02 Nov, 2019

1 commit

  • We have seen many crashes on powerpc hosts while loading bpf programs.

    The problem here is that bpf_int_jit_compile() does a first pass
    to compute the program length.

    Then it allocates memory to store the generated program and
    calls bpf_jit_build_body() a second time (and a third time
    later)

    What I have observed is that the second bpf_jit_build_body()
    could end up using few more words than expected.

    If bpf_jit_binary_alloc() put the space for the program
    at the end of the allocated page, we then write on
    a non mapped memory.

    It appears that bpf_jit_emit_tail_call() calls
    bpf_jit_emit_common_epilogue() while ctx->seen might not
    be stable.

    Only after the second pass we can be sure ctx->seen wont be changed.

    Trying to avoid a second pass seems quite complex and probably
    not worth it.

    Fixes: ce0761419faef ("powerpc/bpf: Implement support for tail calls")
    Signed-off-by: Eric Dumazet
    Signed-off-by: Daniel Borkmann
    Cc: Naveen N. Rao
    Cc: Sandipan Das
    Cc: Benjamin Herrenschmidt
    Cc: Paul Mackerras
    Cc: Michael Ellerman
    Cc: Martin KaFai Lau
    Cc: Song Liu
    Cc: Yonghong Song
    Link: https://lore.kernel.org/bpf/20191101033444.143741-1-edumazet@google.com

    Eric Dumazet
     

18 Jun, 2019

2 commits

  • Honestly all the conflicts were simple overlapping changes,
    nothing really interesting to report.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Pull networking fixes from David Miller:
    "Lots of bug fixes here:

    1) Out of bounds access in __bpf_skc_lookup, from Lorenz Bauer.

    2) Fix rate reporting in cfg80211_calculate_bitrate_he(), from John
    Crispin.

    3) Use after free in psock backlog workqueue, from John Fastabend.

    4) Fix source port matching in fdb peer flow rule of mlx5, from Raed
    Salem.

    5) Use atomic_inc_not_zero() in fl6_sock_lookup(), from Eric Dumazet.

    6) Network header needs to be set for packet redirect in nfp, from
    John Hurley.

    7) Fix udp zerocopy refcnt, from Willem de Bruijn.

    8) Don't assume linear buffers in vxlan and geneve error handlers,
    from Stefano Brivio.

    9) Fix TOS matching in mlxsw, from Jiri Pirko.

    10) More SCTP cookie memory leak fixes, from Neil Horman.

    11) Fix VLAN filtering in rtl8366, from Linus Walluij.

    12) Various TCP SACK payload size and fragmentation memory limit fixes
    from Eric Dumazet.

    13) Use after free in pneigh_get_next(), also from Eric Dumazet.

    14) LAPB control block leak fix from Jeremy Sowden"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (145 commits)
    lapb: fixed leak of control-blocks.
    tipc: purge deferredq list for each grp member in tipc_group_delete
    ax25: fix inconsistent lock state in ax25_destroy_timer
    neigh: fix use-after-free read in pneigh_get_next
    tcp: fix compile error if !CONFIG_SYSCTL
    hv_sock: Suppress bogus "may be used uninitialized" warnings
    be2net: Fix number of Rx queues used for flow hashing
    net: handle 802.1P vlan 0 packets properly
    tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
    tcp: add tcp_min_snd_mss sysctl
    tcp: tcp_fragment() should apply sane memory limits
    tcp: limit payload size of sacked skbs
    Revert "net: phylink: set the autoneg state in phylink_phy_change"
    bpf: fix nested bpf tracepoints with per-cpu data
    bpf: Fix out of bounds memory access in bpf_sk_storage
    vsock/virtio: set SOCK_DONE on peer shutdown
    net: dsa: rtl8366: Fix up VLAN filtering
    net: phylink: set the autoneg state in phylink_phy_change
    net: add high_order_alloc_disable sysctl/static key
    tcp: add tcp_tx_skb_cache sysctl
    ...

    Linus Torvalds
     

14 Jun, 2019

1 commit


05 Jun, 2019

1 commit

  • Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation version 2 of the license

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 315 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Reviewed-by: Armijn Hemel
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

25 May, 2019

1 commit


17 Mar, 2019

1 commit

  • Daniel Borkmann says:

    ====================
    pull-request: bpf 2019-03-16

    The following pull-request contains BPF updates for your *net* tree.

    The main changes are:

    1) Fix a umem memory leak on cleanup in AF_XDP, from Björn.

    2) Fix BTF to properly resolve forward-declared enums into their corresponding
    full enum definition types during deduplication, from Andrii.

    3) Fix libbpf to reject invalid flags in xsk_socket__create(), from Magnus.

    4) Fix accessing invalid pointer returned from bpf_tcp_sock() and
    bpf_sk_fullsock() after bpf_sk_release() was called, from Martin.

    5) Fix generation of load/store DW instructions in PPC JIT, from Naveen.

    6) Various fixes in BPF helper function documentation in bpf.h UAPI header
    used to bpf-helpers(7) man page, from Quentin.

