1. 05 1月, 2016 2 次提交
    • T
      x86/mm/pat: Change free_memtype() to support shrinking case · 2039e6ac
      Toshi Kani 提交于
      Using mremap() to shrink the map size of a VM_PFNMAP range causes
      the following error message, and leaves the pfn range allocated.
      
       x86/PAT: test:3493 freeing invalid memtype [mem 0x483200000-0x4863fffff]
      
      This is because rbt_memtype_erase(), called from free_memtype()
      with spin_lock held, only supports to free a whole memtype node in
      memtype_rbroot.  Therefore, this patch changes rbt_memtype_erase()
      to support a request that shrinks the size of a memtype node for
      mremap().
      
      memtype_rb_exact_match() is renamed to memtype_rb_match(), and
      is enhanced to support EXACT_MATCH and END_MATCH in @match_type.
      Since the memtype_rbroot tree allows overlapping ranges,
      rbt_memtype_erase() checks with EXACT_MATCH first, i.e. free
      a whole node for the munmap case.  If no such entry is found,
      it then checks with END_MATCH, i.e. shrink the size of a node
      from the end for the mremap case.
      
      On the mremap case, rbt_memtype_erase() proceeds in two steps,
      1) remove the node, and then 2) insert the updated node.  This
      allows proper update of augmented values, subtree_max_end, in
      the tree.
      Signed-off-by: NToshi Kani <toshi.kani@hpe.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: stsp@list.ru
      Cc: linux-mm@kvack.org
      Link: http://lkml.kernel.org/r/1450832064-10093-3-git-send-email-toshi.kani@hpe.comSigned-off-by: NThomas Gleixner <tglx@linutronix.de>
      2039e6ac
    • T
      x86/mm/pat: Add untrack_pfn_moved for mremap · d9fe4fab
      Toshi Kani 提交于
      mremap() with MREMAP_FIXED on a VM_PFNMAP range causes the following
      WARN_ON_ONCE() message in untrack_pfn().
      
        WARNING: CPU: 1 PID: 3493 at arch/x86/mm/pat.c:985 untrack_pfn+0xbd/0xd0()
        Call Trace:
        [<ffffffff817729ea>] dump_stack+0x45/0x57
        [<ffffffff8109e4b6>] warn_slowpath_common+0x86/0xc0
        [<ffffffff8109e5ea>] warn_slowpath_null+0x1a/0x20
        [<ffffffff8106a88d>] untrack_pfn+0xbd/0xd0
        [<ffffffff811d2d5e>] unmap_single_vma+0x80e/0x860
        [<ffffffff811d3725>] unmap_vmas+0x55/0xb0
        [<ffffffff811d916c>] unmap_region+0xac/0x120
        [<ffffffff811db86a>] do_munmap+0x28a/0x460
        [<ffffffff811dec33>] move_vma+0x1b3/0x2e0
        [<ffffffff811df113>] SyS_mremap+0x3b3/0x510
        [<ffffffff817793ee>] entry_SYSCALL_64_fastpath+0x12/0x71
      
      MREMAP_FIXED moves a pfnmap from old vma to new vma.  untrack_pfn() is
      called with the old vma after its pfnmap page table has been removed,
      which causes follow_phys() to fail.  The new vma has a new pfnmap to
      the same pfn & cache type with VM_PAT set.  Therefore, we only need to
      clear VM_PAT from the old vma in this case.
      
      Add untrack_pfn_moved(), which clears VM_PAT from a given old vma.
      move_vma() is changed to call this function with the old vma when
      VM_PFNMAP is set.  move_vma() then calls do_munmap(), and untrack_pfn()
      is a no-op since VM_PAT is cleared.
      Reported-by: NStas Sergeev <stsp@list.ru>
      Signed-off-by: NToshi Kani <toshi.kani@hpe.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: linux-mm@kvack.org
      Link: http://lkml.kernel.org/r/1450832064-10093-2-git-send-email-toshi.kani@hpe.comSigned-off-by: NThomas Gleixner <tglx@linutronix.de>
      d9fe4fab
  2. 29 12月, 2015 2 次提交
  3. 06 12月, 2015 2 次提交
    • I
      x86/mm/64: Enable SWIOTLB if system has SRAT memory regions above MAX_DMA32_PFN · ec941c5f
      Igor Mammedov 提交于
      when memory hotplug enabled system is booted with less
      than 4GB of RAM and then later more RAM is hotplugged
      32-bit devices stop functioning with following error:
      
       nommu_map_single: overflow 327b4f8c0+1522 of device mask ffffffff
      
      the reason for this is that if x86_64 system were booted
      with RAM less than 4GB, it doesn't enable SWIOTLB and
      when memory is hotplugged beyond MAX_DMA32_PFN, devices
      that expect 32-bit addresses can't handle 64-bit addresses.
      
      Fix it by tracking max possible PFN when parsing
      memory affinity structures from SRAT ACPI table and
      enable SWIOTLB if there is hotpluggable memory
      regions beyond MAX_DMA32_PFN.
      
