17 Mar, 2017

21 commits


13 Mar, 2017

4 commits

  • Linus Torvalds
     
  • Pull s390 fixes from Martin Schwidefsky:

    - four patches to get the new cputime code in shape for s390

    - add the new statx system call

    - a few bug fixes

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
    s390: wire up statx system call
    KVM: s390: Fix guest migration for huge guests resulting in panic
    s390/ipl: always use load normal for CCW-type re-IPL
    s390/timex: micro optimization for tod_to_ns
    s390/cputime: provide archicture specific cputime_to_nsecs
    s390/cputime: reset all accounting fields on fork
    s390/cputime: remove last traces of cputime_t
    s390: fix in-kernel program checks
    s390/crypt: fix missing unlock in ctr_paes_crypt on error path

    Linus Torvalds
     
  • Pull x86 fixes from Thomas Gleixner:

    - a fix for the kexec/purgatory regression which was introduced in the
    merge window via an innocent sparse fix. We could have reverted that
    commit, but on deeper inspection it turned out that the whole
    machinery is neither documented nor robust. So a proper cleanup was
    done instead

    - the fix for the TLB flush issue which was discovered recently

    - a simple typo fix for a reboot quirk

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/tlb: Fix tlb flushing when lguest clears PGE
    kexec, x86/purgatory: Unbreak it and clean it up
    x86/reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk

    Linus Torvalds
     
  • Pull irq fixes from Thomas Gleixner:

    - a workaround for a GIC erratum

    - a missing stub function for CONFIG_IRQDOMAIN=n

    - fixes for a couple of type inconsistencies

    * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    irqchip/crossbar: Fix incorrect type of register size
    irqchip/gicv3-its: Add workaround for QDF2400 ITS erratum 0065
    irqdomain: Add empty irq_domain_check_msi_remap
    irqchip/crossbar: Fix incorrect type of local variables

    Linus Torvalds
     

12 Mar, 2017

5 commits

  • Fengguang reported random corruptions from various locations on x86-32
    after commits d2852a224050 ("arch: add ARCH_HAS_SET_MEMORY config") and
    9d876e79df6a ("bpf: fix unlocking of jited image when module ronx not set")
    that uses the former. While x86-32 doesn't have a JIT like x86_64, the
    bpf_prog_lock_ro() and bpf_prog_unlock_ro() got enabled due to
    ARCH_HAS_SET_MEMORY, whereas Fengguang's test kernel doesn't have module
    support built in and therefore never had the DEBUG_SET_MODULE_RONX setting
    enabled.

    After investigating the crashes further, it turned out that using
    set_memory_ro() and set_memory_rw() didn't have the desired effect, for
    example, setting the pages as read-only on x86-32 would still let
    probe_kernel_write() succeed without error. This behavior would manifest
    itself in situations where the vmalloc'ed buffer was accessed prior to
    set_memory_*() such as in case of bpf_prog_alloc(). In cases where it
    wasn't, the page attribute changes seemed to have taken effect, leading to
    the conclusion that a TLB invalidate didn't happen. Moreover, it turned out
    that this issue reproduced with qemu in "-cpu kvm64" mode, but not for
    "-cpu host". When the issue occurs, change_page_attr_set_clr() did trigger
    a TLB flush as expected via __flush_tlb_all() through cpa_flush_range(),
    though.

    There are 3 variants for issuing a TLB flush: invpcid_flush_all() (depends
    on CPU feature bits X86_FEATURE_INVPCID, X86_FEATURE_PGE), cr4 based flush
    (depends on X86_FEATURE_PGE), and cr3 based flush. For "-cpu host" case in
    my setup, the flush used invpcid_flush_all() variant, whereas for "-cpu
    kvm64", the flush was cr4 based. Switching the kvm64 case to cr3 manually
    worked fine, and further investigating the cr4 one turned out that
    X86_CR4_PGE bit was not set in cr4 register, meaning the
    __native_flush_tlb_global_irq_disabled() wrote cr4 twice with the same
    value instead of clearing X86_CR4_PGE in the first write to trigger the
    flush.

