1. 05 Feb, 2020 25 commits
  2. 31 Jan, 2020 2 commits
    • Linus Torvalds's avatar
      Merge tag 'kvm-5.6-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm · e813e650
      Linus Torvalds authored
      Pull KVM updates from Paolo Bonzini:
       "This is the first batch of KVM changes.
      
        ARM:
         - cleanups and corner case fixes.
      
        PPC:
         - Bugfixes
      
        x86:
         - Support for mapping DAX areas with large nested page table entries.
      
         - Cleanups and bugfixes here too. A particularly important one is a
           fix for FPU load when the thread has TIF_NEED_FPU_LOAD. There is
           also a race condition which could be used in guest userspace to
           exploit the guest kernel, for which the embargo expired today.
      
         - Fast path for IPI delivery vmexits, shaving about 200 clock cycles
           from IPI latency.
      
         - Protect against "Spectre-v1/L1TF" (bring data in the cache via
           speculative out of bound accesses, use L1TF on the sibling
           hyperthread to read it), which unfortunately is an even bigger
           whack-a-mole game than SpectreV1.
      
        Sean continues his mission to rewrite KVM. In addition to a sizable
        number of x86 patches, this time he contributed a pretty large
        refactoring of vCPU creation that affects all architectures but should
        not have any visible effect.
      
        s390 will come next week together with some more x86 patches"
      
      * tag 'kvm-5.6-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (204 commits)
        x86/KVM: Clean up host's steal time structure
        x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
        x86/kvm: Cache gfn to pfn translation
        x86/kvm: Introduce kvm_(un)map_gfn()
        x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
        KVM: PPC: Book3S PR: Fix -Werror=return-type build failure
        KVM: PPC: Book3S HV: Release lock on page-out failure path
        KVM: arm64: Treat emulated TVAL TimerValue as a signed 32-bit integer
        KVM: arm64: pmu: Only handle supported event counters
        KVM: arm64: pmu: Fix chained SW_INCR counters
        KVM: arm64: pmu: Don't mark a counter as chained if the odd one is disabled
        KVM: arm64: pmu: Don't increment SW_INCR if PMCR.E is unset
        KVM: x86: Use a typedef for fastop functions
        KVM: X86: Add 'else' to unify fastop and execute call path
        KVM: x86: inline memslot_valid_for_gpte
        KVM: x86/mmu: Use huge pages for DAX-backed files
        KVM: x86/mmu: Remove lpage_is_disallowed() check from set_spte()
        KVM: x86/mmu: Fold max_mapping_level() into kvm_mmu_hugepage_adjust()
        KVM: x86/mmu: Zap any compound page when collapsing sptes
        KVM: x86/mmu: Remove obsolete gfn restoration in FNAME(fetch)
        ...
      e813e650
    • Linus Torvalds's avatar
      Merge tag 'mpx-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-mpx · ccaaaf6f
      Linus Torvalds authored
      Pull x86 MPX removal from Dave Hansen:
       "MPX requires recompiling applications, which requires compiler
        support. Unfortunately, GCC 9.1 is expected to be be released without
        support for MPX. This means that there was only a relatively small
        window where folks could have ever used MPX. It failed to gain wide
        adoption in the industry, and Linux was the only mainstream OS to ever
        support it widely.
      
        Support for the feature may also disappear on future processors.
      
        This set completes the process that we started during the 5.4 merge
        window when the MPX prctl()s were removed. XSAVE support is left in
        place, which allows MPX-using KVM guests to continue to function"
      
      * tag 'mpx-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-mpx:
        x86/mpx: remove MPX from arch/x86
        mm: remove arch_bprm_mm_init() hook
        x86/mpx: remove bounds exception code
        x86/mpx: remove build infrastructure
        x86/alternatives: add missing insn.h include
      ccaaaf6f
  3. 30 Jan, 2020 13 commits
    • Linus Torvalds's avatar
      Merge tag 'mtd/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux · 35c222fd
      Linus Torvalds authored
      Pull MTD updates from Miquel Raynal:
       "MTD core
         - block2mtd: page index should use pgoff_t
         - maps: physmap: minimal Runtime PM support
         - maps: pcmciamtd: avoid possible sleep-in-atomic-context bugs
         - concat: Fix a comment referring to an unknown symbol
      
        Raw NAND:
         - Macronix: Use match_string() helper
         - Atmel: switch to using devm_fwnode_gpiod_get()
         - Denali: rework the SKIP_BYTES feature and add reset controlling
         - Brcmnand: set appropriate DMA mask
         - Cadence: add unspecified HAS_IOMEM dependency
         - Various cleanup.
      
