* refs/heads/tmp-26c8156: Linux 4.4.49 drm/i915: fix use-after-free in page_flip_completed() ALSA: seq: Don't handle loop timeout at snd_seq_pool_done() ALSA: seq: Fix race at creating a queue xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend() scsi: mpt3sas: disable ASPM for MPI2 controllers scsi: aacraid: Fix INTx/MSI-x issue with older controllers scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send netvsc: Set maximum GSO size in the right place mac80211: Fix adding of mesh vendor IEs ARM: 8642/1: LPAE: catch pending imprecise abort on unmask target: Fix COMPARE_AND_WRITE ref leak for non GOOD status target: Fix early transport_generic_handle_tmr abort scenario target: Use correct SCSI status during EXTENDED_COPY exception target: Don't BUG_ON during NodeACL dynamic -> explicit conversion ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write hns: avoid stack overflow with CONFIG_KASAN cpumask: use nr_cpumask_bits for parsing functions Revert "x86/ioapic: Restore IO-APIC irq_chip retrigger callback" selinux: fix off-by-one in setprocattr ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup Linux 4.4.48 base/memory, hotplug: fix a kernel oops in show_valid_zones() x86/irq: Make irq activate operations symmetric USB: serial: option: add device ID for HP lt2523 (Novatel E371) usb: gadget: f_fs: Assorted buffer overflow checks. USB: Add quirk for WORLDE easykey.25 MIDI keyboard USB: serial: pl2303: add ATEN device ID USB: serial: qcserial: add Dell DW5570 QDL KVM: x86: do not save guest-unsupported XSAVE state HID: wacom: Fix poor prox handling in 'wacom_pl_irq' percpu-refcount: fix reference leak during percpu-atomic transition mmc: sdhci: Ignore unexpected CARD_INT interrupts can: bcm: fix hrtimer/tasklet termination in bcm op removal mm, fs: check for fatal signals in do_generic_file_read() mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() cifs: initialize file_info_lock zswap: disable changing params if init fails svcrpc: fix oops in absence of krb5 module NFSD: Fix a null reference case in find_or_create_lock_stateid() powerpc: Add missing error check to prom_find_boot_cpu() powerpc/eeh: Fix wrong flag passed to eeh_unfreeze_pe() libata: apply MAX_SEC_1024 to all CX1-JB*-HP devices ata: sata_mv:- Handle return value of devm_ioremap. perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory crypto: arm64/aes-blk - honour iv_out requirement in CBC and CTR modes crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215 ext4: validate s_first_meta_bg at mount time PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies ANDROID: security: export security_path_chown() Linux 4.4.47 net: dsa: Bring back device detaching in dsa_slave_suspend() qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card af_unix: move unix_mknod() out of bindlock r8152: don't execute runtime suspend if the tx is not empty bridge: netlink: call br_changelink() during br_dev_newlink() tcp: initialize max window for a new fastopen socket ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock net: phy: bcm63xx: Utilize correct config_intr function net: fix harmonize_features() vs NETIF_F_HIGHDMA ax25: Fix segfault after sock connection timeout ravb: do not use zero-length alignment DMA descriptor openvswitch: maintain correct checksum state in conntrack actions tcp: fix tcp_fastopen unaligned access complaints on sparc net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim net: ipv4: fix table id in getroute response net: lwtunnel: Handle lwtunnel_fill_encap failure mlxsw: pci: Fix EQE structure definition mlxsw: switchx2: Fix memory leak at skb reallocation mlxsw: spectrum: Fix memory leak at skb reallocation r8152: fix the sw rx checksum is unavailable ANDROID: sdcardfs: Switch strcasecmp for internal call ANDROID: sdcardfs: switch to full_name_hash and qstr ANDROID: sdcardfs: Add GID Derivation to sdcardfs ANDROID: sdcardfs: Remove redundant operation ANDROID: sdcardfs: add support for user permission isolation ANDROID: sdcardfs: Refactor configfs interface ANDROID: sdcardfs: Allow non-owners to touch ANDROID: binder: fix format specifier for type binder_size_t ANDROID: fs: Export vfs_rmdir2 ANDROID: fs: Export free_fs_struct and set_fs_pwd ANDROID: mnt: remount should propagate to slaves of slaves ANDROID: sdcardfs: Switch ->d_inode to d_inode() ANDROID: sdcardfs: Fix locking issue with permision fix up ANDROID: sdcardfs: Change magic value ANDROID: sdcardfs: Use per mount permissions ANDROID: sdcardfs: Add gid and mask to private mount data ANDROID: sdcardfs: User new permission2 functions ANDROID: vfs: Add setattr2 for filesystems with per mount permissions ANDROID: vfs: Add permission2 for filesystems with per mount permissions ANDROID: vfs: Allow filesystems to access their private mount data ANDROID: mnt: Add filesystem private data to mount points ANDROID: sdcardfs: Move directory unlock before touch ANDROID: sdcardfs: fix external storage exporting incorrect uid ANDROID: sdcardfs: Added top to sdcardfs_inode_info ANDROID: sdcardfs: Switch package list to RCU ANDROID: sdcardfs: Fix locking for permission fix up ANDROID: sdcardfs: Check for other cases on path lookup ANDROID: sdcardfs: override umask on mkdir and create Linux 4.4.46 mm, memcg: do not retry precharge charges platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT pinctrl: broxton: Use correct PADCFGLOCK offset s5k4ecgx: select CRC32 helper IB/umem: Release pid in error and ODP flow IB/ipoib: move back IB LL address into the hard header drm/i915: Don't leak edid in intel_crt_detect_ddc() SUNRPC: cleanup ida information when removing sunrpc module NFSv4.0: always send mode in SETATTR after EXCLUSIVE4 nfs: Don't increment lock sequence ID after NFS4ERR_MOVED parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header ARC: [arcompact] handle unaligned access delay slot corner case ARC: udelay: fix inline assembler by adding LP_COUNT to clobber list can: ti_hecc: add missing prepare and unprepare of the clock can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer s390/ptrace: Preserve previous registers for short regset write RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled ISDN: eicon: silence misleading array-bounds warning sysctl: fix proc_doulongvec_ms_jiffies_minmax() mm/mempolicy.c: do not put mempolicy before using its nodemask drm: Fix broken VT switch with video=1366x768 option tile/ptrace: Preserve previous registers for short regset write fbdev: color map copying bounds checking Linux 4.4.45 arm64: avoid returning from bad_mode selftest/powerpc: Wrong PMC initialized in pmc56_overflow test dmaengine: pl330: Fix runtime PM support for terminated transfers ite-cir: initialize use_demodulator before using it blackfin: check devm_pinctrl_get() for errors ARM: 8613/1: Fix the uaccess crash on PB11MPCore ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation ARM: dts: imx6qdl-nitrogen6_max: fix sgtl5000 pinctrl init arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields arm64/ptrace: Avoid uninitialised struct padding in fpr_set() arm64/ptrace: Preserve previous registers for short regset write - 3 arm64/ptrace: Preserve previous registers for short regset write - 2 arm64/ptrace: Preserve previous registers for short regset write ARM: dts: da850-evm: fix read access to SPI flash ceph: fix bad endianness handling in parse_reply_info_extra ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs svcrdma: avoid duplicate dma unmapping during error recovery clocksource/exynos_mct: Clear interrupt when cpu is shut down ubifs: Fix journal replay wrt. xattr nodes qla2xxx: Fix crash due to null pointer access x86/ioapic: Restore IO-APIC irq_chip retrigger callback mtd: nand: xway: disable module support ieee802154: atusb: do not use the stack for buffers to make them DMA able mmc: mxs-mmc: Fix additional cycles after transmission stop HID: corsair: fix control-transfer error handling HID: corsair: fix DMA buffers on stack PCI: Enumerate switches below PCI-to-PCIe bridges fuse: clear FR_PENDING flag when moving requests out of pending queue svcrpc: don't leak contexts on PROC_DESTROY x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F tmpfs: clear S_ISGID when setting posix ACLs ARM: dts: imx31: fix AVIC base address ARM: dts: imx31: move CCM device node to AIPS2 bus devices ARM: dts: imx31: fix clock control module interrupts description perf scripting: Avoid leaking the scripting_context variable IB/IPoIB: Remove can't use GFP_NOIO warning IB/mlx4: When no DMFS for IPoIB, don't allow NET_IF QPs IB/mlx4: Fix port query for 56Gb Ethernet links IB/mlx4: Fix out-of-range array index in destroy qp flow IB/mlx4: Set traffic class in AH IB/mlx5: Wait for all async command completions to complete ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it Linux 4.4.44 pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE powerpc/ibmebus: Fix device reference leaks in sysfs interface powerpc/ibmebus: Fix further device reference leaks bus: vexpress-config: fix device reference leak blk-mq: Always schedule hctx->next_cpu ACPI / APEI: Fix NMI notification handling block: cfq_cpd_alloc() should use @gfp cpufreq: powernv: Disable preemption while checking CPU throttling state NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success. NFS: Fix a performance regression in readdir pNFS: Fix race in pnfs_wait_on_layoutreturn pinctrl: meson: fix gpio request disabling other modes btrfs: fix error handling when run_delayed_extent_op fails btrfs: fix locking when we put back a delayed ref that's too new x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option USB: serial: ch341: fix modem-control and B0 handling USB: serial: ch341: fix resume after reset drm/radeon: drop verde dpm quirks sysctl: Drop reference added by grab_header in proc_sys_readdir sysrq: attach sysrq handler correctly for 32-bit kernel tty/serial: atmel_serial: BUG: stop DMA from transmitting in stop_tx mnt: Protect the mountpoint hashtable with mount_lock vme: Fix wrong pointer utilization in ca91cx42_slave_get xhci: fix deadlock at host remove by running watchdog correctly i2c: fix kernel memory disclosure in dev interface i2c: print correct device invalid address Input: elants_i2c - avoid divide by 0 errors on bad touchscreen data USB: serial: ch341: fix open and resume after B0 USB: serial: ch341: fix control-message error handling USB: serial: ch341: fix open error handling USB: serial: ch341: fix initial modem-control state USB: serial: kl5kusb105: fix line-state error handling nl80211: fix sched scan netlink socket owner destruction KVM: x86: Introduce segmented_write_std KVM: x86: emulate FXSAVE and FXRSTOR KVM: x86: add asm_safe wrapper KVM: x86: add Align16 instruction flag KVM: x86: flush pending lapic jump label updates on module unload jump_labels: API for flushing deferred jump label updates KVM: eventfd: fix NULL deref irqbypass consumer KVM: x86: fix emulation of "MOV SS, null selector" mm/hugetlb.c: fix reservation race when freeing surplus pages ocfs2: fix crash caused by stale lvb with fsdlm plugin mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done} selftests: do not require bash for the generated test selftests: do not require bash to run netsocktests testcase Input: i8042 - add Pegatron touchpad to noloop table Input: xpad - use correct product id for x360w controllers DEBUG: sched/fair: Fix sched_load_avg_cpu events for task_groups DEBUG: sched/fair: Fix missing sched_load_avg_cpu events net: socket: don't set sk_uid to garbage value in ->setattr() ANDROID: configs: CONFIG_ARM64_SW_TTBR0_PAN=y UPSTREAM: arm64: Disable PAN on uaccess_enable() UPSTREAM: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN UPSTREAM: arm64: xen: Enable user access before a privcmd hvc call UPSTREAM: arm64: Handle faults caused by inadvertent user access with PAN enabled BACKPORT: arm64: Disable TTBR0_EL1 during normal kernel execution BACKPORT: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1 BACKPORT: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro BACKPORT: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros UPSTREAM: arm64: alternative: add auto-nop infrastructure UPSTREAM: arm64: barriers: introduce nops and __nops macros for NOP sequences Revert "FROMLIST: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros" Revert "FROMLIST: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro" Revert "FROMLIST: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1" Revert "FROMLIST: arm64: Disable TTBR0_EL1 during normal kernel execution" Revert "FROMLIST: arm64: Handle faults caused by inadvertent user access with PAN enabled" Revert "FROMLIST: arm64: xen: Enable user access before a privcmd hvc call" Revert "FROMLIST: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN" ANDROID: sched/walt: fix build failure if FAIR_GROUP_SCHED=n Linux 4.4.43 mm/init: fix zone boundary creation ALSA: usb-audio: Add a quirk for Plantronics BT600 spi: mvebu: fix baudrate calculation for armada variant ARM: OMAP4+: Fix bad fallthrough for