1. 20 Dec, 2017 4 commits
  2. 19 Dec, 2017 4 commits
    • Mark Brown's avatar
      Merge remote-tracking branches 'spi/fix/armada', 'spi/fix/atmel',... · 4d029763
      Mark Brown authored
      Merge remote-tracking branches 'spi/fix/armada', 'spi/fix/atmel', 'spi/fix/doc', 'spi/fix/imx', 'spi/fix/rspi', 'spi/fix/sun4i' and 'spi/fix/xilinx' into spi-linus
      4d029763
    • Radu Pirea's avatar
      spi: atmel: fixed spin_lock usage inside atmel_spi_remove · 66e900a3
      Radu Pirea authored
      The only part of atmel_spi_remove which needs to be atomic is hardware
      reset.
      
      atmel_spi_stop_dma calls dma_terminate_all and this needs interrupts
      enabled.
      atmel_spi_release_dma calls dma_release_channel and dma_release_channel
      locks a mutex inside of spin_lock.
      
      So the call of these functions can't be inside a spin_lock.
      Reported-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
      Signed-off-by: default avatarRadu Pirea <radu.pirea@microchip.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      66e900a3
    • Takashi Iwai's avatar
      ALSA: usb-audio: Fix the missing ctl name suffix at parsing SU · 5a15f289
      Takashi Iwai authored
      The commit 89b89d12 ("ALSA: usb-audio: Add check return value for
      usb_string()") added the check of the return value from
      snd_usb_copy_string_desc(), which is correct per se, but it introduced
      a regression.  In the original code, either the "Clock Source",
      "Playback Source" or "Capture Source" suffix is added after the
      terminal string, while the commit changed it to add the suffix only
      when get_term_name() is failing.  It ended up with an incorrect ctl
      name like "PCM" instead of "PCM Capture Source".
      
      Also, even the original code has a similar bug: when the ctl name is
      generated from snd_usb_copy_string_desc() for the given iSelector, it
      also doesn't put the suffix.
      
      This patch addresses these issues: the suffix is added always when no
      static mapping is found.  Also the patch tries to put more comments
      and cleans up the if/else block for better readability in order to
      avoid the same pitfall again.
      
      Fixes: 89b89d12 ("ALSA: usb-audio: Add check return value for usb_string()")
      Reported-and-tested-by: default avatarMauro Santos <registo.mailling@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      5a15f289
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20171218' of git://git.infradead.org/linux-mtd · ace52288
      Linus Torvalds authored
      Pull MTD fixes from Richard Weinberger:
       "This contains the following regression fixes:
      
         - fix bitflip handling in brcmnand and gpmi nand drivers
      
         - revert a bad device tree binding for spi-nor
      
         - fix a copy&paste error in gpio-nand driver
      
         - fix a too strict length check in mtd core"
      
      * tag 'for-linus-20171218' of git://git.infradead.org/linux-mtd:
        mtd: Fix mtd_check_oob_ops()
        mtd: nand: gpio: Fix ALE gpio configuration
        mtd: nand: brcmnand: Zero bitflip is not an error
        mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
        Revert "dt-bindings: mtd: add sst25wf040b and en25s64 to sip-nor list"
      ace52288
  3. 18 Dec, 2017 5 commits
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · cb81fc6a
      Linus Torvalds authored
      Pull parisc fixes from Helge Deller:
       "There are two important fixes here:
      
         - Add PCI quirks to disable built-in a serial AUX and a graphics
           cards from specific GSP (management board) PCI cards. This fixes
           boot via serial console on rp3410 and rp3440 machines.
      
         - Revert the "Re-enable interrups early" patch which was added to
           kernel v4.10. It can trigger stack overflows and thus silent data
           corruption. With this patch reverted we can lower our thread stack
           back to 16kb again.
      
