I'm announcing the release of the 4.16.10 kernel.
All users of the 4.16 kernel series must upgrade.
The updated 4.16.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.16.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
drivers/infiniband/hw/mlx5/main.c | 2
drivers/net/bonding/bond_alb.c | 15 +
drivers/net/bonding/bond_main.c | 2
drivers/net/ethernet/broadcom/bcmsysport.c | 16 +-
drivers/net/ethernet/broadcom/tg3.c | 9 -
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 16 ++
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 8 -
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 7
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 8 -
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 7
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 20 +-
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 11 +
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 23 +-
drivers/net/ethernet/mellanox/mlxsw/core.c | 4
drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 -
drivers/net/ethernet/netronome/nfp/flower/action.c | 10 +
drivers/net/ethernet/netronome/nfp/flower/cmsg.h | 5
drivers/net/ethernet/realtek/8139too.c | 2
drivers/net/ethernet/realtek/r8169.c | 3
drivers/net/ethernet/sun/niu.c | 5
drivers/net/ethernet/ti/cpsw.c | 2
drivers/net/hyperv/netvsc_drv.c | 3
drivers/net/hyperv/rndis_filter.c | 2
drivers/net/phy/sfp-bus.c | 2
drivers/net/usb/qmi_wwan.c | 12 +
drivers/scsi/aacraid/commsup.c | 8 -
fs/proc/base.c | 8 -
include/linux/mlx5/driver.h | 12 -
include/linux/mm.h | 1
include/net/bonding.h | 1
include/net/tls.h | 1
mm/gup.c | 3
net/bridge/br_if.c | 4
net/compat.c | 6
net/dccp/ccids/ccid2.c | 14 +
net/dccp/timer.c | 2
net/ipv4/ping.c | 7
net/ipv4/route.c | 119 ++++++---------
net/ipv4/tcp.c | 5
net/ipv4/tcp_bbr.c | 4
net/ipv4/udp.c | 11 -
net/ipv6/route.c | 7
net/ipv6/udp.c | 4
net/llc/af_llc.c | 3
net/nsh/nsh.c | 4
net/openvswitch/flow_netlink.c | 9 -
net/rds/recv.c | 1
net/sched/act_skbmod.c | 5
net/sched/cls_api.c | 2
net/sched/sch_fq.c | 37 +++-
net/sctp/associola.c | 30 +++
net/sctp/inqueue.c | 2
net/sctp/ipv6.c | 3
net/sctp/sm_statefuns.c | 88 +++++------
net/sctp/stream.c | 2
net/sctp/ulpevent.c | 1
net/smc/af_smc.c | 18 +-
net/tipc/socket.c | 3
net/tls/tls_main.c | 8 +
60 files changed, 397 insertions(+), 244 deletions(-)
Adi Nissim (1):
net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
Andre Tomt (1):
net/tls: Fix connection stall on partial tls record
Andrey Ignatov (1):
ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
Antoine Tenart (1):
net: phy: sfp: fix the BR,min computation
Bjørn Mork (1):
qmi_wwan: do not steal interfaces from class drivers
Christophe JAILLET (2):
net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'
mlxsw: core: Fix an error handling path in 'mlxsw_core_bus_device_register()'
Dave Carroll (1):
scsi: aacraid: Correct hba_send to include iu_type
Dave Watson (1):
net/tls: Don't recursively call push_record during tls_write_space callbacks
Debabrata Banerjee (2):
bonding: do not allow rlb updates to invalid mac
bonding: send learning packets for vlans on slave
Eric Dumazet (8):
dccp: fix tasklet usage
llc: better deal with too small mtu
net_sched: fq: take care of throttled flows before reuse
rds: do not leak kernel memory to user land
ipv6: fix uninit-value in ip6_multipath_l3_keys()
nsh: fix infinite loop
tcp: restore autocorking
tipc: fix one byte leak in tipc_sk_set_orig_addr()
Florian Fainelli (1):
net: systemport: Correclty disambiguate driver instances
Greg Kroah-Hartman (1):
Linux 4.16.10
Grygorii Strashko (1):
net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode
Hangbin Liu (2):
bridge: check iface upper dev when setting master via ioctl
ipv4: reset fnhe_mtu_locked after cache route flushed
Heiner Kallweit (1):
r8169: fix powering up RTL8168h
Huy Nguyen (1):
net/mlx5e: DCBNL fix min inline header size for dscp