cpuidle ARM: zynq: Reserve correct amount of non-DMA RAM powerpc: Fix build warning on 32-bit PPC ALSA: firewire-tascam: Fix to handle error from initialization of stream data HID: hid-cypress: validate length of report net: vrf: do not allow table id 0 net: ipv4: Fix multipath selection with vrf gro: Disable frag0 optimization on IPv6 ext headers gro: use min_t() in skb_gro_reset_offset() gro: Enter slow-path if there is no tailroom r8152: fix rx issue for runtime suspend r8152: split rtl8152_suspend function ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules igmp: Make igmp group member RFC 3376 compliant drop_monitor: consider inserted data in genlmsg_end drop_monitor: add missing call to genlmsg_end net/mlx5: Avoid shadowing numa_node net/mlx5: Check FW limitations on log_max_qp before setting it net: stmmac: Fix race between stmmac_drv_probe and stmmac_open net, sched: fix soft lockup in tc_classify ipv6: handle -EFAULT from skb_copy_bits net: vrf: Drop conntrack data after pass through VRF device on Tx ser_gigaset: return -ENOMEM on error instead of success netvsc: reduce maximum GSO size Linux 4.4.42 usb: gadget: composite: always set ep->mult to a sensible value Revert "usb: gadget: composite: always set ep->mult to a sensible value" tick/broadcast: Prevent NULL pointer dereference drm/radeon: Always store CRTC relative radeon_crtc->cursor_x/y values cx23885-dvb: move initialization of a8293_pdata net: vxge: avoid unused function warnings net: ti: cpmac: Fix compiler warning due to type confusion cred/userns: define current_user_ns() as a function staging: comedi: dt282x: tidy up register bit defines powerpc/pci/rpadlpar: Fix device reference leaks md: MD_RECOVERY_NEEDED is set for mddev->recovery crypto: arm64/aes-ce - fix for big endian crypto: arm64/aes-xts-ce: fix for big endian crypto: arm64/sha1-ce - fix for big endian crypto: arm64/aes-neon - fix for big endian crypto: arm64/aes-ccm-ce: fix for big endian crypto: arm/aes-ce - fix for big endian crypto: arm64/ghash-ce - fix for big endian crypto: arm64/sha2-ce - fix for big endian s390/crypto: unlock on error in prng_tdes_read() mmc: mmc_test: Uninitialized return value PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend irqchip/bcm7038-l1: Implement irq_cpu_offline() callback target/iscsi: Fix double free in lio_target_tiqn_addtpg() scsi: mvsas: fix command_active typo ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped iommu/vt-d: Fix pasid table size encoding iommu/amd: Fix the left value check of cmd buffer iommu/amd: Missing error code in amd_iommu_init_device() clk: imx31: fix rewritten input argument of mx31_clocks_init() clk: clk-wm831x: fix a logic error hwmon: (g762) Fix overflows and crash seen when writing limit attributes hwmon: (nct7802) Fix overflows seen when writing into limit attributes hwmon: (ds620) Fix overflows seen when writing temperature limits hwmon: (amc6821) sign extension temperature hwmon: (scpi) Fix module autoload cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected ath10k: use the right length of "background" stable-fixup: hotplug: fix unused function warning usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb() usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb() usb: dwc3: gadget: always unmap EP0 requests staging: iio: ad7606: fix improper setting of oversampling pins mei: bus: fix mei_cldev_enable KDoc USB: serial: io_ti: bind to interface after fw download USB: phy: am335x-control: fix device and of_node leaks ARM: dts: r8a7794: Correct hsusb parent clock USB: serial: kl5kusb105: abort on open exception path ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream() usb: musb: blackfin: add bfin_fifo_offset in bfin_ops usb: hub: Move hub_port_disable() to fix warning if PM is disabled usb: musb: Fix trying to free already-free IRQ 4 usb: dwc3: pci: add Intel Gemini Lake PCI ID xhci: Fix race related to abort operation xhci: Use delayed_work instead of timer for command timeout usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL USB: serial: mos7720: fix parallel probe USB: serial: mos7720: fix parport use-after-free on probe errors USB: serial: mos7720: fix use-after-free on probe errors USB: serial: mos7720: fix NULL-deref at open USB: serial: mos7840: fix NULL-deref at open USB: serial: kobil_sct: fix NULL-deref in write USB: serial: cyberjack: fix NULL-deref at open USB: serial: oti6858: fix NULL-deref at open USB: serial: io_edgeport: fix NULL-deref at open USB: serial: ti_usb_3410_5052: fix NULL-deref at open USB: serial: garmin_gps: fix memory leak on failed URB submit USB: serial: iuu_phoenix: fix NULL-deref at open USB: serial: io_ti: fix I/O after disconnect USB: serial: io_ti: fix another NULL-deref at open USB: serial: io_ti: fix NULL-deref at open USB: serial: spcp8x5: fix NULL-deref at open USB: serial: keyspan_pda: verify endpoints at probe USB: serial: pl2303: fix NULL-deref at open USB: serial: quatech2: fix sleep-while-atomic in close USB: serial: omninet: fix NULL-derefs at open and disconnect usb: xhci: hold lock over xhci_abort_cmd_ring() xhci: Handle command completion and timeout race usb: host: xhci: Fix possible wild pointer when handling abort command usb: xhci: fix return value of xhci_setup_device() xhci: free xhci virtual devices with leaf nodes first usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Apollo Lake xhci: workaround for hosts missing CAS bit usb: xhci: fix possible wild pointer usb: dwc3: core: avoid Overflow events usb: gadget: composite: Test get_alt() presence instead of set_alt() USB: dummy-hcd: fix bug in stop_activity (handle ep0) USB: fix problems with duplicate endpoint addresses USB: gadgetfs: fix checks of wTotalLength in config descriptors USB: gadgetfs: fix use-after-free bug USB: gadgetfs: fix unbounded memory allocation bug usb: gadgetfs: restrict upper bound on device configuration size usb: storage: unusual_uas: Add JMicron JMS56x to unusual device usb: musb: dsps: implement clear_ep_rxintr() callback usb: musb: core: add clear_ep_rxintr() to musb_platform_ops KVM: MIPS: Flush KVM entry code from icache globally KVM: x86: reset MMU on KVM_SET_VCPU_EVENTS mac80211: initialize fast-xmit 'info' later ARM: davinci: da850: don't add emac clock to lookup table twice ALSA: usb-audio: Fix irq/process data synchronization ALSA: hda - Apply asus-mode8 fixup to ASUS X71SL ALSA: hda - Fix up GPIO for ASUS ROG Ranger Linux 4.4.41 net: mvpp2: fix dma unmapping of TX buffers for fragments sg_write()/bsg_write() is not