Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3054dc3 authored by jianzhou's avatar jianzhou
Browse files

Merge android-4.9.204(72e85987) into msm-4.9 



* refs/heads/tmp-72e85987:
  Linux 4.9.204
  KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
  powerpc/book3s64: Fix link stack flush on context switch
  powerpc/64s: support nospectre_v2 cmdline option
  staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
  USB: serial: option: add support for Foxconn T77W968 LTE modules
  USB: serial: option: add support for DW5821e with eSIM support
  USB: serial: mos7840: fix remote wakeup
  USB: serial: mos7720: fix remote wakeup
  USB: serial: mos7840: add USB ID to support Moxa UPort 2210
  appledisplay: fix error handling in the scheduled work
  USB: chaoskey: fix error case of a timeout
  usb-serial: cp201x: support Mark-10 digital force gauge
  usbip: tools: fix fd leakage in the function of read_attr_usbip_status
  virtio_console: move removal code
  virtio_console: drop custom control queue cleanup
  virtio_console: fix uninitialized variable use
  virtio_ring: fix return code on DMA mapping fails
  virtio_console: allocate inbufs in add_port() only if it is needed
  virtio_console: don't tie bufs to a vq
  virtio_console: reset on out of memory
  media: imon: invalid dereference in imon_touch_event
  media: cxusb: detect cxusb_ctrl_msg error in query
  media: b2c2-flexcop-usb: add sanity checking
  media: uvcvideo: Fix error path in control parsing failure
  cpufreq: Add NULL checks to show() and store() methods of cpufreq
  media: usbvision: Fix races among open, close, and disconnect
  media: vivid: Fix wrong locking that causes race conditions on streaming stop
  media: vivid: Set vid_cap_streaming and vid_out_streaming to true
  l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
  nfc: port100: handle command failure cleanly
  x86/speculation: Fix redundant MDS mitigation message
  x86/speculation: Fix incorrect MDS/TAA mitigation status
  x86/insn: Fix awk regexp warnings
  ARC: perf: Accommodate big-endian CPU
  ARM: 8904/1: skip nomap memblocks while finding the lowmem/highmem boundary
  ocfs2: remove ocfs2_is_o2cb_active()
  cpufreq: Skip cpufreq resume if it's not suspended
  arm64: fix for bad_mode() handler to always result in panic
  dm: use blk_set_queue_dying() in __dm_destroy()
  ath9k_hw: fix uninitialized variable data
  KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved
  Bluetooth: Fix invalid-free in bcsp_close()
  mm/memory_hotplug: Do not unlock when fails to take the device_hotplug_lock
  spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
  PCI: keystone: Use quirk to limit MRRS for K2G
  pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD
  pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT
  pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues
  sock: Reset dst when changing sk_mark via setsockopt
  net: bcmgenet: return correct value 'ret' from bcmgenet_power_down
  ACPICA: Use %d for signed int print formatting instead of %u
  dlm: don't leak kernel pointer to userspace
  dlm: fix invalid free
  scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces
  scsi: megaraid_sas: Fix msleep granularity
  scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11
  scsi: mpt3sas: Fix Sync cache command failure during driver unload
  rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information
  wireless: airo: potential buffer overflow in sprintf()
  brcmsmac: never log "tid x is not agg'able" by default
  rtl8xxxu: Fix missing break in switch
  wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()'
  audit: print empty EXECVE args
  sched/fair: Don't increase sd->balance_interval on newidle balance
  net: do not abort bulk send on BQL status
  ocfs2: fix clusters leak in ocfs2_defrag_extent()
  ocfs2: don't put and assigning null to bh allocated outside
  arm64: makefile fix build of .i file in external module case
  ntb: intel: fix return value for ndev_vec_mask()
  ntb_netdev: fix sleep time mismatch
  igb: shorten maximum PHC timecounter update interval
  mm/memory_hotplug: make add_memory() take the device_hotplug_lock
  fs/hfs/extent.c: fix array out of bounds read of array extent
  hfs: update timestamp on truncate()
  hfsplus: update timestamps on truncate()
  hfs: fix return value of hfs_get_block()
  hfsplus: fix return value of hfsplus_get_block()
  hfs: prevent btree data loss on ENOSPC
  hfsplus: prevent btree data loss on ENOSPC
  hfs: fix BUG on bnode parent update
  hfsplus: fix BUG on bnode parent update
  linux/bitmap.h: fix type of nbits in bitmap_shift_right()
  linux/bitmap.h: handle constant zero-size bitmaps correctly
  um: Make line/tty semantics use true write IRQ
  macsec: let the administrator set UP state even if lowerdev is down
  macsec: update operstate when lower device changes
  mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock
  fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle()
  sparc64: Rework xchg() definition to avoid warnings.
  powerpc/process: Fix flush_all_to_thread for SPE
  thermal: rcar_thermal: Prevent hardware access during system suspend
  selftests/ftrace: Fix to test kprobe $comm arg only if available
  mfd: max8997: Enale irq-wakeup unconditionally
  mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values
  mfd: arizona: Correct calling of runtime_put_sync
  net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode
  qlcnic: fix a return in qlcnic_dcb_get_capability()
  mISDN: Fix type of switch control variable in ctrl_teimanager
  f2fs: fix to spread clear_cold_data()
  rtc: s35390a: Change buf's type to u8 in s35390a_init
  ceph: fix dentry leak in ceph_readdir_prepopulate
  sparc: Fix parport build warnings.
  spi: omap2-mcspi: Set FIFO DMA trigger level to word length
  s390/perf: Return error when debug_register fails
  atm: zatm: Fix empty body Clang warnings
  sunrpc: safely reallow resvport min/max inversion
  SUNRPC: Fix a compile warning for cmpxchg64()
  usbip: tools: fix atoi() on non-null terminated string
  USB: misc: appledisplay: fix backlight update_status return code
  macintosh/windfarm_smu_sat: Fix debug output
  ALSA: i2c/cs8427: Fix int to char conversion
  kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack
  xfs: fix use-after-free race in xfs_buf_rele
  net: ena: Fix Kconfig dependency on X86
  net: fix warning in af_unix
  scsi: dc395x: fix DMA API usage in sg_update_list
  scsi: dc395x: fix dma API usage in srb_done
  ASoC: tegra_sgtl5000: fix device_node refcounting
  clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk
  scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param
  scsi: isci: Change sci_controller_start_task's return type to sci_status
  scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler
  KVM/x86: Fix invvpid and invept register operand size in 64-bit mode
  scsi: ips: fix missing break in switch
  amiflop: clean up on errors during setup
  m68k: fix command-line parsing when passed from u-boot
  misc: mic: fix a DMA pool free failure
  gsmi: Fix bug in append_to_eventlog sysfs handler
  btrfs: handle error of get_old_root
  mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail
  spi: sh-msiof: fix deferred probing
  ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem
  brcmsmac: AP mode: update beacon when TIM changes
  powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field
  powerpc: Fix signedness bug in update_flash_db()
  synclink_gt(): fix compat_ioctl()
  gfs2: Fix marking bitmaps non-full
  printk: fix integer overflow in setup_log_buf()
  ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback
  mwifiex: Fix NL80211_TX_POWER_LIMITED
  platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
  platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
  mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
  Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()"
  tools: gpio: Correctly add make dependencies for gpio_utils
  gpio: max77620: Fixup debounce delays
  net/sched: act_pedit: fix WARN() in the traffic path
  net/mlx5e: Fix set vf link state error flow
  sfc: Only cancel the PPS workqueue if it exists
  net: rtnetlink: prevent underflows in do_setvfinfo()
  net/mlx4_en: fix mlx4 ethtool -N insertion

