1. 16 Sep, 2015 1 commit
  2. 11 Sep, 2015 5 commits
    • Russell King's avatar
      Merge branch 'uaccess' into fixes · c2172ce2
      Russell King authored
      c2172ce2
    • Robert Jarzmik's avatar
      ARM: 8431/1: fix alignement of __bug_table section entries · a4a5a737
      Robert Jarzmik authored
      On old ARM chips, unaligned accesses to memory are not trapped and
      fixed.  On module load, symbols are relocated, and the relocation of
      __bug_table symbols is done on a u32 basis. Yet the section is not
      aligned to a multiple of 4 address, but to a multiple of 2.
      
      This triggers an Oops on pxa architecture, where address 0xbf0021ea
      is the first relocation in the __bug_table section :
        apply_relocate(): pxa3xx_nand: section 13 reloc 0 sym ''
        Unable to handle kernel paging request at virtual address bf0021ea
        pgd = e1cd0000
        [bf0021ea] *pgd=c1cce851, *pte=c1cde04f, *ppte=c1cde01f
        Internal error: Oops: 23 [#1] ARM
        Modules linked in:
        CPU: 0 PID: 606 Comm: insmod Not tainted 4.2.0-rc8-next-20150828-cm-x300+ #887
        Hardware name: CM-X300 module
        task: e1c68700 ti: e1c3e000 task.ti: e1c3e000
        PC is at apply_relocate+0x2f4/0x3d4
        LR is at 0xbf0021ea
        pc : [<c000e7c8>]    lr : [<bf0021ea>]    psr: 80000013
        sp : e1c3fe30  ip : 60000013  fp : e49e8c60
        r10: e49e8fa8  r9 : 00000000  r8 : e49e7c58
        r7 : e49e8c38  r6 : e49e8a58  r5 : e49e8920  r4 : e49e8918
        r3 : bf0021ea  r2 : bf007034  r1 : 00000000  r0 : bf000000
        Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
        Control: 0000397f  Table: c1cd0018  DAC: 00000051
        Process insmod (pid: 606, stack limit = 0xe1c3e198)
        [<c000e7c8>] (apply_relocate) from [<c005ce5c>] (load_module+0x1248/0x1f5c)
        [<c005ce5c>] (load_module) from [<c005dc54>] (SyS_init_module+0xe4/0x170)
        [<c005dc54>] (SyS_init_module) from [<c000a420>] (ret_fast_syscall+0x0/0x38)
      
      Fix this by ensuring entries in __bug_table are all aligned to at least
      of multiple of 4. This transforms a module section  __bug_table as :
      -   [12] __bug_table       PROGBITS        00000000 002232 000018 00   A  0   0  1
      +   [12] __bug_table       PROGBITS        00000000 002232 000018 00   A  0   0  4
      Signed-off-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
      Reviewed-by: default avatarDave Martin <Dave.Martin@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      a4a5a737
    • Julien Grall's avatar
      arm/xen: Enable user access to the kernel before issuing a privcmd call · 0b61f2c0
      Julien Grall authored
      When Xen is copying data to/from the guest it will check if the kernel
      has the right to do the access. If not, the hypercall will return an
      error.
      
      After the commit a5e090ac "ARM:
      software-based privileged-no-access support", the kernel can't access
      any longer the user space by default. This will result to fail on every
      hypercall made by the userspace (i.e via privcmd).
      
      We have to enable the userspace access and then restore the correct
      permission every time the privcmd is used to made an hypercall.
      
      I didn't find generic helpers to do a these operations, so the change
      is only arm32 specific.
      Reported-by: default avatarRiku Voipio <riku.voipio@linaro.org>
      Signed-off-by: default avatarJulien Grall <julien.grall@citrix.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      0b61f2c0
    • Russell King's avatar
      ARM: domains: add memory dependencies to get_domain/set_domain · 6e8f580d
      Russell King authored
      We need to have memory dependencies on get_domain/set_domain to avoid
      the compiler over-optimising these inline assembly instructions.
      
      Loads/stores must not be reordered across a set_domain(), so introduce
      a compiler barrier for that assembly.
      