    It turned out that X86_CR4_PGE was cleared from cr4 during init from
    lguest_arch_host_init() via adjust_pge(). The X86_FEATURE_PGE bit is also
    cleared from there due to concerns of using PGE in guest kernel that can
    lead to hard to trace bugs (see bff672e630a0 ("lguest: documentation V:
    Host") in init()). The CPU feature bits are cleared in dynamic
    boot_cpu_data, but they never propagated to __flush_tlb_all() as it uses
    static_cpu_has() instead of boot_cpu_has() for testing which variant of TLB
    flushing to use, meaning they still used the old setting of the host
    kernel.

    Clearing via setup_clear_cpu_cap(X86_FEATURE_PGE) so this would propagate
    to static_cpu_has() checks is too late at this point as sections have been
    patched already, so for now, it seems reasonable to switch back to
    boot_cpu_has(X86_FEATURE_PGE) as it was prior to commit c109bf95992b
    ("x86/cpufeature: Remove cpu_has_pge"). This lets the TLB flush trigger via
    cr3 as originally intended, properly makes the new page attributes visible
    and thus fixes the crashes seen by Fengguang.

    Fixes: c109bf95992b ("x86/cpufeature: Remove cpu_has_pge")
    Reported-by: Fengguang Wu
    Signed-off-by: Daniel Borkmann
    Cc: bp@suse.de
    Cc: Kees Cook
    Cc: "David S. Miller"
    Cc: netdev@vger.kernel.org
    Cc: Rusty Russell
    Cc: Alexei Starovoitov
    Cc: Linus Torvalds
    Cc: lkp@01.org
    Cc: Laura Abbott
    Cc: stable@vger.kernel.org
    Link: http://lkml.kernrl.org/r/20170301125426.l4nf65rx4wahohyl@wfg-t540p.sh.intel.com
    Link: http://lkml.kernel.org/r/25c41ad9eca164be4db9ad84f768965b7eb19d9e.1489191673.git.daniel@iogearbox.net
    Signed-off-by: Thomas Gleixner

    Daniel Borkmann
     
  • Pull KVM fixes from Radim Krčmář:
    "ARM updates from Marc Zyngier:
    - vgic updates:
    - Honour disabling the ITS
    - Don't deadlock when deactivating own interrupts via MMIO
    - Correctly expose the lact of IRQ/FIQ bypass on GICv3

    - I/O virtualization:
    - Make KVM_CAP_NR_MEMSLOTS big enough for large guests with many
    PCIe devices

    - General bug fixes:
    - Gracefully handle exception generated with syndroms that the host
    doesn't understand
    - Properly invalidate TLBs on VHE systems

    x86:
    - improvements in emulation of VMCLEAR, VMX MSR bitmaps, and VCPU
    reset

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    KVM: nVMX: do not warn when MSR bitmap address is not backed
    KVM: arm64: Increase number of user memslots to 512
    KVM: arm/arm64: Remove KVM_PRIVATE_MEM_SLOTS definition that are unused
    KVM: arm/arm64: Enable KVM_CAP_NR_MEMSLOTS on arm/arm64
    KVM: Add documentation for KVM_CAP_NR_MEMSLOTS
    KVM: arm/arm64: VGIC: Fix command handling while ITS being disabled
    arm64: KVM: Survive unknown traps from guests
    arm: KVM: Survive unknown traps from guests
    KVM: arm/arm64: Let vcpu thread modify its own active state
    KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset
    kvm: nVMX: VMCLEAR should not cause the vCPU to shut down
    KVM: arm/arm64: vgic-v3: Don't pretend to support IRQ/FIQ bypass
    arm64: KVM: VHE: Clear HCR_TGE when invalidating guest TLBs

    Linus Torvalds
     
  • Pull extable.h fix from Paul Gortmaker:
    "Fixup for arch/score after extable.h introduction.

    It seems that Guenter is the only one on the planet doing builds for
    arch/score -- we don't have compile coverage for it in linux-next or
    in the kbuild-bot either. Guenter couldn't even recall where he got
    his toolchain, but was kind enough to share it with me so I could
    validate this change and also add arch/score to my build coverage.