        The other patches are minor cleanups: avoid duplicate includes,
        indenting fixes, correctly align variable in asm code"
      
      * 'parisc-4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Reduce thread stack to 16 kb
        Revert "parisc: Re-enable interrupts early"
        parisc: remove duplicate includes
        parisc: Hide Diva-built-in serial aux and graphics card
        parisc: Align os_hpmc_size on word boundary
        parisc: Fix indenting in puts()
      cb81fc6a
    • Linus Torvalds's avatar
      Merge branch 'WIP.x86-pti.entry-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 64a48099
      Linus Torvalds authored
      Pull x86 syscall entry code changes for PTI from Ingo Molnar:
       "The main changes here are Andy Lutomirski's changes to switch the
        x86-64 entry code to use the 'per CPU entry trampoline stack'. This,
        besides helping fix KASLR leaks (the pending Page Table Isolation
        (PTI) work), also robustifies the x86 entry code"
      
      * 'WIP.x86-pti.entry-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits)
        x86/cpufeatures: Make CPU bugs sticky
        x86/paravirt: Provide a way to check for hypervisors
        x86/paravirt: Dont patch flush_tlb_single
        x86/entry/64: Make cpu_entry_area.tss read-only
        x86/entry: Clean up the SYSENTER_stack code
        x86/entry/64: Remove the SYSENTER stack canary
        x86/entry/64: Move the IST stacks into struct cpu_entry_area
        x86/entry/64: Create a per-CPU SYSCALL entry trampoline
        x86/entry/64: Return to userspace from the trampoline stack
        x86/entry/64: Use a per-CPU trampoline stack for IDT entries
        x86/espfix/64: Stop assuming that pt_regs is on the entry stack
        x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0
        x86/entry: Remap the TSS into the CPU entry area
        x86/entry: Move SYSENTER_stack to the beginning of struct tss_struct
        x86/dumpstack: Handle stack overflow on all stacks
        x86/entry: Fix assumptions that the HW TSS is at the beginning of cpu_tss
        x86/kasan/64: Teach KASAN about the cpu_entry_area
        x86/mm/fixmap: Generalize the GDT fixmap mechanism, introduce struct cpu_entry_area
        x86/entry/gdt: Put per-CPU GDT remaps in ascending order
        x86/dumpstack: Add get_stack_info() support for the SYSENTER stack
        ...
      64a48099
    • Kailang Yang's avatar
      ALSA: hda/realtek - Fix Dell AIO LineOut issue · 92266651
      Kailang Yang authored
      Dell AIO had LineOut jack.
      Add LineOut verb into this patch.
      
      [ Additional notes:
        the ALC274 codec seems requiring the fixed pin / DAC connections for
        HP / line-out pins for enabling EQ for speakers; i.e. the HP / LO
        pins expect to be connected with NID 0x03 while keeping the speaker
        with NID 0x02.  However, by adding a new line-out pin, the
        auto-parser assigns the NID 0x02 for HP/LO pins as primary outputs.
        As an easy workaround, we provide the preferred_pairs[] to map
        forcibly for these pins. -- tiwai ]
      
      Fixes: 75ee94b2 ("ALSA: hda - fix headset mic problem for Dell machines with alc274")
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      92266651
    • Miquel Raynal's avatar
      mtd: Fix mtd_check_oob_ops() · d82c3682
      Miquel Raynal authored
      The mtd_check_oob_ops() helper verifies if the operation defined by the
      user is correct.
      
      Fix the check that verifies if the entire requested area exists. This
      check is too restrictive and will fail anytime the last data byte of the
      very last page is included in an operation.
      
      Fixes: 5cdd929d ("mtd: Add sanity checks in mtd_write/read_oob()")
      Signed-off-by: default avatarMiquel Raynal <miquel.raynal@free-electrons.com>
      Acked-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      d82c3682
    • Linus Torvalds's avatar
      Linux 4.15-rc4 · 1291a0d5
      Linus Torvalds authored
      1291a0d5
  4. 17 Dec, 2017 27 commits
    • Kees Cook's avatar
      Revert "exec: avoid RLIMIT_STACK races with prlimit()" · 779f4e1c
      Kees Cook authored
      This reverts commit 04e35f44.
      