Ido Schimmel (1):
mlxsw: spectrum_switchdev: Do not remove mrouter port from MDB's ports list
Ingo Molnar (1):
8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
Israel Rukshin (1):
net/mlx5: Fix mlx5_get_vector_affinity function
Jianbo Liu (1):
net/mlx5e: Allow offloading ipv4 header re-write for icmp
Jiri Pirko (1):
net: sched: fix error path in tcf_proto_create() when modules are not configured
John Hurley (1):
nfp: flower: set tunnel ttl value to net default
Julian Anastasov (1):
ipv4: fix fnhe usage by non-cached routes
Lance Richardson (1):
net: support compat 64-bit time in {s,g}etsockopt
Michael Chan (1):
tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
Mohammed Gamal (1):
hv_netvsc: Fix net device attach on older Windows hosts
Moshe Shemesh (1):
net/mlx4_en: Verify coalescing parameters are in range
Neal Cardwell (1):
tcp_bbr: fix to zero idle_restart only upon S/ACKed data
Paolo Abeni (1):
udp: fix SO_BINDTODEVICE
Rob Taglang (1):
net: ethernet: sun: niu set correct packet size in skb
Roi Dayan (1):
net/mlx5e: Err if asked to offload TC match on frag being first
Roman Mashak (1):
net sched actions: fix refcnt leak in skbmod
Stefano Brivio (1):
openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
Stephen Hemminger (1):
hv_netvsc: set master device
Talat Batheesh (1):
net/mlx5: Avoid cleaning flow steering table twice during error flow
Tariq Toukan (1):
net/mlx5e: TX, Use correct counter in dma_map error flow
Ursula Braun (2):
net/smc: restrict non-blocking connect finish
net/smc: keep clcsock reference in smc_tcp_listen_work()
Willy Tarreau (1):
proc: do not access cmdline nor environ from file-backed areas
Xin Long (6):
sctp: delay the authentication for the duplicated cookie-echo chunk
sctp: fix the issue that the cookie-ack with auth can't get processed
sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg
sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
sctp: clear the new asoc's stream outcnt in sctp_stream_update
Yuchung Cheng (1):
tcp: ignore Fast Open on repair mode
I'm announcing the release of the 4.14.42 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
drivers/net/bonding/bond_alb.c | 15 +-
drivers/net/bonding/bond_main.c | 2
drivers/net/ethernet/broadcom/tg3.c | 9 -
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 16 ++
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 8 -
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 7 -
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 7 +
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 20 +--
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 11 +-
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 23 ++--
drivers/net/ethernet/realtek/8139too.c | 2
drivers/net/ethernet/realtek/r8169.c | 3
drivers/net/ethernet/sun/niu.c | 5
drivers/net/ethernet/ti/cpsw.c | 2
drivers/net/hyperv/netvsc_drv.c | 3
drivers/net/usb/qmi_wwan.c | 12 ++
drivers/scsi/aacraid/commsup.c | 8 -
fs/btrfs/extent-tree.c | 7 +
fs/proc/base.c | 8 -
include/linux/mm.h | 1
include/net/bonding.h | 1
include/net/tls.h | 1
mm/gup.c | 3
net/bridge/br_if.c | 4
net/compat.c | 6 -
net/dccp/ccids/ccid2.c | 14 ++
net/dccp/timer.c | 2
net/ipv4/ping.c | 7 -
net/ipv4/route.c | 118 +++++++++-------------
net/ipv4/tcp.c | 3
net/ipv4/tcp_bbr.c | 4
net/ipv4/udp.c | 11 +-
net/ipv6/route.c | 7 +
net/ipv6/udp.c | 4
net/l2tp/l2tp_netlink.c | 2
net/llc/af_llc.c | 3
net/nsh/nsh.c | 2
net/openvswitch/flow_netlink.c | 9 -
net/rds/recv.c | 1
net/sched/act_skbmod.c | 5
net/sched/cls_api.c | 2
net/sched/sch_fq.c | 37 ++++--
net/sctp/associola.c | 30 +++++
net/sctp/inqueue.c | 2
net/sctp/ipv6.c | 3
net/sctp/sm_statefuns.c | 88 ++++++++--------
net/sctp/ulpevent.c | 1
net/tls/tls_main.c | 8 +
net/xfrm/xfrm_input.c | 2
net/xfrm/xfrm_state.c | 1
51 files changed, 348 insertions(+), 204 deletions(-)
Adi Nissim (1):
