PKVM_NOPAGE meta-state which, although not directly
stored in the software bits of the pte, can be used to represent an
entry for which there is no underlying page. This is distinct from an
invalid pte, as stage-2 identity mappings for the host are created
lazily and so an invalid pte there is the same as a valid mapping for
the purposes of ownership information.

This state will be used for permission checking during page transitions
in later patches.

Reviewed-by: Andrew Walbran <qwandor@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-9-qperret@google.com
(cherry picked from commit 3d467f7b8c
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I2e803a6ae83694be178a3d3eaf75fe918c881659
 2022-01-06 11:05:19 +00:00
Quentin Perret
61936dc510 FROMGIT: KVM: arm64: pkvm: Refcount the pages shared with EL2 
In order to simplify the page tracking infrastructure at EL2 in nVHE
protected mode, move the responsibility of refcounting pages that are
shared multiple times on the host. In order to do so, let's create a
red-black tree tracking all the PFNs that have been shared, along with
a refcount.

Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-8-qperret@google.com
(cherry picked from commit a83e2191b7
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I58f39d139c84acb545676c99144547cd080cdda3
 2022-01-06 11:05:19 +00:00
Quentin Perret
6234d46744 BACKPORT: FROMGIT: KVM: arm64: Introduce kvm_share_hyp() 
The create_hyp_mappings() function can currently be called at any point
in time. However, its behaviour in protected mode changes widely
depending on when it is being called. Prior to KVM init, it is used to
create the temporary page-table used to bring-up the hypervisor, and
later on it is transparently turned into a 'share' hypercall when the
kernel has lost control over the hypervisor stage-1. In order to prepare
the ground for also unsharing pages with the hypervisor during guest
teardown, introduce a kvm_share_hyp() function to make it clear in which
places a share hypercall should be expected, as we will soon need a
matching unshare hypercall in all those places.

[ qperret: BACKPORT due to resolution in kvm_arch_vcpu_run_map_fp() in
  merge commit 2d761dbf7f ("Merge branch kvm-arm64/fpsimd-tracking
  into kvmarm-master/next") ]

Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-7-qperret@google.com
(cherry picked from commit 3f868e142c
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: Id3ba033a51550e5aada862d6af06773d0be833fb
 2022-01-06 11:05:19 +00:00
Will Deacon
a7be01eb8d FROMGIT: KVM: arm64: Implement kvm_pgtable_hyp_unmap() at EL2 
Implement kvm_pgtable_hyp_unmap() which can be used to remove hypervisor
stage-1 mappings at EL2.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-6-qperret@google.com
(cherry picked from commit 82bb02445d
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I7c8dababccaa31a7b6d90977d583c8c0f8b8d47a
 2022-01-06 11:05:19 +00:00
Will Deacon
5f9b0a6162 FROMGIT: KVM: arm64: Hook up ->page_count() for hypervisor stage-1 page-table 
kvm_pgtable_hyp_unmap() relies on the ->page_count() function callback
being provided by the memory-management operations for the page-table.

Wire up this callback for the hypervisor stage-1 page-table.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-5-qperret@google.com
(cherry picked from commit 34ec7cbf1e
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I481b1f722f4dddda72e35481aca725a937a52090
 2022-01-06 11:05:19 +00:00
Quentin Perret
7fbaf37069 FROMGIT: KVM: arm64: Fixup hyp stage-1 refcount 
In nVHE-protected mode, the hyp stage-1 page-table refcount is broken
due to the lack of refcount support in the early allocator. Fix-up the
refcount in the finalize walker, once the 'hyp_vmemmap' is up and running.

Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-4-qperret@google.com
(cherry picked from commit d6b4bd3f48
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I6c48e4e5a0ae969e1d1ac6be0ce601faf138cfd3
 2022-01-06 11:05:18 +00:00
Quentin Perret
acfd934617 FROMGIT: KVM: arm64: Refcount hyp stage-1 pgtable pages 
To prepare the ground for allowing hyp stage-1 mappings to be removed at
run-time, update the KVM page-table code to maintain a correct refcount
using the ->{get,put}_page() function callbacks.

Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-3-qperret@google.com
(cherry picked from commit 2ea2ff91e8
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: Ic4ce9177a4381a01e1f2c3b00e9f376e14015718
 2022-01-06 11:05:18 +00:00
Quentin Perret
830bf938c4 FROMGIT: KVM: arm64: Provide {get,put}_page() stubs for early hyp allocator 
In nVHE protected mode, the EL2 code uses a temporary allocator during
boot while re-creating its stage-1 page-table. Unfortunately, the
hyp_vmmemap is not ready to use at this stage, so refcounting pages
is not possible. That is not currently a problem because hyp stage-1
mappings are never removed, which implies refcounting of page-table
pages is unnecessary.

In preparation for allowing hypervisor stage-1 mappings to be removed,
provide stub implementations for {get,put}_page() in the early allocator.

Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211215161232.1480836-2-qperret@google.com
(cherry picked from commit 1fac3cfb9c
 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next)
Bug: 209599700
Change-Id: I9602cb4db9cef6f52e8beefa52e53cf71f2e0cd1
 2022-01-06 11:05:18 +00:00
Quentin Perret
6cb9fcb232 Revert "FROMLIST: KVM: arm64: Provide {get,put}_page() stubs for early hyp allocator" 
This reverts commit 2183d4b524.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I1c7256d8992d29d38f122f5ad889ba904eda9793
 2022-01-06 11:05:13 +00:00
Quentin Perret
647d1e9dcc Revert "FROMLIST: KVM: arm64: Refcount hyp stage-1 pgtable pages" 
This reverts commit b91c0e5d96.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I34ad2c837d3d37cfe85b6a6e0fdba1368298fce6
 2022-01-06 11:05:07 +00:00
Quentin Perret
da05d9279e Revert "FROMLIST: KVM: arm64: Fixup hyp stage-1 refcount" 
This reverts commit 59b96bd25e.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Icde87ddf560b90c55195f3c1250e6079b0795389
 2022-01-06 11:05:02 +00:00
Quentin Perret
81ab9e20cf Revert "FROMLIST: KVM: arm64: Hook up ->page_count() for hypervisor stage-1 page-table" 
This reverts commit 75ed01242c.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: If7628be6ada702db6aa1326734fd70349aa1f3e4
 2022-01-06 11:04:57 +00:00
Quentin Perret
8e885d812c Revert "FROMLIST: KVM: arm64: Implement kvm_pgtable_hyp_unmap() at EL2" 
This reverts commit d6d544e4af.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Ie7351e6764d468a5b8a5c0ed663e50d8875914b3
 2022-01-06 11:04:52 +00:00
Quentin Perret
f635fad1fc Revert "FROMLIST: KVM: arm64: Introduce kvm_share_hyp()" 
This reverts commit 7c979b8271.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I710c31254ce80a5b1de5ced791ccaec1b0bebd64
 2022-01-06 11:04:47 +00:00
Quentin Perret
95580d6d6d Revert "FROMLIST: KVM: arm64: pkvm: Refcount the pages shared with EL2" 
This reverts commit e41cc0f83a.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Id418beae1a0d2d418c9e5167ae25105f231bdd68
 2022-01-06 11:04:42 +00:00
Quentin Perret
acb3a1f80a Revert "FROMLIST: KVM: arm64: Extend pkvm_page_state enumeration to handle absent pages" 
This reverts commit 1d5d8f2493.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I51fb6724d3a305800aa9d9226406c5d1b2e94331
 2022-01-06 11:04:38 +00:00
Quentin Perret
0262359012 Revert "FROMLIST: KVM: arm64: Introduce wrappers for host and hyp spin lock accessors" 
This reverts commit 0a1b52003b.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I9776a0847f6ccd15cf6ad5d62f0e81dd38aa0598
 2022-01-06 11:04:33 +00:00
Quentin Perret
58c639d709 Revert "FROMLIST: KVM: arm64: Implement do_share() helper for sharing memory" 
This reverts commit a8e6e3763a.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Ibd16a2427b2de139bd7b2651a563238540949ecc
 2022-01-06 11:04:28 +00:00
Quentin Perret
958cf0694e Revert "FROMLIST: KVM: arm64: Implement __pkvm_host_share_hyp() using do_share()" 
This reverts commit a39c93198b.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Idf31ec997871d56bcb21b464e73b18a5cb50d49a
 2022-01-06 11:04:23 +00:00
Quentin Perret
739e040272 Revert "FROMLIST: KVM: arm64: Implement do_unshare() helper for unsharing memory" 
This reverts commit 92140facee.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I4f6f88e9cee2d150fd5df2d584f8c5cdb4fc03cf
 2022-01-06 11:04:15 +00:00
Quentin Perret
5b78540213 Revert "FROMLIST: KVM: arm64: Expose unshare hypercall to the host" 
This reverts commit 326a987d71.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Iab4f3808718db5f245696fdf5c96056280924c53
 2022-01-06 11:04:10 +00:00
Quentin Perret
0a0bb54767 Revert "FROMLIST: KVM: arm64: pkvm: Unshare guest structs during teardown" 
This reverts commit 206467fd5a.

