Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 mm updates from Ingo Molnar:
 "Various x86 low level modifications:

   - preparatory work to support virtually mapped kernel stacks (Andy
     Lutomirski)

   - support for 64-bit __get_user() on 32-bit kernels (Benjamin
     LaHaise)

   - (involved) workaround for Knights Landing CPU erratum (Dave Hansen)

   - MPX enhancements (Dave Hansen)

   - mremap() extension to allow remapping of the special VDSO vma, for
     purposes of user level context save/restore (Dmitry Safonov)

   - hweight and entry code cleanups (Borislav Petkov)

   - bitops code generation optimizations and cleanups with modern GCC
     (H. Peter Anvin)

   - syscall entry code optimizations (Paolo Bonzini)"

* 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (43 commits)
  x86/mm/cpa: Add missing comment in populate_pdg()
  x86/mm/cpa: Fix populate_pgd(): Stop trying to deallocate failed PUDs
  x86/syscalls: Add compat_sys_preadv64v2/compat_sys_pwritev64v2
  x86/smp: Remove unnecessary initialization of thread_info::cpu
  x86/smp: Remove stack_smp_processor_id()
  x86/uaccess: Move thread_info::addr_limit to thread_struct
  x86/dumpstack: Rename thread_struct::sig_on_uaccess_error to sig_on_uaccess_err
  x86/uaccess: Move thread_info::uaccess_err and thread_info::sig_on_uaccess_err to thread_struct
  x86/dumpstack: When OOPSing, rewind the stack before do_exit()
  x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm
  x86/dumpstack/64: Handle faults when printing the "Stack: " part of an OOPS
  x86/dumpstack: Try harder to get a call trace on stack overflow
  x86/mm: Remove kernel_unmap_pages_in_pgd() and efi_cleanup_page_tables()
  x86/mm/cpa: In populate_pgd(), don't set the PGD entry until it's populated
  x86/mm/hotplug: Don't remove PGD entries in remove_pagetable()
  x86/mm: Use pte_none() to test for empty PTE
  x86/mm: Disallow running with 32-bit PTEs to work around erratum
  x86/mm: Ignore A/D bits in pte/pmd/pud_none()
  x86/mm: Move swap offset/type up in PTE to work around erratum
  x86/entry: Inline enter_from_user_mode()
  ...

10 files changed, 148 insertions, 13 deletions

diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
index 674134e9f5e5..2bd5c6ff7ee7 100644
--- a/arch/x86/kernel/asm-offsets.c
+++ b/arch/x86/kernel/asm-offsets.c
@@ -31,7 +31,9 @@ void common(void) {
         BLANK();
         OFFSET(TI_flags, thread_info, flags);
         OFFSET(TI_status, thread_info, status);
-        OFFSET(TI_addr_limit, thread_info, addr_limit);
+
+        BLANK();
+        OFFSET(TASK_addr_limit, task_struct, thread.addr_limit);
 
         BLANK();
         OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 0fe6953f421c..d22a7b9c4f0e 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1452,7 +1452,7 @@ void cpu_init(void)
         struct task_struct *me;
         struct tss_struct *t;
         unsigned long v;
-        int cpu = stack_smp_processor_id();
+        int cpu = raw_smp_processor_id();
         int i;
 
         wait_for_master_cpu(cpu);
diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
index f6f50c4ceaec..cfa97ff67bda 100644
--- a/arch/x86/kernel/cpu/rdrand.c
+++ b/arch/x86/kernel/cpu/rdrand.c
@@ -39,9 +39,9 @@ __setup("nordrand", x86_rdrand_setup);
  */
 #define SANITY_CHECK_LOOPS 8
 
+#ifdef CONFIG_ARCH_RANDOM
 void x86_init_rdrand(struct cpuinfo_x86 *c)
 {
-#ifdef CONFIG_ARCH_RANDOM
         unsigned long tmp;
         int i;
 
@@ -55,5 +55,5 @@ void x86_init_rdrand(struct cpuinfo_x86 *c)
                         return;
                 }
         }
-#endif
 }
+#endif
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index ef8017ca5ba9..de8242d8bb61 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -87,7 +87,7 @@ static inline int valid_stack_ptr(struct task_struct *task,
                 else
                         return 0;
         }
-        return p > t && p < t + THREAD_SIZE - size;
+        return p >= t && p < t + THREAD_SIZE - size;
 }
 
 unsigned long
@@ -98,6 +98,14 @@ print_context_stack(struct task_struct *task,
 {
         struct stack_frame *frame = (struct stack_frame *)bp;
 
+        /*
+         * If we overflowed the stack into a guard page, jump back to the
+         * bottom of the usable stack.
+         */
+        if ((unsigned long)task_stack_page(task) - (unsigned long)stack <
+            PAGE_SIZE)
+                stack = (unsigned long *)task_stack_page(task);
+
         while (valid_stack_ptr(task, stack, sizeof(*stack), end)) {
                 unsigned long addr;
 