      The value of get_domain() must not be cached across a set_domain(), but
      we still want to allow the compiler to optimise it away.  Introduce a
      dependency on current_thread_info()->cpu_domain to avoid this; the new
      memory clobber in set_domain() should therefore cause the compiler to
      re-load this.  The other advantage of using this is we should have its
      address in the register set already, or very soon after at most call
      sites.
      Tested-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      6e8f580d
    • Russell King's avatar
      ARM: domains: thread_info.h no longer needs asm/domains.h · 716ff192
      Russell King authored
      As of 1eef5d2f ("ARM: domains: switch to keeping domain value in
      register") we no longer need to include asm/domains.h into
      asm/thread_info.h.  Remove it.
      Tested-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      716ff192
  3. 09 Sep, 2015 3 commits
  4. 07 Sep, 2015 1 commit
    • Ard Biesheuvel's avatar
      ARM: 8429/1: disable GCC SRA optimization · a077224f
      Ard Biesheuvel authored
      While working on the 32-bit ARM port of UEFI, I noticed a strange
      corruption in the kernel log. The following snprintf() statement
      (in drivers/firmware/efi/efi.c:efi_md_typeattr_format())
      
      	snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",
      
      was producing the following output in the log:
      
      	|    |   |   |   |    |WB|WT|WC|UC]
      	|    |   |   |   |    |WB|WT|WC|UC]
      	|    |   |   |   |    |WB|WT|WC|UC]
      	|RUN|   |   |   |    |WB|WT|WC|UC]*
      	|RUN|   |   |   |    |WB|WT|WC|UC]*
      	|    |   |   |   |    |WB|WT|WC|UC]
      	|RUN|   |   |   |    |WB|WT|WC|UC]*
      	|    |   |   |   |    |WB|WT|WC|UC]
      	|RUN|   |   |   |    |   |   |   |UC]
      	|RUN|   |   |   |    |   |   |   |UC]
      
      As it turns out, this is caused by incorrect code being emitted for
      the string() function in lib/vsprintf.c. The following code
      
      	if (!(spec.flags & LEFT)) {
      		while (len < spec.field_width--) {
      			if (buf < end)
      				*buf = ' ';
      			++buf;
      		}
      	}
      	for (i = 0; i < len; ++i) {
      		if (buf < end)
      			*buf = *s;
      		++buf; ++s;
      	}
      	while (len < spec.field_width--) {
      		if (buf < end)
      			*buf = ' ';
      		++buf;
      	}
      
      when called with len == 0, triggers an issue in the GCC SRA optimization
      pass (Scalar Replacement of Aggregates), which handles promotion of signed
      struct members incorrectly. This is a known but as yet unresolved issue.
      (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular
      case, it is causing the second while loop to be executed erroneously a
      single time, causing the additional space characters to be printed.
      
      So disable the optimization by passing -fno-ipa-sra.
      
      Cc: <stable@vger.kernel.org>
      Acked-by: default avatarNicolas Pitre <nico@linaro.org>
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      a077224f
  5. 26 Aug, 2015 3 commits
    • Russell King's avatar
      ARM: software-based priviledged-no-access support · a5e090ac
      Russell King authored
      Provide a software-based implementation of the priviledged no access
      support found in ARMv8.1.
      
      Userspace pages are mapped using a different domain number from the
      kernel and IO mappings.  If we switch the user domain to "no access"
      when we enter the kernel, we can prevent the kernel from touching
      userspace.
      
      However, the kernel needs to be able to access userspace via the
      various user accessor functions.  With the wrapping in the previous
      patch, we can temporarily enable access when the kernel needs user
      access, and re-disable it afterwards.
      
      This allows us to trap non-intended accesses to userspace, eg, caused
      by an inadvertent dereference of the LIST_POISON* values, which, with
      appropriate user mappings setup, can be made to succeed.  This in turn
      can allow use-after-free bugs to be further exploited than would
      otherwise be possible.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      a5e090ac
    • Russell King's avatar
      ARM: entry: provide uaccess assembly macro hooks · 2190fed6
      Russell King authored
      Provide hooks into the kernel entry and exit paths to permit control
      of userspace visibility to the kernel.  The intended use is:
      
      - on entry to kernel from user, uaccess_disable will be called to
        disable userspace visibility
      - on exit from kernel to user, uaccess_enable will be called to
        enable userspace visibility
      - on entry from a kernel exception, uaccess_save_and_disable will be
        called to save the current userspace visibility setting, and disable
        access
      - on exit from a kernel exception, uaccess_restore will be called to
        restore the userspace visibility as it was before the exception
        occurred.
      
      These hooks allows us to keep userspace visibility disabled for the
      vast majority of the kernel, except for localised regions where we
      want to explicitly access userspace.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      2190fed6
    • Russell King's avatar
      ARM: entry: get rid of multiple macro definitions · aa06e5c1
      Russell King authored
      The following structure is just asking for trouble:
      
       #ifdef CONFIG_symbol
      	.macro foo
      	...
      	.endm
      	.macro bar
      	...
      	.endm
      	.macro baz
      	...
      	.endm
       #else
      	.macro foo
      	...
      	.endm
      	.macro bar
      	...
      	.endm
       #ifdef CONFIG_symbol2
      	.macro baz
      	...
      	.endm
       #else
      	.macro baz
      	...
      	.endm
       #endif
       #endif
      
      such as one defintion being updated, but the other definitions miss out.
      Where the contents of a macro needs to be conditional, the hint is in
      the first clause of this very sentence.  "contents" "conditional".  Not
      multiple separate definitions, especially not when much of the macro
      is the same between different configs.
      
      This patch fixes this bad style, which had caused the Thumb2 code to
      miss-out on the uaccess updates.
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      aa06e5c1
  6. 25 Aug, 2015 2 commits
  7. 21 Aug, 2015 6 commits
  8. 18 Aug, 2015 2 commits
    • Masahiro Yamada's avatar
      ARM: 8418/1: add boot image dependencies to not generate invalid images · 3939f334
      Masahiro Yamada authored
      U-Boot is often used to boot the kernel on ARM boards, but uImage
      is not built by "make all", so we are often inclined to do
      "make all uImage" to generate DTBs, modules and uImage in a single
      command, but we should notice a pitfall behind it.  In fact,
      "make all uImage" could generate an invalid uImage if it is run with
      the parallel option (-j).
      
      You can reproduce this problem with the following procedure:
      
      [1] First, build "all" and "uImage" separately.
          You will get a valid uImage
      
        $ git clean -f -x -d
        $ export CROSS_COMPILE=<your-tools-prefix>
        $ make -s -j8 ARCH=arm multi_v7_defconfig
        $ make -s -j8 ARCH=arm all
        $ make -j8 ARCH=arm UIMAGE_LOADADDR=0x80208000 uImage
          CHK     include/config/kernel.release
          CHK     include/generated/uapi/linux/version.h
          CHK     include/generated/utsrelease.h
        make[1]: `include/generated/mach-types.h' is up to date.
          CHK     include/generated/timeconst.h
          CHK     include/generated/bounds.h
          CHK     include/generated/asm-offsets.h
          CALL    scripts/checksyscalls.sh
          CHK     include/generated/compile.h
          Kernel: arch/arm/boot/Image is ready
          Kernel: arch/arm/boot/zImage is ready
          UIMAGE  arch/arm/boot/uImage
        Image Name:   Linux-4.2.0-rc5-00156-gdd2384a7-d
        Created:      Sat Aug  8 23:21:35 2015
        Image Type:   ARM Linux Kernel Image (uncompressed)
        Data Size:    6138648 Bytes = 5994.77 kB = 5.85 MB
        Load Address: 80208000
        Entry Point:  80208000
          Image arch/arm/boot/uImage is ready
        $ ls -l arch/arm/boot/*Image
        -rwxrwxr-x 1 masahiro masahiro 13766656 Aug  8 23:20 arch/arm/boot/Image
        -rw-rw-r-- 1 masahiro masahiro  6138712 Aug  8 23:21 arch/arm/boot/uImage
        -rwxrwxr-x 1 masahiro masahiro  6138648 Aug  8 23:20 arch/arm/boot/zImage
      
      [2] Update some source file(s)
      
        $ touch init/main.c
      
      [3] Then, re-build "all" and "uImage" simultaneously.
          You will get an invalid uImage at random.
      