This will be replaced by a FROMGIT patch shortly.

Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I4523460d30837024d2ddc58aab419e634fb299cd
 2022-01-06 11:04:00 +00:00
Ramji Jiyani
f8bd6cf70d ANDROID: GKI: Add module load time protected symbol lookup 
Add CONFIG_MODULE_SIG_PROTECT to enable lookup for the protected
symbols and exports from the build time generated list of symbols
and exports.

Module loading behavior will change as follows:
- Allows Android GKI Modules signed using MODULE_SIG_ALL during build.
- Allows other modules to load if they don't violate the access to
  Android GKI protected symbols and do not export the symbols already
  exported by the Android GKI modules. Loading will fail and return
  -EACCES (Permission denied) if symbol access contidions are not met.

Bug: 200082547
Test: Treehugger
Signed-off-by: Ramji Jiyani <ramjiyani@google.com>
Change-Id: Iedb99d8434db82a9c7f18ffd363d84f4b2316c5b
(cherry picked from commit 9ab6a24225)
 2022-01-05 18:38:02 +00:00
Ramji Jiyani
31d5735baf ANDROID: GKI: Add script to generate symbol protection headers 
Called By: KERNEL_SRC/kernel/Makefile if CONFIG_MODULE_SIG_PROTECT=y

Generates headers required by gki_modules.c from symbol lists:

gki_module_protected.h: from android/abi_gki_modules_protected
gki_module_exported.h: from android/abi_gki_modules_exports

Bug: 200082547
Test: Treehugger
Signed-off-by: Ramji Jiyani <ramjiyani@google.com>
Change-Id: Ibcc6e6fe0ad6c7850d48f7c0a283c7f9b06e4456
(cherry picked from commit 23cd26aab1)
 2022-01-05 18:38:02 +00:00
Suren Baghdasaryan
0f047989b0 FROMGIT: mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30% 
For embedded systems with low total memory, having to run applications
with relatively large memory requirements, 10% max limitation for
watermark_scale_factor poses an issue of triggering direct reclaim every
time such application is started.  This results in slow application
startup times and bad end-user experience.

By increasing watermark_scale_factor max limit we allow vendors more
flexibility to choose the right level of kswapd aggressiveness for their
device and workload requirements.

Link: https://lkml.kernel.org/r/20211124193604.2758863-1-surenb@google.com
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Lukas Middendorf <kernel@tuxforce.de>
Cc: Antti Palosaari <crope@iki.fi>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Zhang Yi <yi.zhang@huawei.com>
Cc: Fengfei Xi <xi.fengfei@h3c.com>
Cc: Mike Rapoport <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 4e36dc369cc7581ac19a7523303e682a53e52e59
 git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master)