    I sat on this a bit in case there was any other fallout in other arch
    dirs, but since this still seems to be the only one, I might as well
    send it on its way"

    * tag 'extable-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux:
    score: Fix implicit includes now failing build after extable change

    Linus Torvalds
     
  • Pull random updates from Ted Ts'o:
    "Change get_random_{int,log} to use the CRNG used by /dev/urandom and
    getrandom(2). It's faster and arguably more secure than cut-down MD5
    that we had been using.

    Also do some code cleanup"

    * tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
    random: move random_min_urandom_seed into CONFIG_SYSCTL ifdef block
    random: convert get_random_int/long into get_random_u32/u64
    random: use chacha20 for get_random_int/long
    random: fix comment for unused random_min_urandom_seed
    random: remove variable limit
    random: remove stale urandom_init_wait
    random: remove stale maybe_reseed_primary_crng

    Linus Torvalds
     
  • After changing from module.h to extable.h, score builds fail with:

    arch/score/kernel/traps.c: In function 'do_ri':
    arch/score/kernel/traps.c:248:4: error: implicit declaration of function 'user_disable_single_step'
    arch/score/mm/extable.c: In function 'fixup_exception':
    arch/score/mm/extable.c:32:38: error: dereferencing pointer to incomplete type
    arch/score/mm/extable.c:34:24: error: dereferencing pointer to incomplete type

    because extable.h doesn't drag in the same amount of headers as the
    module.h did. Add in the headers which were implicitly expected.

    Fixes: 90858794c960 ("module.h: remove extable.h include now users have migrated")
    Signed-off-by: Guenter Roeck
    [PG: tweak commit log; refresh for sched header refactoring.]
    Signed-off-by: Paul Gortmaker

    Guenter Roeck
     

11 Mar, 2017

10 commits

  • Pull tty/serial fixes frpm Greg KH:
    "Here are two bugfixes for tty stuff for 4.11-rc2.

    One of them resolves the pretty bad bug in the n_hdlc code that
    Alexander Popov found and fixed and has been reported everywhere. The
    other just fixes a samsung serial driver issue when DMA fails on some
    systems.

    Both have been in linux-next with no reported issues"

    * tag 'tty-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    serial: samsung: Continue to work if DMA request fails
    tty: n_hdlc: get rid of racy n_hdlc.tbuf

    Linus Torvalds
     
  • Pull staging driver fixes from Greg KH:
    "Here are two small build warning fixes for some staging drivers that
    Arnd has found on his valiant quest to get the kernel to build
    properly with no warnings.

    Both of these have been in linux-next this week and resolve the
    reported issues"

    * tag 'staging-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging: octeon: remove unused variable
    staging/vc04_services: add CONFIG_OF dependency

    Linus Torvalds
     
  • Pull USB fixes from Greg KH:
    "Here is a number of different USB fixes for 4.11-rc2.

    Seems like there were a lot of unresolved issues that people have been
    finding for this subsystem, and a bunch of good security auditing
    happening as well from Johan Hovold. There's the usual batch of gadget
    driver fixes and xhci issues resolved as well.

    All of these have been in linux-next with no reported issues"

    * tag 'usb-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits)
    usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers
    usb: host: xhci-dbg: HCIVERSION should be a binary number
    usb: xhci: remove dummy extra_priv_size for size of xhci_hcd struct
    usb: xhci-mtk: check hcc_params after adding primary hcd
    USB: serial: digi_acceleport: fix OOB-event processing
    MAINTAINERS: usb251xb: remove reference inexistent file
    doc: dt-bindings: usb251xb: mark reg as required
    usb: usb251xb: dt: add unit suffix to oc-delay and power-on-time
    usb: usb251xb: remove max_{power,current}_{sp,bp} properties
    usb-storage: Add ignore-residue quirk for Initio INIC-3619
    USB: iowarrior: fix NULL-deref in write
    USB: iowarrior: fix NULL-deref at probe
    usb: phy: isp1301: Add OF device ID table
    usb: ohci-at91: Do not drop unhandled USB suspend control requests
    USB: serial: safe_serial: fix information leak in completion handler
    USB: serial: io_ti: fix information leak in completion handler
    USB: serial: omninet: drop open callback
    USB: serial: omninet: fix reference leaks at open
    USB: serial: io_ti: fix NULL-deref in interrupt callback
    usb: dwc3: gadget: make to increment req->remaining in all cases
    ...

