Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d309c99 authored by Srinivasarao P's avatar Srinivasarao P
Browse files

Merge android-4.4.107 (79f138ac) into msm-4.4 



* refs/heads/tmp-79f138ac
  Linux 4.4.107
  ath9k: fix tx99 potential info leak
  IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
  RDMA/cma: Avoid triggering undefined behavior
  macvlan: Only deliver one copy of the frame to the macvlan interface
  udf: Avoid overflow when session starts at large offset
  scsi: bfa: integer overflow in debugfs
  scsi: sd: change allow_restart to bool in sysfs interface
  scsi: sd: change manage_start_stop to bool in sysfs interface
  vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
  scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
  raid5: Set R5_Expanded on parity devices as well as data.
  pinctrl: adi2: Fix Kconfig build problem
  usb: musb: da8xx: fix babble condition handling
  tty fix oops when rmmod 8250
  powerpc/perf/hv-24x7: Fix incorrect comparison in memord
  scsi: hpsa: destroy sas transport properties before scsi_host
  scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
  PCI: Detach driver before procfs & sysfs teardown on device remove
  xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
  xfs: fix log block underflow during recovery cycle verification
  l2tp: cleanup l2tp_tunnel_delete calls
  bcache: fix wrong cache_misses statistics
  bcache: explicitly destroy mutex while exiting
  GFS2: Take inode off order_write list when setting jdata flag
  thermal/drivers/step_wise: Fix temperature regulation misbehavior
  ppp: Destroy the mutex when cleanup
  clk: tegra: Fix cclk_lp divisor register
  clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
  clk: mediatek: add the option for determining PLL source clock
  mm: Handle 0 flags in _calc_vm_trans() macro
  crypto: tcrypt - fix buffer lengths in test_aead_speed()
  arm-ccn: perf: Prevent module unload while PMU is in use
  target/file: Do not return error for UNMAP if length is zero
  target:fix condition return in core_pr_dump_initiator_port()
  iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
  target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
  powerpc/ipic: Fix status get and status clear
  powerpc/opal: Fix EBUSY bug in acquiring tokens
  netfilter: ipvs: Fix inappropriate output of procfs
  powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
  PCI/PME: Handle invalid data when reading Root Status
  dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
  rtc: pcf8563: fix output clock rate
  video: fbdev: au1200fb: Return an error code if a memory allocation fails
  video: fbdev: au1200fb: Release some resources if a memory allocation fails
  video: udlfb: Fix read EDID timeout
  fbdev: controlfb: Add missing modes to fix out of bounds access
  sfc: don't warn on successful change of MAC
  target: fix race during implicit transition work flushes
  target: fix ALUA transition timeout handling
  target: Use system workqueue for ALUA transitions
  btrfs: add missing memset while reading compressed inline extents
  NFSv4.1 respect server's max size in CREATE_SESSION
  efi/esrt: Cleanup bad memory map log messages
  perf symbols: Fix symbols__fixup_end heuristic for corner cases
  net/mlx4_core: Avoid delays during VF driver device shutdown
  afs: Fix afs_kill_pages()
  afs: Fix page leak in afs_write_begin()
  afs: Populate and use client modification time
  afs: Fix the maths in afs_fs_store_data()
  afs: Prevent callback expiry timer overflow
  afs: Migrate vlocation fields to 64-bit
  afs: Flush outstanding writes when an fd is closed
  afs: Adjust mode bits processing
  afs: Populate group ID from vnode status
  afs: Fix missing put_page()
  drm/radeon: reinstate oland workaround for sclk
  mmc: mediatek: Fixed bug where clock frequency could be set wrong
  sched/deadline: Use deadline instead of period when calculating overflow
  sched/deadline: Throttle a constrained deadline task activated after the deadline
  sched/deadline: Make sure the replenishment timer fires in the next period
  drm/radeon/si: add dpm quirk for Oland
  fjes: Fix wrong netdevice feature flags
  scsi: hpsa: limit outstanding rescans
  scsi: hpsa: update check for logical volume status
  openrisc: fix issue handling 8 byte get_user calls
  intel_th: pci: Add Gemini Lake support
  mlxsw: reg: Fix SPVMLR max record count
  mlxsw: reg: Fix SPVM max record count
  net: Resend IGMP memberships upon peer notification.
  dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
  net: wimax/i2400m: fix NULL-deref at probe
  writeback: fix memory leak in wb_queue_work()
  netfilter: bridge: honor frag_max_size when refragmenting
  drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
  Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
  NFSD: fix nfsd_reset_versions for NFSv4.
  NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
  net: bcmgenet: Power up the internal PHY before probing the MII
  net: bcmgenet: power down internal phy if open or resume fails
  net: bcmgenet: reserved phy revisions must be checked first
  net: bcmgenet: correct MIB access of UniMAC RUNT counters
  net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
  net: initialize msg.msg_flags in recvfrom
  userfaultfd: selftest: vm: allow to build in vm/ directory
  userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
  md-cluster: free md_cluster_info if node leave cluster
  usb: phy: isp1301: Add OF device ID table
  mac80211: Fix addition of mesh configuration element
  KEYS: add missing permission check for request_key() destination
  ext4: fix crash when a directory's i_size is too small
  ext4: fix fdatasync(2) after fallocate(2) operation
  dmaengine: dmatest: move callback wait queue to thread context
  sched/rt: Do not pull from current CPU if only one CPU to pull
  xhci: Don't add a virt_dev to the devs array before it's fully allocated
  Bluetooth: btusb: driver to enable the usb-wakeup feature
  ceph: drop negative child dentries before try pruning inode's alias
  usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
  USB: core: prevent malicious bNumInterfaces overflow
  USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
  tracing: Allocate mask_str buffer dynamically
  autofs: fix careless error in recent commit
  crypto: salsa20 - fix blkcipher_walk API usage
  crypto: hmac - require that the underlying hash algorithm is unkeyed
  UPSTREAM: arm64: setup: introduce kaslr_offset()
  UPSTREAM: kcov: fix comparison callback signature
  UPSTREAM: kcov: support comparison operands collection
  UPSTREAM: kcov: remove pointless current != NULL check
  UPSTREAM: kcov: support compat processes
  UPSTREAM: kcov: simplify interrupt check
  UPSTREAM: kcov: make kcov work properly with KASLR enabled
  UPSTREAM: kcov: add more missing includes
  UPSTREAM: kcov: add missing #include <linux/sched.h>
  UPSTREAM: kcov: properly check if we are in an interrupt
  UPSTREAM: kcov: don't profile branches in kcov
  UPSTREAM: kcov: don't trace the code coverage code
  BACKPORT: kernel: add kcov code coverage