        Onenand:
         - Rename Samsung and Omap2 drivers to avoid possible build warnings
         - Enable compile testing
         - Various build issues
         - Kconfig cleanup
      
        SPI-NAND:
         - Support for Toshiba TC58CVG2S0HRAIJ
      
        SPI-NOR:
         - Add support for TB selection using SR bit 6,
         - Add support for few flashes"
      
      * tag 'mtd/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (41 commits)
        mtd: concat: Fix a comment referring to an unknown symbol
        mtd: rawnand: add unspecified HAS_IOMEM dependency
        mtd: block2mtd: page index should use pgoff_t
        mtd: maps: physmap: Add minimal Runtime PM support
        mtd: maps: pcmciamtd: fix possible sleep-in-atomic-context bugs in pcmciamtd_set_vpp()
        mtd: onenand: Rename omap2 driver to avoid a build warning
        mtd: onenand: Use a better name for samsung driver
        mtd: rawnand: atmel: switch to using devm_fwnode_gpiod_get()
        mtd: spinand: add support for Toshiba TC58CVG2S0HRAIJ
        mtd: rawnand: macronix: Use match_string() helper to simplify the code
        mtd: sharpslpart: Fix unsigned comparison to zero
        mtd: onenand: Enable compile testing of OMAP and Samsung drivers
        mtd: onenand: samsung: Fix printing format for size_t on 64-bit
        mtd: onenand: samsung: Fix pointer cast -Wpointer-to-int-cast warnings on 64 bit
        mtd: rawnand: denali: remove hard-coded DENALI_DEFAULT_OOB_SKIP_BYTES
        mtd: rawnand: denali_dt: add reset controlling
        dt-bindings: mtd: denali_dt: document reset property
        mtd: rawnand: denali_dt: Add support for configuring SPARE_AREA_SKIP_BYTES
        mtd: rawnand: denali_dt: error out if platform has no associated data
        mtd: rawnand: brcmnand: Set appropriate DMA mask
        ...
      35c222fd
    • Linus Torvalds's avatar
      Merge tag 'upstream-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs · e84bcd61
      Linus Torvalds authored
      Pull UBI/UBIFS updates from Miquel Raynal:
       "This pull request contains mostly fixes for UBI and UBIFS:
      
        UBI:
         - Fixes for memory leaks in error paths
         - Fix for an logic error in a fastmap selfcheck
      
        UBIFS:
         - Fix for FS_IOC_SETFLAGS related to fscrypt flag
         - Support for FS_ENCRYPT_FL
         - Fix for a dead lock in bulk-read mode"
      
      Sent on behalf of Richard Weinberger who is traveling.
      
      * tag 'upstream-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
        ubi: Fix an error pointer dereference in error handling code
        ubifs: Fix memory leak from c->sup_node
        ubifs: Fix ino_t format warnings in orphan_delete()
        ubifs: Fix deadlock in concurrent bulk-read and writepage
        ubifs: Fix wrong memory allocation
        ubi: Free the normal volumes in error paths of ubi_attach_mtd_dev()
        ubi: Check the presence of volume before call ubi_fastmap_destroy_checkmap()
        ubifs: Add support for FS_ENCRYPT_FL
        ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
        ubi: wl: Remove set but not used variable 'prev_e'
        ubi: fastmap: Fix inverted logic in seen selfcheck
      e84bcd61
    • Linus Torvalds's avatar
      Merge tag 'f2fs-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs · 6e135bae
      Linus Torvalds authored
      Pull f2fs updates from Jaegeuk Kim:
       "In this series, we've implemented transparent compression
        experimentally. It supports LZO and LZ4, but will add more later as we
        investigate in the field more.
      
