1. 21 Jan, 2016 5 commits
    • Junil Lee's avatar
      zsmalloc: fix migrate_zspage-zs_free race condition · c102f07c
      Junil Lee authored
      record_obj() in migrate_zspage() does not preserve handle's
      HANDLE_PIN_BIT, set by find_aloced_obj()->trypin_tag(), and implicitly
      (accidentally) un-pins the handle, while migrate_zspage() still performs
      an explicit unpin_tag() on the that handle.  This additional explicit
      unpin_tag() introduces a race condition with zs_free(), which can pin
      that handle by this time, so the handle becomes un-pinned.
      
      Schematically, it goes like this:
      
        CPU0                                        CPU1
        migrate_zspage
          find_alloced_obj
            trypin_tag
              set HANDLE_PIN_BIT                    zs_free()
                                                      pin_tag()
        obj_malloc() -- new object, no tag
        record_obj() -- remove HANDLE_PIN_BIT           set HANDLE_PIN_BIT
        unpin_tag()  -- remove zs_free's HANDLE_PIN_BIT
      
      The race condition may result in a NULL pointer dereference:
      
        Unable to handle kernel NULL pointer dereference at virtual address 00000000
        CPU: 0 PID: 19001 Comm: CookieMonsterCl Tainted:
        PC is at get_zspage_mapping+0x0/0x24
        LR is at obj_free.isra.22+0x64/0x128
        Call trace:
           get_zspage_mapping+0x0/0x24
           zs_free+0x88/0x114
           zram_free_page+0x64/0xcc
           zram_slot_free_notify+0x90/0x108
           swap_entry_free+0x278/0x294
           free_swap_and_cache+0x38/0x11c
           unmap_single_vma+0x480/0x5c8
           unmap_vmas+0x44/0x60
           exit_mmap+0x50/0x110
           mmput+0x58/0xe0
           do_exit+0x320/0x8dc
           do_group_exit+0x44/0xa8
           get_signal+0x538/0x580
           do_signal+0x98/0x4b8
           do_notify_resume+0x14/0x5c
      
      This patch keeps the lock bit in migration path and update value
      atomically.
      Signed-off-by: default avatarJunil Lee <junil0814.lee@lge.com>
      Signed-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
      Cc: <stable@vger.kernel.org> [4.1+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c102f07c
    • Guenter Roeck's avatar
      mm: arch: remove duplicate definitions of MADV_FREE · dcd6c87c
      Guenter Roeck authored
      Commits 21f55b01 ("arch/*/include/uapi/asm/mman.h: : let MADV_FREE
      have same value for all architectures") and ef58978f ("mm: define
      MADV_FREE for some arches") both defined MADV_FREE, but did not use the
      same values.  This results in build errors such as
      
        ./arch/alpha/include/uapi/asm/mman.h:53:0: error: "MADV_FREE" redefined
        ./arch/alpha/include/uapi/asm/mman.h:50:0: note: this is the location of the previous definition
      
      for the affected architectures.
      
      Fixes: 21f55b01 ("arch/*/include/uapi/asm/mman.h: : let MADV_FREE have same value for all architectures")
      Fixes: ef58978f ("mm: define MADV_FREE for some arches")
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Cc: Chen Gang <gang.chen.5i5j@gmail.com>
      Cc: Minchan Kim <minchan@kernel.org>
      Acked-by: Helge Deller <deller@gmx.de>	[parisc]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dcd6c87c
    • Kirill A. Shutemov's avatar
      fs/proc/task_mmu.c: add workaround for old compilers · f4be6153
      Kirill A. Shutemov authored
      For THP=n, HPAGE_PMD_NR in smaps_account() expands to BUILD_BUG().
      That's fine since this codepath is eliminated by modern compilers.
      
      But older compilers have not that efficient dead code elimination.  It
      causes problem at least with gcc 4.1.2 on m68k:
      
         fs/built-in.o: In function `smaps_account':
         task_mmu.c:(.text+0x4f8fa): undefined reference to `__compiletime_assert_471'
      
      Let's replace HPAGE_PMD_NR with 1 << compound_order(page).
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f4be6153
    • Kirill A. Shutemov's avatar
      thp: fix interrupt unsafe locking in split_huge_page() · 0b9b6fff
      Kirill A. Shutemov authored
      split_queue_lock can be taken from interrupt context in some cases, but
      I forgot to convert locking in split_huge_page() to interrupt-safe
      primitives.
      
      Let's fix this.
      
      lockdep output:
      
        ======================================================
        [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ]
        4.4.0+ #259 Tainted: G        W
        ------------------------------------------------------
        syz-executor/18183 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire:
         (split_queue_lock){+.+...}, at: free_transhuge_page+0x24/0x90 mm/huge_memory.c:3436
      
        and this task is already holding:
         (slock-AF_INET){+.-...}, at: spin_lock_bh include/linux/spinlock.h:307
         (slock-AF_INET){+.-...}, at: lock_sock_fast+0x45/0x120 net/core/sock.c:2462
        which would create a new lock dependency:
         (slock-AF_INET){+.-...} -> (split_queue_lock){+.+...}
      
        but this new dependency connects a SOFTIRQ-irq-safe lock:
         (slock-AF_INET){+.-...}
        ... which became SOFTIRQ-irq-safe at:
           mark_irqflags kernel/locking/lockdep.c:2799
           __lock_acquire+0xfd8/0x4700 kernel/locking/lockdep.c:3162
           lock_acquire+0x1dc/0x430 kernel/locking/lockdep.c:3585
           __raw_spin_lock include/linux/spinlock_api_smp.h:144
           _raw_spin_lock+0x33/0x50 kernel/locking/spinlock.c:151
           spin_lock include/linux/spinlock.h:302
           udp_queue_rcv_skb+0x781/0x1550 net/ipv4/udp.c:1680
           flush_stack+0x50/0x330 net/ipv6/udp.c:799
           __udp4_lib_mcast_deliver+0x694/0x7f0 net/ipv4/udp.c:1798
           __udp4_lib_rcv+0x17dc/0x23e0 net/ipv4/udp.c:1888
           udp_rcv+0x21/0x30 net/ipv4/udp.c:2108
           ip_local_deliver_finish+0x2b3/0xa50 net/ipv4/ip_input.c:216
           NF_HOOK_THRESH include/linux/netfilter.h:226
           NF_HOOK include/linux/netfilter.h:249
           ip_local_deliver+0x1c4/0x2f0 net/ipv4/ip_input.c:257
           dst_input include/net/dst.h:498
           ip_rcv_finish+0x5ec/0x1730 net/ipv4/ip_input.c:365
           NF_HOOK_THRESH include/linux/netfilter.h:226
           NF_HOOK include/linux/netfilter.h:249
           ip_rcv+0x963/0x1080 net/ipv4/ip_input.c:455
           __netif_receive_skb_core+0x1620/0x2f80 net/core/dev.c:4154
           __netif_receive_skb+0x2a/0x160 net/core/dev.c:4189
           netif_receive_skb_internal+0x1b5/0x390 net/core/dev.c:4217
           napi_skb_finish net/core/dev.c:4542
           napi_gro_receive+0x2bd/0x3c0 net/core/dev.c:4572
           e1000_clean_rx_irq+0x4e2/0x1100 drivers/net/ethernet/intel/e1000e/netdev.c:1038
           e1000_clean+0xa08/0x24a0 drivers/net/ethernet/intel/e1000/e1000_main.c:3819
           napi_poll net/core/dev.c:5074
           net_rx_action+0x7eb/0xdf0 net/core/dev.c:5139
           __do_softirq+0x26a/0x920 kernel/softirq.c:273
           invoke_softirq kernel/softirq.c:350
           irq_exit+0x18f/0x1d0 kernel/softirq.c:391
           exiting_irq ./arch/x86/include/asm/apic.h:659
           do_IRQ+0x86/0x1a0 arch/x86/kernel/irq.c:252
           ret_from_intr+0x0/0x20 arch/x86/entry/entry_64.S:520
           arch_safe_halt ./arch/x86/include/asm/paravirt.h:117
           default_idle+0x52/0x2e0 arch/x86/kernel/process.c:304
           arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:295
           default_idle_call+0x48/0xa0 kernel/sched/idle.c:92
           cpuidle_idle_call kernel/sched/idle.c:156
           cpu_idle_loop kernel/sched/idle.c:252
           cpu_startup_entry+0x554/0x710 kernel/sched/idle.c:300
           rest_init+0x192/0x1a0 init/main.c:412
           start_kernel+0x678/0x69e init/main.c:683
           x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:195
           x86_64_start_kernel+0x158/0x167 arch/x86/kernel/head64.c:184
      