        $ make -j8 ARCH=arm UIMAGE_LOADADDR=0x80208000 all uImage
          CHK     include/config/kernel.release
          CHK     include/generated/uapi/linux/version.h
          CHK     include/generated/utsrelease.h
        make[1]: `include/generated/mach-types.h' is up to date.
          CHK     include/generated/timeconst.h
          CHK     include/generated/bounds.h
          CHK     include/generated/asm-offsets.h
          CALL    scripts/checksyscalls.sh
          CC      init/main.o
          CHK     include/generated/compile.h
          LD      init/built-in.o
          LINK    vmlinux
          LD      vmlinux.o
          MODPOST vmlinux.o
          GEN     .version
          CHK     include/generated/compile.h
          UPD     include/generated/compile.h
          CC      init/version.o
          LD      init/built-in.o
          KSYM    .tmp_kallsyms1.o
          KSYM    .tmp_kallsyms2.o
          LD      vmlinux
          SORTEX  vmlinux
          SYSMAP  System.map
          OBJCOPY arch/arm/boot/Image
          Building modules, stage 2.
          Kernel: arch/arm/boot/Image is ready
          GZIP    arch/arm/boot/compressed/piggy.gzip
          AS      arch/arm/boot/compressed/piggy.gzip.o
          Kernel: arch/arm/boot/Image is ready
          LD      arch/arm/boot/compressed/vmlinux
          GZIP    arch/arm/boot/compressed/piggy.gzip
          OBJCOPY arch/arm/boot/zImage
          Kernel: arch/arm/boot/zImage is ready
          UIMAGE  arch/arm/boot/uImage
        Image Name:   Linux-4.2.0-rc5-00156-gdd2384a7-d
        Created:      Sat Aug  8 23:23:14 2015
        Image Type:   ARM Linux Kernel Image (uncompressed)
        Data Size:    26472 Bytes = 25.85 kB = 0.03 MB
        Load Address: 80208000
        Entry Point:  80208000
          Image arch/arm/boot/uImage is ready
          MODPOST 192 modules
          AS      arch/arm/boot/compressed/piggy.gzip.o
          LD      arch/arm/boot/compressed/vmlinux
          OBJCOPY arch/arm/boot/zImage
          Kernel: arch/arm/boot/zImage is ready
        $ ls -l arch/arm/boot/*Image
        -rwxrwxr-x 1 masahiro masahiro 13766656 Aug  8 23:23 arch/arm/boot/Image
        -rw-rw-r-- 1 masahiro masahiro    26536 Aug  8 23:23 arch/arm/boot/uImage
        -rwxrwxr-x 1 masahiro masahiro  6138648 Aug  8 23:23 arch/arm/boot/zImage
      
      Please notice the uImage is extremely small when this issue is
      encountered.  Besides, "Kernel: arch/arm/boot/zImage is ready" is
      displayed twice, before and after the uImage log.
      
      The root cause of this is the race condition between zImage and
      uImage.  Actually, uImage depends on zImage, but the dependency
      between the two is only described in arch/arm/boot/Makefile.
      Because arch/arm/boot/Makefile is not included from the top-level
      Makefile, it cannot know the dependency between zImage and uImage.
      
      Consequently, when we run make with the parallel option, Kbuild
      updates vmlinux first, and then two different threads descends into
      the arch/arm/boot/Makefile almost at the same time, one for updating
      zImage and the other for uImage.  While one thread is re-generating
      zImage, the other also tries to update zImage before creating uImage
      on top of that.  zImage is overwritten by the slower thread and then
      uImage is created based on the half-written zImage.
      
      This is the reason why "Kernel: arch/arm/boot/zImage is ready" is
      displayed twice, and a broken uImage is created.
      
      The same problem could happen on bootpImage.
      
      This commit adds dependencies among Image, zImage, uImage, and
      bootpImage to arch/arm/Makefile, which is included from the
      top-level Makefile.
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      3939f334
    • Nicolas Pitre's avatar
      ARM: 8414/1: __copy_to_user_memcpy: fix mmap semaphore usage · 0f64b247
      Nicolas Pitre authored
      The mmap semaphore should not be taken when page faults are disabled.
      Since pagefault_disable() no longer disables preemption, we now need
      to use faulthandler_disabled() in place of in_atomic().
      Signed-off-by: default avatarNicolas Pitre <nico@linaro.org>
      Tested-by: default avatarMark Salter <msalter@redhat.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      0f64b247
  9. 11 Aug, 2015 1 commit
    • Nathan Lynch's avatar
      ARM: 8410/1: VDSO: fix coarse clock monotonicity regression · 09edea4f
      Nathan Lynch authored
      Since 906c5557 ("timekeeping: Copy the shadow-timekeeper over the
      real timekeeper last") it has become possible on ARM to:
      
      - Obtain a CLOCK_MONOTONIC_COARSE or CLOCK_REALTIME_COARSE timestamp
        via syscall.
      - Subsequently obtain a timestamp for the same clock ID via VDSO which
        predates the first timestamp (by one jiffy).
      