@@ -226,6 +234,8 @@ unsigned long oops_begin(void)
 EXPORT_SYMBOL_GPL(oops_begin);
 NOKPROBE_SYMBOL(oops_begin);
 
+void __noreturn rewind_stack_do_exit(int signr);
+
 void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
 {
         if (regs && kexec_should_crash(current))
@@ -247,7 +257,13 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
                 panic("Fatal exception in interrupt");
         if (panic_on_oops)
                 panic("Fatal exception");
-        do_exit(signr);
+
+        /*
+         * We're not going to return, but we might be on an IST stack or
+         * have very little stack space left.  Rewind the stack and kill
+         * the task.
+         */
+        rewind_stack_do_exit(signr);
 }
 NOKPROBE_SYMBOL(oops_end);
 
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index d558a8a49016..2552a1eadfed 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -272,6 +272,8 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
 
         stack = sp;
         for (i = 0; i < kstack_depth_to_print; i++) {
+                unsigned long word;
+
                 if (stack >= irq_stack && stack <= irq_stack_end) {
                         if (stack == irq_stack_end) {
                                 stack = (unsigned long *) (irq_stack_end[-1]);
@@ -281,12 +283,18 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
                 if (kstack_end(stack))
                         break;
                 }
+
+                if (probe_kernel_address(stack, word))
+                        break;
+
                 if ((i % STACKSLOTS_PER_LINE) == 0) {
                         if (i != 0)
                                 pr_cont("\n");
-                        printk("%s %016lx", log_lvl, *stack++);
+                        printk("%s %016lx", log_lvl, word);
                 } else
-                        pr_cont(" %016lx", *stack++);
+                        pr_cont(" %016lx", word);
+
+                stack++;
                 touch_nmi_watchdog();
         }
         preempt_enable();
diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
index 64341aa485ae..d40ee8a38fed 100644
--- a/arch/x86/kernel/i386_ksyms_32.c
+++ b/arch/x86/kernel/i386_ksyms_32.c
@@ -42,3 +42,5 @@ EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(___preempt_schedule);
 EXPORT_SYMBOL(___preempt_schedule_notrace);
 #endif
+
+EXPORT_SYMBOL(__sw_hweight32);
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index dc3c0b1c816f..b44564bf86a8 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -1,11 +1,104 @@
 #include <linux/compat.h>
 #include <linux/uaccess.h>
 
+/*
+ * The compat_siginfo_t structure and handing code is very easy
+ * to break in several ways.  It must always be updated when new
+ * updates are made to the main siginfo_t, and
+ * copy_siginfo_to_user32() must be updated when the
+ * (arch-independent) copy_siginfo_to_user() is updated.
+ *
+ * It is also easy to put a new member in the compat_siginfo_t
+ * which has implicit alignment which can move internal structure
+ * alignment around breaking the ABI.  This can happen if you,
+ * for instance, put a plain 64-bit value in there.
+ */
+static inline void signal_compat_build_tests(void)
+{
+        int _sifields_offset = offsetof(compat_siginfo_t, _sifields);
+
+        /*
+         * If adding a new si_code, there is probably new data in
+         * the siginfo.  Make sure folks bumping the si_code
+         * limits also have to look at this code.  Make sure any
+         * new fields are handled in copy_siginfo_to_user32()!
+         */
+        BUILD_BUG_ON(NSIGILL  != 8);
+        BUILD_BUG_ON(NSIGFPE  != 8);
+        BUILD_BUG_ON(NSIGSEGV != 4);
+        BUILD_BUG_ON(NSIGBUS  != 5);
+        BUILD_BUG_ON(NSIGTRAP != 4);
+        BUILD_BUG_ON(NSIGCHLD != 6);
+        BUILD_BUG_ON(NSIGSYS  != 1);
+
+        /* This is part of the ABI and can never change in size: */
+        BUILD_BUG_ON(sizeof(compat_siginfo_t) != 128);
+        /*
+         * The offsets of all the (unioned) si_fields are fixed
+         * in the ABI, of course.  Make sure none of them ever
+         * move and are always at the beginning:
+         */
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields) != 3 * sizeof(int));
+#define CHECK_CSI_OFFSET(name)    BUILD_BUG_ON(_sifields_offset != offsetof(compat_siginfo_t, _sifields.name))
+
+         /*
+         * Ensure that the size of each si_field never changes.
+         * If it does, it is a sign that the
+         * copy_siginfo_to_user32() code below needs to updated
+         * along with the size in the CHECK_SI_SIZE().
+         *
+         * We repeat this check for both the generic and compat
+         * siginfos.
+         *
+         * Note: it is OK for these to grow as long as the whole
+         * structure stays within the padding size (checked
+         * above).
+         */
+#define CHECK_CSI_SIZE(name, size) BUILD_BUG_ON(size != sizeof(((compat_siginfo_t *)0)->_sifields.name))
+#define CHECK_SI_SIZE(name, size) BUILD_BUG_ON(size != sizeof(((siginfo_t *)0)->_sifields.name))
+
+        CHECK_CSI_OFFSET(_kill);
+        CHECK_CSI_SIZE  (_kill, 2*sizeof(int));
+        CHECK_SI_SIZE   (_kill, 2*sizeof(int));
+
+        CHECK_CSI_OFFSET(_timer);
+        CHECK_CSI_SIZE  (_timer, 5*sizeof(int));
+        CHECK_SI_SIZE   (_timer, 6*sizeof(int));
+
+        CHECK_CSI_OFFSET(_rt);
+        CHECK_CSI_SIZE  (_rt, 3*sizeof(int));
+        CHECK_SI_SIZE   (_rt, 4*sizeof(int));
+
+        CHECK_CSI_OFFSET(_sigchld);
+        CHECK_CSI_SIZE  (_sigchld, 5*sizeof(int));
+        CHECK_SI_SIZE   (_sigchld, 8*sizeof(int));
+
+        CHECK_CSI_OFFSET(_sigchld_x32);
+        CHECK_CSI_SIZE  (_sigchld_x32, 7*sizeof(int));
+        /* no _sigchld_x32 in the generic siginfo_t */
+
+        CHECK_CSI_OFFSET(_sigfault);
+        CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
+        CHECK_SI_SIZE   (_sigfault, 8*sizeof(int));
+
+        CHECK_CSI_OFFSET(_sigpoll);
+        CHECK_CSI_SIZE  (_sigpoll, 2*sizeof(int));
+        CHECK_SI_SIZE   (_sigpoll, 4*sizeof(int));
+
+        CHECK_CSI_OFFSET(_sigsys);
+        CHECK_CSI_SIZE  (_sigsys, 3*sizeof(int));
+        CHECK_SI_SIZE   (_sigsys, 4*sizeof(int));
+
+        /* any new si_fields should be added here */
+}
+
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
 {
         int err = 0;
         bool ia32 = test_thread_flag(TIF_IA32);
 