    7) Fix segfault in BPF test_progs when prog loading failed, from Yonghong.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

16 Mar, 2019

1 commit

  • Yauheni Kaliuta pointed out that PTR_TO_STACK store/load verifier test
    was failing on powerpc64 BE, and rightfully indicated that the PPC_LD()
    macro is not masking away the last two bits of the offset per the ISA,
    resulting in the generation of 'lwa' instruction instead of the intended
    'ld' instruction.

    Segher also pointed out that we can't simply mask away the last two bits
    as that will result in loading/storing from/to a memory location that
    was not intended.

    This patch addresses this by using ldx/stdx if the offset is not
    word-aligned. We load the offset into a temporary register (TMP_REG_2)
    and use that as the index register in a subsequent ldx/stdx. We fix
    PPC_LD() macro to mask off the last two bits, but enhance PPC_BPF_LL()
    and PPC_BPF_STL() to factor in the offset value and generate the proper
    instruction sequence. We also convert all existing users of PPC_LD() and
    PPC_STD() to use these macros. All existing uses of these macros have
    been audited to ensure that TMP_REG_2 can be clobbered.

    Fixes: 156d0e290e96 ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
    Cc: stable@vger.kernel.org # v4.9+

    Reported-by: Yauheni Kaliuta
    Signed-off-by: Naveen N. Rao
    Signed-off-by: Daniel Borkmann

    Naveen N. Rao
     

08 Mar, 2019

1 commit

  • Pull powerpc updates from Michael Ellerman:
    "Notable changes:

    - Enable THREAD_INFO_IN_TASK to move thread_info off the stack.

    - A big series from Christoph reworking our DMA code to use more of
    the generic infrastructure, as he said:
    "This series switches the powerpc port to use the generic swiotlb
    and noncoherent dma ops, and to use more generic code for the
    coherent direct mapping, as well as removing a lot of dead
    code."

    - Increase our vmalloc space to 512T with the Hash MMU on modern
    CPUs, allowing us to support machines with larger amounts of total
    RAM or distance between nodes.

    - Two series from Christophe, one to optimise TLB miss handlers on
    6xx, and another to optimise the way STRICT_KERNEL_RWX is
    implemented on some 32-bit CPUs.

    - Support for KCOV coverage instrumentation which means we can run
    syzkaller and discover even more bugs in our code.

    And as always many clean-ups, reworks and minor fixes etc.

    Thanks to: Alan Modra, Alexey Kardashevskiy, Alistair Popple, Andrea
    Arcangeli, Andrew Donnellan, Aneesh Kumar K.V, Aravinda Prasad, Balbir
    Singh, Brajeswar Ghosh, Breno Leitao, Christian Lamparter, Christian
    Zigotzky, Christophe Leroy, Christoph Hellwig, Corentin Labbe, Daniel
    Axtens, David Gibson, Diana Craciun, Firoz Khan, Gustavo A. R. Silva,
    Igor Stoppa, Joe Lawrence, Joel Stanley, Jonathan Neuschäfer, Jordan
    Niethe, Laurent Dufour, Madhavan Srinivasan, Mahesh Salgaonkar, Mark
    Cave-Ayland, Masahiro Yamada, Mathieu Malaterre, Matteo Croce, Meelis
    Roos, Michael W. Bringmann, Nathan Chancellor, Nathan Fontenot,
    Nicholas Piggin, Nick Desaulniers, Nicolai Stange, Oliver O'Halloran,
    Paul Mackerras, Peter Xu, PrasannaKumar Muralidharan, Qian Cai,
    Rashmica Gupta, Reza Arbab, Robert P. J. Day, Russell Currey,
    Sabyasachi Gupta, Sam Bobroff, Sandipan Das, Sergey Senozhatsky,
    Souptick Joarder, Stewart Smith, Tyrel Datwyler, Vaibhav Jain,
    YueHaibing"

    * tag 'powerpc-5.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (200 commits)
    powerpc/32: Clear on-stack exception marker upon exception return
    powerpc: Remove export of save_stack_trace_tsk_reliable()
    powerpc/mm: fix "section_base" set but not used
    powerpc/mm: Fix "sz" set but not used warning
    powerpc/mm: Check secondary hash page table
    powerpc: remove nargs from __SYSCALL
    powerpc/64s: Fix unrelocated interrupt trampoline address test
    powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables
    powerpc/fsl: Fix the flush of branch predictor.
    powerpc/powernv: Make opal log only readable by root
    powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc
    powerpc/powernv: move OPAL call wrapper tracing and interrupt handling to C
    powerpc/64s: Fix data interrupts vs d-side MCE reentrancy
    powerpc/64s: Prepare to handle data interrupts vs d-side MCE reentrancy
    powerpc/64s: system reset interrupt preserve HSRRs
    powerpc/64s: Fix HV NMI vs HV interrupt recoverability test
    powerpc/mm/hash: Handle mmap_min_addr correctly in get_unmapped_area topdown search
    powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback
    selftests/powerpc: Remove duplicate header
    powerpc sstep: Add support for modsd, modud instructions
    ...