fit to be called under KERNEL_DS kconfig/nconf: Fix hang when editing symbol with a long prompt target/user: Fix use-after-free of tcmu_cmds if they are expired powerpc: Convert cmp to cmpd in idle enter sequence powerpc/ps3: Fix system hang with GCC 5 builds nfs_write_end(): fix handling of short copies libceph: verify authorize reply on connect PCI: Check for PME in targeted sleep state Input: drv260x - fix input device's parent assignment media: solo6x10: fix lockup by avoiding delayed register write IB/cma: Fix a race condition in iboe_addr_get_sgid() IB/multicast: Check ib_find_pkey() return value IPoIB: Avoid reading an uninitialized member variable IB/mad: Fix an array index check fgraph: Handle a case where a tracer ignores set_graph_notrace platform/x86: asus-nb-wmi.c: Add X45U quirk ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) KVM: PPC: Book3S HV: Don't lose hardware R/C bit updates in H_PROTECT KVM: PPC: Book3S HV: Save/restore XER in checkpointed register state md/raid5: limit request size according to implementation limits sc16is7xx: Drop bogus use of IRQF_ONESHOT s390/vmlogrdr: fix IUCV buffer allocation firmware: fix usermode helper fallback loading ARC: mm: arc700: Don't assume 2 colours for aliasing VIPT dcache scsi: avoid a permanent stop of the scsi device's request queue scsi: zfcp: fix rport unblock race with LUN recovery scsi: zfcp: do not trace pure benign residual HBA responses at default level scsi: zfcp: fix use-after-"free" in FC ingress path after TMF scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset vt: fix Scroll Lock LED trigger name block: protect iterate_bdevs() against concurrent close mei: request async autosuspend at the end of enumeration drivers/gpu/drm/ast: Fix infinite loop if read fails drm/gma500: Add compat ioctl drm/radeon: add additional pci revision to dpm workaround drm/radeon: Hide the HW cursor while it's out of bounds drm/radeon: Also call cursor_move_locked when the cursor size changes drm/nouveau/i2c/gk110b,gm10x: use the correct implementation drm/nouveau/fifo/gf100-: protect channel preempt with subdev mutex drm/nouveau/ltc: protect clearing of comptags with mutex drm/nouveau/bios: require checksum to match for fast acpi shadow method drm/nouveau/kms: lvds panel strap moved again on maxwell ACPI / video: Add force_native quirk for HP Pavilion dv6 ACPI / video: Add force_native quirk for Dell XPS 17 L702X staging: comedi: ni_mio_common: fix E series ni_ai_insn_read() data staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask thermal: hwmon: Properly report critical temperature in sysfs clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion regulator: stw481x-vmmc: fix ages old enable error mmc: sdhci: Fix recovery from tuning timeout ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards. cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts rtlwifi: Fix enter/exit power_save ssb: Fix error routine when fallback SPROM fails Linux 4.4.40 ppp: defer netns reference release for ppp channel driver core: fix race between creating/querying glue dir and its cleanup xfs: set AGI buffer type in xlog_recover_clear_agi_bucket arm/xen: Use alloc_percpu rather than __alloc_percpu xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing tpm xen: Remove bogus tpm_chip_unregister kernel/debug/debug_core.c: more properly delay for secondary CPUs kernel/watchdog: use nmi registers snapshot in hardlockup handler CIFS: Fix a possible memory corruption in push locks CIFS: Fix missing nls unload in smb2_reconnect() CIFS: Fix a possible memory corruption during reconnect ASoC: intel: Fix crash at suspend/resume without card registration dm space map metadata: fix 'struct sm_metadata' leak on failed create dm crypt: mark key as invalid until properly loaded dm flakey: return -EINVAL on interval bounds error in flakey_ctr() blk-mq: Do not invoke .queue_rq() for a stopped queue usb: gadget: composite: always set ep->mult to a sensible value exec: Ensure mm->user_ns contains the execed files fs: exec: apply CLOEXEC before changing dumpable task flags mm/vmscan.c: set correct defer count for shrinker loop: return proper error from loop_queue_rq() f2fs: set ->owner for debugfs status file's file_operations ext4: do not perform data journaling when data is encrypted ext4: return -ENOMEM instead of success ext4: reject inodes with negative size ext4: add sanity checking to count_overhead() ext4: fix in-superblock mount options processing ext4: use more strict checks for inodes_per_block on mount ext4: fix stack memory corruption with 64k block size ext4: fix mballoc breakage with 64k block size crypto: caam - fix AEAD givenc descriptors ptrace: Capture the ptracer's creds not PT_PTRACE_CAP mm: Add a user_ns owner to mm_struct and fix ptrace permission checks block_dev: don't test bdev->bd_contains when it is not stable btrfs: make file clone aware of fatal signals Btrfs: don't BUG() during drop snapshot Btrfs: fix memory leak in do_walk_down Btrfs: don't leak reloc root nodes on error Btrfs: return gracefully from balance if fs tree is corrupted Btrfs: bail out if block group has different mixed flag Btrfs: fix memory leak in reading btree blocks clk: ti: omap36xx: Work around sprz319 advisory 2.1 ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO ALSA: hda - fix headset-mic problem on a Dell laptop ALSA: hda - ignore the assoc and seq when comparing pin configurations ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016 ALSA: hiface: Fix M2Tech hiFace driver sampling rate change ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks USB: UHCI: report non-PME wakeup signalling for Intel hardware usb: gadget: composite: correctly initialize ep->maxpacket usb: gadget: f_uac2: fix error handling at afunc_bind usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices USB: cdc-acm: add device id for GW Instek AFG-125 USB: serial: kl5kusb105: fix open error path USB: serial: option: add dlink dwm-158 USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041 Btrfs: fix qgroup rescan worker initialization btrfs: store and load values of stripes_min/stripes_max in balance status item Btrfs: fix tree search logic when replaying directory entry deletes btrfs: limit async_work allocation and worker func duration ANDROID: trace: net: use %pK for kernel pointers ANDROID: android-base: Enable QUOTA related configs net: ipv4: Don't crash if passing a null sk to ip_rt_update_pmtu. net: inet: Support UID-based routing in IP protocols. Revert "net: ipv6: fix