mirror of
https://github.com/Fishwaldo/build.git
synced 2025-03-29 02:01:21 +00:00
334 lines
11 KiB
Diff
334 lines
11 KiB
Diff
diff --git a/Makefile b/Makefile
|
|
index c92186c3efd7..def39fdd9df4 100644
|
|
--- a/Makefile
|
|
+++ b/Makefile
|
|
@@ -1,6 +1,6 @@
|
|
VERSION = 3
|
|
PATCHLEVEL = 14
|
|
-SUBLEVEL = 45
|
|
+SUBLEVEL = 46
|
|
EXTRAVERSION =
|
|
NAME = Remembering Coco
|
|
|
|
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
|
|
index 797b1a6a4906..7e666cfda634 100644
|
|
--- a/arch/arm/kernel/hyp-stub.S
|
|
+++ b/arch/arm/kernel/hyp-stub.S
|
|
@@ -134,9 +134,7 @@ ENTRY(__hyp_stub_install_secondary)
|
|
mcr p15, 4, r7, c1, c1, 3 @ HSTR
|
|
|
|
THUMB( orr r7, #(1 << 30) ) @ HSCTLR.TE
|
|
-#ifdef CONFIG_CPU_BIG_ENDIAN
|
|
- orr r7, #(1 << 9) @ HSCTLR.EE
|
|
-#endif
|
|
+ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
|
|
mcr p15, 4, r7, c1, c0, 0 @ HSCTLR
|
|
|
|
mrc p15, 4, r7, c1, c1, 1 @ HDCR
|
|
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
|
|
index 26b03e1254ef..8ff2b3ca7ee9 100644
|
|
--- a/drivers/bluetooth/ath3k.c
|
|
+++ b/drivers/bluetooth/ath3k.c
|
|
@@ -79,6 +79,7 @@ static const struct usb_device_id ath3k_table[] = {
|
|
{ USB_DEVICE(0x0489, 0xe057) },
|
|
{ USB_DEVICE(0x0489, 0xe056) },
|
|
{ USB_DEVICE(0x0489, 0xe05f) },
|
|
+ { USB_DEVICE(0x0489, 0xe076) },
|
|
{ USB_DEVICE(0x0489, 0xe078) },
|
|
{ USB_DEVICE(0x04c5, 0x1330) },
|
|
{ USB_DEVICE(0x04CA, 0x3004) },
|
|
@@ -109,6 +110,7 @@ static const struct usb_device_id ath3k_table[] = {
|
|
{ USB_DEVICE(0x13d3, 0x3402) },
|
|
{ USB_DEVICE(0x13d3, 0x3408) },
|
|
{ USB_DEVICE(0x13d3, 0x3432) },
|
|
+ { USB_DEVICE(0x13d3, 0x3474) },
|
|
|
|
/* Atheros AR5BBU12 with sflash firmware */
|
|
{ USB_DEVICE(0x0489, 0xE02C) },
|
|
@@ -133,6 +135,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
|
|
{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
|
|
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
|
|
@@ -163,6 +166,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
|
|
{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
|
|
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
|
|
|
|
/* Atheros AR5BBU22 with sflash firmware */
|
|
{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
|
|
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
|
|
index 9eb1669962ef..c0e7a9aa97a4 100644
|
|
--- a/drivers/bluetooth/btusb.c
|
|
+++ b/drivers/bluetooth/btusb.c
|
|
@@ -157,6 +157,7 @@ static const struct usb_device_id blacklist_table[] = {
|
|
{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
|
|
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
|
|
@@ -187,6 +188,7 @@ static const struct usb_device_id blacklist_table[] = {
|
|
{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
|
|
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
|
|
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
|
|
|
|
/* Atheros AR5BBU12 with sflash firmware */
|
|
{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
|
|
diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
|
|
index 28486b19fc36..ae6dae8ef7ab 100644
|
|
--- a/drivers/crypto/caam/caamrng.c
|
|
+++ b/drivers/crypto/caam/caamrng.c
|
|
@@ -56,7 +56,7 @@
|
|
|
|
/* Buffer, its dma address and lock */
|
|
struct buf_data {
|
|
- u8 buf[RN_BUF_SIZE];
|
|
+ u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
|
|
dma_addr_t addr;
|
|
struct completion filled;
|
|
u32 hw_desc[DESC_JOB_O_LEN];
|
|
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
|
|
index 968374776db9..f2511a03e3e9 100644
|
|
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
|
|
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
|
|
@@ -1529,6 +1529,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
|
|
return MODE_BANDWIDTH;
|
|
}
|
|
|
|
+ if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 ||
|
|
+ (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) {
|
|
+ return MODE_H_ILLEGAL;
|
|
+ }
|
|
+
|
|
if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 ||
|
|
mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 ||
|
|
mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 ||
|
|
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
|
|
index 8f580fda443f..ce211328bc1c 100644
|
|
--- a/drivers/scsi/lpfc/lpfc_sli.c
|
|
+++ b/drivers/scsi/lpfc/lpfc_sli.c
|
|
@@ -265,6 +265,16 @@ lpfc_sli4_eq_get(struct lpfc_queue *q)
|
|
return NULL;
|
|
|
|
q->hba_index = idx;
|
|
+
|
|
+ /*
|
|
+ * insert barrier for instruction interlock : data from the hardware
|
|
+ * must have the valid bit checked before it can be copied and acted
|
|
+ * upon. Given what was seen in lpfc_sli4_cq_get() of speculative
|
|
+ * instructions allowing action on content before valid bit checked,
|
|
+ * add barrier here as well. May not be needed as "content" is a
|
|
+ * single 32-bit entity here (vs multi word structure for cq's).