Bug: 194652782
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I3e926c8b222933a10c79068d22a1407ff3181824
 2022-01-05 17:22:33 +00:00
Greg Kroah-Hartman
009596c521 Merge 5.15.13 into android13-5.15 
Changes in 5.15.13
	Input: i8042 - add deferred probe support
	Input: i8042 - enable deferred probe quirk for ASUS UM325UA
	tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
	tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
	net/sched: Extend qdisc control block with tc control block
	parisc: Clear stale IIR value on instruction access rights trap
	platform/mellanox: mlxbf-pmc: Fix an IS_ERR() vs NULL bug in mlxbf_pmc_map_counters
	platform/x86: apple-gmux: use resource_size() with res
	memblock: fix memblock_phys_alloc() section mismatch error
	ALSA: hda: intel-sdw-acpi: harden detection of controller
	ALSA: hda: intel-sdw-acpi: go through HDAS ACPI at max depth of 2
	recordmcount.pl: fix typo in s390 mcount regex
	powerpc/ptdump: Fix DEBUG_WX since generic ptdump conversion
	efi: Move efifb_setup_from_dmi() prototype from arch headers
	selinux: initialize proto variable in selinux_ip_postroute_compat()
	scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
	net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
	net/mlx5: Fix error print in case of IRQ request failed
	net/mlx5: Fix SF health recovery flow
	net/mlx5: Fix tc max supported prio for nic mode
	net/mlx5e: Wrap the tx reporter dump callback to extract the sq
	net/mlx5e: Fix interoperability between XSK and ICOSQ recovery flow
	net/mlx5e: Fix ICOSQ recovery flow for XSK
	net/mlx5e: Use tc sample stubs instead of ifdefs in source file
	net/mlx5e: Delete forward rule for ct or sample action
	udp: using datalen to cap ipv6 udp max gso segments
	selftests: Calculate udpgso segment count without header adjustment
	sctp: use call_rcu to free endpoint
	net/smc: fix using of uninitialized completions
	net: usb: pegasus: Do not drop long Ethernet frames
	net: ag71xx: Fix a potential double free in error handling paths
	net: lantiq_xrx200: fix statistics of received bytes
	NFC: st21nfca: Fix memory leak in device probe and remove
	net/smc: don't send CDC/LLC message if link not ready
	net/smc: fix kernel panic caused by race of smc_sock
	igc: Do not enable crosstimestamping for i225-V models
	igc: Fix TX timestamp support for non-MSI-X platforms
	drm/amd/display: Send s0i2_rdy in stream_count == 0 optimization
	drm/amd/display: Set optimize_pwr_state for DCN31
	ionic: Initialize the 'lif->dbid_inuse' bitmap
	net/mlx5e: Fix wrong features assignment in case of error
	net: bridge: mcast: add and enforce query interval minimum
	net: bridge: mcast: add and enforce startup query interval minimum
	selftests/net: udpgso_bench_tx: fix dst ip argument
	selftests: net: Fix a typo in udpgro_fwd.sh
	net: bridge: mcast: fix br_multicast_ctx_vlan_global_disabled helper
	net/ncsi: check for error return from call to nla_put_u32
	selftests: net: using ping6 for IPv6 in udpgro_fwd.sh
	fsl/fman: Fix missing put_device() call in fman_port_probe
	i2c: validate user data in compat ioctl
	nfc: uapi: use kernel size_t to fix user-space builds
	uapi: fix linux/nfc.h userspace compilation errors
	drm/nouveau: wait for the exclusive fence after the shared ones v2
	drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled
	drm/amdgpu: add support for IP discovery gc_info table v2
	drm/amd/display: Changed pipe split policy to allow for multi-display pipe split
	xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
	usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
	usb: mtu3: add memory barrier before set GPD's HWO
	usb: mtu3: fix list_head check warning
	usb: mtu3: set interval of FS intr and isoc endpoint
	nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert
	binder: fix async_free_space accounting for empty parcels
	scsi: vmw_pvscsi: Set residual data length conditionally
	Input: appletouch - initialize work before device registration
	Input: spaceball - fix parsing of movement data packets
	mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()'
	net: fix use-after-free in tw_timer_handler
	fs/mount_setattr: always cleanup mount_kattr
	perf intel-pt: Fix parsing of VM time correlation arguments
	perf script: Fix CPU filtering of a script's switch events
	perf scripts python: intel-pt-events.py: Fix printing of switch events
	Linux 5.15.13

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie0d5130643ce211d5e21ea9d11bc5577efeddc90
 2022-01-05 15:36:44 +01:00
Nick Desaulniers
70f80ec2b0 ANDROID: remove stale variables from build.config files 
LLVM_IAS=1 is implied by LLVM=1 as of LLVM_IAS as of v5.15-rc1 via
commit f12b034afe ("scripts/Makefile.clang: default to LLVM_IAS=1").

CROSS_COMPILE is no longer necessary when building with LLVM=1 as of
v5.15-rc1 via:
commit 231ad7f409 ("Makefile: infer --target from ARCH for CC=clang")

There is no need for CROSS_COMPILE_COMPAT as of v5.16-rc1 via
commit 3e6f8d1fa1 ("arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd")
when LLVM=1 is set. This was backported to v5.15.12.

LINUX_GCC_CROSS_COMPILE_PREBUILTS_BIN was a temporary dependency until
LLVM_IAS=1 was enabled for all architectures. With LLVM_IAS=1 (implied
by LLVM=1), nothing in this directory is used and the variable can be
removed.

It doesn't hurt to respecify any of the above, but they are no longer
necessary.

