<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/arch/arm, branch v4.4.91</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>ARM: remove duplicate 'const' annotations'</title>
<updated>2017-10-08T08:14:20+00:00</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2017-05-11T11:50:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=d32ee7026081bc43313dc8f7aac8bbf93206e6a5'/>
<id>d32ee7026081bc43313dc8f7aac8bbf93206e6a5</id>
<content type='text'>
commit 0527873b29b077fc8e656acd63e1866b429fef55 upstream.

gcc-7 warns about some declarations that are more 'const' than necessary:

arch/arm/mach-at91/pm.c:338:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const ramc_ids[] __initconst = {
arch/arm/mach-bcm/bcm_kona_smc.c:36:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const bcm_kona_smc_ids[] __initconst = {
arch/arm/mach-spear/time.c:207:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const timer_of_match[] __initconst = {
arch/arm/mach-omap2/prm_common.c:714:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = {
arch/arm/mach-omap2/vc.c:562:35: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = {

The ones in arch/arm were apparently all introduced accidentally by one
commit that correctly marked a lot of variables as __initconst.

Fixes: 19c233b79d1a ("ARM: appropriate __init annotation for const data")
Acked-by: Alexandre Belloni &lt;alexandre.belloni@free-electrons.com&gt;
Acked-by: Tony Lindgren &lt;tony@atomide.com&gt;
Acked-by: Nicolas Pitre &lt;nico@linaro.org&gt;
Acked-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Acked-by: Viresh Kumar &lt;viresh.kumar@linaro.org&gt;
Acked-by: Krzysztof Hałasa &lt;khalasa@piap.pl&gt;
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 0527873b29b077fc8e656acd63e1866b429fef55 upstream.

gcc-7 warns about some declarations that are more 'const' than necessary:

arch/arm/mach-at91/pm.c:338:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const ramc_ids[] __initconst = {
arch/arm/mach-bcm/bcm_kona_smc.c:36:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const bcm_kona_smc_ids[] __initconst = {
arch/arm/mach-spear/time.c:207:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const timer_of_match[] __initconst = {
arch/arm/mach-omap2/prm_common.c:714:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = {
arch/arm/mach-omap2/vc.c:562:35: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier]
 static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = {

The ones in arch/arm were apparently all introduced accidentally by one
commit that correctly marked a lot of variables as __initconst.

Fixes: 19c233b79d1a ("ARM: appropriate __init annotation for const data")
Acked-by: Alexandre Belloni &lt;alexandre.belloni@free-electrons.com&gt;
Acked-by: Tony Lindgren &lt;tony@atomide.com&gt;
Acked-by: Nicolas Pitre &lt;nico@linaro.org&gt;
Acked-by: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Acked-by: Viresh Kumar &lt;viresh.kumar@linaro.org&gt;
Acked-by: Krzysztof Hałasa &lt;khalasa@piap.pl&gt;
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM</title>
<updated>2017-10-08T08:14:17+00:00</updated>
<author>
<name>Afzal Mohammed</name>
<email>afzal.mohd.ma@gmail.com</email>
</author>
<published>2017-01-07T16:48:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f97c79e83f7e01ff4e310f0fc4cb41a992ccc5ed'/>
<id>f97c79e83f7e01ff4e310f0fc4cb41a992ccc5ed</id>
<content type='text'>
[ Upstream commit 8a792e9afbce84a0fdaf213fe42bb97382487094 ]

REMAP_VECTORS_TO_RAM depends on DRAM_BASE, but since DRAM_BASE is a
hex, REMAP_VECTORS_TO_RAM could never get enabled. Also depending on
DRAM_BASE is redundant as whenever REMAP_VECTORS_TO_RAM makes itself
available to Kconfig, DRAM_BASE also is available as the Kconfig
gets sourced on !MMU.