      This is because ARM's update_vsyscall is deriving the coarse time
      using the __current_kernel_time interface, when it should really be
      using the timekeeper object provided to it by the timekeeping core.
      It happened to work before only because __current_kernel_time would
      access the same timekeeper object which had been passed to
      update_vsyscall.  This is no longer the case.
      
      Cc: stable@vger.kernel.org
      Fixes: 906c5557 ("timekeeping: Copy the shadow-timekeeper over the real timekeeper last")
      Signed-off-by: default avatarNathan Lynch <nathan_lynch@mentor.com>
      Acked-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      09edea4f
  10. 07 Aug, 2015 2 commits
  11. 31 Jul, 2015 1 commit
    • Nathan Lynch's avatar
      ARM: 8405/1: VDSO: fix regression with toolchains lacking ld.bfd executable · 3473f265
      Nathan Lynch authored
      The Sourcery CodeBench Lite 2014.05 toolchain (gcc 4.8.3, binutils
      2.24.51) has a GCC which implements -fuse-ld, and it doesn't include
      the gold linker, but it lacks an ld.bfd executable in its
      installation.  This means that passing -fuse-ld=bfd fails with:
      
            VDSO    arch/arm/vdso/vdso.so.raw
          collect2: fatal error: cannot find 'ld'
      
      Arguably this is a deficiency in the toolchain, but I suspect it's
      commonly used enough that it's worth accommodating: just use
      
      cc-ldoption (to cause a link attempt) instead of cc-option to test
      whether we can use -fuse-ld.  So -fuse-ld=bfd won't be used with this
      toolchain, but the build will rightly succeed, just as it does for
      toolchains which don't implement -fuse-ld (and don't use gold as the
      default linker).
      
      Note: this will change the failure mode for a corner case I was trying
      to handle in d2b30cd4, where the toolchain defaults to the gold
      linker and the BFD linker is not found in PATH, from:
      
            VDSO    arch/arm/vdso/vdso.so.raw
          collect2: fatal error: cannot find 'ld'
      
      i.e. the BFD linker is not found, to:
      
            OBJCOPY arch/arm/vdso/vdso.so
          BFD: arch/arm/vdso/vdso.so: Not enough room for program headers, try
          linking with -N
      
      that is, we fail to prevent gold from being used as the linker, and it
      produces an object that objcopy can't digest.
      Reported-by: default avatarBaruch Siach <baruch@tkos.co.il>
      Tested-by: default avatarBaruch Siach <baruch@tkos.co.il>
      Tested-by: default avatarRaphaël Poggi <poggi.raph@gmail.com>
      Fixes: d2b30cd4 ("ARM: 8384/1: VDSO: force use of BFD linker")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNathan Lynch <nathan_lynch@mentor.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      3473f265
  12. 17 Jul, 2015 5 commits
  13. 12 Jul, 2015 8 commits
    • Linus Torvalds's avatar
      Linux 4.2-rc2 · bc0195aa
      Linus Torvalds authored
      bc0195aa
    • Linus Torvalds's avatar
      Revert "drm/i915: Use crtc_state->active in primary check_plane func" · 01e2d062
      Linus Torvalds authored
      This reverts commit dec4f799.
      
      Jörg Otte reports a NULL pointder dereference due to this commit, as
      'crtc_state' very much can be NULL:
      
              crtc_state = state->base.state ?
                      intel_atomic_get_crtc_state(state->base.state, intel_crtc) : NULL;
      
      So the change to test 'crtc_state->base.active' cannot possibly be
      correct as-is.
      
      There may be some other minimal fix (like just checking crtc_state for
      NULL), but I'm just reverting it now for the rc2 release, and people
      like Daniel Vetter who actually know this code will figure out what the
      right solution is in the longer term.
      Reported-and-bisected-by: default avatarJörg Otte <jrg.otte@gmail.com>
      Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Daniel Vetter <daniel.vetter@intel.com>
      CC: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      01e2d062
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · c83727a6
      Linus Torvalds authored
      Pull VFS fixes from Al Viro:
       "Fixes for this cycle regression in overlayfs and a couple of
        long-standing (== all the way back to 2.6.12, at least) bugs"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        freeing unlinked file indefinitely delayed
        fix a braino in ovl_d_select_inode()
        9p: don't leave a half-initialized inode sitting around
      c83727a6
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · 7fbb58a0
      Linus Torvalds authored
      Pull MIPS fixes from Ralf Baechle:
       "A fair number of 4.2 fixes also because Markos opened the flood gates.
      