Bug: 209655537
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Change-Id: I361b05ea9f36da933e6712150650f476b093d0a7
 2022-01-05 14:33:38 +00:00
Greg Kroah-Hartman
734eb1fd20 Linux 5.15.13 
Link: https://lore.kernel.org/r/20220103142056.911344037@linuxfoundation.org
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Rudi Heitbaum <rudi@heitbaum.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20220104073845.629257314@linuxfoundation.org
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Zan Aziz <zanaziz313@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:40 +01:00
Adrian Hunter
bc5fce3dff perf scripts python: intel-pt-events.py: Fix printing of switch events 
commit 0f80bfbf49 upstream.

The intel-pt-events.py script displays only the last of consecutive switch
statements but that may not be the last switch event for the CPU. Fix by
keeping a dictionary of last context switch keyed by CPU, and make it
possible to see all switch events by adding option --all-switch-events.

Fixes: a92bf335fd ("perf scripts python: intel-pt-events.py: Add branches to script")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Riccardo Mancini <rickyman7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211215080636.149562-4-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:40 +01:00
Adrian Hunter
632ee8a178 perf script: Fix CPU filtering of a script's switch events 
commit 5e0c325cdb upstream.

CPU filtering was not being applied to a script's switch events.

Fixes: 5bf83c29a0 ("perf script: Add scripting operation process_switch()")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Riccardo Mancini <rickyman7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211215080636.149562-3-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Adrian Hunter
90d273381b perf intel-pt: Fix parsing of VM time correlation arguments 
commit a78abde220 upstream.

Parser did not take ':' into account.

Example:

 Before:

  $ perf record -e intel_pt//u uname
  Linux
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.026 MB perf.data ]
  $ perf inject -i perf.data --vm-time-correlation="dry-run 123"
  $ perf inject -i perf.data --vm-time-correlation="dry-run 123:456"
  Failed to parse VM Time Correlation options
  0x620 [0x98]: failed to process type: 70 [Invalid argument]
  $

 After:

  $ perf inject -i perf.data --vm-time-correlation="dry-run 123:456"
  $

Fixes: e3ff42bdeb ("perf intel-pt: Parse VM Time Correlation options and set up decoding")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Riccardo Mancini <rickyman7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211215080636.149562-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Christian Brauner
47b5d0a753 fs/mount_setattr: always cleanup mount_kattr 
commit 012e332286 upstream.

Make sure that finish_mount_kattr() is called after mount_kattr was
succesfully built in both the success and failure case to prevent
leaking any references we took when we built it.  We returned early if
path lookup failed thereby risking to leak an additional reference we
took when building mount_kattr when an idmapped mount was requested.

Cc: linux-fsdevel@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: 9caccd4154 ("fs: introduce MOUNT_ATTR_IDMAP")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Muchun Song
08eacbd141 net: fix use-after-free in tw_timer_handler 
commit e22e45fc9e upstream.

A real world panic issue was found as follow in Linux 5.4.

    BUG: unable to handle page fault for address: ffffde49a863de28
    PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
    RIP: 0010:tw_timer_handler+0x20/0x40
    Call Trace:
     <IRQ>
     call_timer_fn+0x2b/0x120
     run_timer_softirq+0x1ef/0x450
     __do_softirq+0x10d/0x2b8
     irq_exit+0xc7/0xd0
     smp_apic_timer_interrupt+0x68/0x120
     apic_timer_interrupt+0xf/0x20

This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.

The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_sk_ops is registered befrore
ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops
in the list of pernet_list. There will be a use-after-free on
net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net
if there are some inflight time-wait timers.

This bug is not introduced by commit f2bf415cfe ("mib: add net to
NET_ADD_STATS_BH") since the net_statistics is a global variable
instead of dynamic allocation and freeing. Actually, commit
61a7e26028 ("mib: put net statistics on struct net") introduces
the bug since it put net statistics on struct net and free it when
net namespace is destroyed.

Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug
and replace pr_crit() with panic() since continuing is meaningless
when init_ipv4_mibs() fails.

[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1

Fixes: 61a7e26028 ("mib: put net statistics on struct net")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Cc: Cong Wang <cong.wang@bytedance.com>
Cc: Fam Zheng <fam.zheng@bytedance.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211228104145.9426-1-songmuchun@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
SeongJae Park
ffe4a1ba1a mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' 
commit ebb3f994dd upstream.

DAMON debugfs interface increases the reference counts of 'struct pid's
for targets from the 'target_ids' file write callback
('dbgfs_target_ids_write()'), but decreases the counts only in DAMON
monitoring termination callback ('dbgfs_before_terminate()').