Signed-off-by: Afzal Mohammed &lt;afzal.mohd.ma@gmail.com&gt;
Reviewed-by: Vladimir Murzin &lt;vladimir.murzin@arm.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 8a792e9afbce84a0fdaf213fe42bb97382487094 ]

REMAP_VECTORS_TO_RAM depends on DRAM_BASE, but since DRAM_BASE is a
hex, REMAP_VECTORS_TO_RAM could never get enabled. Also depending on
DRAM_BASE is redundant as whenever REMAP_VECTORS_TO_RAM makes itself
available to Kconfig, DRAM_BASE also is available as the Kconfig
gets sourced on !MMU.

Signed-off-by: Afzal Mohammed &lt;afzal.mohd.ma@gmail.com&gt;
Reviewed-by: Vladimir Murzin &lt;vladimir.murzin@arm.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes</title>
<updated>2017-10-08T08:14:16+00:00</updated>
<author>
<name>Simon Horman</name>
<email>horms+renesas@verge.net.au</email>
</author>
<published>2016-12-20T10:32:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=b00cfc01e70f78bfbc4df8e579e20d53688b209d'/>
<id>b00cfc01e70f78bfbc4df8e579e20d53688b209d</id>
<content type='text'>
[ Upstream commit 654450baf2afba86cf328e1849ccac61ec4630af ]

Use recently added R-Car Gen 2 fallback binding for msiof nodes in
DT for r8a7790 SoC.

This has no run-time effect for the current driver as the initialisation
sequence is the same for the SoC-specific binding for r8a7790 and the
fallback binding for R-Car Gen 2.

Signed-off-by: Simon Horman &lt;horms+renesas@verge.net.au&gt;
Reviewed-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 654450baf2afba86cf328e1849ccac61ec4630af ]

Use recently added R-Car Gen 2 fallback binding for msiof nodes in
DT for r8a7790 SoC.

This has no run-time effect for the current driver as the initialisation
sequence is the same for the SoC-specific binding for r8a7790 and the
fallback binding for R-Car Gen 2.

Signed-off-by: Simon Horman &lt;horms+renesas@verge.net.au&gt;
Reviewed-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>swiotlb-xen: implement xen_swiotlb_dma_mmap callback</title>
<updated>2017-10-05T07:41:48+00:00</updated>
<author>
<name>Stefano Stabellini</name>
<email>stefano.stabellini@eu.citrix.com</email>
</author>
<published>2017-02-07T17:58:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=079c03f4a915da1279604f88d6c07bf70427ddbc'/>
<id>079c03f4a915da1279604f88d6c07bf70427ddbc</id>
<content type='text'>
commit 7e91c7df29b5e196de3dc6f086c8937973bd0b88 upstream.

This function creates userspace mapping for the DMA-coherent memory.

Signed-off-by: Stefano Stabellini &lt;stefano.stabellini@eu.citrix.com&gt;
Signed-off-by: Oleksandr Dmytryshyn &lt;oleksandr.dmytryshyn@globallogic.com&gt;
Signed-off-by: Andrii Anisov &lt;andrii_anisov@epam.com&gt;
Signed-off-by: Konrad Rzeszutek Wilk &lt;konrad@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7e91c7df29b5e196de3dc6f086c8937973bd0b88 upstream.

This function creates userspace mapping for the DMA-coherent memory.

Signed-off-by: Stefano Stabellini &lt;stefano.stabellini@eu.citrix.com&gt;
Signed-off-by: Oleksandr Dmytryshyn &lt;oleksandr.dmytryshyn@globallogic.com&gt;
Signed-off-by: Andrii Anisov &lt;andrii_anisov@epam.com&gt;
Signed-off-by: Konrad Rzeszutek Wilk &lt;konrad@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: pxa: fix the number of DMA requestor lines</title>
<updated>2017-10-05T07:41:48+00:00</updated>
<author>
<name>Robert Jarzmik</name>
<email>robert.jarzmik@free.fr</email>
</author>
<published>2016-03-08T23:46:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=90df2daa1da071bd0c2766b0c5bd9abbee08e3d7'/>
<id>90df2daa1da071bd0c2766b0c5bd9abbee08e3d7</id>
<content type='text'>
commit 4c35430ad18f5a034302cb90e559ede5a27f93b9 upstream.