+        signal_compat_build_tests();
+
         if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
                 return -EFAULT;
 
@@ -32,6 +125,21 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
                                           &to->_sifields._pad[0]);
                         switch (from->si_code >> 16) {
                         case __SI_FAULT >> 16:
+                                if (from->si_signo == SIGBUS &&
+                                    (from->si_code == BUS_MCEERR_AR ||
+                                     from->si_code == BUS_MCEERR_AO))
+                                        put_user_ex(from->si_addr_lsb, &to->si_addr_lsb);
+
+                                if (from->si_signo == SIGSEGV) {
+                                        if (from->si_code == SEGV_BNDERR) {
+                                                compat_uptr_t lower = (unsigned long)&to->si_lower;
+                                                compat_uptr_t upper = (unsigned long)&to->si_upper;
+                                                put_user_ex(lower, &to->si_lower);
+                                                put_user_ex(upper, &to->si_upper);
+                                        }
+                                        if (from->si_code == SEGV_PKUERR)
+                                                put_user_ex(from->si_pkey, &to->si_pkey);
+                                }
                                 break;
                         case __SI_SYS >> 16:
                                 put_user_ex(from->si_syscall, &to->si_syscall);
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 2ed0ec1353f8..d0a51939c150 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1292,7 +1292,6 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
         cpumask_copy(cpu_callin_mask, cpumask_of(0));
         mb();
 
-        current_thread_info()->cpu = 0;  /* needed? */
         for_each_possible_cpu(i) {
                 zalloc_cpumask_var(&per_cpu(cpu_sibling_map, i), GFP_KERNEL);
                 zalloc_cpumask_var(&per_cpu(cpu_core_map, i), GFP_KERNEL);
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 3dce1ca0a653..01f30e56f99e 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -440,10 +440,7 @@ static inline unsigned long get_vflags(struct kernel_vm86_regs *regs)
 
 static inline int is_revectored(int nr, struct revectored_struct *bitmap)
 {
-        __asm__ __volatile__("btl %2,%1\n\tsbbl %0,%0"
-                :"=r" (nr)
-                :"m" (*bitmap), "r" (nr));
-        return nr;
+        return test_bit(nr, bitmap->__map);
 }
 
 #define val_byte(val, n) (((__u8 *)&val)[n])
diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
index cd05942bc918..f1aebfb49c36 100644
--- a/arch/x86/kernel/x8664_ksyms_64.c
+++ b/arch/x86/kernel/x8664_ksyms_64.c
@@ -44,6 +44,9 @@ EXPORT_SYMBOL(clear_page);
 
 EXPORT_SYMBOL(csum_partial);
 
+EXPORT_SYMBOL(__sw_hweight32);
+EXPORT_SYMBOL(__sw_hweight64);
+
 /*
  * Export string functions. We normally rely on gcc builtin for most of these,
  * but gcc sometimes decides not to inline them.