Conflicts:
	Makefile
	mm/kasan/Makefile
	scripts/Makefile.lib

Change-Id: Ic19953706ea2e700621b0ba94d1c90bbffa4f471
Signed-off-by: default avatarSrinivasarao P <spathi@codeaurora.org>
parents dd4f1e35 79f138ac

Documentation/kcov.txt

0 → 100644
+111 −0
Original line number Diff line number Diff line 
kcov: code coverage for fuzzing

===============================



kcov exposes kernel code coverage information in a form suitable for coverage-

guided fuzzing (randomized testing). Coverage data of a running kernel is

exported via the "kcov" debugfs file. Coverage collection is enabled on a task

basis, and thus it can capture precise coverage of a single system call.



Note that kcov does not aim to collect as much coverage as possible. It aims

to collect more or less stable coverage that is function of syscall inputs.

To achieve this goal it does not collect coverage in soft/hard interrupts

and instrumentation of some inherently non-deterministic parts of kernel is

disbled (e.g. scheduler, locking).



Usage:

======



Configure kernel with:



        CONFIG_KCOV=y



CONFIG_KCOV requires gcc built on revision 231296 or later.

Profiling data will only become accessible once debugfs has been mounted:



        mount -t debugfs none /sys/kernel/debug



The following program demonstrates kcov usage from within a test program:



#include <stdio.h>

#include <stddef.h>

#include <stdint.h>

#include <stdlib.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <sys/ioctl.h>

#include <sys/mman.h>

#include <unistd.h>

#include <fcntl.h>



#define KCOV_INIT_TRACE			_IOR('c', 1, unsigned long)

#define KCOV_ENABLE			_IO('c', 100)

#define KCOV_DISABLE			_IO('c', 101)

#define COVER_SIZE			(64<<10)



int main(int argc, char **argv)

{

	int fd;

	unsigned long *cover, n, i;



	/* A single fd descriptor allows coverage collection on a single

	 * thread.

	 */

	fd = open("/sys/kernel/debug/kcov", O_RDWR);

	if (fd == -1)

		perror("open"), exit(1);

	/* Setup trace mode and trace size. */

	if (ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE))

		perror("ioctl"), exit(1);

	/* Mmap buffer shared between kernel- and user-space. */

	cover = (unsigned long*)mmap(NULL, COVER_SIZE * sizeof(unsigned long),

				     PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

	if ((void*)cover == MAP_FAILED)

		perror("mmap"), exit(1);

	/* Enable coverage collection on the current thread. */

	if (ioctl(fd, KCOV_ENABLE, 0))

		perror("ioctl"), exit(1);

	/* Reset coverage from the tail of the ioctl() call. */

	__atomic_store_n(&cover[0], 0, __ATOMIC_RELAXED);

	/* That's the target syscal call. */

	read(-1, NULL, 0);

	/* Read number of PCs collected. */

	n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED);

	for (i = 0; i < n; i++)

		printf("0x%lx\n", cover[i + 1]);

	/* Disable coverage collection for the current thread. After this call

	 * coverage can be enabled for a different thread.