         - Patch up the math used calculate the location for the page bitmap.
      
         - The FDC (Not what you think, FDC stands for Fast Debug Channel) IRQ
           around was causing issues on non-Malta platforms, so move the code
           to a Malta specific location.
      
         - A spelling fix replicated through several files.
      
         - Fix to the emulation of an R2 instruction for R6 cores.
      
         - Fix the JR emulation for R6.
      
         - Further patching of mindless 64 bit issues.
      
         - Ensure the kernel won't crash on CPUs with L2 caches with >= 8
           ways.
      
         - Use compat_sys_getsockopt for O32 ABI on 64 bit kernels.
      
         - Fix cache flushing for multithreaded cores.
      
         - A build fix"
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
        MIPS: O32: Use compat_sys_getsockopt.
        MIPS: c-r4k: Extend way_string array
        MIPS: Pistachio: Support CDMM & Fast Debug Channel
        MIPS: Malta: Make GIC FDC IRQ workaround Malta specific
        MIPS: c-r4k: Fix cache flushing for MT cores
        Revert "MIPS: Kconfig: Disable SMP/CPS for 64-bit"
        MIPS: cps-vec: Use macros for various arithmetics and memory operations
        MIPS: kernel: cps-vec: Replace KSEG0 with CKSEG0
        MIPS: kernel: cps-vec: Use ta0-ta3 pseudo-registers for 64-bit
        MIPS: kernel: cps-vec: Replace mips32r2 ISA level with mips64r2
        MIPS: kernel: cps-vec: Replace 'la' macro with PTR_LA
        MIPS: kernel: smp-cps: Fix 64-bit compatibility errors due to pointer casting
        MIPS: Fix erroneous JR emulation for MIPS R6
        MIPS: Fix branch emulation for BLTC and BGEC instructions
        MIPS: kernel: traps: Fix broken indentation
        MIPS: bootmem: Don't use memory holes for page bitmap
        MIPS: O32: Do not handle require 32 bytes from the stack to be readable.
        MIPS, CPUFREQ: Fix spelling of Institute.
        MIPS: Lemote 2F: Fix build caused by recent mass rename.
      7fbb58a0
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1daa1cfb
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
      
       - the high latency PIT detection fix, which slipped through the cracks
         for rc1
      
       - a regression fix for the early printk mechanism
      
       - the x86 part to plug irq/vector related hotplug races
      
       - move the allocation of the espfix pages on cpu hotplug to non atomic
         context.  The current code triggers a might_sleep() warning.
      
       - a series of KASAN fixes addressing boot crashes and usability
      
       - a trivial typo fix for Kconfig help text
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/kconfig: Fix typo in the CONFIG_CMDLINE_BOOL help text
        x86/irq: Retrieve irq data after locking irq_desc
        x86/irq: Use proper locking in check_irq_vectors_for_cpu_disable()
        x86/irq: Plug irq vector hotplug race
        x86/earlyprintk: Allow early_printk() to use console style parameters like '115200n8'
        x86/espfix: Init espfix on the boot CPU side
        x86/espfix: Add 'cpu' parameter to init_espfix_ap()
        x86/kasan: Move KASAN_SHADOW_OFFSET to the arch Kconfig
        x86/kasan: Add message about KASAN being initialized
        x86/kasan: Fix boot crash on AMD processors
        x86/kasan: Flush TLBs after switching CR3
        x86/kasan: Fix KASAN shadow region page tables
        x86/init: Clear 'init_level4_pgt' earlier
        x86/tsc: Let high latency PIT fail fast in quick_pit_calibrate()
      1daa1cfb
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 7b732169
      Linus Torvalds authored
      Pull timer fixes from Thomas Gleixner:
       "This update from the timer departement contains:
      
         - A series of patches which address a shortcoming in the tick
           broadcast code.
      
           If the broadcast device is not available or an hrtimer emulated
           broadcast device, some of the original assumptions lead to boot
           failures.  I rather plugged all of the corner cases instead of only
           addressing the issue reported, so the change got a little larger.
      
           Has been extensivly tested on x86 and arm.
      