      SELinux runs with secureexec for all non-"noatsecure" domain transitions,
      which means lots of processes end up hitting the stack hard-limit change
      that was introduced in order to fix a race with prlimit(). That race fix
      will need to be redesigned.
      Reported-by: default avatarLaura Abbott <labbott@redhat.com>
      Reported-by: default avatarTomáš Trnka <trnka@scm.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      779f4e1c
    • Linus Torvalds's avatar
      Merge branch 'WIP.x86-pti.base-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f8940a0f
      Linus Torvalds authored
      Pull Page Table Isolation (PTI) v4.14 backporting base tree from Ingo Molnar:
       "This tree contains the v4.14 PTI backport preparatory tree, which
        consists of four merges of upstream trees and 7 cherry-picked commits,
        which the upcoming PTI work depends on"
      
      NOTE! The resulting tree is exactly the same as the original base tree
      (ie the diff between this commit and its immediate first parent is
      empty).
      
      The only reason for this merge is literally to have a common point for
      the actual PTI changes so that the commits can be shared in both the
      4.15 and 4.14 trees.
      
      * 'WIP.x86-pti.base-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow
        locking/barriers: Convert users of lockless_dereference() to READ_ONCE()
        locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE()
        bpf: fix build issues on um due to mising bpf_perf_event.h
        perf/x86: Enable free running PEBS for REGS_USER/INTR
        x86: Make X86_BUG_FXSAVE_LEAK detectable in CPUID on AMD
        x86/cpufeature: Add User-Mode Instruction Prevention definitions
      f8940a0f
    • Linus Torvalds's avatar
      Merge branch 'WIP.x86-pti.base.prep-for-linus' of... · 6ba64fef
      Linus Torvalds authored
      Merge branch 'WIP.x86-pti.base.prep-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
      
      Pull Page Table Isolation (PTI) preparatory tree from Ingo Molnar:
       "This does a rename to free up linux/pti.h to be used by the upcoming
        page table isolation feature"
      
      * 'WIP.x86-pti.base.prep-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        drivers/misc/intel/pti: Rename the header file to free up the namespace
      6ba64fef
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 2ffb448c
      Linus Torvalds authored
      Pull timer fix from Thomas Gleixner:
       "A single bugfix which prevents arbitrary sigev_notify values in
        posix-timers"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        posix-timer: Properly check sigevent->sigev_notify
      2ffb448c
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.15-rc4' of git://git.infradead.org/users/vkoul/slave-dma · c4372790
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "This time consisting of fixes in a bunch of drivers and the dmatest
        module:
      
         - Fix for disable clk on error path in fsl-edma driver
         - Disable clk fail fix in jz4740 driver
         - Fix long pending bug in dmatest driver for dangling pointer
         - Fix potential NULL pointer dereference in at_hdmac driver
         - Error handling path in ioat driver"
      
      * tag 'dmaengine-fix-4.15-rc4' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: fsl-edma: disable clks on all error paths
        dmaengine: jz4740: disable/unprepare clk if probe fails
        dmaengine: dmatest: move callback wait queue to thread context
        dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
        dmaengine: ioat: Fix error handling path
      c4372790
    • Arnd Bergmann's avatar
      cramfs: fix MTD dependency · b9f5fb18
      Arnd Bergmann authored
      With CONFIG_MTD=m and CONFIG_CRAMFS=y, we now get a link failure:
      
        fs/cramfs/inode.o: In function `cramfs_mount': inode.c:(.text+0x220): undefined reference to `mount_mtd'
        fs/cramfs/inode.o: In function `cramfs_mtd_fill_super':
        inode.c:(.text+0x6d8): undefined reference to `mtd_point'
        inode.c:(.text+0xae4): undefined reference to `mtd_unpoint'
      
      This adds a more specific Kconfig dependency to avoid the broken
      configuration.
      
      Alternatively we could make CRAMFS itself depend on "MTD || !MTD" with a
      similar result.
      
      Fixes: 99c18ce5 ("cramfs: direct memory access support")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarNicolas Pitre <nico@linaro.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b9f5fb18
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 73d080d3
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "The alloc_super() one is a regression in this merge window, lazytime
        thing is older..."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        VFS: Handle lazytime in do_mount()
        alloc_super(): do ->s_umount initialization earlier
      73d080d3
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 1c6b942d
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Fix a regression which caused us to fail to interpret symlinks in very
        ancient ext3 file system images.
      