  Conflicts:
	drivers/pinctrl/qcom/pinctrl-spmi-gpio.c

Change-Id: I4e2fd2f605dd8552250db79ae7976dbac8223a96
Signed-off-by: default avatarjianzhou <jianzhou@codeaurora.org>
parents 42144868 72e85987

Documentation/hw-vuln/mds.rst

+5 −2
Original line number Diff line number Diff line
@@ -265,8 +265,11 @@ time with the option "mds=". The valid arguments for this option are: 


  ============  =============================================================



Not specifying this option is equivalent to "mds=full".



Not specifying this option is equivalent to "mds=full". For processors

that are affected by both TAA (TSX Asynchronous Abort) and MDS,

specifying just "mds=off" without an accompanying "tsx_async_abort=off"

will have no effect as the same mitigation is used for both

vulnerabilities.



Mitigation selection guide

--------------------------

Documentation/hw-vuln/tsx_async_abort.rst

+4 −1
Original line number Diff line number Diff line
@@ -174,7 +174,10 @@ the option "tsx_async_abort=". The valid arguments for this option are: 
                CPU is not vulnerable to cross-thread TAA attacks.

  ============  =============================================================



Not specifying this option is equivalent to "tsx_async_abort=full".

Not specifying this option is equivalent to "tsx_async_abort=full". For

processors that are affected by both TAA and MDS, specifying just

"tsx_async_abort=off" without an accompanying "mds=off" will have no

effect as the same mitigation is used for both vulnerabilities.



The kernel command line also allows to control the TSX feature using the

parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used

Documentation/kernel-parameters.txt

+11 −0
Original line number Diff line number Diff line
@@ -2387,6 +2387,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 
				     SMT on vulnerable CPUs

			off        - Unconditionally disable MDS mitigation



			On TAA-affected machines, mds=off can be prevented by

			an active TAA mitigation as both vulnerabilities are

			mitigated with the same mechanism so in order to disable

			this mitigation, you need to specify tsx_async_abort=off

			too.



			Not specifying this option is equivalent to

			mds=full.
@@ -4633,6 +4639,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 
				     vulnerable to cross-thread TAA attacks.

			off        - Unconditionally disable TAA mitigation



			On MDS-affected machines, tsx_async_abort=off can be

			prevented by an active MDS mitigation as both vulnerabilities

			are mitigated with the same mechanism so in order to disable

			this mitigation, you need to specify mds=off too.



			Not specifying this option is equivalent to

			tsx_async_abort=full.  On CPUs which are MDS affected

			and deploy MDS mitigation, TAA mitigation is not

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 9

SUBLEVEL = 203

SUBLEVEL = 204

EXTRAVERSION =

NAME = Roaring Lionus

arch/arc/kernel/perf_event.c

+2 −2
Original line number Diff line number Diff line
@@ -488,8 +488,8 @@ static int arc_pmu_device_probe(struct platform_device *pdev) 
	/* loop thru all available h/w condition indexes */

	for (j = 0; j < cc_bcr.c; j++) {

		write_aux_reg(ARC_REG_CC_INDEX, j);

		cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);

		cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);

		cc_name.indiv.word0 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME0));

		cc_name.indiv.word1 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME1));



		/* See if it has been mapped to a perf event_id */

		for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {