Skip to content
  1. Oct 25, 2014
  2. Oct 24, 2014
    • Catalin Marinas's avatar
      arm64: Fix memblock current_limit with 64K pages and 48-bit VA · 3dec0fe4
      Catalin Marinas authored
      
      
      With 48-bit VA space, the 64K page configuration uses 3 levels instead
      of 2 and PUD_SIZE != PMD_SIZE. Since with 64K pages we only cover
      PMD_SIZE with the initial swapper_pg_dir populated in head.S, the
      memblock current_limit needs to be set accordingly in map_mem() to avoid
      allocating unmapped memory. The memblock current_limit is progressively
      increased as more blocks are mapped.
      
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      3dec0fe4
    • David S. Miller's avatar
      sparc64: Implement __get_user_pages_fast(). · 06090e8e
      David S. Miller authored
      
      
      It is not sufficient to only implement get_user_pages_fast(), you
      must also implement the atomic version __get_user_pages_fast()
      otherwise you end up using the weak symbol fallback implementation
      which simply returns zero.
      
      This is dangerous, because it causes the futex code to loop forever
      if transparent hugepages are supported (see get_futex_key()).
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      06090e8e
    • David S. Miller's avatar
      sparc64: Fix register corruption in top-most kernel stack frame during boot. · ef3e035c
      David S. Miller authored
      
      
      Meelis Roos reported that kernels built with gcc-4.9 do not boot, we
      eventually narrowed this down to only impacting machines using
      UltraSPARC-III and derivitive cpus.
      
      The crash happens right when the first user process is spawned:
      
      [   54.451346] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004
      [   54.451346]
      [   54.571516] CPU: 1 PID: 1 Comm: init Not tainted 3.16.0-rc2-00211-gd7933ab #96
      [   54.666431] Call Trace:
      [   54.698453]  [0000000000762f8c] panic+0xb0/0x224
      [   54.759071]  [000000000045cf68] do_exit+0x948/0x960
      [   54.823123]  [000000000042cbc0] fault_in_user_windows+0xe0/0x100
      [   54.902036]  [0000000000404ad0] __handle_user_windows+0x0/0x10
      [   54.978662] Press Stop-A (L1-A) to return to the boot prom
      [   55.050713] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004
      
      Further investigation showed that compiling only per_cpu_patch() with
      an older compiler fixes the boot.
      
      Detailed analysis showed that the function is not being miscompiled by
      gcc-4.9, but it is using a different register allocation ordering.
      
      With the gcc-4.9 compiled function, something during the code patching
      causes some of the %i* input registers to get corrupted.  Perhaps
      we have a TLB miss path into the firmware that is deep enough to
      cause a register window spill and subsequent restore when we get
      back from the TLB miss trap.
      
      Let's plug this up by doing two things:
      
      1) Stop using the firmware stack for client interface calls into
         the firmware.  Just use the kernel's stack.
      
      2) As soon as we can, call into a new function "start_early_boot()"
         to put a one-register-window buffer between the firmware's
         deepest stack frame and the top-most initial kernel one.
      
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Tested-by: default avatarMeelis Roos <mroos@linux.ee>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef3e035c
    • Arun Chandran's avatar
      arm64: ASLR: Don't randomise text when randomise_va_space == 0 · 92980405
      Arun Chandran authored
      
      
      When user asks to turn off ASLR by writing "0" to
      /proc/sys/kernel/randomize_va_space there should not be
      any randomization to mmap base, stack, VDSO, libs, text and heap
      
      Currently arm64 violates this behavior by randomising text.
      Fix this by defining a constant ELF_ET_DYN_BASE. The randomisation of
      mm->mmap_base is done by setup_new_exec -> arch_pick_mmap_layout ->
      mmap_base -> mmap_rnd.
      
      Signed-off-by: default avatarArun Chandran <achandran@mvista.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      92980405
    • Ralf Baechle's avatar
      MIPS: SEAD3: Fix I2C device registration. · 4846f118
      Ralf Baechle authored
      
      
      This isn't a module and shouldn't be one.
      
      Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      4846f118
    • Nadav Amit's avatar
      KVM: x86: Wrong assertion on paging_tmpl.h · 1715d0dc
      Nadav Amit authored
      
      
      Even after the recent fix, the assertion on paging_tmpl.h is triggered.
      Apparently, the assertion wants to check that the PAE is always set on
      long-mode, but does it in incorrect way.  Note that the assertion is not
      enabled unless the code is debugged by defining MMU_DEBUG.
      
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      1715d0dc
    • Nadav Amit's avatar
      KVM: x86: PREFETCH and HINT_NOP should have SrcMem flag · 3f6f1480
      Nadav Amit authored
      
      
      The decode phase of the x86 emulator assumes that every instruction with the
      ModRM flag, and which can be used with RIP-relative addressing, has either
      SrcMem or DstMem.  This is not the case for several instructions - prefetch,
      hint-nop and clflush.
      
      Adding SrcMem|NoAccess for prefetch and hint-nop and SrcMem for clflush.
      
      This fixes CVE-2014-8480.
      
      Fixes: 41061cdb
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      3f6f1480
    • Nadav Amit's avatar
      KVM: x86: Emulator does not decode clflush well · 13e457e0
      Nadav Amit authored
      
      
      Currently, all group15 instructions are decoded as clflush (e.g., mfence,
      xsave).  In addition, the clflush instruction requires no prefix (66/f2/f3)
      would exist. If prefix exists it may encode a different instruction (e.g.,
      clflushopt).
      
      Creating a group for clflush, and different group for each prefix.
      
      This has been the case forever, but the next patch needs the cflush group
      in order to fix a bug introduced in 3.17.
      
      Fixes: 41061cdb
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      13e457e0
    • Paolo Bonzini's avatar
      KVM: emulate: avoid accessing NULL ctxt->memopp · a430c916
      Paolo Bonzini authored
      
      
      A failure to decode the instruction can cause a NULL pointer access.
      This is fixed simply by moving the "done" label as close as possible
      to the return.
      
      This fixes CVE-2014-8481.
      
      Reported-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Cc: stable@vger.kernel.org
      Fixes: 41061cdb
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      a430c916
    • Ralf Baechle's avatar
      MIPS: SEAD3: Nuke PIC32 I2C driver. · cc08d25a
      Ralf Baechle authored
      
      
      A platform driver for which nothing ever registers the corresponding
      platform device.
      
      Also it was driving the same hardware as sead3-i2c-drv.c so redundant
      anyway and couldn't co-exist with that driver because each of them was
      using a private spinlock to protect access to the same hardware
      resources.
      
      This also fixes a randconfig problem:
      
      arch/mips/mti-sead3/sead3-pic32-i2c-drv.c: In function 'i2c_platform_probe':
      arch/mips/mti-sead3/sead3-pic32-i2c-drv.c:345:2: error: implicit declaration of
      function 'i2c_add_numbered_adapter' [-Werror=implicit-function-declaration]
        ret = i2c_add_numbered_adapter(&priv->adap);
          ^
      arch/mips/mti-sead3/sead3-pic32-i2c-drv.c: In function
      'i2c_platform_remove':
      arch/mips/mti-sead3/sead3-pic32-i2c-drv.c:361:2: error: implicit declaration
      of function 'i2c_del_adapter' [-Werror=implicit-function-declaration]
      i2c_del_adapter(&priv->adap);
      
      Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      cc08d25a
    • Nadav Amit's avatar
      KVM: x86: Decoding guest instructions which cross page boundary may fail · 08da44ae
      Nadav Amit authored
      
      
      Once an instruction crosses a page boundary, the size read from the second page
      disregards the common case that part of the operand resides on the first page.
      As a result, fetch of long insturctions may fail, and thereby cause the
      decoding to fail as well.
      