        At this point, the feature doesn't expose compressed space to user
        directly in order to guarantee potential data updates later to the
        space. Instead, the main goal is to reduce data writes to flash disk
        as much as possible, resulting in extending disk life time as well as
        relaxing IO congestion.
      
        Alternatively, we're also considering to add ioctl() to reclaim
        compressed space and show it to user after putting the immutable bit.
      
        Enhancements:
         - add compression support
         - avoid unnecessary locks in quota ops
         - harden power-cut scenario for zoned block devices
         - use private bio_set to avoid IO congestion
         - replace GC mutex with rwsem to serialize callers
      
        Bug fixes:
         - fix dentry consistency and memory corruption in rename()'s error case
         - fix wrong swap extent reports
         - fix casefolding bugs
         - change lock coverage to avoid deadlock
         - avoid GFP_KERNEL under f2fs_lock_op
      
        And, we've cleaned up sysfs entries to prepare no debugfs"
      
      * tag 'f2fs-for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (31 commits)
        f2fs: fix race conditions in ->d_compare() and ->d_hash()
        f2fs: fix dcache lookup of !casefolded directories
        f2fs: Add f2fs stats to sysfs
        f2fs: delete duplicate information on sysfs nodes
        f2fs: change to use rwsem for gc_mutex
        f2fs: update f2fs document regarding to fsync_mode
        f2fs: add a way to turn off ipu bio cache
        f2fs: code cleanup for f2fs_statfs_project()
        f2fs: fix miscounted block limit in f2fs_statfs_project()
        f2fs: show the CP_PAUSE reason in checkpoint traces
        f2fs: fix deadlock allocating bio_post_read_ctx from mempool
        f2fs: remove unneeded check for error allocating bio_post_read_ctx
        f2fs: convert inline_dir early before starting rename
        f2fs: fix memleak of kobject
        f2fs: fix to add swap extent correctly
        f2fs: run fsck when getting bad inode during GC
        f2fs: support data compression
        f2fs: free sysfs kobject
        f2fs: declare nested quota_sem and remove unnecessary sems
        f2fs: don't put new_page twice in f2fs_rename
        ...
      6e135bae
    • Linus Torvalds's avatar
      Merge tag 'for_v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 0196be12
      Linus Torvalds authored
      Pull UDF, quota, reiserfs, ext2 fixes and cleanups from Jan Kara:
       "A few assorted fixes and cleanups for udf, quota, reiserfs, and ext2"
      
      * tag 'for_v5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        fs/reiserfs: remove unused macros
        fs/quota: remove unused macro
        udf: Clarify meaning of f_files in udf_statfs
        udf: Allow writing to 'Rewritable' partitions
        udf: Disallow R/W mode for disk with Metadata partition
        udf: Fix meaning of ENTITYID_FLAGS_* macros to be really bitwise-or flags
        udf: Fix free space reporting for metadata and virtual partitions
        udf: Update header files to UDF 2.60
        udf: Move OSTA Identifier Suffix macros from ecma_167.h to osta_udf.h
        udf: Fix spelling in EXT_NEXT_EXTENT_ALLOCDESCS
        ext2: Adjust indentation in ext2_fill_super
        quota: avoid time_t in v1_disk_dqblk definition
        reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
        reiserfs: Fix memory leak of journal device string
        ext2: set proper errno in error case of ext2_fill_super()
      0196be12
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.6-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 91f1a956
      Linus Torvalds authored
      Pull xfs updates from Darrick Wong:
       "In this release we clean out the last of the old 32-bit timestamp
        code, fix a number of bugs and memory corruptions on 32-bit platforms,
        and a refactoring of some of the extended attribute code.
      