|
|
+ */
|
|
+ mb();
|
|
return eqe;
|
|
}
|
|
|
|
@@ -370,6 +380,17 @@ lpfc_sli4_cq_get(struct lpfc_queue *q)
|
|
|
|
cqe = q->qe[q->hba_index].cqe;
|
|
q->hba_index = idx;
|
|
+
|
|
+ /*
|
|
+ * insert barrier for instruction interlock : data from the hardware
|
|
+ * must have the valid bit checked before it can be copied and acted
|
|
+ * upon. Speculative instructions were allowing a bcopy at the start
|
|
+ * of lpfc_sli4_fp_handle_wcqe(), which is called immediately
|
|
+ * after our return, to copy data before the valid bit check above
|
|
+ * was done. As such, some of the copied data was stale. The barrier
|
|
+ * ensures the check is before any data is copied.
|
|
+ */
|
|
+ mb();
|
|
return cqe;
|
|
}
|
|
|
|
diff --git a/fs/pipe.c b/fs/pipe.c
|
|
index 78fd0d0788db..46f1ab264a4c 100644
|
|
--- a/fs/pipe.c
|
|
+++ b/fs/pipe.c
|
|
@@ -117,25 +117,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
|
|
}
|
|
|
|
static int
|
|
-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
|
|
- int atomic)
|
|
+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
|
|
+ size_t *remaining, int atomic)
|
|
{
|
|
unsigned long copy;
|
|
|
|
- while (len > 0) {
|
|
+ while (*remaining > 0) {
|
|
while (!iov->iov_len)
|
|
iov++;
|
|
- copy = min_t(unsigned long, len, iov->iov_len);
|
|
+ copy = min_t(unsigned long, *remaining, iov->iov_len);
|
|
|
|
if (atomic) {
|
|
- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
|
|
+ if (__copy_from_user_inatomic(addr + *offset,
|
|
+ iov->iov_base, copy))
|
|
return -EFAULT;
|
|
} else {
|
|
- if (copy_from_user(to, iov->iov_base, copy))
|
|
+ if (copy_from_user(addr + *offset,
|
|
+ iov->iov_base, copy))
|
|
return -EFAULT;
|
|
}
|
|
- to += copy;
|
|
- len -= copy;
|
|
+ *offset += copy;
|
|
+ *remaining -= copy;
|
|
iov->iov_base += copy;
|
|
iov->iov_len -= copy;
|
|
}
|
|
@@ -143,25 +145,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
|
|
}
|
|
|
|
static int
|
|
-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
|
|
- int atomic)
|
|
+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
|
|
+ size_t *remaining, int atomic)
|
|
{
|
|
unsigned long copy;
|
|
|
|
- while (len > 0) {
|
|
+ while (*remaining > 0) {
|
|
while (!iov->iov_len)
|
|
iov++;
|
|
- copy = min_t(unsigned long, len, iov->iov_len);
|
|
+ copy = min_t(unsigned long, *remaining, iov->iov_len);
|
|
|
|
if (atomic) {
|
|
- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
|
|
+ if (__copy_to_user_inatomic(iov->iov_base,
|
|
+ addr + *offset, copy))
|
|
return -EFAULT;
|
|
} else {
|
|
- if (copy_to_user(iov->iov_base, from, copy))
|
|
+ if (copy_to_user(iov->iov_base,
|
|
+ addr + *offset, copy))
|
|
return -EFAULT;
|
|
}
|
|
- from += copy;
|
|
- len -= copy;
|
|
+ *offset += copy;
|
|
+ *remaining -= copy;
|
|
iov->iov_base += copy;
|
|
iov->iov_len -= copy;
|
|
}
|
|
@@ -395,7 +399,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
|
|
struct pipe_buffer *buf = pipe->bufs + curbuf;
|
|