Therefore, when 'target_ids' file is repeatedly written without DAMON
monitoring start/termination, the reference count is not decreased and
therefore memory for the 'struct pid' cannot be freed.  This commit
fixes this issue by decreasing the reference counts when 'target_ids' is
written.

Link: https://lkml.kernel.org/r/20211229124029.23348-1-sj@kernel.org
Fixes: 4bc05954d0 ("mm/damon: implement a debugfs-based user space interface")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org>	[5.15+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Leo L. Schwab
466267ced8 Input: spaceball - fix parsing of movement data packets 
commit bc7ec91718 upstream.

The spaceball.c module was not properly parsing the movement reports
coming from the device.  The code read axis data as signed 16-bit
little-endian values starting at offset 2.

In fact, axis data in Spaceball movement reports are signed 16-bit
big-endian values starting at offset 3.  This was determined first by
visually inspecting the data packets, and later verified by consulting:
http://spacemice.org/pdf/SpaceBall_2003-3003_Protocol.pdf

If this ever worked properly, it was in the time before Git...

Signed-off-by: Leo L. Schwab <ewhac@ewhac.org>
Link: https://lore.kernel.org/r/20211221101630.1146385-1-ewhac@ewhac.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Pavel Skripkin
e79ff8c68a Input: appletouch - initialize work before device registration 
commit 9f3ccdc3f6 upstream.

Syzbot has reported warning in __flush_work(). This warning is caused by
work->func == NULL, which means missing work initialization.

This may happen, since input_dev->close() calls
cancel_work_sync(&dev->work), but dev->work initalization happens _after_
input_register_device() call.

So this patch moves dev->work initialization before registering input
device

Fixes: 5a6eb676d3 ("Input: appletouch - improve powersaving for Geyser3 devices")
Reported-and-tested-by: syzbot+b88c5eae27386b252bbd@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20211230141151.17300-1-paskripkin@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Alexey Makhalov
90ffed2d5e scsi: vmw_pvscsi: Set residual data length conditionally 
commit 142c779d05 upstream.

The PVSCSI implementation in the VMware hypervisor under specific
configuration ("SCSI Bus Sharing" set to "Physical") returns zero dataLen
in the completion descriptor for READ CAPACITY(16). As a result, the kernel
can not detect proper disk geometry. This can be recognized by the kernel
message:

  [ 0.776588] sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512.

The PVSCSI implementation in QEMU does not set dataLen at all, keeping it
zeroed. This leads to a boot hang as was reported by Shmulik Ladkani.

It is likely that the controller returns the garbage at the end of the
buffer. Residual length should be set by the driver in that case. The SCSI
layer will erase corresponding data. See commit bdb2b8cab4 ("[SCSI] erase
invalid data returned by device") for details.

Commit e662502b3a ("scsi: vmw_pvscsi: Set correct residual data length")
introduced the issue by setting residual length unconditionally, causing
the SCSI layer to erase the useful payload beyond dataLen when this value
is returned as 0.

As a result, considering existing issues in implementations of PVSCSI
controllers, we do not want to call scsi_set_resid() when dataLen ==
0. Calling scsi_set_resid() has no effect if dataLen equals buffer length.

Link: https://lore.kernel.org/lkml/20210824120028.30d9c071@blondie/
Link: https://lore.kernel.org/r/20211220190514.55935-1-amakhalov@vmware.com
Fixes: e662502b3a ("scsi: vmw_pvscsi: Set correct residual data length")
Cc: Matt Wang <wwentao@vmware.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Vishal Bhakta <vbhakta@vmware.com>
Cc: VMware PV-Drivers <pv-drivers@vmware.com>
Cc: James E.J. Bottomley <jejb@linux.ibm.com>
Cc: linux-scsi@vger.kernel.org
Cc: stable@vger.kernel.org
Reported-and-suggested-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Todd Kjos
17691bada6 binder: fix async_free_space accounting for empty parcels 
commit cfd0d84ba2 upstream.

In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space")
fixed a kernel structure visibility issue. As part of that patch,
sizeof(void *) was used as the buffer size for 0-length data payloads so
the driver could detect abusive clients sending 0-length asynchronous
transactions to a server by enforcing limits on async_free_size.