The number of requestor lines was clamped to 0 for all pxa architectures
in the requestor declaration. Fix this by using the value.

Fixes: 72b195cb7162 ("ARM: pxa: add the number of DMA requestor lines")
Signed-off-by: Robert Jarzmik &lt;robert.jarzmik@free.fr&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4c35430ad18f5a034302cb90e559ede5a27f93b9 upstream.

The number of requestor lines was clamped to 0 for all pxa architectures
in the requestor declaration. Fix this by using the value.

Fixes: 72b195cb7162 ("ARM: pxa: add the number of DMA requestor lines")
Signed-off-by: Robert Jarzmik &lt;robert.jarzmik@free.fr&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: pxa: add the number of DMA requestor lines</title>
<updated>2017-10-05T07:41:48+00:00</updated>
<author>
<name>Robert Jarzmik</name>
<email>robert.jarzmik@free.fr</email>
</author>
<published>2016-02-15T20:57:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=c575be9a393fd88267cf42dd6af35f1a1f2a363a'/>
<id>c575be9a393fd88267cf42dd6af35f1a1f2a363a</id>
<content type='text'>
commit 72b195cb716284217e8b270af420bc7e5cf04b3c upstream.

Declare the number of DMA requestor lines per platform :
 - for pxa25x: 40 requestor lines
 - for pxa27x: 75 requestor lines
 - for pxa3xx: 100 requestor lines

This information will be used to activate the DMA flow control or not.

Signed-off-by: Robert Jarzmik &lt;robert.jarzmik@free.fr&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 72b195cb716284217e8b270af420bc7e5cf04b3c upstream.

Declare the number of DMA requestor lines per platform :
 - for pxa25x: 40 requestor lines
 - for pxa27x: 75 requestor lines
 - for pxa3xx: 100 requestor lines

This information will be used to activate the DMA flow control or not.

Signed-off-by: Robert Jarzmik &lt;robert.jarzmik@free.fr&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 8692/1: mm: abort uaccess retries upon fatal signal</title>
<updated>2017-09-13T21:09:46+00:00</updated>
<author>
<name>Mark Rutland</name>
<email>mark.rutland@arm.com</email>
</author>
<published>2017-08-22T10:36:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=84478477d0b8572c6d267492aaaf49acd6fc4db5'/>
<id>84478477d0b8572c6d267492aaaf49acd6fc4db5</id>
<content type='text'>
commit 746a272e44141af24a02f6c9b0f65f4c4598ed42 upstream.

When there's a fatal signal pending, arm's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.

However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.

To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.

Signed-off-by: Mark Rutland &lt;mark.rutland@arm.com&gt;
Reviewed-by: Steve Capper &lt;steve.capper@arm.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 746a272e44141af24a02f6c9b0f65f4c4598ed42 upstream.

When there's a fatal signal pending, arm's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.

However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.

To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.

Signed-off-by: Mark Rutland &lt;mark.rutland@arm.com&gt;
Reviewed-by: Steve Capper &lt;steve.capper@arm.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@armlinux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>kvm: arm/arm64: Force reading uncached stage2 PGD</title>
<updated>2017-09-07T06:34:10+00:00</updated>
<author>
<name>Suzuki K Poulose</name>
<email>suzuki.poulose@arm.com</email>
</author>
<published>2017-05-16T09:34:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=628212c89faeed34704977a0edcfaaaae467a34d'/>
<id>628212c89faeed34704977a0edcfaaaae467a34d</id>
<content type='text'>
commit 2952a6070e07ebdd5896f1f5b861acad677caded upstream.

Make sure we don't use a cached value of the KVM stage2 PGD while
resetting the PGD.

Cc: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Reviewed-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;


</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 2952a6070e07ebdd5896f1f5b861acad677caded upstream.