        I think I'll be back next week with some refactoring of how the XFS
        buffer code returns error codes, however I prefer to hold onto that
        for another week to let it soak a while longer
      
        Summary:
      
         - Get rid of compat_time_t
      
         - Convert time_t to time64_t in quota code
      
         - Remove shadow variables
      
         - Prevent ATTR_ flag misuse in the attrmulti ioctls
      
         - Clean out strlen in the attr code
      
         - Remove some bogus asserts
      
         - Fix various file size limit calculation errors with 32-bit kernels
      
         - Pack xfs_dir2_sf_entry_t to fix build errors on arm oabi
      
         - Fix nowait inode locking calls for directio aio reads
      
         - Fix memory corruption bugs when invalidating remote xattr value
           buffers
      
         - Streamline remote attr value removal
      
         - Make the buffer log format size consistent across platforms
      
         - Strengthen buffer log format size checking
      
         - Fix messed up return types of xfs_inode_need_cow
      
         - Fix some unused variable warnings"
      
      * tag 'xfs-5.6-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (24 commits)
        xfs: remove unused variable 'done'
        xfs: fix uninitialized variable in xfs_attr3_leaf_inactive
        xfs: change return value of xfs_inode_need_cow to int
        xfs: check log iovec size to make sure it's plausibly a buffer log format
        xfs: make struct xfs_buf_log_format have a consistent size
        xfs: complain if anyone tries to create a too-large buffer log item
        xfs: clean up xfs_buf_item_get_format return value
        xfs: streamline xfs_attr3_leaf_inactive
        xfs: fix memory corruption during remote attr value buffer invalidation
        xfs: refactor remote attr value buffer invalidation
        xfs: fix IOCB_NOWAIT handling in xfs_file_dio_aio_read
        xfs: Add __packed to xfs_dir2_sf_entry_t definition
        xfs: fix s_maxbytes computation on 32-bit kernels
        xfs: truncate should remove all blocks, not just to the end of the page cache
        xfs: introduce XFS_MAX_FILEOFF
        xfs: remove bogus assertion when online repair isn't enabled
        xfs: Remove all strlen in all xfs_attr_* functions for attr names.
        xfs: fix misuse of the XFS_ATTR_INCOMPLETE flag
        xfs: also remove cached ACLs when removing the underlying attr
        xfs: reject invalid flags combinations in XFS_IOC_ATTRMULTI_BY_HANDLE
        ...
      91f1a956
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · e5da4c93
      Linus Torvalds authored
      Pull ext4 updates from Ted Ts'o:
       "This merge window, we've added some performance improvements in how we
        handle inode locking in the read/write paths, and improving the
        performance of Direct I/O overwrites.
      
        We also now record the error code which caused the first and most
        recent ext4_error() report in the superblock, to make it easier to
        root cause problems in production systems.
      
        There are also many of the usual cleanups and miscellaneous bug fixes"
      
      * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (49 commits)
        jbd2: clean __jbd2_journal_abort_hard() and __journal_abort_soft()
        jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
        ext4, jbd2: ensure panic when aborting with zero errno
        jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
        jbd2_seq_info_next should increase position index
        jbd2: remove pointless assertion in __journal_remove_journal_head
        ext4,jbd2: fix comment and code style
        jbd2: delete the duplicated words in the comments
        ext4: fix extent_status trace points
        ext4: fix symbolic enum printing in trace output
        ext4: choose hardlimit when softlimit is larger than hardlimit in ext4_statfs_project()
        ext4: fix race conditions in ->d_compare() and ->d_hash()
        ext4: make dioread_nolock the default
        ext4: fix extent_status fragmentation for plain files
        jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
        ext4: drop ext4_kvmalloc()
        ext4: Add EXT4_IOC_FSGETXATTR/EXT4_IOC_FSSETXATTR to compat_ioctl
        ext4: remove unused macro MPAGE_DA_EXTENT_TAIL
        ext4: add missing braces in ext4_ext_drop_refs()
        ext4: fix some nonstandard indentation in extents.c
        ...
      e5da4c93
    • Paolo Bonzini's avatar
      Merge branch 'cve-2019-3016' into kvm-next-5.6 · 4cbc418a
      Paolo Bonzini authored
      From Boris Ostrovsky:
      
      The KVM hypervisor may provide a guest with ability to defer remote TLB
      flush when the remote VCPU is not running. When this feature is used,
      the TLB flush will happen only when the remote VPCU is scheduled to run
      again. This will avoid unnecessary (and expensive) IPIs.
      