net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
Andre Tomt (1):
net/tls: Fix connection stall on partial tls record
Andrey Ignatov (1):
ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
Antony Antony (1):
xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)
Bjørn Mork (1):
qmi_wwan: do not steal interfaces from class drivers
Christophe JAILLET (1):
net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'
Dave Carroll (1):
scsi: aacraid: Correct hba_send to include iu_type
Dave Watson (1):
net/tls: Don't recursively call push_record during tls_write_space callbacks
Debabrata Banerjee (2):
bonding: do not allow rlb updates to invalid mac
bonding: send learning packets for vlans on slave
Eric Dumazet (6):
dccp: fix tasklet usage
llc: better deal with too small mtu
net_sched: fq: take care of throttled flows before reuse
rds: do not leak kernel memory to user land
ipv6: fix uninit-value in ip6_multipath_l3_keys()
nsh: fix infinite loop
Greg Kroah-Hartman (1):
Linux 4.14.42
Grygorii Strashko (1):
net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode
Hangbin Liu (1):
bridge: check iface upper dev when setting master via ioctl
Heiner Kallweit (1):
r8169: fix powering up RTL8168h
Herbert Xu (1):
xfrm: Use __skb_queue_tail in xfrm_trans_queue
Ingo Molnar (1):
8139too: Use disable_irq_nosync() in rtl8139_poll_controller()
James Chapman (1):
l2tp: revert "l2tp: fix missing print session offset info"
Jianbo Liu (1):
net/mlx5e: Allow offloading ipv4 header re-write for icmp
Jiri Pirko (1):
net: sched: fix error path in tcf_proto_create() when modules are not configured
Julian Anastasov (1):
ipv4: fix fnhe usage by non-cached routes
Lance Richardson (1):
net: support compat 64-bit time in {s,g}etsockopt
Michael Chan (1):
tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().
Moshe Shemesh (1):
net/mlx4_en: Verify coalescing parameters are in range
Neal Cardwell (1):
tcp_bbr: fix to zero idle_restart only upon S/ACKed data
Paolo Abeni (1):
udp: fix SO_BINDTODEVICE
Rob Taglang (1):
net: ethernet: sun: niu set correct packet size in skb
Roi Dayan (1):
net/mlx5e: Err if asked to offload TC match on frag being first
Roman Mashak (1):
net sched actions: fix refcnt leak in skbmod
Stefano Brivio (1):
openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found
Stephen Hemminger (1):
hv_netvsc: set master device
Talat Batheesh (1):
net/mlx5: Avoid cleaning flow steering table twice during error flow
Tariq Toukan (1):
net/mlx5e: TX, Use correct counter in dma_map error flow
Willy Tarreau (1):
proc: do not access cmdline nor environ from file-backed areas
Xin Long (5):
sctp: delay the authentication for the duplicated cookie-echo chunk
sctp: fix the issue that the cookie-ack with auth can't get processed
sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg
sctp: use the old asoc when making the cookie-ack chunk in dupcook_d
Yuchung Cheng (1):
tcp: ignore Fast Open on repair mode
ethanwu (1):
btrfs: Take trans lock before access running trans in check_delayed_ref
The patch below does not apply to the 4.16-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1c1a2ee1b53b006754073eefc65d2b2cedb5264b Mon Sep 17 00:00:00 2001
From: Coly Li <colyli(a)suse.de>
Date: Thu, 17 May 2018 23:33:26 +0800
Subject: [PATCH] bcache: return 0 from bch_debug_init() if CONFIG_DEBUG_FS=n
Commit 539d39eb2708 ("bcache: fix wrong return value in bch_debug_init()")
returns the return value of debugfs_create_dir() to bcache_init(). When
CONFIG_DEBUG_FS=n, bch_debug_init() always returns 1 and makes
bcache_init() failedi.
This patch makes bch_debug_init() always returns 0 if CONFIG_DEBUG_FS=n,
so bcache can continue to work for the kernels which don't have debugfs
enanbled.
Changelog:
v4: Add Acked-by from Kent Overstreet.
v3: Use IS_ENABLED(CONFIG_DEBUG_FS) to replace #ifdef DEBUG_FS.
v2: Remove a warning information
v1: Initial version.