Make sure we don't use a cached value of the KVM stage2 PGD while
resetting the PGD.

Cc: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Reviewed-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;


</pre>
</div>
</content>
</entry>
<entry>
<title>kvm: arm/arm64: Fix race in resetting stage2 PGD</title>
<updated>2017-09-07T06:34:09+00:00</updated>
<author>
<name>Suzuki K Poulose</name>
<email>suzuki.poulose@arm.com</email>
</author>
<published>2017-05-03T14:17:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=57ff696f54b5c51d8d4df00295341bec17fab36f'/>
<id>57ff696f54b5c51d8d4df00295341bec17fab36f</id>
<content type='text'>
commit 6c0d706b563af732adb094c5bf807437e8963e84 upstream.

In kvm_free_stage2_pgd() we check the stage2 PGD before holding
the lock and proceed to take the lock if it is valid. And we unmap
the page tables, followed by releasing the lock. We reset the PGD
only after dropping this lock, which could cause a race condition
where another thread waiting on or even holding the lock, could
potentially see that the PGD is still valid and proceed to perform
a stage2 operation and later encounter a NULL PGD.

[223090.242280] Unable to handle kernel NULL pointer dereference at
virtual address 00000040
[223090.262330] PC is at unmap_stage2_range+0x8c/0x428
[223090.262332] LR is at kvm_unmap_hva_handler+0x2c/0x3c
[223090.262531] Call trace:
[223090.262533] [&lt;ffff0000080adb78&gt;] unmap_stage2_range+0x8c/0x428
[223090.262535] [&lt;ffff0000080adf40&gt;] kvm_unmap_hva_handler+0x2c/0x3c
[223090.262537] [&lt;ffff0000080ace2c&gt;] handle_hva_to_gpa+0xb0/0x104
[223090.262539] [&lt;ffff0000080af988&gt;] kvm_unmap_hva+0x5c/0xbc
[223090.262543] [&lt;ffff0000080a2478&gt;]
kvm_mmu_notifier_invalidate_page+0x50/0x8c
[223090.262547] [&lt;ffff0000082274f8&gt;]
__mmu_notifier_invalidate_page+0x5c/0x84
[223090.262551] [&lt;ffff00000820b700&gt;] try_to_unmap_one+0x1d0/0x4a0
[223090.262553] [&lt;ffff00000820c5c8&gt;] rmap_walk+0x1cc/0x2e0
[223090.262555] [&lt;ffff00000820c90c&gt;] try_to_unmap+0x74/0xa4
[223090.262557] [&lt;ffff000008230ce4&gt;] migrate_pages+0x31c/0x5ac
[223090.262561] [&lt;ffff0000081f869c&gt;] compact_zone+0x3fc/0x7ac
[223090.262563] [&lt;ffff0000081f8ae0&gt;] compact_zone_order+0x94/0xb0
[223090.262564] [&lt;ffff0000081f91c0&gt;] try_to_compact_pages+0x108/0x290
[223090.262569] [&lt;ffff0000081d5108&gt;] __alloc_pages_direct_compact+0x70/0x1ac
[223090.262571] [&lt;ffff0000081d64a0&gt;] __alloc_pages_nodemask+0x434/0x9f4
[223090.262572] [&lt;ffff0000082256f0&gt;] alloc_pages_vma+0x230/0x254
[223090.262574] [&lt;ffff000008235e5c&gt;] do_huge_pmd_anonymous_page+0x114/0x538
[223090.262576] [&lt;ffff000008201bec&gt;] handle_mm_fault+0xd40/0x17a4
[223090.262577] [&lt;ffff0000081fb324&gt;] __get_user_pages+0x12c/0x36c
[223090.262578] [&lt;ffff0000081fb804&gt;] get_user_pages_unlocked+0xa4/0x1b8
[223090.262579] [&lt;ffff0000080a3ce8&gt;] __gfn_to_pfn_memslot+0x280/0x31c
[223090.262580] [&lt;ffff0000080a3dd0&gt;] gfn_to_pfn_prot+0x4c/0x5c
[223090.262582] [&lt;ffff0000080af3f8&gt;] kvm_handle_guest_abort+0x240/0x774
[223090.262584] [&lt;ffff0000080b2bac&gt;] handle_exit+0x11c/0x1ac
[223090.262586] [&lt;ffff0000080ab99c&gt;] kvm_arch_vcpu_ioctl_run+0x31c/0x648
[223090.262587] [&lt;ffff0000080a1d78&gt;] kvm_vcpu_ioctl+0x378/0x768
[223090.262590] [&lt;ffff00000825df5c&gt;] do_vfs_ioctl+0x324/0x5a4
[223090.262591] [&lt;ffff00000825e26c&gt;] SyS_ioctl+0x90/0xa4
[223090.262595] [&lt;ffff000008085d84&gt;] el0_svc_naked+0x38/0x3c