        to a SOFTIRQ-irq-unsafe lock:
         (split_queue_lock){+.+...}
         which became SOFTIRQ-irq-unsafe at:
           mark_irqflags kernel/locking/lockdep.c:2817
           __lock_acquire+0x146e/0x4700 kernel/locking/lockdep.c:3162
           lock_acquire+0x1dc/0x430 kernel/locking/lockdep.c:3585
           __raw_spin_lock include/linux/spinlock_api_smp.h:144
           _raw_spin_lock+0x33/0x50 kernel/locking/spinlock.c:151
           spin_lock include/linux/spinlock.h:302
           split_huge_page_to_list+0xcc0/0x1c50 mm/huge_memory.c:3399
           split_huge_page include/linux/huge_mm.h:99
           queue_pages_pte_range+0xa38/0xef0 mm/mempolicy.c:507
           walk_pmd_range mm/pagewalk.c:50
           walk_pud_range mm/pagewalk.c:90
           walk_pgd_range mm/pagewalk.c:116
           __walk_page_range+0x653/0xcd0 mm/pagewalk.c:204
           walk_page_range+0xfe/0x2b0 mm/pagewalk.c:281
           queue_pages_range+0xfb/0x130 mm/mempolicy.c:687
           migrate_to_node mm/mempolicy.c:1004
           do_migrate_pages+0x370/0x4e0 mm/mempolicy.c:1109
           SYSC_migrate_pages mm/mempolicy.c:1453
           SyS_migrate_pages+0x640/0x730 mm/mempolicy.c:1374
           entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185
      
        other info that might help us debug this:
      
         Possible interrupt unsafe locking scenario:
      
               CPU0                    CPU1
               ----                    ----
          lock(split_queue_lock);
                                       local_irq_disable();
                                       lock(slock-AF_INET);
                                       lock(split_queue_lock);
          <Interrupt>
            lock(slock-AF_INET);
      Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Reviewed-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0b9b6fff
    • Jean Delvare's avatar
      lib/libcrc32c.c: fix build warning · 290e0e0f
      Jean Delvare authored
      Fix the following build warning:
      
        lib/libcrc32c.c:42:5: warning: no previous prototype for "crc32c" [-Wmissing-prototypes]
         u32 crc32c(u32 crc, const void *address, unsigned int length)
             ^
      Signed-off-by: default avatarJean Delvare <jdelvare@suse.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      290e0e0f
  2. 20 Jan, 2016 24 commits
  3. 19 Jan, 2016 11 commits
    • Yevgeny Pats's avatar
      KEYS: Fix keyring ref leak in join_session_keyring() · 23567fd0
      Yevgeny Pats authored
      This fixes CVE-2016-0728.
      
      If a thread is asked to join as a session keyring the keyring that's already
      set as its session, we leak a keyring reference.
      
      This can be tested with the following program:
      
      	#include <stddef.h>
      	#include <stdio.h>
      	#include <sys/types.h>
      	#include <keyutils.h>
      
      	int main(int argc, const char *argv[])
      	{
      		int i = 0;
      		key_serial_t serial;
      
      		serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
      				"leaked-keyring");
      		if (serial < 0) {
      			perror("keyctl");
      			return -1;
      		}
      
      		if (keyctl(KEYCTL_SETPERM, serial,
      			   KEY_POS_ALL | KEY_USR_ALL) < 0) {
      			perror("keyctl");
      			return -1;
      		}
      
      		for (i = 0; i < 100; i++) {
      			serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
      					"leaked-keyring");
      			if (serial < 0) {
      				perror("keyctl");
      				return -1;
      			}
      		}
      
      		return 0;
      	}
      
      If, after the program has run, there something like the following line in
      /proc/keys:
      
      3f3d898f I--Q---   100 perm 3f3f0000     0     0 keyring   leaked-keyring: empty
      
      with a usage count of 100 * the number of times the program has been run,
      then the kernel is malfunctioning.  If leaked-keyring has zero usages or
      has been garbage collected, then the problem is fixed.
      Reported-by: default avatarYevgeny Pats <yevgeny@perception-point.io>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Acked-by: default avatarDon Zickus <dzickus@redhat.com>
      Acked-by: default avatarPrarit Bhargava <prarit@redhat.com>
      Acked-by: default avatarJarod Wilson <jarod@redhat.com>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      23567fd0
    • Mattia Dongili's avatar
      Keyboard backlight control for some Vaio Fit models · 800f2017
      Mattia Dongili authored
      SVF1521P6EW, SVF1521DCXW, SVF13N1L2ES and likely most SVF*.
      do not expose separate timeout controls in auto mode.
      Signed-off-by: default avatarDominik Matta <dominik@matta.sk>
      Signed-off-by: default avatarMattia Dongili <malattia@linux.it>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      800f2017
    • Azael Avalos's avatar
      platform/x86: Add rfkill dependency to ACPI_TOSHIBA entry · dc4522be
      Azael Avalos authored
      Commit 2fdde834 ("toshiba_acpi: Add WWAN RFKill support") added
      WWAN rfkill support to the driver, but the KConfig entry was not
      updated to add the RFKill dependency, causing a broken build if
      RFKill is not selected.
      