         - Get rid of the last holdouts using do_posix_clock_monotonic_gettime()
      
         - A regression fix for the imx clocksource driver
      
         - An update to the new state callbacks mechanism for clockevents.
           This is required to simplify the conversion, which will take place
           in 4.3"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        tick/broadcast: Prevent NULL pointer dereference
        time: Get rid of do_posix_clock_monotonic_gettime
        cris: Replace do_posix_clock_monotonic_gettime()
        tick/broadcast: Unbreak CONFIG_GENERIC_CLOCKEVENTS=n build
        tick/broadcast: Handle spurious interrupts gracefully
        tick/broadcast: Check for hrtimer broadcast active early
        tick/broadcast: Return busy when IPI is pending
        tick/broadcast: Return busy if periodic mode and hrtimer broadcast
        tick/broadcast: Move the check for periodic mode inside state handling
        tick/broadcast: Prevent deep idle if no broadcast device available
        tick/broadcast: Make idle check independent from mode and config
        tick/broadcast: Sanity check the shutdown of the local clock_event
        tick/broadcast: Prevent hrtimer recursion
        clockevents: Allow set-state callbacks to be optional
        clocksource/imx: Define clocksource for mx27
      7b732169
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · c4bc680c
      Linus Torvalds authored
      Pull irq fix from Thomas Gleixner:
       "A single fix for a cpu hotplug race vs. interrupt descriptors:
      
        Prevent irq setup/teardown across the cpu starting/dying parts of cpu
        hotplug so that the starting/dying cpu has a stable view of the
        descriptor space.  This has been an issue for all architectures in the
        cpu dying phase, where interrupts are migrated away from the dying
        cpu.  In the starting phase its mostly a x86 issue vs the vector space
        update"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        hotplug: Prevent alloc/free of irq descriptors during cpu up/down
      c4bc680c
    • Al Viro's avatar
      freeing unlinked file indefinitely delayed · 75a6f82a
      Al Viro authored
      	Normally opening a file, unlinking it and then closing will have
      the inode freed upon close() (provided that it's not otherwise busy and
      has no remaining links, of course).  However, there's one case where that
      does *not* happen.  Namely, if you open it by fhandle with cold dcache,
      then unlink() and close().
      
      	In normal case you get d_delete() in unlink(2) notice that dentry
      is busy and unhash it; on the final dput() it will be forcibly evicted from
      dcache, triggering iput() and inode removal.  In this case, though, we end
      up with *two* dentries - disconnected (created by open-by-fhandle) and
      regular one (used by unlink()).  The latter will have its reference to inode
      dropped just fine, but the former will not - it's considered hashed (it
      is on the ->s_anon list), so it will stay around until the memory pressure
      will finally do it in.  As the result, we have the final iput() delayed
      indefinitely.  It's trivial to reproduce -
      
      void flush_dcache(void)
      {
              system("mount -o remount,rw /");
      }
      
      static char buf[20 * 1024 * 1024];
      
      main()
      {
              int fd;
              union {
                      struct file_handle f;
                      char buf[MAX_HANDLE_SZ];
              } x;
              int m;
      
              x.f.handle_bytes = sizeof(x);
              chdir("/root");
              mkdir("foo", 0700);
              fd = open("foo/bar", O_CREAT | O_RDWR, 0600);
              close(fd);
              name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0);
              flush_dcache();
              fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);
              unlink("foo/bar");
              write(fd, buf, sizeof(buf));
              system("df .");			/* 20Mb eaten */
              close(fd);
              system("df .");			/* should've freed those 20Mb */
              flush_dcache();
              system("df .");			/* should be the same as #2 */
      }
      
      will spit out something like
      Filesystem     1K-blocks   Used Available Use% Mounted on
      /dev/root         322023 303843      1131 100% /
      Filesystem     1K-blocks   Used Available Use% Mounted on
      /dev/root         322023 303843      1131 100% /
      Filesystem     1K-blocks   Used Available Use% Mounted on
      /dev/root         322023 283282     21692  93% /
      - inode gets freed only when dentry is finally evicted (here we trigger
      than by remount; normally it would've happened in response to memory
      pressure hell knows when).
      
      Cc: stable@vger.kernel.org # v2.6.38+; earlier ones need s/kill_it/unhash_it/
      Acked-by: default avatarJ. Bruce Fields <bfields@fieldses.org>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      75a6f82a