      It fixes KVM guests when they use emulated devices
      (reproduces with ata_piix, e1000 and usb devices,
       RHBZ: 1275941, 1275977, 1271527)
      
      It also fixes the HyperV, VMWare with emulated devices
      which are affected by this issue as well.
      Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: akataria@vmware.com
      Cc: fujita.tomonori@lab.ntt.co.jp
      Cc: konrad.wilk@oracle.com
      Cc: pbonzini@redhat.com
      Cc: revers@redhat.com
      Cc: riel@redhat.com
      Link: http://lkml.kernel.org/r/1449234426-273049-3-git-send-email-imammedo@redhat.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      ec941c5f
    • I
      x86/mm: Introduce max_possible_pfn · 8dd33030
      Igor Mammedov 提交于
      max_possible_pfn will be used for tracking max possible
      PFN for memory that isn't present in E820 table and
      could be hotplugged later.
      
      By default max_possible_pfn is initialized with max_pfn,
      but later it could be updated with highest PFN of
      hotpluggable memory ranges declared in ACPI SRAT table
      if any present.
      Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: akataria@vmware.com
      Cc: fujita.tomonori@lab.ntt.co.jp
      Cc: konrad.wilk@oracle.com
      Cc: pbonzini@redhat.com
      Cc: revers@redhat.com
      Cc: riel@redhat.com
      Link: http://lkml.kernel.org/r/1449234426-273049-2-git-send-email-imammedo@redhat.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      8dd33030
  4. 04 12月, 2015 2 次提交
    • B
      x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only · 071ac0c4
      Borislav Petkov 提交于
      File should be created with S_IRUSR and not with S_IWUSR too
      because writing to it doesn't make any sense. I mean, we don't
      have a ->write method anyway but let's have the permissions
      correct too.
      Signed-off-by: NBorislav Petkov <bp@suse.de>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Arjan van de Ven <arjan@linux.intel.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/1448885579-32506-1-git-send-email-bp@alien8.deSigned-off-by: NIngo Molnar <mingo@kernel.org>
      071ac0c4
    • R
      x86/mm/mtrr: Mark the 'range_new' static variable in mtrr_calc_range_state() as __initdata · c332813b
      Rasmus Villemoes 提交于
      'range_new' doesn't seem to be used after init. It is only passed
      to memset(), sum_ranges(), memcmp() and x86_get_mtrr_mem_range(), the
      latter of which also only passes it on to various *range*
      library functions.
      
      So mark it __initdata to free up an extra page after init.
      
      Its contents are wiped at every call to mtrr_calc_range_state(),
      so it being static is not about preserving state between calls,
      but simply to avoid a 4k+ stack frame. While there, add a
      comment explaining this and why it's safe.
      
      We could also mark nr_range_new as __initdata, but since it's
      just a single int and also doesn't carry state between calls (it
      is unconditionally assigned to before it is read), we might as
      well make it an ordinary automatic variable.
      Signed-off-by: NRasmus Villemoes <linux@rasmusvillemoes.dk>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Toshi Kani <toshi.kani@hp.com>
      Link: http://lkml.kernel.org/r/1449002691-20783-1-git-send-email-linux@rasmusvillemoes.dkSigned-off-by: NIngo Molnar <mingo@kernel.org>
      c332813b
  5. 23 11月, 2015 1 次提交
    • K
      x86/mm: Turn CONFIG_X86_PTDUMP into a module · 8609d1b5
      Kees Cook 提交于
      Being able to examine page tables is handy, so make this a
      module that can be loaded as needed.
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephen Smalley <sds@tycho.nsa.gov>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Toshi Kani <toshi.kani@hpe.com>
      Cc: Vladimir Murzin <vladimir.murzin@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Link: http://lkml.kernel.org/r/20151120010755.GA9060@www.outflux.netSigned-off-by: NIngo Molnar <mingo@kernel.org>
      8609d1b5
  6. 19 11月, 2015 2 次提交
  7. 14 11月, 2015 1 次提交
  8. 12 11月, 2015 5 次提交
    • H
      perf/x86/intel/rapl: Remove the unused RAPL_EVENT_DESC() macro · 41ac18eb
      Huang Rui 提交于
      Signed-off-by: NHuang Rui <ray.huang@amd.com>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Dasaratharaman Chandramouli <dasaratharaman.chandramouli@intel.com>
      Cc: Fengguang Wu <fengguang.wu@intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Tony Li <tony.li@amd.com>
      Link: http://lkml.kernel.org/r/1446630233-3166-1-git-send-email-ray.huang@amd.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      41ac18eb
    • H
      x86/fpu: Fix get_xsave_addr() behavior under virtualization · a05917b6
      Huaitong Han 提交于
      KVM uses the get_xsave_addr() function in a different fashion from
      the native kernel, in that the 'xsave' parameter belongs to guest vcpu,
      not the currently running task.
      
      But 'xsave' is replaced with current task's (host) xsave structure, so
      get_xsave_addr() will incorrectly return the bad xsave address to KVM.
      