This patch moves the stage2 PGD manipulation under the lock.

Reported-by: Alexander Graf &lt;agraf@suse.de&gt;
Cc: Mark Rutland &lt;mark.rutland@arm.com&gt;
Cc: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Cc: Paolo Bonzini &lt;pbonzini@redhat.com&gt;
Cc: Radim Krčmář &lt;rkrcmar@redhat.com&gt;
Reviewed-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Reviewed-by: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Signed-off-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 6c0d706b563af732adb094c5bf807437e8963e84 upstream.

In kvm_free_stage2_pgd() we check the stage2 PGD before holding
the lock and proceed to take the lock if it is valid. And we unmap
the page tables, followed by releasing the lock. We reset the PGD
only after dropping this lock, which could cause a race condition
where another thread waiting on or even holding the lock, could
potentially see that the PGD is still valid and proceed to perform
a stage2 operation and later encounter a NULL PGD.

[223090.242280] Unable to handle kernel NULL pointer dereference at
virtual address 00000040
[223090.262330] PC is at unmap_stage2_range+0x8c/0x428
[223090.262332] LR is at kvm_unmap_hva_handler+0x2c/0x3c
[223090.262531] Call trace:
[223090.262533] [&lt;ffff0000080adb78&gt;] unmap_stage2_range+0x8c/0x428
[223090.262535] [&lt;ffff0000080adf40&gt;] kvm_unmap_hva_handler+0x2c/0x3c
[223090.262537] [&lt;ffff0000080ace2c&gt;] handle_hva_to_gpa+0xb0/0x104
[223090.262539] [&lt;ffff0000080af988&gt;] kvm_unmap_hva+0x5c/0xbc
[223090.262543] [&lt;ffff0000080a2478&gt;]
kvm_mmu_notifier_invalidate_page+0x50/0x8c
[223090.262547] [&lt;ffff0000082274f8&gt;]
__mmu_notifier_invalidate_page+0x5c/0x84
[223090.262551] [&lt;ffff00000820b700&gt;] try_to_unmap_one+0x1d0/0x4a0
[223090.262553] [&lt;ffff00000820c5c8&gt;] rmap_walk+0x1cc/0x2e0
[223090.262555] [&lt;ffff00000820c90c&gt;] try_to_unmap+0x74/0xa4
[223090.262557] [&lt;ffff000008230ce4&gt;] migrate_pages+0x31c/0x5ac
[223090.262561] [&lt;ffff0000081f869c&gt;] compact_zone+0x3fc/0x7ac
[223090.262563] [&lt;ffff0000081f8ae0&gt;] compact_zone_order+0x94/0xb0
[223090.262564] [&lt;ffff0000081f91c0&gt;] try_to_compact_pages+0x108/0x290
[223090.262569] [&lt;ffff0000081d5108&gt;] __alloc_pages_direct_compact+0x70/0x1ac
[223090.262571] [&lt;ffff0000081d64a0&gt;] __alloc_pages_nodemask+0x434/0x9f4
[223090.262572] [&lt;ffff0000082256f0&gt;] alloc_pages_vma+0x230/0x254
[223090.262574] [&lt;ffff000008235e5c&gt;] do_huge_pmd_anonymous_page+0x114/0x538
[223090.262576] [&lt;ffff000008201bec&gt;] handle_mm_fault+0xd40/0x17a4
[223090.262577] [&lt;ffff0000081fb324&gt;] __get_user_pages+0x12c/0x36c
[223090.262578] [&lt;ffff0000081fb804&gt;] get_user_pages_unlocked+0xa4/0x1b8
[223090.262579] [&lt;ffff0000080a3ce8&gt;] __gfn_to_pfn_memslot+0x280/0x31c
[223090.262580] [&lt;ffff0000080a3dd0&gt;] gfn_to_pfn_prot+0x4c/0x5c
[223090.262582] [&lt;ffff0000080af3f8&gt;] kvm_handle_guest_abort+0x240/0x774
[223090.262584] [&lt;ffff0000080b2bac&gt;] handle_exit+0x11c/0x1ac
[223090.262586] [&lt;ffff0000080ab99c&gt;] kvm_arch_vcpu_ioctl_run+0x31c/0x648
[223090.262587] [&lt;ffff0000080a1d78&gt;] kvm_vcpu_ioctl+0x378/0x768
[223090.262590] [&lt;ffff00000825df5c&gt;] do_vfs_ioctl+0x324/0x5a4
[223090.262591] [&lt;ffff00000825e26c&gt;] SyS_ioctl+0x90/0xa4
[223090.262595] [&lt;ffff000008085d84&gt;] el0_svc_naked+0x38/0x3c