    Linus Torvalds
     

23 Feb, 2019

1 commit

  • This patch activates CONFIG_THREAD_INFO_IN_TASK which
    moves the thread_info into task_struct.

    Moving thread_info into task_struct has the following advantages:
    - It protects thread_info from corruption in the case of stack
    overflows.
    - Its address is harder to determine if stack addresses are leaked,
    making a number of attacks more difficult.

    This has the following consequences:
    - thread_info is now located at the beginning of task_struct.
    - The 'cpu' field is now in task_struct, and only exists when
    CONFIG_SMP is active.
    - thread_info doesn't have anymore the 'task' field.

    This patch:
    - Removes all recopy of thread_info struct when the stack changes.
    - Changes the CURRENT_THREAD_INFO() macro to point to current.
    - Selects CONFIG_THREAD_INFO_IN_TASK.
    - Modifies raw_smp_processor_id() to get ->cpu from current without
    including linux/sched.h to avoid circular inclusion and without
    including asm/asm-offsets.h to avoid symbol names duplication
    between ASM constants and C constants.
    - Modifies klp_init_thread_info() to take a task_struct pointer
    argument.

    Signed-off-by: Christophe Leroy
    Reviewed-by: Nicholas Piggin
    [mpe: Add task_stack.h to livepatch.h to fix build fails]
    Signed-off-by: Michael Ellerman

    Christophe Leroy
     

02 Feb, 2019

1 commit


27 Jan, 2019

1 commit

  • This patch implements code-gen for new JMP32 instructions on ppc.

    For JMP32 | JSET, instruction encoding for PPC_RLWINM_DOT is added to check
    the result of ANDing low 32-bit of operands.

    Cc: Naveen N. Rao
    Cc: Sandipan Das
    Signed-off-by: Jiong Wang
    Signed-off-by: Alexei Starovoitov

    Jiong Wang
     

11 Dec, 2018

1 commit

  • Daniel Borkmann says:

    ====================
    pull-request: bpf-next 2018-12-11

    The following pull-request contains BPF updates for your *net-next* tree.

    It has three minor merge conflicts, resolutions:

    1) tools/testing/selftests/bpf/test_verifier.c

    Take first chunk with alignment_prevented_execution.

    2) net/core/filter.c

    [...]
    case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
    case bpf_ctx_range(struct __sk_buff, wire_len):
    return false;
    [...]

    3) include/uapi/linux/bpf.h

    Take the second chunk for the two cases each.

    The main changes are:

    1) Add support for BPF line info via BTF and extend libbpf as well
    as bpftool's program dump to annotate output with BPF C code to
    facilitate debugging and introspection, from Martin.

    2) Add support for BPF_ALU | BPF_ARSH | BPF_{K,X} in interpreter
    and all JIT backends, from Jiong.

    3) Improve BPF test coverage on archs with no efficient unaligned
    access by adding an "any alignment" flag to the BPF program load
    to forcefully disable verifier alignment checks, from David.

    4) Add a new bpf_prog_test_run_xattr() API to libbpf which allows for
    proper use of BPF_PROG_TEST_RUN with data_out, from Lorenz.

    5) Extend tc BPF programs to use a new __sk_buff field called wire_len
    for more accurate accounting of packets going to wire, from Petar.

    6) Improve bpftool to allow dumping the trace pipe from it and add
    several improvements in bash completion and map/prog dump,
    from Quentin.

    7) Optimize arm64 BPF JIT to always emit movn/movk/movk sequence for
    kernel addresses and add a dedicated BPF JIT backend allocator,
    from Ard.

    8) Add a BPF helper function for IR remotes to report mouse movements,
    from Sean.

    9) Various cleanups in BPF prog dump e.g. to make UAPI bpf_prog_info
    member naming consistent with existing conventions, from Yonghong
    and Song.

    10) Misc cleanups and improvements in allowing to pass interface name
    via cmdline for xdp1 BPF example, from Matteo.

    11) Fix a potential segfault in BPF sample loader's kprobes handling,
    from Daniel T.

    12) Fix SPDX license in libbpf's README.rst, from Andrey.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

10 Dec, 2018

1 commit

  • Several conflicts, seemingly all over the place.

    I used Stephen Rothwell's sample resolutions for many of these, if not
    just to double check my own work, so definitely the credit largely
    goes to him.

    The NFP conflict consisted of a bug fix (moving operations
    past the rhashtable operation) while chaning the initial
    argument in the function call in the moved code.

    The net/dsa/master.c conflict had to do with a bug fix intermixing of
    making dsa_master_set_mtu() static with the fixing of the tagging
    attribute location.

    cls_flower had a conflict because the dup reject fix from Or
    overlapped with the addition of port range classifiction.

    __set_phy_supported()'s conflict was relatively easy to resolve
    because Andrew fixed it in both trees, so it was just a matter
    of taking the net-next copy. Or at least I think it was :-)

    Joe Stringer's fix to the handling of netns id 0 in bpf_sk_lookup()
    intermixed with changes on how the sdif and caller_net are calculated
    in these code paths in net-next.