      Cc: stable@vger.kernel.org
      Fixes: 5cfc7e0f
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      08da44ae
    • Michael S. Tsirkin's avatar
      kvm: x86: don't kill guest on unknown exit reason · 2bc19dc3
      Michael S. Tsirkin authored
      
      
      KVM_EXIT_UNKNOWN is a kvm bug, we don't really know whether it was
      triggered by a priveledged application.  Let's not kill the guest: WARN
      and inject #UD instead.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      2bc19dc3
    • Petr Matousek's avatar
      kvm: vmx: handle invvpid vm exit gracefully · a642fc30
      Petr Matousek authored
      
      
      On systems with invvpid instruction support (corresponding bit in
      IA32_VMX_EPT_VPID_CAP MSR is set) guest invocation of invvpid
      causes vm exit, which is currently not handled and results in
      propagation of unknown exit to userspace.
      
      Fix this by installing an invvpid vm exit handler.
      
      This is CVE-2014-3646.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarPetr Matousek <pmatouse@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      a642fc30
    • Nadav Amit's avatar
      KVM: x86: Handle errors when RIP is set during far jumps · d1442d85
      Nadav Amit authored
      
      
      Far jmp/call/ret may fault while loading a new RIP.  Currently KVM does not
      handle this case, and may result in failed vm-entry once the assignment is
      done.  The tricky part of doing so is that loading the new CS affects the
      VMCS/VMCB state, so if we fail during loading the new RIP, we are left in
      unconsistent state.  Therefore, this patch saves on 64-bit the old CS
      descriptor and restores it if loading RIP failed.
      
      This fixes CVE-2014-3647.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      d1442d85
    • Nadav Amit's avatar
      KVM: x86: Emulator fixes for eip canonical checks on near branches · 234f3ce4
      Nadav Amit authored
      
      
      Before changing rip (during jmp, call, ret, etc.) the target should be asserted
      to be canonical one, as real CPUs do.  During sysret, both target rsp and rip
      should be canonical. If any of these values is noncanonical, a #GP exception
      should occur.  The exception to this rule are syscall and sysenter instructions
      in which the assigned rip is checked during the assignment to the relevant
      MSRs.
      
      This patch fixes the emulator to behave as real CPUs do for near branches.
      Far branches are handled by the next patch.
      
      This fixes CVE-2014-3647.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      234f3ce4
    • Nadav Amit's avatar
      KVM: x86: Fix wrong masking on relative jump/call · 05c83ec9
      Nadav Amit authored
      
      
      Relative jumps and calls do the masking according to the operand size, and not
      according to the address size as the KVM emulator does today.
      
      This patch fixes KVM behavior.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      05c83ec9
    • Andy Honig's avatar
      KVM: x86: Improve thread safety in pit · 2febc839
      Andy Honig authored
      
      
      There's a race condition in the PIT emulation code in KVM.  In
      __kvm_migrate_pit_timer the pit_timer object is accessed without
      synchronization.  If the race condition occurs at the wrong time this
      can crash the host kernel.
      
      This fixes CVE-2014-3611.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      2febc839
    • Andy Honig's avatar
      KVM: x86: Prevent host from panicking on shared MSR writes. · 8b3c3104
      Andy Honig authored
      
      
      The previous patch blocked invalid writes directly when the MSR
      is written.  As a precaution, prevent future similar mistakes by
      gracefulling handle GPs caused by writes to shared MSRs.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
      [Remove parts obsoleted by Nadav's patch. - Paolo]
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      8b3c3104
    • Nadav Amit's avatar
      KVM: x86: Check non-canonical addresses upon WRMSR · 854e8bb1
      Nadav Amit authored
      
      
      Upon WRMSR, the CPU should inject #GP if a non-canonical value (address) is
      written to certain MSRs. The behavior is "almost" identical for AMD and Intel
      (ignoring MSRs that are not implemented in either architecture since they would
      anyhow #GP). However, IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if
      non-canonical address is written on Intel but not on AMD (which ignores the top
      32-bits).
      