This patch moves the stage2 PGD manipulation under the lock.

Reported-by: Alexander Graf &lt;agraf@suse.de&gt;
Cc: Mark Rutland &lt;mark.rutland@arm.com&gt;
Cc: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Cc: Paolo Bonzini &lt;pbonzini@redhat.com&gt;
Cc: Radim Krčmář &lt;rkrcmar@redhat.com&gt;
Reviewed-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Reviewed-by: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Signed-off-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: arm/arm64: Handle hva aging while destroying the vm</title>
<updated>2017-08-13T02:29:09+00:00</updated>
<author>
<name>Suzuki K Poulose</name>
<email>Suzuki.Poulose@arm.com</email>
</author>
<published>2017-07-05T08:57:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=7e86f2d55f66e0026aa70ea268021df6bf294c5b'/>
<id>7e86f2d55f66e0026aa70ea268021df6bf294c5b</id>
<content type='text'>
commit 7e5a672289c9754d07e1c3b33649786d3d70f5e4 upstream.

The mmu_notifier_release() callback of KVM triggers cleaning up
the stage2 page table on kvm-arm. However there could be other
notifier callbacks in parallel with the mmu_notifier_release(),
which could cause the call backs ending up in an empty stage2
page table. Make sure we check it for all the notifier callbacks.

Fixes: commit 293f29363 ("kvm-arm: Unmap shadow pagetables properly")
Reported-by: Alex Graf &lt;agraf@suse.de&gt;
Reviewed-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Signed-off-by: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;


</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7e5a672289c9754d07e1c3b33649786d3d70f5e4 upstream.

The mmu_notifier_release() callback of KVM triggers cleaning up
the stage2 page table on kvm-arm. However there could be other
notifier callbacks in parallel with the mmu_notifier_release(),
which could cause the call backs ending up in an empty stage2
page table. Make sure we check it for all the notifier callbacks.

Fixes: commit 293f29363 ("kvm-arm: Unmap shadow pagetables properly")
Reported-by: Alex Graf &lt;agraf@suse.de&gt;
Reviewed-by: Christoffer Dall &lt;cdall@linaro.org&gt;
Signed-off-by: Suzuki K Poulose &lt;suzuki.poulose@arm.com&gt;
Signed-off-by: Marc Zyngier &lt;marc.zyngier@arm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;


</pre>
</div>
</content>
</entry>
</feed>