    The remaining BPF conflicts were largely about the addition of the
    __bpf_md_ptr stuff in 'net' overlapping with adjustments and additions
    to the relevant data structure where the MD pointer macros are used.

    Signed-off-by: David S. Miller

    David S. Miller
     

08 Dec, 2018

1 commit


04 Dec, 2018

1 commit

  • Once the JITed images for each function in a multi-function program
    are generated after the first three JIT passes, we only need to fix
    the target address for the branch instruction corresponding to each
    bpf-to-bpf function call.

    This introduces the following optimizations for reducing the work
    done by the JIT compiler when handling multi-function programs:

    [1] Instead of doing two extra passes to fix the bpf function calls,
    do just one as that would be sufficient.

    [2] During the extra pass, only overwrite the instruction sequences
    for the bpf-to-bpf function calls as everything else would still
    remain exactly the same. This also reduces the number of writes
    to the JITed image.

    [3] Do not regenerate the prologue and the epilogue during the extra
    pass as that would be redundant.

    Signed-off-by: Sandipan Das
    Signed-off-by: Daniel Borkmann

    Sandipan Das
     

29 Nov, 2018

1 commit


27 Nov, 2018

1 commit

  • Make fetching of the BPF call address from ppc64 JIT generic. ppc64
    was using a slightly different variant rather than through the insns'
    imm field encoding as the target address would not fit into that space.
    Therefore, the target subprog number was encoded into the insns' offset
    and fetched through fp->aux->func[off]->bpf_func instead. Given there
    are other JITs with this issue and the mechanism of fetching the address
    is JIT-generic, move it into the core as a helper instead. On the JIT
    side, we get information on whether the retrieved address is a fixed
    one, that is, not changing through JIT passes, or a dynamic one. For
    the former, JITs can optimize their imm emission because this doesn't
    change jump offsets throughout JIT process.

    Signed-off-by: Daniel Borkmann
    Reviewed-by: Sandipan Das
    Tested-by: Sandipan Das
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     

17 Nov, 2018

2 commits


18 Aug, 2018

1 commit

  • Pull powerpc updates from Michael Ellerman:
    "Notable changes:

    - A fix for a bug in our page table fragment allocator, where a page
    table page could be freed and reallocated for something else while
    still in use, leading to memory corruption etc. The fix reuses
    pt_mm in struct page (x86 only) for a powerpc only refcount.

    - Fixes to our pkey support. Several are user-visible changes, but
    bring us in to line with x86 behaviour and/or fix outright bugs.
    Thanks to Florian Weimer for reporting many of these.

    - A series to improve the hvc driver & related OPAL console code,
    which have been seen to cause hardlockups at times. The hvc driver
    changes in particular have been in linux-next for ~month.

    - Increase our MAX_PHYSMEM_BITS to 128TB when SPARSEMEM_VMEMMAP=y.

    - Remove Power8 DD1 and Power9 DD1 support, neither chip should be in
    use anywhere other than as a paper weight.

    - An optimised memcmp implementation using Power7-or-later VMX
    instructions

    - Support for barrier_nospec on some NXP CPUs.

    - Support for flushing the count cache on context switch on some IBM
    CPUs (controlled by firmware), as a Spectre v2 mitigation.

    - A series to enhance the information we print on unhandled signals
    to bring it into line with other arches, including showing the
    offending VMA and dumping the instructions around the fault.

    Thanks to: Aaro Koskinen, Akshay Adiga, Alastair D'Silva, Alexey
    Kardashevskiy, Alexey Spirkov, Alistair Popple, Andrew Donnellan,
    Aneesh Kumar K.V, Anju T Sudhakar, Arnd Bergmann, Bartosz Golaszewski,
    Benjamin Herrenschmidt, Bharat Bhushan, Bjoern Noetel, Boqun Feng,
    Breno Leitao, Bryant G. Ly, Camelia Groza, Christophe Leroy, Christoph
    Hellwig, Cyril Bur, Dan Carpenter, Daniel Klamt, Darren Stevens, Dave
    Young, David Gibson, Diana Craciun, Finn Thain, Florian Weimer,
    Frederic Barrat, Gautham R. Shenoy, Geert Uytterhoeven, Geoff Levand,
    Guenter Roeck, Gustavo Romero, Haren Myneni, Hari Bathini, Joel
    Stanley, Jonathan Neuschäfer, Kees Cook, Madhavan Srinivasan, Mahesh
    Salgaonkar, Markus Elfring, Mathieu Malaterre, Mauro S. M. Rodrigues,
    Michael Hanselmann, Michael Neuling, Michael Schmitz, Mukesh Ojha,
    Murilo Opsfelder Araujo, Nicholas Piggin, Parth Y Shah, Paul
    Mackerras, Paul Menzel, Ram Pai, Randy Dunlap, Rashmica Gupta, Reza
    Arbab, Rodrigo R. Galvao, Russell Currey, Sam Bobroff, Scott Wood,
    Shilpasri G Bhat, Simon Guo, Souptick Joarder, Stan Johnson, Thiago
    Jung Bauermann, Tyrel Datwyler, Vaibhav Jain, Vasant Hegde, Venkat
    Rao, zhong jiang"