Fixes: Commit 539d39eb2708 ("bcache: fix wrong return value in bch_debug_init()")
Cc: stable(a)vger.kernel.org
Signed-off-by: Coly Li <colyli(a)suse.de>
Reported-by: Massimo B. <massimo.b(a)gmx.net>
Reported-by: Kai Krakow <kai(a)kaishome.de>
Tested-by: Kai Krakow <kai(a)kaishome.de>
Acked-by: Kent Overstreet <kent.overstreet(a)gmail.com>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
index 4e63c6f6c04d..d030ce3025a6 100644
--- a/drivers/md/bcache/debug.c
+++ b/drivers/md/bcache/debug.c
@@ -250,7 +250,9 @@ void bch_debug_exit(void)
int __init bch_debug_init(struct kobject *kobj)
{
- bcache_debug = debugfs_create_dir("bcache", NULL);
+ if (!IS_ENABLED(CONFIG_DEBUG_FS))
+ return 0;
+ bcache_debug = debugfs_create_dir("bcache", NULL);
return IS_ERR_OR_NULL(bcache_debug);
}
On Sun, May 20, 2018 at 10:59:32AM +0200, Kai Krakow wrote:
> Hey Greg!
>
> The v1 version applied for me but it shows a compiler warning. I didn't try
> the newer version yet.
>
> I could prepare a back-ported version.
Backported would be good.
Also, the code really is wrong even with this change. No code path
should ever do anything different if debugfs is enabled or not, or based
on the return value of a debugfs call. No need to check anything here
at all, the function should be:
void __init bch_debug_init(void)
{
bcache_debug = debugfs_create_dir("bcache", NULL);
}
That's it, no checking, and all is fine and good. Any result of a
debugfs call can always be fed back into another debugfs call with no
harm or errors happening.
thanks,
greg k-h
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 23a4d7fd34856da8218c4cfc23dba7a6ec0a423a Mon Sep 17 00:00:00 2001
From: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Date: Wed, 25 Apr 2018 18:35:26 +0200
Subject: [PATCH] s390/ftrace: use expoline for indirect branches
The return from the ftrace_stub, _mcount, ftrace_caller and
return_to_handler functions is done with "br %r14" and "br %r1".
These are indirect branches as well and need to use execute
trampolines for CONFIG_EXPOLINE=y.
The ftrace_caller function is a special case as it returns to the
start of a function and may only use %r0 and %r1. For a pre z10
machine the standard execute trampoline uses a LARL + EX to do
this, but this requires *two* registers in the range %r1..%r15.
To get around this the 'br %r1' located in the lowcore is used,
then the EX instruction does not need an address register.
But the lowcore trick may only be used for pre z14 machines,
with noexec=on the mapping for the first page may not contain
instructions. The solution for that is an ALTERNATIVE in the
expoline THUNK generated by 'GEN_BR_THUNK %r1' to switch to
EXRL, this relies on the fact that a machine that supports
noexec=on has EXRL as well.
Cc: stable(a)vger.kernel.org # 4.16
Fixes: f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Signed-off-by: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
diff --git a/arch/s390/include/asm/nospec-insn.h b/arch/s390/include/asm/nospec-insn.h
index 440689cbcf51..7d7640e1cf90 100644
--- a/arch/s390/include/asm/nospec-insn.h
+++ b/arch/s390/include/asm/nospec-insn.h
@@ -2,12 +2,16 @@
#ifndef _ASM_S390_NOSPEC_ASM_H
#define _ASM_S390_NOSPEC_ASM_H
+#include <asm/alternative-asm.h>
+#include <asm/asm-offsets.h>
#include <asm/dwarf.h>
#ifdef __ASSEMBLY__
#ifdef CONFIG_EXPOLINE
+_LC_BR_R1 = __LC_BR_R1
+
/*
* The expoline macros are used to create thunks in the same format
* as gcc generates them. The 'comdat' section flag makes sure that
@@ -78,13 +82,21 @@
.endm
.macro __THUNK_EX_BR reg,ruse
+ # Be very careful when adding instructions to this macro!
+ # The ALTERNATIVE replacement code has a .+10 which targets
+ # the "br \reg" after the code has been patched.
#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
exrl 0,555f
j .
#else
+ .ifc \reg,%r1
+ ALTERNATIVE "ex %r0,_LC_BR_R1", ".insn ril,0xc60000000000,0,.+10", 35
+ j .
+ .else
larl \ruse,555f
ex 0,0(\ruse)
j .