virtual tunneling build" net: core: add UID to flows, rules, and routes net: core: Add a UID field to struct sock. Revert "net: core: Support UID-based routing." Revert "net: core: Handle 'sk' being NULL in UID-based routing" Revert "ANDROID: net: fix 'const' warnings" Revert "ANDROID: net: fib: remove duplicate assignment" Revert "ANDROID: net: core: fix UID-based routing" UPSTREAM: efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping UPSTREAM: arm64: enable CONFIG_DEBUG_RODATA by default goldfish: enable CONFIG_INET_DIAG_DESTROY sched/walt: kill {min,max}_capacity sched: fix wrong truncation of walt_avg ANDROID: dm verity: add minimum prefetch size Linux 4.4.39 crypto: rsa - Add Makefile dependencies to fix parallel builds hotplug: Make register and unregister notifier API symmetric batman-adv: Check for alloc errors when preparing TT local data m68k: Fix ndelay() macro arm64: futex.h: Add missing PAN toggling can: peak: fix bad memory access and free sequence can: raw: raw_setsockopt: limit number of can_filter that can be set crypto: mcryptd - Check mcryptd algorithm compatibility perf/x86: Fix full width counter, counter overflow locking/rtmutex: Use READ_ONCE() in rt_mutex_owner() locking/rtmutex: Prevent dequeue vs. unlock race zram: restrict add/remove attributes to root only parisc: Fix TLB related boot crash on SMP machines parisc: Remove unnecessary TLB purges from flush_dcache_page_asm and flush_icache_page_asm parisc: Purge TLB before setting PTE powerpc/eeh: Fix deadlock when PE frozen state can't be cleared Conflicts: arch/arm64/kernel/traps.c drivers/usb/dwc3/core.h drivers/usb/dwc3/ep0.c drivers/usb/gadget/function/f_fs.c drivers/usb/host/xhci-mem.c drivers/usb/host/xhci-ring.c drivers/usb/host/xhci.c drivers/video/fbdev/core/fbcmap.c include/trace/events/sched.h mm/vmscan.c Change-Id: I3faa0010ecb98972cd8e6470377a493b56d95f89 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org> Signed-off-by: Runmin Wang <runminw@codeaurora.org>
712 lines
20 KiB
C
712 lines
20 KiB
C
/*
|
|
* Based on arch/arm/mm/fault.c
|
|
*
|
|
* Copyright (C) 1995 Linus Torvalds
|
|
* Copyright (C) 1995-2004 Russell King
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/signal.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/hardirq.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kprobes.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/page-flags.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/highmem.h>
|
|
#include <linux/perf_event.h>
|
|
#include <linux/preempt.h>
|
|
|
|
#include <asm/bug.h>
|
|
#include <asm/cpufeature.h>
|
|
#include <asm/exception.h>
|
|
#include <asm/debug-monitors.h>
|
|
#include <asm/esr.h>
|
|
#include <asm/sysreg.h>
|
|
#include <asm/system_misc.h>
|
|
#include <asm/pgtable.h>
|
|
#include <asm/tlbflush.h>
|
|
#include <asm/edac.h>
|
|
#include <soc/qcom/scm.h>
|
|
|
|
#include <trace/events/exception.h>
|
|
|
|
static const char *fault_name(unsigned int esr);
|
|
|
|
#ifdef CONFIG_KPROBES
|
|
static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
|
|
{
|
|
int ret = 0;
|
|
|
|
/* kprobe_running() needs smp_processor_id() */
|
|
if (!user_mode(regs)) {
|
|
preempt_disable();
|
|
if (kprobe_running() && kprobe_fault_handler(regs, esr))
|
|
ret = 1;
|
|
preempt_enable();
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#else
|
|
static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/*
|
|
* Dump out the page tables associated with 'addr' in mm 'mm'.
|
|
*/
|
|
void show_pte(struct mm_struct *mm, unsigned long addr)
|
|
{
|
|
pgd_t *pgd;
|
|
|
|
if (!mm)
|
|
mm = &init_mm;
|
|
|
|
pr_alert("pgd = %p\n", mm->pgd);
|
|
pgd = pgd_offset(mm, addr);
|
|
pr_alert("[%08lx] *pgd=%016llx", addr, pgd_val(*pgd));
|
|
|
|
do {
|
|
pud_t *pud;
|
|
pmd_t *pmd;
|
|
pte_t *pte;
|
|
|
|
if (pgd_none(*pgd) || pgd_bad(*pgd))
|
|
break;
|
|
|
|
pud = pud_offset(pgd, addr);
|
|
printk(", *pud=%016llx", pud_val(*pud));
|
|
if (pud_none(*pud) || pud_bad(*pud))
|
|
break;
|
|
|
|
pmd = pmd_offset(pud, addr);
|
|
printk(", *pmd=%016llx", pmd_val(*pmd));
|
|
if (pmd_none(*pmd) || pmd_bad(*pmd))
|
|
break;
|
|
|
|
pte = pte_offset_map(pmd, addr);
|
|
printk(", *pte=%016llx", pte_val(*pte));
|
|
pte_unmap(pte);
|
|
} while(0);
|
|
|
|
printk("\n");
|
|
}
|
|
|
|
#ifdef CONFIG_ARM64_HW_AFDBM
|
|
/*
|
|
* This function sets the access flags (dirty, accessed), as well as write
|
|
* permission, and only to a more permissive setting.
|
|
*
|
|
* It needs to cope with hardware update of the accessed/dirty state by other
|
|
* agents in the system and can safely skip the __sync_icache_dcache() call as,
|
|
* like set_pte_at(), the PTE is never changed from no-exec to exec here.
|
|
*
|
|
* Returns whether or not the PTE actually changed.
|
|
*/
|
|
int ptep_set_access_flags(struct vm_area_struct *vma,
|
|
unsigned long address, pte_t *ptep,
|
|
pte_t entry, int dirty)
|
|
{
|
|
pteval_t old_pteval;
|
|
unsigned int tmp;
|
|
|
|
if (pte_same(*ptep, entry))
|
|
return 0;
|
|
|
|
/* only preserve the access flags and write permission */
|
|
pte_val(entry) &= PTE_AF | PTE_WRITE | PTE_DIRTY;
|
|
|
|
/*
|
|
* PTE_RDONLY is cleared by default in the asm below, so set it in
|
|
* back if necessary (read-only or clean PTE).
|
|
*/
|
|
if (!pte_write(entry) || !pte_sw_dirty(entry))
|
|
pte_val(entry) |= PTE_RDONLY;
|
|
|
|
/*
|
|
* Setting the flags must be done atomically to avoid racing with the
|
|
* hardware update of the access/dirty state.
|
|
*/
|
|
asm volatile("// ptep_set_access_flags\n"
|
|
" prfm pstl1strm, %2\n"
|
|
"1: ldxr %0, %2\n"
|
|
" and %0, %0, %3 // clear PTE_RDONLY\n"
|
|
" orr %0, %0, %4 // set flags\n"
|
|
" stxr %w1, %0, %2\n"
|
|
" cbnz %w1, 1b\n"
|
|
: "=&r" (old_pteval), "=&r" (tmp), "+Q" (pte_val(*ptep))
|
|
: "L" (~PTE_RDONLY), "r" (pte_val(entry)));
|
|
|
|
flush_tlb_fix_spurious_fault(vma, address);
|
|
return 1;
|
|
}
|
|
#endif
|
|
|
|
static bool is_el1_instruction_abort(unsigned int esr)
|
|
{
|
|
return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_CUR;
|
|
}
|
|
|
|
/*
|
|
* The kernel tried to access some page that wasn't present.
|
|
*/
|
|
static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr,
|
|
unsigned int esr, struct pt_regs *regs)
|
|
{
|
|
/*
|
|
* Are we prepared to handle this kernel fault?
|
|
* We are almost certainly not prepared to handle instruction faults.
|
|
*/
|
|
if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
|
|
return;
|
|
|
|
/*
|
|
* No handler, we'll have to terminate things with extreme prejudice.