    * tag 'powerpc-4.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (234 commits)
    powerpc/mm/book3s/radix: Add mapping statistics
    powerpc/uaccess: Enable get_user(u64, *p) on 32-bit
    powerpc/mm/hash: Remove unnecessary do { } while(0) loop
    powerpc/64s: move machine check SLB flushing to mm/slb.c
    powerpc/powernv/idle: Fix build error
    powerpc/mm/tlbflush: update the mmu_gather page size while iterating address range
    powerpc/mm: remove warning about ‘type’ being set
    powerpc/32: Include setup.h header file to fix warnings
    powerpc: Move `path` variable inside DEBUG_PROM
    powerpc/powermac: Make some functions static
    powerpc/powermac: Remove variable x that's never read
    cxl: remove a dead branch
    powerpc/powermac: Add missing include of header pmac.h
    powerpc/kexec: Use common error handling code in setup_new_fdt()
    powerpc/xmon: Add address lookup for percpu symbols
    powerpc/mm: remove huge_pte_offset_and_shift() prototype
    powerpc/lib: Use patch_site to patch copy_32 functions once cache is enabled
    powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
    powerpc/fadump: merge adjacent memory ranges to reduce PT_LOAD segements
    powerpc/fadump: handle crash memory ranges array index overflow
    ...

    Linus Torvalds
     

07 Aug, 2018

1 commit


30 Jul, 2018

1 commit


20 Jul, 2018

1 commit

  • None of the JITs is allowed to implement exit paths from the BPF
    insn mappings other than BPF_JMP | BPF_EXIT. In the BPF core code
    we have a couple of rewrites in eBPF (e.g. LD_ABS / LD_IND) and
    in eBPF to cBPF translation to retain old existing behavior where
    exceptions may occur; they are also tightly controlled by the
    verifier where it disallows some of the features such as BPF to
    BPF calls when legacy LD_ABS / LD_IND ops are present in the BPF
    program. During recent review of all BPF_XADD JIT implementations
    I noticed that the ppc64 one is buggy in that it contains two
    jumps to exit paths. This is problematic as this can bypass verifier
    expectations e.g. pointed out in commit f6b1b3bf0d5f ("bpf: fix
    subprog verifier bypass by div/mod by 0 exception"). The first
    exit path is obsoleted by the fix in ca36960211eb ("bpf: allow xadd
    only on aligned memory") anyway, and for the second one we need to
    do a fetch, add and store loop if the reservation from lwarx/ldarx
    was lost in the meantime.

    Fixes: 156d0e290e96 ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
    Reviewed-by: Naveen N. Rao
    Reviewed-by: Sandipan Das
    Tested-by: Sandipan Das
    Signed-off-by: Daniel Borkmann
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     

13 Jun, 2018

1 commit

  • The kzalloc() function has a 2-factor argument form, kcalloc(). This
    patch replaces cases of:

    kzalloc(a * b, gfp)

    with:
    kcalloc(a * b, gfp)

    as well as handling cases of:

    kzalloc(a * b * c, gfp)

    with:

    kzalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kzalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kzalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kzalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kzalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kzalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kzalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kzalloc
    + kcalloc
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kzalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kzalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kzalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kzalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kzalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kzalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kzalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kzalloc(C1 * C2 * C3, ...)
    |
    kzalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kzalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kzalloc(sizeof(THING) * C2, ...)
    |
    kzalloc(sizeof(TYPE) * C2, ...)
    |
    kzalloc(C1 * C2 * C3, ...)
    |
    kzalloc(C1 * C2, ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kzalloc
    + kcalloc
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

24 May, 2018

2 commits

  • This adds support for bpf-to-bpf function calls in the powerpc64
    JIT compiler. The JIT compiler converts the bpf call instructions
    to native branch instructions. After a round of the usual passes,
    the start addresses of the JITed images for the callee functions
    are known. Finally, to fixup the branch target addresses, we need
    to perform an extra pass.

    Because of the address range in which JITed images are allocated
    on powerpc64, the offsets of the start addresses of these images
    from __bpf_call_base are as large as 64 bits. So, for a function
    call, we cannot use the imm field of the instruction to determine
    the callee's address. Instead, we use the alternative method of
    getting it from the list of function addresses in the auxiliary
    data of the caller by using the off field as an index.

    Signed-off-by: Sandipan Das
    Signed-off-by: Daniel Borkmann

    Sandipan Das
     
  • For multi-function programs, loading the address of a callee
    function to a register requires emitting instructions whose
    count varies from one to five depending on the nature of the
    address.

    Since we come to know of the callee's address only before the
    extra pass, the number of instructions required to load this
    address may vary from what was previously generated. This can
    make the JITed image grow or shrink.

    To avoid this, we should generate a constant five-instruction
    when loading function addresses by padding the optimized load
    sequence with NOPs.