+ .endif
#endif
555: br \reg
.endm
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index eb2a5c0443cd..11aea745a2a6 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -181,6 +181,7 @@ int main(void)
OFFSET(__LC_MACHINE_FLAGS, lowcore, machine_flags);
OFFSET(__LC_PREEMPT_COUNT, lowcore, preempt_count);
OFFSET(__LC_GMAP, lowcore, gmap);
+ OFFSET(__LC_BR_R1, lowcore, br_r1_trampoline);
/* software defined ABI-relevant lowcore locations 0xe00 - 0xe20 */
OFFSET(__LC_DUMP_REIPL, lowcore, ipib);
/* hardware defined lowcore locations 0x1000 - 0x18ff */
diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
index 82df7d80fab2..27110f3294ed 100644
--- a/arch/s390/kernel/mcount.S
+++ b/arch/s390/kernel/mcount.S
@@ -9,13 +9,17 @@
#include <linux/linkage.h>
#include <asm/asm-offsets.h>
#include <asm/ftrace.h>
+#include <asm/nospec-insn.h>
#include <asm/ptrace.h>
#include <asm/export.h>
+ GEN_BR_THUNK %r1
+ GEN_BR_THUNK %r14
+
.section .kprobes.text, "ax"
ENTRY(ftrace_stub)
- br %r14
+ BR_EX %r14
#define STACK_FRAME_SIZE (STACK_FRAME_OVERHEAD + __PT_SIZE)
#define STACK_PTREGS (STACK_FRAME_OVERHEAD)
@@ -23,7 +27,7 @@ ENTRY(ftrace_stub)
#define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
ENTRY(_mcount)
- br %r14
+ BR_EX %r14
EXPORT_SYMBOL(_mcount)
@@ -53,7 +57,7 @@ ENTRY(ftrace_caller)
#endif
lgr %r3,%r14
la %r5,STACK_PTREGS(%r15)
- basr %r14,%r1
+ BASR_EX %r14,%r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
# The j instruction gets runtime patched to a nop instruction.
# See ftrace_enable_ftrace_graph_caller.
@@ -68,7 +72,7 @@ ftrace_graph_caller_end:
#endif
lg %r1,(STACK_PTREGS_PSW+8)(%r15)
lmg %r2,%r15,(STACK_PTREGS_GPRS+2*8)(%r15)
- br %r1
+ BR_EX %r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
@@ -81,6 +85,6 @@ ENTRY(return_to_handler)
aghi %r15,STACK_FRAME_OVERHEAD
lgr %r14,%r2
lmg %r2,%r5,32(%r15)
- br %r14
+ BR_EX %r14
#endif
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 23a4d7fd34856da8218c4cfc23dba7a6ec0a423a Mon Sep 17 00:00:00 2001
From: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Date: Wed, 25 Apr 2018 18:35:26 +0200
Subject: [PATCH] s390/ftrace: use expoline for indirect branches
The return from the ftrace_stub, _mcount, ftrace_caller and
return_to_handler functions is done with "br %r14" and "br %r1".
These are indirect branches as well and need to use execute
trampolines for CONFIG_EXPOLINE=y.
The ftrace_caller function is a special case as it returns to the
start of a function and may only use %r0 and %r1. For a pre z10
machine the standard execute trampoline uses a LARL + EX to do
this, but this requires *two* registers in the range %r1..%r15.
To get around this the 'br %r1' located in the lowcore is used,
then the EX instruction does not need an address register.
But the lowcore trick may only be used for pre z14 machines,
with noexec=on the mapping for the first page may not contain
instructions. The solution for that is an ALTERNATIVE in the
expoline THUNK generated by 'GEN_BR_THUNK %r1' to switch to
EXRL, this relies on the fact that a machine that supports
noexec=on has EXRL as well.
Cc: stable(a)vger.kernel.org # 4.16
Fixes: f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Signed-off-by: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
diff --git a/arch/s390/include/asm/nospec-insn.h b/arch/s390/include/asm/nospec-insn.h
index 440689cbcf51..7d7640e1cf90 100644
--- a/arch/s390/include/asm/nospec-insn.h
+++ b/arch/s390/include/asm/nospec-insn.h
@@ -2,12 +2,16 @@
#ifndef _ASM_S390_NOSPEC_ASM_H
#define _ASM_S390_NOSPEC_ASM_H
+#include <asm/alternative-asm.h>
+#include <asm/asm-offsets.h>
#include <asm/dwarf.h>
#ifdef __ASSEMBLY__
#ifdef CONFIG_EXPOLINE
+_LC_BR_R1 = __LC_BR_R1
+
/*
* The expoline macros are used to create thunks in the same format
* as gcc generates them. The 'comdat' section flag makes sure that
@@ -78,13 +82,21 @@
.endm
.macro __THUNK_EX_BR reg,ruse
+ # Be very careful when adding instructions to this macro!
+ # The ALTERNATIVE replacement code has a .+10 which targets
+ # the "br \reg" after the code has been patched.
#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
exrl 0,555f
j .