        Also fix two xfstests failures, one of which could cause an OOPS, plus
        an additional bug fix caught by fuzz testing"
      
      * tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix crash when a directory's i_size is too small
        ext4: add missing error check in __ext4_new_inode()
        ext4: fix fdatasync(2) after fallocate(2) operation
        ext4: support fast symlinks from ext3 file systems
      1c6b942d
    • John David Anglin's avatar
      parisc: Reduce thread stack to 16 kb · da57c541
      John David Anglin authored
      In testing, I found that the thread stack can be 16 kB when using an irq
      stack.  Without it, the thread stack needs to be 32 kB. Currently, the irq
      stack is 32 kB. While it probably could be 16 kB, I would prefer to leave it
      as is for safety.
      Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      da57c541
    • John David Anglin's avatar
      Revert "parisc: Re-enable interrupts early" · 9352aead
      John David Anglin authored
      This reverts commit 5c38602d.
      
      Interrupts can't be enabled early because the register saves are done on
      the thread stack prior to switching to the IRQ stack.  This caused stack
      overflows and the thread stack needed increasing to 32k.  Even then,
      stack overflows still occasionally occurred.
      
      Background:
      Even with a 32 kB thread stack, I have seen instances where the thread
      stack overflowed on the mx3210 buildd.  Detection of stack overflow only
      occurs when we have an external interrupt.  When an external interrupt
      occurs, we switch to the thread stack if we are not already on a kernel
      stack.  Then, registers and specials are saved to the kernel stack.
      
      The bug occurs in intr_return where interrupts are reenabled prior to
      returning from the interrupt.  This was done incase we need to schedule
      or deliver signals.  However, it introduces the possibility that
      multiple external interrupts may occur on the thread stack and cause a
      stack overflow.  These might not be detected and cause the kernel to
      misbehave in random ways.
      
      This patch changes the code back to only reenable interrupts when we are
      going to schedule or deliver signals.  As a result, we generally return
      from an interrupt before reenabling interrupts.  This minimizes the
      growth of the thread stack.
      
      Fixes: 5c38602d ("parisc: Re-enable interrupts early")
      Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
      Cc: <stable@vger.kernel.org> # v4.10+
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      9352aead
    • Pravin Shedge's avatar
      parisc: remove duplicate includes · 6a16fc32
      Pravin Shedge authored
      These duplicate includes have been found with scripts/checkincludes.pl
      but they have been removed manually to avoid removing false positives.
      Signed-off-by: default avatarPravin Shedge <pravin.shedge4linux@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      6a16fc32
    • Helge Deller's avatar
      parisc: Hide Diva-built-in serial aux and graphics card · bcf3f175
      Helge Deller authored
      Diva GSP card has built-in serial AUX port and ATI graphic card which simply
      don't work and which both don't have external connectors.  User Guides even
      mention that those devices shouldn't be used.
      So, prevent that Linux drivers try to enable those devices.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: <stable@vger.kernel.org> # v3.0+
      bcf3f175
    • Helge Deller's avatar
      parisc: Align os_hpmc_size on word boundary · 0ed9d3de
      Helge Deller authored
      The os_hpmc_size variable sometimes wasn't aligned at word boundary and thus
      triggered the unaligned fault handler at startup.
      Fix it by aligning it properly.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: <stable@vger.kernel.org> # v4.14+
      0ed9d3de
    • Helge Deller's avatar
      parisc: Fix indenting in puts() · 203c110b
      Helge Deller authored
      Static analysis tools complain that we intended to have curly braces
      around this indent block. In this case this assumption is wrong, so fix
      the indenting.
      
      Fixes: 2f3c7b81 ("parisc: Add core code for self-extracting kernel")
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: <stable@vger.kernel.org> # v4.14+
      203c110b
    • Thomas Gleixner's avatar
      x86/cpufeatures: Make CPU bugs sticky · 6cbd2171
      Thomas Gleixner authored
      There is currently no way to force CPU bug bits like CPU feature bits. That
      makes it impossible to set a bug bit once at boot and have it stick for all
      upcoming CPUs.
      