|
|
*/
|
|
bust_spinlocks(1);
|
|
pr_alert("Unable to handle kernel %s at virtual address %08lx\n",
|
|
(addr < PAGE_SIZE) ? "NULL pointer dereference" :
|
|
"paging request", addr);
|
|
|
|
show_pte(mm, addr);
|
|
die("Oops", regs, esr);
|
|
bust_spinlocks(0);
|
|
do_exit(SIGKILL);
|
|
}
|
|
|
|
/*
|
|
* Something tried to access memory that isn't in our memory map. User mode
|
|
* accesses just cause a SIGSEGV
|
|
*/
|
|
static void __do_user_fault(struct task_struct *tsk, unsigned long addr,
|
|
unsigned int esr, unsigned int sig, int code,
|
|
struct pt_regs *regs)
|
|
{
|
|
struct siginfo si;
|
|
|
|
trace_user_fault(tsk, addr, esr);
|
|
|
|
if (unhandled_signal(tsk, sig) && show_unhandled_signals_ratelimited()) {
|
|
pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
|
|
tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
|
|
addr, esr);
|
|
show_pte(tsk->mm, addr);
|
|
show_regs(regs);
|
|
}
|
|
|
|
tsk->thread.fault_address = addr;
|
|
tsk->thread.fault_code = esr;
|
|
si.si_signo = sig;
|
|
si.si_errno = 0;
|
|
si.si_code = code;
|
|
si.si_addr = (void __user *)addr;
|
|
force_sig_info(sig, &si, tsk);
|
|
}
|
|
|
|
static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
|
|
{
|
|
struct task_struct *tsk = current;
|
|
struct mm_struct *mm = tsk->active_mm;
|
|
|
|
/*
|
|
* If we are in kernel mode at this point, we have no context to
|
|
* handle this fault with.
|
|
*/
|
|
if (user_mode(regs))
|
|
__do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
|
|
else
|
|
__do_kernel_fault(mm, addr, esr, regs);
|
|
}
|
|
|
|
#define VM_FAULT_BADMAP 0x010000
|
|
#define VM_FAULT_BADACCESS 0x020000
|
|
|
|
static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
|
|
unsigned int mm_flags, unsigned long vm_flags,
|
|
struct task_struct *tsk)
|
|
{
|
|
struct vm_area_struct *vma;
|
|
int fault;
|
|
|
|
vma = find_vma(mm, addr);
|
|
fault = VM_FAULT_BADMAP;
|
|
if (unlikely(!vma))
|
|
goto out;
|
|
if (unlikely(vma->vm_start > addr))
|
|
goto check_stack;
|
|
|
|
/*
|
|
* Ok, we have a good vm_area for this memory access, so we can handle
|
|
* it.
|
|
*/
|
|
good_area:
|
|
/*
|
|
* Check that the permissions on the VMA allow for the fault which
|
|
* occurred. If we encountered a write or exec fault, we must have
|
|
* appropriate permissions, otherwise we allow any permission.
|
|
*/
|
|
if (!(vma->vm_flags & vm_flags)) {
|
|
fault = VM_FAULT_BADACCESS;
|
|
goto out;
|
|
}
|
|
|
|
return handle_mm_fault(mm, vma, addr & PAGE_MASK, mm_flags);
|
|
|
|
check_stack:
|
|
if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
|
|
goto good_area;
|
|
out:
|
|
return fault;
|
|
}
|
|
|
|
static inline bool is_permission_fault(unsigned int esr, struct pt_regs *regs)
|
|
{
|
|
unsigned int ec = ESR_ELx_EC(esr);
|
|
unsigned int fsc_type = esr & ESR_ELx_FSC_TYPE;
|
|
|
|
if (ec != ESR_ELx_EC_DABT_CUR && ec != ESR_ELx_EC_IABT_CUR)
|
|
return false;
|
|
|
|
if (system_uses_ttbr0_pan())
|
|
return fsc_type == ESR_ELx_FSC_FAULT &&
|
|
(regs->pstate & PSR_PAN_BIT);
|
|
else
|
|
return fsc_type == ESR_ELx_FSC_PERM;
|
|
}
|
|
|
|
static bool is_el0_instruction_abort(unsigned int esr)
|
|
{
|
|
return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_LOW;
|
|
}
|
|
|
|
static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
|
|
struct pt_regs *regs)
|
|
{
|
|
struct task_struct *tsk;
|
|
struct mm_struct *mm;
|
|
int fault, sig, code;
|
|
unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
|
|
unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
|
|
|
|
if (notify_page_fault(regs, esr))
|
|
return 0;
|
|
|
|
tsk = current;
|
|
mm = tsk->mm;
|
|
|
|
/* Enable interrupts if they were enabled in the parent context. */
|
|
if (interrupts_enabled(regs))
|
|
local_irq_enable();
|
|
|
|
/*
|
|
* If we're in an interrupt or have no user context, we must not take
|
|
* the fault.
|
|
*/
|
|
if (faulthandler_disabled() || !mm)
|
|
goto no_context;
|
|
|
|
if (user_mode(regs))
|
|
mm_flags |= FAULT_FLAG_USER;
|
|
|
|
if (is_el0_instruction_abort(esr)) {
|
|
vm_flags = VM_EXEC;
|
|
} else if (((esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM)) ||
|
|
((esr & ESR_ELx_CM) && !(mm_flags & FAULT_FLAG_USER))) {
|
|
vm_flags = VM_WRITE;
|
|
mm_flags |= FAULT_FLAG_WRITE;
|
|
}
|
|
|
|
if (addr < USER_DS && is_permission_fault(esr, regs)) {
|
|
if (is_el1_instruction_abort(esr))
|
|
die("Attempting to execute userspace memory", regs, esr);
|
|
|
|
if (!search_exception_tables(regs->pc))
|
|
die("Accessing user space memory outside uaccess.h routines", regs, esr);
|
|
}
|
|
|
|
/*
|
|
* As per x86, we may deadlock here. However, since the kernel only
|
|
* validly references user space from well defined areas of the code,
|
|
* we can bug out early if this is from code which shouldn't.
|
|
*/
|
|
if (!down_read_trylock(&mm->mmap_sem)) {
|
|
if (!user_mode(regs) && !search_exception_tables(regs->pc))
|
|
goto no_context;
|
|
retry:
|
|
down_read(&mm->mmap_sem);
|
|
} else {
|
|
/*
|
|
* The above down_read_trylock() might have succeeded in which
|
|
* case, we'll have missed the might_sleep() from down_read().
|
|
*/
|
|
might_sleep();
|
|
#ifdef CONFIG_DEBUG_VM
|
|
if (!user_mode(regs) && !search_exception_tables(regs->pc))
|
|
goto no_context;
|
|
#endif
|
|
}
|
|
|
|
fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
|
|
|
|
/*
|
|
* If we need to retry but a fatal signal is pending, handle the
|
|
* signal first. We do not need to release the mmap_sem because it
|
|
* would already be released in __lock_page_or_retry in mm/filemap.c.
|
|
*/
|
|
if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
|
|
return 0;
|
|
|
|
/*
|
|
* Major/minor page fault accounting is only done on the initial
|
|
* attempt. If we go through a retry, it is extremely likely that the
|
|
* page will be found in page cache at that point.
