1. 29 Dec, 2017 40 commits
    • Guneshwor Singh's avatar
      ALSA: hda - Add vendor id for Cannonlake HDMI codec · 70709c27
      Guneshwor Singh authored
      commit 2b4584d0 upstream.
      
      Cannonlake HDMI codec has the same nid as Geminilake. This adds the
      codec entry for it.
      Signed-off-by: default avatarGuneshwor Singh <guneshwor.o.singh@intel.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      70709c27
    • Kailang Yang's avatar
      ALSA: hda/realtek - Fix Dell AIO LineOut issue · 7a6a8463
      Kailang Yang authored
      commit 92266651 upstream.
      
      Dell AIO had LineOut jack.
      Add LineOut verb into this patch.
      
      [ Additional notes:
        the ALC274 codec seems requiring the fixed pin / DAC connections for
        HP / line-out pins for enabling EQ for speakers; i.e. the HP / LO
        pins expect to be connected with NID 0x03 while keeping the speaker
        with NID 0x02.  However, by adding a new line-out pin, the
        auto-parser assigns the NID 0x02 for HP/LO pins as primary outputs.
        As an easy workaround, we provide the preferred_pairs[] to map
        forcibly for these pins. -- tiwai ]
      
      Fixes: 75ee94b2 ("ALSA: hda - fix headset mic problem for Dell machines with alc274")
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7a6a8463
    • Takashi Iwai's avatar
      ALSA: rawmidi: Avoid racy info ioctl via ctl device · 065a2865
      Takashi Iwai authored
      commit c1cfd902 upstream.
      
      The rawmidi also allows to obtaining the information via ioctl of ctl
      API.  It means that user can issue an ioctl to the rawmidi device even
      when it's being removed as long as the control device is present.
      Although the code has some protection via the global register_mutex,
      its range is limited to the search of the corresponding rawmidi
      object, and the mutex is already unlocked at accessing the rawmidi
      object.  This may lead to a use-after-free.
      
      For avoiding it, this patch widens the application of register_mutex
      to the whole snd_rawmidi_info_select() function.  We have another
      mutex per rawmidi object, but this operation isn't very hot path, so
      it shouldn't matter from the performance POV.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      065a2865
    • Johan Hovold's avatar
      mfd: twl6040: Fix child-node lookup · 637de99c
      Johan Hovold authored
      commit 85e9b13c upstream.
      
      Fix child-node lookup during probe, which ended up searching the whole
      device tree depth-first starting at the parent rather than just matching
      on its children.
      
      To make things worse, the parent node was prematurely freed, while the
      child node was leaked.
      
      Note that the CONFIG_OF compile guard can be removed as
      of_get_child_by_name() provides a !CONFIG_OF implementation which always
      fails.
      
      Fixes: 37e13cec ("mfd: Add support for Device Tree to twl6040")
      Fixes: ca2cad6a ("mfd: Fix twl6040 build failure")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarPeter Ujfalusi <peter.ujfalusi@ti.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      637de99c
    • Johan Hovold's avatar
      mfd: twl4030-audio: Fix sibling-node lookup · 6300daa0
      Johan Hovold authored
      commit 0a423772 upstream.
      
      A helper purported to look up a child node based on its name was using
      the wrong of-helper and ended up prematurely freeing the parent of-node
      while leaking any matching node.
      
      To make things worse, any matching node would not even necessarily be a
      child node as the whole device tree was searched depth-first starting at
      the parent.
      
      Fixes: 019a7e6b ("mfd: twl4030-audio: Add DT support")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarPeter Ujfalusi <peter.ujfalusi@ti.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6300daa0
    • Jon Hunter's avatar
      mfd: cros ec: spi: Don't send first message too soon · de3b66c0
      Jon Hunter authored
      commit 15d83748 upstream.
      
      On the Tegra124 Nyan-Big chromebook the very first SPI message sent to
      the EC is failing.
      
      The Tegra SPI driver configures the SPI chip-selects to be active-high
      by default (and always has for many years). The EC SPI requires an
      active-low chip-select and so the Tegra chip-select is reconfigured to
      be active-low when the EC SPI driver calls spi_setup(). The problem is
      that if the first SPI message to the EC is sent too soon after
      reconfiguring the SPI chip-select, it fails.
      
      The EC SPI driver prevents back-to-back SPI messages being sent too
      soon by keeping track of the time the last transfer was sent via the
      variable 'last_transfer_ns'. To prevent the very first transfer being
      sent too soon, initialise the 'last_transfer_ns' variable after calling
      spi_setup() and before sending the first SPI message.
      Signed-off-by: default avatarJon Hunter <jonathanh@nvidia.com>
      Reviewed-by: default avatarBrian Norris <briannorris@chromium.org>
      Reviewed-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarBenson Leung <bleung@chromium.org>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      de3b66c0
    • Stephan Mueller's avatar
      crypto: af_alg - fix race accessing cipher request · f09fca41
      Stephan Mueller authored
      commit d53c5135 upstream.
      
      When invoking an asynchronous cipher operation, the invocation of the
      callback may be performed before the subsequent operations in the
      initial code path are invoked. The callback deletes the cipher request
      data structure which implies that after the invocation of the
      asynchronous cipher operation, this data structure must not be accessed
      any more.
      
      The setting of the return code size with the request data structure must
      therefore be moved before the invocation of the asynchronous cipher
      operation.
      
      Fixes: e870456d ("crypto: algif_skcipher - overhaul memory management")
      Fixes: d887c52d ("crypto: algif_aead - overhaul memory management")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarStephan Mueller <smueller@chronox.de>
      Acked-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f09fca41
    • Stephan Mueller's avatar
      crypto: af_alg - wait for data at beginning of recvmsg · c692698e
      Stephan Mueller authored
      commit 11edb555 upstream.
      
      The wait for data is a non-atomic operation that can sleep and therefore
      potentially release the socket lock. The release of the socket lock
      allows another thread to modify the context data structure. The waiting
      operation for new data therefore must be called at the beginning of
      recvmsg. This prevents a race condition where checks of the members of
      the context data structure are performed by recvmsg while there is a
      potential for modification of these values.
      
      Fixes: e870456d ("crypto: algif_skcipher - overhaul memory management")
      Fixes: d887c52d ("crypto: algif_aead - overhaul memory management")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarStephan Mueller <smueller@chronox.de>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c692698e
    • Sebastian Andrzej Siewior's avatar
      crypto: mcryptd - protect the per-CPU queue with a lock · 88990591
      Sebastian Andrzej Siewior authored
      commit 9abffc6f upstream.
      
      mcryptd_enqueue_request() grabs the per-CPU queue struct and protects
      access to it with disabled preemption. Then it schedules a worker on the
      same CPU. The worker in mcryptd_queue_worker() guards access to the same
      per-CPU variable with disabled preemption.
      
      If we take CPU-hotplug into account then it is possible that between
      queue_work_on() and the actual invocation of the worker the CPU goes
      down and the worker will be scheduled on _another_ CPU. And here the
      preempt_disable() protection does not work anymore. The easiest thing is
      to add a spin_lock() to guard access to the list.
      
      Another detail: mcryptd_queue_worker() is not processing more than
      MCRYPTD_BATCH invocation in a row. If there are still items left, then
      it will invoke queue_work() to proceed with more later. *I* would
      suggest to simply drop that check because it does not use a system
      workqueue and the workqueue is already marked as "CPU_INTENSIVE". And if
      preemption is required then the scheduler should do it.
      However if queue_work() is used then the work item is marked as CPU
      unbound. That means it will try to run on the local CPU but it may run
      on another CPU as well. Especially with CONFIG_DEBUG_WQ_FORCE_RR_CPU=y.
      Again, the preempt_disable() won't work here but lock which was
      introduced will help.
      In order to keep work-item on the local CPU (and avoid RR) I changed it
      to queue_work_on().
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      88990591
    • Eric Biggers's avatar
      crypto: skcipher - set walk.iv for zero-length inputs · 29082870
      Eric Biggers authored
      commit 2b4f27c3 upstream.
      
      All the ChaCha20 algorithms as well as the ARM bit-sliced AES-XTS
      algorithms call skcipher_walk_virt(), then access the IV (walk.iv)
      before checking whether any bytes need to be processed (walk.nbytes).
      
      But if the input is empty, then skcipher_walk_virt() doesn't set the IV,
      and the algorithms crash trying to use the uninitialized IV pointer.
      
      Fix it by setting the IV earlier in skcipher_walk_virt().  Also fix it
      for the AEAD walk functions.
      
      This isn't a perfect solution because we can't actually align the IV to
      ->cra_alignmask unless there are bytes to process, for one because the
      temporary buffer for the aligned IV is freed by skcipher_walk_done(),
      which is only called when there are bytes to process.  Thus, algorithms
      that require aligned IVs will still need to avoid accessing the IV when
      walk.nbytes == 0.  Still, many algorithms/architectures are fine with
      IVs having any alignment, and even for those that aren't, a misaligned
      pointer bug is much less severe than an uninitialized pointer bug.
      
      This change also matches the behavior of the older blkcipher_walk API.
      
      Fixes: 0cabf2af ("crypto: skcipher - Fix crash on zero-length input")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      29082870
    • Dan Williams's avatar
      acpi, nfit: fix health event notification · 94e0c5ab
      Dan Williams authored
      commit adf68957 upstream.
      
      Integration testing with a BIOS that generates injected health event
      notifications fails to communicate those events to userspace. The nfit
      driver neglects to link the ACPI DIMM device with the necessary driver
      data so acpi_nvdimm_notify() fails this lookup:
      
              nfit_mem = dev_get_drvdata(dev);
              if (nfit_mem && nfit_mem->flags_attr)
                      sysfs_notify_dirent(nfit_mem->flags_attr);
      
      Add the necessary linkage when installing the notification handler and
      clean it up when the nfit driver instance is torn down.
      
      Cc: Toshi Kani <toshi.kani@hpe.com>
      Cc: Vishal Verma <vishal.l.verma@intel.com>
      Fixes: ba9c8dd3 ("acpi, nfit: add dimm device notification support")
      Reported-by: default avatarDaniel Osawa <daniel.k.osawa@intel.com>
      Tested-by: default avatarDaniel Osawa <daniel.k.osawa@intel.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      94e0c5ab
    • Takashi Iwai's avatar
      ACPI: APEI / ERST: Fix missing error handling in erst_reader() · 7a5d5789
      Takashi Iwai authored
      commit bb82e0b4 upstream.
      
      The commit f6f82851 ("pstore: pass allocated memory region back to
      caller") changed the check of the return value from erst_read() in
      erst_reader() in the following way:
      
              if (len == -ENOENT)
                      goto skip;
      -       else if (len < 0) {
      -               rc = -1;
      +       else if (len < sizeof(*rcd)) {
      +               rc = -EIO;
                      goto out;
      
      This introduced another bug: since the comparison with sizeof() is
      cast to unsigned, a negative len value doesn't hit any longer.
      As a result, when an error is returned from erst_read(), the code
      falls through, and it may eventually lead to some weird thing like
      memory corruption.
      
      This patch adds the negative error value check more explicitly for
      addressing the issue.
      
      Fixes: f6f82851 (pstore: pass allocated memory region back to caller)
      Tested-by: default avatarJerry Tang <jtang@suse.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7a5d5789
    • Thomas Gleixner's avatar
      x86/cpu_entry_area: Prevent wraparound in setup_cpu_entry_area_ptes() on 32bit · 752d0170
      Thomas Gleixner authored
      commit f6c4fd50 upstream.
      
      The loop which populates the CPU entry area PMDs can wrap around on 32bit
      machines when the number of CPUs is small.
      
      It worked wonderful for NR_CPUS=64 for whatever reason and the moron who
      wrote that code did not bother to test it with !SMP.
      
      Check for the wraparound to fix it.
      
      Fixes: 92a0f81d ("x86/cpu_entry_area: Move it out of the fixmap")
      Reported-by: default avatarkernel test robot <fengguang.wu@intel.com>
      Signed-off-by: default avatarThomas "Feels stupid" Gleixner <tglx@linutronix.de>
      Tested-by: default avatarBorislav Petkov <bp@alien8.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      752d0170
    • Thomas Gleixner's avatar
      init: Invoke init_espfix_bsp() from mm_init() · 763f7eaf
      Thomas Gleixner authored
      commit 613e396b upstream.
      
      init_espfix_bsp() needs to be invoked before the page table isolation
      initialization. Move it into mm_init() which is the place where pti_init()
      will be added.
      
      While at it get rid of the #ifdeffery and provide proper stub functions.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      763f7eaf
    • Thomas Gleixner's avatar
      x86/cpu_entry_area: Move it out of the fixmap · 34400932
      Thomas Gleixner authored
      commit 92a0f81d upstream.
      
      Put the cpu_entry_area into a separate P4D entry. The fixmap gets too big
      and 0-day already hit a case where the fixmap PTEs were cleared by
      cleanup_highmap().
      
      Aside of that the fixmap API is a pain as it's all backwards.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      34400932
    • Thomas Gleixner's avatar
      x86/cpu_entry_area: Move it to a separate unit · 1b0eddf0
      Thomas Gleixner authored
      commit ed1bbc40 upstream.
      
      Separate the cpu_entry_area code out of cpu/common.c and the fixmap.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1b0eddf0
    • Peter Zijlstra's avatar
      x86/mm: Create asm/invpcid.h · b6167aeb
      Peter Zijlstra authored
      commit 1a3b0cae upstream.
      
      Unclutter tlbflush.h a little.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b6167aeb
    • Dave Hansen's avatar
      x86/mm: Put MMU to hardware ASID translation in one place · acefb451
      Dave Hansen authored
      commit dd95f1a4 upstream.
      
      There are effectively two ASID types:
      
       1. The one stored in the mmu_context that goes from 0..5
       2. The one programmed into the hardware that goes from 1..6
      
      This consolidates the locations where converting between the two (by doing
      a +1) to a single place which gives us a nice place to comment.
      PAGE_TABLE_ISOLATION will also need to, given an ASID, know which hardware
      ASID to flush for the userspace mapping.
      Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      acefb451
    • Dave Hansen's avatar
      x86/mm: Remove hard-coded ASID limit checks · 1765d0a5
      Dave Hansen authored
      commit cb0a9144 upstream.
      
      First, it's nice to remove the magic numbers.
      
      Second, PAGE_TABLE_ISOLATION is going to consume half of the available ASID
      space.  The space is currently unused, but add a comment to spell out this
      new restriction.
      Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1765d0a5
    • Dave Hansen's avatar
      x86/mm: Move the CR3 construction functions to tlbflush.h · b72e0abe
      Dave Hansen authored
      commit 50fb83a6 upstream.
      
      For flushing the TLB, the ASID which has been programmed into the hardware
      must be known.  That differs from what is in 'cpu_tlbstate'.
      
      Add functions to transform the 'cpu_tlbstate' values into to the one
      programmed into the hardware (CR3).
      
      It's not easy to include mmu_context.h into tlbflush.h, so just move the
      CR3 building over to tlbflush.h.
      Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b72e0abe
    • Peter Zijlstra's avatar
      x86/mm: Add comments to clarify which TLB-flush functions are supposed to flush what · 29606f10
      Peter Zijlstra authored
      commit 3f67af51 upstream.
      
      Per popular request..
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      29606f10
    • Peter Zijlstra's avatar
      x86/mm: Remove superfluous barriers · 6472c502
      Peter Zijlstra authored
      commit b5fc6d94 upstream.
      
      atomic64_inc_return() already implies smp_mb() before and after.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6472c502
    • Peter Zijlstra's avatar
      x86/mm: Use __flush_tlb_one() for kernel memory · a0edc494
      Peter Zijlstra authored
      commit a501686b upstream.
      
      __flush_tlb_single() is for user mappings, __flush_tlb_one() for
      kernel mappings.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a0edc494
    • Peter Zijlstra's avatar
      x86/microcode: Dont abuse the TLB-flush interface · de4c8bbd
      Peter Zijlstra authored
      commit 23cb7d46 upstream.
      
      Commit:
      
        ec400dde ("x86/microcode_intel_early.c: Early update ucode on Intel's CPU")
      
      ... grubbed into tlbflush internals without coherent explanation.
      
      Since it says its a precaution and the SDM doesn't mention anything like
      this, take it out back.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: fenghua.yu@intel.com
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      de4c8bbd
    • Peter Zijlstra's avatar
      x86/uv: Use the right TLB-flush API · 032fd2e3
      Peter Zijlstra authored
      commit 3e46e0f5 upstream.
      
      Since uv_flush_tlb_others() implements flush_tlb_others() which is
      about flushing user mappings, we should use __flush_tlb_single(),
      which too is about flushing user mappings.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Acked-by: default avatarAndrew Banman <abanman@hpe.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Mike Travis <mike.travis@hpe.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      032fd2e3
    • Dave Hansen's avatar
      x86/entry: Rename SYSENTER_stack to CPU_ENTRY_AREA_entry_stack · 06f9acfe
      Dave Hansen authored
      commit 4fe2d8b1 upstream.
      
      If the kernel oopses while on the trampoline stack, it will print
      "<SYSENTER>" even if SYSENTER is not involved.  That is rather confusing.
      
      The "SYSENTER" stack is used for a lot more than SYSENTER now.  Give it a
      better string to display in stack dumps, and rename the kernel code to
      match.
      
      Also move the 32-bit code over to the new naming even though it still uses
      the entry stack only for SYSENTER.
      Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      06f9acfe
    • Peter Zijlstra's avatar
      x86/doc: Remove obvious weirdnesses from the x86 MM layout documentation · d8f29ac7
      Peter Zijlstra authored
      commit e8ffe96e upstream.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d8f29ac7
    • Andy Lutomirski's avatar
      x86/mm/64: Improve the memory map documentation · 88569f5e
      Andy Lutomirski authored
      commit 5a7ccf47 upstream.
      
      The old docs had the vsyscall range wrong and were missing the fixmap.
      Fix both.
      
      There used to be 8 MB reserved for future vsyscalls, but that's long gone.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Kirill A. Shutemov <kirill@shutemov.name>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      88569f5e
    • Thomas Gleixner's avatar
      x86/ldt: Prevent LDT inheritance on exec · 2c8e9099
      Thomas Gleixner authored
      commit a4828f81 upstream.
      
      The LDT is inherited across fork() or exec(), but that makes no sense
      at all because exec() is supposed to start the process clean.
      
      The reason why this happens is that init_new_context_ldt() is called from
      init_new_context() which obviously needs to be called for both fork() and
      exec().
      
      It would be surprising if anything relies on that behaviour, so it seems to
      be safe to remove that misfeature.
      
      Split the context initialization into two parts. Clear the LDT pointer and
      initialize the mutex from the general context init and move the LDT
      duplication to arch_dup_mmap() which is only called on fork().
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Andy Lutomirsky <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: dan.j.williams@intel.com
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: kirill.shutemov@linux.intel.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2c8e9099
    • Peter Zijlstra's avatar
      x86/ldt: Rework locking · b1745934
      Peter Zijlstra authored
      commit c2b3496b upstream.
      
      The LDT is duplicated on fork() and on exec(), which is wrong as exec()
      should start from a clean state, i.e. without LDT. To fix this the LDT
      duplication code will be moved into arch_dup_mmap() which is only called
      for fork().
      
      This introduces a locking problem. arch_dup_mmap() holds mmap_sem of the
      parent process, but the LDT duplication code needs to acquire
      mm->context.lock to access the LDT data safely, which is the reverse lock
      order of write_ldt() where mmap_sem nests into context.lock.
      
      Solve this by introducing a new rw semaphore which serializes the
      read/write_ldt() syscall operations and use context.lock to protect the
      actual installment of the LDT descriptor.
      
      So context.lock stabilizes mm->context.ldt and can nest inside of the new
      semaphore or mmap_sem.
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Andy Lutomirsky <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: dan.j.williams@intel.com
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: kirill.shutemov@linux.intel.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b1745934
    • Thomas Gleixner's avatar
      arch, mm: Allow arch_dup_mmap() to fail · ee8e8b2d
      Thomas Gleixner authored
      commit c10e83f5 upstream.
      
      In order to sanitize the LDT initialization on x86 arch_dup_mmap() must be
      allowed to fail. Fix up all instances.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Andy Lutomirsky <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: dan.j.williams@intel.com
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: kirill.shutemov@linux.intel.com
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ee8e8b2d
    • Andy Lutomirski's avatar
      x86/vsyscall/64: Warn and fail vsyscall emulation in NATIVE mode · 49c01662
      Andy Lutomirski authored
      commit 4831b779 upstream.
      
      If something goes wrong with pagetable setup, vsyscall=native will
      accidentally fall back to emulation.  Make it warn and fail so that we
      notice.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      49c01662
    • Andy Lutomirski's avatar
      x86/vsyscall/64: Explicitly set _PAGE_USER in the pagetable hierarchy · beb899c4
      Andy Lutomirski authored
      commit 49275fef upstream.
      
      The kernel is very erratic as to which pagetables have _PAGE_USER set.  The
      vsyscall page gets lucky: it seems that all of the relevant pagetables are
      among the apparently arbitrary ones that set _PAGE_USER.  Rather than
      relying on chance, just explicitly set _PAGE_USER.
      
      This will let us clean up pagetable setup to stop setting _PAGE_USER.  The
      added code can also be reused by pagetable isolation to manage the
      _PAGE_USER bit in the usermode tables.
      
      [ tglx: Folded paravirt fix from Juergen Gross ]
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      beb899c4
    • Thomas Gleixner's avatar
      x86/mm/dump_pagetables: Make the address hints correct and readable · 7b45ad6e
      Thomas Gleixner authored
      commit 146122e2 upstream.
      
      The address hints are a trainwreck. The array entry numbers have to kept
      magically in sync with the actual hints, which is doomed as some of the
      array members are initialized at runtime via the entry numbers.
      
      Designated initializers have been around before this code was
      implemented....
      
      Use the entry numbers to populate the address hints array and add the
      missing bits and pieces. Split 32 and 64 bit for readability sake.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7b45ad6e
    • Thomas Gleixner's avatar
      x86/mm/dump_pagetables: Check PAGE_PRESENT for real · c4bc3980
      Thomas Gleixner authored
      commit c0534494 upstream.
      
      The check for a present page in printk_prot():
      
             if (!pgprot_val(prot)) {
                      /* Not present */
      
      is bogus. If a PTE is set to PAGE_NONE then the pgprot_val is not zero and
      the entry is decoded in bogus ways, e.g. as RX GLB. That is confusing when
      analyzing mapping correctness. Check for the present bit to make an
      informed decision.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c4bc3980
    • Thomas Gleixner's avatar
      x86/Kconfig: Limit NR_CPUS on 32-bit to a sane amount · 662fd946
      Thomas Gleixner authored
      commit 7bbcbd3d upstream.
      
      The recent cpu_entry_area changes fail to compile on 32-bit when BIGSMP=y
      and NR_CPUS=512, because the fixmap area becomes too big.
      
      Limit the number of CPUs with BIGSMP to 64, which is already way to big for
      32-bit, but it's at least a working limitation.
      
      We performed a quick survey of 32-bit-only machines that might be affected
      by this change negatively, but found none.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      662fd946
    • Ricardo Neri's avatar
      x86/insn-eval: Add utility functions to get segment selector · adc37e20
      Ricardo Neri authored
      commit 32d0b953 upstream.
      
      [note, only the inat.h portion, to get objtool back in sync - gregkh]
      
      b0caa8c8c6bbc422bc3c32b64852d6d618f32b49 Mon Sep 17 00:00:00 2001
      When computing a linear address and segmentation is used, we need to know
      the base address of the segment involved in the computation. In most of
      the cases, the segment base address will be zero as in USER_DS/USER32_DS.
      However, it may be possible that a user space program defines its own
      segments via a local descriptor table. In such a case, the segment base
      address may not be zero. Thus, the segment base address is needed to
      calculate correctly the linear address.
      
      If running in protected mode, the segment selector to be used when
      computing a linear address is determined by either any of segment override
      prefixes in the instruction or inferred from the registers involved in the
      computation of the effective address; in that order. Also, there are cases
      when the segment override prefixes shall be ignored (i.e., code segments
      are always selected by the CS segment register; string instructions always
      use the ES segment register when using rDI register as operand). In long
      mode, segment registers are ignored, except for FS and GS. In these two
      cases, base addresses are obtained from the respective MSRs.
      
      For clarity, this process can be split into four steps (and an equal
      number of functions): determine if segment prefixes overrides can be used;
      parse the segment override prefixes, and use them if found; if not found
      or cannot be used, use the default segment registers associated with the
      operand registers. Once the segment register to use has been identified,
      read its value to obtain the segment selector.
      
      The method to obtain the segment selector depends on several factors. In
      32-bit builds, segment selectors are saved into a pt_regs structure
      when switching to kernel mode. The same is also true for virtual-8086
      mode. In 64-bit builds, segmentation is mostly ignored, except when
      running a program in 32-bit legacy mode. In this case, CS and SS can be
      obtained from pt_regs. DS, ES, FS and GS can be read directly from
      the respective segment registers.
      
      In order to identify the segment registers, a new set of #defines is
      introduced. It also includes two special identifiers. One of them
      indicates when the default segment register associated with instruction
      operands shall be used. Another one indicates that the contents of the
      segment register shall be ignored; this identifier is used when in long
      mode.
      Improvements-by: default avatarBorislav Petkov <bp@suse.de>
      Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: ricardo.neri@intel.com
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Cc: Huang Rui <ray.huang@amd.com>
      Cc: Qiaowei Ren <qiaowei.ren@intel.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
      Cc: Chris Metcalf <cmetcalf@mellanox.com>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Colin Ian King <colin.king@canonical.com>
      Cc: Chen Yucong <slaoub@gmail.com>
      Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: Lorenzo Stoakes <lstoakes@gmail.com>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Thomas Garnier <thgarnie@google.com>
      Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      adc37e20
    • Randy Dunlap's avatar
      x86/decoder: Fix and update the opcodes map · da8eb8ad
      Randy Dunlap authored
      commit f5b5fab1 upstream
      
      Update x86-opcode-map.txt based on the October 2017 Intel SDM publication.
      Fix INVPID to INVVPID.
      Add UD0 and UD1 instruction opcodes.
      
      Also sync the objtool and perf tooling copies of this file.
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Acked-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Masami Hiramatsu <masami.hiramatsu@gmail.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/aac062d7-c0f6-96e3-5c92-ed299e2bd3da@infradead.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      da8eb8ad
    • Mikulas Patocka's avatar
      objtool: Fix 64-bit build on 32-bit host · 76358c8d
      Mikulas Patocka authored
      commit 14c47b54 upstream.
      
      The new ORC unwinder breaks the build of a 64-bit kernel on a 32-bit
      host.  Building the kernel on a i386 or x32 host fails with:
      
        orc_dump.c: In function 'orc_dump':
        orc_dump.c:105:26: error: passing argument 2 of 'elf_getshdrnum' from incompatible pointer type [-Werror=incompatible-pointer-types]
          if (elf_getshdrnum(elf, &nr_sections)) {
                                  ^
        In file included from /usr/local/include/gelf.h:32:0,
                         from elf.h:22,
                         from warn.h:26,
                         from orc_dump.c:20:
        /usr/local/include/libelf.h:304:12: note: expected 'size_t * {aka unsigned int *}' but argument is of type 'long unsigned int *'
         extern int elf_getshdrnum (Elf *__elf, size_t *__dst);
                    ^~~~~~~~~~~~~~
        orc_dump.c:190:17: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'Elf64_Sxword {aka long long int}' [-Werror=format=]
            printf("%s+%lx:", name, rela.r_addend);
                       ~~^          ~~~~~~~~~~~~~
                       %llx
      
      Fix the build failure.
      
      Another problem is that if the user specifies HOSTCC or HOSTLD
      variables, they are ignored in the objtool makefile.  Change the
      Makefile to respect these variables.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Sven Joachim <svenjoac@gmx.de>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Fixes: 627fce14 ("objtool: Add ORC unwind table generation")
      Link: http://lkml.kernel.org/r/19f0e64d8e07e30a7b307cd010eb780c404fe08d.1512252895.git.jpoimboe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      76358c8d
    • Ingo Molnar's avatar
      tools/headers: Sync objtool UAPI header · 6a8f7688
      Ingo Molnar authored
      commit a356d2ae upstream.
      
      objtool grew this new warning:
      
        Warning: synced file at 'tools/objtool/arch/x86/include/asm/inat.h' differs from latest kernel version at 'arch/x86/include/asm/inat.h'
      
      which upstream header grew new INAT_SEG_* definitions.
      
      Sync up the tooling version of the header.
      Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6a8f7688