      Fix it so that the passed in 'xsave' address is used - as intended
      originally.
      Signed-off-by: NHuaitong Han <huaitong.han@intel.com>
      Reviewed-by: NDave Hansen <dave.hansen@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: dave.hansen@intel.com
      Link: http://lkml.kernel.org/r/1446800423-21622-1-git-send-email-huaitong.han@intel.com
      [ Tidied up the changelog. ]
      Signed-off-by: NIngo Molnar <mingo@kernel.org>
      a05917b6
    • D
      x86/fpu: Fix 32-bit signal frame handling · ab6b5294
      Dave Hansen 提交于
      (This should have gone to LKML originally. Sorry for the extra
       noise, folks on the cc.)
      
      Background:
      
      Signal frames on x86 have two formats:
      
        1. For 32-bit executables (whether on a real 32-bit kernel or
           under 32-bit emulation on a 64-bit kernel) we have a
          'fpregset_t' that includes the "FSAVE" registers.
      
        2. For 64-bit executables (on 64-bit kernels obviously), the
           'fpregset_t' is smaller and does not contain the "FSAVE"
           state.
      
      When creating the signal frame, we have to be aware of whether
      we are running a 32 or 64-bit executable so we create the
      correct format signal frame.
      
      Problem:
      
      save_xstate_epilog() uses 'fx_sw_reserved_ia32' whenever it is
      called for a 32-bit executable.  This is for real 32-bit and
      ia32 emulation.
      
      But, fpu__init_prepare_fx_sw_frame() only initializes
      'fx_sw_reserved_ia32' when emulation is enabled, *NOT* for real
      32-bit kernels.
      
      This leads to really wierd situations where 32-bit programs
      lose their extended state when returning from a signal handler.
      The kernel copies the uninitialized (zero) 'fx_sw_reserved_ia32'
      out to userspace in save_xstate_epilog().  But when returning
      from the signal, the kernel errors out in check_for_xstate()
      when it does not see FP_XSTATE_MAGIC1 present (because it was
      zeroed).  This leads to the FPU/XSAVE state being initialized.
      
      For MPX, this leads to the most permissive state and means we
      silently lose bounds violations.  I think this would also mean
      that we could lose *ANY* FPU/SSE/AVX state.  I'm not sure why
      no one has spotted this bug.
      
      I believe this was broken by:
      
      	72a671ce ("x86, fpu: Unify signal handling code paths for x86 and x86_64 kernels")
      
      way back in 2012.
      Signed-off-by: NDave Hansen <dave.hansen@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: dave@sr71.net
      Cc: fenghua.yu@intel.com
      Cc: yu-cheng.yu@intel.com
      Link: http://lkml.kernel.org/r/20151111002354.A0799571@viggo.jf.intel.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      ab6b5294
    • D
      x86/mpx: Fix 32-bit address space calculation · f3119b83
      Dave Hansen 提交于
      I received a bug report that running 32-bit MPX binaries on
      64-bit kernels was broken.  I traced it down to this little code
      snippet.  We were switching our "number of bounds directory
      entries" calculation correctly.  But, we didn't switch the other
      side of the calculation: the virtual space size.
      
      This meant that we were calculating an absurd size for
      bd_entry_virt_space() on 32-bit because we used the 64-bit
      virt_space.
      
      This was _also_ broken for 32-bit kernels running on 64-bit
      hardware since boot_cpu_data.x86_virt_bits=48 even when running
      in 32-bit mode.
      
      Correct that and properly handle all 3 possible cases:
      
       1. 32-bit binary on 64-bit kernel
       2. 64-bit binary on 64-bit kernel
       3. 32-bit binary on 32-bit kernel
      
      This manifested in having bounds tables not properly unmapped.
      It "leaked" memory but had no functional impact otherwise.
      Signed-off-by: NDave Hansen <dave.hansen@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave@sr71.net>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/20151111181934.FA7FAC34@viggo.jf.intel.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      f3119b83
    • D
      x86/mpx: Do proper get_user() when running 32-bit binaries on 64-bit kernels · 46561c39
      Dave Hansen 提交于
      When you call get_user(foo, bar), you effectively do a
      
      	copy_from_user(&foo, bar, sizeof(*bar));
      
      Note that the sizeof() is implicit.
      
      When we reach out to userspace to try to zap an entire "bounds
      table" we need to go read a "bounds directory entry" in order to
      locate the table's address.  The size of a "directory entry"
      depends on the binary being run and is always the size of a
      pointer.
      
      But, when we have a 64-bit kernel and a 32-bit application, the
      directory entry is still only 32-bits long, but we fetch it with
      a 64-bit pointer which makes get_user() does a 64-bit fetch.
      Reading 4 extra bytes isn't harmful, unless we are at the end of
      and run off the table.  It might also cause the zero page to get
      faulted in unnecessarily even if you are not at the end.
      
      Fix it up by doing a special 32-bit get_user() via a cast when
      we have 32-bit userspace.
      Signed-off-by: NDave Hansen <dave.hansen@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Dave Hansen <dave@sr71.net>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/20151111181931.3ACF6822@viggo.jf.intel.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      46561c39
  9. 10 11月, 2015 18 次提交
  10. 07 11月, 2015 5 次提交