|
|
*/
|
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
|
|
if (mm_flags & FAULT_FLAG_ALLOW_RETRY) {
|
|
if (fault & VM_FAULT_MAJOR) {
|
|
tsk->maj_flt++;
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
|
|
addr);
|
|
} else {
|
|
tsk->min_flt++;
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
|
|
addr);
|
|
}
|
|
if (fault & VM_FAULT_RETRY) {
|
|
/*
|
|
* Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
|
|
* starvation.
|
|
*/
|
|
mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
|
|
mm_flags |= FAULT_FLAG_TRIED;
|
|
goto retry;
|
|
}
|
|
}
|
|
|
|
up_read(&mm->mmap_sem);
|
|
|
|
/*
|
|
* Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
|
|
*/
|
|
if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP |
|
|
VM_FAULT_BADACCESS))))
|
|
return 0;
|
|
|
|
/*
|
|
* If we are in kernel mode at this point, we have no context to
|
|
* handle this fault with.
|
|
*/
|
|
if (!user_mode(regs))
|
|
goto no_context;
|
|
|
|
if (fault & VM_FAULT_OOM) {
|
|
/*
|
|
* We ran out of memory, call the OOM killer, and return to
|
|
* userspace (which will retry the fault, or kill us if we got
|
|
* oom-killed).
|
|
*/
|
|
pagefault_out_of_memory();
|
|
return 0;
|
|
}
|
|
|
|
if (fault & VM_FAULT_SIGBUS) {
|
|
/*
|
|
* We had some memory, but were unable to successfully fix up
|
|
* this page fault.
|
|
*/
|
|
sig = SIGBUS;
|
|
code = BUS_ADRERR;
|
|
} else {
|
|
/*
|
|
* Something tried to access memory that isn't in our memory
|
|
* map.
|
|
*/
|
|
sig = SIGSEGV;
|
|
code = fault == VM_FAULT_BADACCESS ?
|
|
SEGV_ACCERR : SEGV_MAPERR;
|
|
}
|
|
|
|
__do_user_fault(tsk, addr, esr, sig, code, regs);
|
|
return 0;
|
|
|
|
no_context:
|
|
__do_kernel_fault(mm, addr, esr, regs);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* TLB conflict is already handled in EL2. This rourtine should return zero
|
|
* so that, do_mem_abort would not crash kernel thinking TLB conflict not
|
|
* handled.
|
|
*/
|
|
#ifdef CONFIG_QCOM_TLB_EL2_HANDLER
|
|
static int do_tlb_conf_fault(unsigned long addr,
|
|
unsigned int esr,
|
|
struct pt_regs *regs)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif
|
|
/*
|
|
* First Level Translation Fault Handler
|
|
*
|
|
* We enter here because the first level page table doesn't contain a valid
|
|
* entry for the address.
|
|
*
|
|
* If the address is in kernel space (>= TASK_SIZE), then we are probably
|
|
* faulting in the vmalloc() area.
|
|
*
|
|
* If the init_task's first level page tables contains the relevant entry, we
|
|
* copy the it to this task. If not, we send the process a signal, fixup the
|
|
* exception, or oops the kernel.
|
|
*
|
|
* NOTE! We MUST NOT take any locks for this case. We may be in an interrupt
|
|
* or a critical region, and should only copy the information from the master
|
|
* page table, nothing more.
|
|
*/
|
|
static int __kprobes do_translation_fault(unsigned long addr,
|
|
unsigned int esr,
|
|
struct pt_regs *regs)
|
|
{
|
|
if (addr < TASK_SIZE)
|
|
return do_page_fault(addr, esr, regs);
|
|
|
|
do_bad_area(addr, esr, regs);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* This abort handler always returns "fault".
|
|
*/
|
|
static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
|
|
{
|
|
arm64_check_cache_ecc(NULL);
|
|
return 1;
|
|
}
|
|
|
|
static const struct fault_info {
|
|
int (*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
|
|
int sig;
|
|
int code;
|
|
const char *name;
|
|
} fault_info[] = {
|
|
{ do_bad, SIGBUS, 0, "ttbr address size fault" },
|
|
{ do_bad, SIGBUS, 0, "level 1 address size fault" },
|
|
{ do_bad, SIGBUS, 0, "level 2 address size fault" },
|
|
{ do_bad, SIGBUS, 0, "level 3 address size fault" },
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 0 translation fault" },
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 1 translation fault" },
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 2 translation fault" },
|
|
{ do_page_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" },
|
|
{ do_bad, SIGBUS, 0, "unknown 8" },
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 access flag fault" },
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 access flag fault" },
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 3 access flag fault" },
|
|
{ do_bad, SIGBUS, 0, "unknown 12" },
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 permission fault" },
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 permission fault" },
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 3 permission fault" },
|
|
{ do_bad, SIGBUS, 0, "synchronous external abort" },
|
|
{ do_bad, SIGBUS, 0, "unknown 17" },
|
|
{ do_bad, SIGBUS, 0, "unknown 18" },
|
|
{ do_bad, SIGBUS, 0, "unknown 19" },
|
|
{ do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous parity error" },
|
|
{ do_bad, SIGBUS, 0, "unknown 25" },
|
|
{ do_bad, SIGBUS, 0, "unknown 26" },
|
|
{ do_bad, SIGBUS, 0, "unknown 27" },
|
|
{ do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" },
|
|
{ do_bad, SIGBUS, 0, "unknown 32" },
|
|
{ do_bad, SIGBUS, BUS_ADRALN, "alignment fault" },
|
|
{ do_bad, SIGBUS, 0, "unknown 34" },
|
|
{ do_bad, SIGBUS, 0, "unknown 35" },
|
|
{ do_bad, SIGBUS, 0, "unknown 36" },
|
|
{ do_bad, SIGBUS, 0, "unknown 37" },
|
|
{ do_bad, SIGBUS, 0, "unknown 38" },
|
|
{ do_bad, SIGBUS, 0, "unknown 39" },
|
|
{ do_bad, SIGBUS, 0, "unknown 40" },
|
|
{ do_bad, SIGBUS, 0, "unknown 41" },
|
|
{ do_bad, SIGBUS, 0, "unknown 42" },
|
|
{ do_bad, SIGBUS, 0, "unknown 43" },
|
|
{ do_bad, SIGBUS, 0, "unknown 44" },
|
|
{ do_bad, SIGBUS, 0, "unknown 45" },
|
|
{ do_bad, SIGBUS, 0, "unknown 46" },
|
|
{ do_bad, SIGBUS, 0, "unknown 47" },
|
|
#ifdef CONFIG_QCOM_TLB_EL2_HANDLER
|
|
{ do_tlb_conf_fault, SIGBUS, 0, "TLB conflict abort" },
|
|
#else
|
|
{ do_bad, SIGBUS, 0, "TLB conflict abort" },
|
|
#endif
|
|
{ do_bad, SIGBUS, 0, "unknown 49" },
|
|
{ do_bad, SIGBUS, 0, "unknown 50" },
|
|
{ do_bad, SIGBUS, 0, "unknown 51" },
|
|
{ do_bad, SIGBUS, 0, "implementation fault (lockdown abort)" },
|
|
{ do_bad, SIGBUS, 0, "implementation fault (unsupported exclusive)" },
|
|
{ do_bad, SIGBUS, 0, "unknown 54" },
|
|
{ do_bad, SIGBUS, 0, "unknown 55" },
|
|
{ do_bad, SIGBUS, 0, "unknown 56" },
|
|
{ do_bad, SIGBUS, 0, "unknown 57" },
|
|
{ do_bad, SIGBUS, 0, "unknown 58" },
|
|
{ do_bad, SIGBUS, 0, "unknown 59" },
|
|
{ do_bad, SIGBUS, 0, "unknown 60" },
|
|
{ do_bad, SIGBUS, 0, "section domain fault" },
|
|
{ do_bad, SIGBUS, 0, "page domain fault" },
|
|
{ do_bad, SIGBUS, 0, "unknown 63" },
|
|
};
|
|
|
|
static const char *fault_name(unsigned int esr)
|
|
{
|
|
const struct fault_info *inf = fault_info + (esr & 63);
|
|
return inf->name;
|
|
}
|
|
|
|
/*
|
|
* Dispatch a data abort to the relevant handler.