      Under certain circumstances, when a guest initiates such deferred action,
      the hypervisor may miss the request. It is also possible that the guest
      may mistakenly assume that it has already marked remote VCPU as needing
      a flush when in fact that request had already been processed by the
      hypervisor. In both cases this will result in an invalid translation
      being present in a vCPU, potentially allowing accesses to memory locations
      in that guest's address space that should not be accessible.
      
      Note that only intra-guest memory is vulnerable.
      
      The five patches address both of these problems:
      1. The first patch makes sure the hypervisor doesn't accidentally clear
      a guest's remote flush request
      2. The rest of the patches prevent the race between hypervisor
      acknowledging a remote flush request and guest issuing a new one.
      
      Conflicts:
      	arch/x86/kvm/x86.c [move from kvm_arch_vcpu_free to kvm_arch_vcpu_destroy]
      4cbc418a
    • Boris Ostrovsky's avatar
      x86/KVM: Clean up host's steal time structure · a6bd811f
      Boris Ostrovsky authored
      Now that we are mapping kvm_steal_time from the guest directly we
      don't need keep a copy of it in kvm_vcpu_arch.st. The same is true
      for the stime field.
      
      This is part of CVE-2019-3016.
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      a6bd811f
    • Boris Ostrovsky's avatar
      x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed · b0431382
      Boris Ostrovsky authored
      There is a potential race in record_steal_time() between setting
      host-local vcpu->arch.st.steal.preempted to zero (i.e. clearing
      KVM_VCPU_PREEMPTED) and propagating this value to the guest with
      kvm_write_guest_cached(). Between those two events the guest may
      still see KVM_VCPU_PREEMPTED in its copy of kvm_steal_time, set
      KVM_VCPU_FLUSH_TLB and assume that hypervisor will do the right
      thing. Which it won't.
      
      Instad of copying, we should map kvm_steal_time and that will
      guarantee atomicity of accesses to @preempted.
      
      This is part of CVE-2019-3016.
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      b0431382
    • Boris Ostrovsky's avatar
      x86/kvm: Cache gfn to pfn translation · 91724814
      Boris Ostrovsky authored
      __kvm_map_gfn()'s call to gfn_to_pfn_memslot() is
      * relatively expensive
      * in certain cases (such as when done from atomic context) cannot be called
      
      Stashing gfn-to-pfn mapping should help with both cases.
      
      This is part of CVE-2019-3016.
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      91724814
    • Boris Ostrovsky's avatar
      x86/kvm: Introduce kvm_(un)map_gfn() · 1eff70a9
      Boris Ostrovsky authored
      kvm_vcpu_(un)map operates on gfns from any current address space.
      In certain cases we want to make sure we are not mapping SMRAM
      and for that we can use kvm_(un)map_gfn() that we are introducing
      in this patch.
      
      This is part of CVE-2019-3016.
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      1eff70a9
    • Boris Ostrovsky's avatar
      x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit · 8c6de56a
      Boris Ostrovsky authored
      kvm_steal_time_set_preempted() may accidentally clear KVM_VCPU_FLUSH_TLB
      bit if it is called more than once while VCPU is preempted.
      
      This is part of CVE-2019-3016.
      
      (This bug was also independently discovered by Jim Mattson
      <jmattson@google.com>)
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Reviewed-by: default avatarJoao Martins <joao.m.martins@oracle.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      8c6de56a
    • Paolo Bonzini's avatar
      Merge tag 'kvm-ppc-next-5.6-2' of... · 1d5920c3
      Paolo Bonzini authored
      Merge tag 'kvm-ppc-next-5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD
      
      Second KVM PPC update for 5.6
      
      * Fix compile warning on 32-bit machines
      * Fix locking error in secure VM support
      1d5920c3