#else
+ .ifc \reg,%r1
+ ALTERNATIVE "ex %r0,_LC_BR_R1", ".insn ril,0xc60000000000,0,.+10", 35
+ j .
+ .else
larl \ruse,555f
ex 0,0(\ruse)
j .
+ .endif
#endif
555: br \reg
.endm
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index eb2a5c0443cd..11aea745a2a6 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -181,6 +181,7 @@ int main(void)
OFFSET(__LC_MACHINE_FLAGS, lowcore, machine_flags);
OFFSET(__LC_PREEMPT_COUNT, lowcore, preempt_count);
OFFSET(__LC_GMAP, lowcore, gmap);
+ OFFSET(__LC_BR_R1, lowcore, br_r1_trampoline);
/* software defined ABI-relevant lowcore locations 0xe00 - 0xe20 */
OFFSET(__LC_DUMP_REIPL, lowcore, ipib);
/* hardware defined lowcore locations 0x1000 - 0x18ff */
diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
index 82df7d80fab2..27110f3294ed 100644
--- a/arch/s390/kernel/mcount.S
+++ b/arch/s390/kernel/mcount.S
@@ -9,13 +9,17 @@
#include <linux/linkage.h>
#include <asm/asm-offsets.h>
#include <asm/ftrace.h>
+#include <asm/nospec-insn.h>
#include <asm/ptrace.h>
#include <asm/export.h>
+ GEN_BR_THUNK %r1
+ GEN_BR_THUNK %r14
+
.section .kprobes.text, "ax"
ENTRY(ftrace_stub)
- br %r14
+ BR_EX %r14
#define STACK_FRAME_SIZE (STACK_FRAME_OVERHEAD + __PT_SIZE)
#define STACK_PTREGS (STACK_FRAME_OVERHEAD)
@@ -23,7 +27,7 @@ ENTRY(ftrace_stub)
#define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
ENTRY(_mcount)
- br %r14
+ BR_EX %r14
EXPORT_SYMBOL(_mcount)
@@ -53,7 +57,7 @@ ENTRY(ftrace_caller)
#endif
lgr %r3,%r14
la %r5,STACK_PTREGS(%r15)
- basr %r14,%r1
+ BASR_EX %r14,%r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
# The j instruction gets runtime patched to a nop instruction.
# See ftrace_enable_ftrace_graph_caller.
@@ -68,7 +72,7 @@ ftrace_graph_caller_end:
#endif
lg %r1,(STACK_PTREGS_PSW+8)(%r15)
lmg %r2,%r15,(STACK_PTREGS_GPRS+2*8)(%r15)
- br %r1
+ BR_EX %r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
@@ -81,6 +85,6 @@ ENTRY(return_to_handler)
aghi %r15,STACK_FRAME_OVERHEAD
lgr %r14,%r2
lmg %r2,%r5,32(%r15)
- br %r14
+ BR_EX %r14
#endif
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 23a4d7fd34856da8218c4cfc23dba7a6ec0a423a Mon Sep 17 00:00:00 2001
From: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Date: Wed, 25 Apr 2018 18:35:26 +0200
Subject: [PATCH] s390/ftrace: use expoline for indirect branches
The return from the ftrace_stub, _mcount, ftrace_caller and
return_to_handler functions is done with "br %r14" and "br %r1".
These are indirect branches as well and need to use execute
trampolines for CONFIG_EXPOLINE=y.
The ftrace_caller function is a special case as it returns to the
start of a function and may only use %r0 and %r1. For a pre z10
machine the standard execute trampoline uses a LARL + EX to do
this, but this requires *two* registers in the range %r1..%r15.
To get around this the 'br %r1' located in the lowcore is used,
then the EX instruction does not need an address register.
But the lowcore trick may only be used for pre z14 machines,
with noexec=on the mapping for the first page may not contain
instructions. The solution for that is an ALTERNATIVE in the
expoline THUNK generated by 'GEN_BR_THUNK %r1' to switch to
EXRL, this relies on the fact that a machine that supports
noexec=on has EXRL as well.
Cc: stable(a)vger.kernel.org # 4.16
Fixes: f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Signed-off-by: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
diff --git a/arch/s390/include/asm/nospec-insn.h b/arch/s390/include/asm/nospec-insn.h
index 440689cbcf51..7d7640e1cf90 100644
--- a/arch/s390/include/asm/nospec-insn.h
+++ b/arch/s390/include/asm/nospec-insn.h
@@ -2,12 +2,16 @@
#ifndef _ASM_S390_NOSPEC_ASM_H
#define _ASM_S390_NOSPEC_ASM_H
+#include <asm/alternative-asm.h>
+#include <asm/asm-offsets.h>
#include <asm/dwarf.h>
#ifdef __ASSEMBLY__
#ifdef CONFIG_EXPOLINE
+_LC_BR_R1 = __LC_BR_R1
+
/*
* The expoline macros are used to create thunks in the same format
* as gcc generates them. The 'comdat' section flag makes sure that
@@ -78,13 +82,21 @@
.endm
.macro __THUNK_EX_BR reg,ruse
+ # Be very careful when adding instructions to this macro!