|
|
*/
|
|
asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
|
|
struct pt_regs *regs)
|
|
{
|
|
const struct fault_info *inf = fault_info + (esr & 63);
|
|
struct siginfo info;
|
|
|
|
if (!inf->fn(addr, esr, regs))
|
|
return;
|
|
|
|
pr_alert("Unhandled fault: %s (0x%08x) at 0x%016lx\n",
|
|
inf->name, esr, addr);
|
|
|
|
info.si_signo = inf->sig;
|
|
info.si_errno = 0;
|
|
info.si_code = inf->code;
|
|
info.si_addr = (void __user *)addr;
|
|
arm64_notify_die("", regs, &info, esr);
|
|
}
|
|
|
|
/*
|
|
* Handle stack alignment exceptions.
|
|
*/
|
|
asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
|
|
unsigned int esr,
|
|
struct pt_regs *regs)
|
|
{
|
|
struct siginfo info;
|
|
struct task_struct *tsk = current;
|
|
|
|
if (show_unhandled_signals && unhandled_signal(tsk, SIGBUS))
|
|
pr_info_ratelimited("%s[%d]: %s exception: pc=%p sp=%p\n",
|
|
tsk->comm, task_pid_nr(tsk),
|
|
esr_get_class_string(esr), (void *)regs->pc,
|
|
(void *)regs->sp);
|
|
|
|
info.si_signo = SIGBUS;
|
|
info.si_errno = 0;
|
|
info.si_code = BUS_ADRALN;
|
|
info.si_addr = (void __user *)addr;
|
|
arm64_notify_die("Oops - SP/PC alignment exception", regs, &info, esr);
|
|
}
|
|
|
|
int __init early_brk64(unsigned long addr, unsigned int esr,
|
|
struct pt_regs *regs);
|
|
|
|
/*
|
|
* __refdata because early_brk64 is __init, but the reference to it is
|
|
* clobbered at arch_initcall time.
|
|
* See traps.c and debug-monitors.c:debug_traps_init().
|
|
*/
|
|
static struct fault_info __refdata debug_fault_info[] = {
|
|
{ do_bad, SIGTRAP, TRAP_HWBKPT, "hardware breakpoint" },
|
|
{ do_bad, SIGTRAP, TRAP_HWBKPT, "hardware single-step" },
|
|
{ do_bad, SIGTRAP, TRAP_HWBKPT, "hardware watchpoint" },
|
|
{ do_bad, SIGBUS, 0, "unknown 3" },
|
|
{ do_bad, SIGTRAP, TRAP_BRKPT, "aarch32 BKPT" },
|
|
{ do_bad, SIGTRAP, 0, "aarch32 vector catch" },
|
|
{ early_brk64, SIGTRAP, TRAP_BRKPT, "aarch64 BRK" },
|
|
{ do_bad, SIGBUS, 0, "unknown 7" },
|
|
};
|
|
|
|
void __init hook_debug_fault_code(int nr,
|
|
int (*fn)(unsigned long, unsigned int, struct pt_regs *),
|
|
int sig, int code, const char *name)
|
|
{
|
|
BUG_ON(nr < 0 || nr >= ARRAY_SIZE(debug_fault_info));
|
|
|
|
debug_fault_info[nr].fn = fn;
|
|
debug_fault_info[nr].sig = sig;
|
|
debug_fault_info[nr].code = code;
|
|
debug_fault_info[nr].name = name;
|
|
}
|
|
|
|
asmlinkage int __exception do_debug_exception(unsigned long addr,
|
|
unsigned int esr,
|
|
struct pt_regs *regs)
|
|
{
|
|
const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
|
|
struct siginfo info;
|
|
|
|
if (!inf->fn(addr, esr, regs))
|
|
return 1;
|
|
|
|
pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
|
|
inf->name, esr, addr);
|
|
|
|
info.si_signo = inf->sig;
|
|
info.si_errno = 0;
|
|
info.si_code = inf->code;
|
|
info.si_addr = (void __user *)addr;
|
|
arm64_notify_die("", regs, &info, 0);
|
|
|
|
return 0;
|
|
}
|
|
NOKPROBE_SYMBOL(do_debug_exception);
|
|
|
|
#ifdef CONFIG_ARM64_PAN
|
|
int cpu_enable_pan(void *__unused)
|
|
{
|
|
/*
|
|
* We modify PSTATE. This won't work from irq context as the PSTATE
|
|
* is discarded once we return from the exception.
|
|
*/
|
|
WARN_ON_ONCE(in_interrupt());
|
|
|
|
config_sctlr_el1(SCTLR_EL1_SPAN, 0);
|
|
asm(SET_PSTATE_PAN(1));
|
|
return 0;
|
|
}
|
|
#endif /* CONFIG_ARM64_PAN */
|
|
|
|
#ifdef CONFIG_ARM64_UAO
|
|
/*
|
|
* Kernel threads have fs=KERNEL_DS by default, and don't need to call
|
|
* set_fs(), devtmpfs in particular relies on this behaviour.
|
|
* We need to enable the feature at runtime (instead of adding it to
|
|
* PSR_MODE_EL1h) as the feature may not be implemented by the cpu.
|
|
*/
|
|
int cpu_enable_uao(void *__unused)
|
|
{
|
|
asm(SET_PSTATE_UAO(1));
|
|
}
|
|
#endif /* CONFIG_ARM64_UAO */
|