    Linus Torvalds
     
  • Pull pinctrl fixes from Linus Walleij:
    "Two smaller pin control fixes for the v4.11 series:

    - Add a get_direction() function to the qcom driver

    - Fix two pin names in the uniphier driver"

    * tag 'pinctrl-v4.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
    pinctrl: uniphier: change pin names of aio/xirq for LD11
    pinctrl: qcom: add get_direction function

    Linus Torvalds
     
  • The purgatory code defines global variables which are referenced via a
    symbol lookup in the kexec code (core and arch).

    A recent commit addressing sparse warnings made these static and thereby
    broke kexec_file.

    Why did this happen? Simply because the whole machinery is undocumented and
    lacks any form of forward declarations. The variable names are unspecific
    and lack a prefix, so adding forward declarations creates shadow variables
    in the core code. Aside of that the code relies on magic constants and
    duplicate struct definitions with no way to ensure that these things stay
    in sync. The section placement of the purgatory variables happened by
    chance and not by design.

    Unbreak kexec and cleanup the mess:

    - Add proper forward declarations and document the usage
    - Use common struct definition
    - Use the proper common defines instead of magic constants
    - Add a purgatory_ prefix to have a proper name space
    - Use ARRAY_SIZE() instead of a homebrewn reimplementation
    - Add proper sections to the purgatory variables [ From Mike ]

    Fixes: 72042a8c7b01 ("x86/purgatory: Make functions and variables static")
    Reported-by: Mike Galbraith <
    Signed-off-by: Thomas Gleixner
    Cc: Nicholas Mc Guire
    Cc: Borislav Petkov
    Cc: Vivek Goyal
    Cc: "Tobin C. Harding"
    Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1703101315140.3681@nanos
    Signed-off-by: Thomas Gleixner

    Thomas Gleixner
     
  • Pull ceph fixes from Ilya Dryomov:

    - a fix for the recently discovered misdirected requests bug present in
    jewel and later on the server side and all stable kernels

    - a fixup for -rc1 CRUSH changes

    - two usability enhancements: osd_request_timeout option and
    supported_features bus attribute.

    * tag 'ceph-for-4.11-rc2' of git://github.com/ceph/ceph-client:
    libceph: osd_request_timeout option
    rbd: supported_features bus attribute
    libceph: don't set weight to IN when OSD is destroyed
    libceph: fix crush_decode() for older maps

    Linus Torvalds
     
  • Pull i2c fixes from Wolfram Sang:
    "Here are some driver bugfixes from I2C.

    Unusual this time are the two reverts. One because I accidently picked
    a patch from the list which I should have pulled from my co-maintainer
    instead ("missing of_node_put"). And one which I wrongly assumed to be
    an easy fix but it turned out already that it needs more iterations
    ("copy device properties")"

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    Revert "i2c: copy device properties when using i2c_register_board_info()"
    Revert "i2c: add missing of_node_put in i2c_mux_del_adapters"
    i2c: exynos5: Avoid transaction timeouts due TRANSFER_DONE_AUTO not set
    i2c: designware: add reset interface
    i2c: meson: fix wrong variable usage in meson_i2c_put_data
    i2c: copy device properties when using i2c_register_board_info()
    i2c: m65xx: drop superfluous quirk structure
    i2c: brcmstb: Fix START and STOP conditions
    i2c: add missing of_node_put in i2c_mux_del_adapters
    i2c: riic: fix restart condition
    i2c: add missing of_node_put in i2c_mux_del_adapters

    Linus Torvalds
     
  • Pull drm fixes from Dave Airlie:
    "Intel, amd and mxsfb fixes.