      This patch adds the RFKILL dependency to the KConfig entry, fixing
      the build issue.
      Signed-off-by: default avatarAzael Avalos <coproscefalo@gmail.com>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      dc4522be
    • Qipeng Zha's avatar
      platform:x86: add Intel P-Unit mailbox IPC driver · fdca4f16
      Qipeng Zha authored
      This driver provides support for P-Unit mailbox IPC on Intel platforms.
      The heart of the P-Unit is the Foxton microcontroller and its firmware,
      which provide mailbox interface for power management usage.
      Signed-off-by: default avatarQipeng Zha <qipeng.zha@intel.com>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      fdca4f16
    • Qipeng Zha's avatar
      intel_pmc_ipc: update acpi resource structure for Punit · 8cc7fb4a
      Qipeng Zha authored
      BIOS restructure exported memory resources for Punit
      in acpi table, So update resources for Punit.
      Signed-off-by: default avatarQipeng Zha <qipeng.zha@intel.com>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      8cc7fb4a
    • Josh Boyer's avatar
      ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list · edde316a
      Josh Boyer authored
      One of the newest ideapad models also lacks a physical hw rfkill switch,
      and trying to read the hw rfkill switch through the ideapad module
      causes it to always reported blocking breaking wifi.
      
      Fix it by adding this model to the DMI list.
      
      BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1286293
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJosh Boyer <jwboyer@fedoraproject.org>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      edde316a
    • Andy Lutomirski's avatar
      dell-wmi: Improve unknown hotkey handling · cbc61f11
      Andy Lutomirski authored
      If DMI lists a hotkey that we don't recognize, log and ignore it
      instead of trying to map it to keycode 0.  I haven't seen this happen,
      but it will help maintain the key map in the future and it will help
      avoid sending bogus events.
      
      This also improves the message that we log when we get an unknown key
      event.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Reviewed-by: default avatarPali Rohár <pali.rohar@gmail.com>
      [dvhart: remove BUILD_BUG_ON per mutual agreement on list]
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      cbc61f11
    • Matthew Garrett's avatar
      apple-gmux: Assign apple_gmux_data before registering · c1e1655b
      Matthew Garrett authored
      Registering the handler after both GPUs will trigger a DDC switch for
      connector reprobing. This will oops if apple_gmux_data hasn't already
      been assigned. Reorder the code to do that.
      
      [Lukas: More generally, this commit fixes a race condition that
      is triggered by invoking a handler callback between the call to
      vga_switcheroo_register_handler() and the assignment of
      apple_gmux_data.]
      Tested-by: default avatarPierre Moreau <pierre.morrow@free.fr>
          [MBP  5,3 2009  nvidia MCP79 + G96        pre-retina  15"]
      Tested-by: default avatarPaul Hordiienko <pvt.gord@gmail.com>
          [MBP  6,2 2010  intel ILK + nvidia GT216  pre-retina  15"]
      Tested-by: default avatarLukas Wunner <lukas@wunner.de>
          [MBP  9,1 2012  intel IVB + nvidia GK107  pre-retina  15"]
      Tested-by: default avatarWilliam Brown <william@blackhats.net.au>
          [MBP  8,2 2011  intel SNB + amd turks     pre-retina  15"]
      Tested-by: default avatarBruno Bierbaumer <bruno@bierbaumer.net>
          [MBP 11,3 2013  intel HSW + nvidia GK107  retina      15"]
      Signed-off-by: default avatarMatthew Garrett <matthew.garrett@nebula.com>
      Reviewed-by: default avatarLukas Wunner <lukas@wunner.de>
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      c1e1655b
    • Azael Avalos's avatar
      toshiba_acpi: Fix keyboard backlight sysfs entries not being updated · 65e3cf9c
      Azael Avalos authored
      Certain Toshiba models with the second generation keyboard backlight
      (type 2) do not generate the keyboard backlight changed event (0x92),
      and thus, the sysfs entries are never being updated.
      
      This patch adds a workquee and a global boolean variable to address
      the issue.
      
      For those models that do generate the event, the sysfs entries are
      being updated via the *notify function and the boolean is set to
      true to avoid a second call to update the entries.
      