Unfortunately, on the "free" side, the accounting of async_free_space
did not add the sizeof(void *) back. The result was that up to 8-bytes of
async_free_space were leaked on every async transaction of 8-bytes or
less.  These small transactions are uncommon, so this accounting issue
has gone undetected for several years.

The fix is to use "buffer_size" (the allocated buffer size) instead of
"size" (the logical buffer size) when updating the async_free_space
during the free operation. These are the same except for this
corner case of asynchronous transactions with payloads < 8 bytes.

Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org # 4.14+
Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Andra Paraschiv
90d2beed5e nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert 
commit 3a0152b219 upstream.

After commit 5b78ed24e8 ("mm/pagemap: add mmap_assert_locked()
annotations to find_vma*()"), the call to get_user_pages() will trigger
the mmap assert.

static inline void mmap_assert_locked(struct mm_struct *mm)
{
	lockdep_assert_held(&mm->mmap_lock);
	VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm);
}

[   62.521410] kernel BUG at include/linux/mmap_lock.h:156!
...........................................................
[   62.538938] RIP: 0010:find_vma+0x32/0x80
...........................................................
[   62.605889] Call Trace:
[   62.608502]  <TASK>
[   62.610956]  ? lock_timer_base+0x61/0x80
[   62.614106]  find_extend_vma+0x19/0x80
[   62.617195]  __get_user_pages+0x9b/0x6a0
[   62.620356]  __gup_longterm_locked+0x42d/0x450
[   62.623721]  ? finish_wait+0x41/0x80
[   62.626748]  ? __kmalloc+0x178/0x2f0
[   62.629768]  ne_set_user_memory_region_ioctl.isra.0+0x225/0x6a0 [nitro_enclaves]
[   62.635776]  ne_enclave_ioctl+0x1cf/0x6d7 [nitro_enclaves]
[   62.639541]  __x64_sys_ioctl+0x82/0xb0
[   62.642620]  do_syscall_64+0x3b/0x90
[   62.645642]  entry_SYSCALL_64_after_hwframe+0x44/0xae

Use get_user_pages_unlocked() when setting the enclave memory regions.
That's a similar pattern as mmap_read_lock() used together with
get_user_pages().

Fixes: 5b78ed24e8 ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()")
Cc: stable@vger.kernel.org
Signed-off-by: Andra Paraschiv <andraprs@amazon.com>
Link: https://lore.kernel.org/r/20211220195856.6549-1-andraprs@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:39 +01:00
Chunfeng Yun
0c823e0b46 usb: mtu3: set interval of FS intr and isoc endpoint 
commit 43f3b8cbcf upstream.

Add support to set interval also for FS intr and isoc endpoint.

Fixes: 4d79e042ed ("usb: mtu3: add support for usb3.1 IP")
Cc: stable@vger.kernel.org
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/20211218095749.6250-4-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:38 +01:00
Chunfeng Yun
249ddfbe00 usb: mtu3: fix list_head check warning 
commit 8c313e3bfd upstream.

This is caused by uninitialization of list_head.

BUG: KASAN: use-after-free in __list_del_entry_valid+0x34/0xe4

Call trace:
dump_backtrace+0x0/0x298
show_stack+0x24/0x34
dump_stack+0x130/0x1a8
print_address_description+0x88/0x56c
__kasan_report+0x1b8/0x2a0
kasan_report+0x14/0x20
__asan_load8+0x9c/0xa0
__list_del_entry_valid+0x34/0xe4
mtu3_req_complete+0x4c/0x300 [mtu3]
mtu3_gadget_stop+0x168/0x448 [mtu3]
usb_gadget_unregister_driver+0x204/0x3a0
unregister_gadget_item+0x44/0xa4

Fixes: 83374e035b ("usb: mtu3: add tracepoints to help debug")
Cc: stable@vger.kernel.org
Reported-by: Yuwen Ng <yuwen.ng@mediatek.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/20211218095749.6250-3-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:38 +01:00
Chunfeng Yun
dace4123e3 usb: mtu3: add memory barrier before set GPD's HWO 
commit a7aae769ca upstream.

There is a seldom issue that the controller access invalid address
and trigger devapc or emimpu violation. That is due to memory access
is out of order and cause gpd data is not correct.
Add mb() to prohibit compiler or cpu from reordering to make sure GPD
is fully written before setting its HWO.

Fixes: 48e0d3735a ("usb: mtu3: supports new QMU format")
Cc: stable@vger.kernel.org
Reported-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/20211218095749.6250-2-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2022-01-05 12:42:38 +01:00