    These are the drm fixes I've collected for rc2. Mostly i915 GVT only
    fixes, along with a single EDID fix, some mxsfb fixes and a few minor
    amd fixes"

    * tag 'drm-fixes-for-4.11-rc2' of git://people.freedesktop.org/~airlied/linux: (38 commits)
    drm: mxsfb: Implement drm_panel handling
    drm: mxsfb_crtc: Fix the framebuffer misplacement
    drm: mxsfb: Fix crash when provided invalid DT bindings
    drm: mxsfb: fix pixel clock polarity
    drm: mxsfb: use bus_format to determine LCD bus width
    drm/amdgpu: bump driver version for some new features
    drm/amdgpu: validate paramaters in the gem ioctl
    drm/amd/amdgpu: fix console deadlock if late init failed
    drm/i915/gvt: change some gvt_err to gvt_dbg_cmd
    drm/i915/gvt: protect RO and Rsvd bits of virtual vgpu configuration space
    drm/i915/gvt: handle workload lifecycle properly
    drm/edid: Add EDID_QUIRK_FORCE_8BPC quirk for Rotel RSX-1058
    drm/i915/gvt: fix an error for F_RO flag
    drm/i915/gvt: use pfn_valid for better checking
    drm/i915/gvt: set SFUSE_STRAP properly for vitual monitor detection
    drm/i915/gvt: fix an error for one register
    drm/i915/gvt: add more registers into handlers list
    drm/i915/gvt: have more registers with F_CMD_ACCESS flags set
    drm/i915/gvt: add some new MMIOs to cmd_access white list
    drm/i915/gvt: fix pcode mailbox write emulation of BDW
    ...

    Linus Torvalds
     
  • Merge 5-level page table prep from Kirill Shutemov:
    "Here's relatively low-risk part of 5-level paging patchset. Merging it
    now will make x86 5-level paging enabling in v4.12 easier.

    The first patch is actually x86-specific: detect 5-level paging
    support. It boils down to single define.

    The rest of patchset converts Linux MMU abstraction from 4- to 5-level
    paging.

    Enabling of new abstraction in most cases requires adding single line
    of code in arch-specific code. The rest is taken care by asm-generic/.

    Changes to mm/ code are mostly mechanical: add support for new page
    table level -- p4d_t -- where we deal with pud_t now.

    v2:
    - fix build on microblaze (Michal);
    - comment for __ARCH_HAS_5LEVEL_HACK in kasan_populate_zero_shadow();
    - acks from Michal"

    * emailed patches from Kirill A Shutemov :
    mm: introduce __p4d_alloc()
    mm: convert generic code to 5-level paging
    asm-generic: introduce
    arch, mm: convert all architectures to use 5level-fixup.h
    asm-generic: introduce __ARCH_USE_5LEVEL_HACK
    asm-generic: introduce 5level-fixup.h
    x86/cpufeature: Add 5-level paging detection

    Linus Torvalds
     
  • Merge fixes from Andrew Morton:
    "26 fixes"

    * emailed patches from Andrew Morton : (26 commits)
    userfaultfd: remove wrong comment from userfaultfd_ctx_get()
    fat: fix using uninitialized fields of fat_inode/fsinfo_inode
    sh: cayman: IDE support fix
    kasan: fix races in quarantine_remove_cache()
    kasan: resched in quarantine_remove_cache()
    mm: do not call mem_cgroup_free() from within mem_cgroup_alloc()
    thp: fix another corner case of munlock() vs. THPs
    rmap: fix NULL-pointer dereference on THP munlocking
    mm/memblock.c: fix memblock_next_valid_pfn()
    userfaultfd: selftest: vm: allow to build in vm/ directory
    userfaultfd: non-cooperative: userfaultfd_remove revalidate vma in MADV_DONTNEED
    userfaultfd: non-cooperative: fix fork fctx->new memleak
    mm/cgroup: avoid panic when init with low memory
    drivers/md/bcache/util.h: remove duplicate inclusion of blkdev.h
    mm/vmstats: add thp_split_pud event for clarity
    include/linux/fs.h: fix unsigned enum warning with gcc-4.2
    userfaultfd: non-cooperative: release all ctx in dup_userfaultfd_complete
    userfaultfd: non-cooperative: robustness check
    userfaultfd: non-cooperative: rollback userfaultfd_exit
    x86, mm: unify exit paths in gup_pte_range()
    ...

    Linus Torvalds