+ # The ALTERNATIVE replacement code has a .+10 which targets
+ # the "br \reg" after the code has been patched.
#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
exrl 0,555f
j .
#else
+ .ifc \reg,%r1
+ ALTERNATIVE "ex %r0,_LC_BR_R1", ".insn ril,0xc60000000000,0,.+10", 35
+ j .
+ .else
larl \ruse,555f
ex 0,0(\ruse)
j .
+ .endif
#endif
555: br \reg
.endm
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index eb2a5c0443cd..11aea745a2a6 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -181,6 +181,7 @@ int main(void)
OFFSET(__LC_MACHINE_FLAGS, lowcore, machine_flags);
OFFSET(__LC_PREEMPT_COUNT, lowcore, preempt_count);
OFFSET(__LC_GMAP, lowcore, gmap);
+ OFFSET(__LC_BR_R1, lowcore, br_r1_trampoline);
/* software defined ABI-relevant lowcore locations 0xe00 - 0xe20 */
OFFSET(__LC_DUMP_REIPL, lowcore, ipib);
/* hardware defined lowcore locations 0x1000 - 0x18ff */
diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
index 82df7d80fab2..27110f3294ed 100644
--- a/arch/s390/kernel/mcount.S
+++ b/arch/s390/kernel/mcount.S
@@ -9,13 +9,17 @@
#include <linux/linkage.h>
#include <asm/asm-offsets.h>
#include <asm/ftrace.h>
+#include <asm/nospec-insn.h>
#include <asm/ptrace.h>
#include <asm/export.h>
+ GEN_BR_THUNK %r1
+ GEN_BR_THUNK %r14
+
.section .kprobes.text, "ax"
ENTRY(ftrace_stub)
- br %r14
+ BR_EX %r14
#define STACK_FRAME_SIZE (STACK_FRAME_OVERHEAD + __PT_SIZE)
#define STACK_PTREGS (STACK_FRAME_OVERHEAD)
@@ -23,7 +27,7 @@ ENTRY(ftrace_stub)
#define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
ENTRY(_mcount)
- br %r14
+ BR_EX %r14
EXPORT_SYMBOL(_mcount)
@@ -53,7 +57,7 @@ ENTRY(ftrace_caller)
#endif
lgr %r3,%r14
la %r5,STACK_PTREGS(%r15)
- basr %r14,%r1
+ BASR_EX %r14,%r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
# The j instruction gets runtime patched to a nop instruction.
# See ftrace_enable_ftrace_graph_caller.
@@ -68,7 +72,7 @@ ftrace_graph_caller_end:
#endif
lg %r1,(STACK_PTREGS_PSW+8)(%r15)
lmg %r2,%r15,(STACK_PTREGS_GPRS+2*8)(%r15)
- br %r1
+ BR_EX %r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
@@ -81,6 +85,6 @@ ENTRY(return_to_handler)
aghi %r15,STACK_FRAME_OVERHEAD
lgr %r14,%r2
lmg %r2,%r5,32(%r15)
- br %r14
+ BR_EX %r14
#endif
The patch below does not apply to the 4.16-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 23a4d7fd34856da8218c4cfc23dba7a6ec0a423a Mon Sep 17 00:00:00 2001
From: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
Date: Wed, 25 Apr 2018 18:35:26 +0200
Subject: [PATCH] s390/ftrace: use expoline for indirect branches
The return from the ftrace_stub, _mcount, ftrace_caller and
return_to_handler functions is done with "br %r14" and "br %r1".
These are indirect branches as well and need to use execute
trampolines for CONFIG_EXPOLINE=y.
The ftrace_caller function is a special case as it returns to the
start of a function and may only use %r0 and %r1. For a pre z10
machine the standard execute trampoline uses a LARL + EX to do
this, but this requires *two* registers in the range %r1..%r15.
To get around this the 'br %r1' located in the lowcore is used,
then the EX instruction does not need an address register.