	 */

	if (ioctl(fd, KCOV_DISABLE, 0))

		perror("ioctl"), exit(1);

	/* Free resources. */

	if (munmap(cover, COVER_SIZE * sizeof(unsigned long)))

		perror("munmap"), exit(1);

	if (close(fd))

		perror("close"), exit(1);

	return 0;

}



After piping through addr2line output of the program looks as follows:



SyS_read

fs/read_write.c:562

__fdget_pos

fs/file.c:774

__fget_light

fs/file.c:746

__fget_light

fs/file.c:750

__fget_light

fs/file.c:760

__fdget_pos

fs/file.c:784

SyS_read

fs/read_write.c:562



If a program needs to collect coverage from several threads (independently),

it needs to open /sys/kernel/debug/kcov in each thread separately.



The interface is fine-grained to allow efficient forking of test processes.

That is, a parent process opens /sys/kernel/debug/kcov, enables trace mode,

mmaps coverage buffer and then forks child processes in a loop. Child processes

only need to enable coverage (disable happens automatically on thread end).

Makefile

+11 −2
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 4

SUBLEVEL = 106

SUBLEVEL = 107

EXTRAVERSION =

NAME = Blurry Fish Butt
@@ -373,6 +373,7 @@ LDFLAGS_MODULE = 
CFLAGS_KERNEL	=

AFLAGS_KERNEL	=

CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage -fno-tree-loop-im

CFLAGS_KCOV	= -fsanitize-coverage=trace-pc





# Use USERINCLUDE when you must reference the UAPI directories only.
@@ -420,7 +421,7 @@ export MAKE AWK GENKSYMS INSTALLKERNEL PERL PYTHON UTS_MACHINE 
export HOSTCXX HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS



export KBUILD_CPPFLAGS NOSTDINC_FLAGS LINUXINCLUDE OBJCOPYFLAGS LDFLAGS

export KBUILD_CFLAGS CFLAGS_KERNEL CFLAGS_MODULE CFLAGS_GCOV CFLAGS_KASAN CFLAGS_UBSAN

export KBUILD_CFLAGS CFLAGS_KERNEL CFLAGS_MODULE CFLAGS_GCOV CFLAGS_KCOV CFLAGS_KASAN CFLAGS_UBSAN

export KBUILD_AFLAGS AFLAGS_KERNEL AFLAGS_MODULE

export KBUILD_AFLAGS_MODULE KBUILD_CFLAGS_MODULE KBUILD_LDFLAGS_MODULE

export KBUILD_AFLAGS_KERNEL KBUILD_CFLAGS_KERNEL
@@ -697,6 +698,14 @@ endif 
endif

KBUILD_CFLAGS += $(stackp-flag)



ifdef CONFIG_KCOV

  ifeq ($(call cc-option, $(CFLAGS_KCOV)),)

    $(warning Cannot use CONFIG_KCOV: \

             -fsanitize-coverage=trace-pc is not supported by compiler)

    CFLAGS_KCOV =

  endif

endif



ifeq ($(cc-name),clang)

ifneq ($(CROSS_COMPILE),)

CLANG_TRIPLE    ?= $(CROSS_COMPILE)

arch/arm64/include/asm/memory.h

+5 −0
Original line number Diff line number Diff line
@@ -148,6 +148,11 @@ extern u64 kimage_vaddr; 
/* the offset between the kernel virtual and physical mappings */

extern u64			kimage_voffset;



static inline unsigned long kaslr_offset(void)

{

	return kimage_vaddr - KIMAGE_VADDR;

}



/*

 * Allow all memory at the discovery stage. We will clip it later.

 */

arch/arm64/kernel/setup.c

+4 −4
Original line number Diff line number Diff line
@@ -429,11 +429,11 @@ void arch_setup_pdev_archdata(struct platform_device *pdev) 
static int dump_kernel_offset(struct notifier_block *self, unsigned long v,

			      void *p)

{

	u64 const kaslr_offset = kimage_vaddr - KIMAGE_VADDR;

	const unsigned long offset = kaslr_offset();



	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && kaslr_offset > 0) {

		pr_emerg("Kernel Offset: 0x%llx from 0x%lx\n",

			 kaslr_offset, KIMAGE_VADDR);

	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && offset > 0) {

		pr_emerg("Kernel Offset: 0x%lx from 0x%lx\n",

			 offset, KIMAGE_VADDR);

	} else {

		pr_emerg("Kernel Offset: disabled\n");

	}

arch/blackfin/Kconfig

+5 −2
Original line number Diff line number Diff line
@@ -318,11 +318,14 @@ config BF53x 


config GPIO_ADI

	def_bool y

	depends on !PINCTRL

	depends on (BF51x || BF52x || BF53x || BF538 || BF539 || BF561)



config PINCTRL

config PINCTRL_BLACKFIN_ADI2

	def_bool y

	depends on BF54x || BF60x

	depends on (BF54x || BF60x)

	select PINCTRL

	select PINCTRL_ADI2



config MEM_MT48LC64M4A2FB_7E

	bool