      For those models that do not generate the event, the workquee is
      used to update the sysfs entries and also to emulate the event via
      netlink, to make userspace aware of such change.
      Signed-off-by: default avatarAzael Avalos <coproscefalo@gmail.com>
      Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
      65e3cf9c
    • Linus Torvalds's avatar
      Merge branch 'for-4.5/core' of git://git.kernel.dk/linux-block · 7c24d9f3
      Linus Torvalds authored
      Pull core block updates from Jens Axboe:
       "We don't have a lot of core changes this time around, it's mostly in
        drivers, which will come in a subsequent pull.
      
        The cores changes include:
      
         - blk-mq
              - Prep patch from Christoph, changing blk_mq_alloc_request() to
                take flags instead of just using gfp_t for sleep/nosleep.
              - Doc patch from me, clarifying the difference between legacy
                and blk-mq for timer usage.
              - Fixes from Raghavendra for memory-less numa nodes, and a reuse
                of CPU masks.
      
         - Cleanup from Geliang Tang, using offset_in_page() instead of open
           coding it.
      
         - From Ilya, rename request_queue slab to it reflects what it holds,
           and a fix for proper use of bdgrab/put.
      
         - A real fix for the split across stripe boundaries from Keith.  We
           yanked a broken version of this from 4.4-rc final, this one works.
      
         - From Mike Krinkin, emit a trace message when we split.
      
         - From Wei Tang, two small cleanups, not explicitly clearing memory
           that is already cleared"
      
      * 'for-4.5/core' of git://git.kernel.dk/linux-block:
        block: use bd{grab,put}() instead of open-coding
        block: split bios to max possible length
        block: add call to split trace point
        blk-mq: Avoid memoryless numa node encoded in hctx numa_node
        blk-mq: Reuse hardware context cpumask for tags
        blk-mq: add a flags parameter to blk_mq_alloc_request
        Revert "blk-flush: Queue through IO scheduler when flush not required"
        block: clarify blk_add_timer() use case for blk-mq
        bio: use offset_in_page macro
        block: do not initialise statics to 0 or NULL
        block: do not initialise globals to 0 or NULL
        block: rename request_queue slab cache
      7c24d9f3
    • Linus Torvalds's avatar
      Merge tag 'iommu-updates-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 99e38df8
      Linus Torvalds authored
      Pull IOMMU updates from Joerg Roedel:
       "The updates include:
      
         - Small code cleanups in the AMD IOMMUv2 driver
      
         - Scalability improvements for the DMA-API implementation of the AMD
           IOMMU driver.  This is just a starting point, but already showed
           some good improvements in my tests.
      
         - Removal of the unused Renesas IPMMU/IPMMUI driver
      
         - Updates for ARM-SMMU include:
            * Some fixes to get the driver working nicely on Broadcom hardware
            * A change to the io-pgtable API to indicate the unit in which to
              flush (all callers converted, with Ack from Laurent)
            * Use of devm_* for allocating/freeing the SMMUv3 buffers
      
         - Some other small fixes and improvements for other drivers"
      
      * tag 'iommu-updates-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (46 commits)
        iommu/vt-d: Fix up error handling in alloc_iommu
        iommu/vt-d: Check the return value of iommu_device_create()
        iommu/amd: Remove an unneeded condition
        iommu/amd: Preallocate dma_ops apertures based on dma_mask
        iommu/amd: Use trylock to aquire bitmap_lock
        iommu/amd: Make dma_ops_domain->next_index percpu
        iommu/amd: Relax locking in dma_ops path
        iommu/amd: Initialize new aperture range before making it visible
        iommu/amd: Build io page-tables with cmpxchg64
        iommu/amd: Allocate new aperture ranges in dma_ops_alloc_addresses
        iommu/amd: Optimize dma_ops_free_addresses
        iommu/amd: Remove need_flush from struct dma_ops_domain
        iommu/amd: Iterate over all aperture ranges in dma_ops_area_alloc
        iommu/amd: Flush iommu tlb in dma_ops_free_addresses
        iommu/amd: Rename dma_ops_domain->next_address to next_index
        iommu/amd: Remove 'start' parameter from dma_ops_area_alloc
        iommu/amd: Flush iommu tlb in dma_ops_aperture_alloc()
        iommu/amd: Retry address allocation within one aperture
        iommu/amd: Move aperture_range.offset to another cache-line
        iommu/amd: Add dma_ops_aperture_alloc() function
        ...
      99e38df8