      Accordingly, this patch injects a #GP on the MSRs which behave identically on
      Intel and AMD.  To eliminate the differences between the architecutres, the
      value which is written to IA32_SYSENTER_ESP and IA32_SYSENTER_EIP is turned to
      canonical value before writing instead of injecting a #GP.
      
      Some references from Intel and AMD manuals:
      
      According to Intel SDM description of WRMSR instruction #GP is expected on
      WRMSR "If the source register contains a non-canonical address and ECX
      specifies one of the following MSRs: IA32_DS_AREA, IA32_FS_BASE, IA32_GS_BASE,
      IA32_KERNEL_GS_BASE, IA32_LSTAR, IA32_SYSENTER_EIP, IA32_SYSENTER_ESP."
      
      According to AMD manual instruction manual:
      LSTAR/CSTAR (SYSCALL): "The WRMSR instruction loads the target RIP into the
      LSTAR and CSTAR registers.  If an RIP written by WRMSR is not in canonical
      form, a general-protection exception (#GP) occurs."
      IA32_GS_BASE and IA32_FS_BASE (WRFSBASE/WRGSBASE): "The address written to the
      base field must be in canonical form or a #GP fault will occur."
      IA32_KERNEL_GS_BASE (SWAPGS): "The address stored in the KernelGSbase MSR must
      be in canonical form."
      
      This patch fixes CVE-2014-3610.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      854e8bb1
    • Olof Johansson's avatar
      ARM: multi_v7_defconfig: enable CONFIG_MMC_DW_ROCKCHIP · 90f0845c
      Olof Johansson authored
      
      
      Allows booting from SD/MMC on RK3288 and other platforms. Added here so I
      can enable the board in the boot farm.
      
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      90f0845c
    • Olof Johansson's avatar
      ARM: sunxi_defconfig: enable CONFIG_REGULATOR_FIXED_VOLTAGE · 3e10dccc
      Olof Johansson authored
      
      
      I missed in 9a2ad529 that REGULATOR_FIXED_VOLTAGE had also gotten
      deselected, so it needs to be added back as an explicit option.
      
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      3e10dccc
    • Markos Chandras's avatar
      MIPS: ftrace: Fix a microMIPS build problem · aedd153f
      Markos Chandras authored
      
      
      Code before the .fixup section needs to have the .insn directive.
      This has no side effects on MIPS32/64 but it affects the way microMIPS
      loads the address for the return label.
      
      Fixes the following build problem:
      mips-linux-gnu-ld: arch/mips/built-in.o: .fixup+0x4a0: Unsupported jump between
      ISA modes; consider recompiling with interlinking enabled.
      mips-linux-gnu-ld: final link failed: Bad value
      Makefile:819: recipe for target 'vmlinux' failed
      
      The fix is similar to 1658f914 ("MIPS: microMIPS:
      Disable LL/SC and fix linker bug.")
      
      Signed-off-by: default avatarMarkos Chandras <markos.chandras@imgtec.com>
      Cc: stable@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/8117/
      
      
      Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      aedd153f
    • Stefan Hengelein's avatar
      MIPS: MSP71xx: Fix build error · 6fa88d9e
      Stefan Hengelein authored
      
      
      When CONFIG_MIPS_MT_SMP is enabled, the following compilation error
      occurs:
      
      arch/mips/pmcs-msp71xx/msp_irq_cic.c:134: error: ‘irq’ undeclared
      
      This code clearly never saw a compiler.
      The surrounding code suggests, that 'd->irq' was intended, not
      'irq'.
      
      This error was found with vampyr.
      
      Signed-off-by: default avatarStefan Hengelein <stefan.hengelein@fau.de>
      Fixes: d7881fbd ("MIPS: msp71xx: Convert to new irq_chip functions")
      Acked-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Cc: linux-mips@linux-mips.org
      Cc: linux-kernel@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/8116/
      
      
      Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      6fa88d9e
  3. Oct 23, 2014
  4. Oct 22, 2014
Loading