Commit 8b8dc695 authored by Michael Ellerman's avatar Michael Ellerman
Browse files

Merge branch 'fixes' into next 

Merge our fixes branch into next, this brings in a number of commits
that fix bugs we don't want to hit in next, in particular the fix for
CVE-2019-12817.
parents 3c25ab35 b7cbb524

arch/powerpc/include/asm/book3s/64/pgtable.h

+30 −0
Original line number Diff line number Diff line
@@ -884,6 +884,23 @@ static inline int pmd_present(pmd_t pmd) 
	return false;

}



static inline int pmd_is_serializing(pmd_t pmd)

{

	/*

	 * If the pmd is undergoing a split, the _PAGE_PRESENT bit is clear

	 * and _PAGE_INVALID is set (see pmd_present, pmdp_invalidate).

	 *

	 * This condition may also occur when flushing a pmd while flushing

	 * it (see ptep_modify_prot_start), so callers must ensure this

	 * case is fine as well.

	 */

	if ((pmd_raw(pmd) & cpu_to_be64(_PAGE_PRESENT | _PAGE_INVALID)) ==

						cpu_to_be64(_PAGE_INVALID))

		return true;



	return false;

}



static inline int pmd_bad(pmd_t pmd)

{

	if (radix_enabled())
@@ -1100,6 +1117,19 @@ static inline int pmd_protnone(pmd_t pmd) 
#define pmd_access_permitted pmd_access_permitted

static inline bool pmd_access_permitted(pmd_t pmd, bool write)

{

	/*

	 * pmdp_invalidate sets this combination (which is not caught by

	 * !pte_present() check in pte_access_permitted), to prevent

	 * lock-free lookups, as part of the serialize_against_pte_lookup()

	 * synchronisation.

	 *

	 * This also catches the case where the PTE's hardware PRESENT bit is

	 * cleared while TLB is flushed, which is suboptimal but should not

	 * be frequent.

	 */

	if (pmd_is_serializing(pmd))

		return false;



	return pte_access_permitted(pmd_pte(pmd), write);

}

arch/powerpc/include/asm/btext.h

+4 −0
Original line number Diff line number Diff line
@@ -13,7 +13,11 @@ extern void btext_update_display(unsigned long phys, int width, int height, 
				 int depth, int pitch);

extern void btext_setup_display(int width, int height, int depth, int pitch,

				unsigned long address);

#ifdef CONFIG_PPC32

extern void btext_prepare_BAT(void);

#else

static inline void btext_prepare_BAT(void) { }

#endif

extern void btext_map(void);

extern void btext_unmap(void);

arch/powerpc/include/asm/kexec.h

+3 −0
Original line number Diff line number Diff line
@@ -94,6 +94,9 @@ static inline bool kdump_in_progress(void) 
	return crashing_cpu >= 0;

}



void relocate_new_kernel(unsigned long indirection_page, unsigned long reboot_code_buffer,

			 unsigned long start_address) __noreturn;



#ifdef CONFIG_KEXEC_FILE

extern const struct kexec_file_ops kexec_elf64_ops;

arch/powerpc/include/asm/page.h

+7 −0
Original line number Diff line number Diff line
@@ -323,6 +323,13 @@ struct vm_area_struct; 
#endif /* __ASSEMBLY__ */

#include <asm/slice.h>



/*

 * Allow 30-bit DMA for very limited Broadcom wifi chips on many powerbooks.

 */

#ifdef CONFIG_PPC32

#define ARCH_ZONE_DMA_BITS 30

#else

#define ARCH_ZONE_DMA_BITS 31

#endif



#endif /* _ASM_POWERPC_PAGE_H */

arch/powerpc/kernel/exceptions-64s.S

+1 −1
Original line number Diff line number Diff line
@@ -315,7 +315,7 @@ TRAMP_REAL_BEGIN(machine_check_common_early) 
	mfspr	r11,SPRN_DSISR		/* Save DSISR */

	std	r11,_DSISR(r1)

	std	r9,_CCR(r1)		/* Save CR in stackframe */

	kuap_save_amr_and_lock r9, r10, cr1

	/* We don't touch AMR here, we never go to virtual mode */

	/* Save r9 through r13 from EXMC save area to stack frame. */

	EXCEPTION_PROLOG_COMMON_2(PACA_EXMC)

	mfmsr	r11			/* get MSR value */