      Extend the force set/clear arrays to handle bug bits as well.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.992156574@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      6cbd2171
    • Thomas Gleixner's avatar
      x86/paravirt: Provide a way to check for hypervisors · 79cc7415
      Thomas Gleixner authored
      There is no generic way to test whether a kernel is running on a specific
      hypervisor. But that's required to prevent the upcoming user address space
      separation feature in certain guest modes.
      
      Make the hypervisor type enum unconditionally available and provide a
      helper function which allows to test for a specific type.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.912938129@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      79cc7415
    • Thomas Gleixner's avatar
      x86/paravirt: Dont patch flush_tlb_single · a0357954
      Thomas Gleixner authored
      native_flush_tlb_single() will be changed with the upcoming
      PAGE_TABLE_ISOLATION feature. This requires to have more code in
      there than INVLPG.
      
      Remove the paravirt patching for it.
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Acked-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Cc: linux-mm@kvack.org
      Cc: michael.schwarz@iaik.tugraz.at
      Cc: moritz.lipp@iaik.tugraz.at
      Cc: richard.fellner@student.tugraz.at
      Link: https://lkml.kernel.org/r/20171204150606.828111617@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      a0357954
    • Andy Lutomirski's avatar
      x86/entry/64: Make cpu_entry_area.tss read-only · c482feef
      Andy Lutomirski authored
      The TSS is a fairly juicy target for exploits, and, now that the TSS
      is in the cpu_entry_area, it's no longer protected by kASLR.  Make it
      read-only on x86_64.
      
      On x86_32, it can't be RO because it's written by the CPU during task
      switches, and we use a task gate for double faults.  I'd also be
      nervous about errata if we tried to make it RO even on configurations
      without double fault handling.
      
      [ tglx: AMD confirmed that there is no problem on 64-bit with TSS RO.  So
        	it's probably safe to assume that it's a non issue, though Intel
        	might have been creative in that area. Still waiting for
        	confirmation. ]
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bpetkov@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.733700132@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      c482feef
    • Andy Lutomirski's avatar
      x86/entry: Clean up the SYSENTER_stack code · 0f9a4810
      Andy Lutomirski authored
      The existing code was a mess, mainly because C arrays are nasty.  Turn
      SYSENTER_stack into a struct, add a helper to find it, and do all the
      obvious cleanups this enables.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bpetkov@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.653244723@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      0f9a4810
    • Andy Lutomirski's avatar
      x86/entry/64: Remove the SYSENTER stack canary · 7fbbd5cb
      Andy Lutomirski authored
      Now that the SYSENTER stack has a guard page, there's no need for a canary
      to detect overflow after the fact.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.572577316@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      7fbbd5cb
    • Andy Lutomirski's avatar
      x86/entry/64: Move the IST stacks into struct cpu_entry_area · 40e7f949
      Andy Lutomirski authored
      The IST stacks are needed when an IST exception occurs and are accessed
      before any kernel code at all runs.  Move them into struct cpu_entry_area.
      
      The IST stacks are unlike the rest of cpu_entry_area: they're used even for
      entries from kernel mode.  This means that they should be set up before we
      load the final IDT.  Move cpu_entry_area setup to trap_init() for the boot
      CPU and set it up for all possible CPUs at once in native_smp_prepare_cpus().
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.480598743@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      40e7f949
    • Andy Lutomirski's avatar
      x86/entry/64: Create a per-CPU SYSCALL entry trampoline · 3386bc8a
      Andy Lutomirski authored
      Handling SYSCALL is tricky: the SYSCALL handler is entered with every
      single register (except FLAGS), including RSP, live.  It somehow needs
      to set RSP to point to a valid stack, which means it needs to save the
      user RSP somewhere and find its own stack pointer.  The canonical way
      to do this is with SWAPGS, which lets us access percpu data using the
      %gs prefix.
      
      With PAGE_TABLE_ISOLATION-like pagetable switching, this is
      problematic.  Without a scratch register, switching CR3 is impossible, so
      %gs-based percpu memory would need to be mapped in the user pagetables.
      Doing that without information leaks is difficult or impossible.
      