    Signed-off-by: Sandipan Das
    Signed-off-by: Daniel Borkmann

    Sandipan Das
     

04 May, 2018

1 commit

  • Since LD_ABS/LD_IND instructions are now removed from the core and
    reimplemented through a combination of inlined BPF instructions and
    a slow-path helper, we can get rid of the complexity from ppc64 JIT.

    Signed-off-by: Daniel Borkmann
    Acked-by: Naveen N. Rao
    Acked-by: Alexei Starovoitov
    Tested-by: Sandipan Das
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     

06 Mar, 2018

1 commit

  • Pull networking fixes from David Miller:

    1) Use an appropriate TSQ pacing shift in mac80211, from Toke
    Høiland-Jørgensen.

    2) Just like ipv4's ip_route_me_harder(), we have to use skb_to_full_sk
    in ip6_route_me_harder, from Eric Dumazet.

    3) Fix several shutdown races and similar other problems in l2tp, from
    James Chapman.

    4) Handle missing XDP flush properly in tuntap, for real this time.
    From Jason Wang.

    5) Out-of-bounds access in powerpc ebpf tailcalls, from Daniel
    Borkmann.

    6) Fix phy_resume() locking, from Andrew Lunn.

    7) IFLA_MTU values are ignored on newlink for some tunnel types, fix
    from Xin Long.

    8) Revert F-RTO middle box workarounds, they only handle one dimension
    of the problem. From Yuchung Cheng.

    9) Fix socket refcounting in RDS, from Ka-Cheong Poon.

    10) Don't allow ppp unit registration to an unregistered channel, from
    Guillaume Nault.

    11) Various hv_netvsc fixes from Stephen Hemminger.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (98 commits)
    hv_netvsc: propagate rx filters to VF
    hv_netvsc: filter multicast/broadcast
    hv_netvsc: defer queue selection to VF
    hv_netvsc: use napi_schedule_irqoff
    hv_netvsc: fix race in napi poll when rescheduling
    hv_netvsc: cancel subchannel setup before halting device
    hv_netvsc: fix error unwind handling if vmbus_open fails
    hv_netvsc: only wake transmit queue if link is up
    hv_netvsc: avoid retry on send during shutdown
    virtio-net: re enable XDP_REDIRECT for mergeable buffer
    ppp: prevent unregistered channels from connecting to PPP units
    tc-testing: skbmod: fix match value of ethertype
    mlxsw: spectrum_switchdev: Check success of FDB add operation
    net: make skb_gso_*_seglen functions private
    net: xfrm: use skb_gso_validate_network_len() to check gso sizes
    net: sched: tbf: handle GSO_BY_FRAGS case in enqueue
    net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len
    rds: Incorrect reference counting in TCP socket creation
    net: ethtool: don't ignore return from driver get_fecparam method
    vrf: check forwarding on the original netdevice when generating ICMP dest unreachable
    ...

    Linus Torvalds
     

27 Feb, 2018

1 commit

  • While working on 16338a9b3ac3 ("bpf, arm64: fix out of bounds access in
    tail call") I noticed that ppc64 JIT is partially affected as well. While
    the bound checking is correctly performed as unsigned comparison, the
    register with the index value however, is never truncated into 32 bit
    space, so e.g. a index value of 0x100000000ULL with a map of 1 element
    would pass with PPC_CMPLW() whereas we later on continue with the full
    64 bit register value. Therefore, as we do in interpreter and other JITs
    truncate the value to 32 bit initially in order to fix access.

    Fixes: ce0761419fae ("powerpc/bpf: Implement support for tail calls")
    Signed-off-by: Daniel Borkmann
    Reviewed-by: Naveen N. Rao
    Tested-by: Naveen N. Rao
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     

22 Feb, 2018

1 commit

  • I am using SECCOMP to filter syscalls on a ppc32 platform, and noticed
    that the JIT compiler was failing on the BPF even though the
    interpreter was working fine.

    The issue was that the compiler was missing one of the instructions
    used by SECCOMP, so here is a patch to enable JIT for that
    instruction.

    Fixes: eb84bab0fb38 ("ppc: Kconfig: Enable BPF JIT on ppc32")
    Signed-off-by: Mark Lord
    Acked-by: Naveen N. Rao
    Signed-off-by: Michael Ellerman

    Mark Lord
     

27 Jan, 2018

1 commit


20 Jan, 2018

1 commit

  • Having a pure_initcall() callback just to permanently enable BPF
    JITs under CONFIG_BPF_JIT_ALWAYS_ON is unnecessary and could leave
    a small race window in future where JIT is still disabled on boot.
    Since we know about the setting at compilation time anyway, just
    initialize it properly there. Also consolidate all the individual
    bpf_jit_enable variables into a single one and move them under one
    location. Moreover, don't allow for setting unspecified garbage
    values on them.

    Signed-off-by: Daniel Borkmann
    Acked-by: Alexei Starovoitov
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     

23 Dec, 2017

1 commit

  • Lots of overlapping changes. Also on the net-next side
    the XDP state management is handled more in the generic
    layers so undo the 'net' nfp fix which isn't applicable
    in net-next.

    Include a necessary change by Jakub Kicinski, with log message:

    ====================
    cls_bpf no longer takes care of offload tracking. Make sure
    netdevsim performs necessary checks. This fixes a warning
    caused by TC trying to remove a filter it has not added.

    Signed-off-by: Jakub Kicinski
    Reviewed-by: Quentin Monnet
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

18 Dec, 2017

1 commit

  • global bpf_jit_enable variable is tested multiple times in JITs,
    blinding and verifier core. The malicious root can try to toggle
    it while loading the programs. This race condition was accounted
    for and there should be no issues, but it's safer to avoid
    this race condition.

    Signed-off-by: Alexei Starovoitov
    Acked-by: Daniel Borkmann
    Signed-off-by: Daniel Borkmann

    Alexei Starovoitov
     

16 Dec, 2017

1 commit

  • The assumption of unconditionally reloading skb pointers on
    BPF helper calls where bpf_helper_changes_pkt_data() holds
    true is wrong. There can be different contexts where the helper
    would enforce a reload such as in case of XDP. Here, we do
    have a struct xdp_buff instead of struct sk_buff as context,
    thus this will access garbage.

    JITs only ever need to deal with cached skb pointer reload
    when ld_abs/ind was seen, therefore guard the reload behind
    SEEN_SKB.

    Fixes: 156d0e290e96 ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
    Signed-off-by: Daniel Borkmann
    Reviewed-by: Naveen N. Rao
    Acked-by: Alexei Starovoitov
    Tested-by: Sandipan Das
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     

17 Nov, 2017

1 commit

  • Pull powerpc updates from Michael Ellerman:
    "A bit of a small release, I suspect in part due to me travelling for
    KS. But my backlog of patches to review is smaller than usual, so I
    think in part folks just didn't send as much this cycle.

    Non-highlights:

    - Five fixes for the >128T address space handling, both to fix bugs
    in our implementation and to bring the semantics exactly into line
    with x86.

    Highlights:

    - Support for a new OPAL call on bare metal machines which gives us a
    true NMI (ie. is not masked by MSR[EE]=0) for debugging etc.

    - Support for Power9 DD2 in the CXL driver.

    - Improvements to machine check handling so that uncorrectable errors
    can be reported into the generic memory_failure() machinery.

    - Some fixes and improvements for VPHN, which is used under PowerVM
    to notify the Linux partition of topology changes.

    - Plumbing to enable TM (transactional memory) without suspend on
    some Power9 processors (PPC_FEATURE2_HTM_NO_SUSPEND).

    - Support for emulating vector loads form cache-inhibited memory, on
    some Power9 revisions.

    - Disable the fast-endian switch "syscall" by default (behind a
    CONFIG), we believe it has never had any users.

    - A major rework of the API drivers use when initiating and waiting
    for long running operations performed by OPAL firmware, and changes
    to the powernv_flash driver to use the new API.

    - Several fixes for the handling of FP/VMX/VSX while processes are
    using transactional memory.

    - Optimisations of TLB range flushes when using the radix MMU on
    Power9.

    - Improvements to the VAS facility used to access coprocessors on
    Power9, and related improvements to the way the NX crypto driver
    handles requests.

    - Implementation of PMEM_API and UACCESS_FLUSHCACHE for 64-bit.

    Thanks to: Alexey Kardashevskiy, Alistair Popple, Allen Pais, Andrew
    Donnellan, Aneesh Kumar K.V, Arnd Bergmann, Balbir Singh, Benjamin
    Herrenschmidt, Breno Leitao, Christophe Leroy, Christophe Lombard,
    Cyril Bur, Frederic Barrat, Gautham R. Shenoy, Geert Uytterhoeven,
    Guilherme G. Piccoli, Gustavo Romero, Haren Myneni, Joel Stanley,
    Kamalesh Babulal, Kautuk Consul, Markus Elfring, Masami Hiramatsu,
    Michael Bringmann, Michael Neuling, Michal Suchanek, Naveen N. Rao,
    Nicholas Piggin, Oliver O'Halloran, Paul Mackerras, Pedro Miraglia
    Franco de Carvalho, Philippe Bergheaud, Sandipan Das, Seth Forshee,
    Shriya, Stephen Rothwell, Stewart Smith, Sukadev Bhattiprolu, Tyrel
    Datwyler, Vaibhav Jain, Vaidyanathan Srinivasan, and William A.
    Kennington III"