But the lowcore trick may only be used for pre z14 machines,
with noexec=on the mapping for the first page may not contain
instructions. The solution for that is an ALTERNATIVE in the
expoline THUNK generated by 'GEN_BR_THUNK %r1' to switch to
EXRL, this relies on the fact that a machine that supports
noexec=on has EXRL as well.
Cc: stable(a)vger.kernel.org # 4.16
Fixes: f19fbd5ed6 ("s390: introduce execute-trampolines for branches")
Signed-off-by: Martin Schwidefsky <schwidefsky(a)de.ibm.com>
diff --git a/arch/s390/include/asm/nospec-insn.h b/arch/s390/include/asm/nospec-insn.h
index 440689cbcf51..7d7640e1cf90 100644
--- a/arch/s390/include/asm/nospec-insn.h
+++ b/arch/s390/include/asm/nospec-insn.h
@@ -2,12 +2,16 @@
#ifndef _ASM_S390_NOSPEC_ASM_H
#define _ASM_S390_NOSPEC_ASM_H
+#include <asm/alternative-asm.h>
+#include <asm/asm-offsets.h>
#include <asm/dwarf.h>
#ifdef __ASSEMBLY__
#ifdef CONFIG_EXPOLINE
+_LC_BR_R1 = __LC_BR_R1
+
/*
* The expoline macros are used to create thunks in the same format
* as gcc generates them. The 'comdat' section flag makes sure that
@@ -78,13 +82,21 @@
.endm
.macro __THUNK_EX_BR reg,ruse
+ # Be very careful when adding instructions to this macro!
+ # The ALTERNATIVE replacement code has a .+10 which targets
+ # the "br \reg" after the code has been patched.
#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
exrl 0,555f
j .
#else
+ .ifc \reg,%r1
+ ALTERNATIVE "ex %r0,_LC_BR_R1", ".insn ril,0xc60000000000,0,.+10", 35
+ j .
+ .else
larl \ruse,555f
ex 0,0(\ruse)
j .
+ .endif
#endif
555: br \reg
.endm
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index eb2a5c0443cd..11aea745a2a6 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -181,6 +181,7 @@ int main(void)
OFFSET(__LC_MACHINE_FLAGS, lowcore, machine_flags);
OFFSET(__LC_PREEMPT_COUNT, lowcore, preempt_count);
OFFSET(__LC_GMAP, lowcore, gmap);
+ OFFSET(__LC_BR_R1, lowcore, br_r1_trampoline);
/* software defined ABI-relevant lowcore locations 0xe00 - 0xe20 */
OFFSET(__LC_DUMP_REIPL, lowcore, ipib);
/* hardware defined lowcore locations 0x1000 - 0x18ff */
diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
index 82df7d80fab2..27110f3294ed 100644
--- a/arch/s390/kernel/mcount.S
+++ b/arch/s390/kernel/mcount.S
@@ -9,13 +9,17 @@
#include <linux/linkage.h>
#include <asm/asm-offsets.h>
#include <asm/ftrace.h>
+#include <asm/nospec-insn.h>
#include <asm/ptrace.h>
#include <asm/export.h>
+ GEN_BR_THUNK %r1
+ GEN_BR_THUNK %r14
+
.section .kprobes.text, "ax"
ENTRY(ftrace_stub)
- br %r14
+ BR_EX %r14
#define STACK_FRAME_SIZE (STACK_FRAME_OVERHEAD + __PT_SIZE)
#define STACK_PTREGS (STACK_FRAME_OVERHEAD)
@@ -23,7 +27,7 @@ ENTRY(ftrace_stub)
#define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
ENTRY(_mcount)
- br %r14
+ BR_EX %r14
EXPORT_SYMBOL(_mcount)
@@ -53,7 +57,7 @@ ENTRY(ftrace_caller)
#endif
lgr %r3,%r14
la %r5,STACK_PTREGS(%r15)
- basr %r14,%r1
+ BASR_EX %r14,%r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
# The j instruction gets runtime patched to a nop instruction.
# See ftrace_enable_ftrace_graph_caller.
@@ -68,7 +72,7 @@ ftrace_graph_caller_end:
#endif
lg %r1,(STACK_PTREGS_PSW+8)(%r15)
lmg %r2,%r15,(STACK_PTREGS_GPRS+2*8)(%r15)
- br %r1
+ BR_EX %r1
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
@@ -81,6 +85,6 @@ ENTRY(return_to_handler)
aghi %r15,STACK_FRAME_OVERHEAD
lgr %r14,%r2
lmg %r2,%r5,32(%r15)
- br %r14
+ BR_EX %r14
#endif