      Instead, use a different sneaky trick.  Map a copy of the first part
      of the SYSCALL asm at a different address for each CPU.  Now RIP
      varies depending on the CPU, so we can use RIP-relative memory access
      to access percpu memory.  By putting the relevant information (one
      scratch slot and the stack address) at a constant offset relative to
      RIP, we can make SYSCALL work without relying on %gs.
      
      A nice thing about this approach is that we can easily switch it on
      and off if we want pagetable switching to be configurable.
      
      The compat variant of SYSCALL doesn't have this problem in the first
      place -- there are plenty of scratch registers, since we don't care
      about preserving r8-r15.  This patch therefore doesn't touch SYSCALL32
      at all.
      
      This patch actually seems to be a small speedup.  With this patch,
      SYSCALL touches an extra cache line and an extra virtual page, but
      the pipeline no longer stalls waiting for SWAPGS.  It seems that, at
      least in a tight loop, the latter outweights the former.
      
      Thanks to David Laight for an optimization tip.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bpetkov@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.403607157@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      3386bc8a
    • Andy Lutomirski's avatar
      x86/entry/64: Return to userspace from the trampoline stack · 3e3b9293
      Andy Lutomirski authored
      By itself, this is useless.  It gives us the ability to run some final code
      before exit that cannnot run on the kernel stack.  This could include a CR3
      switch a la PAGE_TABLE_ISOLATION or some kernel stack erasing, for
      example.  (Or even weird things like *changing* which kernel stack gets
      used as an ASLR-strengthening mechanism.)
      
      The SYSRET32 path is not covered yet.  It could be in the future or
      we could just ignore it and force the slow path if needed.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.306546484@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      3e3b9293
    • Andy Lutomirski's avatar
      x86/entry/64: Use a per-CPU trampoline stack for IDT entries · 7f2590a1
      Andy Lutomirski authored
      Historically, IDT entries from usermode have always gone directly
      to the running task's kernel stack.  Rearrange it so that we enter on
      a per-CPU trampoline stack and then manually switch to the task's stack.
      This touches a couple of extra cachelines, but it gives us a chance
      to run some code before we touch the kernel stack.
      
      The asm isn't exactly beautiful, but I think that fully refactoring
      it can wait.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.225330557@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      7f2590a1
    • Andy Lutomirski's avatar
      x86/espfix/64: Stop assuming that pt_regs is on the entry stack · 6d9256f0
      Andy Lutomirski authored
      When we start using an entry trampoline, a #GP from userspace will
      be delivered on the entry stack, not on the task stack.  Fix the
      espfix64 #DF fixup to set up #GP according to TSS.SP0, rather than
      assuming that pt_regs + 1 == SP0.  This won't change anything
      without an entry stack, but it will make the code continue to work
      when an entry stack is added.
      
      While we're at it, improve the comments to explain what's actually
      going on.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.130778051@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      6d9256f0
    • Andy Lutomirski's avatar
      x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0 · 9aaefe7b
      Andy Lutomirski authored
      On 64-bit kernels, we used to assume that TSS.sp0 was the current
      top of stack.  With the addition of an entry trampoline, this will
      no longer be the case.  Store the current top of stack in TSS.sp1,
      which is otherwise unused but shares the same cacheline.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Borislav Petkov <bpetkov@suse.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150606.050864668@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      9aaefe7b
    • Andy Lutomirski's avatar
      x86/entry: Remap the TSS into the CPU entry area · 72f5e08d
      Andy Lutomirski authored
      This has a secondary purpose: it puts the entry stack into a region
      with a well-controlled layout.  A subsequent patch will take
      advantage of this to streamline the SYSCALL entry code to be able to
      find it more easily.
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarBorislav Petkov <bpetkov@suse.de>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: David Laight <David.Laight@aculab.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Eduardo Valentin <eduval@amazon.com>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Juergen Gross <jgross@suse.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: aliguori@amazon.com
      Cc: daniel.gruss@iaik.tugraz.at
      Cc: hughd@google.com
      Cc: keescook@google.com
      Link: https://lkml.kernel.org/r/20171204150605.962042855@linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      72f5e08d