    * tag 'powerpc-4.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (151 commits)
    powerpc/64s: Fix Power9 DD2.0 workarounds by adding DD2.1 feature
    powerpc/64s: Fix masking of SRR1 bits on instruction fault
    powerpc/64s: mm_context.addr_limit is only used on hash
    powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation
    powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary
    powerpc/64s/hash: Fix fork() with 512TB process address space
    powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
    powerpc/64s/hash: Fix 512T hint detection to use >= 128T
    powerpc: Fix DABR match on hash based systems
    powerpc/signal: Properly handle return value from uprobe_deny_signal()
    powerpc/fadump: use kstrtoint to handle sysfs store
    powerpc/lib: Implement UACCESS_FLUSHCACHE API
    powerpc/lib: Implement PMEM API
    powerpc/powernv/npu: Don't explicitly flush nmmu tlb
    powerpc/powernv/npu: Use flush_all_mm() instead of flush_tlb_mm()
    powerpc/powernv/idle: Round up latency and residency values
    powerpc/kprobes: refactor kprobe_lookup_name for safer string operations
    powerpc/kprobes: Blacklist emulate_update_regs() from kprobes
    powerpc/kprobes: Do not disable interrupts for optprobes and kprobes_on_ftrace
    powerpc/kprobes: Disable preemption before invoking probe handler for optprobes
    ...

    Linus Torvalds
     

06 Nov, 2017

1 commit


02 Nov, 2017

1 commit

  • Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

08 Sep, 2017

1 commit

  • Pull powerpc updates from Michael Ellerman:
    "Nothing really major this release, despite quite a lot of activity.
    Just lots of things all over the place.

    Some things of note include:

    - Access via perf to a new type of PMU (IMC) on Power9, which can
    count both core events as well as nest unit events (Memory
    controller etc).

    - Optimisations to the radix MMU TLB flushing, mostly to avoid
    unnecessary Page Walk Cache (PWC) flushes when the structure of the
    tree is not changing.

    - Reworks/cleanups of do_page_fault() to modernise it and bring it
    closer to other architectures where possible.

    - Rework of our page table walking so that THP updates only need to
    send IPIs to CPUs where the affected mm has run, rather than all
    CPUs.

    - The size of our vmalloc area is increased to 56T on 64-bit hash MMU
    systems. This avoids problems with the percpu allocator on systems
    with very sparse NUMA layouts.

    - STRICT_KERNEL_RWX support on PPC32.

    - A new sched domain topology for Power9, to capture the fact that
    pairs of cores may share an L2 cache.

    - Power9 support for VAS, which is a new mechanism for accessing
    coprocessors, and initial support for using it with the NX
    compression accelerator.

    - Major work on the instruction emulation support, adding support for
    many new instructions, and reworking it so it can be used to
    implement the emulation needed to fixup alignment faults.

    - Support for guests under PowerVM to use the Power9 XIVE interrupt
    controller.

    And probably that many things again that are almost as interesting,
    but I had to keep the list short. Plus the usual fixes and cleanups as
    always.

    Thanks to: Alexey Kardashevskiy, Alistair Popple, Andreas Schwab,
    Aneesh Kumar K.V, Anju T Sudhakar, Arvind Yadav, Balbir Singh,
    Benjamin Herrenschmidt, Bhumika Goyal, Breno Leitao, Bryant G. Ly,
    Christophe Leroy, Cédric Le Goater, Dan Carpenter, Dou Liyang,
    Frederic Barrat, Gautham R. Shenoy, Geliang Tang, Geoff Levand, Hannes
    Reinecke, Haren Myneni, Ivan Mikhaylov, John Allen, Julia Lawall,
    LABBE Corentin, Laurentiu Tudor, Madhavan Srinivasan, Markus Elfring,
    Masahiro Yamada, Matt Brown, Michael Neuling, Murilo Opsfelder Araujo,
    Nathan Fontenot, Naveen N. Rao, Nicholas Piggin, Oliver O'Halloran,
    Paul Mackerras, Rashmica Gupta, Rob Herring, Rui Teng, Sam Bobroff,
    Santosh Sivaraj, Scott Wood, Shilpasri G Bhat, Sukadev Bhattiprolu,
    Suraj Jitindar Singh, Tobin C. Harding, Victor Aoqui"

    * tag 'powerpc-4.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (321 commits)
    powerpc/xive: Fix section __init warning
    powerpc: Fix kernel crash in emulation of vector loads and stores
    powerpc/xive: improve debugging macros
    powerpc/xive: add XIVE Exploitation Mode to CAS
    powerpc/xive: introduce H_INT_ESB hcall
    powerpc/xive: add the HW IRQ number under xive_irq_data
    powerpc/xive: introduce xive_esb_write()
    powerpc/xive: rename xive_poke_esb() in xive_esb_read()
    powerpc/xive: guest exploitation of the XIVE interrupt controller
    powerpc/xive: introduce a common routine xive_queue_page_alloc()
    powerpc/sstep: Avoid used uninitialized error
    axonram: Return directly after a failed kzalloc() in axon_ram_probe()
    axonram: Improve a size determination in axon_ram_probe()
    axonram: Delete an error message for a failed memory allocation in axon_ram_probe()
    powerpc/powernv/npu: Move tlb flush before launching ATSD
    powerpc/macintosh: constify wf_sensor_ops structures
    powerpc/iommu: Use permission-specific DEVICE_ATTR variants
    powerpc/eeh: Delete an error out of memory message at init time
    powerpc/mm: Use seq_putc() in two functions
    macintosh: Convert to using %pOF instead of full_name
    ...

    Linus Torvalds