const struct pipe_buf_operations *ops = buf->ops;
|
|
void *addr;
|
|
- size_t chars = buf->len;
|
|
+ size_t chars = buf->len, remaining;
|
|
int error, atomic;
|
|
|
|
if (chars > total_len)
|
|
@@ -409,9 +413,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
|
|
}
|
|
|
|
atomic = !iov_fault_in_pages_write(iov, chars);
|
|
+ remaining = chars;
|
|
redo:
|
|
addr = ops->map(pipe, buf, atomic);
|
|
- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
|
|
+ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
|
|
+ &remaining, atomic);
|
|
ops->unmap(pipe, buf, addr);
|
|
if (unlikely(error)) {
|
|
/*
|
|
@@ -426,7 +432,6 @@ redo:
|
|
break;
|
|
}
|
|
ret += chars;
|
|
- buf->offset += chars;
|
|
buf->len -= chars;
|
|
|
|
/* Was it a packet buffer? Clean up and exit */
|
|
@@ -531,6 +536,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
|
|
if (ops->can_merge && offset + chars <= PAGE_SIZE) {
|
|
int error, atomic = 1;
|
|
void *addr;
|
|
+ size_t remaining = chars;
|
|
|
|
error = ops->confirm(pipe, buf);
|
|
if (error)
|
|
@@ -539,8 +545,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
|
|
iov_fault_in_pages_read(iov, chars);
|
|
redo1:
|
|
addr = ops->map(pipe, buf, atomic);
|
|
- error = pipe_iov_copy_from_user(offset + addr, iov,
|
|
- chars, atomic);
|
|
+ error = pipe_iov_copy_from_user(addr, &offset, iov,
|
|
+ &remaining, atomic);
|
|
ops->unmap(pipe, buf, addr);
|
|
ret = error;
|
|
do_wakeup = 1;
|
|
@@ -575,6 +581,8 @@ redo1:
|
|
struct page *page = pipe->tmp_page;
|
|
char *src;
|
|
int error, atomic = 1;
|
|
+ int offset = 0;
|
|
+ size_t remaining;
|
|
|
|
if (!page) {
|
|
page = alloc_page(GFP_HIGHUSER);
|
|
@@ -595,14 +603,15 @@ redo1:
|
|
chars = total_len;
|
|
|
|
iov_fault_in_pages_read(iov, chars);
|
|
+ remaining = chars;
|
|
redo2:
|
|
if (atomic)
|
|
src = kmap_atomic(page);
|
|
else
|
|
src = kmap(page);
|
|
|
|
- error = pipe_iov_copy_from_user(src, iov, chars,
|
|
- atomic);
|
|
+ error = pipe_iov_copy_from_user(src, &offset, iov,
|
|
+ &remaining, atomic);
|
|
if (atomic)
|
|
kunmap_atomic(src);
|
|
else
|
|
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
|
|
index 8a8631926a07..cb347e85f75e 100644
|
|
--- a/kernel/trace/trace_events_filter.c
|
|
+++ b/kernel/trace/trace_events_filter.c
|
|
@@ -1399,19 +1399,24 @@ static int check_preds(struct filter_parse_state *ps)
|
|
{
|
|
int n_normal_preds = 0, n_logical_preds = 0;
|
|
struct postfix_elt *elt;
|
|
+ int cnt = 0;
|
|
|
|
list_for_each_entry(elt, &ps->postfix, list) {
|
|
- if (elt->op == OP_NONE)
|
|
+ if (elt->op == OP_NONE) {
|
|
+ cnt++;
|
|
continue;
|
|
+ }
|
|
|
|
+ cnt--;
|
|
if (elt->op == OP_AND || elt->op == OP_OR) {
|
|
n_logical_preds++;
|
|
continue;
|
|
}
|
|
n_normal_preds++;
|
|
+ WARN_ON_ONCE(cnt < 0);
|
|
}
|
|
|
|
- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
|
|
+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
|
|
parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
|
|
return -EINVAL;
|
|
}
|